Host your own Nostr relay

What a relay is, and why host your own

Nostr splits identity from infrastructure. Your account is a keypair you hold; a relay is just a server that stores signed notes and streams them to clients over a WebSocket. There are no usernames or passwords on the relay — it validates the signature on each event, keeps it, and forwards matching events to whoever subscribes.

Running your own relay buys you two things. First, durability: your posts live on a machine you control instead of depending on someone else’s free relay staying online and un-blocked. Second, reach on your terms: you decide whether the relay is a public service to the network or a private, allowlisted home for you and the people you follow. Because the host is no-KYC and payable in crypto, standing up that relay does not create another identity record tied to your name.

Pick a plan

strfry is a single compiled binary with an embedded LMDB database, so it is light on CPU and mostly bound by disk and RAM for caching. A standard plan is a sensible starting point for a personal or small-community relay. If you plan to run a busy public relay ingesting a lot of the network, budget more disk and RAM and move up a tier — storage, not compute, is usually the limit.

Install strfry

The commands below build strfry on a fresh Ubuntu server. They are illustrative; follow the project’s own README for the current build steps.

# on a fresh VPS (Ubuntu 24.04)
sudo apt update
sudo apt install -y git build-essential libyaml-perl liblmdb-dev \
  libflatbuffers-dev libsecp256k1-dev libzstd-dev

git clone https://github.com/hoytech/strfry
cd strfry
git submodule update --init
make setup-golpe
make -j$(nproc)

That produces a strfry binary. Create a data directory for the database and a service user so the relay does not run as root.

sudo useradd --system --home /var/lib/strfry --shell /usr/sbin/nologin strfry
sudo mkdir -p /var/lib/strfry/db
sudo chown -R strfry:strfry /var/lib/strfry

Configure the relay

strfry reads a strfry.conf. Point it at your database directory, bind to localhost (the reverse proxy will handle TLS and the public port), and set sane limits so a single client cannot exhaust memory or disk.

db = "/var/lib/strfry/db"

relay {
    bind = "127.0.0.1"
    port = 7777
    info {
        name = "my relay"
        description = "A small self-hosted Nostr relay."
    }
    maxWebsocketPayloadSize = 131072   # cap event size
    maxSubsPerConnection = 20
}

For a restricted relay, add a write policy so only chosen pubkeys can publish. strfry supports a plugin that receives each incoming event on stdin and accepts or rejects it — use it for an allowlist, per-kind rules, or rate limits. An open public relay skips the allowlist but should keep the size and rate caps.

Run it under systemd so it restarts on reboot:

sudo -u strfry /usr/local/bin/strfry --config /etc/strfry.conf relay

Terminate TLS for wss://

Nostr clients connect over wss://, so the relay needs a valid certificate on a domain. Put a reverse proxy in front of strfry and let it terminate TLS, upgrading the WebSocket to the local port.

server {
    listen 443 ssl;
    server_name relay.example.com;

    ssl_certificate     /etc/letsencrypt/live/relay.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/relay.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:7777;
        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host       $host;
        proxy_read_timeout 3600s;
    }
}

Issue the certificate with your usual ACME client, then open 443/tcp in the firewall and confirm nothing else is exposing 7777 publicly.

sudo ufw allow 443/tcp
sudo ufw deny 7777/tcp

Test it from a client

Add wss://relay.example.com to any Nostr client (a desktop or web client, or a CLI like nak), publish a note, and check it appears when you query from a second device. A quick command-line check:

# publish a test note through your relay
nak event -c "hello from my own relay" wss://relay.example.com
# then read it back
nak req -k 1 --limit 1 wss://relay.example.com

If the note round-trips, your relay is live.

Where this fits with the rest of your stack

A relay pairs well with the rest of a privacy-first setup. Zaps ride on the Lightning Network, so a Nostr identity often sits alongside a Lightning-paid VPS and a wallet you host. You can also make the relay reachable as a Tor hidden service for readers who prefer not to resolve a clearnet domain, and pay for the box itself with Monero so the hosting leaves no identity trail.

What you are responsible for

You operate the relay, so you decide — and are accountable for — what it stores and serves. Keep event-size and rate limits on, keep a way to remove content, and keep a contact address our abuse desk can reach under the AUP. We are a privacy host with a published policy, not a no-rules relay: run yours cleanly and it will stay online.