messages: messages.coinos.io, a Magnitude Relay for the app's private messages, inbox lists, calls and group chats; copies down from relay.coinos.io over NIP-77 (the strfry tunnel), never writes into it

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01QjVvE4YAcK3AGwV7kZXeN4

2 files changed, 76 insertions, 0 deletions

diff --git a/messages/README.md b/messages/README.md
new file mode 100644
index 0000000..aa0d4da
--- /dev/null
+++ b/messages/README.md
@@ -0,0 +1,35 @@
+# messages.coinos.io
+
+The messaging relay: [Magnitude Relay](https://github.com/VectorPrivacy/magnitude-relay)
+(AGPL-3.0, Rust), run as the `messages` service in `compose.yml` with the
+settings in `relay.toml`. relay.coinos.io (strfry on desk) stays the general
+relay; this one takes the app's private messages, inbox lists, calls and
+group chats, and copies down what other clients deliver to relay.coinos.io.
+
+## Build (on cs)
+
+The binary is built from a pinned commit, outside the deploy hook (a release
+build takes minutes), and mounted into the container:
+
+```sh
+git -C ~/magnitude-relay-src fetch && git -C ~/magnitude-relay-src checkout <rev>
+docker run --rm --cpus 4 -v ~/magnitude-relay-src:/src -v ~/magnitude-build:/target \
+  -v magnitude-cargo:/usr/local/cargo/registry -w /src -e CARGO_TARGET_DIR=/target \
+  -e RELAY_BUILD_REV=<rev> rust:1-bookworm cargo build --release -p relay-server
+install -m 755 ~/magnitude-build/release/magnitude-relay $STATE/messages/bin/
+docker compose -f ~/coinosv3-server/compose.yml --env-file ~/coinosv3-state/.env up -d --force-recreate messages
+```
+
+Running now: 92f2440.
+
+## Ingress
+
+`messages.coinos.io` → `http://localhost:8794` in `~/.cloudflared/bitcoin.yml`
+(`sudo systemctl restart cloudflared-bitcoin`), DNS CNAME to the tunnel.
+
+## Operating
+
+Dashboard `https://messages.coinos.io/dashboard`, `/stats`, `/metrics`. Operator
+commands (`query`, `count`, `delete`, `backup`, `sync`) reach the running relay
+through `/data/admin.sock`:
+`docker exec messages magnitude-relay --config /etc/magnitude-relay/relay.toml count '{"kinds":[1059]}'`
diff --git a/messages/relay.toml b/messages/relay.toml
new file mode 100644
index 0000000..5d17967
--- /dev/null
+++ b/messages/relay.toml
@@ -0,0 +1,41 @@
+# messages.coinos.io: the messaging relay behind coinos v3 (Magnitude Relay,
+# github.com/VectorPrivacy/magnitude-relay). Private messages (NIP-17 gift
+# wraps), DM inbox lists, calls, Concord and White Noise (Marmot) group chats.
+# Posts, profiles' feeds, wallet sync and NWC stay on relay.coinos.io (strfry).
+# Every key is documented by `magnitude-relay init`.
+
+[relay]
+bind = "127.0.0.1:8794"
+urls = ["wss://messages.coinos.io"]
+# behind the Cloudflare tunnel every connection comes from cloudflared
+real_ip_header = "CF-Connecting-IP"
+
+[info]
+name = "coinos messages"
+description = "The messaging relay for coinos: private messages, group chats and calls."
+contact = "https://coinos.io"
+
+[policy]
+# Vector's set (gift wraps, 10050 inbox lists, Concord, calls' ephemeral
+# wraps 21059, NIP-46) plus Marmot: key packages (443 legacy, 30443), their
+# relay list (10051), welcomes (444) and group messages (445)
+kinds = "vector"
+allow_kinds = [443, 444, 445, 10051, 30443]
+# a Marmot welcome for a big group runs past 200 KB (relay.coinos.io went to 1 MB for it)
+max_event_bytes = 1048576
+
+[limits]
+max_message_bytes = 1150000
+
+[store]
+data = "/data"
+
+# Down from relay.coinos.io (strfry on desk, through cs's standing ssh tunnel
+# to it, relay-standby-tunnel.service): what other clients deliver there per
+# the old inbox lists lands here too. Down only: this relay never writes into
+# strfry (its write policy rate-limits by IP).
+[[sync]]
+url = "ws://127.0.0.1:17777"
+direction = "down"
+filter = '{"kinds":[1059,10050,443,444,445,10051,30443,13302,13303,33301,33302]}'
+reconcile_seconds = 300