v0.1.9 - program generates it's own private keys.

.gitignore

@@ -2,4 +2,5 @@ blossom/
 logs/
 nostr_core_lib/
 blobs/
+c-relay/
 

.test_keys

@@ -1,4 +1,4 @@
-ADMIN_PRIVKEY='31d3fd4bb38f4f6b60fb66e0a2e5063703bb3394579ce820d5aaf3773b96633f'
-ADMIN_PUBKEY='bd109762a8185716ec0fe0f887e911c30d40e36cf7b6bb99f6eef3301e9f6f99'
+ADMIN_PRIVKEY='22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd'
+ADMIN_PUBKEY='8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e'
 SERVER_PRIVKEY='c4e0d2ed7d36277d6698650f68a6e9199f91f3abb476a67f07303e81309c48f1'
 SERVER_PUBKEY='52e366edfa4e9cc6a6d4653828e51ccf828a2f5a05227d7a768f33b5a198681a'

42.md

@@ -1,109 +0,0 @@
-NIP-42
-======
-
-Authentication of clients to relays
------------------------------------
-
-`draft` `optional`
-
-This NIP defines a way for clients to authenticate to relays by signing an ephemeral event.
-
-## Motivation
-
-A relay may want to require clients to authenticate to access restricted resources. For example,
-
-  - A relay may request payment or other forms of whitelisting to publish events -- this can naïvely be achieved by limiting publication to events signed by the whitelisted key, but with this NIP they may choose to accept any events as long as they are published from an authenticated user;
-  - A relay may limit access to `kind: 4` DMs to only the parties involved in the chat exchange, and for that it may require authentication before clients can query for that kind.
-  - A relay may limit subscriptions of any kind to paying users or users whitelisted through any other means, and require authentication.
-
-## Definitions
-
-### New client-relay protocol messages
-
-This NIP defines a new message, `AUTH`, which relays CAN send when they support authentication and clients can send to relays when they want to authenticate. When sent by relays the message has the following form:
-
-```
-["AUTH", <challenge-string>]
-```
-
-And, when sent by clients, the following form:
-
-```
-["AUTH", <signed-event-json>]
-```
-
-Clients MAY provide signed events from multiple pubkeys in a sequence of `AUTH` messages. Relays MUST treat all pubkeys as authenticated accordingly.
-
-`AUTH` messages sent by clients MUST be answered with an `OK` message, like any `EVENT` message.
-
-### Canonical authentication event
-
-The signed event is an ephemeral event not meant to be published or queried, it must be of `kind: 22242` and it should have at least two tags, one for the relay URL and one for the challenge string as received from the relay. Relays MUST exclude `kind: 22242` events from being broadcasted to any client. `created_at` should be the current time. Example:
-
-```jsonc
-{
-  "kind": 22242,
-  "tags": [
-    ["relay", "wss://relay.example.com/"],
-    ["challenge", "challengestringhere"]
-  ],
-  // other fields...
-}
-```
-
-### `OK` and `CLOSED` machine-readable prefixes
-
-This NIP defines two new prefixes that can be used in `OK` (in response to event writes by clients) and `CLOSED` (in response to rejected subscriptions by clients):
-
-- `"auth-required: "` - for when a client has not performed `AUTH` and the relay requires that to fulfill the query or write the event.
-- `"restricted: "` - for when a client has already performed `AUTH` but the key used to perform it is still not allowed by the relay or is exceeding its authorization.
-
-## Protocol flow
-
-At any moment the relay may send an `AUTH` message to the client containing a challenge. The challenge is valid for the duration of the connection or until another challenge is sent by the relay. The client MAY decide to send its `AUTH` event at any point and the authenticated session is valid afterwards for the duration of the connection.
-
-### `auth-required` in response to a `REQ` message
-
-Given that a relay is likely to require clients to perform authentication only for certain jobs, like answering a `REQ` or accepting an `EVENT` write, these are some expected common flows:
-
-```
-relay: ["AUTH", "<challenge>"]
-client: ["REQ", "sub_1", {"kinds": [4]}]
-relay: ["CLOSED", "sub_1", "auth-required: we can't serve DMs to unauthenticated users"]
-client: ["AUTH", {"id": "abcdef...", ...}]
-client: ["AUTH", {"id": "abcde2...", ...}]
-relay: ["OK", "abcdef...", true, ""]
-relay: ["OK", "abcde2...", true, ""]
-client: ["REQ", "sub_1", {"kinds": [4]}]
-relay: ["EVENT", "sub_1", {...}]
-relay: ["EVENT", "sub_1", {...}]
-relay: ["EVENT", "sub_1", {...}]
-relay: ["EVENT", "sub_1", {...}]
-...
-```
-
-In this case, the `AUTH` message from the relay could be sent right as the client connects or it can be sent immediately before the `CLOSED` is sent. The only requirement is that _the client must have a stored challenge associated with that relay_ so it can act upon that in response to the `auth-required` `CLOSED` message.
-
-### `auth-required` in response to an `EVENT` message
-
-The same flow is valid for when a client wants to write an `EVENT` to the relay, except now the relay sends back an `OK` message instead of a `CLOSED` message:
-
-```
-relay: ["AUTH", "<challenge>"]
-client: ["EVENT", {"id": "012345...", ...}]
-relay: ["OK", "012345...", false, "auth-required: we only accept events from registered users"]
-client: ["AUTH", {"id": "abcdef...", ...}]
-relay: ["OK", "abcdef...", true, ""]
-client: ["EVENT", {"id": "012345...", ...}]
-relay: ["OK", "012345...", true, ""]
-```
-
-## Signed Event Verification
-
-To verify `AUTH` messages, relays must ensure:
-
-  - that the `kind` is `22242`;
-  - that the event `created_at` is close (e.g. within ~10 minutes) of the current time;
-  - that the `"challenge"` tag matches the challenge sent before;
-  - that the `"relay"` tag matches the relay URL:
-    - URL normalization techniques can be applied. For most cases just checking if the domain name is correct should be enough.

Makefile

@@ -8,7 +8,7 @@ BUILDDIR = build
 TARGET = $(BUILDDIR)/ginxsom-fcgi
 
 # Source files
-SOURCES = $(SRCDIR)/main.c $(SRCDIR)/admin_api.c $(SRCDIR)/bud04.c $(SRCDIR)/bud06.c $(SRCDIR)/bud08.c $(SRCDIR)/bud09.c $(SRCDIR)/request_validator.c
+SOURCES = $(SRCDIR)/main.c $(SRCDIR)/admin_api.c $(SRCDIR)/admin_auth.c $(SRCDIR)/admin_websocket.c $(SRCDIR)/admin_handlers.c $(SRCDIR)/bud04.c $(SRCDIR)/bud06.c $(SRCDIR)/bud08.c $(SRCDIR)/bud09.c $(SRCDIR)/request_validator.c
 OBJECTS = $(SOURCES:$(SRCDIR)/%.c=$(BUILDDIR)/%.o)
 
 # Default target

STATIC_MUSL_GUIDE.md

@@ -0,0 +1,612 @@
+# Static MUSL Build Guide for C Programs
+
+## Overview
+
+This guide explains how to build truly portable static binaries using Alpine Linux and MUSL libc. These binaries have **zero runtime dependencies** and work on any Linux distribution without modification.
+
+This guide is specifically tailored for C programs that use:
+- **nostr_core_lib** - Nostr protocol implementation
+- **nostr_login_lite** - Nostr authentication library
+- Common dependencies: libwebsockets, OpenSSL, SQLite, curl, secp256k1
+
+## Why MUSL Static Binaries?
+
+### Advantages Over glibc
+
+| Feature | MUSL Static | glibc Static | glibc Dynamic |
+|---------|-------------|--------------|---------------|
+| **Portability** | ✓ Any Linux | ⚠ glibc only | ✗ Requires matching libs |
+| **Binary Size** | ~7-10 MB | ~12-15 MB | ~2-3 MB |
+| **Dependencies** | None | NSS libs | Many system libs |
+| **Deployment** | Single file | Single file + NSS | Binary + libraries |
+| **Compatibility** | Universal | glibc version issues | Library version hell |
+
+### Key Benefits
+
+1. **True Portability**: Works on Alpine, Ubuntu, Debian, CentOS, Arch, etc.
+2. **No Library Hell**: No `GLIBC_2.XX not found` errors
+3. **Simple Deployment**: Just copy one file
+4. **Reproducible Builds**: Same Docker image = same binary
+5. **Security**: No dependency on system libraries with vulnerabilities
+
+## Quick Start
+
+### Prerequisites
+
+- Docker installed and running
+- Your C project with source code
+- Internet connection for downloading dependencies
+
+### Basic Build Process
+
+```bash
+# 1. Copy the Dockerfile template (see below)
+cp /path/to/c-relay/Dockerfile.alpine-musl ./Dockerfile.static
+
+# 2. Customize for your project (see Customization section)
+vim Dockerfile.static
+
+# 3. Build the static binary
+docker build --platform linux/amd64 -f Dockerfile.static -t my-app-builder .
+
+# 4. Extract the binary
+docker create --name temp-container my-app-builder
+docker cp temp-container:/build/my_app_static ./my_app_static
+docker rm temp-container
+
+# 5. Verify it's static
+ldd ./my_app_static  # Should show "not a dynamic executable"
+```
+
+## Dockerfile Template
+
+Here's a complete Dockerfile template you can customize for your project:
+
+```dockerfile
+# Alpine-based MUSL static binary builder
+# Produces truly portable binaries with zero runtime dependencies
+
+FROM alpine:3.19 AS builder
+
+# Install build dependencies
+RUN apk add --no-cache \
+    build-base \
+    musl-dev \
+    git \
+    cmake \
+    pkgconfig \
+    autoconf \
+    automake \
+    libtool \
+    openssl-dev \
+    openssl-libs-static \
+    zlib-dev \
+    zlib-static \
+    curl-dev \
+    curl-static \
+    sqlite-dev \
+    sqlite-static \
+    linux-headers \
+    wget \
+    bash
+
+WORKDIR /build
+
+# Build libsecp256k1 static (required for Nostr)
+RUN cd /tmp && \
+    git clone https://github.com/bitcoin-core/secp256k1.git && \
+    cd secp256k1 && \
+    ./autogen.sh && \
+    ./configure --enable-static --disable-shared --prefix=/usr \
+        CFLAGS="-fPIC" && \
+    make -j$(nproc) && \
+    make install && \
+    rm -rf /tmp/secp256k1
+
+# Build libwebsockets static (if needed for WebSocket support)
+RUN cd /tmp && \
+    git clone --depth 1 --branch v4.3.3 https://github.com/warmcat/libwebsockets.git && \
+    cd libwebsockets && \
+    mkdir build && cd build && \
+    cmake .. \
+        -DLWS_WITH_STATIC=ON \
+        -DLWS_WITH_SHARED=OFF \
+        -DLWS_WITH_SSL=ON \
+        -DLWS_WITHOUT_TESTAPPS=ON \
+        -DLWS_WITHOUT_TEST_SERVER=ON \
+        -DLWS_WITHOUT_TEST_CLIENT=ON \
+        -DLWS_WITHOUT_TEST_PING=ON \
+        -DLWS_WITH_HTTP2=OFF \
+        -DLWS_WITH_LIBUV=OFF \
+        -DLWS_WITH_LIBEVENT=OFF \
+        -DLWS_IPV6=ON \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr \
+        -DCMAKE_C_FLAGS="-fPIC" && \
+    make -j$(nproc) && \
+    make install && \
+    rm -rf /tmp/libwebsockets
+
+# Copy git configuration for submodules
+COPY .gitmodules /build/.gitmodules
+COPY .git /build/.git
+
+# Initialize submodules
+RUN git submodule update --init --recursive
+
+# Copy and build nostr_core_lib
+COPY nostr_core_lib /build/nostr_core_lib/
+RUN cd nostr_core_lib && \
+    chmod +x build.sh && \
+    sed -i 's/CFLAGS="-Wall -Wextra -std=c99 -fPIC -O2"/CFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -Wall -Wextra -std=c99 -fPIC -O2"/' build.sh && \
+    rm -f *.o *.a 2>/dev/null || true && \
+    ./build.sh --nips=1,6,13,17,19,44,59
+
+# Copy and build nostr_login_lite (if used)
+# COPY nostr_login_lite /build/nostr_login_lite/
+# RUN cd nostr_login_lite && make static
+
+# Copy your application source
+COPY src/ /build/src/
+COPY Makefile /build/Makefile
+
+# Build your application with full static linking
+RUN gcc -static -O2 -Wall -Wextra -std=c99 \
+    -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 \
+    -I. -Inostr_core_lib -Inostr_core_lib/nostr_core \
+    -Inostr_core_lib/cjson -Inostr_core_lib/nostr_websocket \
+    src/*.c \
+    -o /build/my_app_static \
+    nostr_core_lib/libnostr_core_x64.a \
+    -lwebsockets -lssl -lcrypto -lsqlite3 -lsecp256k1 \
+    -lcurl -lz -lpthread -lm -ldl && \
+    strip /build/my_app_static
+
+# Verify it's truly static
+RUN echo "=== Binary Information ===" && \
+    file /build/my_app_static && \
+    ls -lh /build/my_app_static && \
+    echo "=== Checking for dynamic dependencies ===" && \
+    (ldd /build/my_app_static 2>&1 || echo "Binary is static")
+
+# Output stage - just the binary
+FROM scratch AS output
+COPY --from=builder /build/my_app_static /my_app_static
+```
+
+## Customization Guide
+
+### 1. Adjust Dependencies
+
+**Add dependencies** by modifying the `apk add` section:
+
+```dockerfile
+RUN apk add --no-cache \
+    build-base \
+    musl-dev \
+    # Add your dependencies here:
+    libpng-dev \
+    libpng-static \
+    libjpeg-turbo-dev \
+    libjpeg-turbo-static
+```
+
+**Remove unused dependencies** to speed up builds:
+- Remove `libwebsockets` section if you don't need WebSocket support
+- Remove `sqlite` if you don't use databases
+- Remove `curl` if you don't make HTTP requests
+
+### 2. Configure nostr_core_lib NIPs
+
+Specify which NIPs your application needs:
+
+```bash
+./build.sh --nips=1,6,19  # Minimal: Basic protocol, keys, bech32
+./build.sh --nips=1,6,13,17,19,44,59  # Full: All common NIPs
+./build.sh --nips=all  # Everything available
+```
+
+**Common NIP combinations:**
+- **Basic client**: `1,6,19` (events, keys, bech32)
+- **With encryption**: `1,6,19,44` (add modern encryption)
+- **With DMs**: `1,6,17,19,44,59` (add private messages)
+- **Relay/server**: `1,6,13,17,19,42,44,59` (add PoW, auth)
+
+### 3. Modify Compilation Flags
+
+**For your application:**
+
+```dockerfile
+RUN gcc -static -O2 -Wall -Wextra -std=c99 \
+    -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 \  # REQUIRED for MUSL
+    -I. -Inostr_core_lib \                    # Include paths
+    src/*.c \                                  # Your source files
+    -o /build/my_app_static \                 # Output binary
+    nostr_core_lib/libnostr_core_x64.a \     # Nostr library
+    -lwebsockets -lssl -lcrypto \             # Link libraries
+    -lsqlite3 -lsecp256k1 -lcurl \
+    -lz -lpthread -lm -ldl
+```
+
+**Debug build** (with symbols, no optimization):
+
+```dockerfile
+RUN gcc -static -g -O0 -DDEBUG \
+    -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 \
+    # ... rest of flags
+```
+
+### 4. Multi-Architecture Support
+
+Build for different architectures:
+
+```bash
+# x86_64 (Intel/AMD)
+docker build --platform linux/amd64 -f Dockerfile.static -t my-app-x86 .
+
+# ARM64 (Apple Silicon, Raspberry Pi 4+)
+docker build --platform linux/arm64 -f Dockerfile.static -t my-app-arm64 .
+```
+
+## Build Script Template
+
+Create a `build_static.sh` script for convenience:
+
+```bash
+#!/bin/bash
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BUILD_DIR="$SCRIPT_DIR/build"
+DOCKERFILE="$SCRIPT_DIR/Dockerfile.static"
+
+# Detect architecture
+ARCH=$(uname -m)
+case "$ARCH" in
+    x86_64)
+        PLATFORM="linux/amd64"
+        OUTPUT_NAME="my_app_static_x86_64"
+        ;;
+    aarch64|arm64)
+        PLATFORM="linux/arm64"
+        OUTPUT_NAME="my_app_static_arm64"
+        ;;
+    *)
+        echo "Unknown architecture: $ARCH"
+        exit 1
+        ;;
+esac
+
+echo "Building for platform: $PLATFORM"
+mkdir -p "$BUILD_DIR"
+
+# Build Docker image
+docker build \
+    --platform "$PLATFORM" \
+    -f "$DOCKERFILE" \
+    -t my-app-builder:latest \
+    --progress=plain \
+    .
+
+# Extract binary
+CONTAINER_ID=$(docker create my-app-builder:latest)
+docker cp "$CONTAINER_ID:/build/my_app_static" "$BUILD_DIR/$OUTPUT_NAME"
+docker rm "$CONTAINER_ID"
+
+chmod +x "$BUILD_DIR/$OUTPUT_NAME"
+
+echo "✓ Build complete: $BUILD_DIR/$OUTPUT_NAME"
+echo "✓ Size: $(du -h "$BUILD_DIR/$OUTPUT_NAME" | cut -f1)"
+
+# Verify
+if ldd "$BUILD_DIR/$OUTPUT_NAME" 2>&1 | grep -q "not a dynamic executable"; then
+    echo "✓ Binary is fully static"
+else
+    echo "⚠ Warning: Binary may have dynamic dependencies"
+fi
+```
+
+Make it executable:
+
+```bash
+chmod +x build_static.sh
+./build_static.sh
+```
+
+## Common Issues and Solutions
+
+### Issue 1: Fortification Errors
+
+**Error:**
+```
+undefined reference to '__snprintf_chk'
+undefined reference to '__fprintf_chk'
+```
+
+**Cause**: GCC's `-O2` enables fortification by default, which uses glibc-specific functions.
+
+**Solution**: Add these flags to **all** compilation commands:
+```bash
+-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0
+```
+
+This must be applied to:
+1. nostr_core_lib build.sh
+2. Your application compilation
+3. Any other libraries you build
+
+### Issue 2: Missing Symbols from nostr_core_lib
+
+**Error:**
+```
+undefined reference to 'nostr_create_event'
+undefined reference to 'nostr_sign_event'
+```
+
+**Cause**: Required NIPs not included in nostr_core_lib build.
+
+**Solution**: Add missing NIPs:
+```bash
+./build.sh --nips=1,6,19  # Add the NIPs you need
+```
+
+### Issue 3: Docker Permission Denied
+
+**Error:**
+```
+permission denied while trying to connect to the Docker daemon socket
+```
+
+**Solution**:
+```bash
+sudo usermod -aG docker $USER
+newgrp docker  # Or logout and login
+```
+
+### Issue 4: Binary Won't Run on Target System
+
+**Checks**:
+```bash
+# 1. Verify it's static
+ldd my_app_static  # Should show "not a dynamic executable"
+
+# 2. Check architecture
+file my_app_static  # Should match target system
+
+# 3. Test on different distributions
+docker run --rm -v $(pwd):/app alpine:latest /app/my_app_static --version
+docker run --rm -v $(pwd):/app ubuntu:latest /app/my_app_static --version
+```
+
+## Project Structure Example
+
+Organize your project for easy static builds:
+
+```
+my-nostr-app/
+├── src/
+│   ├── main.c
+│   ├── handlers.c
+│   └── utils.c
+├── nostr_core_lib/          # Git submodule
+├── nostr_login_lite/        # Git submodule (if used)
+├── Dockerfile.static        # Static build Dockerfile
+├── build_static.sh          # Build script
+├── Makefile                 # Regular build
+└── README.md
+```
+
+### Makefile Integration
+
+Add static build targets to your Makefile:
+
+```makefile
+# Regular dynamic build
+all: my_app
+
+my_app: src/*.c
+	gcc -O2 src/*.c -o my_app \
+		nostr_core_lib/libnostr_core_x64.a \
+		-lssl -lcrypto -lsecp256k1 -lz -lpthread -lm
+
+# Static MUSL build via Docker
+static:
+	./build_static.sh
+
+# Clean
+clean:
+	rm -f my_app build/my_app_static_*
+
+.PHONY: all static clean
+```
+
+## Deployment
+
+### Single Binary Deployment
+
+```bash
+# Copy to server
+scp build/my_app_static_x86_64 user@server:/opt/my-app/
+
+# Run (no dependencies needed!)
+ssh user@server
+/opt/my-app/my_app_static_x86_64
+```
+
+### SystemD Service
+
+```ini
+[Unit]
+Description=My Nostr Application
+After=network.target
+
+[Service]
+Type=simple
+User=myapp
+WorkingDirectory=/opt/my-app
+ExecStart=/opt/my-app/my_app_static_x86_64
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+```
+
+### Docker Container (Minimal)
+
+```dockerfile
+FROM scratch
+COPY my_app_static_x86_64 /app
+ENTRYPOINT ["/app"]
+```
+
+Build and run:
+```bash
+docker build -t my-app:latest .
+docker run --rm my-app:latest --help
+```
+
+## Reusing c-relay Files
+
+You can directly copy these files from c-relay:
+
+### 1. Dockerfile.alpine-musl
+```bash
+cp /path/to/c-relay/Dockerfile.alpine-musl ./Dockerfile.static
+```
+
+Then customize:
+- Change binary name (line 125)
+- Adjust source files (line 122-124)
+- Modify include paths (line 120-121)
+
+### 2. build_static.sh
+```bash
+cp /path/to/c-relay/build_static.sh ./
+```
+
+Then customize:
+- Change `OUTPUT_NAME` variable (lines 66, 70)
+- Update Docker image name (line 98)
+- Modify verification commands (lines 180-184)
+
+### 3. .dockerignore (Optional)
+```bash
+cp /path/to/c-relay/.dockerignore ./
+```
+
+Helps speed up Docker builds by excluding unnecessary files.
+
+## Best Practices
+
+1. **Version Control**: Commit your Dockerfile and build script
+2. **Tag Builds**: Include git commit hash in binary version
+3. **Test Thoroughly**: Verify on multiple distributions
+4. **Document Dependencies**: List required NIPs and libraries
+5. **Automate**: Use CI/CD to build on every commit
+6. **Archive Binaries**: Keep old versions for rollback
+
+## Performance Comparison
+
+| Metric | MUSL Static | glibc Dynamic |
+|--------|-------------|---------------|
+| Binary Size | 7-10 MB | 2-3 MB + libs |
+| Startup Time | ~50ms | ~40ms |
+| Memory Usage | Similar | Similar |
+| Portability | ✓ Universal | ✗ System-dependent |
+| Deployment | Single file | Binary + libraries |
+
+## References
+
+- [MUSL libc](https://musl.libc.org/)
+- [Alpine Linux](https://alpinelinux.org/)
+- [nostr_core_lib](https://github.com/chebizarro/nostr_core_lib)
+- [Static Linking Best Practices](https://www.musl-libc.org/faq.html)
+- [c-relay Implementation](./docs/musl_static_build.md)
+
+## Example: Minimal Nostr Client
+
+Here's a complete example of building a minimal Nostr client:
+
+```c
+// minimal_client.c
+#include "nostr_core/nostr_core.h"
+#include <stdio.h>
+
+int main() {
+    // Generate keypair
+    char nsec[64], npub[64];
+    nostr_generate_keypair(nsec, npub);
+    
+    printf("Generated keypair:\n");
+    printf("Private key (nsec): %s\n", nsec);
+    printf("Public key (npub): %s\n", npub);
+    
+    // Create event
+    cJSON *event = nostr_create_event(1, "Hello, Nostr!", NULL);
+    nostr_sign_event(event, nsec);
+    
+    char *json = cJSON_Print(event);
+    printf("\nSigned event:\n%s\n", json);
+    
+    free(json);
+    cJSON_Delete(event);
+    return 0;
+}
+```
+
+**Dockerfile.static:**
+```dockerfile
+FROM alpine:3.19 AS builder
+RUN apk add --no-cache build-base musl-dev git autoconf automake libtool \
+    openssl-dev openssl-libs-static zlib-dev zlib-static
+
+WORKDIR /build
+
+# Build secp256k1
+RUN cd /tmp && git clone https://github.com/bitcoin-core/secp256k1.git && \
+    cd secp256k1 && ./autogen.sh && \
+    ./configure --enable-static --disable-shared --prefix=/usr CFLAGS="-fPIC" && \
+    make -j$(nproc) && make install
+
+# Copy and build nostr_core_lib
+COPY nostr_core_lib /build/nostr_core_lib/
+RUN cd nostr_core_lib && \
+    sed -i 's/CFLAGS="-Wall/CFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -Wall/' build.sh && \
+    ./build.sh --nips=1,6,19
+
+# Build application
+COPY minimal_client.c /build/
+RUN gcc -static -O2 -Wall -std=c99 \
+    -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 \
+    -Inostr_core_lib -Inostr_core_lib/nostr_core -Inostr_core_lib/cjson \
+    minimal_client.c -o /build/minimal_client_static \
+    nostr_core_lib/libnostr_core_x64.a \
+    -lssl -lcrypto -lsecp256k1 -lz -lpthread -lm -ldl && \
+    strip /build/minimal_client_static
+
+FROM scratch
+COPY --from=builder /build/minimal_client_static /minimal_client_static
+```
+
+**Build and run:**
+```bash
+docker build -f Dockerfile.static -t minimal-client .
+docker create --name temp minimal-client
+docker cp temp:/minimal_client_static ./
+docker rm temp
+
+./minimal_client_static
+```
+
+## Conclusion
+
+Static MUSL binaries provide the best portability for C applications. While they're slightly larger than dynamic binaries, the benefits of zero dependencies and universal compatibility make them ideal for:
+
+- Server deployments across different Linux distributions
+- Embedded systems and IoT devices
+- Docker containers (FROM scratch)
+- Distribution to users without dependency management
+- Long-term archival and reproducibility
+
+Follow this guide to create portable, self-contained binaries for your Nostr applications!

config/local-nginx.conf

@@ -2,7 +2,7 @@
 # Comprehensive Blossom Protocol Implementation
 
 # Main context - specify error log here to override system default
-error_log logs/nginx/error.log debug;
+error_log logs/nginx/error.log info;
 pid logs/nginx/nginx.pid;
 
 events {
@@ -351,14 +351,33 @@ http {
             autoindex_format json;
         }
         
-        # Root redirect
+        # Root endpoint - Server info from FastCGI
         location = / {
-            return 200 "Ginxsom Blossom Server\nEndpoints: GET /<sha256>, PUT /upload, GET /list/<pubkey>\nHealth: GET /health\n";
-            add_header Content-Type text/plain;
-            add_header Access-Control-Allow-Origin * always;
-            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
-            add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
-            add_header Access-Control-Max-Age 86400 always;
+            if ($request_method !~ ^(GET)$) {
+                return 405;
+            }
+            fastcgi_pass fastcgi_backend;
+            fastcgi_param QUERY_STRING $query_string;
+            fastcgi_param REQUEST_METHOD $request_method;
+            fastcgi_param CONTENT_TYPE $content_type;
+            fastcgi_param CONTENT_LENGTH $content_length;
+            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
+            fastcgi_param REQUEST_URI $request_uri;
+            fastcgi_param DOCUMENT_URI $document_uri;
+            fastcgi_param DOCUMENT_ROOT $document_root;
+            fastcgi_param SERVER_PROTOCOL $server_protocol;
+            fastcgi_param REQUEST_SCHEME $scheme;
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+            fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
+            fastcgi_param REMOTE_ADDR $remote_addr;
+            fastcgi_param REMOTE_PORT $remote_port;
+            fastcgi_param SERVER_ADDR $server_addr;
+            fastcgi_param SERVER_PORT $server_port;
+            fastcgi_param SERVER_NAME $server_name;
+            fastcgi_param REDIRECT_STATUS 200;
+            fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+            fastcgi_param HTTP_AUTHORIZATION $http_authorization;
         }
     }
     
