{"id":"2cbbffe06ede3cee239b77740d42938acfe563db0b41769345d6fa888d6a53ef","pubkey":"8e696ac6eb96e55a8956d37267de311e2c3e53fe4db519ac938fea419d2b61b7","created_at":1751194027,"kind":30817,"tags":[["d","nip-106-decentralized-web-hosting-on-nostr"],["title","NIP-106 Decentralized Web Hosting on Nostr"],["k","35392"],["k","35393"],["k","35394"],["client","nostrhub.io"]],"content":"`draft` `optional` `author:studiokaiji`\n\nStoring HTML, CSS, and JS on Nostr relays makes it possible to create a decentralized web hosting solution that eliminates the need for centralized servers. Nostr clients, including web servers, can retrieve stored data and transform it into the appropriate form for the application.\n\n## Reasons for hosting on Nostr\n\n- Tamper-resistance due to public key-based signatures\n- Fault tolerance through deployment across multiple relays\n- Resistance to blocking due to the distribution of web servers and clients\n- Faster retrieval speed when compared to IPFS's DHT\n\n## Kinds and References\n\nEach HTML, CSS, and JS file is assigned a `kind` for identification.\n\n- HTML: `kind: 5392`\n- CSS: `kind: 5393`\n- JS: `kind: 5394`\n\nThe \"content\" field contains the content of the file. However, internal links (`href`, `src`, etc.) referenced are replaced with event IDs of the `nevent` form.\n\nExample: ``\n\n### Implementation on Web Server or Client\n\nEvents are accessed using `/e/{nevent}`. Since an event is specified for each internal link, opening an HTML file enables automatic retrieval of data from the appropriate endpoint.\n\nBy using `nevent`, you can expedite the retrieval of relay information by including it internally, which offers the advantage of speed. However, it is also acceptable to implement the retrieval in the usual hex format as an option.\n\n**Implementation Example (Golang)**\n\n```go\nr.GET(\"/e/:nevent\", func(ctx *gin.Context) {\n nevent := ctx.Param(\"nevent\")\n\n // parse nevent\n _, res, err := nip19.Decode(hexOrNevent)\n if err != nil {\n ctx.String(http.StatusBadRequest, \"Invalid nevent\")\n return\n }\n\n data, ok := res.(nostr.EventPointer)\n if !ok {\n ctx.String(http.StatusBadRequest, \"Failed to decode nevent\")\n return\n }\n\n id := data.ID\n allRelays = append(allRelays, data.Relays...)\n\n // Fetch data from nostr pool\n ev := pool.QuerySingle(ctx, allRelays, nostr.Filter{\n Kinds: []int{\n consts.KindWebhostHTML, // 5392\n consts.KindWebhostCSS, // 5393\n consts.KindWebhostJS // 5394\n },\n IDs: []string{id},\n })\n\n if ev != nil {\n // Return data with content-type adapted to kind\n switch ev.Kind {\n case consts.KindWebhostHTML:\n ctx.Data(http.StatusOK, \"text/html; charset=utf-8\", []byte(ev.Content))\n case consts.KindWebhostCSS:\n ctx.Data(http.StatusOK, \"text/css; charset=utf-8\", []byte(ev.Content))\n case consts.KindWebhostJS:\n ctx.Data(http.StatusOK, \"text/javascript; charset=utf-8\", []byte(ev.Content))\n default:\n ctx.String(http.StatusNotFound, http.StatusText(http.StatusNotFound))\n }\n } else {\n ctx.String(http.StatusNotFound, http.StatusText(http.StatusNotFound))\n }\n\n return\n})\n```\n\n### Replaceable Decentralized Web Hosting\n\nAdditionally, this proposal can be extended to incorporate decentralized web hosting according to the NIP-33 specification. This allows tracking of website data with a single identifier, keeping URL paths immutable.\n\nFollowing the NIP-33 specification, the `kind` would be as follows.\n\n- HTML: `kind: 35392`\n- CSS: `kind: 35393`\n- JS: `kind: 35394`\n\nIdentifiers must be included within the `d` tag.\n\n**Example**\n\n```json\n{\n ...,\n \"kind\": 35392,\n \"tags\": [[\"d\", \"hostr-lp\"]]\n}\n```\n\nMoreover, internal links within the `content` should be assigned NIP-33 identifiers instead of event IDs.\n\n#### Identifier Format\n\n`[html_identifier][filepath]`\n\n**Example:** \n- index.html: `hostr-lp`\n- assets/index-ab834f60.css: `hostr-lp/assets/index-ab834f60.css`\n\n### Implementation on Web Server or Client\n\nEvents can be accessed through `/p/{author_hex}/d/{d_tag}`.\n\n**Implementation Example (Golang)**\n\n```go\nr.GET(\"/p/:author_hex/d/*dTag\", func(ctx *gin.Context) {\n authorHex := ctx.Param(\"author_hex\")\n\n // Add authors filter\n authors := []string{authorHex}\n\n // Add #d tag to filter\n dTag := ctx.Param(\"dTag\")[1:]\n tags := nostr.TagMap{}\n tags[\"d\"] = []string{dTag}\n\n // Fetch data from pool\n ev := pool.QuerySingle(ctx, allRelays, nostr.Filter{\n Kinds: []int{\n consts.KindWebhostReplaceableHTML, // 35392\n consts.KindWebhostReplaceableCSS, // 35393\n consts.KindWebhostReplaceableJS, // 35394\n },\n Authors: authors,\n Tags: tags,\n })\n if ev != nil {\n // Return data with content-type adapted to kind\n switch ev.Kind {\n case consts.KindWebhostReplaceableHTML:\n ctx.Data(http.StatusOK, \"text/html; charset=utf-8\", []byte(ev.Content))\n case consts.KindWebhostReplaceableCSS:\n ctx.Data(http.StatusOK, \"text/css; charset=utf-8\", []byte(ev.Content))\n case consts.KindWebhostReplaceableJS:\n ctx.Data(http.StatusOK, \"text/javascript; charset=utf-8\", []byte(ev.Content))\n default:\n ctx.String(http.StatusNotFound, http.StatusText(http.StatusNotFound))\n }\n } else {\n ctx.String(http.StatusNotFound, http.StatusText(http.StatusNotFound))\n }\n\n return\n})\n```\n\n## Web Server Implementation Vulnerabilities\n\nThe current web server implementation allows access to websites within a single domain. While this reduces server-side implementation complexity and provides resilience against blocking, it is not suitable for use with domain-based authorization systems (such as NIP-07). For instance, if signing is permitted for Nostr clients on the web hosting relay, it would grant permission for all web pages hosted on that relay, making it vulnerable to spam postings.\n\n## Implementation\n\nRepository: \n\nExample Implementation: ","sig":"beeb57e4f9446e44d4905941215aa6d19fec0b02881af4bbb9eba915e6a27c7196ab1f79c9de6d8735853fc6e0095e1719a23339a1f9e8b3a9da0c240b21433a"}