Community Apps

strfry

By NostrDev

A nostr relay

1.1.3 256MB Updated 22 Sep 2026
Package Website
nostr relay
Install this app
In your Cloudron dashboard, open the App Store, choose "Community apps" and paste this URL:
https://git.nostrdev.com/stuff/cloudron-strfry/raw/branch/main/CloudronVersions.json

Description

strfry - a nostr relay

strfry is a relay for the nostr protocol

  • Supports most applicable NIPs: 1, 2, 4, 9, 11, 12, 15, 16, 20, 22, 28, 33, 40
  • No external database required: All data is stored locally on the filesystem in LMDB
  • Hot reloading of config file: No server restart needed for many config param changes
  • Zero downtime restarts, for upgrading binary without impacting users
  • Websocket compression: permessage-deflate with optional sliding window, when supported by clients
  • Built-in support for real-time streaming (up/down/both) events from remote relays, and bulk import/export of events from/to jsonl files
  • negentropy-based set reconcilliation for efficient syncing with remote relays
Screenshot

Recent Changes

  • Security/hardening pass on the 1.1.7/1.1.8 changes:

  • sync.sh: mid-line # is no longer treated as a comment — nostr tag filters like {"#e":[...]} contain # and were being corrupted; comments must start the line (README/example updated to match)

  • sync.sh: flock-based one-run-at-a-time guard (/app/data/sync.lock) so overlapping cron schedules cannot run two sync writers against the same LMDB dir; a URL scheme check (ws:// or wss:// only) and a numeric timeout guard reject malformed config lines instead of misbehaving

  • Dockerfile: pin strfry and chief by commit SHA instead of mutable tag (1.1.3 = 16c00df0, v0.1.0 = d00e0727, both verified to deref from the tags); chief builds with cargo build --locked; rustup uses --profile minimal

  • CI: SHA-pin actions (checkout@11d5960, login-action@c94ce9f, both tag-verified) and add a trivy gate before publish: the image is scanned for HIGH/CRITICAL vulns (trivy 0.74.0, checksum-pinned, run as a plain step) and the release fails before registry push if any fixable finding exists. The trivy-action wrapper is deliberately not used: v0.36.0 declares the node24 action runtime, which the Gitea act runner does not support

  • Documented residual risks: rustup installs current stable (no versioned channel to pin; rustc 1.98.1 built the pinned chief) and the golpe/negentropy submodules track their own repos at whatever the pinned strfry commit references

  • Base image 5.0.0 -> 5.1.0 (both Ubuntu 24.04; 5.1.0 is the base for Cloudron 10). 5.0.0 was 19 months old and carried 892 fixable HIGH/CRITICAL findings plus 3 secret-scan hits on its own; 5.1.0 carries 378 and no secrets

  • Patch the distro in the runtime stage (apt upgrade) so the shipped image carries current Ubuntu security updates instead of the base image's build-day snapshot; this clears the OS package findings entirely

  • CI: the trivy gate now skips the tooling the base image bundles that this relay never runs (mongo tools, yq, gosu, bundled node) - all of the remaining findings come from those binaries' old Go stdlib, and none of them are shipped or executed by this package