CompleteNoobs - Recent changes [en]

User:JosefinaA20

JosefinaA20 — Sat, 13 Jun 2026 07:37:15 GMT

User account JosefinaA20 was created

Hive Blockchain Create Custom Coins

AwesomO — Tue, 26 May 2026 17:32:20 GMT

Exchanging tokens on an exchange

← Older revision		Revision as of 17:32, 26 May 2026
Line 118:		Line 118:
	* https://hive-engine.com/trade/CNOOBS		* https://hive-engine.com/trade/CNOOBS
	<code>https://hive-engine.com/trade/<YOUR_TOKEN></code>		<code>https://hive-engine.com/trade/<YOUR_TOKEN></code>

			== Finding your tokens across the network ==

			* https://he.dtools.dev/richlist/CNOOBS

	== Common Problems and Fixes ==		== Common Problems and Fixes ==

NGate

AwesomO — Tue, 26 May 2026 00:40:51 GMT

← Older revision		Revision as of 00:40, 26 May 2026
Line 4:		Line 4:

	Stage 2: https://www.completenoobs.com/noobs/Nostr-handson		Stage 2: https://www.completenoobs.com/noobs/Nostr-handson

			Data: https://www.completenoobs.com/noobs/V4call-server-data-flow

			https://www.completenoobs.com/noobs/Ngate_basic

			https://www.completenoobs.com/noobs/Ngate-strfry-basic

Ngate-strfry-basic

AwesomO — Tue, 26 May 2026 00:40:18 GMT

Created page with "{{:LICENCE_HEADER_MIT}} = strfry + nGate — A Hot-Reloading Whitelisted Nostr Relay on Ubuntu 24.04 = From CompleteNoobs This guide deploys a '''strfry''' Nostr relay at <code>nostr.v4call.com</code> on a fresh Ubuntu 24.04 server, behind TLS, with nGate driving a '''live, hot-reloading whitelist''' — the relay's allowed-publisher list is updated '''without ever restarting the relay'''. This is the "Stage 4" path described in CLAUDE.md / STATUS.md. It is..."

Show changes

Ngate basic

AwesomO — Tue, 26 May 2026 00:38:07 GMT

Created page with "{{:LICENCE_HEADER_MIT}} = nGate — Deploy to a Fresh Ubuntu 24.04 Server = From CompleteNoobs This guide walks an operator through deploying nGate on top of an existing stage-1 nostr-rs-relay running on a Vultr Ubuntu 24.04 box. After this you'll have: * The relay still running as before. * Caddy still terminating TLS as before. * '''A new sidecar container''' (<code>ngate-sync</code>) running alongside, scanning Hive every..."

New page

{{:LICENCE_HEADER_MIT}}

= nGate — Deploy to a Fresh Ubuntu 24.04 Server =

From CompleteNoobs

This guide walks an operator through deploying nGate on top of an existing
[[Nostr_Relay_With_a_3-Key_Whitelist|stage-1 nostr-rs-relay]] running on a
Vultr Ubuntu 24.04 box. After this you'll have:

* The relay still running as before.
* Caddy still terminating TLS as before.
* '''A new sidecar container''' (<code>ngate-sync</code>) running alongside,
scanning Hive every 6 hours, updating the relay's <code>pubkey_whitelist</code>
automatically when v4call-server operators announce themselves.
* '''Cryptographic enforcement''': only posts that prove ownership of both
the Hive account AND the Nostr key (via mutual attestation) get whitelisted.

== Prerequisites ==

You've already:

* Followed [[Nostr_Relay_With_a_3-Key_Whitelist|stage 1]] and have a working
<code>wss://nostr.YOUR-DOMAIN/</code> relay.
* Followed [[Nostr_Hands-On|stage 2]] enough to be comfortable with the
Nostr protocol fundamentals.
* Have at least one v4call-server announce post on Hive (signed via
<code>server-sign.html</code>, announced via <code>server-announce.html</code>)
to use as test input.

If you don't have a v4call-server post yet, you can still deploy nGate and
test it (the scan will find existing operators' posts), you just won't be in
the whitelist until you publish your own.

== Contents ==

* [[#Step_1:_SSH_to_the_relay_box|1 Step 1: SSH to the relay box]]
* [[#Step_2:_Install_runtime_dependencies|2 Step 2: Install runtime dependencies]]
* [[#Step_3:_Clone_nGate|3 Step 3: Clone nGate]]
* [[#Step_4:_Install_npm_dependencies|4 Step 4: Install npm dependencies]]
* [[#Step_5:_Bootstrap_config.toml|5 Step 5: Bootstrap config.toml]]
* [[#Step_6:_Create_seed.toml|6 Step 6: Create seed.toml (CRITICAL — don't skip)]]
* [[#Step_7:_Configure_ngate.yaml|7 Step 7: Configure ngate.yaml]]
* [[#Step_8:_Dry-run_the_chain|8 Step 8: Dry-run the chain]]
* [[#Step_9:_Merge_sidecar_into_docker-compose.yml|9 Step 9: Merge sidecar into docker-compose.yml]]
* [[#Step_10:_Build_and_start_the_sidecar|10 Step 10: Build and start the sidecar]]
* [[#Step_11:_Watch_a_cycle|11 Step 11: Watch a cycle]]
* [[#Step_12:_Routine_monitoring|12 Step 12: Routine monitoring]]
* [[#Updating_nGate|13 Updating nGate]]
* [[#Known_gotchas|14 Known gotchas]]
* [[#Removing_nGate|15 Removing nGate (back to manual whitelist)]]

== Step 1: SSH to the relay box ==

ssh root@nostr.YOUR-DOMAIN

If you set up a non-root user during stage 1, use that and prefix everything
with <code>sudo</code> as needed.

== Step 2: Install runtime dependencies ==

nGate needs a few things beyond what stage 1 installed. Inside the sidecar
container, all deps are auto-installed (Alpine image bakes Node + jq + curl
+ docker-cli + yq). Outside the container — for dry-runs and manual sync
commands — install on the host:

apt update
apt install -y nodejs npm jq curl

Verify:

for c in bash curl jq sed awk node; do command -v $c >/dev/null && echo "✓ $c" || echo "✗ $c MISSING"; done

All six should print ✓.