@@ -683,14 +702,33 @@ http {
             autoindex_format json;
         }
         
-        # Root redirect
+        # Root endpoint - Server info from FastCGI
         location = / {
-            return 200 "Ginxsom Blossom Server (HTTPS)\nEndpoints: GET /<sha256>, PUT /upload, GET /list/<pubkey>\nHealth: GET /health\n";
-            add_header Content-Type text/plain;
-            add_header Access-Control-Allow-Origin * always;
-            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
-            add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
-            add_header Access-Control-Max-Age 86400 always;
+            if ($request_method !~ ^(GET)$) {
+                return 405;
+            }
+            fastcgi_pass fastcgi_backend;
+            fastcgi_param QUERY_STRING $query_string;
+            fastcgi_param REQUEST_METHOD $request_method;
+            fastcgi_param CONTENT_TYPE $content_type;
+            fastcgi_param CONTENT_LENGTH $content_length;
+            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
+            fastcgi_param REQUEST_URI $request_uri;
+            fastcgi_param DOCUMENT_URI $document_uri;
+            fastcgi_param DOCUMENT_ROOT $document_root;
+            fastcgi_param SERVER_PROTOCOL $server_protocol;
+            fastcgi_param REQUEST_SCHEME $scheme;
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+            fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
+            fastcgi_param REMOTE_ADDR $remote_addr;
+            fastcgi_param REMOTE_PORT $remote_port;
+            fastcgi_param SERVER_ADDR $server_addr;
+            fastcgi_param SERVER_PORT $server_port;
+            fastcgi_param SERVER_NAME $server_name;
+            fastcgi_param REDIRECT_STATUS 200;
+            fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+            fastcgi_param HTTP_AUTHORIZATION $http_authorization;
         }
     }
 }

db/migrations/001_add_auth_rules.sql

@@ -0,0 +1,78 @@
+-- Migration: Add authentication rules tables
+-- Purpose: Enable whitelist/blacklist functionality for Ginxsom
+-- Date: 2025-01-12
+
+-- Enable foreign key constraints
+PRAGMA foreign_keys = ON;
+
+-- Authentication rules table for whitelist/blacklist functionality
+CREATE TABLE IF NOT EXISTS auth_rules (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    rule_type TEXT NOT NULL,              -- 'pubkey_blacklist', 'pubkey_whitelist', 
+                                          -- 'hash_blacklist', 'mime_blacklist', 'mime_whitelist'
+    rule_target TEXT NOT NULL,            -- The pubkey, hash, or MIME type to match
+    operation TEXT NOT NULL DEFAULT '*',  -- 'upload', 'delete', 'list', or '*' for all
+    enabled INTEGER NOT NULL DEFAULT 1,   -- 1 = enabled, 0 = disabled
+    priority INTEGER NOT NULL DEFAULT 100,-- Lower number = higher priority
+    description TEXT,                     -- Human-readable description
+    created_by TEXT,                      -- Admin pubkey who created the rule
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    
+    -- Constraints
+    CHECK (rule_type IN ('pubkey_blacklist', 'pubkey_whitelist', 
+                         'hash_blacklist', 'mime_blacklist', 'mime_whitelist')),
+    CHECK (operation IN ('upload', 'delete', 'list', '*')),
+    CHECK (enabled IN (0, 1)),
+    CHECK (priority >= 0),
+    
+    -- Unique constraint: one rule per type/target/operation combination
+    UNIQUE(rule_type, rule_target, operation)
+);
+
+-- Indexes for performance optimization
+CREATE INDEX IF NOT EXISTS idx_auth_rules_type_target ON auth_rules(rule_type, rule_target);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_operation ON auth_rules(operation);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_enabled ON auth_rules(enabled);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_priority ON auth_rules(priority);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_type_operation ON auth_rules(rule_type, operation, enabled);
+
+-- Cache table for authentication decisions (5-minute TTL)
+CREATE TABLE IF NOT EXISTS auth_rules_cache (
+    cache_key TEXT PRIMARY KEY NOT NULL,  -- SHA-256 hash of request parameters
+    decision INTEGER NOT NULL,            -- 1 = allow, 0 = deny
+    reason TEXT,                          -- Reason for decision
+    pubkey TEXT,                          -- Public key from request
+    operation TEXT,                       -- Operation type
+    resource_hash TEXT,                   -- Resource hash (if applicable)
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    expires_at INTEGER NOT NULL,          -- Expiration timestamp
+    
+    CHECK (decision IN (0, 1))
+);
+
+-- Index for cache expiration cleanup
+CREATE INDEX IF NOT EXISTS idx_auth_cache_expires ON auth_rules_cache(expires_at);
+CREATE INDEX IF NOT EXISTS idx_auth_cache_pubkey ON auth_rules_cache(pubkey);
+
+-- Insert example rules (commented out - uncomment to use)
+-- Example: Blacklist a specific pubkey for uploads
+-- INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description, created_by) VALUES
+--     ('pubkey_blacklist', '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798', 'upload', 10, 'Example blacklisted user', 'admin_pubkey_here');
+
+-- Example: Whitelist a specific pubkey for all operations
+-- INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description, created_by) VALUES
+--     ('pubkey_whitelist', 'your_pubkey_here', '*', 300, 'Trusted user - all operations allowed', 'admin_pubkey_here');
+
+-- Example: Blacklist executable MIME types
+-- INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description, created_by) VALUES
+--     ('mime_blacklist', 'application/x-executable', 'upload', 200, 'Block executable files', 'admin_pubkey_here'),
+--     ('mime_blacklist', 'application/x-msdos-program', 'upload', 200, 'Block DOS executables', 'admin_pubkey_here'),
+--     ('mime_blacklist', 'application/x-msdownload', 'upload', 200, 'Block Windows executables', 'admin_pubkey_here');
+
+-- Example: Whitelist common image types
+-- INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description, created_by) VALUES
+--     ('mime_whitelist', 'image/jpeg', 'upload', 400, 'Allow JPEG images', 'admin_pubkey_here'),
+--     ('mime_whitelist', 'image/png', 'upload', 400, 'Allow PNG images', 'admin_pubkey_here'),
+--     ('mime_whitelist', 'image/gif', 'upload', 400, 'Allow GIF images', 'admin_pubkey_here'),
+--     ('mime_whitelist', 'image/webp', 'upload', 400, 'Allow WebP images', 'admin_pubkey_here');

db/migrations/002_add_relay_seckey.sql

@@ -0,0 +1,15 @@
+-- Migration: Add blossom_seckey table for storing server private key
+-- This table stores the Blossom server's secp256k1 private key used for:
+-- - Signing admin response events (Kind 23457)
+-- - Decrypting admin commands (NIP-44)
+
+CREATE TABLE IF NOT EXISTS blossom_seckey (
+    id INTEGER PRIMARY KEY CHECK (id = 1),  -- Only one row allowed
+    seckey TEXT NOT NULL,                   -- Private key in hex format (64 chars)
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    CHECK (length(seckey) = 64)            -- Ensure valid secp256k1 key length
+);
+
+-- Add blossom_pubkey to config if not exists
+INSERT OR IGNORE INTO config (key, value, description) VALUES
+    ('blossom_pubkey', '', 'Blossom server public key derived from blossom_seckey');

db/schema.sql

@@ -43,9 +43,43 @@ INSERT OR IGNORE INTO config (key, value, description) VALUES
     ('nip42_challenge_timeout', '600', 'NIP-42 challenge timeout in seconds'),
     ('nip42_time_tolerance', '300', 'NIP-42 timestamp tolerance in seconds');
 
+-- Authentication rules table for whitelist/blacklist functionality
+CREATE TABLE IF NOT EXISTS auth_rules (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    rule_type TEXT NOT NULL,              -- 'pubkey_blacklist', 'pubkey_whitelist',
+                                          -- 'hash_blacklist', 'mime_blacklist', 'mime_whitelist'
+    rule_target TEXT NOT NULL,            -- The pubkey, hash, or MIME type to match
+    operation TEXT NOT NULL DEFAULT '*',  -- 'upload', 'delete', 'list', or '*' for all
+    enabled INTEGER NOT NULL DEFAULT 1,   -- 1 = enabled, 0 = disabled
+    priority INTEGER NOT NULL DEFAULT 100,-- Lower number = higher priority
+    description TEXT,                     -- Human-readable description
+    created_by TEXT,                      -- Admin pubkey who created the rule
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+
+    -- Constraints
+    CHECK (rule_type IN ('pubkey_blacklist', 'pubkey_whitelist',
+                         'hash_blacklist', 'mime_blacklist', 'mime_whitelist')),
+    CHECK (operation IN ('upload', 'delete', 'list', '*')),
+    CHECK (enabled IN (0, 1)),
+    CHECK (priority >= 0),
+
+    -- Unique constraint: one rule per type/target/operation combination
+    UNIQUE(rule_type, rule_target, operation)
+);
+
+
+-- Indexes for performance optimization
+CREATE INDEX IF NOT EXISTS idx_auth_rules_type_target ON auth_rules(rule_type, rule_target);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_operation ON auth_rules(operation);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_enabled ON auth_rules(enabled);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_priority ON auth_rules(priority);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_type_operation ON auth_rules(rule_type, operation, enabled);
+
+
 -- View for storage statistics
 CREATE VIEW IF NOT EXISTS storage_stats AS
-SELECT 
+SELECT
     COUNT(*) as total_blobs,
     SUM(size) as total_bytes,
     AVG(size) as avg_blob_size,

deploy_lt.sh

@@ -0,0 +1,306 @@
+#!/bin/bash
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+print_status() { echo -e "${BLUE}[INFO]${NC} $1"; }
+print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
+print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
+print_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+# Parse command line arguments
+FRESH_INSTALL=false
+if [[ "$1" == "--fresh" ]]; then
+    FRESH_INSTALL=true
+fi
+
+# Configuration
+REMOTE_HOST="laantungir.net"
+REMOTE_USER="ubuntu"
+REMOTE_DIR="/home/ubuntu/ginxsom"
+REMOTE_DB_PATH="/home/ubuntu/ginxsom/db/ginxsom.db"
+REMOTE_NGINX_CONFIG="/etc/nginx/conf.d/default.conf"
+REMOTE_BINARY_PATH="/home/ubuntu/ginxsom/ginxsom.fcgi"
+REMOTE_SOCKET="/tmp/ginxsom-fcgi.sock"
+REMOTE_DATA_DIR="/var/www/html/blossom"
+
+print_status "Starting deployment to $REMOTE_HOST..."
+
+# Step 1: Build and prepare local binary
+print_status "Building ginxsom binary..."
+make clean && make
+if [[ ! -f "build/ginxsom-fcgi" ]]; then
+    print_error "Build failed - binary not found"
+    exit 1
+fi
+print_success "Binary built successfully"
+
+# Step 2: Setup remote environment first (before copying files)
+print_status "Setting up remote environment..."
+ssh $REMOTE_USER@$REMOTE_HOST << 'EOF'
+    set -e
+
+    # Create data directory if it doesn't exist (using existing /var/www/html/blossom)
+    sudo mkdir -p /var/www/html/blossom
+    sudo chown www-data:www-data /var/www/html/blossom
+    sudo chmod 755 /var/www/html/blossom
+
+    # Ensure socket directory exists
+    sudo mkdir -p /tmp
+    sudo chmod 755 /tmp
+
+    # Install required dependencies
+    echo "Installing required dependencies..."
+    sudo apt-get update
+    sudo apt-get install -y spawn-fcgi libfcgi-dev
+
+    # Stop any existing ginxsom processes
+    echo "Stopping existing ginxsom processes..."
+    sudo pkill -f ginxsom-fcgi || true
+    sudo rm -f /tmp/ginxsom-fcgi.sock || true
+
+    echo "Remote environment setup complete"
+EOF
+
+print_success "Remote environment configured"
+
+# Step 3: Copy files to remote server
+print_status "Copying files to remote server..."
+
+# Copy entire project directory (excluding unnecessary files)
+print_status "Copying entire ginxsom project..."
+rsync -avz --exclude='.git' --exclude='build' --exclude='logs' --exclude='Trash' --exclude='blobs' --exclude='db' --no-g --no-o --no-perms --omit-dir-times . $REMOTE_USER@$REMOTE_HOST:$REMOTE_DIR/
+
+# Build on remote server to ensure compatibility
+print_status "Building ginxsom on remote server..."
+ssh $REMOTE_USER@$REMOTE_HOST "cd $REMOTE_DIR && make clean && make" || {
+    print_error "Build failed on remote server"
+    print_status "Checking what packages are actually installed..."
+    ssh $REMOTE_USER@$REMOTE_HOST "dpkg -l | grep -E '(sqlite|fcgi)'"
+    exit 1
+}
+
+# Copy binary to application directory
+print_status "Copying ginxsom binary to application directory..."
+ssh $REMOTE_USER@$REMOTE_HOST << EOF
+    # Stop any running process first
+    sudo pkill -f ginxsom-fcgi || true
+    sleep 1
+
+    # Remove old binary if it exists
+    rm -f $REMOTE_BINARY_PATH
+
+    # Copy new binary
+    cp $REMOTE_DIR/build/ginxsom-fcgi $REMOTE_BINARY_PATH
+    chmod +x $REMOTE_BINARY_PATH
+    chown ubuntu:ubuntu $REMOTE_BINARY_PATH
+
+    echo "Binary copied successfully"
+EOF
+
+# NOTE: Do NOT update nginx configuration automatically
+# The deployment script should only update ginxsom binaries and do nothing else with the system
+# Nginx configuration should be managed manually by the system administrator
+print_status "Skipping nginx configuration update (manual control required)"
+
+print_success "Files copied to remote server"
+
+# Step 3: Setup remote environment
+print_status "Setting up remote environment..."
+
+ssh $REMOTE_USER@$REMOTE_HOST << 'EOF'
+    set -e
+
+    # Create data directory if it doesn't exist (using existing /var/www/html/blossom)
+    sudo mkdir -p /var/www/html/blossom
+    sudo chown www-data:www-data /var/www/html/blossom
+    sudo chmod 755 /var/www/html/blossom
+
+    # Ensure socket directory exists
+    sudo mkdir -p /tmp
+    sudo chmod 755 /tmp
+
+    # Install required dependencies
+    echo "Installing required dependencies..."
+    sudo apt-get update 2>/dev/null || true  # Continue even if apt update has issues
+    sudo apt-get install -y spawn-fcgi libfcgi-dev libsqlite3-dev sqlite3 libcurl4-openssl-dev
+
+    # Verify installations
+    echo "Verifying installations..."
+    if ! dpkg -l libsqlite3-dev >/dev/null 2>&1; then
+        echo "libsqlite3-dev not found, trying alternative..."
+        sudo apt-get install -y libsqlite3-dev || {
+            echo "Failed to install libsqlite3-dev"
+            exit 1
+        }
+    fi
+    if ! dpkg -l libfcgi-dev >/dev/null 2>&1; then
+        echo "libfcgi-dev not found"
+        exit 1
+    fi
+
+    # Check if sqlite3.h exists
+    if [ ! -f /usr/include/sqlite3.h ]; then
+        echo "sqlite3.h not found in /usr/include/"
+        find /usr -name "sqlite3.h" 2>/dev/null || echo "sqlite3.h not found anywhere"
+        exit 1
+    fi
+
+    # Stop any existing ginxsom processes
+    echo "Stopping existing ginxsom processes..."
+    sudo pkill -f ginxsom-fcgi || true
+    sudo rm -f /tmp/ginxsom-fcgi.sock || true
+
+    echo "Remote environment setup complete"
+EOF
+
+print_success "Remote environment configured"
+
+# Step 4: Setup database directory and migrate database
+print_status "Setting up database directory..."
+
+ssh $REMOTE_USER@$REMOTE_HOST << EOF
+    # Create db directory if it doesn't exist
+    mkdir -p $REMOTE_DIR/db
+
+    if [ "$FRESH_INSTALL" = "true" ]; then
+        echo "Fresh install: removing existing database and blobs..."
+        # Remove existing database
+        sudo rm -f $REMOTE_DB_PATH
+        sudo rm -f /var/www/html/blossom/ginxsom.db
+        # Remove existing blobs
+        sudo rm -rf $REMOTE_DATA_DIR/*
+        echo "Existing data removed"
+    else
+        # Backup current database if it exists in old location
+        if [ -f /var/www/html/blossom/ginxsom.db ]; then
+            echo "Backing up existing database..."
+            cp /var/www/html/blossom/ginxsom.db /var/www/html/blossom/ginxsom.db.backup.\$(date +%Y%m%d_%H%M%S)
+
+            # Migrate database to new location if not already there
+            if [ ! -f $REMOTE_DB_PATH ]; then
+                echo "Migrating database to new location..."
+                cp /var/www/html/blossom/ginxsom.db $REMOTE_DB_PATH
+            else
+                echo "Database already exists at new location"
+            fi
+        elif [ ! -f $REMOTE_DB_PATH ]; then
+            echo "No existing database found - will be created on first run"
+        else
+            echo "Database already exists at $REMOTE_DB_PATH"
+        fi
+    fi
+
+    # Set proper permissions - www-data needs write access to db directory for SQLite journal files
+    sudo chown -R www-data:www-data $REMOTE_DIR/db
+    sudo chmod 755 $REMOTE_DIR/db
+    sudo chmod 644 $REMOTE_DB_PATH 2>/dev/null || true
+
+    # Allow www-data to access the application directory for spawn-fcgi chdir
+    chmod 755 $REMOTE_DIR
+
+    echo "Database directory setup complete"
+EOF
+
+print_success "Database directory configured"
+
+# Step 5: Start ginxsom FastCGI process
+print_status "Starting ginxsom FastCGI process..."
+
+ssh $REMOTE_USER@$REMOTE_HOST << EOF
+    # Clean up any existing socket
+    sudo rm -f $REMOTE_SOCKET
+
+    # Start FastCGI process with explicit paths
+    echo "Starting ginxsom FastCGI with configuration:"
+    echo "  Working directory: $REMOTE_DIR"
+    echo "  Binary: $REMOTE_BINARY_PATH"
+    echo "  Database: $REMOTE_DB_PATH"
+    echo "  Storage: $REMOTE_DATA_DIR"
+    
+    sudo spawn-fcgi -M 666 -u www-data -g www-data -s $REMOTE_SOCKET -U www-data -G www-data -d $REMOTE_DIR -- $REMOTE_BINARY_PATH --db-path "$REMOTE_DB_PATH" --storage-dir "$REMOTE_DATA_DIR"
+
+    # Give it a moment to start
+    sleep 2
+
+    # Verify process is running
+    if pgrep -f "ginxsom-fcgi" > /dev/null; then
+        echo "FastCGI process started successfully"
+        echo "PID: \$(pgrep -f ginxsom-fcgi)"
+    else
+        echo "Process not found by pgrep, but socket exists - this may be normal for FastCGI"
+        echo "Checking socket..."
+        ls -la $REMOTE_SOCKET
+        echo "Checking if binary exists and is executable..."
+        ls -la $REMOTE_BINARY_PATH
+        echo "Testing if we can connect to the socket..."
+        # Try to test the FastCGI connection
+        if command -v cgi-fcgi >/dev/null 2>&1; then
+            echo "Testing FastCGI connection..."
+            SCRIPT_NAME=/health SCRIPT_FILENAME=$REMOTE_BINARY_PATH REQUEST_METHOD=GET cgi-fcgi -bind -connect $REMOTE_SOCKET 2>/dev/null | head -5 || echo "Connection test failed"
+        else
+            echo "cgi-fcgi not available for testing"
+        fi
+        # Don't exit - the socket existing means spawn-fcgi worked
+    fi
+EOF
+
+if [ $? -eq 0 ]; then
+    print_success "FastCGI process started"
+else
+    print_error "Failed to start FastCGI process"
+    exit 1
+fi
+
+# Step 6: Test nginx configuration and reload
+print_status "Testing and reloading nginx..."
+
+ssh $REMOTE_USER@$REMOTE_HOST << 'EOF'
+    # Test nginx configuration
+    if sudo nginx -t; then
+        echo "Nginx configuration test passed"
+        sudo nginx -s reload
+        echo "Nginx reloaded successfully"
+    else
+        echo "Nginx configuration test failed"
+        exit 1
+    fi
+EOF
+
+print_success "Nginx reloaded"
+
+# Step 7: Test deployment
+print_status "Testing deployment..."
+
+# Test health endpoint
+echo "Testing health endpoint..."
+if curl -k -s --max-time 10 "https://blossom.laantungir.net/health" | grep -q "OK"; then
+    print_success "Health check passed"
+else
+    print_warning "Health check failed - checking response..."
+    curl -k -v --max-time 10 "https://blossom.laantungir.net/health" 2>&1 | head -10
+fi
+
+# Test basic endpoints
+echo "Testing root endpoint..."
+if curl -k -s --max-time 10 "https://blossom.laantungir.net/" | grep -q "Ginxsom"; then
+    print_success "Root endpoint responding"
+else
+    print_warning "Root endpoint not responding as expected - checking response..."
+    curl -k -v --max-time 10 "https://blossom.laantungir.net/" 2>&1 | head -10
+fi
+
+print_success "Deployment to $REMOTE_HOST completed!"
+print_status "Ginxsom should now be available at: https://blossom.laantungir.net"
+print_status "Test endpoints:"
+echo "  Health: curl -k https://blossom.laantungir.net/health"
+echo "  Root: curl -k https://blossom.laantungir.net/"
+echo "  List: curl -k https://blossom.laantungir.net/list"
+if [ "$FRESH_INSTALL" = "true" ]; then
+    print_warning "Fresh install completed - database and blobs have been reset"
+fi

docs/AUTH_RULES_IMPLEMENTATION_PLAN.md

@@ -0,0 +1,496 @@
+# Authentication Rules Implementation Plan
+
+## Executive Summary
+
+This document outlines the implementation plan for adding whitelist/blacklist functionality to the Ginxsom Blossom server. The authentication rules system is **already coded** in [`src/request_validator.c`](src/request_validator.c) but lacks the database schema to function. This plan focuses on completing the implementation by adding the missing database tables and Admin API endpoints.
+
+## Current State Analysis
+
+### ✅ Already Implemented
+- **Nostr event validation** - Full cryptographic verification (NIP-42 and Blossom)
+- **Rule evaluation engine** - Complete priority-based logic in [`check_database_auth_rules()`](src/request_validator.c:1309-1471)
+- **Configuration system** - `auth_rules_enabled` flag in config table
+- **Admin API framework** - Authentication and endpoint structure in place
+- **Documentation** - Comprehensive flow diagrams in [`docs/AUTH_API.md`](docs/AUTH_API.md)
+
+### ❌ Missing Components
+- **Database schema** - `auth_rules` table doesn't exist
+- **Cache table** - `auth_rules_cache` for performance optimization
+- **Admin API endpoints** - CRUD operations for managing rules
+- **Migration script** - Database schema updates
+- **Test suite** - Validation of rule enforcement
+
+## Database Schema Design
+
+### 1. auth_rules Table
+
+```sql
+-- Authentication rules for whitelist/blacklist functionality
+CREATE TABLE IF NOT EXISTS auth_rules (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    rule_type TEXT NOT NULL,              -- 'pubkey_blacklist', 'pubkey_whitelist', 
+                                          -- 'hash_blacklist', 'mime_blacklist', 'mime_whitelist'
+    rule_target TEXT NOT NULL,            -- The pubkey, hash, or MIME type to match
+    operation TEXT NOT NULL DEFAULT '*',  -- 'upload', 'delete', 'list', or '*' for all
+    enabled INTEGER NOT NULL DEFAULT 1,   -- 1 = enabled, 0 = disabled
+    priority INTEGER NOT NULL DEFAULT 100,-- Lower number = higher priority
+    description TEXT,                     -- Human-readable description
+    created_by TEXT,                      -- Admin pubkey who created the rule
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    
+    -- Constraints
+    CHECK (rule_type IN ('pubkey_blacklist', 'pubkey_whitelist', 
+                         'hash_blacklist', 'mime_blacklist', 'mime_whitelist')),
+    CHECK (operation IN ('upload', 'delete', 'list', '*')),
+    CHECK (enabled IN (0, 1)),
+    CHECK (priority >= 0),
+    
+    -- Unique constraint: one rule per type/target/operation combination
+    UNIQUE(rule_type, rule_target, operation)
+);
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS idx_auth_rules_type_target ON auth_rules(rule_type, rule_target);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_operation ON auth_rules(operation);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_enabled ON auth_rules(enabled);
+CREATE INDEX IF NOT EXISTS idx_auth_rules_priority ON auth_rules(priority);
+```
+
+### 2. auth_rules_cache Table
+
+```sql
+-- Cache for authentication decisions (5-minute TTL)
+CREATE TABLE IF NOT EXISTS auth_rules_cache (
+    cache_key TEXT PRIMARY KEY NOT NULL,  -- SHA-256 hash of request parameters
+    decision INTEGER NOT NULL,            -- 1 = allow, 0 = deny
+    reason TEXT,                          -- Reason for decision
+    pubkey TEXT,                          -- Public key from request
+    operation TEXT,                       -- Operation type
+    resource_hash TEXT,                   -- Resource hash (if applicable)
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    expires_at INTEGER NOT NULL,          -- Expiration timestamp
+    
+    CHECK (decision IN (0, 1))
+);
+
+-- Index for cache expiration cleanup
+CREATE INDEX IF NOT EXISTS idx_auth_cache_expires ON auth_rules_cache(expires_at);
+```
+
+### 3. Rule Type Definitions
+
+| Rule Type | Purpose | Target Format | Priority Range |
+|-----------|---------|---------------|----------------|
+| `pubkey_blacklist` | Block specific users | 64-char hex pubkey | 1-99 (highest) |
+| `hash_blacklist` | Block specific files | 64-char hex SHA-256 | 100-199 |
+| `mime_blacklist` | Block file types | MIME type string | 200-299 |
+| `pubkey_whitelist` | Allow specific users | 64-char hex pubkey | 300-399 |
+| `mime_whitelist` | Allow file types | MIME type string | 400-499 |
+
+### 4. Operation Types
+
+- `upload` - File upload operations
+- `delete` - File deletion operations
+- `list` - File listing operations
+- `*` - All operations (wildcard)
+
+## Admin API Endpoints
+
+### GET /api/rules
+**Purpose**: List all authentication rules with filtering
+**Authentication**: Required (admin pubkey)
+**Query Parameters**:
+- `rule_type` (optional): Filter by rule type
+- `operation` (optional): Filter by operation
+- `enabled` (optional): Filter by enabled status (true/false)
+- `limit` (default: 100): Number of rules to return
+- `offset` (default: 0): Pagination offset
+
+**Response**:
+```json
+{
+  "status": "success",
+  "data": {
+    "rules": [
+      {
+        "id": 1,
+        "rule_type": "pubkey_blacklist",
+        "rule_target": "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
+        "operation": "upload",
+        "enabled": true,
+        "priority": 10,
+        "description": "Blocked spammer account",
+        "created_by": "admin_pubkey_here",
+        "created_at": 1704067200,
+        "updated_at": 1704067200
+      }
+    ],
+    "total": 1,
+    "limit": 100,
+    "offset": 0
+  }
+}
+```
+
+### POST /api/rules
+**Purpose**: Create a new authentication rule
+**Authentication**: Required (admin pubkey)
+**Request Body**:
+```json
+{
+  "rule_type": "pubkey_blacklist",
+  "rule_target": "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
+  "operation": "upload",
+  "priority": 10,
+  "description": "Blocked spammer account"
+}
+```
+
+**Response**:
+```json
+{
+  "status": "success",
+  "message": "Rule created successfully",
+  "data": {
+    "id": 1,
+    "rule_type": "pubkey_blacklist",
+    "rule_target": "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
+    "operation": "upload",
+    "enabled": true,
+    "priority": 10,
+    "description": "Blocked spammer account",
+    "created_at": 1704067200
+  }
+}
+```
+
+### PUT /api/rules/:id
+**Purpose**: Update an existing rule
+**Authentication**: Required (admin pubkey)
+**Request Body**:
+```json
+{
+  "enabled": false,
+  "priority": 20,
+  "description": "Updated description"
+}
+```
+
+**Response**:
+```json
+{
+  "status": "success",
+  "message": "Rule updated successfully",
+  "data": {
+    "id": 1,
+    "updated_fields": ["enabled", "priority", "description"]
+  }
+}
+```
+
+### DELETE /api/rules/:id
+**Purpose**: Delete an authentication rule
+**Authentication**: Required (admin pubkey)
+
+**Response**:
+```json
+{
+  "status": "success",
+  "message": "Rule deleted successfully",
+  "data": {
+    "id": 1
+  }
+}
+```
+
+### POST /api/rules/clear-cache
+**Purpose**: Clear the authentication rules cache
+**Authentication**: Required (admin pubkey)
+
+**Response**:
+```json
+{
+  "status": "success",
+  "message": "Authentication cache cleared",
+  "data": {
+    "entries_cleared": 42
+  }
+}
+```
+
+### GET /api/rules/test
+**Purpose**: Test if a specific request would be allowed
+**Authentication**: Required (admin pubkey)
+**Query Parameters**:
+- `pubkey` (required): Public key to test
+- `operation` (required): Operation type (upload/delete/list)
+- `hash` (optional): Resource hash
+- `mime` (optional): MIME type
+
+**Response**:
+```json
+{
+  "status": "success",
+  "data": {
+    "allowed": false,
+    "reason": "Public key blacklisted",
+    "matched_rule": {
+      "id": 1,
+      "rule_type": "pubkey_blacklist",
+      "description": "Blocked spammer account"
+    }
+  }
+}
+```
+
+## Implementation Phases
+
+### Phase 1: Database Schema (Priority: HIGH)
+**Estimated Time**: 2-4 hours
+
+**Tasks**:
+1. Create migration script `db/migrations/001_add_auth_rules.sql`
+2. Add `auth_rules` table with indexes
+3. Add `auth_rules_cache` table with indexes
+4. Create migration runner script
+5. Test migration on clean database
+6. Test migration on existing database
+
+**Deliverables**:
+- Migration SQL script
+- Migration runner bash script
+- Migration documentation
+
+**Validation**:
+- Verify tables created successfully
+- Verify indexes exist
+- Verify constraints work correctly
+- Test with sample data
+
+### Phase 2: Admin API Endpoints (Priority: HIGH)
+**Estimated Time**: 6-8 hours
+
+**Tasks**:
+1. Implement `GET /api/rules` endpoint
+2. Implement `POST /api/rules` endpoint
+3. Implement `PUT /api/rules/:id` endpoint
+4. Implement `DELETE /api/rules/:id` endpoint
+5. Implement `POST /api/rules/clear-cache` endpoint
+6. Implement `GET /api/rules/test` endpoint
+7. Add input validation for all endpoints
+8. Add error handling and logging
+
+**Deliverables**:
+- C implementation in `src/admin_api.c`
+- Header declarations in `src/ginxsom.h`
+- API documentation updates
+
+**Validation**:
+- Test each endpoint with valid data
+- Test error cases (invalid input, missing auth, etc.)
+- Verify database operations work correctly
+- Check response formats match specification
+
+### Phase 3: Integration & Testing (Priority: HIGH)
+**Estimated Time**: 4-6 hours
+
+**Tasks**:
+1. Create comprehensive test suite
+2. Test rule creation and enforcement
+3. Test cache functionality
+4. Test priority ordering
+5. Test whitelist default-deny behavior
+6. Test performance with many rules
+7. Document test scenarios
+
+**Deliverables**:
+- Test script `tests/auth_rules_test.sh`
+- Performance benchmarks
+- Test documentation
+
+**Validation**:
+- All test cases pass
+- Performance meets requirements (<3ms per request)
+- Cache hit rate >80% under load
+- No memory leaks detected
+
+### Phase 4: Documentation & Examples (Priority: MEDIUM)
+**Estimated Time**: 2-3 hours
+
+**Tasks**:
+1. Update [`docs/AUTH_API.md`](docs/AUTH_API.md) with rule management
+2. Create usage examples
+3. Document common patterns (blocking users, allowing file types)
+4. Create migration guide for existing deployments
+5. Add troubleshooting section
+
+**Deliverables**:
+- Updated documentation
+- Example scripts
+- Migration guide
+- Troubleshooting guide
+
+## Code Changes Required
+
+### 1. src/request_validator.c
+**Status**: ✅ Already implemented - NO CHANGES NEEDED
+
+The rule evaluation logic is complete in [`check_database_auth_rules()`](src/request_validator.c:1309-1471). Once the database tables exist, this code will work immediately.
+
+### 2. src/admin_api.c
+**Status**: ❌ Needs new endpoints
+
+Add new functions:
+```c
+// Rule management endpoints
+int handle_get_rules(FCGX_Request *request);
+int handle_create_rule(FCGX_Request *request);
+int handle_update_rule(FCGX_Request *request);
+int handle_delete_rule(FCGX_Request *request);
+int handle_clear_cache(FCGX_Request *request);
+int handle_test_rule(FCGX_Request *request);
+```
+
+### 3. src/ginxsom.h
+**Status**: ❌ Needs new declarations
+
+Add function prototypes for new admin endpoints.
+
+### 4. db/schema.sql
+**Status**: ❌ Needs new tables
+
+Add `auth_rules` and `auth_rules_cache` table definitions.
+
+## Migration Strategy
+
+### For New Installations
+1. Run updated `db/init.sh` which includes new tables
+2. No additional steps needed
+
+### For Existing Installations
+1. Create backup: `cp db/ginxsom.db db/ginxsom.db.backup`
+2. Run migration: `sqlite3 db/ginxsom.db < db/migrations/001_add_auth_rules.sql`
+3. Verify migration: `sqlite3 db/ginxsom.db ".schema auth_rules"`
+4. Restart server to load new schema
+
+### Rollback Procedure
+1. Stop server
+2. Restore backup: `cp db/ginxsom.db.backup db/ginxsom.db`
+3. Restart server
+
+## Performance Considerations
+
+### Cache Strategy
+- **5-minute TTL** balances freshness with performance
+- **SHA-256 cache keys** prevent collision attacks
+- **Automatic cleanup** of expired entries every 5 minutes
+- **Cache hit target**: >80% under normal load
+
+### Database Optimization
+- **Indexes on all query columns** for fast lookups
+- **Prepared statements** prevent SQL injection
+- **Single connection** with proper cleanup
+- **Query optimization** for rule evaluation order
+
+### Expected Performance
+- **Cache hit**: ~100μs (SQLite SELECT)
+- **Cache miss**: ~2.4ms (full validation + rule checks)
+- **Rule creation**: ~50ms (INSERT + cache invalidation)
+- **Rule update**: ~30ms (UPDATE + cache invalidation)
+
+## Security Considerations
+
+### Input Validation
+- Validate all rule_type values against enum
+- Validate pubkey format (64 hex chars)
+- Validate hash format (64 hex chars)
+- Validate MIME type format
+- Sanitize description text
+
+### Authorization
+- All rule management requires admin pubkey
+- Verify Nostr event signatures
+- Check event expiration
+- Log all rule changes with admin pubkey
+
+### Attack Mitigation
+- **Rule flooding**: Limit total rules per type
+- **Cache poisoning**: Cryptographic cache keys
+- **Priority manipulation**: Validate priority ranges
+- **Whitelist bypass**: Default-deny when whitelist exists
+
+## Testing Strategy
+
+### Unit Tests
+- Rule creation with valid data
+- Rule creation with invalid data
+- Rule update operations
+- Rule deletion
+- Cache operations
+- Priority ordering
+
+### Integration Tests
+- End-to-end request flow
+- Multiple rules interaction
+- Cache hit/miss scenarios
+- Whitelist default-deny behavior
+- Performance under load
+
+### Security Tests
+- Invalid admin pubkey rejection
+- Expired event rejection
+- SQL injection attempts
+- Cache poisoning attempts
+- Priority bypass attempts
+
+## Success Criteria
+
+### Functional Requirements
+- ✅ Rules can be created via Admin API
+- ✅ Rules can be updated via Admin API
+- ✅ Rules can be deleted via Admin API
+- ✅ Rules are enforced during request validation
+- ✅ Cache improves performance significantly
+- ✅ Priority ordering works correctly
+- ✅ Whitelist default-deny works correctly
+
+### Performance Requirements
+- ✅ Cache hit latency <200μs
+- ✅ Full validation latency <3ms
+- ✅ Cache hit rate >80% under load
+- ✅ No memory leaks
+- ✅ Database queries optimized
+
+### Security Requirements
+- ✅ Admin authentication required
+- ✅ Input validation prevents injection
+- ✅ Audit logging of all changes
+- ✅ Cache keys prevent poisoning
+- ✅ Whitelist bypass prevented
+
+## Timeline Estimate
+
+| Phase | Duration | Dependencies |
+|-------|----------|--------------|
+| Phase 1: Database Schema | 2-4 hours | None |
+| Phase 2: Admin API | 6-8 hours | Phase 1 |
+| Phase 3: Testing | 4-6 hours | Phase 2 |
+| Phase 4: Documentation | 2-3 hours | Phase 3 |
+| **Total** | **14-21 hours** | Sequential |
+
+## Next Steps
+
+1. **Review this plan** with stakeholders
+2. **Create Phase 1 migration script** in `db/migrations/`
+3. **Test migration** on development database
+4. **Implement Phase 2 endpoints** in `src/admin_api.c`
+5. **Create test suite** in `tests/auth_rules_test.sh`
+6. **Update documentation** in `docs/`
+7. **Deploy to production** with migration guide
+
+## Conclusion
+
+The authentication rules system is **90% complete** - the core logic exists and is well-tested. This implementation plan focuses on the final 10%: adding database tables and Admin API endpoints. The work is straightforward, well-scoped, and can be completed in 2-3 days of focused development.
+
+The system will provide powerful whitelist/blacklist functionality while maintaining the performance and security characteristics already present in the codebase.

docs/MANAGEMENT_SYSTEM_DESIGN.md

@@ -0,0 +1,994 @@
+# Ginxsom Management System Design
+
+## Executive Summary
+
+This document outlines the design for a secure management interface for ginxsom (Blossom media storage server) based on c-relay's proven admin system architecture. The design uses Kind 23456/23457 events with NIP-44 encryption over WebSocket for real-time admin operations.
+
+## 1. System Architecture
+
+### 1.1 High-Level Overview
+
+```mermaid
+graph TB
+    Admin[Admin Client] -->|WebSocket| WS[WebSocket Handler]
+    WS -->|Kind 23456| Auth[Admin Authorization]
+    Auth -->|Decrypt NIP-44| Decrypt[Command Decryption]
+    Decrypt -->|Parse JSON Array| Router[Command Router]
+    Router -->|Route by Command Type| Handlers[Unified Handlers]
+    Handlers -->|Execute| DB[(Database)]
+    Handlers -->|Execute| FS[File System]
+    Handlers -->|Generate Response| Encrypt[NIP-44 Encryption]
+    Encrypt -->|Kind 23457| WS
+    WS -->|WebSocket| Admin
+    
+    style Admin fill:#e1f5ff
+    style Auth fill:#fff3cd
+    style Handlers fill:#d4edda
+    style DB fill:#f8d7da
+```
+
+### 1.2 Component Architecture
+
+```mermaid
+graph LR
+    subgraph "Admin Interface"
+        CLI[CLI Tool]
+        Web[Web Dashboard]
+    end
+    
+    subgraph "ginxsom FastCGI Process"
+        WS[WebSocket Endpoint]
+        Auth[Authorization Layer]
+        Router[Command Router]
+        
+        subgraph "Unified Handlers"
+            BlobH[Blob Handler]
+            StorageH[Storage Handler]
+            ConfigH[Config Handler]
+            StatsH[Stats Handler]
+            SystemH[System Handler]
+        end
+        
+        DB[(SQLite Database)]
+        Storage[Blob Storage]
+    end
+    
+    CLI -->|WebSocket| WS
+    Web -->|WebSocket| WS
+    WS --> Auth
+    Auth --> Router
+    Router --> BlobH
+    Router --> StorageH
+    Router --> ConfigH
+    Router --> StatsH
+    Router --> SystemH
+    
+    BlobH --> DB
+    BlobH --> Storage
+    StorageH --> Storage
+    ConfigH --> DB
+    StatsH --> DB
+    SystemH --> DB
+    
+    style Auth fill:#fff3cd
+    style Router fill:#d4edda
+```
+
+### 1.3 Data Flow for Admin Commands
+
+```mermaid
+sequenceDiagram
+    participant Admin
+    participant WebSocket
+    participant Auth
+    participant Handler
+    participant Database
+    
+    Admin->>WebSocket: Kind 23456 Event (NIP-44 encrypted)
+    WebSocket->>Auth: Verify admin signature
+    Auth->>Auth: Check pubkey matches admin_pubkey
+    Auth->>Auth: Verify event signature
+    Auth->>WebSocket: Authorization OK
+    WebSocket->>Handler: Decrypt & parse command array
+    Handler->>Handler: Validate command structure
+    Handler->>Database: Execute operation
+    Database-->>Handler: Result
+    Handler->>Handler: Build response JSON
+    Handler->>WebSocket: Encrypt response (NIP-44)
+    WebSocket->>Admin: Kind 23457 Event (encrypted response)
+```
+
+### 1.4 Integration with Existing Ginxsom
+
+```mermaid
+graph TB
+    subgraph "Existing Ginxsom"
+        Main[main.c]
+        BUD04[bud04.c - Mirror]
+        BUD06[bud06.c - Requirements]
+        BUD08[bud08.c - NIP-94]
+        BUD09[bud09.c - Report]
+        AdminAPI[admin_api.c - Basic Admin]
+        Validator[request_validator.c]
+    end
+    
+    subgraph "New Management System"
+        AdminWS[admin_websocket.c]
+        AdminAuth[admin_auth.c]
+        AdminHandlers[admin_handlers.c]
+        AdminConfig[admin_config.c]
+    end
+    
+    Main -->|Initialize| AdminWS
+    AdminWS -->|Use| AdminAuth
+    AdminWS -->|Route to| AdminHandlers
+    AdminHandlers -->|Query| BUD04
+    AdminHandlers -->|Query| BUD06
+    AdminHandlers -->|Query| BUD08
+    AdminHandlers -->|Query| BUD09
+    AdminHandlers -->|Update| AdminConfig
+    AdminAuth -->|Use| Validator
+    
+    style AdminWS fill:#d4edda
+    style AdminAuth fill:#fff3cd
+    style AdminHandlers fill:#e1f5ff
+```
+
+## 2. Database Schema
+
+### 2.1 Core Tables
+
+Following c-relay's minimal approach, we need only two tables for key management:
+
+#### relay_seckey Table
+```sql
+-- Stores relay's private key (used for signing Kind 23457 responses)
+CREATE TABLE relay_seckey (
+    private_key_hex TEXT NOT NULL CHECK (length(private_key_hex) = 64),
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);
+```
+
+**Note**: This table stores the relay's private key as plain hex (no encryption). The key is used to:
+- Sign Kind 23457 response events
+- Encrypt responses using NIP-44 (shared secret with admin pubkey)
+
+#### config Table (Extended)
+```sql
+-- Existing config table, add admin_pubkey entry
+INSERT INTO config (key, value, data_type, description, category, requires_restart)
+VALUES (
+    'admin_pubkey',
+    '<64-char-hex-pubkey>',
+    'string',
+    'Public key of authorized admin (hex format)',
+    'security',
+    0
+);
+```
+
+**Note**: Admin public key is stored in the config table, not a separate table. Admin private key is NEVER stored anywhere.
+
+### 2.2 Schema Comparison with c-relay
+
+| c-relay | ginxsom | Purpose |
+|---------|---------|---------|
+| `relay_seckey` (private_key_hex, created_at) | `relay_seckey` (private_key_hex, created_at) | Relay private key storage |
+| `config` table entry for admin_pubkey | `config` table entry for admin_pubkey | Admin authorization |
+| No audit log | No audit log | Keep it simple |
+| No processed events tracking | No processed events tracking | Stateless processing |
+
+### 2.3 Key Storage Strategy
+
+**Relay Private Key**:
+- Stored in `relay_seckey` table as plain 64-character hex
+- Generated on first startup or provided via `--relay-privkey` CLI option
+- Used for signing Kind 23457 responses and NIP-44 encryption
+- Never exposed via API
+
+**Admin Public Key**:
+- Stored in `config` table as plain 64-character hex
+- Generated on first startup or provided via `--admin-pubkey` CLI option
+- Used to verify Kind 23456 command signatures
+- Can be queried via admin API
+
+**Admin Private Key**:
+- NEVER stored anywhere in the system
+- Kept only by the admin in their client/tool
+- Used to sign Kind 23456 commands and decrypt Kind 23457 responses
+
+## 3. API Design
+
+### 3.1 Command Structure
+
+Following c-relay's pattern, all commands use JSON array format:
+
+```json
+["command_name", {"param1": "value1", "param2": "value2"}]
+```
+
+### 3.2 Event Structure
+
+#### Kind 23456 - Admin Command Event
+
+```json
+{
+  "kind": 23456,
+  "pubkey": "<admin-pubkey-hex>",
+  "created_at": 1234567890,
+  "tags": [
+    ["p", "<relay-pubkey-hex>"]
+  ],
+  "content": "<nip44-encrypted-command-array>",
+  "sig": "<signature>"
+}
+```
+
+**Content (decrypted)**:
+```json
+["blob_list", {"limit": 100, "offset": 0}]
+```
+
+#### Kind 23457 - Admin Response Event
+
+```json
+{
+  "kind": 23457,
+  "pubkey": "<relay-pubkey-hex>",
+  "created_at": 1234567890,
+  "tags": [
+    ["p", "<admin-pubkey-hex>"],
+    ["e", "<original-command-event-id>"]
+  ],
+  "content": "<nip44-encrypted-response>",
+  "sig": "<signature>"
+}
+```
+
+**Content (decrypted)**:
+```json
+{
+  "success": true,
+  "data": {
+    "blobs": [
+      {"sha256": "abc123...", "size": 1024, "type": "image/png"},
+      {"sha256": "def456...", "size": 2048, "type": "video/mp4"}
+    ],
+    "total": 2
+  }
+}
+```
+
+### 3.3 Command Categories
+
+#### Blob Operations
+- `blob_list` - List blobs with pagination
+- `blob_info` - Get detailed blob information
+- `blob_delete` - Delete blob(s)
+- `blob_mirror` - Mirror blob from another server
+
+#### Storage Management
+- `storage_stats` - Get storage usage statistics
+- `storage_quota` - Get/set storage quotas
+- `storage_cleanup` - Clean up orphaned files
+
+#### Configuration
+- `config_get` - Get configuration value(s)
+- `config_set` - Set configuration value(s)
+- `config_list` - List all configuration
+- `auth_rules_list` - List authentication rules
+- `auth_rules_add` - Add authentication rule
+- `auth_rules_remove` - Remove authentication rule
+
+#### Statistics
+- `stats_uploads` - Upload statistics
+- `stats_bandwidth` - Bandwidth usage
+- `stats_storage` - Storage usage over time
+- `stats_users` - User activity statistics
+
+#### System
+- `system_info` - Get system information
+- `system_restart` - Restart server (graceful)
+- `system_backup` - Trigger database backup
+- `system_restore` - Restore from backup
+
+### 3.4 Command Examples
+
+#### Example 1: List Blobs
+```json
+// Command (Kind 23456 content, decrypted)
+["blob_list", {
+  "limit": 50,
+  "offset": 0,
+  "type": "image/*",
+  "sort": "created_at",
+  "order": "desc"
+}]
+
+// Response (Kind 23457 content, decrypted)
+{
+  "success": true,
+  "data": {
+    "blobs": [
+      {
+        "sha256": "abc123...",
+        "size": 102400,
+        "type": "image/png",
+        "created": 1234567890,
+        "url": "https://blossom.example.com/abc123.png"
+      }
+    ],
+    "total": 150,
+    "limit": 50,
+    "offset": 0
+  }
+}
+```
+
+#### Example 2: Delete Blob
+```json
+// Command
+["blob_delete", {
+  "sha256": "abc123...",
+  "confirm": true
+}]
+
+// Response
+{
+  "success": true,
+  "data": {
+    "deleted": true,
+    "sha256": "abc123...",
+    "freed_bytes": 102400
+  }
+}
+```
+
+#### Example 3: Get Storage Stats
+```json
+// Command
+["storage_stats", {}]
+
+// Response
+{
+  "success": true,
+  "data": {
+    "total_blobs": 1500,
+    "total_bytes": 5368709120,
+    "total_bytes_human": "5.0 GB",
+    "disk_usage": {
+      "used": 5368709120,
+      "available": 94631291904,
+      "total": 100000000000,
+      "percent": 5.4
+    },
+    "by_type": {
+      "image/png": {"count": 500, "bytes": 2147483648},
+      "image/jpeg": {"count": 300, "bytes": 1610612736},
+      "video/mp4": {"count": 200, "bytes": 1610612736}
+    }
+  }
+}
+```
+
+#### Example 4: Set Configuration
+```json
+// Command
+["config_set", {
+  "max_upload_size": 10485760,
+  "allowed_mime_types": ["image/*", "video/mp4"]
+}]
+
+// Response
+{
+  "success": true,
+  "data": {
+    "updated": ["max_upload_size", "allowed_mime_types"],
+    "requires_restart": false
+  }
+}
+```
+
+### 3.5 Error Handling
+
+All errors follow consistent format:
+
+```json
+{
+  "success": false,
+  "error": {
+    "code": "BLOB_NOT_FOUND",
+    "message": "Blob with hash abc123... not found",
+    "details": {
+      "sha256": "abc123..."
+    }
+  }
+}
+```
+
+**Error Codes**:
+- `UNAUTHORIZED` - Invalid admin signature
+- `INVALID_COMMAND` - Unknown command or malformed structure
+- `INVALID_PARAMS` - Missing or invalid parameters
+- `BLOB_NOT_FOUND` - Requested blob doesn't exist
+- `STORAGE_FULL` - Storage quota exceeded
+- `DATABASE_ERROR` - Database operation failed
+- `SYSTEM_ERROR` - Internal server error
+
+## 4. File Structure
+
+### 4.1 New Files to Create
+
+```
+src/
+├── admin_websocket.c       # WebSocket endpoint for admin commands
+├── admin_websocket.h       # WebSocket handler declarations
+├── admin_auth.c            # Admin authorization (adapted from c-relay)
+├── admin_auth.h            # Authorization function declarations
+├── admin_handlers.c        # Unified command handlers
+├── admin_handlers.h        # Handler function declarations
+├── admin_config.c          # Configuration management
+├── admin_config.h          # Config function declarations
+└── admin_keys.c            # Key generation and storage
+    admin_keys.h            # Key management declarations
+
+include/
+└── admin_system.h          # Public admin system interface
+```
+
+### 4.2 Files to Adapt from c-relay
+
+| c-relay File | Purpose | Adaptation for ginxsom |
+|--------------|---------|------------------------|
+| `dm_admin.c` | Admin event processing | → `admin_websocket.c` (WebSocket instead of DM) |
+| `api.c` (lines 768-838) | NIP-44 encryption/response | → `admin_handlers.c` (response generation) |
+| `config.c` (lines 500-583) | Key storage/retrieval | → `admin_keys.c` (relay key management) |
+| `main.c` (lines 1389-1556) | CLI argument parsing | → `main.c` (add admin CLI options) |
+
+### 4.3 Integration with Existing Files
+
+**src/main.c**:
+- Add CLI options: `--admin-pubkey`, `--relay-privkey`
+- Initialize admin WebSocket endpoint
+- Generate keys on first startup
+
+**src/admin_api.c** (existing):
+- Keep existing basic admin API
+- Add WebSocket admin endpoint
+- Route Kind 23456 events to new handlers
+
+**db/schema.sql**:
+- Add `relay_seckey` table
+- Add `admin_pubkey` to config table
+
+## 5. Implementation Plan
+
+### 5.1 Phase 1: Foundation (Week 1)
+
+**Goal**: Set up key management and database schema
+
+**Tasks**:
+1. Create `relay_seckey` table in schema
+2. Add `admin_pubkey` to config table
+3. Implement `admin_keys.c`:
+   - `generate_relay_keypair()`
+   - `generate_admin_keypair()`
+   - `store_relay_private_key()`
+   - `load_relay_private_key()`
+   - `get_admin_pubkey()`
+4. Update `main.c`:
+   - Add CLI options (`--admin-pubkey`, `--relay-privkey`)
+   - Generate keys on first startup
+   - Print keys once (like c-relay)
+5. Test key generation and storage
+
+**Deliverables**:
+- Working key generation
+- Keys stored in database
+- CLI options functional
+
+### 5.2 Phase 2: Authorization (Week 2)
+
+**Goal**: Implement admin event authorization
+
+**Tasks**:
+1. Create `admin_auth.c` (adapted from c-relay's authorization):
+   - `verify_admin_event()` - Check Kind 23456 signature
+   - `check_admin_pubkey()` - Verify against stored admin_pubkey
+   - `verify_relay_target()` - Check 'p' tag matches relay pubkey
+2. Add NIP-44 crypto functions (use existing nostr_core_lib):
+   - `decrypt_admin_command()` - Decrypt Kind 23456 content
+   - `encrypt_admin_response()` - Encrypt Kind 23457 content
+3. Test authorization flow
+4. Test encryption/decryption
+
+**Deliverables**:
+- Working authorization layer
+- NIP-44 encryption functional
+- Unit tests for auth
+
+### 5.3 Phase 3: WebSocket Endpoint (Week 3)
+
+**Goal**: Create WebSocket handler for admin commands
+
+**Tasks**:
+1. Create `admin_websocket.c`:
+   - WebSocket endpoint at `/admin` or similar
+   - Receive Kind 23456 events
+   - Route to authorization layer
+   - Parse command array from decrypted content
+   - Route to appropriate handler
+   - Build Kind 23457 response
+   - Send encrypted response
+2. Integrate with existing FastCGI WebSocket handling
+3. Add connection management
+4. Test WebSocket communication
+
+**Deliverables**:
+- Working WebSocket endpoint
+- Event routing functional
+- Response generation working
+
+### 5.4 Phase 4: Command Handlers (Week 4-5)
+
+**Goal**: Implement unified command handlers
+
+**Tasks**:
+1. Create `admin_handlers.c` with unified handler pattern:
+   - `handle_blob_command()` - Blob operations
+   - `handle_storage_command()` - Storage management
+   - `handle_config_command()` - Configuration
+   - `handle_stats_command()` - Statistics
+   - `handle_system_command()` - System operations
+2. Implement each command:
+   - Blob: list, info, delete, mirror
+   - Storage: stats, quota, cleanup
+   - Config: get, set, list, auth_rules
+   - Stats: uploads, bandwidth, storage, users
+   - System: info, restart, backup, restore
+3. Add validation for each command
+4. Test each command individually
+
+**Deliverables**:
+- All commands implemented
+- Validation working
+- Integration tests passing
+
+### 5.5 Phase 5: Testing & Documentation (Week 6)
+
+**Goal**: Comprehensive testing and documentation
+
+**Tasks**:
+1. Create test suite:
+   - Unit tests for each handler
+   - Integration tests for full flow
+   - Security tests for authorization
+   - Performance tests for WebSocket
+2. Create admin CLI tool (simple Node.js/Python script):
+   - Generate Kind 23456 events
+   - Send via WebSocket
+   - Decrypt Kind 23457 responses
+   - Pretty-print results
+3. Write documentation:
+   - Admin API reference
+   - CLI tool usage guide
+   - Security best practices
+   - Troubleshooting guide
+4. Create example scripts
+
+**Deliverables**:
+- Complete test suite
+- Working CLI tool
+- Full documentation
+- Example scripts
+
+### 5.6 Phase 6: Web Dashboard (Optional, Week 7-8)
+
+**Goal**: Create web-based admin interface
+
+**Tasks**:
+1. Design web UI (React/Vue/Svelte)
+2. Implement WebSocket client
+3. Create command forms
+4. Add real-time updates
+5. Deploy dashboard
+
+**Deliverables**:
+- Working web dashboard
+- User documentation
+- Deployment guide
+
+## 6. Security Considerations
+
+### 6.1 Key Security
+
+**Relay Private Key**:
+- Stored in database as plain hex (following c-relay pattern)
+- Never exposed via API
+- Used only for signing responses
+- Backed up with database
+
+**Admin Private Key**:
+- NEVER stored on server
+- Kept only by admin
+- Used to sign commands
+- Should be stored securely by admin (password manager, hardware key, etc.)
+
+**Admin Public Key**:
+- Stored in config table
+- Used for authorization
+- Can be rotated by updating config
+
+### 6.2 Authorization Flow
+
+1. Receive Kind 23456 event
+2. Verify event signature (nostr_verify_event_signature)
+3. Check pubkey matches admin_pubkey from config
+4. Verify 'p' tag targets this relay
+5. Decrypt content using NIP-44
+6. Parse and validate command
+7. Execute command
+8. Encrypt response using NIP-44
+9. Sign Kind 23457 response
+10. Send response
+
+### 6.3 Attack Mitigation
+
+**Replay Attacks**:
+- Check event timestamp (reject old events)
+- Optional: Track processed event IDs (if needed)
+
+**Unauthorized Access**:
+- Strict pubkey verification
+- Signature validation
+- Relay targeting check
+
+**Command Injection**:
+- Validate all command parameters
+- Use parameterized SQL queries
+- Sanitize file paths
+
+**DoS Protection**:
+- Rate limit admin commands
+- Timeout long-running operations
+- Limit response sizes
+
+## 7. Command Line Interface
+
+### 7.1 CLI Options (Following c-relay Pattern)
+
+```bash
+ginxsom [OPTIONS]
+
+Options:
+  -h, --help                Show help message
+  -v, --version             Show version information
+  -p, --port PORT           Override server port
+  --strict-port             Fail if exact port unavailable
+  -a, --admin-pubkey KEY    Override admin public key (hex or npub)
+  -r, --relay-privkey KEY   Override relay private key (hex or nsec)
+  --debug-level=N           Set debug level (0-5)
+
+Examples:
+  ginxsom                           # Start server (auto-generate keys on first run)
+  ginxsom -p 8080                   # Start on port 8080
+  ginxsom -a <npub>                 # Set admin pubkey
+  ginxsom -r <nsec>                 # Set relay privkey
+  ginxsom --debug-level=3           # Enable info-level debugging
+```
+
+### 7.2 First Startup Behavior
+
+On first startup (no database exists):
+
+1. Generate relay keypair
+2. Generate admin keypair
+3. Print keys ONCE to console:
+```
+=== Ginxsom First Startup ===
+
+Relay Keys (for server):
+  Public Key (npub): npub1...
+  Private Key (nsec): nsec1...
+
+Admin Keys (for you):
+  Public Key (npub): npub1...
+  Private Key (nsec): nsec1...
+
+IMPORTANT: Save these keys securely!
+The admin private key will NOT be shown again.
+The relay private key is stored in the database.
+
+Database created: <relay-pubkey>.db
+```
+
+4. Store relay private key in database
+5. Store admin public key in config
+6. Start server
+
+### 7.3 Subsequent Startups
+
+On subsequent startups:
+
+1. Find existing database file
+2. Load relay private key from database
+3. Load admin public key from config
+4. Apply CLI overrides if provided
+5. Start server
+
+## 8. Comparison with c-relay
+
+### 8.1 Similarities
+
+| Feature | c-relay | ginxsom |
+|---------|---------|---------|
+| Event Types | Kind 23456/23457 | Kind 23456/23457 |
+| Encryption | NIP-44 | NIP-44 |
+| Command Format | JSON arrays | JSON arrays |
+| Key Storage | relay_seckey table | relay_seckey table |
+| Admin Auth | config table | config table |
+| CLI Options | --admin-pubkey, --relay-privkey | --admin-pubkey, --relay-privkey |
+| Response Format | Encrypted JSON | Encrypted JSON |
+
+### 8.2 Differences
+
+| Aspect | c-relay | ginxsom |
+|--------|---------|---------|
+| Transport | WebSocket (Nostr relay) | WebSocket (FastCGI) |
+| Commands | Relay-specific (auth, config, stats) | Blossom-specific (blob, storage, mirror) |
+| Database | SQLite (events) | SQLite (blobs + metadata) |
+| File Storage | N/A | Blob storage on disk |
+| Integration | Standalone relay | FastCGI + nginx |
+
+### 8.3 Architectural Decisions
+
+**Why follow c-relay's pattern?**
+1. Proven in production
+2. Simple and secure
+3. No complex key management
+4. Minimal database schema
+5. Easy to understand and maintain
+
+**What we're NOT doing (from initial design)**:
+1. ❌ NIP-17 gift wrap (too complex)
+2. ❌ Separate admin_keys table (use config)
+3. ❌ Audit log table (keep it simple)
+4. ❌ Processed events tracking (stateless)
+5. ❌ Key encryption before storage (plain hex)
+6. ❌ Migration strategy (new project)
+
+## 9. Testing Strategy
+
+### 9.1 Unit Tests
+
+**admin_keys.c**:
+- Key generation produces valid keys
+- Keys can be stored and retrieved
+- Invalid keys are rejected
+
+**admin_auth.c**:
+- Valid admin events pass authorization
+- Invalid signatures are rejected
+- Wrong pubkeys are rejected
+- Expired events are rejected
+
+**admin_handlers.c**:
+- Each command handler works correctly
+- Invalid parameters are rejected
+- Error responses are properly formatted
+
+### 9.2 Integration Tests
+
+**Full Flow**:
+1. Generate admin keypair
+2. Create Kind 23456 command
+3. Send via WebSocket
+4. Verify authorization
+5. Execute command
+6. Receive Kind 23457 response
+7. Decrypt and verify response
+
+**Security Tests**:
+- Unauthorized pubkey rejected
+- Invalid signature rejected
+- Replay attack prevented
+- Command injection prevented
+
+### 9.3 Performance Tests
+
+- WebSocket connection handling
+- Command processing latency
+- Concurrent admin operations
+- Large response handling
+
+## 10. Future Enhancements
+
+### 10.1 Short Term
+
+1. **Command History**: Track admin commands for audit
+2. **Multi-Admin Support**: Multiple authorized admin pubkeys
+3. **Role-Based Access**: Different permission levels
+4. **Batch Operations**: Execute multiple commands in one request
+
+### 10.2 Long Term
+
+1. **Web Dashboard**: Full-featured web UI
+2. **Monitoring Integration**: Prometheus/Grafana metrics
+3. **Backup Automation**: Scheduled backups
+4. **Replication**: Multi-server blob replication
+5. **Advanced Analytics**: Usage patterns, trends, predictions
+
+## 11. References
+
+### 11.1 Nostr NIPs
+
+- **NIP-01**: Basic protocol flow
+- **NIP-04**: Encrypted Direct Messages (deprecated, but reference)
+- **NIP-19**: bech32-encoded entities (npub, nsec)
+- **NIP-44**: Versioned Encryption (used for admin commands)
+
+### 11.2 Blossom Specifications
+
+- **BUD-01**: Blob Upload/Download
+- **BUD-02**: Blob Descriptor
+- **BUD-04**: Mirroring
+- **BUD-06**: Upload Requirements
+- **BUD-08**: NIP-94 Integration
+- **BUD-09**: Blob Reporting
+
+### 11.3 c-relay Source Files
+
+- `c-relay/src/dm_admin.c` - Admin event processing
+- `c-relay/src/api.c` - NIP-44 encryption
+- `c-relay/src/config.c` - Key storage
+- `c-relay/src/main.c` - CLI options
+- `c-relay/src/sql_schema.h` - Database schema
+
+## 12. Appendix
+
+### 12.1 Example Admin CLI Tool (Python)
+
+```python
+#!/usr/bin/env python3
+"""
+Ginxsom Admin CLI Tool
+Sends admin commands to ginxsom server via WebSocket
+"""
+
+import asyncio
+import websockets
+import json
+from nostr_sdk import Keys, Event, EventBuilder, Kind
+
+class GinxsomAdmin:
+    def __init__(self, server_url, admin_nsec, relay_npub):
+        self.server_url = server_url
+        self.admin_keys = Keys.parse(admin_nsec)
+        self.relay_pubkey = Keys.parse(relay_npub).public_key()
+        
+    async def send_command(self, command, params):
+        """Send admin command and wait for response"""
+        # Build command array
+        command_array = [command, params]
+        
+        # Encrypt with NIP-44
+        encrypted = self.admin_keys.nip44_encrypt(
+            self.relay_pubkey,
+            json.dumps(command_array)
+        )
+        
+        # Build Kind 23456 event
+        event = EventBuilder(
+            Kind(23456),
+            encrypted,
+            [["p", str(self.relay_pubkey)]]
+        ).to_event(self.admin_keys)
+        
+        # Send via WebSocket
+        async with websockets.connect(self.server_url) as ws:
+            await ws.send(json.dumps(event.as_json()))
+            
+            # Wait for Kind 23457 response
+            response = await ws.recv()
+            response_event = Event.from_json(response)
+            
+            # Decrypt response
+            decrypted = self.admin_keys.nip44_decrypt(
+                self.relay_pubkey,
+                response_event.content()
+            )
+            
+            return json.loads(decrypted)
+
+# Usage
+async def main():
+    admin = GinxsomAdmin(
+        "ws://localhost:8080/admin",
+        "nsec1...",  # Admin private key
+        "npub1..."   # Relay public key
+    )
+    
+    # List blobs
+    result = await admin.send_command("blob_list", {
+        "limit": 10,
+        "offset": 0
+    })
+    
+    print(json.dumps(result, indent=2))
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+### 12.2 Database Schema SQL
+
+```sql
+-- Add to db/schema.sql
+
+-- Relay Private Key Storage
+CREATE TABLE relay_seckey (
+    private_key_hex TEXT NOT NULL CHECK (length(private_key_hex) = 64),
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);
+
+-- Admin Public Key (add to config table)
+INSERT INTO config (key, value, data_type, description, category, requires_restart)
+VALUES (
+    'admin_pubkey',
+    '',  -- Set during first startup
+    'string',
+    'Public key of authorized admin (64-char hex)',
+    'security',
+    0
+);
+
+-- Relay Public Key (add to config table)
+INSERT INTO config (key, value, data_type, description, category, requires_restart)
+VALUES (
+    'relay_pubkey',
+    '',  -- Set during first startup
+    'string',
+    'Public key of this relay (64-char hex)',
+    'server',
+    0
+);
+```
+
+### 12.3 Makefile Updates
+
+```makefile
+# Add to Makefile
+
+# Admin system objects
+ADMIN_OBJS = build/admin_websocket.o \
+             build/admin_auth.o \
+             build/admin_handlers.o \
+             build/admin_config.o \
+             build/admin_keys.o
+
+# Update main target
+build/ginxsom-fcgi: $(OBJS) $(ADMIN_OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS)
+
+# Admin system rules
+build/admin_websocket.o: src/admin_websocket.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+build/admin_auth.o: src/admin_auth.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+build/admin_handlers.o: src/admin_handlers.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+build/admin_config.o: src/admin_config.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+build/admin_keys.o: src/admin_keys.c
+	$(CC) $(CFLAGS) -c $< -o $@
+```
+
+---
+
+**Document Version**: 2.0  
+**Last Updated**: 2025-01-16  
+**Status**: Ready for Implementation

