Add SERVICE_URL env var to fix NIP-98 auth behind reverse proxy

When running behind a reverse proxy that terminates TLS, khatru
auto-detects ws:// instead of wss://, causing NIP-98 "u" tag
validation to fail. SERVICE_URL overrides the auto-detected URL.

.env.example

@@ -9,6 +9,9 @@ NAME=Standard Relay
 DESCRIPTION=A standard Nostr relay with NIP-86 management API
 ICON=
 
+# Public-facing URL (set when behind a reverse proxy to fix NIP-98 auth)
+# SERVICE_URL=wss://your-relay.example.com
+
 # Server configuration
 PORT=3334
 DB_PATH=./data/relay.db

README.md

@@ -19,6 +19,7 @@ A standard Nostr relay with NIP-86 Management API support built on [khatru](http
 | `NAME` | Relay name (NIP-11) | `Standard Relay` |
 | `DESCRIPTION` | Relay description (NIP-11) | Empty |
 | `ICON` | Relay icon URL (NIP-11) | Empty |
+| `SERVICE_URL` | Public-facing WebSocket URL (e.g. `wss://your-relay.example.com`). Set when behind a reverse proxy so NIP-98 auth uses the correct URL | auto-detected |
 | `PORT` | HTTP server port | `3334` |
 | `DB_PATH` | Path to BoltDB database file | `./data/relay.db` |
 | `ALLOWLIST_MODE` | Enable allowlist mode (`true`/`false`) | `false` |

main.go

@@ -52,6 +52,9 @@ func main() {
 
 	// Create relay
 	relay := khatru.NewRelay()
+	if serviceURL := os.Getenv("SERVICE_URL"); serviceURL != "" {
+		relay.ServiceURL = serviceURL
+	}
 
 	// Relay info from environment
 	relay.Info.Name = getEnvOrDefault("NAME", "Standard Relay")