== Step 3: Clone nGate ==

The relay lives at <code>/opt/nostr-relay/</code>. Clone nGate next to it so
the bind-mount paths in <code>docker-compose.example.yml</code> work:

cd /opt/nostr-relay
git clone https://github.com/CompleteNoobs/nGate src

That gives you:

/opt/nostr-relay/
├── config.toml ← from stage 1
├── Caddyfile ← from stage 1
├── docker-compose.yml ← from stage 1
├── data/ ← from stage 1 (relay sqlite DB)
├── caddy_data/ ← from stage 1
└── src/ ← NEW (nGate repo)
├── scripts/
├── ngate.yaml.example
├── docker-compose.example.yml
└── ...

For convenience, symlink the scripts dir + copy the YAML template up to
<code>/opt/nostr-relay/</code> (so bind-mount paths are simple):

cd /opt/nostr-relay
ln -s src/scripts scripts
cp src/ngate.yaml.example ngate.yaml

Now <code>scripts/ngate-*.sh</code> work from <code>/opt/nostr-relay/</code>.

'''💡 Tip''': you can also clone nGate anywhere else and adjust the
<code>NGATE_*</code> env-vars in <code>ngate.yaml</code> to point at the
right paths. The clone-into-<code>src/</code>-and-symlink approach is just
the path of least resistance.

== Step 4: Install npm dependencies ==

The Hive ECDSA + Nostr schnorr helpers are Node scripts that need
<code>@hiveio/dhive</code> and <code>nostr-tools</code>:

cd /opt/nostr-relay/src/scripts
npm install

This creates <code>node_modules/</code> in the scripts folder (~35MB).
Gitignored — won't bloat the repo. One-time cost; subsequent
<code>git pull</code> + <code>npm install</code> is incremental.

Verify both deps are present:

ls node_modules/@hiveio/dhive/package.json
ls node_modules/nostr-tools/package.json

Both should exist.

== Step 5: Bootstrap config.toml ==

Your stage-1 <code>config.toml</code> has an <code>[authorization]</code>
section with hand-pasted hex pubkeys. nGate manages a specific block of
this file between BEGIN/END marker comments. Run the bootstrap to wrap your
existing section:

cd /opt/nostr-relay
./scripts/ngate-apply.sh --bootstrap

Output should look like:

ngate-apply: ✓ Bootstrapped — wrapped [authorization] in BEGIN/END markers.
ngate-apply: ngate-apply now manages everything between those markers.
ngate-apply: Operator-edited keys go in: /opt/nostr-relay/seed.toml

Inspect <code>config.toml</code>:

cat /opt/nostr-relay/config.toml

You should see your existing pubkey_whitelist entries, now wrapped:

# === BEGIN NGATE-MANAGED — DO NOT EDIT BY HAND ===
[authorization]
pubkey_whitelist = [
"your_existing_hex_1",
"your_existing_hex_2",
"your_existing_hex_3",
]
# === END NGATE-MANAGED ===

'''⚠ From this point forward, don't hand-edit between those markers.'''
nGate will overwrite that region on every sync. Manual additions go in
<code>seed.toml</code> (next step).

== Step 6: Create seed.toml (CRITICAL — don't skip) ==

'''Why this matters''': nGate's first <code>--apply</code> with
<code>--allow-removals</code> can delete entries that aren't currently
backed by a valid v4call-server post on Hive — including yours, if your
operator key isn't yet announced. Without a seed entry, you can lock
yourself out.

Make a <code>seed.toml</code> at <code>/opt/nostr-relay/seed.toml</code>
listing every hex pubkey that should ALWAYS be allowed, regardless of
discovery state. Most importantly: your own operator key.

nano /opt/nostr-relay/seed.toml

Paste:

# nGate seed list — operator-managed, never auto-removed.
# One hex pubkey per line. Comments allowed.
#
# Critical: include your own operator key here so nGate can't accidentally
# lock you out if your v4call-server post temporarily fails verification.

your_operator_hex_pubkey_here # @noblemage's nostr key

If you've been running stage 1 with 3 manual keys, you might want all 3 as
seeds initially. Worst case is one extra entry in the whitelist; not a
correctness problem.

== Step 7: Configure ngate.yaml ==

Open the YAML config and edit for your relay:

nano /opt/nostr-relay/ngate.yaml

The defaults are sensible. Key fields to customise:

* <code>instance_name</code> — appears in logs. e.g. <code>nostr-hive-book</code>.
* <code>scan_interval_seconds</code> — default 21600 (6 hours). If you
want faster updates and don't mind the Hive RC, drop to 3600 (1 hour).
* <code>gate.account</code> — <code>escrow</code> (default; gates the
operational account that holds caller funds) or <code>hive_account</code>
(gates the announce-signing account).
* <code>gate.min_hp</code> — minimum HP staked. <code>3</code> is a fine
test threshold. Production servers might want 30+.
* <code>gate.min_token_*</code> — leave blank to disable; set to a
Hive-Engine token symbol + amount if you want token-gating.
* <code>max_consecutive_failures</code> — 3 = ~18 hours of absence before
remove. Keep default unless you have a reason.
* <code>restart_command</code> — default <code>docker restart nostr-relay</code>
matches the container_name in your docker-compose.yml. Don't change
unless you renamed the relay container.
* <code>paths.*</code> — only change if you put nGate somewhere other than
<code>/opt/nostr-relay/</code>.

== Step 8: Dry-run the chain ==

Before turning the sidecar loose, run the full pipeline manually in
<code>--dry-run</code> mode (no writes, no restarts):

cd /opt/nostr-relay
./scripts/ngate-scan.sh 2>/dev/null \
| ./scripts/ngate-verify.sh 2>&1 \
| NGATE_MIN_HP=3 ./scripts/ngate-gate.sh 2>&1 \
| ./scripts/ngate-apply.sh

Expected stderr output sequence:

* <code>ngate-scan:</code> ok, N posts
* <code>ngate-verify:</code> OK / REJECT / skip for each candidate
* <code>ngate-gate:</code> OK / REJECT for each verified candidate
* <code>ngate-apply:</code> seed: X loaded, current: Y in whitelist, stdin:
Z passed, summary: add=… keep=… tolerate=… remove=… → DRY RUN, no
files changed.

Read the output. Check that:

* Your own operator key is in the SEED count.
* Your v4call-server post (if you have one) appears as OK in verify and
passes the gate (or fails for an understandable reason).
* The summary "new whitelist size" looks plausible.
* config.toml hasn't been modified (<code>cat config.toml</code> shows the
same content as after bootstrap).

If anything looks off, fix it (re-sign + re-announce, adjust ngate.yaml,
adjust seed.toml) before going live.

== Step 9: Merge sidecar into docker-compose.yml ==

Your stage-1 <code>docker-compose.yml</code> already has the <code>nostr-relay</code>
and <code>caddy</code> services. The nGate sidecar adds a third. Open both
files:

nano /opt/nostr-relay/docker-compose.yml
# In another terminal:
cat /opt/nostr-relay/src/docker-compose.example.yml

Copy the <code>ngate-sync</code> service block from the example into your
real <code>docker-compose.yml</code>. The block looks like:

services:
# ... your existing nostr-relay + caddy services ...

ngate-sync:
build:
context: .
dockerfile: src/scripts/Dockerfile
container_name: ngate-sync
restart: unless-stopped
volumes:
- ./src/scripts:/app/scripts
- ./ngate.yaml:/app/ngate.yaml:ro
- ./seed.toml:/app/seed.toml:ro
- ./config.toml:/app/config.toml
- ./state.json:/app/state.json
- /var/run/docker.sock:/var/run/docker.sock
environment:
- NGATE_YAML=/app/ngate.yaml
depends_on:
- nostr-relay
networks:
- relaynet

(Note: <code>./src/scripts</code> instead of <code>./scripts</code> because
we kept the cloned repo at <code>src/</code> and symlinked. If you did it
differently, adjust the volume paths.)

Make sure to pre-create the state.json so the bind-mount works:

echo '{"last_run":"","last_apply":"","restart_log":[],"candidates":{}}' > /opt/nostr-relay/state.json

'''⚠ Security note''': the sidecar mounts <code>/var/run/docker.sock</code>
so it can <code>docker restart nostr-relay</code>. This gives the sidecar
container effective root on the host. Acceptable on a single-purpose relay
box. NOT acceptable on a multi-tenant machine. If that bothers you, set
<code>restart_command</code> in <code>ngate.yaml</code> to a noop (e.g.
<code>true</code>) and restart the relay manually after each cycle —
configuration writes still work; only the restart is skipped.

== Step 10: Build and start the sidecar ==

cd /opt/nostr-relay
docker compose build ngate-sync
docker compose up -d ngate-sync

First build downloads node:20-alpine + yq + docker-cli (~150MB). Subsequent
builds are fast (cached layers). On startup the sidecar runs
<code>npm install</code> inside the bind-mounted scripts dir if
<code>node_modules</code> isn't present — should be quick if you already
ran step 4.

Check the container's running:

docker compose ps ngate-sync

Should show <code>Up</code>.

== Step 11: Watch a cycle ==

Tail the logs:

docker compose logs -f ngate-sync

The sidecar runs ONE cycle immediately at startup, then sleeps for
<code>scan_interval_seconds</code> between cycles. The first cycle should
show:

[2026-05-13T…] [nostr-hive-book] starting ngate-sync instance=… interval=21600s …
[2026-05-13T…] [nostr-hive-book] ─── cycle starting ───
ngate-scan: trying https://api.hive.blog …
ngate-scan: ok, N posts
ngate-scan: scan complete
ngate-verify: OK @cnoobs/call.completenoobs.com — Hive sig + Nostr attestation valid …
ngate-verify: OK @v4call/v4call.com — Hive sig + Nostr attestation valid …
ngate-verify: OK @hive-book/hive-book.com — Hive sig + Nostr attestation valid …
ngate-gate: config: account=escrow mode=or hp_enabled=1 (>=3, delegated=false) …
ngate-gate: OK @cnoobs/… — passed via hp hp=…
ngate-gate: complete — total=3 passed=3 rejected=0 errors=0
ngate-apply: seed: 1 pubkey(s) loaded from /app/seed.toml
ngate-apply: current: 3 pubkey(s) in /app/config.toml whitelist
ngate-apply: stdin: 3 candidate(s) passed gate this run
ngate-apply: summary: add=… keep=… tolerate=0 remove=0 seed=1 → new whitelist size = …
ngate-apply: ✓ wrote new whitelist to /app/config.toml
ngate-apply: restarting relay: docker restart nostr-relay
ngate-apply: ✓ restart succeeded
[2026-05-13T…] [nostr-hive-book] ─── cycle complete (apply ok) ───
[2026-05-13T…] [nostr-hive-book] sleeping 21600s until next cycle

After this, your <code>config.toml</code>'s nGate-managed block should
reflect the discovered+gated set.

Verify the relay still works:

docker compose ps nostr-relay # Up
# From your laptop:
nak req -k 1 -a YOUR_HEX wss://nostr.YOUR-DOMAIN

If it returns events, the restart worked cleanly.

== Step 12: Routine monitoring ==

;'''Status snapshot'''
:From inside the sidecar:
: <code>docker compose exec ngate-sync /app/scripts/ngate-status.sh</code>
:Or from the host (env-vars on the command):
:
: NGATE_YAML=/opt/nostr-relay/ngate.yaml \
: NGATE_STATE_PATH=/opt/nostr-relay/state.json \
: NGATE_CONFIG_PATH=/opt/nostr-relay/config.toml \
: NGATE_SEED_PATH=/opt/nostr-relay/seed.toml \
: /opt/nostr-relay/scripts/ngate-status.sh

;'''Logs'''
:* <code>docker compose logs -f ngate-sync</code> — live stream
:* <code>tail -F /opt/nostr-relay/ngate-sync.log</code> — bind-mounted host file

;'''Manual sync'''
:If you want a fresh cycle right now (don't wait 6 hours):
: <code>docker compose exec ngate-sync /app/scripts/ngate-sync.sh --once</code>
:Or restart the sidecar (runs one cycle on startup):
: <code>docker compose restart ngate-sync</code>

;'''Inspect state.json'''
:Shows per-key first-seen, last-seen, consecutive_misses, source
:(discovery|seed|removed):
: <code>jq . /opt/nostr-relay/state.json</code>

== Updating nGate ==

When the repo updates:

cd /opt/nostr-relay/src
git pull
cd scripts && npm install # in case dep versions changed
cd /opt/nostr-relay
docker compose build ngate-sync # only needed if Dockerfile changed
docker compose restart ngate-sync

The scripts dir is bind-mounted, so script-only changes take effect on next
sync without rebuild. Restart picks them up immediately.

== Known gotchas ==

;'''"Keychain not detected" in server-announce''' (browser-side, not nGate)
:Some browsers don't expose <code>window.hive_keychain</code> even with the
:extension installed (iOS Safari, Brave on iOS, etc.). server-announce.html
:has a posting-key paste fallback that uses dhive to broadcast directly —
:scroll past the Keychain button to the "POSTING KEY PASTE" section. Key
:never leaves your browser.

;'''nGate-verify rejects with "no nostr_attestation in well-known OR post"'''
:Your v4call-server post is pre-attestation, OR the well-known doesn't have
:the <code>nostr_attestation</code> field, OR the post body doesn't have a
:<code>NOSTR-ATTESTATION:</code> base64 line. Re-sign in
:<code>server-sign.html</code> (Option B canonical) and re-announce. The
:full chain produces both the well-known field AND the post-body line in
:one signed event.

;'''nGate-verify rejects with "Hive signature DID NOT verify"'''
:Most common cause: signature was computed under a DIFFERENT canonical
:payload shape than what nGate-verify reconstructs. Re-sign with the
:current server-sign.html (which produces the Option B / SHORT canonical
:that nGate-verify and v4call's existing federation code both expect).

;'''nGate-verify rejects with "attestation v4call_hive_account tag (X) ≠ post's HIVE-ACCOUNT (Y)"'''
:You signed the attestation with one Hive account name (e.g.
:<code>hive-book</code>) but the Hive post declares a different one (e.g.
:<code>hive-book.com</code>). Re-sign with consistent values across the
:whole flow (server-sign → server-announce → Hive post).

;'''Sidecar can't restart relay ("permission denied" on docker.sock)'''
:Less common, but if the relay box has docker access locked down: either
:loosen perms on <code>/var/run/docker.sock</code> (default world-writable
:on most distros) OR change <code>restart_command</code> in ngate.yaml to
:a noop and restart the relay manually after each sync.

;'''Sidecar in a restart loop'''
:Probably an invalid <code>ngate.yaml</code> or missing
:<code>node_modules</code>. Check:
: <code>docker compose logs --tail=50 ngate-sync</code>
:The startup log shows YAML parse errors clearly. If
:<code>node_modules</code> is missing the sidecar will install it on first
:start; subsequent runs are fast.

;'''"Restart cap hit" in logs'''
:nGate refuses to restart the relay more than
:<code>max_restarts_per_day</code> times in 24h. If you see this
:repeatedly, something upstream is causing the whitelist to flap.
:Investigate state.json and check whether candidates are missing-then-back
:repeatedly (suggests Hive RPC flakiness or a v4call-server post
:disappearing temporarily).

;'''"Sanity bound triggered" in logs'''
:nGate refused to apply because the result would have removed every
:non-seed entry. Triggered when upstream had errors AND
:<code>--allow-removals</code> was somehow set. With the sidecar's
:PIPESTATUS-aware logic, this shouldn't happen in practice; if it does,
:check upstream phase exit codes.

== Removing nGate (back to manual whitelist) ==

If you want to disable nGate and go back to hand-editing
<code>config.toml</code>:

cd /opt/nostr-relay
docker compose down ngate-sync
docker compose rm -f ngate-sync

Then manually edit <code>config.toml</code>:

nano /opt/nostr-relay/config.toml

Either:

* Delete the BEGIN/END marker comments (keep the
<code>[authorization]</code> section between them as-is), OR
* Replace the entire managed block with a hand-curated whitelist.

Restart the relay to pick up the new config:

docker compose restart nostr-relay

The relay reads <code>config.toml</code> on startup regardless of markers.
nGate's markers are JUST for nGate's internal "what to manage" logic; the
relay itself ignores them as TOML comments.

== When you're done ==

After 24 hours of clean runs, nGate has handled at least one normal cycle
(scan + verify + gate + maybe-apply). At that point you can:

* Stake some HIVE on your test operator to confirm a transition (off-gate
→ passing the gate after stake).
* Publish a v4call-server post for a new operator and watch it get picked
up on the next cycle.
* Deploy nGate to your second relay box (nostr.v4call.com) with a
staggered scan time (set <code>scan_interval_seconds</code> the same but
schedule the startup at a different time of day for faster
federation-wide pickup).

For the next phase of work (stage 3.6 refinements + stage 4 strfry
migration), see [[STATUS.md]] in the nGate repo.

V4call-server-data-flow

AwesomO — Tue, 26 May 2026 00:36:05 GMT

Created page with "{{:LICENCE_HEADER_MIT}} = v4call Server Data Flow — Sign, Announce, Verify, Gate — A Noob Reference = From CompleteNoobs A clear-cut reference for which value goes in which field across <code>server-sign.html</code>, <code>server-announce.html</code>, the <code>/.well-known/v4call-server.json</code> file, the Hive announce post, and the four nGate scripts. Use this when you're not 100% sure what to type into a form, or when nGate-verify gives you an error and you..."

New page

{{:LICENCE_HEADER_MIT}}

= v4call Server Data Flow — Sign, Announce, Verify, Gate — A Noob Reference =

From CompleteNoobs

A clear-cut reference for which value goes in which field across <code>server-sign.html</code>, <code>server-announce.html</code>, the <code>/.well-known/v4call-server.json</code> file, the Hive announce post, and the four nGate scripts. Use this when you're not 100% sure what to type into a form, or when nGate-verify gives you an error and you don't know which value caused it.

This doc complements [[Nostr_Relay_With_a_3-Key_Whitelist|stage 1]], [[Nostr_Hands-On|stage 2]], and [[NGate_—_Auto-Whitelist_a_Nostr_Relay|stage 3]] — it's not a phase, it's a "wait, I'm confused, what's what?" reference you can flip to any time.

== The single biggest source of confusion: '''3 different "accounts"''' ==

These are three '''separate''' things. They might happen to share names. They are not the same.

{| class="wikitable"
! Thing !! Example !! What it is !! Where it lives
|-
| '''HIVE ACCOUNT''' || <code>cnoobs</code> || A Hive blockchain account. Has a posting key, an active key, and an owner key. Signs the announce post. || On Hive (chain). Resolved by name lookup.
|-
| '''ESCROW ACCOUNT''' || <code>cnoobs-escrow</code> || ANOTHER Hive blockchain account, used by v4call-server to hold caller funds during paid calls. Its active key must be in <code>V4CALL_ESCROW_KEY</code> on the v4call server. Default nGate gate target. || On Hive (chain). Different from the HIVE ACCOUNT above. Could be the same account, but usually isn't (operational separation).
|-
| '''DOMAIN''' || <code>call.completenoobs.com</code> || An '''internet hostname'''. Has DNS records. Hosts your v4call server's HTTPS endpoint AND the <code>.well-known/v4call-server.json</code> file. || In DNS. Has nothing to do with Hive — domains are not blockchain accounts.
|}

'''Common confusion patterns''' from real test sessions:
* Putting <code>call.completenoobs.com</code> (a domain) into the HIVE ACCOUNT field. Hive accounts don't have dots-and-tlds; <code>call.completenoobs.com</code> is the DOMAIN field.
* Putting <code>hive-book.com</code> (the domain) into the HIVE ACCOUNT field, signing it, and ending up with a well-known that says <code>"hive_account": "hive-book.com"</code>. nGate-verify catches it and rejects.
* Staking HP on <code>v4call</code> (the announcing HIVE ACCOUNT) when the gate is checking <code>v4call-escrow</code> (the escrow). Staking on the wrong account ≠ staking.

== The data flow (what goes where) ==

┌──────────────────────────────────────────────────────────────────────────┐
│ YOU (operator) │
│ Decide your 3 accounts + your domain first │
└────────────────────────────┬─────────────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ Step 1 — server-sign.html │
│ │
│ You fill in the IDENTITY card and SERVER CONFIG card and (optionally) │
│ the NOSTR card. Then click "Sign with Hive Keychain". │
│ │
│ KEYCHAIN signs a "|"-joined canonical string with the HIVE ACCOUNT's │
│ posting key. Output is a single signed JSON file. │
└────────────────────────────┬─────────────────────────────────────────────┘
│
│ Download JSON →
│ deploy to server's filesystem at
│ /public/.well-known/v4call-server.json
│ Rebuild + restart the v4call container.
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ https://YOUR-DOMAIN/.well-known/v4call-server.json │
│ │
│ Anyone in the world can fetch this. It's the cryptographic ground │
│ truth: "This Hive account vouches for this domain." │
└────────────────────────────┬─────────────────────────────────────────────┘
│
│ "Next step →" link in server-sign.html
│ opens server-announce.html with all the
│ same fields prefilled via querystring
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ Step 2 — server-announce.html │
│ │
│ Fields are auto-filled from server-sign. Verify they match. Click │
│ "Post to Hive". KEYCHAIN signs a Hive post broadcast. │
└────────────────────────────┬─────────────────────────────────────────────┘
│
│ Hive consensus stores the post forever.
│ Tagged "v4call-server".
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ HIVE BLOCKCHAIN — the public directory of v4call servers │
│ │
│ Other nGate operators query this for new candidates. │
└────────────────────────────┬─────────────────────────────────────────────┘
│
│ ngate-scan.sh queries Hive
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ ngate-scan.sh — Phase 3.1 │
│ │
│ Reads each post's V4CALL-SERVER-V1 block, emits NDJSON candidate. │
└────────────────────────────┬─────────────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ ngate-verify.sh — Phase 3.2 │
│ │
│ For each candidate, fetches the well-known JSON and runs FIVE checks: │
│ ───────────────────────────────────────────────────────────────────── │
│ │
│ ① Reachable: HTTPS GET of verify_url returns 200 + parses as JSON │
│ ② Schema: well-known has claim, signature, hive_account, nonce │
│ ③ HIVE-ACCOUNT cross-check: │
│ well-known.hive_account == post's HIVE-ACCOUNT field │
│ ④ NOSTR-HEX cross-check (defense in depth, optional): │
│ well-known.nostr_hex == post's NOSTR-PUBKEY-HEX (if both present) │
│ ⑤ SIGNATURE cross-check: │
│ fetches HIVE-ACCOUNT's posting pubkey from Hive, │
│ reproduces canonical "|"-joined payload from well-known fields, │
│ verifies signature using @hiveio/dhive │
└────────────────────────────┬─────────────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ ngate-gate.sh — Phase 3.3 │
│ │
│ For each verified candidate, picks the gate target: │
│ • NGATE_GATE_ACCOUNT=escrow (default) → checks ESCROW account │
│ • NGATE_GATE_ACCOUNT=hive_account → checks HIVE-ACCOUNT │
│ │
│ Fetches HP from Hive, fetches token balance from Hive-Engine, │
│ applies thresholds and OR/AND mode, emits passing candidates. │
└──────────────────────────────────────────────────────────────────────────┘

== server-sign.html — field-by-field reference ==

What to put in each field, what value type, where it ends up. Every field is in BOTH the signed JSON AND (later, by querystring chain) the announce post.

{| class="wikitable"
! Field !! Type !! Example !! ⚠ Common mistakes
|-
| HIVE ACCOUNT (the one that signs) || Hive account name || <code>cnoobs</code> || ❌ Putting the domain (<code>cnoobs.com</code>). ❌ Putting an email. ❌ Putting a Nostr npub.
|-
| DOMAIN || Hostname (no scheme, no path) || <code>call.completenoobs.com</code> || ❌ Adding <code>https://</code> or trailing slash. ❌ Putting a Hive account name.
|-
| ESCROW ACCOUNT || Hive account name || <code>cnoobs-escrow</code> || ❌ Same as HIVE ACCOUNT (allowed but not recommended — operational separation matters). ❌ Putting an account whose active key isn't on the v4call server.
|-
| FEE ACCOUNT || Hive account name || <code>cnoobs</code> || Often same as HIVE ACCOUNT. ❌ A different chain's account.
|-
| FEDERATION-WS || WebSocket URL || <code>wss://call.completenoobs.com/federation</code> || ❌ Missing <code>wss://</code>. ❌ Wrong domain. ❌ Forgetting <code>/federation</code>.
|-
| NOSTR PUBKEY (npub) || Bech32 string starting <code>npub1</code> || <code>npub1cxgaen…q57qw3d</code> || ❌ Pasting an nsec (the secret key — never paste secrets into form fields you didn't write yourself). ❌ Pasting hex into the npub field (use the auto-sync — it'll auto-fill).
|-
| NOSTR PUBKEY (hex) || 64-char lowercase hex || <code>c191dccd…1ba12c</code> || ❌ Uppercase. ❌ Wrong length. (Auto-fills if you typed a valid npub above.)
|-
| NOSTR RELAY 1–5 || WebSocket URLs || <code>wss://nostr.v4call.com</code> || ❌ Missing <code>wss://</code>. (Slots 3–5 left blank are silently skipped.)
|-
| ISSUED || Auto-filled || timestamp at sign time || (Don't touch — auto-filled by server-sign.)
|-
| NONCE || Auto-filled || random hex || (Don't touch — auto-filled.)
|-
| EXPIRES || Optional date || <code>2027-01-01</code> || (Most operators leave blank. Set only if you have a specific rotation schedule.)
|}

After signing, you '''download''' the signed JSON and '''deploy''' it to:
* The v4call repo's <code>public/.well-known/v4call-server.json</code> (overwriting the placeholder).
* Rebuild + restart: <code>docker compose down && docker compose build --no-cache && docker compose up -d</code>.
* Test reachable: <code>curl https://YOUR-DOMAIN/.well-known/v4call-server.json</code> should return your file.

== server-announce.html — field-by-field reference ==

server-announce auto-fills from server-sign's "Next step →" link. Verify the prefilled fields match what you signed. Don't post mismatched data.

{| class="wikitable"
! Field !! Same as server-sign? !! Why it's here too
|-
| HIVE ACCOUNT (poster) || YES — must match || Hive consensus needs to know who's authoring this post.
|-
| DOMAIN || YES || nGate-scan reads this from the post; ngate-verify uses it to fetch the well-known.
|-
| ESCROW ACCOUNT || YES || Default gate target. Visible in the directory entry.
|-
| FEE ACCOUNT || YES || Visible in the directory entry. Informational.
|-
| FEDERATION-WS || YES || How peer servers connect for federation.
|-
| VERIFY URL (auto) || Auto-computed from DOMAIN || <code>https://DOMAIN/.well-known/v4call-server.json</code>.
|-
| SOFTWARE / PROTOCOL || Optional || Forks may put their own software name here.
|-
| NOSTR fields || YES (auto-filled from sign) || Optional. Lets nGate-scan pick up the Nostr key claim.
|-
| POST TAGS || <code>v4call-server, v4call, hive</code> || First tag MUST be <code>v4call-server</code> — that's what nGate-scan searches for.
|-
| INTRO PARAGRAPH || Optional human readable || Just the prose at the top of the post. Doesn't affect any field parsing.
|}

After clicking "Post to Hive" + Keychain confirm, the post is live on Hive. '''The post is permanent''' — Hive doesn't allow deletion. If you made a typo, you can publish a NEW post with the corrected fields; nGate-scan picks up the most recent one for each (account, domain) pair.

== What ends up in the signed JSON ==

The JSON file at <code>/.well-known/v4call-server.json</code>. Public, fetchable from anywhere, signed by your HIVE ACCOUNT's posting key.

{
"claim": "v4call-server-ownership", ← fixed string
"domain": "call.completenoobs.com", ← from DOMAIN
"hive_account": "cnoobs", ← from HIVE ACCOUNT
"escrow": "cnoobs-escrow", ← from ESCROW ACCOUNT
"fee_account": "cnoobs", ← from FEE ACCOUNT
"federation_ws": "wss://call.completenoobs.com/federation",
"issued": "2026-05-08T11:18:00Z", ← auto
"expires": "", ← optional
"nonce": "abc123def456", ← auto
"key_type": "posting", ← fixed
"signature": "1f4a3b…", ← Hive ECDSA signature

// Optional Nostr fields (only present if you filled the NOSTR card):
"nostr_npub": "npub1cxgaen…q57qw3d",
"nostr_hex": "c191dccd…1ba12c",
"nostr_relays": ["wss://nostr.v4call.com", "wss://nostr.hive-book.com"]
}

The signature is over a single canonical string built from these fields in a fixed order — server-sign.html computes it; nGate-verify reproduces it. If a single character of any signed field is different between the well-known and what was signed, verification fails.

== What ends up in the Hive post body ==

The announce post body has a markdown-code-block like this (4 leading spaces per line — that's how Hive renders the block):

[V4CALL-SERVER-V1]
DOMAIN: call.completenoobs.com ← from DOMAIN field
HIVE-ACCOUNT: cnoobs ← from HIVE ACCOUNT field
ESCROW: cnoobs-escrow ← from ESCROW ACCOUNT field
FEE-ACCOUNT: cnoobs ← from FEE ACCOUNT field
FEDERATION-WS: wss://call.completenoobs.com/federation
VERIFY-URL: https://call.completenoobs.com/.well-known/v4call-server.json
SOFTWARE: v4call
PROTOCOL: 0.3
NOSTR-PUBKEY: npub1cxgaen…q57qw3d ← from NOSTR NPUB field
NOSTR-PUBKEY-HEX: c191dccd…1ba12c ← from NOSTR HEX field
NOSTR-RELAYS: wss://nostr.v4call.com, wss://nostr.hive-book.com
DECLARED: 2026-05-08T11:18:30Z ← timestamp at post time
[/V4CALL-SERVER-V1]

ngate-scan reads exactly this block. Field names are matched case-sensitively after stripping leading whitespace. Lines that don't match a known field are ignored.