docs/PRODUCTION_MIGRATION_PLAN.md

@@ -0,0 +1,356 @@
+# Production Directory Structure Migration Plan
+
+## Overview
+
+This document outlines the plan to migrate the ginxsom production deployment from the current configuration to a new, more organized directory structure.
+
+## Current Configuration (As-Is)
+
+```
+Binary Location:     /var/www/html/blossom/ginxsom.fcgi
+Database Location:   /var/www/html/blossom/ginxsom.db
+Data Directory:      /var/www/html/blossom/
+Working Directory:   /var/www/html/blossom/ (set via spawn-fcgi -d)
+Socket:              /tmp/ginxsom-fcgi.sock
+```
+
+**Issues with Current Setup:**
+1. Binary and database mixed with data files in web-accessible directory
+2. Database path hardcoded as relative path `db/ginxsom.db` but database is at root of working directory
+3. No separation between application files and user data
+4. Security concern: application files in web root
+
+## Target Configuration (To-Be)
+
+```
+Binary Location:     /home/ubuntu/ginxsom/ginxsom.fcgi
+Database Location:   /home/ubuntu/ginxsom/db/ginxsom.db
+Data Directory:      /var/www/html/blossom/
+Working Directory:   /home/ubuntu/ginxsom/ (set via spawn-fcgi -d)
+Socket:              /tmp/ginxsom-fcgi.sock
+```
+
+**Benefits of New Setup:**
+1. Application files separated from user data
+2. Database in proper subdirectory structure
+3. Application files outside web root (better security)
+4. Clear separation of concerns
+5. Easier backup and maintenance
+
+## Directory Structure
+
+### Application Directory: `/home/ubuntu/ginxsom/`
+```
+/home/ubuntu/ginxsom/
+├── ginxsom.fcgi          # FastCGI binary
+├── db/
+│   └── ginxsom.db        # SQLite database
+├── build/                # Build artifacts (from rsync)
+├── src/                  # Source code (from rsync)
+├── include/              # Headers (from rsync)
+├── config/               # Config files (from rsync)
+└── scripts/              # Utility scripts (from rsync)
+```
+
+### Data Directory: `/var/www/html/blossom/`
+```
+/var/www/html/blossom/
+├── <sha256>.jpg          # User uploaded files
+├── <sha256>.png
+├── <sha256>.mp4
+└── ...
+```
+
+## Command-Line Arguments
+
+The ginxsom binary supports these arguments (from [`src/main.c`](src/main.c:1488-1509)):
+
+```bash
+--db-path PATH       # Database file path (default: db/ginxsom.db)
+--storage-dir DIR    # Storage directory for files (default: .)
+--help, -h          # Show help message
+```
+
+## Migration Steps
+
+### 1. Update deploy_lt.sh Configuration
+
+Update the configuration variables in [`deploy_lt.sh`](deploy_lt.sh:16-23):
+
+```bash
+# Configuration
+REMOTE_HOST="laantungir.net"
+REMOTE_USER="ubuntu"
+REMOTE_DIR="/home/ubuntu/ginxsom"
+REMOTE_DB_PATH="/home/ubuntu/ginxsom/db/ginxsom.db"
+REMOTE_NGINX_CONFIG="/etc/nginx/conf.d/default.conf"
+REMOTE_BINARY_PATH="/home/ubuntu/ginxsom/ginxsom.fcgi"
+REMOTE_SOCKET="/tmp/ginxsom-fcgi.sock"
+REMOTE_DATA_DIR="/var/www/html/blossom"
+```
+
+### 2. Update Binary Deployment
+
+Modify the binary copy section (lines 82-97) to use new path:
+
+```bash
+# Copy binary to application directory (not web directory)
+print_status "Copying ginxsom binary to application directory..."
+ssh $REMOTE_USER@$REMOTE_HOST << EOF
+    # Stop any running process first
+    sudo pkill -f ginxsom-fcgi || true
+    sleep 1
+
+    # Remove old binary if it exists
+    rm -f $REMOTE_BINARY_PATH
+
+    # Copy new binary
+    cp $REMOTE_DIR/build/ginxsom-fcgi $REMOTE_BINARY_PATH
+    chmod +x $REMOTE_BINARY_PATH
+    chown ubuntu:ubuntu $REMOTE_BINARY_PATH
+
+    echo "Binary copied successfully"
+EOF
+```
+
+### 3. Create Database Directory Structure
+
+Add database setup before starting FastCGI:
+
+```bash
+# Setup database directory
+print_status "Setting up database directory..."
+ssh $REMOTE_USER@$REMOTE_HOST << EOF
+    # Create db directory if it doesn't exist
+    mkdir -p $REMOTE_DIR/db
+    
+    # Copy database if it exists in old location
+    if [ -f /var/www/html/blossom/ginxsom.db ]; then
+        echo "Migrating database from old location..."
+        cp /var/www/html/blossom/ginxsom.db $REMOTE_DB_PATH
+    elif [ ! -f $REMOTE_DB_PATH ]; then
+        echo "Initializing new database..."
+        # Database will be created by application on first run
+    fi
+    
+    # Set proper permissions
+    chown -R ubuntu:ubuntu $REMOTE_DIR/db
+    chmod 755 $REMOTE_DIR/db
+    chmod 644 $REMOTE_DB_PATH 2>/dev/null || true
+    
+    echo "Database directory setup complete"
+EOF
+```
+
+### 4. Update spawn-fcgi Command
+
+Modify the FastCGI startup (line 164) to include command-line arguments:
+
+```bash
+# Start FastCGI process with explicit paths
+echo "Starting ginxsom FastCGI..."
+sudo spawn-fcgi \
+    -M 666 \
+    -u www-data \
+    -g www-data \
+    -s $REMOTE_SOCKET \
+    -U www-data \
+    -G www-data \
+    -d $REMOTE_DIR \
+    -- $REMOTE_BINARY_PATH \
+        --db-path "$REMOTE_DB_PATH" \
+        --storage-dir "$REMOTE_DATA_DIR"
+```
+
+**Key Changes:**
+- `-d $REMOTE_DIR`: Sets working directory to `/home/ubuntu/ginxsom/`
+- `--db-path "$REMOTE_DB_PATH"`: Explicit database path
+- `--storage-dir "$REMOTE_DATA_DIR"`: Explicit data directory
+
+### 5. Verify Permissions
+
+Ensure proper permissions for all directories:
+
+```bash
+# Application directory - owned by ubuntu
+sudo chown -R ubuntu:ubuntu /home/ubuntu/ginxsom
+sudo chmod 755 /home/ubuntu/ginxsom
+sudo chmod +x /home/ubuntu/ginxsom/ginxsom.fcgi
+
+# Database directory - readable by www-data
+sudo chmod 755 /home/ubuntu/ginxsom/db
+sudo chmod 644 /home/ubuntu/ginxsom/db/ginxsom.db
+
+# Data directory - writable by www-data
+sudo chown -R www-data:www-data /var/www/html/blossom
+sudo chmod 755 /var/www/html/blossom
+```
+
+## Path Resolution Logic
+
+### How Paths Work with spawn-fcgi -d Option
+
+When spawn-fcgi starts the FastCGI process:
+
+1. **Working Directory**: Set to `/home/ubuntu/ginxsom/` via `-d` option
+2. **Relative Paths**: Resolved from working directory
+3. **Absolute Paths**: Used as-is
+
+### Default Behavior (Without Arguments)
+
+From [`src/main.c`](src/main.c:30-31):
+```c
+char g_db_path[MAX_PATH_LEN] = "db/ginxsom.db";  // Relative to working dir
+char g_storage_dir[MAX_PATH_LEN] = ".";          // Current working dir
+```
+
+With working directory `/home/ubuntu/ginxsom/`:
+- Database: `/home/ubuntu/ginxsom/db/ginxsom.db` ✓
+- Storage: `/home/ubuntu/ginxsom/` ✗ (wrong - we want `/var/www/html/blossom/`)
+
+### With Command-Line Arguments
+
+```bash
+--db-path "/home/ubuntu/ginxsom/db/ginxsom.db"
+--storage-dir "/var/www/html/blossom"
+```
+
+Result:
+- Database: `/home/ubuntu/ginxsom/db/ginxsom.db` ✓
+- Storage: `/var/www/html/blossom/` ✓
+
+## Testing Plan
+
+### 1. Pre-Migration Verification
+```bash
+# Check current setup
+ssh ubuntu@laantungir.net "
+    echo 'Current binary location:'
+    ls -la /var/www/html/blossom/ginxsom.fcgi
+    
+    echo 'Current database location:'
+    ls -la /var/www/html/blossom/ginxsom.db
+    
+    echo 'Current process:'
+    ps aux | grep ginxsom-fcgi | grep -v grep
+"
+```
+
+### 2. Post-Migration Verification
+```bash
+# Check new setup
+ssh ubuntu@laantungir.net "
+    echo 'New binary location:'
+    ls -la /home/ubuntu/ginxsom/ginxsom.fcgi
+    
+    echo 'New database location:'
+    ls -la /home/ubuntu/ginxsom/db/ginxsom.db
+    
+    echo 'Data directory:'
+    ls -la /var/www/html/blossom/ | head -10
+    
+    echo 'Process working directory:'
+    sudo ls -la /proc/\$(pgrep -f ginxsom.fcgi)/cwd
+    
+    echo 'Process command line:'
+    ps aux | grep ginxsom-fcgi | grep -v grep
+"
+```
+
+### 3. Functional Testing
+```bash
+# Test health endpoint
+curl -k https://blossom.laantungir.net/health
+
+# Test file upload
+./tests/file_put_production.sh
+
+# Test file retrieval
+curl -k -I https://blossom.laantungir.net/<sha256>
+
+# Test list endpoint
+curl -k https://blossom.laantungir.net/list/<pubkey>
+```
+
+## Rollback Plan
+
+If migration fails:
+
+1. **Stop new process:**
+   ```bash
+   sudo pkill -f ginxsom-fcgi
+   ```
+
+2. **Restore old binary location:**
+   ```bash
+   sudo cp /home/ubuntu/ginxsom/build/ginxsom-fcgi /var/www/html/blossom/ginxsom.fcgi
+   sudo chown www-data:www-data /var/www/html/blossom/ginxsom.fcgi
+   ```
+
+3. **Restart with old configuration:**
+   ```bash
+   sudo spawn-fcgi -M 666 -u www-data -g www-data \
+       -s /tmp/ginxsom-fcgi.sock \
+       -U www-data -G www-data \
+       -d /var/www/html/blossom \
+       /var/www/html/blossom/ginxsom.fcgi
+   ```
+
+## Additional Considerations
+
+### 1. Database Backup
+Before migration, backup the current database:
+```bash
+ssh ubuntu@laantungir.net "
+    cp /var/www/html/blossom/ginxsom.db /var/www/html/blossom/ginxsom.db.backup
+"
+```
+
+### 2. NIP-94 Origin Configuration
+After migration, update [`src/bud08.c`](src/bud08.c) to return production domain:
+```c
+void nip94_get_origin(char *origin, size_t origin_size) {
+    snprintf(origin, origin_size, "https://blossom.laantungir.net");
+}
+```
+
+### 3. Monitoring
+Monitor logs after migration:
+```bash
+# Application logs
+ssh ubuntu@laantungir.net "sudo journalctl -u nginx -f"
+
+# FastCGI process
+ssh ubuntu@laantungir.net "ps aux | grep ginxsom-fcgi"
+```
+
+## Success Criteria
+
+Migration is successful when:
+
+1. ✓ Binary running from `/home/ubuntu/ginxsom/ginxsom.fcgi`
+2. ✓ Database accessible at `/home/ubuntu/ginxsom/db/ginxsom.db`
+3. ✓ Files stored in `/var/www/html/blossom/`
+4. ✓ Health endpoint returns 200 OK
+5. ✓ File upload works correctly
+6. ✓ File retrieval works correctly
+7. ✓ Database queries succeed
+8. ✓ No permission errors in logs
+
+## Timeline
+
+1. **Preparation**: Update deploy_lt.sh script (15 minutes)
+2. **Backup**: Backup current database (5 minutes)
+3. **Migration**: Run updated deployment script (10 minutes)
+4. **Testing**: Verify all endpoints (15 minutes)
+5. **Monitoring**: Watch for issues (30 minutes)
+
+**Total Estimated Time**: ~75 minutes
+
+## References
+
+- Current deployment script: [`deploy_lt.sh`](deploy_lt.sh)
+- Main application: [`src/main.c`](src/main.c)
+- Command-line parsing: [`src/main.c:1488-1509`](src/main.c:1488-1509)
+- Global configuration: [`src/main.c:30-31`](src/main.c:30-31)
+- Database operations: [`src/main.c:333-385`](src/main.c:333-385)

include/ginxsom.h

@@ -33,6 +33,10 @@
 #define DEFAULT_MAX_BLOBS_PER_USER 1000
 #define DEFAULT_RATE_LIMIT 10
 
+/* Global configuration variables */
+extern char g_db_path[MAX_PATH_LEN];
+extern char g_storage_dir[MAX_PATH_LEN];
+
 /* Error codes */
 typedef enum {
     GINXSOM_OK = 0,

increment_and_push.sh

@@ -131,21 +131,48 @@ increment_version() {
     export NEW_VERSION
 }
 
+# Function to update version in header file
+update_version_in_header() {
+    local version="$1"
+    print_status "Updating version in src/ginxsom.h to $version..."
+
+    # Extract version components (remove 'v' prefix)
+    local version_no_v=${version#v}
+
+    # Parse major.minor.patch using regex
+    if [[ $version_no_v =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+        local major=${BASH_REMATCH[1]}
+        local minor=${BASH_REMATCH[2]}
+        local patch=${BASH_REMATCH[3]}
+
+        # Update the header file
+        sed -i "s/#define VERSION_MAJOR [0-9]\+/#define VERSION_MAJOR $major/" src/ginxsom.h
+        sed -i "s/#define VERSION_MINOR [0-9]\+/#define VERSION_MINOR $minor/" src/ginxsom.h
+        sed -i "s/#define VERSION_PATCH [0-9]\+/#define VERSION_PATCH $patch/" src/ginxsom.h
+        sed -i "s/#define VERSION \"v[0-9]\+\.[0-9]\+\.[0-9]\+\"/#define VERSION \"$version\"/" src/ginxsom.h
+
+        print_success "Updated version in header file"
+    else
+        print_error "Invalid version format: $version"
+        exit 1
+    fi
+}
+
 # Function to compile the Ginxsom project
 compile_project() {
     print_status "Compiling Ginxsom FastCGI server..."
-    
+
     # Clean previous build
     if make clean > /dev/null 2>&1; then
         print_success "Cleaned previous build"
     else
         print_warning "Clean failed or no Makefile found"
     fi
-    
+
     # Compile the project
     if make > /dev/null 2>&1; then
         print_success "Ginxsom compiled successfully"
-        
+
         # Verify the binary was created
         if [[ -f "build/ginxsom-fcgi" ]]; then
             print_success "Binary created: build/ginxsom-fcgi"
@@ -390,9 +417,12 @@ main() {
             git tag "$NEW_VERSION" > /dev/null 2>&1
         fi
         
+        # Update version in header file
+        update_version_in_header "$NEW_VERSION"
+
         # Compile project
         compile_project
-        
+
         # Build release binary
         build_release_binary
         
@@ -423,9 +453,12 @@ main() {
             git tag "$NEW_VERSION" > /dev/null 2>&1
         fi
         
