chore: resolve merge conflicts

Author: Mahmoud-s-Khedr

.eslintrc.js

@@ -3,23 +3,33 @@ module.exports = {
   parserOptions: {
     sourceType: 'module',
   },
-  plugins: ['@typescript-eslint/eslint-plugin'],
+  plugins: ['@typescript-eslint'],
   extends: ['eslint:recommended', 'plugin:@typescript-eslint/recommended'],
   root: true,
   env: {
     node: true,
   },
   ignorePatterns: ['dist', 'tslint.json', 'node_modules'],
   rules: {
-    '@typescript-eslint/interface-name-prefix': 'off',
     '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+    '@typescript-eslint/no-unused-vars': [
+      'error',
+      {
+        argsIgnorePattern: '^_',
+        caughtErrors: 'none',
+      },
+    ],
+    '@typescript-eslint/no-require-imports': 'off',
+
     semi: ['error', 'never'],
     quotes: ['error', 'single', { avoidEscape: true }],
-    'sort-imports': ['error', {
-      ignoreCase: true,
-      allowSeparatedGroups: true,
-    }],
+    'sort-imports': [
+      'error',
+      {
+        ignoreCase: true,
+        allowSeparatedGroups: true,
+      },
+    ],
     curly: [2, 'multi-line'],
     'max-len': [
       'error',
@@ -32,4 +42,12 @@ module.exports = {
     ],
     'comma-dangle': ['error', 'always-multiline'],
   },
-}
+  overrides: [
+    {
+      files: ['test/**/*.ts', '**/*.spec.ts'],
+      rules: {
+        '@typescript-eslint/no-unused-expressions': 'off',
+      },
+    },
+  ],
+}

.github/workflows/checks.yml

@@ -42,6 +42,8 @@ jobs:
         run: npm ci
       - name: Run ESLint
         run: npm run lint
+      - name: Run Knip
+        run: npm run knip
   build-check:
     name: Build check
     runs-on: ubuntu-latest

.knip.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://unpkg.com/knip@2/schema.json",
+  "entry": [
+    "src/index.ts",
+    "src/import-events.ts",
+    "knexfile.js"
+  ],
+  "project": [
+    "src/**/*.ts"
+  ],
+  "ignoreFiles": [],
+  "commitlint": false,
+  "eslint": false,
+  "github-actions": false,
+  "husky": false,
+  "mocha": false,
+  "nyc": false,
+  "semantic-release": false
+}

CONFIGURATION.md

@@ -109,6 +109,9 @@ Running `nostream` for the first time creates the settings file in `<project_roo
 | limits.event.rateLimits[].rate              | Maximum number of events during period. |
 | limits.event.whitelists.pubkeys             | List of public keys to ignore rate limits. |
 | limits.event.whitelists.ipAddresses         | List of IPs (IPv4 or IPv6) to ignore rate limits. |
+| limits.event.retention.maxDays              | Maximum number of days to retain events. Purge deletes events that are expired (`expires_at`), soft-deleted (`deleted_at`), or older than this window (`created_at`). Any non-positive value disables retention purge. |
+| limits.event.retention.kind.whitelist       | Event kinds excluded from retention purge. NIP-62 `REQUEST_TO_VANISH` is always excluded from retention purge, even if not listed here. |
+| limits.event.retention.pubkey.whitelist     | Public keys excluded from retention purge. |
 | limits.client.subscription.maxSubscriptions | Maximum number of subscriptions per connected client. Defaults to 10. Disabled when set to zero. |
 | limits.client.subscription.maxFilters       | Maximum number of filters per subscription. Defaults to 10. Disabled when set to zero. |
 | limits.message.rateLimits[].period          | Rate limit period in milliseconds. |

CONTRIBUTING.md

@@ -6,6 +6,16 @@ before making a change.
 
 Please keep the conversations civil, respectful and focus on the topic being discussed.
 
+## Local Quality Checks
+
+Run dead code and dependency analysis before opening a pull request:
+
+```
+npm run knip
+```
+
+`npm run lint` now runs Knip first, then ESLint.
+
 ## Pull Request Process
 
 1. Update the relevant documentation with details of changes to the interface, this includes new environment

Dockerfile.railwayapp

@@ -23,14 +23,15 @@ ADD migrations /build/migrations
 
 RUN npm install -g knex@2.4.0 && npm install --quiet
 
-RUN npm run db:migrate
-
 COPY . .
 