== What nGate-verify cross-checks (and what each rejection means) ==

In order — verify stops at the first failure for each candidate.

{| class="wikitable"
! Check !! Failure looks like !! Real-world cause !! Fix
|-
| Reachable + valid JSON || <code>could not fetch verify_url</code> || Domain not deployed yet, DNS not propagated, container not rebuilt after dropping in the new well-known file || Deploy the JSON, rebuild + restart container, test with curl
|-
| Schema fields exist || <code>well-known missing required fields</code> || Old or corrupted JSON file || Re-sign via server-sign.html, redeploy
|-
| Claim string == "v4call-server-ownership" || <code>wrong claim string</code> || Someone deployed a non-v4call signed JSON || (Won't happen if you used server-sign.html)
|-
| HIVE ACCOUNT match || <code>well-known hive_account (X) ≠ post's HIVE-ACCOUNT (Y)</code> || '''You typed a different value in the HIVE ACCOUNT field on server-sign vs. on server-announce''' (or you re-signed and forgot to re-announce) || Re-sign with the correct HIVE ACCOUNT, redeploy, re-announce
|-
| Nostr hex match (if both have it) || <code>well-known nostr_hex differs from post</code> || You signed with one Nostr key, then re-announced with a different one (typo or rotation) || Re-sign with the correct NOSTR HEX, redeploy, re-announce
|-
| Expires not in the past || <code>well-known expired at X</code> || You set an EXPIRES date that has already passed || Re-sign with a fresh ISSUED timestamp (and either no expiry or a future one)
|-
| Within-scan hex collision || <code>FORGERY-FLAG hex=… claimed by both @A and @B — both will be REJECTED</code> || Two operators announcing with the same Nostr hex (one is forged) || Both REJECTED on purpose. Only one operator should hold each Nostr keypair. Re-keying anyone caught in this is mandatory
|-
| Signature valid || <code>signature DID NOT verify</code> || The well-known was tampered with after signing, OR you signed with a different account's posting key by mistake || Re-sign via server-sign.html (fresh issued + nonce), redeploy
|}

== What nGate-gate looks at (and which account matters) ==

By default, nGate-gate checks the '''ESCROW account''', not the announcing HIVE ACCOUNT.

;Why escrow?
:Escrow is the operational account — it actually moves money during paid calls. Gating on its HP/RC enforces "this server can actually operate," not just "the operator owns a Hive account."

;When you'd switch to <code>NGATE_GATE_ACCOUNT=hive_account</code>:
* Testing with a token gate where the HIVE-ACCOUNT holds the test tokens but the escrow doesn't (e.g. CNOOBS).
* Specific governance use cases where the announcer's reputation matters more than the operational account's solvency.

;'''Worked example from a real test session''' (yours):
* You staked 3 HP on <code>v4call</code> (the HIVE-ACCOUNT).
* nGate-gate's default = check ESCROW = <code>v4call-escrow</code>.
* <code>v4call-escrow</code> still has 0 HP.
* Result: rejected with <code>gate→@v4call-escrow … hp=0.000/3=false</code>.
* Fix A (no Hive transactions): <code>NGATE_GATE_ACCOUNT=hive_account NGATE_MIN_HP=3 ./ngate-gate.sh</code> → checks <code>v4call</code>'s HP, passes.
* Fix B (matches default architecture): Power Up 3 HIVE on <code>v4call-escrow</code> directly.

== Common mistakes — based on real test sessions ==

;'''Mistake #1: Putting the domain in HIVE ACCOUNT'''
:Result: well-known has <code>"hive_account": "your-domain.com"</code>. nGate-verify rejects with <code>well-known hive_account (your-domain.com) ≠ post's HIVE-ACCOUNT (your-account)</code>.
:Fix: server-sign.html with HIVE ACCOUNT = <code>your-account</code> (just the Hive name, no .com).

;'''Mistake #2: Staking HP on the wrong account'''
:Result: gate fails for an operator you'd expect to pass.
:Fix: read the <code>(gate→@account)</code> in the rejection — it tells you which account was checked. Stake there, OR change <code>NGATE_GATE_ACCOUNT</code>.

;'''Mistake #3: Not re-announcing after re-signing'''
:Result: well-known has updated fields, but the post on Hive still has the old ones. nGate-verify cross-checks see a mismatch.
:Fix: '''always do server-sign + server-announce together as a pair'''. The "Next step →" button on server-sign goes to server-announce with prefilled fields exactly to keep these in sync.

;'''Mistake #4: Pre-Nostr announce posts still in the scan window'''
:Symptom: <code>skip @user/domain — no nostr_pubkey_hex (pre-Nostr announce; not an error)</code>.
:Cause: you announced before nostr fields were added; the old post still appears in Hive's recent-20 query.
:Fix: nothing required. Each operator only needs ONE current announce; older posts age out. If you want the relay to stop seeing them sooner, just publish a fresh announce — your latest takes precedence in Hive's recent-by-created order.

;'''Mistake #5: Signing without rebuilding the container'''
:Result: deployed the new well-known JSON to disk but the v4call Docker container still serves the old one (Docker images bake in static files at build time).
:Fix: <code>docker compose down && docker compose build --no-cache && docker compose up -d</code> after every well-known change.

;'''Mistake #6: Posting before deploying the well-known'''
:Result: announce post is live on Hive; nGate-scan picks it up; nGate-verify tries to fetch the well-known and gets a 404 → rejection.
:Fix: deploy + rebuild + verify with curl FIRST, then announce. Or fix the well-known and wait for the next scan cycle — eventual consistency.

;'''Mistake #7: Staking "exactly N HIVE" but the gate at <code>NGATE_MIN_HP=N</code> still fails'''
:Symptom: <code>REJECT … gate failed hp=2.999/3=false</code> (or some near-round-number mismatch).
:Cause: HIVE → VESTS → HP round-trip uses 6-decimal vesting math. Staking exactly 3 HIVE can land at 2.999something HP, not exactly 3.000. The gate's comparison is correct (<code>>=</code> not <code>></code>), but the input itself is just slightly under the threshold.
:Fix A: Stake slightly above the threshold (e.g. 4 HIVE for a <code>NGATE_MIN_HP=3</code> gate).
:Fix B: Set the threshold slightly below the stake (e.g. <code>NGATE_MIN_HP=2.5</code>).
:Both work. The first feels "rounder" to the operator; the second uses fewer HIVE. Either is fine.

