From 3468f85ee2cfdb36ff7e043d5aa8ceef0b907284 Mon Sep 17 00:00:00 2001 From: Wade Carpenter Date: Sun, 2 Aug 2026 20:46:56 -0400 Subject: [PATCH] fix(compose): add pair-relay sidecar and ignore local compose secrets Self-hosted compose stacks need buzz-pair-relay for NIP-AB mobile pairing, and local .env / key files should stay out of git. Signed-off-by: Wade Carpenter Co-authored-by: Cursor --- .gitignore | 2 ++ deploy/compose/compose.yml | 24 ++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/.gitignore b/.gitignore index f26e74136c..97c51c46f3 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,5 @@ identity.key # Helm dependency tarballs — regenerable from Chart.lock via `helm dependency build` deploy/charts/*/charts/*.tgz +deploy/compose/.env +deploy/compose/.local-keys.txt diff --git a/deploy/compose/compose.yml b/deploy/compose/compose.yml index 15337c92a2..80056311f3 100644 --- a/deploy/compose/compose.yml +++ b/deploy/compose/compose.yml @@ -20,6 +20,7 @@ services: BUZZ_GIT_REPO_PATH: /data/git BUZZ_AUTO_MIGRATE: ${BUZZ_AUTO_MIGRATE:-false} BUZZ_GIT_CONFORMANCE_PROBE: ${BUZZ_GIT_CONFORMANCE_PROBE:-true} + # BUZZ_PAIRING_RELAY_URL comes from env_file (.env) and is advertised in NIP-11. ports: - "${BUZZ_HTTP_PORT:-3000}:3000" volumes: @@ -48,6 +49,29 @@ services: networks: - buzz-net + # Ephemeral NIP-AB pairing sidecar (same image). Closed/NIP-43 relays need this + # so unpaired phones can complete identity transfer before joining membership. + pair-relay: + image: ${BUZZ_IMAGE:-ghcr.io/block/buzz:main} + entrypoint: ["/usr/local/bin/buzz-pair-relay"] + environment: + BUZZ_PAIR_RELAY_BIND_ADDR: 0.0.0.0:5000 + ports: + - "${BUZZ_PAIR_HTTP_PORT:-3848}:5000" + healthcheck: + test: + [ + "CMD-SHELL", + "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/5000'", + ] + interval: 10s + timeout: 3s + retries: 6 + start_period: 5s + restart: unless-stopped + networks: + - buzz-net + postgres: image: postgres:17-alpine environment: