{"record":{"id":"49bad9a66c1211bf","repo":"block/buzz","slug":"buzz-relay-private-key-is-required-when-buzz-requi","errorCode":null,"errorMessage":"BUZZ_RELAY_PRIVATE_KEY is required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true. NIP-43 events signed with an ephemeral key become unverifiable after restart.","messagePattern":"BUZZ_RELAY_PRIVATE_KEY is required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true\\. NIP-43 events signed with an ephemeral key become unverifiable after restart\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/buzz-relay/src/main.rs","lineNumber":333,"sourceCode":"    // NIP-43: if membership enforcement is on, a valid owner pubkey is required.\n    // config.rs already strips invalid values with a warning; catch the resulting\n    // None here so we fail fast with a clear message rather than starting a relay\n    // that no one can administer.\n    if config.require_relay_membership && config.relay_owner_pubkey.is_none() {\n        error!(\n            \"BUZZ_REQUIRE_RELAY_MEMBERSHIP=true but RELAY_OWNER_PUBKEY is not set or invalid. \\\n             Set RELAY_OWNER_PUBKEY to a valid 64-char hex pubkey.\"\n        );\n        return Err(anyhow::anyhow!(\n            \"RELAY_OWNER_PUBKEY required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true\"\n        ));\n    }\n\n    // NIP-43: relay membership requires a stable signing key.\n    // Check this before any DB mutations so we fail fast — no point backfilling\n    // or bootstrapping if we'll reject the config anyway.\n    if config.require_relay_membership && config.relay_private_key.is_none() {\n        return Err(anyhow::anyhow!(\n            \"BUZZ_RELAY_PRIVATE_KEY is required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true. \\\n             NIP-43 events signed with an ephemeral key become unverifiable after restart.\"\n        ));\n    }\n\n    // NIP-43 / multi-tenant: seed the deployment's *own* community before any\n    // membership backfill or owner bootstrap, so those writes are scoped to a\n    // real `(community_id, pubkey)` and not a global pubkey. The host is derived\n    // from `relay_url` with the *same* normalization request resolution uses\n    // (`relay_url_authority` → `normalize_host`), so the bootstrapped owner lands\n    // in exactly the community that live requests for this host will resolve to.\n    //\n    // `ensure_configured_community` is idempotent, so this is safe to run every\n    // startup. An empty authority (unparseable `relay_url`)\n    // is a misconfiguration — fail fast when membership is enforced rather than\n    // seeding an empty-host community that no request can ever resolve to.\n    let deployment_community = {\n        let host = buzz_relay::tenant::relay_url_authority(&config.relay_url);","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/block/buzz/blob/ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be/crates/buzz-relay/src/main.rs#L315-L351","documentation":"Fatal startup error: BUZZ_REQUIRE_RELAY_MEMBERSHIP=true but BUZZ_RELAY_PRIVATE_KEY is unset. Membership enforcement means the relay signs NIP-43 membership events, and events signed with an ephemeral, in-memory key become unverifiable after restart — so the relay refuses to boot without a stable key. The check runs before any DB mutation.","triggerScenarios":"Enabling BUZZ_REQUIRE_RELAY_MEMBERSHIP=true without also setting BUZZ_RELAY_PRIVATE_KEY, or the secret failing to reach the process (empty env var from a misconfigured secret mount).","commonSituations":"Hardening an existing deployment by turning membership enforcement on but forgetting the signing key; Kubernetes secret not mounted; CI env dropped between jobs.","solutions":["Generate a stable key: openssl rand -hex 32","Set BUZZ_RELAY_PRIVATE_KEY to that 64-hex value in the relay's environment/secret manager and restart","Keep the same value across restarts and replicas of the same deployment — rotating it invalidates previously signed NIP-43 events","For dev without enforcement, BUZZ_REQUIRE_RELAY_MEMBERSHIP=false avoids the requirement"],"exampleFix":"# before\nexport BUZZ_REQUIRE_RELAY_MEMBERSHIP=true\n# BUZZ_RELAY_PRIVATE_KEY unset\n\n# after\nexport BUZZ_REQUIRE_RELAY_MEMBERSHIP=true\nexport BUZZ_RELAY_PRIVATE_KEY=$(openssl rand -hex 32)  # store durably, reuse every boot","handlingStrategy":"validation","validationCode":"# Deploy-time guard when membership enforcement is on:\nif [ \"${BUZZ_REQUIRE_RELAY_MEMBERSHIP:-false}\" = \"true\" ]; then\n  : \"${BUZZ_RELAY_PRIVATE_KEY:?BUZZ_RELAY_PRIVATE_KEY required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true}\"\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate the key once (openssl rand -hex 32) and store it durably — every restart must reuse it","Never let the relay fall back to an ephemeral key under NIP-43: signed events become unverifiable","Keep the key identical across replicas of the same deployment"],"tags":["config","environment","nip-43","signing-key","startup","buzz-relay"],"backgroundTag":"missing-env-var","analyzedSha":"ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be","analyzedAt":"2026-08-20T04:38:24.874Z","contentChangedAt":"2026-08-20T04:38:24.874Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}