S04-NS: Yes
Rationale
A participant-administered deployment can retain the selected two WSS relay paths and DNS hostnames without mandatory outside naming or certificate services. Unbound static local zones answer both positive and negative queries from maintained configuration, rather than a finite recursive cache. Pinned python-nostr forwards per-relay ssl_options to websocket-client; the latter accepts an explicit SSLContext and resolves the WSS hostname through the OS resolver. A local CA bundle, required certificate/hostname verification and TLS 1.3 can therefore be selected without a public CA. Nginx supports local certificate/key files and WebSocket Upgrade forwarding to each operator-controlled nostr-rs-relay. Participant administrators maintain DNS records, issue/renew certificates and distribute trust changes themselves.
Assessment method
Complete naming/trust administrative dependency trace; configured plausibility witness, no runtime certification
Source context
Pinned Nostr client and WebSocket source; authoritative Unbound, nginx and Python TLS documentation
Outstanding qualification
Conditional documentary deployment witness, not a performed integration test or default behavior of every Nostr client. Clients use participant resolvers with static records for both actual relay hostnames, no external resolver/proxy fallback, and locally administered TLS roots; certificate SANs match the names and validity is maintained with a local clock policy. Keep the two separate relay paths, regular NIP-01 events, existing in-memory/no-log profile and separate author contexts. Disable optional external NIP-05 validation, gRPC authorization, payments, NIP-42 and outsourced certificate automation. Public hostname/address allocation is still S03; global reachability and BGP are still G01. This does not replace a fixed public network with a private clone: the selected profile already specifies operator-controlled relays. No other cell or profile is changed.
Public sources
- https://nlnetlabs.nl/documentation/unbound/unbound.conf/
- https://raw.githubusercontent.com/jeffthibault/python-nostr/37cb66ba2d3968b2d75cc8ad71c3550415ca47fe/nostr/relay.py
- https://raw.githubusercontent.com/websocket-client/websocket-client/3dc494588c4bc6ca1cbb745e9d110108f6bf04f0/websocket/_http.py
- https://nginx.org/en/docs/http/ngx_http_ssl_module.html
- https://nginx.org/en/docs/http/websocket.html
- https://docs.python.org/3.12/library/ssl.html
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round329-sources.json
- round329-witness.json