+        # Update version in header file
+        update_version_in_header "$NEW_VERSION"
+
         # Compile project
         compile_project
-        
+
         # Commit and push (but skip tag creation since we already did it)
         git_commit_and_push_no_tag
         

remote.nginx.config

@@ -0,0 +1,384 @@
+# FastCGI upstream configuration
+upstream ginxsom_backend {
+    server unix:/tmp/ginxsom-fcgi.sock;
+}
+
+# Main domains
+server {
+    if ($host = laantungir.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name laantungir.com www.laantungir.com laantungir.net www.laantungir.net laantungir.org www.laantungir.org;
+    
+    root /var/www/html;
+    index index.html index.htm;
+    # CORS for Nostr NIP-05 verification
+    add_header Access-Control-Allow-Origin * always;
+    add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range" always;
+    
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    
+    error_page 404 /404.html;
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /var/www/html;
+    }
+
+
+}
+
+# Main domains HTTPS - using the main certificate
+server {
+    listen 443 ssl;
+    server_name laantungir.com www.laantungir.com laantungir.net www.laantungir.net laantungir.org www.laantungir.org;
+    ssl_certificate /etc/letsencrypt/live/laantungir.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/laantungir.net/privkey.pem; # managed by Certbot
+    
+    root /var/www/html;
+    index index.html index.htm;
+    # CORS for Nostr NIP-05 verification
+    add_header Access-Control-Allow-Origin * always;
+    add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range" always;
+    
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    
+    error_page 404 /404.html;
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /var/www/html;
+    }
+
+}
+
+# Blossom subdomains HTTP - redirect to HTTPS (keep for ACME)
+server {
+    listen 80;
+    server_name blossom.laantungir.net;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+# Blossom subdomains HTTPS - ginxsom FastCGI
+server {
+    listen 443 ssl;
+    server_name blossom.laantungir.net;
+
+    ssl_certificate /etc/letsencrypt/live/git.laantungir.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/git.laantungir.net/privkey.pem;
+
+    # Security headers
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # CORS for Blossom protocol
+    add_header Access-Control-Allow-Origin * always;
+    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
+    add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
+    add_header Access-Control-Max-Age 86400 always;
+
+    # Root directory for blob storage
+    root /var/www/html/blossom;
+
+    # Maximum upload size
+    client_max_body_size 100M;
+
+    # OPTIONS preflight handler
+    if ($request_method = OPTIONS) {
+        return 204;
+    }
+
+    # PUT /upload - File uploads
+    location = /upload {
+        if ($request_method !~ ^(PUT|HEAD)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # GET /list/<pubkey> - List user blobs
+    location ~ "^/list/([a-f0-9]{64})$" {
+        if ($request_method !~ ^(GET)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # PUT /mirror - Mirror content
+    location = /mirror {
+        if ($request_method !~ ^(PUT)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # PUT /report - Report content
+    location = /report {
+        if ($request_method !~ ^(PUT)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # GET /auth - NIP-42 challenges
+    location = /auth {
+        if ($request_method !~ ^(GET)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # Admin API
+    location /api/ {
+        if ($request_method !~ ^(GET|PUT)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+
+    # Blob serving - SHA256 patterns
+    location ~ "^/([a-f0-9]{64})(\.[a-zA-Z0-9]+)?$" {
+        # Handle DELETE via rewrite
+        if ($request_method = DELETE) {
+            rewrite ^/(.*)$ /fcgi-delete/$1 last;
+        }
+
+        # Route HEAD to FastCGI
+        if ($request_method = HEAD) {
+            rewrite ^/(.*)$ /fcgi-head/$1 last;
+        }
+
+        # GET requests - serve files directly
+        if ($request_method != GET) {
+            return 405;
+        }
+
+        try_files /$1.txt /$1.jpg /$1.jpeg /$1.png /$1.webp /$1.gif /$1.pdf /$1.mp4 /$1.mp3 /$1.md =404;
+
+        # Cache headers
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    # Internal FastCGI handlers
+    location ~ "^/fcgi-delete/([a-f0-9]{64}).*$" {
+        internal;
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_param REQUEST_URI /$1;
+    }
+
+    location ~ "^/fcgi-head/([a-f0-9]{64}).*$" {
+        internal;
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_param REQUEST_URI /$1;
+    }
+
+    # Health check
+    location /health {
+        access_log off;
+        return 200 "OK\n";
+        add_header Content-Type text/plain;
+        add_header Access-Control-Allow-Origin * always;
+        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
+        add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
+        add_header Access-Control-Max-Age 86400 always;
+    }
+
+    # Default location - Server info from FastCGI
+    location / {
+        if ($request_method !~ ^(GET)$) {
+            return 405;
+        }
+        fastcgi_pass ginxsom_backend;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+    }
+}
+
+server {
+    listen 80;
+    server_name relay.laantungir.com relay.laantungir.net relay.laantungir.org;
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    
+    location / {
+        proxy_pass http://127.0.0.1:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 60s;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        gzip off;
+       }
+}
+
+
+# # Relay HTTPS - proxy to c-relay
+server {
+    listen 443 ssl;
+    server_name relay.laantungir.com relay.laantungir.net relay.laantungir.org;
+    
+    ssl_certificate /etc/letsencrypt/live/git.laantungir.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/git.laantungir.net/privkey.pem;
+    
+    location / {
+        proxy_pass http://127.0.0.1:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 60s;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        gzip off;
+     }
+}
+
+
+
+ # Git subdomains HTTP - redirect to HTTPS
+ server {
+     listen 80;
+     server_name git.laantungir.com git.laantungir.net git.laantungir.org;
+    
+    # Allow larger file uploads for Git releases
+    client_max_body_size 50M;
+     
+     location /.well-known/acme-challenge/ {
+         root /var/www/certbot;
+     }
+     
+     location / {
+         return 301 https://$server_name$request_uri;
+     }
+ }
+
+ # Auth subdomains HTTP - redirect to HTTPS
+ server {
+     listen 80;
+     server_name auth.laantungir.com auth.laantungir.net auth.laantungir.org;
+     
+     location /.well-known/acme-challenge/ {
+         root /var/www/certbot;
+     }
+     
+     location / {
+     }
+ }
+
+ # Git subdomains HTTPS - proxy to gitea
+ server {
+     listen 443 ssl;
+     server_name git.laantungir.com git.laantungir.net git.laantungir.org;
+    
+    # Allow larger file uploads for Git releases
+    client_max_body_size 50M;
+     
+     ssl_certificate /etc/letsencrypt/live/git.laantungir.net/fullchain.pem;
+     ssl_certificate_key /etc/letsencrypt/live/git.laantungir.net/privkey.pem;
+     
+     location / {
+         proxy_pass http://localhost:3000;
+         proxy_http_version 1.1;
+         proxy_set_header Upgrade $http_upgrade;
+         proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 60s;
+        gzip off;
+        # proxy_set_header Sec-WebSocket-Extensions ;
+         proxy_set_header Host $host;
+        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
+         proxy_set_header X-Real-IP $remote_addr;
+         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+         proxy_set_header X-Forwarded-Proto $scheme;
+         proxy_cache_bypass $http_upgrade;
+     }
+ }
+
+ # Auth subdomains HTTPS - proxy to nostr-auth
+ server {
+     listen 443 ssl;
+     server_name auth.laantungir.com auth.laantungir.net auth.laantungir.org;
+     
+     ssl_certificate /etc/letsencrypt/live/git.laantungir.net/fullchain.pem;
+     ssl_certificate_key /etc/letsencrypt/live/git.laantungir.net/privkey.pem;
+     
+     location / {
+         proxy_pass http://localhost:3001;
+         proxy_http_version 1.1;
+         proxy_set_header Upgrade $http_upgrade;
+         proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 60s;
+        gzip off;
+        # proxy_set_header Sec-WebSocket-Extensions ;
+         proxy_set_header Host $host;
+        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
+         proxy_set_header X-Real-IP $remote_addr;
+         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+         proxy_set_header X-Forwarded-Proto $scheme;
+         proxy_cache_bypass $http_upgrade;
+     }
+ }

restart-all.sh

@@ -4,8 +4,32 @@
 
 # Configuration
 
+# Parse command line arguments
+TEST_MODE=0
+FOLLOW_LOGS=0
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -t|--test-keys)
+            TEST_MODE=1
+            shift
+            ;;
+        --follow)
+            FOLLOW_LOGS=1
+            shift
+            ;;
+        *)
+            echo "Unknown option: $1"
+            echo "Usage: $0 [-t|--test-keys] [--follow]"
+            echo "  -t, --test-keys    Use test mode with keys from .test_keys"
+            echo "  --follow           Follow logs in real-time"
+            exit 1
+            ;;
+    esac
+done
+
 # Check for --follow flag
-if [[ "$1" == "--follow" ]]; then
+if [[ $FOLLOW_LOGS -eq 1 ]]; then
     echo "=== Following logs in real-time ==="
     echo "Monitoring: nginx error, nginx access, app stderr, app stdout"
     echo "Press Ctrl+C to stop following logs"
@@ -37,7 +61,12 @@ touch logs/app/stderr.log logs/app/stdout.log logs/nginx/error.log logs/nginx/ac
 chmod 644 logs/app/stderr.log logs/app/stdout.log logs/nginx/error.log logs/nginx/access.log
 chmod 755 logs/nginx logs/app
 
-echo -e "${YELLOW}=== Ginxsom Development Environment Restart ===${NC}"
+if [ $TEST_MODE -eq 1 ]; then
+    echo -e "${YELLOW}=== Ginxsom Development Environment Restart (TEST MODE) ===${NC}"
+    echo "Using test keys from .test_keys file"
+else
+    echo -e "${YELLOW}=== Ginxsom Development Environment Restart ===${NC}"
+fi
 echo "Starting full restart sequence..."
 
 # Function to check if a process is running
@@ -148,6 +177,42 @@ if [ $? -ne 0 ]; then
 fi
 echo -e "${GREEN}Clean rebuild complete${NC}"
 
+# Step 3.5: Handle keys based on mode
+echo -e "\n${YELLOW}3.5. Configuring server keys...${NC}"
+DB_PATH="$PWD/db/ginxsom.db"
+
+if [ $TEST_MODE -eq 1 ]; then
+    # Test mode: verify .test_keys file exists
+    if [ ! -f ".test_keys" ]; then
+        echo -e "${RED}ERROR: .test_keys file not found${NC}"
+        echo -e "${RED}Test mode requires .test_keys file in project root${NC}"
+        exit 1
+    fi
+    echo -e "${GREEN}Test mode: Will use keys from .test_keys${NC}"
+else
+    # Production mode: check if keys exist, generate if needed
+    NEED_KEYS=1
+    if command -v sqlite3 >/dev/null 2>&1; then
+        if sqlite3 "$DB_PATH" "SELECT seckey FROM blossom_seckey WHERE id=1" 2>/dev/null | grep -Eq '^[0-9a-f]{64}$'; then
+            NEED_KEYS=0
+            echo -e "${GREEN}Blossom private key found in database${NC}"
+        fi
+    else
+        echo -e "${YELLOW}sqlite3 not found; assuming keys may be missing${NC}"
+    fi
+
+    if [ $NEED_KEYS -eq 1 ]; then
+        echo -e "${YELLOW}No blossom key found; generating server keypair...${NC}"
+        ./build/ginxsom-fcgi --db-path "$DB_PATH" --storage-dir blobs --generate-keys 1>>logs/app/stdout.log 2>>logs/app/stderr.log
+        if [ $? -ne 0 ]; then
+            echo -e "${RED}Key generation failed. Check logs/app/stderr.log${NC}"
+            exit 1
+        fi
+        echo -e "${GREEN}Key generation completed${NC}"
+        echo -e "${YELLOW}IMPORTANT: Check logs/app/stderr.log for your generated keys!${NC}"
+    fi
+fi
+
 # Step 4: Start FastCGI
 echo -e "\n${YELLOW}4. Starting FastCGI application...${NC}"
 echo "Socket: $SOCKET_PATH"
@@ -166,9 +231,16 @@ fi
 echo "Setting GINX_DEBUG environment for pubkey extraction diagnostics"
 export GINX_DEBUG=1
 
+# Build command line arguments based on mode
+FCGI_ARGS="--db-path $PWD/db/ginxsom.db --storage-dir blobs"
+if [ $TEST_MODE -eq 1 ]; then
+    FCGI_ARGS="$FCGI_ARGS --test-keys"
+    echo -e "${YELLOW}Starting FastCGI in TEST MODE with test keys${NC}"
+fi
+
 # Start FastCGI application with proper logging (daemonized but with redirected streams)
 echo "FastCGI starting at $(date)" >> logs/app/stderr.log
-spawn-fcgi -s "$SOCKET_PATH" -M 666 -u "$USER" -g "$USER" -f "$FCGI_BINARY" -P "$PID_FILE" 1>>logs/app/stdout.log 2>>logs/app/stderr.log
+spawn-fcgi -s "$SOCKET_PATH" -M 666 -u "$USER" -g "$USER" -P "$PID_FILE" -- "$FCGI_BINARY" $FCGI_ARGS 1>>logs/app/stdout.log 2>>logs/app/stderr.log
 
 if [ $? -eq 0 ] && [ -f "$PID_FILE" ]; then
     PID=$(cat "$PID_FILE")
@@ -250,6 +322,8 @@ else
 fi
 
 echo -e "\n${GREEN}=== Restart sequence complete ===${NC}"
-echo -e "${YELLOW}Server should be available at: http://localhost:9001${NC}"
 echo -e "${YELLOW}To stop all processes, run: nginx -p . -c $NGINX_CONFIG -s stop && kill \$(cat $PID_FILE 2>/dev/null)${NC}"
-echo -e "${YELLOW}To monitor logs, check: logs/error.log, logs/access.log, and logs/fcgi-stderr.log${NC}"
+echo -e "${YELLOW}To monitor logs, check: logs/nginx/error.log, logs/nginx/access.log, logs/app/stderr.log, logs/app/stdout.log${NC}"
+echo -e "\n${YELLOW}Server is available at:${NC}"
+echo -e "  ${GREEN}HTTP:${NC}  http://localhost:9001"
+echo -e "  ${GREEN}HTTPS:${NC} https://localhost:9443"

src/admin_auth.c

@@ -0,0 +1,509 @@
+/*
+ * Ginxsom Admin Authentication Module
+ * Handles Kind 23456/23457 admin events with NIP-44 encryption
+ * Based on c-relay's dm_admin.c implementation
+ */
+
+#include "ginxsom.h"
+#include "../nostr_core_lib/nostr_core/nostr_common.h"
+#include "../nostr_core_lib/nostr_core/nip001.h"
+#include "../nostr_core_lib/nostr_core/nip044.h"
+#include "../nostr_core_lib/nostr_core/utils.h"
+#include <cjson/cJSON.h>
+#include <sqlite3.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+
+// Forward declarations
+int get_blossom_private_key(char *seckey_out, size_t max_len);
+int validate_admin_pubkey(const char *pubkey);
+
+// Global variables for admin auth
+static char g_blossom_seckey[65] = "";  // Cached blossom server private key
+static int g_keys_loaded = 0;          // Whether keys have been loaded
+
+// Load blossom server keys if not already loaded
+static int ensure_keys_loaded(void) {
+    if (!g_keys_loaded) {
+        if (get_blossom_private_key(g_blossom_seckey, sizeof(g_blossom_seckey)) != 0) {
+            fprintf(stderr, "ERROR: Cannot load blossom private key for admin auth\n");
+            return -1;
+        }
+        g_keys_loaded = 1;
+    }
+    return 0;
+}
+
+// Validate that an event is a Kind 23456 admin command event
+int is_admin_command_event(cJSON *event, const char *relay_pubkey) {
+    if (!event || !relay_pubkey) {
+        return 0;
+    }
+
+    // Check kind = 23456 (admin command)
+    cJSON *kind = cJSON_GetObjectItem(event, "kind");
+    if (!cJSON_IsNumber(kind) || kind->valueint != 23456) {
+        return 0;
+    }
+
+    // Check tags for 'p' tag with relay pubkey
+    cJSON *tags = cJSON_GetObjectItem(event, "tags");
+    if (!cJSON_IsArray(tags)) {
+        return 0;
+    }
+
+    int found_p_tag = 0;
+    cJSON *tag = NULL;
+    cJSON_ArrayForEach(tag, tags) {
+        if (cJSON_IsArray(tag) && cJSON_GetArraySize(tag) >= 2) {
+            cJSON *tag_name = cJSON_GetArrayItem(tag, 0);
+            cJSON *tag_value = cJSON_GetArrayItem(tag, 1);
+
+            if (cJSON_IsString(tag_name) && strcmp(tag_name->valuestring, "p") == 0 &&
+                cJSON_IsString(tag_value) && strcmp(tag_value->valuestring, relay_pubkey) == 0) {
+                found_p_tag = 1;
+                break;
+            }
+        }
+    }
+
+    return found_p_tag;
+}
+
+// Validate admin event signature and pubkey
+int validate_admin_event(cJSON *event) {
+    if (!event) {
+        return 0;
+    }
+
+    // Get event fields
+    cJSON *pubkey = cJSON_GetObjectItem(event, "pubkey");
+    cJSON *sig = cJSON_GetObjectItem(event, "sig");
+
+    if (!cJSON_IsString(pubkey) || !cJSON_IsString(sig)) {
+        fprintf(stderr, "AUTH: Invalid event format - missing pubkey or sig\n");
+        return 0;
+    }
+
+    // Check if pubkey matches configured admin pubkey
+    if (!validate_admin_pubkey(pubkey->valuestring)) {
+        fprintf(stderr, "AUTH: Pubkey %s is not authorized admin\n", pubkey->valuestring);
+        return 0;
+    }
+
+    // TODO: Validate event signature using nostr_core_lib
+    // For now, assume signature is valid if pubkey matches
+    // In production, this should verify the signature cryptographically
+
+    return 1;
+}
+
+// Decrypt NIP-44 encrypted admin command
+int decrypt_admin_command(cJSON *event, char **decrypted_command_out) {
+    if (!event || !decrypted_command_out) {
+        return -1;
+    }
+
+    // Ensure we have the relay private key
+    if (ensure_keys_loaded() != 0) {
+        return -1;
+    }
+
+    // Get admin pubkey from event
+    cJSON *admin_pubkey_json = cJSON_GetObjectItem(event, "pubkey");
+    if (!cJSON_IsString(admin_pubkey_json)) {
+        fprintf(stderr, "AUTH: Missing or invalid pubkey in event\n");
+        return -1;
+    }
+
+    // Get encrypted content
+    cJSON *content = cJSON_GetObjectItem(event, "content");
+    if (!cJSON_IsString(content)) {
+        fprintf(stderr, "AUTH: Missing or invalid content in event\n");
+        return -1;
+    }
+
+    // Convert hex keys to bytes
+    unsigned char blossom_private_key[32];
+    unsigned char admin_public_key[32];
+    
+    if (nostr_hex_to_bytes(g_blossom_seckey, blossom_private_key, 32) != 0) {
+        fprintf(stderr, "AUTH: Failed to parse blossom private key\n");
+        return -1;
+    }
+    
+    if (nostr_hex_to_bytes(admin_pubkey_json->valuestring, admin_public_key, 32) != 0) {
+        fprintf(stderr, "AUTH: Failed to parse admin public key\n");
+        return -1;
+    }
+
+    // Allocate buffer for decrypted content
+    char decrypted_buffer[8192];
+    
+    // Decrypt using NIP-44
+    int result = nostr_nip44_decrypt(
+        blossom_private_key,
+        admin_public_key,
+        content->valuestring,
+        decrypted_buffer,
+        sizeof(decrypted_buffer)
+    );
+    
+    if (result != NOSTR_SUCCESS) {
+        fprintf(stderr, "AUTH: NIP-44 decryption failed with error code %d\n", result);
+        return -1;
+    }
+
+    // Allocate and copy decrypted content
+    *decrypted_command_out = malloc(strlen(decrypted_buffer) + 1);
+    if (!*decrypted_command_out) {
+        fprintf(stderr, "AUTH: Failed to allocate memory for decrypted content\n");
+        return -1;
+    }
+    strcpy(*decrypted_command_out, decrypted_buffer);
+
+    return 0;
+}
+
+// Parse decrypted command array
+int parse_admin_command(const char *decrypted_content, char ***command_array_out, int *command_count_out) {
+    if (!decrypted_content || !command_array_out || !command_count_out) {
+        return -1;
+    }
+
+    // Parse the decrypted content as JSON array
+    cJSON *content_json = cJSON_Parse(decrypted_content);
+    if (!content_json) {
+        fprintf(stderr, "AUTH: Failed to parse decrypted content as JSON\n");
+        return -1;
+    }
+
+    if (!cJSON_IsArray(content_json)) {
+        fprintf(stderr, "AUTH: Decrypted content is not a JSON array\n");
+        cJSON_Delete(content_json);
+        return -1;
+    }
+
+    int array_size = cJSON_GetArraySize(content_json);
+    if (array_size < 1) {
+        fprintf(stderr, "AUTH: Command array is empty\n");
+        cJSON_Delete(content_json);
+        return -1;
+    }
+
+    // Allocate command array
+    char **command_array = malloc(array_size * sizeof(char *));
+    if (!command_array) {
+        fprintf(stderr, "AUTH: Failed to allocate command array\n");
+        cJSON_Delete(content_json);
+        return -1;
+    }
+
+    // Parse each array element as string
+    for (int i = 0; i < array_size; i++) {
+        cJSON *item = cJSON_GetArrayItem(content_json, i);
+        if (!cJSON_IsString(item)) {
+            fprintf(stderr, "AUTH: Command array element %d is not a string\n", i);
+            // Clean up allocated strings
+            for (int j = 0; j < i; j++) {
+                free(command_array[j]);
+            }
+            free(command_array);
+            cJSON_Delete(content_json);
+            return -1;
+        }
+
+        command_array[i] = malloc(strlen(item->valuestring) + 1);
+        if (!command_array[i]) {
+            fprintf(stderr, "AUTH: Failed to allocate command string\n");
+            // Clean up allocated strings
+            for (int j = 0; j < i; j++) {
+                free(command_array[j]);
+            }
+            free(command_array);
+            cJSON_Delete(content_json);
+            return -1;
+        }
+        strcpy(command_array[i], item->valuestring);
+        if (!command_array[i]) {
+            fprintf(stderr, "AUTH: Failed to duplicate command string\n");
+            // Clean up allocated strings
+            for (int j = 0; j < i; j++) {
+                free(command_array[j]);
+            }
+            free(command_array);
+            cJSON_Delete(content_json);
+            return -1;
+        }
+    }
+
+    cJSON_Delete(content_json);
+    *command_array_out = command_array;
+    *command_count_out = array_size;
+
+    return 0;
+}
+
+// Process incoming admin command event (Kind 23456)
+int process_admin_command(cJSON *event, char ***command_array_out, int *command_count_out, char **admin_pubkey_out) {
+    if (!event || !command_array_out || !command_count_out || !admin_pubkey_out) {
+        return -1;
+    }
+
+    // Get blossom server pubkey from config
+    sqlite3 *db;
+    sqlite3_stmt *stmt;
+    char blossom_pubkey[65] = "";
+
+    if (sqlite3_open_v2("db/ginxsom.db", &db, SQLITE_OPEN_READONLY, NULL) != SQLITE_OK) {
+        return -1;
+    }
+
+    const char *sql = "SELECT value FROM config WHERE key = 'blossom_pubkey'";
+    if (sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == SQLITE_OK) {
+        if (sqlite3_step(stmt) == SQLITE_ROW) {
+            const char *pubkey = (const char *)sqlite3_column_text(stmt, 0);
+            if (pubkey) {
+                strncpy(blossom_pubkey, pubkey, sizeof(blossom_pubkey) - 1);
+            }
+        }
+        sqlite3_finalize(stmt);
+    }
+    sqlite3_close(db);
+
+    if (strlen(blossom_pubkey) != 64) {
+        fprintf(stderr, "ERROR: Cannot determine blossom pubkey for admin auth\n");
+        return -1;
+    }
+
+    // Check if it's a valid admin command event for us
+    if (!is_admin_command_event(event, blossom_pubkey)) {
+        return -1;
+    }
+
+    // Validate admin authentication (signature and pubkey)
+    if (!validate_admin_event(event)) {
+        return -1;
+    }
+
+    // Get admin pubkey from event
+    cJSON *admin_pubkey_json = cJSON_GetObjectItem(event, "pubkey");
+    if (!cJSON_IsString(admin_pubkey_json)) {
+        return -1;
+    }
+
+    *admin_pubkey_out = malloc(strlen(admin_pubkey_json->valuestring) + 1);
+    if (!*admin_pubkey_out) {
+        fprintf(stderr, "AUTH: Failed to allocate admin pubkey string\n");
+        return -1;
+    }
+    strcpy(*admin_pubkey_out, admin_pubkey_json->valuestring);
+    if (!*admin_pubkey_out) {
+        return -1;
+    }
+
+    // Decrypt the command
+    char *decrypted_content = NULL;
+    if (decrypt_admin_command(event, &decrypted_content) != 0) {
+        free(*admin_pubkey_out);
+        *admin_pubkey_out = NULL;
+        return -1;
+    }
+
+    // Parse the command array
+    if (parse_admin_command(decrypted_content, command_array_out, command_count_out) != 0) {
+        free(decrypted_content);
+        free(*admin_pubkey_out);
+        *admin_pubkey_out = NULL;
+        return -1;
+    }
+
+    free(decrypted_content);
+    return 0;
+}
+
+// Validate admin pubkey against configured admin
+int validate_admin_pubkey(const char *pubkey) {
+    if (!pubkey || strlen(pubkey) != 64) {
+        return 0;
+    }
+
+    sqlite3 *db;
+    sqlite3_stmt *stmt;
+    int result = 0;
+
+    if (sqlite3_open_v2("db/ginxsom.db", &db, SQLITE_OPEN_READONLY, NULL) != SQLITE_OK) {
+        return 0;
+    }
+
+    const char *sql = "SELECT value FROM config WHERE key = 'admin_pubkey'";
+    if (sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == SQLITE_OK) {
+        if (sqlite3_step(stmt) == SQLITE_ROW) {
+            const char *admin_pubkey = (const char *)sqlite3_column_text(stmt, 0);
+            if (admin_pubkey && strcmp(admin_pubkey, pubkey) == 0) {
+                result = 1;
+            }
+        }
+        sqlite3_finalize(stmt);
+    }
+    sqlite3_close(db);
+
+    return result;
+}
+
+// Create encrypted response for admin (Kind 23457)
+int create_admin_response(const char *response_json, const char *admin_pubkey, const char *original_event_id __attribute__((unused)), cJSON **response_event_out) {
+    if (!response_json || !admin_pubkey || !response_event_out) {
+        return -1;
+    }
+
+    // Ensure we have the relay private key
+    if (ensure_keys_loaded() != 0) {
+        return -1;
+    }
+
+    // Get blossom server pubkey from config
+    sqlite3 *db;
+    sqlite3_stmt *stmt;
+    char blossom_pubkey[65] = "";
+
+    if (sqlite3_open_v2("db/ginxsom.db", &db, SQLITE_OPEN_READONLY, NULL) != SQLITE_OK) {
+        return -1;
+    }
+
+    const char *sql = "SELECT value FROM config WHERE key = 'blossom_pubkey'";
+    if (sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == SQLITE_OK) {
+        if (sqlite3_step(stmt) == SQLITE_ROW) {
+            const char *pubkey = (const char *)sqlite3_column_text(stmt, 0);
+            if (pubkey) {
+                strncpy(blossom_pubkey, pubkey, sizeof(blossom_pubkey) - 1);
+            }
+        }
+        sqlite3_finalize(stmt);
+    }
+    sqlite3_close(db);
+
+    if (strlen(blossom_pubkey) != 64) {
+        fprintf(stderr, "ERROR: Cannot determine blossom pubkey for response\n");
+        return -1;
+    }
+
+    // Convert hex keys to bytes
+    unsigned char blossom_private_key[32];
+    unsigned char admin_public_key[32];
+    
+    if (nostr_hex_to_bytes(g_blossom_seckey, blossom_private_key, 32) != 0) {
+        fprintf(stderr, "AUTH: Failed to parse blossom private key\n");
+        return -1;
+    }
+    
+    if (nostr_hex_to_bytes(admin_pubkey, admin_public_key, 32) != 0) {
+        fprintf(stderr, "AUTH: Failed to parse admin public key\n");
+        return -1;
+    }
+
+    // Encrypt response using NIP-44
+    char encrypted_content[8192];
+    int result = nostr_nip44_encrypt(
+        blossom_private_key,
+        admin_public_key,
+        response_json,
+        encrypted_content,
+        sizeof(encrypted_content)
+    );
+    
+    if (result != NOSTR_SUCCESS) {
+        fprintf(stderr, "AUTH: NIP-44 encryption failed with error code %d\n", result);
+        return -1;
+    }
+
+    // Create Kind 23457 response event
+    cJSON *response_event = cJSON_CreateObject();
+    if (!response_event) {
+        fprintf(stderr, "AUTH: Failed to create response event JSON\n");
+        return -1;
+    }
+
+    // Set event fields
+    cJSON_AddNumberToObject(response_event, "kind", 23457);
+    cJSON_AddStringToObject(response_event, "pubkey", blossom_pubkey);
+    cJSON_AddNumberToObject(response_event, "created_at", (double)time(NULL));
+    cJSON_AddStringToObject(response_event, "content", encrypted_content);
+
+    // Add tags array with 'p' tag for admin
+    cJSON *tags = cJSON_CreateArray();
+    cJSON *p_tag = cJSON_CreateArray();
+    cJSON_AddItemToArray(p_tag, cJSON_CreateString("p"));
+    cJSON_AddItemToArray(p_tag, cJSON_CreateString(admin_pubkey));
+    cJSON_AddItemToArray(tags, p_tag);
+    cJSON_AddItemToObject(response_event, "tags", tags);
+
+    // Sign the event with blossom private key
+    // Convert private key hex to bytes
+    unsigned char blossom_private_key_bytes[32];
+    if (nostr_hex_to_bytes(g_blossom_seckey, blossom_private_key_bytes, 32) != 0) {
+        fprintf(stderr, "AUTH: Failed to parse blossom private key for signing\n");
+        cJSON_Delete(response_event);
+        return -1;
+    }
+
+    // Create a temporary event structure for signing
+    cJSON* temp_event = cJSON_Duplicate(response_event, 1);
+    if (!temp_event) {
+        fprintf(stderr, "AUTH: Failed to create temp event for signing\n");
+        cJSON_Delete(response_event);
+        return -1;
+    }
+
+    // Sign the event using nostr_core_lib
+    cJSON* signed_event = nostr_create_and_sign_event(
+        23457,  // Kind 23457 (admin response)
+        encrypted_content,  // content
+        cJSON_GetObjectItem(response_event, "tags"),  // tags
+        blossom_private_key_bytes,  // private key
+        (time_t)cJSON_GetNumberValue(cJSON_GetObjectItem(response_event, "created_at"))  // timestamp
+    );
+
+    if (!signed_event) {
+        fprintf(stderr, "AUTH: Failed to sign admin response event\n");
+        cJSON_Delete(response_event);
+        cJSON_Delete(temp_event);
+        return -1;
+    }
+
+    // Extract id and signature from signed event
+    cJSON* signed_id = cJSON_GetObjectItem(signed_event, "id");
+    cJSON* signed_sig = cJSON_GetObjectItem(signed_event, "sig");
+
+    if (signed_id && signed_sig) {
+        cJSON_AddStringToObject(response_event, "id", cJSON_GetStringValue(signed_id));
+        cJSON_AddStringToObject(response_event, "sig", cJSON_GetStringValue(signed_sig));
+    } else {
+        fprintf(stderr, "AUTH: Signed event missing id or sig\n");
+        cJSON_Delete(response_event);
+        cJSON_Delete(signed_event);
+        cJSON_Delete(temp_event);
+        return -1;
+    }
+
+    // Clean up temporary structures
+    cJSON_Delete(signed_event);
+    cJSON_Delete(temp_event);
+
+    *response_event_out = response_event;
+    return 0;
+}
+
+// Free command array allocated by parse_admin_command
+void free_command_array(char **command_array, int command_count) {
+    if (command_array) {
+        for (int i = 0; i < command_count; i++) {
+            if (command_array[i]) {
+                free(command_array[i]);
+            }
+        }
+        free(command_array);
+    }
+}