 RUN npm run build
 
 FROM node:24-alpine
 
+# Install dumb-init for proper signal handling
+RUN apk add --no-cache dumb-init
+
 ARG PORT
 ARG PGHOST
 ARG PGPORT
@@ -71,12 +72,19 @@ LABEL org.opencontainers.image.licenses=MIT
 
 WORKDIR /app
 
+# Copy runtime artifacts and configuration
 COPY --from=build /build/dist .
+COPY --from=build /build/package.json /build/package-lock.json ./
+COPY --from=build /build/knexfile.js ./
+COPY --from=build /build/migrations ./migrations
+COPY --from=build /build/seeds ./seeds
 
-RUN npm install --omit=dev --quiet
+RUN npm install --omit=dev --quiet && npm install -g knex@2.4.0
 
 USER 1000:1000
 
 RUN mkdir -p $NOSTR_CONFIG_DIR
 
-CMD ["node", "src/index.js"]
+ENTRYPOINT ["dumb-init", "--"]
+
+CMD ["sh", "-c", "npm run db:migrate && node src/index.js"]

README.md

@@ -209,6 +209,10 @@ Start:
   ```
   ./scripts/start_with_tor
   ```
+  or, with Nginx reverse proxy and Let's Encrypt SSL:
+  ```
+  RELAY_DOMAIN=relay.example.com CERTBOT_EMAIL=you@example.com ./scripts/start_with_nginx
+  ```
 
 **Windows / WSL2 users:** Docker bind-mounts can cause PostgreSQL permission errors on Windows. Use the dedicated override file instead:
   ```

commitlint.config.js

@@ -2,7 +2,8 @@ module.exports = {
   extends: ['@commitlint/config-conventional'],
 	parserPreset: 'conventional-changelog-conventionalcommits',
 	rules: {
-		'body-max-line-length': [2, 'always', 250],
+		'body-max-line-length': [0, 'always'],
+		'header-max-length': [0, 'always'],
 		'subject-case': [0, 'always'],
 		'header-case': [0, 'always'],
 		'body-case': [0, 'always'],

cucumber.js

@@ -11,7 +11,6 @@ const config = [
   '--format @cucumber/pretty-formatter',
   '--format html:.test-reports/integration/report.html',
   '--format json:.test-reports/integration/report.json',
-  '--publish',
 ].join(' ')
 
 module.exports = {

docker-compose.nginx.yml

@@ -0,0 +1,48 @@
+services:
+  nginx:
+    image: nginx:1.25-alpine
+    container_name: nostream-nginx
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - ${PWD}/nginx/conf.d:/etc/nginx/conf.d
+      - ${PWD}/nginx/ssl:/etc/nginx/ssl
+      - certbot-webroot:/var/www/certbot
+    depends_on:
+      - nostream
+    restart: on-failure
+    # Run nginx in foreground (so container exits if nginx dies).
+    # A background loop watches for a signal file created by certbot
+    # after cert issuance/renewal, and reloads nginx within seconds.
+    command: >
+      /bin/sh -c "while :; do
+        if [ -f /etc/nginx/ssl/reload-nginx ]; then
+          if nginx -t && nginx -s reload; then
+            rm -f /etc/nginx/ssl/reload-nginx;
+          fi;
+        fi;
+        sleep 5;
+      done & nginx -g 'daemon off;'"
+    networks:
+      default:
+
+  certbot:
+    image: certbot/certbot:v2.11.0
+    container_name: nostream-certbot
+    environment:
+      RELAY_DOMAIN: ${RELAY_DOMAIN:?RELAY_DOMAIN required}
+      CERTBOT_EMAIL: ${CERTBOT_EMAIL:?CERTBOT_EMAIL required}
+    volumes:
+      - ${PWD}/nginx/ssl:/etc/letsencrypt
+      - ${PWD}/scripts/certbot_entrypoint.sh:/entrypoint.sh:ro
+      - certbot-webroot:/var/www/certbot
+    entrypoint: /entrypoint.sh
+    depends_on:
+      - nginx
+    restart: on-failure
+    networks:
+      default:
+
+volumes:
+  certbot-webroot: