- commit
- 9f9102bbb35e55a0d78407e2bb054f2899935ba0
- parent
- c525f14bca6e643fdc3e138cfb31c13f971d615b
- author
- Dami <dami.etoile@gmail.com>
| M | docs/ | 4 | ++++ |
| M | docs/ | 6 | +++++- |
| M | docs/ | 2 | ++ |
@@ -76,6 +76,10 @@ On the People tab, set a member's role to *moderator*. A moderator can add and r
7676 7777 On the Identity tab, **Transfer ownership** gives the relay to a member. You stay on as a moderator. The relay's key, events, files and fuel do not change.7878 79+## If you lose your key80+81+Keys get lost. On the Identity tab, under **If I lose my key**, name a member as your heir and pick how long you can be away: three months, six, or a year. If you do not sign in for that long, the relay writes to you once a week for a month, in your own inbox and on your DM relays. If you still do not show up, it hands itself to the heir and keeps you on as a moderator. Any signed action on the relay, a console visit, a post, a signed request, resets the clock. Nothing else changes: the relay's key, events, files and fuel stay as they are.82+7983 ## Groups in clients8084 8185 Your relay is also a NIP-29 group, one group per relay, so clients that understand groups (Flotilla, Chachi, 0xchat, Coracle) show it as a community: name and picture, who is in it, a join button and moderation. The group id is the relay's name. Who may read and write follows your Rules tab: members-only reads make the group private, and anything but open writes makes it closed, so joining needs an invite code.@@ -67,11 +67,15 @@ Join terms are shown to people who open an invite link, and published at `/terms
6767 6868 **Delete relay** removes everything and returns the name to unclaimed. You type the relay's name to confirm.6969 70+### If I lose my key71+72+Name a member as your heir and pick the delay: 90, 180 or 365 days. The relay records when you last signed in (any owner-signed action counts, at most once an hour). Past the delay it starts a warning month: a message to you at once and then weekly, and a `succession_pending` date in its NIP-11 document. Any signed action calls the warning off. After the month, the relay transfers itself to the heir the same way **Transfer ownership** does, notifies both of you, and clears the plan. The heir can read the plan's status with the `successionstatus` method; moderators cannot. The plan stays out of exported configuration. If the heir leaves the relay, the plan is dropped and you are told.73+7074 ### Tell your clients7175 7276 One row per list that names relays: relay list (kind 10002), DM inbox (10050), search relays (10007), Blossom servers (10063). **Check** looks for your newest copy here and on the indexers. **Add me** merges this relay into it and publishes the signed result here, to the relays the list names and to the indexers; the row shows which accepted it. **Remove me** does the reverse. Lists are never rebuilt from scratch, so what you had stays.7377 74-**Notifications.** Three switches, all off until you turn them on: a report arrives, fuel runs low, a pull finishes. The relay writes you a NIP-17 private message with its own key, sealed and gift wrapped, stored here as your inbox and pushed to the relays in your kind 10050 when this relay holds one. **Send a test message** proves the path end to end. Only the owner can read these; the catch-all keep-for rule leaves gift wraps alone, though a rule set on kind 1059 itself still applies. Fuel is reported once when it turns low and then once a day while it stays low.78+**Notifications.** Four switches, all off until you turn them on: a report arrives, fuel runs low, a pull finishes, the handover clock is running (this one switches itself on when you name an heir). The relay writes you a NIP-17 private message with its own key, sealed and gift wrapped, stored here as your inbox and pushed to the relays in your kind 10050 when this relay holds one. **Send a test message** proves the path end to end. Only the owner can read these; the catch-all keep-for rule leaves gift wraps alone, though a rule set on kind 1059 itself still applies. Fuel is reported once when it turns low and then once a day while it stays low.7579 7680 - **Fork this relay** leases a new name, copies this relay into it and reserves the claim for a key. Choose a name or take a memorable one, choose who claims it (you by default, or an npub), what to copy (everything, only your events, or a list of kinds) and whether the people come along. The result is the new console URL to hand over; the new name expires like any lease unless it is claimed. One fork an hour.7781 @@ -55,6 +55,8 @@ The alarm also drives jobs (`jobs.ts`), a persisted list run one round at a time
5555 5656 A pull round (`pull.ts`) opens one websocket to the source, reconciles with NIP-77 as the initiator over the job's filter (authors, kinds, since), fetches a bounded batch of the missing ids, verifies signatures, and stores them through the normal write path minus the client policy. Sources on this host are dialled through their object stub and, on a whole-relay pull, their files copied in R2 by prefix. A pull job syncs its sources in turn, so a backfill is a pull with the owner as author from the relays in their kind 10002. A push round takes the next batch past a sequence cursor kept on the job, offers it to every target, counts OKs (a `duplicate:` counts as sent), and leaves a target alone for the round after several refusals in a row; the cursor survives sleeps and runs, so a standing push forwards only what arrived since. NIP-70 protected events are never pushed, nor private kinds from a members-only relay.5757 58+The alarm also runs succession, the dead-man's switch. `ownerSeenAt` in storage is refreshed by owner-signed actions (management calls, websocket AUTH, bridge requests, stored events), at most hourly. With an heir named, silence past the chosen delay puts a warning record in storage, mirrored in memory so NIP-11 can report `succession_pending`; the owner is notified weekly for thirty days; then `transferOwner` runs, both parties are notified and the handover is logged. Any owner action clears the warning.59+5860 ## Fuel5961 6062 Meters accumulate in memory and flush to a monthly `usage` row in batches. Time awake is estimated the way Cloudflare bills it: a wake costs the idle window (about 10 seconds) once, and each later message costs the gap since the previous one, capped at that window.