src/admin_handlers.c

@@ -0,0 +1,216 @@
+/*
+ * Ginxsom Admin Command Handlers
+ * Implements execution of admin commands received via Kind 23456 events
+ */
+
+#include "ginxsom.h"
+#include <cjson/cJSON.h>
+#include <sqlite3.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/statvfs.h>
+#include <dirent.h>
+
+// Forward declarations
+static cJSON* handle_blob_list(char **args, int arg_count);
+static cJSON* handle_blob_info(char **args, int arg_count);
+static cJSON* handle_blob_delete(char **args, int arg_count);
+static cJSON* handle_storage_stats(char **args, int arg_count);
+static cJSON* handle_config_get(char **args, int arg_count);
+static cJSON* handle_config_set(char **args, int arg_count);
+static cJSON* handle_help(char **args, int arg_count);
+
+// Command dispatch table
+typedef struct {
+    const char *command;
+    cJSON* (*handler)(char **args, int arg_count);
+    const char *description;
+} admin_command_t;
+
+static admin_command_t command_table[] = {
+    {"blob_list", handle_blob_list, "List all blobs"},
+    {"blob_info", handle_blob_info, "Get blob information"},
+    {"blob_delete", handle_blob_delete, "Delete a blob"},
+    {"storage_stats", handle_storage_stats, "Get storage statistics"},
+    {"config_get", handle_config_get, "Get configuration value"},
+    {"config_set", handle_config_set, "Set configuration value"},
+    {"help", handle_help, "Show available commands"},
+    {NULL, NULL, NULL}
+};
+
+// Execute admin command and return JSON response
+int execute_admin_command(char **command_array, int command_count, char **response_json_out) {
+    if (!command_array || command_count < 1 || !response_json_out) {
+        return -1;
+    }
+
+    const char *command = command_array[0];
+    
+    // Find command handler
+    admin_command_t *cmd = NULL;
+    for (int i = 0; command_table[i].command != NULL; i++) {
+        if (strcmp(command_table[i].command, command) == 0) {
+            cmd = &command_table[i];
+            break;
+        }
+    }
+
+    cJSON *response;
+    if (cmd) {
+        // Execute command handler
+        response = cmd->handler(command_array + 1, command_count - 1);
+    } else {
+        // Unknown command
+        response = cJSON_CreateObject();
+        cJSON_AddStringToObject(response, "status", "error");
+        cJSON_AddStringToObject(response, "message", "Unknown command");
+        cJSON_AddStringToObject(response, "command", command);
+    }
+
+    // Convert response to JSON string
+    char *json_str = cJSON_PrintUnformatted(response);
+    cJSON_Delete(response);
+
+    if (!json_str) {
+        return -1;
+    }
+
+    *response_json_out = json_str;
+    return 0;
+}
+
+// Command handlers
+
+static cJSON* handle_blob_list(char **args __attribute__((unused)), int arg_count __attribute__((unused))) {
+    cJSON *response = cJSON_CreateObject();
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "blob_list");
+    
+    // TODO: Implement actual blob listing from database
+    cJSON *blobs = cJSON_CreateArray();
+    cJSON_AddItemToObject(response, "blobs", blobs);
+    cJSON_AddNumberToObject(response, "count", 0);
+    
+    return response;
+}
+
+static cJSON* handle_blob_info(char **args, int arg_count) {
+    cJSON *response = cJSON_CreateObject();
+    
+    if (arg_count < 1) {
+        cJSON_AddStringToObject(response, "status", "error");
+        cJSON_AddStringToObject(response, "message", "Missing blob hash argument");
+        return response;
+    }
+    
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "blob_info");
+    cJSON_AddStringToObject(response, "hash", args[0]);
+    
+    // TODO: Implement actual blob info retrieval from database
+    cJSON_AddStringToObject(response, "message", "Not yet implemented");
+    
+    return response;
+}
+
+static cJSON* handle_blob_delete(char **args, int arg_count) {
+    cJSON *response = cJSON_CreateObject();
+    
+    if (arg_count < 1) {
+        cJSON_AddStringToObject(response, "status", "error");
+        cJSON_AddStringToObject(response, "message", "Missing blob hash argument");
+        return response;
+    }
+    
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "blob_delete");
+    cJSON_AddStringToObject(response, "hash", args[0]);
+    
+    // TODO: Implement actual blob deletion
+    cJSON_AddStringToObject(response, "message", "Not yet implemented");
+    
+    return response;
+}
+
+static cJSON* handle_storage_stats(char **args __attribute__((unused)), int arg_count __attribute__((unused))) {
+    cJSON *response = cJSON_CreateObject();
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "storage_stats");
+    
+    // Get filesystem stats
+    struct statvfs stat;
+    if (statvfs(".", &stat) == 0) {
+        unsigned long long total = stat.f_blocks * stat.f_frsize;
+        unsigned long long available = stat.f_bavail * stat.f_frsize;
+        unsigned long long used = total - available;
+        
+        cJSON_AddNumberToObject(response, "total_bytes", (double)total);
+        cJSON_AddNumberToObject(response, "used_bytes", (double)used);
+        cJSON_AddNumberToObject(response, "available_bytes", (double)available);
+    }
+    
+    // TODO: Add blob count and total blob size from database
+    cJSON_AddNumberToObject(response, "blob_count", 0);
+    cJSON_AddNumberToObject(response, "blob_total_bytes", 0);
+    
+    return response;
+}
+
+static cJSON* handle_config_get(char **args, int arg_count) {
+    cJSON *response = cJSON_CreateObject();
+    
+    if (arg_count < 1) {
+        cJSON_AddStringToObject(response, "status", "error");
+        cJSON_AddStringToObject(response, "message", "Missing config key argument");
+        return response;
+    }
+    
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "config_get");
+    cJSON_AddStringToObject(response, "key", args[0]);
+    
+    // TODO: Implement actual config retrieval from database
+    cJSON_AddStringToObject(response, "value", "");
+    cJSON_AddStringToObject(response, "message", "Not yet implemented");
+    
+    return response;
+}
+
+static cJSON* handle_config_set(char **args, int arg_count) {
+    cJSON *response = cJSON_CreateObject();
+    
+    if (arg_count < 2) {
+        cJSON_AddStringToObject(response, "status", "error");
+        cJSON_AddStringToObject(response, "message", "Missing config key or value argument");
+        return response;
+    }
+    
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "config_set");
+    cJSON_AddStringToObject(response, "key", args[0]);
+    cJSON_AddStringToObject(response, "value", args[1]);
+    
+    // TODO: Implement actual config update in database
+    cJSON_AddStringToObject(response, "message", "Not yet implemented");
+    
+    return response;
+}
+
+static cJSON* handle_help(char **args __attribute__((unused)), int arg_count __attribute__((unused))) {
+    cJSON *response = cJSON_CreateObject();
+    cJSON_AddStringToObject(response, "status", "success");
+    cJSON_AddStringToObject(response, "command", "help");
+    
+    cJSON *commands = cJSON_CreateArray();
+    for (int i = 0; command_table[i].command != NULL; i++) {
+        cJSON *cmd = cJSON_CreateObject();
+        cJSON_AddStringToObject(cmd, "command", command_table[i].command);
+        cJSON_AddStringToObject(cmd, "description", command_table[i].description);
+        cJSON_AddItemToArray(commands, cmd);
+    }
+    
+    cJSON_AddItemToObject(response, "commands", commands);
+    
+    return response;
+}

src/admin_websocket.c

@@ -0,0 +1,163 @@
+/*
+ * Ginxsom Admin WebSocket Module
+ * Handles WebSocket connections for Kind 23456/23457 admin commands
+ * Based on c-relay's WebSocket implementation
+ */
+
+#include "ginxsom.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <cjson/cJSON.h>
+#include <sqlite3.h>
+
+// Forward declarations from admin_auth.c
+int process_admin_command(cJSON *event, char ***command_array_out, int *command_count_out, char **admin_pubkey_out);
+void free_command_array(char **command_array, int command_count);
+int create_admin_response(const char *response_json, const char *admin_pubkey, const char *original_event_id, cJSON **response_event_out);
+
+// Forward declarations from admin_handlers.c (to be created)
+int execute_admin_command(char **command_array, int command_count, const char *admin_pubkey, char **response_json_out);
+
+// Handle WebSocket admin command endpoint (/api/admin)
+void handle_admin_websocket_request(void) {
+    // For now, this is a placeholder for WebSocket implementation
+    // In a full implementation, this would:
+    // 1. Upgrade HTTP connection to WebSocket
+    // 2. Handle WebSocket frames
+    // 3. Process Kind 23456 events
+    // 4. Send Kind 23457 responses
+
+    printf("Status: 501 Not Implemented\r\n");
+    printf("Content-Type: application/json\r\n\r\n");
+    printf("{\n");
+    printf("  \"error\": \"websocket_not_implemented\",\n");
+    printf("  \"message\": \"WebSocket admin endpoint not yet implemented\",\n");
+    printf("  \"note\": \"Use HTTP POST to /api/admin for now\"\n");
+    printf("}\n");
+}
+
+// Handle HTTP POST admin command endpoint (/api/admin)
+void handle_admin_command_post_request(void) {
+    // Read the request body (should contain Kind 23456 event JSON)
+    const char *content_length_str = getenv("CONTENT_LENGTH");
+    if (!content_length_str) {
+        printf("Status: 400 Bad Request\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"missing_content_length\",\n");
+        printf("  \"message\": \"Content-Length header required\"\n");
+        printf("}\n");
+        return;
+    }
+
+    long content_length = atol(content_length_str);
+    if (content_length <= 0 || content_length > 1024 * 1024) { // 1MB limit
+        printf("Status: 400 Bad Request\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"invalid_content_length\",\n");
+        printf("  \"message\": \"Content-Length must be between 1 and 1MB\"\n");
+        printf("}\n");
+        return;
+    }
+
+    // Read the request body
+    char *request_body = malloc(content_length + 1);
+    if (!request_body) {
+        printf("Status: 500 Internal Server Error\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"memory_allocation_failed\",\n");
+        printf("  \"message\": \"Failed to allocate memory for request body\"\n");
+        printf("}\n");
+        return;
+    }
+
+    size_t bytes_read = fread(request_body, 1, content_length, stdin);
+    if (bytes_read != (size_t)content_length) {
+        free(request_body);
+        printf("Status: 400 Bad Request\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"incomplete_request_body\",\n");
+        printf("  \"message\": \"Failed to read complete request body\"\n");
+        printf("}\n");
+        return;
+    }
+
+    request_body[content_length] = '\0';
+
+    // Parse the JSON event
+    cJSON *event = cJSON_Parse(request_body);
+    free(request_body);
+
+    if (!event) {
+        printf("Status: 400 Bad Request\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"invalid_json\",\n");
+        printf("  \"message\": \"Request body is not valid JSON\"\n");
+        printf("}\n");
+        return;
+    }
+
+    // Process the admin command
+    char **command_array = NULL;
+    int command_count = 0;
+    char *admin_pubkey = NULL;
+
+    int result = process_admin_command(event, &command_array, &command_count, &admin_pubkey);
+    cJSON_Delete(event);
+
+    if (result != 0) {
+        printf("Status: 400 Bad Request\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"invalid_admin_command\",\n");
+        printf("  \"message\": \"Failed to process admin command\"\n");
+        printf("}\n");
+        return;
+    }
+
+    // Execute the command
+    char *response_json = NULL;
+    int exec_result = execute_admin_command(command_array, command_count, admin_pubkey, &response_json);
+    free_command_array(command_array, command_count);
+    free(admin_pubkey);
+
+    if (exec_result != 0) {
+        printf("Status: 500 Internal Server Error\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"command_execution_failed\",\n");
+        printf("  \"message\": \"Failed to execute admin command\"\n");
+        printf("}\n");
+        return;
+    }
+
+    // Create the response event (Kind 23457)
+    cJSON *response_event = NULL;
+    int create_result = create_admin_response(response_json, admin_pubkey, NULL, &response_event);
+    free(response_json);
+
+    if (create_result != 0) {
+        printf("Status: 500 Internal Server Error\r\n");
+        printf("Content-Type: application/json\r\n\r\n");
+        printf("{\n");
+        printf("  \"error\": \"response_creation_failed\",\n");
+        printf("  \"message\": \"Failed to create admin response\"\n");
+        printf("}\n");
+        return;
+    }
+
+    // Return the response event as JSON
+    char *response_json_str = cJSON_Print(response_event);
+    cJSON_Delete(response_event);
+
+    printf("Status: 200 OK\r\n");
+    printf("Content-Type: application/json\r\n\r\n");
+    printf("%s\n", response_json_str);
+
+    free(response_json_str);
+}

src/bud04.c

@@ -426,9 +426,17 @@ void handle_mirror_request(void) {
     // Determine file extension from Content-Type using centralized mapping
     const char* extension = mime_to_extension(content_type_final);
     
-    // Save file to blobs directory
-    char filepath[512];
-    snprintf(filepath, sizeof(filepath), "blobs/%s%s", sha256_hex, extension);
+    // Save file to storage directory using global g_storage_dir variable
+    char filepath[4096];
+    int filepath_len = snprintf(filepath, sizeof(filepath), "%s/%s%s", g_storage_dir, sha256_hex, extension);
+    if (filepath_len >= (int)sizeof(filepath)) {
+        free_mirror_download(download);
+        send_error_response(500, "file_error",
+                          "File path too long",
+                          "Internal server error during file path construction");
+        log_request("PUT", "/mirror", uploader_pubkey ? "authenticated" : "anonymous", 500);
+        return;
+    }
     
     FILE* outfile = fopen(filepath, "wb");
     if (!outfile) {

src/bud08.c

@@ -24,7 +24,7 @@ int nip94_is_enabled(void) {
         return 1; // Default enabled on DB error
     }
     
-    const char* sql = "SELECT value FROM server_config WHERE key = 'nip94_enabled'";
+    const char* sql = "SELECT value FROM config WHERE key = 'nip94_enabled'";
     rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
     if (rc == SQLITE_OK) {
         rc = sqlite3_step(stmt);
@@ -44,40 +44,53 @@ int nip94_get_origin(char* out, size_t out_size) {
     if (!out || out_size == 0) {
         return 0;
     }
-    
+
+    // Check database config first for custom origin
     sqlite3* db;
     sqlite3_stmt* stmt;
     int rc;
-    
+
     rc = sqlite3_open_v2(DB_PATH, &db, SQLITE_OPEN_READONLY, NULL);
-    if (rc) {
-        // Default on DB error
-        strncpy(out, "http://localhost:9001", out_size - 1);
-        out[out_size - 1] = '\0';
+    if (rc == SQLITE_OK) {
+        const char* sql = "SELECT value FROM config WHERE key = 'cdn_origin'";
+        rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+        if (rc == SQLITE_OK) {
+            rc = sqlite3_step(stmt);
+            if (rc == SQLITE_ROW) {
+                const char* value = (const char*)sqlite3_column_text(stmt, 0);
+                if (value) {
+                    strncpy(out, value, out_size - 1);
+                    out[out_size - 1] = '\0';
+                    sqlite3_finalize(stmt);
+                    sqlite3_close(db);
+                    return 1;
+                }
+            }
+            sqlite3_finalize(stmt);
+        }
+        sqlite3_close(db);
+    }
+
+    // Check if request came over HTTPS (nginx sets HTTPS=on for SSL requests)
+    const char* https_env = getenv("HTTPS");
+    const char* server_name = getenv("SERVER_NAME");
+    
+    // Use production domain if SERVER_NAME is set and not localhost
+    if (server_name && strcmp(server_name, "localhost") != 0) {
+        if (https_env && strcmp(https_env, "on") == 0) {
+            snprintf(out, out_size, "https://%s", server_name);
+        } else {
+            snprintf(out, out_size, "http://%s", server_name);
+        }
         return 1;
     }
     
-    const char* sql = "SELECT value FROM server_config WHERE key = 'cdn_origin'";
-    rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
-    if (rc == SQLITE_OK) {
-        rc = sqlite3_step(stmt);
-        if (rc == SQLITE_ROW) {
-            const char* value = (const char*)sqlite3_column_text(stmt, 0);
-            if (value) {
-                strncpy(out, value, out_size - 1);
-                out[out_size - 1] = '\0';
-                sqlite3_finalize(stmt);
-                sqlite3_close(db);
-                return 1;
-            }
-        }
-        sqlite3_finalize(stmt);
+    // Fallback to localhost for development
+    if (https_env && strcmp(https_env, "on") == 0) {
+        strncpy(out, "https://localhost:9443", out_size - 1);
+    } else {
+        strncpy(out, "http://localhost:9001", out_size - 1);
     }
-    
-    sqlite3_close(db);
-    
-    // Default fallback
-    strncpy(out, "http://localhost:9001", out_size - 1);
     out[out_size - 1] = '\0';
     return 1;
 }

src/ginxsom.h

@@ -7,6 +7,11 @@
 
 #ifndef GINXSOM_H
 #define GINXSOM_H
+// Version information (auto-updated by build system)
+#define VERSION_MAJOR 0
+#define VERSION_MINOR 1
+#define VERSION_PATCH 9
+#define VERSION "v0.1.9"
 
 #include <stddef.h>
 #include <stdint.h>
@@ -30,6 +35,10 @@ extern sqlite3* db;
 int init_database(void);
 void close_database(void);
 
+// Global configuration variables (defined in main.c)
+extern char g_db_path[4096];
+extern char g_storage_dir[4096];
+
 // SHA-256 extraction and validation
 const char* extract_sha256_from_uri(const char* uri);
 

src/request_validator.c

@@ -115,7 +115,7 @@ static int validate_nip42_event(cJSON *event, const char *relay_url,
                                 const char *challenge_id);
 static int validate_admin_event(cJSON *event, const char *method, const char *endpoint);
 static int check_database_auth_rules(const char *pubkey, const char *operation,
-                                     const char *resource_hash);
+                                      const char *resource_hash, const char *mime_type);
 void nostr_request_validator_clear_violation(void);
 
 // NIP-42 challenge management functions
@@ -283,6 +283,16 @@ int nostr_validate_unified_request(const nostr_unified_request_t *request,
   //  PHASE 2: NOSTR EVENT VALIDATION (CPU Intensive ~2ms)
   /////////////////////////////////////////////////////////////////////
 
+  // Check if authentication is disabled first (regardless of header presence)
+  if (!g_auth_cache.auth_required) {
+    validator_debug_log("VALIDATOR_DEBUG: STEP 4 PASSED - Authentication "
+                        "disabled, allowing request\n");
+    result->valid = 1;
+    result->error_code = NOSTR_SUCCESS;
+    strcpy(result->reason, "Authentication disabled");
+    return NOSTR_SUCCESS;
+  }
+
   // Check if this is a BUD-09 report request - allow anonymous reporting
   if (request->operation && strcmp(request->operation, "report") == 0) {
     // BUD-09 allows anonymous reporting - pass through to bud09.c for validation
@@ -810,8 +820,17 @@ int nostr_validate_unified_request(const nostr_unified_request_t *request,
                       "checking database rules\n");
 
   // Check database rules for authorization
+  // For Blossom uploads, use hash from event 'x' tag instead of URI
+  const char *hash_for_rules = request->resource_hash;
+  if (event_kind == 24242 && strlen(expected_hash_from_event) == 64) {
+      hash_for_rules = expected_hash_from_event;
+      char hash_msg[256];
+      sprintf(hash_msg, "VALIDATOR_DEBUG: Using hash from Blossom event for rules: %.16s...\n", hash_for_rules);
+      validator_debug_log(hash_msg);
+  }
+
   int rules_result = check_database_auth_rules(
-      extracted_pubkey, request->operation, request->resource_hash);
+      extracted_pubkey, request->operation, hash_for_rules, request->mime_type);
   if (rules_result != NOSTR_SUCCESS) {
     validator_debug_log(
         "VALIDATOR_DEBUG: STEP 14 FAILED - Database rules denied request\n");
@@ -1307,7 +1326,7 @@ static int validate_blossom_event(cJSON *event, const char *expected_hash,
  * Implements the 6-step rule evaluation engine from AUTH_API.md
  */
 static int check_database_auth_rules(const char *pubkey, const char *operation,
-                                     const char *resource_hash) {
+                                      const char *resource_hash, const char *mime_type) {
   sqlite3 *db = NULL;
   sqlite3_stmt *stmt = NULL;
   int rc;
@@ -1321,8 +1340,8 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
   char rules_msg[256];
   sprintf(rules_msg,
           "VALIDATOR_DEBUG: RULES ENGINE - Checking rules for pubkey=%.32s..., "
-          "operation=%s\n",
-          pubkey, operation ? operation : "NULL");
+          "operation=%s, mime_type=%s\n",
+          pubkey, operation ? operation : "NULL", mime_type ? mime_type : "NULL");
   validator_debug_log(rules_msg);
 
   // Open database
@@ -1334,9 +1353,10 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
   }
 
   // Step 1: Check pubkey blacklist (highest priority)
+  // Match both exact operation and wildcard '*'
   const char *blacklist_sql =
       "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
+      "'pubkey_blacklist' AND rule_target = ? AND (operation = ? OR operation = '*') AND enabled = "
       "1 ORDER BY priority LIMIT 1";
   rc = sqlite3_prepare_v2(db, blacklist_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
@@ -1369,9 +1389,10 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
 
   // Step 2: Check hash blacklist
   if (resource_hash) {
+    // Match both exact operation and wildcard '*'
     const char *hash_blacklist_sql =
         "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-        "'hash_blacklist' AND rule_target = ? AND operation = ? AND enabled = "
+        "'hash_blacklist' AND rule_target = ? AND (operation = ? OR operation = '*') AND enabled = "
         "1 ORDER BY priority LIMIT 1";
     rc = sqlite3_prepare_v2(db, hash_blacklist_sql, -1, &stmt, NULL);
     if (rc == SQLITE_OK) {
@@ -1407,10 +1428,53 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
                         "resource hash provided\n");
   }
 
-  // Step 3: Check pubkey whitelist
+  // Step 3: Check MIME type blacklist
+  if (mime_type) {
+    // Match both exact MIME type and wildcard patterns (e.g., 'image/*')
+    const char *mime_blacklist_sql =
+        "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
+        "'mime_blacklist' AND (rule_target = ? OR rule_target LIKE '%/*' AND ? LIKE REPLACE(rule_target, '*', '%')) AND (operation = ? OR operation = '*') AND enabled = "
+        "1 ORDER BY priority LIMIT 1";
+    rc = sqlite3_prepare_v2(db, mime_blacklist_sql, -1, &stmt, NULL);
+    if (rc == SQLITE_OK) {
+      sqlite3_bind_text(stmt, 1, mime_type, -1, SQLITE_STATIC);
+      sqlite3_bind_text(stmt, 2, mime_type, -1, SQLITE_STATIC);
+      sqlite3_bind_text(stmt, 3, operation ? operation : "", -1, SQLITE_STATIC);
+
+      if (sqlite3_step(stmt) == SQLITE_ROW) {
+        const char *description = (const char *)sqlite3_column_text(stmt, 1);
+        validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 FAILED - "
+                            "MIME type blacklisted\n");
+        char mime_blacklist_msg[256];
+        sprintf(
+            mime_blacklist_msg,
+            "VALIDATOR_DEBUG: RULES ENGINE - MIME blacklist rule matched: %s\n",
+            description ? description : "Unknown");
+        validator_debug_log(mime_blacklist_msg);
+
+        // Set specific violation details for status code mapping
+        strcpy(g_last_rule_violation.violation_type, "mime_blacklist");
+        sprintf(g_last_rule_violation.reason, "%s: MIME type blacklisted",
+                description ? description : "TEST_MIME_BLACKLIST");
+
+        sqlite3_finalize(stmt);
+        sqlite3_close(db);
+        return NOSTR_ERROR_AUTH_REQUIRED;
+      }
+      sqlite3_finalize(stmt);
+    }
+    validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 PASSED - MIME "
+                        "type not blacklisted\n");
+  } else {
+    validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 SKIPPED - No "
+                        "MIME type provided\n");
+  }
+
+  // Step 4: Check pubkey whitelist
+  // Match both exact operation and wildcard '*'
   const char *whitelist_sql =
       "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
-      "'pubkey_whitelist' AND rule_target = ? AND operation = ? AND enabled = "
+      "'pubkey_whitelist' AND rule_target = ? AND (operation = ? OR operation = '*') AND enabled = "
       "1 ORDER BY priority LIMIT 1";
   rc = sqlite3_prepare_v2(db, whitelist_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
@@ -1435,10 +1499,76 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
   validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 3 FAILED - Pubkey "
                       "not whitelisted\n");
 
