Commands
Every nostrfy command, the CLI access list commands, and the inbox/outbox filter extensions.
Overview
All commands accept --config <path> (default nostrfy.toml).
| Command | Description |
|---|---|
nostrfy init | Write a default nostrfy.toml and exit; the file is created 0600 |
nostrfy genkey | Generate a secret key for NIP-29 groups, write it into relay.private_key, set the config to 0600 and print the public key |
nostrfy check | Validate the config (run before starting) |
nostrfy start | Start as a daemon; --foreground runs in the terminal |
nostrfy stop | Stop the running daemon |
nostrfy restart | Stop and start again (re-reads the config) |
nostrfy stats | Show live statistics |
nostrfy upgrade [version] | Update the binary to the latest GitHub release (or the given version); downloads the matching platform asset, verifies it with a --version probe and atomically replaces the binary; never downgrades unless a version is given; --force reinstalls |
Managing the access lists
The relay pubkey allow/deny lists and the Blossom upload allowlist live in LMDB and apply immediately — the running daemon reloads on SIGHUP:
nostrfy relay allow npub1...
nostrfy relay deny npub1...
nostrfy relay list
nostrfy blossom allow npub1...
nostrfy blossom deny npub1...
nostrfy blossom listA denied pubkey is always rejected when publishing and never served when reading.
Inbox/outbox subscription filters
nostrfy extends the REQ filter syntax with two convenience keys for the inbox/outbox routing model — a nostrfy
extension, not part of any NIP. "outbox" expands to "authors": only events authored by the pubkey. "inbox" expands to "#p": only events addressed to the pubkey (mentions, replies, zaps and DMs). Values may be 64-hex or npub1 codes, or arrays that merge with an existing authors/#p key; an invalid pubkey rejects
the subscription:
["REQ", "my-feed", {"outbox": "npub1..."}]
["REQ", "mentions", {"inbox": "npub1...", "kinds": [1, 7]}]The endpoints are also write-restricted: /outbox accepts only events authored by the connection's
NIP-42-authenticated pubkey (server.outbox_write_policy = "any") or only the relay's own events
("relay"); /inbox accepts only events carrying a p tag.