#

selfhosting

(13 articles)

Run Your Own Nostr Relay on Your Android Phone

You don't need a server. You don't need to pay for hosting. Your Android phone is enough to run a personal Nostr relay, accessible from anywhere, over Tor, for free. This guide covers: 1. Installing apps via **Zap Store** 2. Setting up **Citrine** as your relay 3. Exposing it over Tor with **Orbot** 4. Connecting from desktop browsers using **Tor + FoxyProxy** --- ## Step 1: Get Zap Store [Zap Store](https://zapstore.dev) is a Nostr-native app store. Apps are published by their creators directly on Nostr, so you can follow the developer, see their other work, and zap them to support development, all without ads or shady monetization. Discovery can take some getting used to, but there are genuinely useful apps there that you won't find pushed by algorithm or paid placement. If someone you follow builds an app, you can find it on Zap Store and follow their work directly. Install Zap Store first. We'll use it to install the other apps in this guide. --- ## Step 2: Install and Configure Citrine **Citrine** is a Nostr relay that runs locally on your Android phone. It's made by the same developer as **Amber** (the popular Nostr signer app), which is a good trust signal. Install it from Zap Store (or Play Store). Once installed, you have a few options for how permissive your relay is: ### Option A: Personal relay only Only store events from your pubkey or events that mention you. Your relay stays small and relevant to you only. Good default for most people. ### Option B: Open relay with auto-cleanup Allow anyone to publish events to your relay, but run automatic cleanup so old events get deleted. You can configure it to never delete your own events while cleaning up everything else. ### Option C: No filtering Accept and keep everything. Generous, but be aware: your relay is open to spam and your storage will fill up over time. Pick what fits your use case. After configuring, Citrine will start listening on a local port (default: `4869`). Note this port number — you'll need it in the next step. --- ## Step 3: Expose Your Relay Over Tor with Orbot Your relay is running, but it's only accessible locally on your phone. To reach it from other devices and networks, you'll use **Orbot** to create a Tor hidden service (`.onion` address). Install Orbot from Zap Store or Play Store. ### Create a hidden service 1. Open Orbot 2. Go to settings and find **Hidden Services** (or "Tor Hidden Services") 3. Add a new hidden service pointed at the port Citrine is using (e.g. `4869`) 4. Orbot will generate a `.onion` address. Save this, it's your relay address ### Whitelist Citrine in Orbot In Orbot's app list, enable Tor **only for Citrine**. This routes Citrine's traffic through Tor but leaves all your other apps unaffected. ### Set Orbot as Always-On VPN Go to **Android Settings → Network → VPN**, find Orbot, and enable **Always-on VPN**. This makes Orbot start automatically when your phone boots, keeping your relay reachable without manual intervention. > Do not enable the "Block connections without VPN" / kill switch option. Since > only Citrine is whitelisted, enabling it would cut internet access for all > your other apps. Your relay is now live. The `.onion` address works over mobile data, Wi-Fi, any network, no port forwarding, no static IP needed. --- ## Step 4: Add Your Relay to Your Nostr Clients Your `.onion` relay address looks like: `ws://youraddress.onion` Add it to your relay list in your Nostr client. Most mobile Nostr apps (Yakihonne, Amethyst, etc.) have built-in Tor support and will connect to `.onion` relays automatically once you add the address. --- ## Step 5: Connect from Desktop Most mobile apps work out of the box, but desktop browsers can't resolve `.onion` addresses natively. Fix this with Tor + FoxyProxy. ### Install Tor You need Tor running locally. Install it however you prefer. On macOS and Linux, Homebrew is the easiest way: ```bash brew install tor brew services start tor ``` Homebrew itself can be installed from [brew.sh](https://brew.sh). Once running, Tor listens on `localhost:9050` (SOCKS5). ### Install FoxyProxy Install the **FoxyProxy** extension for Firefox or Chromium-based browsers. ### Configure FoxyProxy 1. Click the FoxyProxy icon → **Options** 2. Go to **Proxies** → **Add** 3. Fill in: - **Title:** Onion Resolver (or anything you like) - **Type:** SOCKS5 - **Hostname:** `127.0.0.1` - **Port:** `9050` 4. Scroll down to **Proxy by Patterns** → **Add Pattern** - **Title:** onion - **Pattern:** `*.onion` 5. Save 6. Back in FoxyProxy popup, switch mode to **Proxy by Patterns** Now your browser will route only `.onion` addresses through Tor, leaving all normal traffic unchanged. The goal here is connectivity, not anonymity. You're just making `.onion` addresses resolvable. Open your web-based Nostr client (e.g. Yakihonne web, Primal) and add your relay. It will connect. --- ## You're Done You now have a personal Nostr relay running on your phone, reachable from anywhere in the world. No server, no fees, no central point of failure. Your data lives on your device.