-  // Step 4: Check if any whitelist rules exist - if yes, deny by default
+  // Step 5: Check MIME type whitelist (only if not already denied)
+  if (mime_type) {
+    // Match both exact MIME type and wildcard patterns (e.g., 'image/*')
+    const char *mime_whitelist_sql =
+        "SELECT rule_type, description FROM auth_rules WHERE rule_type = "
+        "'mime_whitelist' AND (rule_target = ? OR rule_target LIKE '%/*' AND ? LIKE REPLACE(rule_target, '*', '%')) AND (operation = ? OR operation = '*') AND enabled = "
+        "1 ORDER BY priority LIMIT 1";
+    rc = sqlite3_prepare_v2(db, mime_whitelist_sql, -1, &stmt, NULL);
+    if (rc == SQLITE_OK) {
+      sqlite3_bind_text(stmt, 1, mime_type, -1, SQLITE_STATIC);
+      sqlite3_bind_text(stmt, 2, mime_type, -1, SQLITE_STATIC);
+      sqlite3_bind_text(stmt, 3, operation ? operation : "", -1, SQLITE_STATIC);
+
+      if (sqlite3_step(stmt) == SQLITE_ROW) {
+        const char *description = (const char *)sqlite3_column_text(stmt, 1);
+        validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 5 PASSED - "
+                            "MIME type whitelisted\n");
+        char mime_whitelist_msg[256];
+        sprintf(mime_whitelist_msg,
+                "VALIDATOR_DEBUG: RULES ENGINE - MIME whitelist rule matched: %s\n",
+                description ? description : "Unknown");
+        validator_debug_log(mime_whitelist_msg);
+        sqlite3_finalize(stmt);
+        sqlite3_close(db);
+        return NOSTR_SUCCESS; // Allow whitelisted MIME type
+      }
+      sqlite3_finalize(stmt);
+    }
+    validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 5 FAILED - MIME "
+                        "type not whitelisted\n");
+  } else {
+    validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 5 SKIPPED - No "
+                        "MIME type provided\n");
+  }
+
+  // Step 6: Check if any MIME whitelist rules exist - if yes, deny by default
+  // Match both exact operation and wildcard '*'
+  const char *mime_whitelist_exists_sql =
+      "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'mime_whitelist' "
+      "AND (operation = ? OR operation = '*') AND enabled = 1 LIMIT 1";
+  rc = sqlite3_prepare_v2(db, mime_whitelist_exists_sql, -1, &stmt, NULL);
+  if (rc == SQLITE_OK) {
+    sqlite3_bind_text(stmt, 1, operation ? operation : "", -1, SQLITE_STATIC);
+
+    if (sqlite3_step(stmt) == SQLITE_ROW) {
+      int mime_whitelist_count = sqlite3_column_int(stmt, 0);
+      if (mime_whitelist_count > 0) {
+        validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 6 FAILED - "
+                            "MIME whitelist exists but type not in it\n");
+
+        // Set specific violation details for status code mapping
+        strcpy(g_last_rule_violation.violation_type, "mime_whitelist_violation");
+        strcpy(g_last_rule_violation.reason,
+               "MIME type not whitelisted for this operation");
+
+        sqlite3_finalize(stmt);
+        sqlite3_close(db);
+        return NOSTR_ERROR_AUTH_REQUIRED;
+      }
+    }
+    sqlite3_finalize(stmt);
+  }
+  validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 6 PASSED - No "
+                      "MIME whitelist restrictions apply\n");
+
+  // Step 7: Check if any whitelist rules exist - if yes, deny by default
+  // Match both exact operation and wildcard '*'
   const char *whitelist_exists_sql =
       "SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'pubkey_whitelist' "
-      "AND operation = ? AND enabled = 1 LIMIT 1";
+      "AND (operation = ? OR operation = '*') AND enabled = 1 LIMIT 1";
   rc = sqlite3_prepare_v2(db, whitelist_exists_sql, -1, &stmt, NULL);
   if (rc == SQLITE_OK) {
     sqlite3_bind_text(stmt, 1, operation ? operation : "", -1, SQLITE_STATIC);
@@ -1465,7 +1595,7 @@ static int check_database_auth_rules(const char *pubkey, const char *operation,
                       "whitelist restrictions apply\n");
 
   sqlite3_close(db);
-  validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 5 PASSED - All "
+  validator_debug_log("VALIDATOR_DEBUG: RULES ENGINE - STEP 7 PASSED - All "
                       "rule checks completed, default ALLOW\n");
   return NOSTR_SUCCESS; // Default allow if no restrictive rules matched
 }

src/test_keygen.c

@@ -0,0 +1,199 @@
+/*
+ * Test program for key generation
+ * Standalone version that doesn't require FastCGI
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sqlite3.h>
+#include "../nostr_core_lib/nostr_core/nostr_common.h"
+#include "../nostr_core_lib/nostr_core/utils.h"
+
+// Forward declarations
+int generate_random_private_key_bytes(unsigned char *key_bytes, size_t len);
+int generate_server_keypair(const char *db_path);
+int store_blossom_private_key(const char *db_path, const char *seckey);
+
+// Generate random private key bytes using /dev/urandom
+int generate_random_private_key_bytes(unsigned char *key_bytes, size_t len) {
+  FILE *fp = fopen("/dev/urandom", "rb");
+  if (!fp) {
+    fprintf(stderr, "ERROR: Cannot open /dev/urandom for key generation\n");
+    return -1;
+  }
+
+  size_t bytes_read = fread(key_bytes, 1, len, fp);
+  fclose(fp);
+
+  if (bytes_read != len) {
+    fprintf(stderr, "ERROR: Failed to read %zu bytes from /dev/urandom\n", len);
+    return -1;
+  }
+
+  return 0;
+}
+
+// Store blossom private key in dedicated table
+int store_blossom_private_key(const char *db_path, const char *seckey) {
+  sqlite3 *db;
+  sqlite3_stmt *stmt;
+  int rc;
+
+  // Validate key format
+  if (!seckey || strlen(seckey) != 64) {
+    fprintf(stderr, "ERROR: Invalid blossom private key format\n");
+    return -1;
+  }
+
+  // Create blossom_seckey table if it doesn't exist
+  rc = sqlite3_open_v2(db_path, &db, SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE, NULL);
+  if (rc) {
+    fprintf(stderr, "ERROR: Can't open database: %s\n", sqlite3_errmsg(db));
+    return -1;
+  }
+
+  // Create table
+  const char *create_sql = "CREATE TABLE IF NOT EXISTS blossom_seckey (id INTEGER PRIMARY KEY CHECK (id = 1), seckey TEXT NOT NULL, created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')), CHECK (length(seckey) = 64))";
+  rc = sqlite3_exec(db, create_sql, NULL, NULL, NULL);
+  if (rc != SQLITE_OK) {
+    fprintf(stderr, "ERROR: Failed to create blossom_seckey table: %s\n", sqlite3_errmsg(db));
+    sqlite3_close(db);
+    return -1;
+  }
+
+  // Store key
+  const char *sql = "INSERT OR REPLACE INTO blossom_seckey (id, seckey) VALUES (1, ?)";
+  rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+  if (rc != SQLITE_OK) {
+    fprintf(stderr, "ERROR: SQL prepare failed: %s\n", sqlite3_errmsg(db));
+    sqlite3_close(db);
+    return -1;
+  }
+
+  sqlite3_bind_text(stmt, 1, seckey, -1, SQLITE_STATIC);
+  rc = sqlite3_step(stmt);
+  sqlite3_finalize(stmt);
+  sqlite3_close(db);
+
+  if (rc != SQLITE_DONE) {
+    fprintf(stderr, "ERROR: Failed to store blossom private key\n");
+    return -1;
+  }
+
+  return 0;
+}
+
+// Generate server keypair and store in database
+int generate_server_keypair(const char *db_path) {
+  printf("Generating server keypair...\n");
+  unsigned char seckey_bytes[32];
+  char seckey_hex[65];
+  char pubkey_hex[65];
+
+  // Generate random private key
+  printf("Generating random private key...\n");
+  if (generate_random_private_key_bytes(seckey_bytes, 32) != 0) {
+    fprintf(stderr, "Failed to generate random bytes\n");
+    return -1;
+  }
+
+  // Validate the private key
+  if (nostr_ec_private_key_verify(seckey_bytes) != NOSTR_SUCCESS) {
+    fprintf(stderr, "ERROR: Generated invalid private key\n");
+    return -1;
+  }
+
+  // Convert to hex
+  nostr_bytes_to_hex(seckey_bytes, 32, seckey_hex);
+
+  // Derive public key
+  unsigned char pubkey_bytes[32];
+  if (nostr_ec_public_key_from_private_key(seckey_bytes, pubkey_bytes) != NOSTR_SUCCESS) {
+    fprintf(stderr, "ERROR: Failed to derive public key\n");
+    return -1;
+  }
+
+  // Convert public key to hex
+  nostr_bytes_to_hex(pubkey_bytes, 32, pubkey_hex);
+
+  // Store private key securely
+  if (store_blossom_private_key(db_path, seckey_hex) != 0) {
+    fprintf(stderr, "ERROR: Failed to store blossom private key\n");
+    return -1;
+  }
+
+  // Store public key in config
+  sqlite3 *db;
+  sqlite3_stmt *stmt;
+  int rc;
+
+  rc = sqlite3_open_v2(db_path, &db, SQLITE_OPEN_READWRITE, NULL);
+  if (rc) {
+    fprintf(stderr, "ERROR: Can't open database for config: %s\n", sqlite3_errmsg(db));
+    return -1;
+  }
+
+  const char *sql = "INSERT OR REPLACE INTO config (key, value, description) VALUES (?, ?, ?)";
+  rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+  if (rc != SQLITE_OK) {
+    fprintf(stderr, "ERROR: SQL prepare failed: %s\n", sqlite3_errmsg(db));
+    sqlite3_close(db);
+    return -1;
+  }
+
+  sqlite3_bind_text(stmt, 1, "blossom_pubkey", -1, SQLITE_STATIC);
+  sqlite3_bind_text(stmt, 2, pubkey_hex, -1, SQLITE_STATIC);
+  sqlite3_bind_text(stmt, 3, "Blossom server's public key for Nostr communication", -1, SQLITE_STATIC);
+
+  rc = sqlite3_step(stmt);
+  sqlite3_finalize(stmt);
+  sqlite3_close(db);
+
+  if (rc != SQLITE_DONE) {
+    fprintf(stderr, "ERROR: Failed to store blossom public key in config\n");
+    return -1;
+  }
+
+  // Display keys for admin setup
+  printf("========================================\n");
+  printf("SERVER KEYPAIR GENERATED SUCCESSFULLY\n");
+  printf("========================================\n");
+  printf("Blossom Public Key:  %s\n", pubkey_hex);
+  printf("Blossom Private Key: %s\n", seckey_hex);
+  printf("========================================\n");
+  printf("IMPORTANT: Save the private key securely!\n");
+  printf("This key is used for decrypting admin messages.\n");
+  printf("========================================\n");
+
+  return 0;
+}
+
+int main(int argc, char *argv[]) {
+  const char *db_path = "db/ginxsom.db";
+  
+  if (argc > 1) {
+    db_path = argv[1];
+  }
+  
+  printf("Test Key Generation\n");
+  printf("===================\n");
+  printf("Database: %s\n\n", db_path);
+  
+  // Initialize nostr crypto
+  printf("Initializing nostr crypto system...\n");
+  if (nostr_crypto_init() != NOSTR_SUCCESS) {
+    fprintf(stderr, "FATAL: Failed to initialize nostr crypto\n");
+    return 1;
+  }
+  printf("Crypto system initialized\n\n");
+  
+  // Generate keypair
+  if (generate_server_keypair(db_path) != 0) {
+    fprintf(stderr, "FATAL: Key generation failed\n");
+    return 1;
+  }
+  
+  printf("\nKey generation test completed successfully!\n");
+  return 0;
+}

src/test_main.c

@@ -0,0 +1,50 @@
+/*
+ * Minimal test version of main.c to debug startup issues
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "ginxsom.h"
+
+// Copy just the essential parts for testing
+char g_db_path[4096] = "db/ginxsom.db";
+char g_storage_dir[4096] = ".";
+char g_admin_pubkey[65] = "";
+char g_relay_seckey[65] = "";
+int g_generate_keys = 0;
+
+int main(int argc, char *argv[]) {
+  printf("DEBUG: main() started\n");
+  fflush(stdout);
+
+  // Parse minimal args
+  for (int i = 1; i < argc; i++) {
+    printf("DEBUG: arg %d: %s\n", i, argv[i]);
+    fflush(stdout);
+    if (strcmp(argv[i], "--generate-keys") == 0) {
+      g_generate_keys = 1;
+      printf("DEBUG: generate-keys flag set\n");
+      fflush(stdout);
+    } else if (strcmp(argv[i], "--help") == 0) {
+      printf("Usage: test_main [options]\n");
+      printf("  --generate-keys    Generate keys\n");
+      printf("  --help             Show help\n");
+      return 0;
+    }
+  }
+
+  printf("DEBUG: g_generate_keys = %d\n", g_generate_keys);
+  fflush(stdout);
+
+  if (g_generate_keys) {
+    printf("DEBUG: Would generate keys here\n");
+    fflush(stdout);
+    return 0;
+  }
+
+  printf("DEBUG: Normal startup would continue here\n");
+  fflush(stdout);
+
+  return 0;
+}

test_key_generation.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Test key generation for ginxsom
+
+echo "=== Testing Key Generation ==="
+echo
+
+# Run the binary with --generate-keys flag
+echo "Running: ./build/ginxsom-fcgi --generate-keys --db-path db/ginxsom.db"
+echo
+./build/ginxsom-fcgi --generate-keys --db-path db/ginxsom.db 2>&1
+
+echo
+echo "=== Checking if keys were stored ==="
+echo
+
+# Check if blossom_seckey table was created
+echo "Checking blossom_seckey table:"
+sqlite3 db/ginxsom.db "SELECT COUNT(*) as key_count FROM blossom_seckey" 2>&1
+
+echo
+echo "Checking blossom_pubkey in config:"
+sqlite3 db/ginxsom.db "SELECT value FROM config WHERE key='blossom_pubkey'" 2>&1
+
+echo
+echo "=== Test Complete ==="

test_mode_verification.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+
+echo "=== Test Mode Verification ==="
+echo ""
+
+# Expected test keys from .test_keys
+EXPECTED_ADMIN_PUBKEY="8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e"
+EXPECTED_SERVER_PUBKEY="52e366edfa4e9cc6a6d4653828e51ccf828a2f5a05227d7a768f33b5a198681a"
+
+echo "1. Checking database keys (should be OLD keys, not test keys)..."
+DB_ADMIN_PUBKEY=$(sqlite3 db/ginxsom.db "SELECT value FROM config WHERE key = 'admin_pubkey'")
+DB_BLOSSOM_PUBKEY=$(sqlite3 db/ginxsom.db "SELECT value FROM config WHERE key = 'blossom_pubkey'")
+DB_BLOSSOM_SECKEY=$(sqlite3 db/ginxsom.db "SELECT seckey FROM blossom_seckey WHERE id = 1")
+
+echo "   Database admin_pubkey: '$DB_ADMIN_PUBKEY'"
+echo "   Database blossom_pubkey: '$DB_BLOSSOM_PUBKEY'"
+echo "   Database blossom_seckey: '$DB_BLOSSOM_SECKEY'"
+echo ""
+
+# Verify database was NOT modified with test keys
+if [ "$DB_ADMIN_PUBKEY" = "$EXPECTED_ADMIN_PUBKEY" ]; then
+    echo "   ❌ FAIL: Database admin_pubkey matches test key (should NOT be modified)"
+    exit 1
+else
+    echo "   ✓ PASS: Database admin_pubkey is different from test key (not modified)"
+fi
+
+if [ "$DB_BLOSSOM_PUBKEY" = "$EXPECTED_SERVER_PUBKEY" ]; then
+    echo "   ❌ FAIL: Database blossom_pubkey matches test key (should NOT be modified)"
+    exit 1
+else
+    echo "   ✓ PASS: Database blossom_pubkey is different from test key (not modified)"
+fi
+
+echo ""
+echo "2. Checking server is running..."
+if curl -s http://localhost:9001/ > /dev/null; then
+    echo "   ✓ PASS: Server is responding"
+else
+    echo "   ❌ FAIL: Server is not responding"
+    exit 1
+fi
+
+echo ""
+echo "3. Verifying test keys from .test_keys file..."
+echo "   Expected admin pubkey: $EXPECTED_ADMIN_PUBKEY"
+echo "   Expected server pubkey: $EXPECTED_SERVER_PUBKEY"
+
+echo ""
+echo "=== All Tests Passed ==="
+echo "Test mode is working correctly:"
+echo "  - Test keys are loaded in memory"
+echo "  - Database was NOT modified"
+echo "  - Server is running with test keys"

tests/auth_test.sh

@@ -14,9 +14,9 @@ TESTS_PASSED=0
 TESTS_FAILED=0
 TOTAL_TESTS=0
 
-# Test keys for different scenarios
-TEST_USER1_PRIVKEY="5c0c523f52a5b6fad39ed2403092df8cebc36318b39383bca6c00808626fab3a"
-TEST_USER1_PUBKEY="87d3561f19b74adbe8bf840682992466068830a9d8c36b4a0c99d36f826cb6cb"
+# Test keys for different scenarios - Using WSB's keys for TEST_USER1
+TEST_USER1_PRIVKEY="22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd"
+TEST_USER1_PUBKEY="8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e"
 
 TEST_USER2_PRIVKEY="182c3a5e3b7a1b7e4f5c6b7c8b4a5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
 TEST_USER2_PUBKEY="c95195e5e7de1ad8c4d3c0ac4e8b5c0c4e0c4d3c1e5c8d4c2e7e9f4a5b6c7d8e"

tests/auth_test_tmp/blacklist_test1.txt

@@ -0,0 +1 @@
+Content from blacklisted user

tests/auth_test_tmp/blacklist_test2.txt

@@ -0,0 +1 @@
+Content from allowed user

tests/auth_test_tmp/cache_test1.txt

@@ -0,0 +1 @@
+First request - cache miss

tests/auth_test_tmp/cache_test2.txt

@@ -0,0 +1 @@
+Second request - cache hit

tests/auth_test_tmp/cleanup_test.txt

@@ -0,0 +1 @@
+Testing after cleanup

tests/auth_test_tmp/disabled_rule_test.txt

@@ -0,0 +1 @@
+Testing disabled rule

tests/auth_test_tmp/enabled_rule_test.txt

@@ -0,0 +1 @@
+Testing enabled rule

tests/auth_test_tmp/hash_blacklist_test.txt

@@ -0,0 +1 @@
+This specific file is blacklisted

tests/auth_test_tmp/hash_blacklist_test2.txt

@@ -0,0 +1 @@
+This file is allowed

tests/auth_test_tmp/mime_test1.txt

@@ -0,0 +1 @@
+Plain text file

tests/auth_test_tmp/mime_whitelist_test.txt

@@ -0,0 +1 @@
+Text file with whitelist active

tests/auth_test_tmp/nip42_challenge

@@ -1 +1 @@
-e3ba927d32ca105a8a4cafa2e013b97945a165c38e9ce573446a2332dc312fdb
+299c28eeb15df327c30c9afd952d4e35c3777443d2094b2caab2fc94599ce607

tests/auth_test_tmp/operation_test.txt

@@ -0,0 +1 @@
+Testing operation-specific rules

tests/auth_test_tmp/priority_test.txt

@@ -0,0 +1 @@
+Testing priority ordering

tests/auth_test_tmp/test.txt

@@ -0,0 +1 @@
+test content

tests/auth_test_tmp/whitelist_test1.txt

@@ -0,0 +1 @@
+Content from whitelisted user

tests/auth_test_tmp/whitelist_test2.txt

@@ -0,0 +1 @@
+Content from non-whitelisted user

tests/auth_test_tmp/wildcard_test.txt

@@ -0,0 +1 @@
+Testing wildcard operation

tests/file_put_bud02.sh

@@ -5,11 +5,14 @@
 
 set -e  # Exit on any error
 
-# Configuration
-SERVER_URL="http://localhost:9001"
+# Configuration - Using WSB's keys
+# SERVER_URL="http://localhost:9001"
+SERVER_URL="https://localhost:9443"
 UPLOAD_ENDPOINT="${SERVER_URL}/upload"
 TEST_FILE="test_blob_$(date +%s).txt"
 CLEANUP_FILES=()
+NOSTR_PRIVKEY="22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd"
+NOSTR_PUBKEY="8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e"
 
 # Colors for output
 RED='\033[0;31m'
@@ -87,7 +90,7 @@ check_prerequisites() {
 check_server() {
     log_info "Checking if server is running..."
     
-    if curl -s -f "${SERVER_URL}/health" > /dev/null 2>&1; then
+    if curl -k -s -f "${SERVER_URL}/health" > /dev/null 2>&1; then
         log_success "Server is running at ${SERVER_URL}"
     else
         log_error "Server is not responding at ${SERVER_URL}"
@@ -127,22 +130,23 @@ calculate_hash() {
 
 # Generate nostr event
 generate_nostr_event() {
-    log_info "Generating kind 24242 nostr event with nak..."
-    
+    log_info "Generating kind 24242 nostr event with nak using Alice's private key..."
+
     # Calculate expiration time (1 hour from now)
     EXPIRATION=$(date -d '+1 hour' +%s)
-    
-    # Generate the event using nak
+
+    # Generate the event using nak with Alice's private key
     EVENT_JSON=$(nak event -k 24242 -c "" \
+        --sec "$NOSTR_PRIVKEY" \
         -t "t=upload" \
         -t "x=${HASH}" \
         -t "expiration=${EXPIRATION}")
-    
+
     if [[ -z "$EVENT_JSON" ]]; then
         log_error "Failed to generate nostr event"
         exit 1
     fi
-    
+
     log_success "Generated nostr event"
     echo "Event JSON: $EVENT_JSON"
 }
@@ -168,7 +172,7 @@ perform_upload() {
     CLEANUP_FILES+=("${RESPONSE_FILE}")
     
     # Perform the upload with verbose output
-    HTTP_STATUS=$(curl -s -w "%{http_code}" \
+    HTTP_STATUS=$(curl -k -s -w "%{http_code}" \
         -X PUT \
         -H "Authorization: ${AUTH_HEADER}" \
         -H "Content-Type: text/plain" \
@@ -217,7 +221,7 @@ test_retrieval() {
     
     RETRIEVAL_URL="${SERVER_URL}/${HASH}"
     
-    if curl -s -f "${RETRIEVAL_URL}" > /dev/null 2>&1; then
+    if curl -k -s -f "${RETRIEVAL_URL}" > /dev/null 2>&1; then
         log_success "File can be retrieved at: ${RETRIEVAL_URL}"
     else
         log_warning "File not yet available for retrieval (expected if upload processing not implemented)"

tests/file_put_production.sh

@@ -0,0 +1,266 @@
+#!/bin/bash
+
+# file_put_production.sh - Test script for production Ginxsom Blossom server
+# Tests upload functionality on blossom.laantungir.net
+
+set -e  # Exit on any error
+
+# Configuration
+SERVER_URL="https://blossom.laantungir.net"
+UPLOAD_ENDPOINT="${SERVER_URL}/upload"
+TEST_FILE="test_blob_$(date +%s).txt"
+CLEANUP_FILES=()
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Cleanup function
+cleanup() {
+    echo -e "${YELLOW}Cleaning up temporary files...${NC}"
+    for file in "${CLEANUP_FILES[@]}"; do
+        if [[ -f "$file" ]]; then
+            rm -f "$file"
+            echo "Removed: $file"
+        fi
+    done
+}
+
+# Set up cleanup on exit
+trap cleanup EXIT
+
+# Helper functions
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+log_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+# Check prerequisites
+check_prerequisites() {
+    log_info "Checking prerequisites..."
+    
+    # Check if nak is installed
+    if ! command -v nak &> /dev/null; then
+        log_error "nak command not found. Please install nak first."
+        log_info "Install with: go install github.com/fiatjaf/nak@latest"
+        exit 1
+    fi
+    log_success "nak is installed"
+    
+    # Check if curl is available
+    if ! command -v curl &> /dev/null; then
+        log_error "curl command not found. Please install curl."
+        exit 1
+    fi
+    log_success "curl is available"
+    
+    # Check if sha256sum is available
+    if ! command -v sha256sum &> /dev/null; then
+        log_error "sha256sum command not found."
+        exit 1
+    fi
+    log_success "sha256sum is available"
+    
+    # Check if base64 is available
+    if ! command -v base64 &> /dev/null; then
+        log_error "base64 command not found."
+        exit 1
+    fi
+    log_success "base64 is available"
+}
+
+# Check if server is running
+check_server() {
+    log_info "Checking if server is running..."
+    
+    if curl -s -f "${SERVER_URL}/health" > /dev/null 2>&1; then
+        log_success "Server is running at ${SERVER_URL}"
+    else
+        log_error "Server is not responding at ${SERVER_URL}"
+        exit 1
+    fi
+}
+
+# Create test file
+create_test_file() {
+    log_info "Creating test file: ${TEST_FILE}"
+    
+    # Create test content with timestamp and random data
+    cat > "${TEST_FILE}" << EOF
+Test blob content for Ginxsom Blossom server (PRODUCTION)
+Timestamp: $(date -Iseconds)
+Random data: $(openssl rand -hex 32)
+Test message: Hello from production test!
+
+This file is used to test the upload functionality
+of the Ginxsom Blossom server on blossom.laantungir.net
+EOF
+    
+    CLEANUP_FILES+=("${TEST_FILE}")
+    log_success "Created test file with $(wc -c < "${TEST_FILE}") bytes"
+}
+
+# Calculate file hash
+calculate_hash() {
+    log_info "Calculating SHA-256 hash..."
+    
+    HASH=$(sha256sum "${TEST_FILE}" | cut -d' ' -f1)
+    
+    log_success "Data to hash: ${TEST_FILE}"
+    log_success "File hash: ${HASH}"
+}
+
+# Generate nostr event
+generate_nostr_event() {
+    log_info "Generating kind 24242 nostr event with nak using WSB's private key..."
+
+    # Calculate expiration time (1 hour from now)
+    EXPIRATION=$(date -d '+1 hour' +%s)
+
+    # Generate the event using nak with WSB's private key
+    EVENT_JSON=$(nak event -k 24242 -c "" \
+        --sec "22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd" \
+        -t "t=upload" \
+        -t "x=${HASH}" \
+        -t "expiration=${EXPIRATION}")
+
+    if [[ -z "$EVENT_JSON" ]]; then
+        log_error "Failed to generate nostr event"
+        exit 1
+    fi
+
+    log_success "Generated nostr event"
+    echo "Event JSON: $EVENT_JSON"
+}
+
+# Create authorization header
+create_auth_header() {
+    log_info "Creating authorization header..."
+    
+    # Base64 encode the event (without newlines)
+    AUTH_B64=$(echo -n "$EVENT_JSON" | base64 -w 0)
+    AUTH_HEADER="Nostr ${AUTH_B64}"
+    
+    log_success "Created authorization header"
+    echo "Auth header length: ${#AUTH_HEADER} characters"
+}
+
+# Perform upload
+perform_upload() {
+    log_info "Performing upload to ${UPLOAD_ENDPOINT}..."
+    
+    # Create temporary file for response
+    RESPONSE_FILE=$(mktemp)
+    CLEANUP_FILES+=("${RESPONSE_FILE}")
+    
+    # Perform the upload with verbose output
+    HTTP_STATUS=$(curl -s -w "%{http_code}" \
+        -X PUT \
+        -H "Authorization: ${AUTH_HEADER}" \
+        -H "Content-Type: text/plain" \
+        -H "Content-Disposition: attachment; filename=\"${TEST_FILE}\"" \
+        --data-binary "@${TEST_FILE}" \
+        "${UPLOAD_ENDPOINT}" \
+        -o "${RESPONSE_FILE}")
+    
+    echo "HTTP Status: ${HTTP_STATUS}"
+    echo "Response body:"
+    cat "${RESPONSE_FILE}"
+    echo
+    
+    # Check response
+    case "${HTTP_STATUS}" in
+        200)
+            log_success "Upload successful!"
+            ;;
+        201)
+            log_success "Upload successful (created)!"
+            ;;
+        400)
+            log_error "Bad request - check the event format"
+            ;;
+        401)
+            log_error "Unauthorized - authentication failed"
+            ;;
+        405)
+            log_error "Method not allowed - check nginx configuration"
+            ;;
+        413)
+            log_error "Payload too large"
+            ;;
+        501)
+            log_warning "Upload endpoint not yet implemented (expected for now)"
+            ;;
+        *)
+            log_error "Upload failed with HTTP status: ${HTTP_STATUS}"
+            ;;
+    esac
+}
+
+# Test file retrieval
+test_retrieval() {
+    log_info "Testing file retrieval..."
+    
+    RETRIEVAL_URL="${SERVER_URL}/${HASH}"
+    
+    if curl -s -f "${RETRIEVAL_URL}" > /dev/null 2>&1; then
+        log_success "File can be retrieved at: ${RETRIEVAL_URL}"
+        
+        # Download and verify
+        DOWNLOADED_FILE=$(mktemp)
+        CLEANUP_FILES+=("${DOWNLOADED_FILE}")
+        curl -s "${RETRIEVAL_URL}" -o "${DOWNLOADED_FILE}"
+        
+        DOWNLOADED_HASH=$(sha256sum "${DOWNLOADED_FILE}" | cut -d' ' -f1)
+        if [[ "${DOWNLOADED_HASH}" == "${HASH}" ]]; then
+            log_success "Downloaded file hash matches! Verification successful."
+        else
+            log_error "Hash mismatch! Expected: ${HASH}, Got: ${DOWNLOADED_HASH}"
+        fi
+    else
+        log_warning "File not yet available for retrieval"
+    fi
+}
+
+# Main execution
+main() {
+    echo "=== Ginxsom Blossom Production Upload Test ==="
+    echo "Server: ${SERVER_URL}"
+    echo "Timestamp: $(date -Iseconds)"
+    echo
+    
+    check_prerequisites
+    check_server
+    create_test_file
+    calculate_hash
+    generate_nostr_event
+    create_auth_header
+    perform_upload
+    test_retrieval
+    
+    echo
+    log_info "Test completed!"
+    echo "Summary:"
+    echo "  Test file: ${TEST_FILE}"
+    echo "  File hash: ${HASH}"
+    echo "  Server: ${SERVER_URL}"
+    echo "  Upload endpoint: ${UPLOAD_ENDPOINT}"
+    echo "  Retrieval URL: ${SERVER_URL}/${HASH}"
+}
+
+# Run main function
+main "$@"

tests/list_test_bud02.sh

@@ -4,8 +4,8 @@
 # This script tests the blob listing functionality
 
 BASE_URL="http://localhost:9001"
-NOSTR_PRIVKEY="0000000000000000000000000000000000000000000000000000000000000001"
-NOSTR_PUBKEY="79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"
+NOSTR_PRIVKEY="22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd"
+NOSTR_PUBKEY="8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e"
 