;'''Mistake #8 — a transient Hive RPC outage shows up as an ERROR line'''
:Symptom: <code>ngate-gate: ERROR … HP fetch failed (transient Hive RPC); not passing</code> on one or more candidates, with the run summary showing <code>errors=1</code>+.
:Cause: Hive node didn't respond before the script's timeout. Not your fault; not a config bug.
:What happens: that candidate is treated as "not passing" for THIS run, so it doesn't get added/refreshed. The script exits with code 2 (partial fetch errors). Phase 3.4 reads this exit code and refuses to REMOVE any existing entries from the whitelist — so a single bad cycle can't kick legitimate operators off your relay.
:Fix: nothing required. Re-run when Hive is healthy. The "ADD-only on partial failure" rule is the design's safety net; this output is what it looks like working.

== Clean-redo checklist ==

If you're re-doing an operator's announce and want to be sure each step is correct, follow this exact order. Tick them off mentally as you go.

# '''☐ Confirm your three accounts and one domain''' on a piece of paper:
#: HIVE ACCOUNT = ___________________ (e.g. <code>cnoobs</code>, no <code>.com</code>)
#: ESCROW ACCT = ___________________ (e.g. <code>cnoobs-escrow</code>, no <code>.com</code>)
#: FEE ACCT = ___________________ (often same as HIVE ACCOUNT)
#: DOMAIN = ___________________ (e.g. <code>call.completenoobs.com</code>, no scheme/path)
#: NOSTR NPUB = ___________________ (from <code>nostr-gen.html</code>)
# '''☐ Open server-sign.html'''. Fill the IDENTITY card, SERVER CONFIG card, and (optionally) NOSTR card with the values above. Verify each line of the form against your paper.
# '''☐ Click "Sign with Hive Keychain"'''. Confirm in Keychain.
# '''☐ Download the signed JSON'''. Open it in a text editor. Eyeball the top fields — they should match your paper.
# '''☐ Deploy the JSON to your v4call repo''' at <code>public/.well-known/v4call-server.json</code> (overwriting whatever was there).
# '''☐ Rebuild + restart''' your v4call container: <code>docker compose down && docker compose build --no-cache && docker compose up -d</code>.
# '''☐ Test reachability''': <code>curl https://YOUR-DOMAIN/.well-known/v4call-server.json</code> on your laptop. Should return the same JSON you just deployed.
# '''☐ Click the "Next step →" link''' on server-sign.html (it auto-opens server-announce.html with all fields prefilled from the querystring). Verify the prefilled fields match your paper.
# '''☐ Click "Post to Hive"'''. Confirm in Keychain. Wait for the success banner.
# '''☐ Verify end-to-end''': from your laptop, run <code>./nGate/scripts/ngate-scan.sh | ./nGate/scripts/ngate-verify.sh</code>. Look for <code>OK @your-account/your-domain — signature valid</code>.
# '''☐ Test the gate''': <code>./ngate-scan.sh | ./ngate-verify.sh | NGATE_MIN_HP=3 ./ngate-gate.sh</code>. Read the <code>(gate→@account)</code> on each rejection — that's the account whose HP it's checking. Stake there OR pick a different gate target.

If anything fails, the rejection message tells you which check failed — see "What nGate-verify cross-checks" or "What nGate-gate looks at" above for the recipe.

== Quick reference card ==

Print this. Tape it next to your monitor while doing operator work.

╔══════════════════════════════════════════════════════════════════════╗
║ v4call ANNOUNCE QUICK REFERENCE ║
╠══════════════════════════════════════════════════════════════════════╣
║ ║
║ 3 ACCOUNTS + 1 DOMAIN — these are NOT the same thing: ║
║ ║
║ HIVE ACCOUNT → signs the announce (e.g. cnoobs) ║
║ ESCROW ACCT → holds funds, gate target (e.g. cnoobs-escrow) ║
║ FEE ACCT → receives platform fees (often = HIVE ACCT) ║
║ DOMAIN → internet hostname (call.completenoobs.com)║
║ ║
║ ALWAYS DO TOGETHER (one breaks if you skip the other): ║
║ ║
║ server-sign.html ─→ deploy + rebuild ─→ server-announce.html ║
║ ║
║ STAKING FOR THE GATE — stake on the right account: ║
║ ║
║ NGATE_GATE_ACCOUNT=escrow (default) → stake on ESCROW ║
║ NGATE_GATE_ACCOUNT=hive_account → stake on HIVE ACCT ║
║ ║
║ WHEN VERIFY FAILS — read the rejection reason: ║
║ ║
║ "well-known hive_account (X) ≠ post's HIVE-ACCOUNT (Y)" ║
║ → typo on one of the two; re-sign with correct value ║
║ ║
║ "signature DID NOT verify" ║
║ → well-known tampered with OR signed by wrong account ║
║ → re-sign cleanly ║
║ ║
║ "could not fetch verify_url" ║
║ → JSON not deployed OR container not rebuilt ║
║ → docker compose down/build/up, curl-test from laptop ║
║ ║
║ "skip … no nostr_pubkey_hex" ║
║ → pre-Nostr announce, harmless, ignore ║
║ ║
║ DEFAULT GATE TARGET: ║
║ ║
║ Escrow account. (Operational solvency check.) ║
║ To check announcing account instead: ║
║ NGATE_GATE_ACCOUNT=hive_account ║
║ ║
╚══════════════════════════════════════════════════════════════════════╝

COMPLETENOOBS FUNDING

Noob — Fri, 22 May 2026 13:12:26 GMT

← Older revision		Revision as of 13:12, 22 May 2026
Line 2:		Line 2:

	Bitcoin: "19S2thMqbYhwB6doLYQamStkzEyuqZs5Yn"		Bitcoin: "19S2thMqbYhwB6doLYQamStkzEyuqZs5Yn"

			Bitcoin lightning: completenoobs@fountain.com

	Hive: cnoobs		Hive: cnoobs