🛡️ Tutorial: Secure SSH Access over Cloudflare Tunnel (Docker Optional)

# 🛡️ Tutorial: Secure SSH Access over Cloudflare Tunnel (Docker Optional) ### 🎯 Objective Set up a **Cloudflare Tunnel** to securely expose **SSH access to your system** without revealing your home IP or requiring port forwarding. This enables secure remote access even behind NAT, CGNAT, or dynamic IP environments. This guide: * Uses **Cloudflare Tunnels** to proxy traffic * **Does not expose your home IP address** * Uses **Docker + Docker Compose** for orchestration (*optional*) * Can be adapted to run under **systemd** directly if preferred --- ## 🔧 Prerequisites * A domain managed via [Cloudflare DNS](https://dash.cloudflare.com) * SSH server running on your machine (default port `22`) * Temporary access to the `cloudflared` CLI (for tunnel creation) * Either: * **Docker and Docker Compose** *(used in this example)*, or * A native `systemd` service (alternative not covered here) --- ## 🪜 Step-by-Step Instructions --- ### **1. Install and Authenticate `cloudflared`** Install `cloudflared` (temporary): ```bash curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 \ -o cloudflared && chmod +x cloudflared && sudo mv cloudflared /usr/local/bin/ ``` Login with your Cloudflare account: ```bash cloudflared tunnel login ``` This will open a browser and link the machine to your Cloudflare zone. --- ### **2. Create the Tunnel** Create a named tunnel: ```bash cloudflared tunnel create ssh-tunnel ``` This creates a credential file, e.g.: ``` ~/.cloudflared/5f84da12-e91b-4d2e-b4f0-7ca842f622f1.json ``` --- ### **3. Define the Tunnel Routing Configuration** Create the tunnel config: ```bash nano ~/.cloudflared/config.yml ``` Example: ```yaml tunnel: ssh-tunnel credentials-file: /etc/cloudflared/5f84da12-e91b-4d2e-b4f0-7ca842f622f1.json ingress: - hostname: secure-ssh.example.com service: ssh://localhost:22 - service: http_status:404 ``` Then bind the hostname to the tunnel: ```bash cloudflared tunnel route dns ssh-tunnel secure-ssh.example.com ``` > Replace `secure-ssh.example.com` with your own subdomain under Cloudflare management. --- ### **4. Prepare File Permissions for Docker Use (Optional)** If using Docker, `cloudflared` runs as a non-root user (`UID 65532`), so grant it access to your config and credentials: ```bash sudo chown 65532:65532 ~/.cloudflared sudo chown 65532:65532 ~/.cloudflared/* ``` --- ### **5. Define `docker-compose.yml` (Optional)** ```yaml version: "3.8" services: cloudflared: image: cloudflare/cloudflared:latest container_name: cloudflared-ssh-tunnel restart: unless-stopped volumes: - ${HOME}/.cloudflared:/etc/cloudflared:ro - ${HOME}/.cloudflared:/home/nonroot/.cloudflared:ro command: tunnel run ssh-tunnel network_mode: host ``` > 📝 Docker is used here for convenience and automation. You may alternatively run `cloudflared tunnel run ssh-tunnel` directly under `systemd` or a background process. --- ### **6. Start the Tunnel** Start the container: ```bash cd ~/docker/sshtunnel docker compose up -d docker logs -f cloudflared-ssh-tunnel ``` You should see `Registered tunnel connection` and other success logs. --- ### **7. Connect to the Tunnel from Remote Systems** #### Option A: Ad-hoc connection with `cloudflared access tcp` ```bash cloudflared access tcp --hostname secure-ssh.example.com --url localhost:2222 ``` In another terminal: ```bash ssh -p 2222 youruser@localhost ``` #### Option B: Permanent SSH Configuration Edit `~/.ssh/config`: ```ssh Host secure-home HostName secure-ssh.example.com User youruser IdentityFile ~/.ssh/id_rsa ProxyCommand cloudflared access ssh --hostname %h ``` Then connect with: ```bash ssh secure-home ``` --- ## ✅ Result * Secure SSH access via a public domain (e.g., `secure-ssh.example.com`) * No ports open to the public Internet * IP address of your machine remains hidden from Cloudflare clients * Easily extendable to expose other services in future --- ## 🔁 Optional Enhancements * Run as a `systemd` service instead of Docker for lower overhead * Use `autossh` or `systemd` to maintain persistent reverse tunnels * Expand to forward additional ports (e.g., Bitcoin RPC, application APIs) * Apply strict firewall rules to limit SSH access to `localhost` only