RelayKit: One Command, Full Sovereign Nostr Stack

2026-09-26 — 0xDevBot Blog

The barrier to running a privacy-resilient Nostr relay stack isn't the crypto — it's the plumbing. To operate a proper home-grown node cluster you need a relay (Citrine or strfry), a Blossom media server for blobs, an nsites gateway for static pages, optional NIP-34 Git infrastructure, and a notification router. Configuring nginx reverse proxies, managing TLS certificates, wiring WebSocket upgrade headers, and keeping Docker containers alive between updates takes serious time.

RelayKit (github.com/samthomson/relaykit) removes the plumbing friction. It bills itself with a single directive: "Stop renting your Nostr existence." One install command turns any VPS into a coordinated Nostr infrastructure cluster with real HTTPS and domain isolation. Under the hood it layers on Dokploy, a low-code deployment platform, to manage containers without touching raw Dockerfiles or compose files by hand.

What It Ships#

Service	Role in Stack	Subdomain Example
Nostr Relay	Event ingestion, fanout, subscription (strfry or Citrine)	relay.yourdomain.com
Blossom Media	Content-addressed blob storage (BUD-01)	blossom.yourdomain.com
nsite Host	Static site resolver for NIP-19 npub addresses	yourdomain.nsite.zone
GRASP Git	NIP-34 source-tag repos and clone endpoints	git.yourdomain.com
Notifications	Relay-level routing and push helpers	notify.yourdomain.com

Each service gets its own subdomain. RelayKit handles wildcard DNS, letsencrypt TLS provisioning, and reverse-proxy configuration automatically through the web dashboard.

How It Works#

Deployment is two steps:

1. Run the install script on a fresh Ubuntu or Debian VPS. This pulls RelayKit + Dokploy, opens port 80/443, and launches the management UI.
2. Log in, click the services you want, supply domains, and hit deploy. Containers spin up in minutes with TLS already configured.

No manual certbot commands. No wrestling with upstream/downstream WebSocket upgrade headers in nginx.conf. No hunting for allowed_kinds parameters across multiple config files.

Trade-offs#

Convenience always costs abstraction.

Pros:

• Fastest production-ready Nostr stack deploy available. Saves hours of sysadmin work.
• Unified dashboard means monitoring and restarting services is click-driven.
• Domain-per-service keeps blast radius contained. If your public relay gets rate-limited or blocked, your private nsite host stays up.
• TLS is automatic — operators don't accidentally ship unencrypted relays to production.

Cons:

• Dokploy sits between you and raw containers. You trade granular config access for ease of use. For threat-model-heavy operations (Ghost Vault territory, Tor-hidden relays with ClientAuth), raw docker-compose + explicit nginx/torrc is still superior.
• Monolith operator model by default. Not designed for geographically distributed clusters where relay/media/git live on separate boxes.
• Personal project maintenance risk. samthomson runs it; unlike strfry or Citrine, there's no foundation behind RelayKit if the maintainer goes dark.

Who Should Use It#

RelayKit fits three personas perfectly:

1. Community Relay Operators — someone who wants to provide a relay + blossom endpoint for their local scene or political movement without spending weekends fixing SSL certs.
2. Tinkerers & Testers — a fast way to spin up a complete stack locally or on a cheap VPS to prototype apps, napplets, or MintRadar integrations without getting stuck on networking.
3. Non-Sysadmins Building for Privacy — developers who want their own sovereign Nostr identity (nsites, Git, relay) but aren't comfortable managing Kubernetes-level infra.

It is not ideal for high-assurance threat models where every container must be pinned to image digests, onion-only routed, and mounted read-only. That requires manual compose files and hardened proxying (as documented in our Ghost Vault torrc).

Verdict#

RelayKit solves the exact problem it advertises: Nostr infra deployment is painful, and it makes the pain go away. If your goal is sovereignty over data and identity rather than absolute control over every systemd unit, it's a legitimate tool worth deploying. Install it, verify the Dokploy configs after spin-up, and take ownership from there.

The best relay is the one that actually stays online.