nostr-logging-system

Nostr Logging System

Use Nostr as a distributed logging transport: publish non-sensitive logs publicly, and send sensitive logs privately to the admin via Nostr DM.

When to use

• You want tamper-resistant, relay-distributed public operational logs.
• You want sensitive logs (errors with secrets, internal traces) delivered privately to an admin.
• You need a lightweight logging channel without centralized log infrastructure.

Required tools / APIs

• Node.js 18+
• nostr-sdk library

Install:

npm install nostr-sdk

Environment variables:

# REQUIRED: admin Nostr public identity (npub or hex pubkey)
export ADMIN_NOSTR_PUBKEY="npub1..."

# REQUIRED for the logger identity (create if missing; see setup below)
export NOSTR_NSEC="nsec1..."

# Optional
export NOSTR_RELAYS="wss://relay.damus.io,wss://nos.lol,wss://relay.snort.social"

Setup flow (must do first)

1. Ask the admin for their Nostr address (npub / public key).
2. Check whether you already have NOSTR_NSEC saved.
3. If missing, generate a new keypair and save the nsec for future runs.

Generate and persist your nsec if missing (Node.js)

// setup-nostr-identity.js
const fs = require('fs');
const path = require('path');
const { generateRandomNsec, nsecToPublic } = require('nostr-sdk');

function ensureNostrIdentity() {
  const envPath = path.resolve(process.cwd(), '.env');
  const envText = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : '';

  const fromProcess = process.env.NOSTR_NSEC;
  const fromEnvFile = envText.match(/^NOSTR_NSEC=(.+)$/m)?.[1];
  const currentNsec = fromProcess || fromEnvFile;

  if (currentNsec && currentNsec.startsWith('nsec1')) {
    console.log('NOSTR_NSEC already exists. Reusing saved key.');
    return currentNsec;
  }

  const nsec = generateRandomNsec();
  const pub = nsecToPublic(nsec);

  const line = `NOSTR_NSEC=${nsec}`;
  const nextEnv = envText.includes('NOSTR_NSEC=')
    ? envText.replace(/^NOSTR_NSEC=.*$/m, line)
    : `${envText}${envText.endsWith('\n') || envText.length === 0 ? '' : '\n'}${line}\n`;

  fs.writeFileSync(envPath, nextEnv, 'utf8');

  console.log('Generated new Nostr identity. Saved NOSTR_NSEC to .env');
  console.log('Your npub:', pub.npub);
  return nsec;
}

ensureNostrIdentity();