How to Run Your Own Nostr Relay on a VPS: Guarding Censorship-Resistant Decentralized Social Networks

Introduction to the Decentralized Web

In an era dominated by centralized social media conglomerates, data privacy, platform lock-in, and arbitrary censorship have become critical liabilities for businesses and thought leaders alike. Traditional platforms control not only your audience reach but also the underlying infrastructure of your digital identity. Enter Nostr (Notes and Other Stuff Transmitted by Relays), a revolutionary, open-source cryptographic protocol designed to create a truly decentralized and censorship-resistant social web.

Unlike traditional networks, Nostr does not rely on a central server. Instead, it utilizes a network of independent servers known as relays to pass data between users. By learning how to set up and host your own Nostr relay on a Virtual Private Server (VPS), you take direct control over your data distribution, enhance network resilience, and establish a foundational footprint in the future of decentralized digital communication.

Understanding the Nostr Architecture: Clients vs. Relays

To successfully operate a relay, one must first grasp the elegant, minimalist architecture of the Nostr protocol. The ecosystem is broadly divided into two primary components:

• Clients: The user-facing interfaces (such as Damus, Amethyst, or Primal) where users write posts, follow accounts, and view feeds. Clients sign every action cryptographically using a private key.
• Relays: The backend nodes that accept, store, and forward these signed cryptographic events. Relays do not communicate with each other; they only interact directly with clients.

When you publish a post, your client sends it to multiple relays. When a follower wants to read your post, their client queries those same relays. This separation of concerns ensures that even if one relay deplatforms a user, the user can seamlessly migrate to another relay without losing their identity, followers, or historical data.

Why Entities and Professionals Should Host a Private Relay

For businesses and enterprise users, running a dedicated Nostr relay offers distinct strategic advantages over relying solely on public infrastructure:

1. Absolute Data Sovereignty: You gain a guaranteed repository for your corporate communications and intellectual property, immune to third-party deletion.
2. Enhanced Performance and Low Latency: Public relays can suffer from congestion. A dedicated VPS ensures high availability and fast query speeds for your specific corporate clients or internal teams.
3. Customized Access Control: You can configure your relay to be entirely public, completely private (restricted to your organization), or paid (requiring a Lightning Network payment to counter spam).
4. Contributing to Network Decentralization: By adding a stable, high-uptime node to the ecosystem, your organization actively strengthens the global censorship-resistant infrastructure.

Prerequisites and System Requirements

Before initiating the deployment process, ensure your technical environment meets the following baseline criteria:

• A Reliable VPS Provider: Providers like DigitalOcean, Linode (Akamai), Hetzner, or AWS are ideal.
• Operating System: A clean installation of Ubuntu 22.04 LTS or Ubuntu 24.04 LTS is highly recommended for stability and package support.
• Hardware Specifications: For a lightweight, personal, or small-team relay, a single-core CPU, 1GB to 2GB of RAM, and 20GB to 40GB of SSD storage are sufficient. Scaling to a massive public relay will require vertical scaling of memory and high-IOPS storage.
• Domain Name: A registered domain or subdomain (e.g., relay.yourcompany.com) pointing to your VPS IP address.
• Basic Technical Competence: Familiarity with the SSH command line, basic Linux administration, and Docker environments.

Step-by-Step Guide: Deploying a Nostr Relay Using Strfry

While multiple relay implementations exist (such as Nostr-rs-relay), Strfry is widely celebrated in the developer community for its exceptional performance, low memory footprint, and robust C++ architecture. Below is the step-by-step deployment methodology using Docker for optimal isolation and ease of maintenance.

Step 1: System Update and Docker Installation

First, securely log into your VPS via SSH and update the operating system packages to their latest secure versions:

sudo apt update && sudo apt upgrade -y

Next, install the required dependencies, including Docker and Docker Compose, which will orchestrate our relay services:

sudo apt install docker.io docker-compose -y
sudo systemctl enable --now docker

Step 2: Configuring the Directory and Docker Compose Architecture

Create a dedicated working directory for your Strfry installation to keep your environment organized:

mkdir -p ~/nostr-relay && cd ~/nostr-relay

Create a docker-compose.yml file using your preferred text editor (e.g., nano) to define the service container structure:

nano docker-compose.yml

Insert the following structural layout configuration into the file:

version: '3.8'

services:
  strfry:
    image: ghcr.io/hoytech/strfry:latest
    container_name: strfry-relay
    volumes:
      - ./strfry.config:/etc/strfry.config
      - ./data:/app/strfry-db
    ports:
      - "7777:7777"
    restart: unless-stopped

Save and exit the text editor. This configuration maps the network ports, establishes persistent storage for the relay database, and references a configuration file we will create in the next step.

Step 3: Customizing the Relay Configuration

Strfry relies on a specialized configuration file to determine its operational parameters. Fetch the default production template or write a streamlined strfry.config file within your directory. Key parameters you must define within this file include:

• info.name: The branding title of your relay (e.g., "Enterprise Alpha Relay").
• info.description: A concise summary detailing the purpose or access rules of your node.
• info.pubkey: Your cryptographic hex public key, designating you as the verified administrative owner.
• info.contact: An administrative email or Nostr contact point for operational inquiries.

Ensure that the database path inside the config matches the internal container directory: /app/strfry-db.

Step 4: Setting Up an Nginx Reverse Proxy and SSL Encryption

Nostr client-to-relay communication mandates secure WebSockets (wss://). To achieve this, we route traffic through an Nginx reverse proxy secured by a free Let's Encrypt SSL certificate.

Install Nginx and the Certbot validation tool:

sudo apt install nginx certbot python3-certbot-nginx -y

Configure a new Nginx server block specifically tailored for WebSockets traffic, pointing incoming traffic on port 80/443 directly to the internal Docker port 7777. Once configured, execute the automated SSL certificate generation command:

sudo certbot --nginx -d relay.yourcompany.com

Certbot will automatically modify the Nginx configuration to enforce strict, modern HTTPS/WSS encryption protocols, securing all data in transit.

Step 5: Launching the System and Verifying Connectivity

With configurations finalized and security certificates actively deployed, initialize the Docker container in detached background execution mode:

docker-compose up -d

Verify that the service is running optimally by reviewing the real-time container log output:

docker-compose logs -f strfry

To finalize verification, open a standard Nostr client interface, navigate to the network settings, add your newly minted endpoint address (e.g., wss://relay.yourcompany.com), and execute a test post. Your private node will instantly process, index, and securely store the cryptographic event.

Conclusion and Best Practices

Congratulations, you have successfully claimed a stake in the decentralized web by launching an independent Nostr relay. As an administrator, ensure you maintain long-term server health by implementing automated backup schedules for your database volume, configuring firewall policies to expose only ports 80, 443, and SSH, and routinely keeping Docker packages updated. By mastering this infrastructure, your organization stands prepared for a resilient, open, and fundamentally uncensorable digital future.