 # Colors for output
 RED='\033[0;31m'
@@ -19,128 +19,117 @@ echo
 # Function to generate a Nostr event for list authorization
 generate_list_auth() {
     local content="$1"
-    local created_at=$(date +%s)
-    local expiration=$((created_at + 3600))  # 1 hour from now
-    
-    # Note: This is a placeholder - in real implementation, you'd use nostr tools
-    # to generate properly signed events. For now, we'll create the structure.
-    cat << EOF
-{
-  "id": "placeholder_id",
-  "pubkey": "$NOSTR_PUBKEY",
-  "kind": 24242,
-  "content": "$content",
-  "created_at": $created_at,
-  "tags": [
-    ["t", "list"],
-    ["expiration", "$expiration"]
-  ],
-  "sig": "placeholder_signature"
-}
-EOF
+
+    # Use nak to generate properly signed events with Alice's private key
+    nak event -k 24242 -c "$content" \
+        --sec "$NOSTR_PRIVKEY" \
+        -t "t=list" \
+        -t "expiration=$(( $(date +%s) + 3600 ))"
 }
 
 # Test 1: List blobs without authorization (should work if optional auth)
 echo -e "${YELLOW}Test 1: GET /list/<pubkey> without authorization${NC}"
+
 RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" "$BASE_URL/list/$NOSTR_PUBKEY")
 HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
 BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
+echo "Using pubkey: $NOSTR_PUBKEY"
+echo "HTTP Status: $HTTP_STATUS"
+echo "Response: $BODY"
+echo
+
+# Test 2: List blobs with authorization
+echo -e "${YELLOW}Test 2: GET /list/<pubkey> with authorization${NC}"
+LIST_AUTH=$(generate_list_auth "List Blobs")
+AUTH_B64=$(echo "$LIST_AUTH" | base64 -w 0)
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
+    -H "Authorization: Nostr $AUTH_B64" \
+    "$BASE_URL/list/$NOSTR_PUBKEY")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+
 echo "HTTP Status: $HTTP_STATUS"
 echo "Response: $BODY"
 echo
 
-# # Test 2: List blobs with authorization
-# echo -e "${YELLOW}Test 2: GET /list/<pubkey> with authorization${NC}"
-# LIST_AUTH=$(generate_list_auth "List Blobs")
-# AUTH_B64=$(echo "$LIST_AUTH" | base64 -w 0)
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
-#     -H "Authorization: Nostr $AUTH_B64" \
-#     "$BASE_URL/list/$NOSTR_PUBKEY")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 3: List blobs with since parameter
+echo -e "${YELLOW}Test 3: GET /list/<pubkey> with since parameter${NC}"
+SINCE_TIMESTAMP=$(($(date +%s) - 86400))  # 24 hours ago
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
+    "$BASE_URL/list/$NOSTR_PUBKEY?since=$SINCE_TIMESTAMP")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# echo "HTTP Status: $HTTP_STATUS"
-# echo "Response: $BODY"
-# echo
+echo "HTTP Status: $HTTP_STATUS"
+echo "Response: $BODY"
+echo
 
-# # Test 3: List blobs with since parameter
-# echo -e "${YELLOW}Test 3: GET /list/<pubkey> with since parameter${NC}"
-# SINCE_TIMESTAMP=$(($(date +%s) - 86400))  # 24 hours ago
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
-#     "$BASE_URL/list/$NOSTR_PUBKEY?since=$SINCE_TIMESTAMP")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 4: List blobs with until parameter
+echo -e "${YELLOW}Test 4: GET /list/<pubkey> with until parameter${NC}"
+UNTIL_TIMESTAMP=$(date +%s)  # now
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
+    "$BASE_URL/list/$NOSTR_PUBKEY?until=$UNTIL_TIMESTAMP")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# echo "HTTP Status: $HTTP_STATUS"
-# echo "Response: $BODY"
-# echo
+echo "HTTP Status: $HTTP_STATUS"
+echo "Response: $BODY"
+echo
 
-# # Test 4: List blobs with until parameter
-# echo -e "${YELLOW}Test 4: GET /list/<pubkey> with until parameter${NC}"
-# UNTIL_TIMESTAMP=$(date +%s)  # now
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
-#     "$BASE_URL/list/$NOSTR_PUBKEY?until=$UNTIL_TIMESTAMP")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 5: List blobs with both since and until parameters
+echo -e "${YELLOW}Test 5: GET /list/<pubkey> with since and until parameters${NC}"
+SINCE_TIMESTAMP=$(($(date +%s) - 86400))  # 24 hours ago
+UNTIL_TIMESTAMP=$(date +%s)  # now
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
+    "$BASE_URL/list/$NOSTR_PUBKEY?since=$SINCE_TIMESTAMP&until=$UNTIL_TIMESTAMP")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# echo "HTTP Status: $HTTP_STATUS"
-# echo "Response: $BODY"
-# echo
+echo "HTTP Status: $HTTP_STATUS"
+echo "Response: $BODY"
+echo
 
-# # Test 5: List blobs with both since and until parameters
-# echo -e "${YELLOW}Test 5: GET /list/<pubkey> with since and until parameters${NC}"
-# SINCE_TIMESTAMP=$(($(date +%s) - 86400))  # 24 hours ago
-# UNTIL_TIMESTAMP=$(date +%s)  # now
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
-#     "$BASE_URL/list/$NOSTR_PUBKEY?since=$SINCE_TIMESTAMP&until=$UNTIL_TIMESTAMP")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 6: List blobs for non-existent pubkey
+echo -e "${YELLOW}Test 6: GET /list/<nonexistent_pubkey>${NC}"
+FAKE_PUBKEY="1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef"
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" "$BASE_URL/list/$FAKE_PUBKEY")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# echo "HTTP Status: $HTTP_STATUS"
-# echo "Response: $BODY"
-# echo
+if [ "$HTTP_STATUS" = "200" ]; then
+    echo -e "${GREEN}✓ Correctly returned 200 with empty array${NC}"
+else
+    echo "HTTP Status: $HTTP_STATUS"
+fi
+echo "Response: $BODY"
+echo
 
-# # Test 6: List blobs for non-existent pubkey
-# echo -e "${YELLOW}Test 6: GET /list/<nonexistent_pubkey>${NC}"
-# FAKE_PUBKEY="1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef"
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" "$BASE_URL/list/$FAKE_PUBKEY")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 7: List blobs with invalid pubkey format
+echo -e "${YELLOW}Test 7: GET /list/<invalid_pubkey_format>${NC}"
+INVALID_PUBKEY="invalid_pubkey"
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" "$BASE_URL/list/$INVALID_PUBKEY")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# if [ "$HTTP_STATUS" = "200" ]; then
-#     echo -e "${GREEN}✓ Correctly returned 200 with empty array${NC}"
-# else
-#     echo "HTTP Status: $HTTP_STATUS"
-# fi
-# echo "Response: $BODY"
-# echo
+if [ "$HTTP_STATUS" = "400" ]; then
+    echo -e "${GREEN}✓ Correctly returned 400 for invalid pubkey format${NC}"
+else
+    echo "HTTP Status: $HTTP_STATUS"
+fi
+echo "Response: $BODY"
+echo
 
-# # Test 7: List blobs with invalid pubkey format
-# echo -e "${YELLOW}Test 7: GET /list/<invalid_pubkey_format>${NC}"
-# INVALID_PUBKEY="invalid_pubkey"
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" "$BASE_URL/list/$INVALID_PUBKEY")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
+# Test 8: List blobs with invalid since/until parameters
+echo -e "${YELLOW}Test 8: GET /list/<pubkey> with invalid timestamp parameters${NC}"
+RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
+    "$BASE_URL/list/$NOSTR_PUBKEY?since=invalid&until=invalid")
+HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
+BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
 
-# if [ "$HTTP_STATUS" = "400" ]; then
-#     echo -e "${GREEN}✓ Correctly returned 400 for invalid pubkey format${NC}"
-# else
-#     echo "HTTP Status: $HTTP_STATUS"
-# fi
-# echo "Response: $BODY"
-# echo
-
-# # Test 8: List blobs with invalid since/until parameters
-# echo -e "${YELLOW}Test 8: GET /list/<pubkey> with invalid timestamp parameters${NC}"
-# RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" \
-#     "$BASE_URL/list/$NOSTR_PUBKEY?since=invalid&until=invalid")
-# HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS" | cut -d: -f2)
-# BODY=$(echo "$RESPONSE" | sed '/HTTP_STATUS/d')
-
-# echo "HTTP Status: $HTTP_STATUS"
-# echo "Response: $BODY"
-# echo
+echo "HTTP Status: $HTTP_STATUS"
+echo "Response: $BODY"
+echo
 
 # echo "=== List Tests Complete ==="
 # echo

tests/mirror_test_bud04.sh

@@ -3,18 +3,31 @@
 # Mirror Test Script for BUD-04
 # Tests the PUT /mirror endpoint with a sample PNG file and NIP-42 authentication
 
+# ============================================================================
+# CONFIGURATION - Choose your target Blossom server
+# ============================================================================
+
+# Local server (uncomment to use)
+BLOSSOM_SERVER="http://localhost:9001"
+
+# Remote server (uncomment to use)
+#BLOSSOM_SERVER="https://blossom.laantungir.net"
+
+# ============================================================================
+
 # Test URL - PNG file with known SHA-256 hash
 TEST_URL="https://laantungir.github.io/img_repo/24308d48eb498b593e55a87b6300ccffdea8432babc0bb898b1eff21ebbb72de.png"
 EXPECTED_HASH="24308d48eb498b593e55a87b6300ccffdea8432babc0bb898b1eff21ebbb72de"
 
 echo "=== BUD-04 Mirror Endpoint Test with Authentication ==="
+echo "Blossom Server: $BLOSSOM_SERVER"
 echo "Target URL: $TEST_URL"
 echo "Expected Hash: $EXPECTED_HASH"
 echo ""
 
 # Get a fresh challenge from the server
 echo "=== Getting Authentication Challenge ==="
-challenge=$(curl -s "http://localhost:9001/auth" | jq -r '.challenge')
+challenge=$(curl -s "$BLOSSOM_SERVER/auth" | jq -r '.challenge')
 if [ "$challenge" = "null" ] || [ -z "$challenge" ]; then
     echo "❌ Failed to get challenge from server"
     exit 1
@@ -48,7 +61,7 @@ RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}\n" \
   -H "Authorization: $auth_header" \
   -H "Content-Type: application/json" \
   -d "$JSON_BODY" \
-  http://localhost:9001/mirror)
+  "$BLOSSOM_SERVER/mirror")
 
 echo "Response:"
 echo "$RESPONSE"
@@ -65,9 +78,9 @@ if [ "$HTTP_CODE" = "200" ]; then
     # Try to access the mirrored blob
     echo ""
     echo "=== Verifying Mirrored Blob ==="
-    echo "Attempting to fetch: http://localhost:9001/$EXPECTED_HASH.png"
+    echo "Attempting to fetch: $BLOSSOM_SERVER/$EXPECTED_HASH.png"
     
-    BLOB_RESPONSE=$(curl -s -w "HTTP_CODE:%{http_code}" -I "http://localhost:9001/$EXPECTED_HASH.png")
+    BLOB_RESPONSE=$(curl -s -w "HTTP_CODE:%{http_code}" -I "$BLOSSOM_SERVER/$EXPECTED_HASH.png")
     BLOB_HTTP_CODE=$(echo "$BLOB_RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2)
     
     if [ "$BLOB_HTTP_CODE" = "200" ]; then
@@ -82,7 +95,7 @@ if [ "$HTTP_CODE" = "200" ]; then
     # Test HEAD request for metadata
     echo ""
     echo "=== Testing HEAD Request ==="
-    HEAD_RESPONSE=$(curl -s -w "HTTP_CODE:%{http_code}" -I -X HEAD "http://localhost:9001/$EXPECTED_HASH")
+    HEAD_RESPONSE=$(curl -s -w "HTTP_CODE:%{http_code}" -I -X HEAD "$BLOSSOM_SERVER/$EXPECTED_HASH")
     HEAD_HTTP_CODE=$(echo "$HEAD_RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2)
     
     if [ "$HEAD_HTTP_CODE" = "200" ]; then

tests/white_black_list_test.sh

@@ -0,0 +1,353 @@
+#!/bin/bash
+
+# white_black_list_test.sh - Whitelist/Blacklist Rules Test Suite
+# Tests the auth_rules table functionality for pubkey and MIME type filtering
+
+# Configuration
+SERVER_URL="http://localhost:9001"
+UPLOAD_ENDPOINT="${SERVER_URL}/upload"
+DB_PATH="db/ginxsom.db"
+TEST_DIR="tests/auth_test_tmp"
+
+# Test results tracking
+TESTS_PASSED=0
+TESTS_FAILED=0
+TOTAL_TESTS=0
+
+# Test keys for different scenarios - Using WSB's keys for TEST_USER1
+# Generated using: nak key public <privkey>
+TEST_USER1_PRIVKEY="22cc83aa57928a2800234c939240c9a6f0f44a33ea3838a860ed38930b195afd"
+TEST_USER1_PUBKEY="8ff74724ed641b3c28e5a86d7c5cbc49c37638ace8c6c38935860e7a5eedde0e"
+
+TEST_USER2_PRIVKEY="182c3a5e3b7a1b7e4f5c6b7c8b4a5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
+TEST_USER2_PUBKEY="0396b426090284a28294078dce53fe73791ab623c3fc46ab4409fea05109a6db"
+
+TEST_USER3_PRIVKEY="abcd1234567890abcd1234567890abcd1234567890abcd1234567890abcd1234"
+TEST_USER3_PUBKEY="769a740386211c76f81bb235de50a5e6fa463cb4fae25e62625607fc2cfc0f28"
+
+# Helper function to record test results
+record_test_result() {
+    local test_name="$1"
+    local expected="$2"
+    local actual="$3"
+    
+    TOTAL_TESTS=$((TOTAL_TESTS + 1))
+    
+    if [[ "$actual" == "$expected" ]]; then
+        echo "✅ $test_name - PASSED"
+        TESTS_PASSED=$((TESTS_PASSED + 1))
+    else
+        echo "❌ $test_name - FAILED (Expected: $expected, Got: $actual)"
+        TESTS_FAILED=$((TESTS_FAILED + 1))
+    fi
+}
+
+# Check prerequisites
+for cmd in nak curl jq sqlite3; do
+    if ! command -v $cmd &> /dev/null; then
+        echo "❌ $cmd command not found"
+        exit 1
+    fi
+done
+
+# Check if server is running
+if ! curl -s -f "${SERVER_URL}/" > /dev/null 2>&1; then
+    echo "❌ Server not running at $SERVER_URL"
+    echo "Start with: ./restart-all.sh"
+    exit 1
+fi
+
+# Check if database exists
+if [[ ! -f "$DB_PATH" ]]; then
+    echo "❌ Database not found at $DB_PATH"
+    exit 1
+fi
+
+# Setup test environment
+mkdir -p "$TEST_DIR"
+
+echo "=========================================="
+echo "  WHITELIST/BLACKLIST RULES TEST SUITE"
+echo "=========================================="
+echo
+
+# Helper functions
+create_test_file() {
+    local filename="$1"
+    local content="${2:-test content for $filename}"
+    local filepath="$TEST_DIR/$filename"
+    echo "$content" > "$filepath"
+    echo "$filepath"
+}
+
+create_auth_event() {
+    local privkey="$1" 
+    local operation="$2"
+    local hash="$3"
+    local expiration_offset="${4:-3600}"  # 1 hour default
+    
+    local expiration=$(date -d "+${expiration_offset} seconds" +%s)
+    
+    local event_args=(-k 24242 -c "" --tag "t=$operation" --tag "expiration=$expiration" --sec "$privkey")
+    
+    if [[ -n "$hash" ]]; then
+        event_args+=(--tag "x=$hash")
+    fi
+    
+    nak event "${event_args[@]}"
+}
+
+test_upload() {
+    local test_name="$1"
+    local privkey="$2"
+    local file_path="$3"
+    local expected_status="${4:-200}"
+    
+    local file_hash=$(sha256sum "$file_path" | cut -d' ' -f1)
+    
+    # Create auth event
+    local event=$(create_auth_event "$privkey" "upload" "$file_hash")
+    local auth_header="Nostr $(echo "$event" | base64 -w 0)"
+    
+    # Make upload request
+    local response_file=$(mktemp)
+    local http_status=$(curl -s -w "%{http_code}" \
+        -H "Authorization: $auth_header" \
+        -H "Content-Type: text/plain" \
+        --data-binary "@$file_path" \
+        -X PUT "$UPLOAD_ENDPOINT" \
+        -o "$response_file" 2>/dev/null)
+    
+    # Show response if test fails
+    if [[ "$http_status" != "$expected_status" ]]; then
+        echo "  Response: $(cat "$response_file")"
+    fi
+    
+    rm -f "$response_file"
+    
+    # Record result
+    record_test_result "$test_name" "$expected_status" "$http_status"
+}
+
+# Clean up any existing rules from previous tests
+echo "Cleaning up existing auth rules..."
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;" 2>/dev/null
+
+# Enable authentication rules
+echo "Enabling authentication rules..."
+sqlite3 "$DB_PATH" "UPDATE config SET value = 'true' WHERE key = 'auth_rules_enabled';"
+
+echo
+echo "=== SECTION 1: PUBKEY BLACKLIST TESTS ==="
+echo
+
+# Test 1: Add pubkey blacklist rule
+echo "Adding blacklist rule for TEST_USER3..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_blacklist', '$TEST_USER3_PUBKEY', 'upload', 10, 'Test blacklist');"
+
+# Test 1a: Blacklisted user should be denied
+test_file1=$(create_test_file "blacklist_test1.txt" "Content from blacklisted user")
+test_upload "Test 1a: Blacklisted Pubkey Upload" "$TEST_USER3_PRIVKEY" "$test_file1" "403"
+
+# Test 1b: Non-blacklisted user should succeed
+test_file2=$(create_test_file "blacklist_test2.txt" "Content from allowed user")
+test_upload "Test 1b: Non-Blacklisted Pubkey Upload" "$TEST_USER1_PRIVKEY" "$test_file2" "200"
+
+echo
+echo "=== SECTION 2: PUBKEY WHITELIST TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 2: Add pubkey whitelist rule
+echo "Adding whitelist rule for TEST_USER1..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_whitelist', '$TEST_USER1_PUBKEY', 'upload', 300, 'Test whitelist');"
+
+# Test 2a: Whitelisted user should succeed
+test_file3=$(create_test_file "whitelist_test1.txt" "Content from whitelisted user")
+test_upload "Test 2a: Whitelisted Pubkey Upload" "$TEST_USER1_PRIVKEY" "$test_file3" "200"
+
+# Test 2b: Non-whitelisted user should be denied (whitelist default-deny)
+test_file4=$(create_test_file "whitelist_test2.txt" "Content from non-whitelisted user")
+test_upload "Test 2b: Non-Whitelisted Pubkey Upload" "$TEST_USER2_PRIVKEY" "$test_file4" "403"
+
+echo
+echo "=== SECTION 3: HASH BLACKLIST TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+
+# Test 3: Create a file and blacklist its hash
+test_file5=$(create_test_file "hash_blacklist_test.txt" "This specific file is blacklisted")
+BLACKLISTED_HASH=$(sha256sum "$test_file5" | cut -d' ' -f1)
+
+echo "Adding hash blacklist rule for $BLACKLISTED_HASH..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('hash_blacklist', '$BLACKLISTED_HASH', 'upload', 100, 'Test hash blacklist');"
+
+# Test 3a: Blacklisted hash should be denied
+test_upload "Test 3a: Blacklisted Hash Upload" "$TEST_USER1_PRIVKEY" "$test_file5" "403"
+
+# Test 3b: Different file should succeed
+test_file6=$(create_test_file "hash_blacklist_test2.txt" "This file is allowed")
+test_upload "Test 3b: Non-Blacklisted Hash Upload" "$TEST_USER1_PRIVKEY" "$test_file6" "200"
+
+echo
+echo "=== SECTION 4: MIME TYPE BLACKLIST TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 4: Blacklist executable MIME types
+echo "Adding MIME type blacklist rules..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('mime_blacklist', 'application/x-executable', 'upload', 200, 'Block executables');"
+
+# Note: This test would require the server to detect MIME types from file content
+# For now, we'll test with text/plain which should be allowed
+test_file7=$(create_test_file "mime_test1.txt" "Plain text file")
+test_upload "Test 4a: Allowed MIME Type Upload" "$TEST_USER1_PRIVKEY" "$test_file7" "200"
+
+echo
+echo "=== SECTION 5: MIME TYPE WHITELIST TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 5: Whitelist only image MIME types
+echo "Adding MIME type whitelist rules..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('mime_whitelist', 'image/jpeg', 'upload', 400, 'Allow JPEG');"
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('mime_whitelist', 'image/png', 'upload', 400, 'Allow PNG');"
+
+# Note: MIME type detection would need to be implemented in the server
+# For now, text/plain should be denied if whitelist exists
+test_file8=$(create_test_file "mime_whitelist_test.txt" "Text file with whitelist active")
+test_upload "Test 5a: Non-Whitelisted MIME Type Upload" "$TEST_USER1_PRIVKEY" "$test_file8" "403"
+
+echo
+echo "=== SECTION 6: PRIORITY ORDERING TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 6: Blacklist should override whitelist (priority ordering)
+echo "Adding both blacklist (priority 10) and whitelist (priority 300) for same pubkey..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_blacklist', '$TEST_USER1_PUBKEY', 'upload', 10, 'Blacklist priority test');"
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_whitelist', '$TEST_USER1_PUBKEY', 'upload', 300, 'Whitelist priority test');"
+
+# Test 6a: Blacklist should win (lower priority number = higher priority)
+test_file9=$(create_test_file "priority_test.txt" "Testing priority ordering")
+test_upload "Test 6a: Blacklist Priority Over Whitelist" "$TEST_USER1_PRIVKEY" "$test_file9" "403"
+
+echo
+echo "=== SECTION 7: OPERATION-SPECIFIC RULES ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 7: Blacklist only for upload operation
+echo "Adding blacklist rule for upload operation only..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_blacklist', '$TEST_USER2_PUBKEY', 'upload', 10, 'Upload-only blacklist');"
+
+# Test 7a: Upload should be denied
+test_file10=$(create_test_file "operation_test.txt" "Testing operation-specific rules")
+test_upload "Test 7a: Operation-Specific Blacklist" "$TEST_USER2_PRIVKEY" "$test_file10" "403"
+
+echo
+echo "=== SECTION 8: WILDCARD OPERATION TESTS ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 8: Blacklist for all operations using wildcard
+echo "Adding blacklist rule for all operations (*)..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, description) VALUES ('pubkey_blacklist', '$TEST_USER3_PUBKEY', '*', 10, 'All operations blacklist');"
+
+# Test 8a: Upload should be denied
+test_file11=$(create_test_file "wildcard_test.txt" "Testing wildcard operation")
+test_upload "Test 8a: Wildcard Operation Blacklist" "$TEST_USER3_PRIVKEY" "$test_file11" "403"
+
+echo
+echo "=== SECTION 9: ENABLED/DISABLED RULES ==="
+echo
+
+# Clean rules
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules_cache;"
+
+# Test 9: Disabled rule should not be enforced
+echo "Adding disabled blacklist rule..."
+sqlite3 "$DB_PATH" "INSERT INTO auth_rules (rule_type, rule_target, operation, priority, enabled, description) VALUES ('pubkey_blacklist', '$TEST_USER1_PUBKEY', 'upload', 10, 0, 'Disabled blacklist');"
+
+# Test 9a: Upload should succeed (rule is disabled)
+test_file12=$(create_test_file "disabled_rule_test.txt" "Testing disabled rule")
+test_upload "Test 9a: Disabled Rule Not Enforced" "$TEST_USER1_PRIVKEY" "$test_file12" "200"
+
+# Test 9b: Enable the rule
+echo "Enabling the blacklist rule..."
+sqlite3 "$DB_PATH" "UPDATE auth_rules SET enabled = 1 WHERE rule_target = '$TEST_USER1_PUBKEY';"
+
+# Test 9c: Upload should now be denied
+test_file13=$(create_test_file "enabled_rule_test.txt" "Testing enabled rule")
+test_upload "Test 9c: Enabled Rule Enforced" "$TEST_USER1_PRIVKEY" "$test_file13" "403"
+
+
+echo
+echo "=== SECTION 11: CLEANUP AND RESET ==="
+echo
+
+# Clean up all test rules
+echo "Cleaning up test rules..."
+sqlite3 "$DB_PATH" "DELETE FROM auth_rules;"
+
+# Verify cleanup
+RULE_COUNT=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM auth_rules;" 2>/dev/null)
+if [[ "$RULE_COUNT" -eq 0 ]]; then
+    record_test_result "Test 10a: Rules Cleanup" "0" "0"
+else
+    record_test_result "Test 10a: Rules Cleanup" "0" "$RULE_COUNT"
+fi
+
+# Test that uploads work again after cleanup
+test_file16=$(create_test_file "cleanup_test.txt" "Testing after cleanup")
+test_upload "Test 10b: Upload After Cleanup" "$TEST_USER1_PRIVKEY" "$test_file16" "200"
+
+echo
+echo "=========================================="
+echo "         TEST SUITE RESULTS"
+echo "=========================================="
+echo
+echo "Total Tests: $TOTAL_TESTS"
+echo "✅ Passed: $TESTS_PASSED"
+echo "❌ Failed: $TESTS_FAILED"
+echo
+if [[ $TESTS_FAILED -eq 0 ]]; then
+    echo "🎉 ALL TESTS PASSED!"
+    echo
+    echo "Whitelist/Blacklist functionality verified:"
+    echo "- Pubkey blacklist: Working"
+    echo "- Pubkey whitelist: Working"
+    echo "- Hash blacklist: Working"
+    echo "- MIME type rules: Working"
+    echo "- Priority ordering: Working"
+    echo "- Operation-specific rules: Working"
+    echo "- Wildcard operations: Working"
+    echo "- Enable/disable rules: Working"
+else
+    echo "⚠️  Some tests failed. Check output above for details."
+    echo "Success rate: $(( (TESTS_PASSED * 100) / TOTAL_TESTS ))%"
+fi
+echo
+echo "To clean up test data: rm -rf $TEST_DIR"
+echo "=========================================="

update_remote_nginx_conf.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+
+# update_remote_nginx_conf.sh
+# Updates the remote nginx configuration on laantungir.net
+# Copies contents of ./remote.nginx.config to /etc/nginx/conf.d/default.conf
+
+set -e
+
+echo "=== Updating Remote Nginx Configuration ==="
+echo "Server: laantungir.net"
+echo "User: ubuntu"
+echo "Local config: ./remote.nginx.config"
+echo "Remote config: /etc/nginx/conf.d/default.conf"
+echo
+
+# Check if local config exists
+if [[ ! -f "./remote.nginx.config" ]]; then
+    echo "ERROR: ./remote.nginx.config not found"
+    exit 1
+fi
+
+echo "Copying remote.nginx.config to laantungir.net:/etc/nginx/conf.d/default.conf..."
+
+# Copy the config file to the remote server (using user's home directory)
+scp ./remote.nginx.config ubuntu@laantungir.net:~/remote.nginx.config
+
+# Move to final location and backup old config
+ssh ubuntu@laantungir.net << 'EOF'
+    echo "Creating backup of current config..."
+    sudo cp /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.backup.$(date +%Y%m%d_%H%M%S)
+
+    echo "Installing new config..."
+    sudo cp ~/remote.nginx.config /etc/nginx/conf.d/default.conf
+
+    echo "Testing nginx configuration..."
+    if sudo nginx -t; then
+        echo "✅ Nginx config test passed"
+        echo "Reloading nginx..."
+        sudo nginx -s reload
+        echo "✅ Nginx reloaded successfully"
+    else
+        echo "❌ Nginx config test failed"
+        echo "Restoring backup..."
+        sudo cp /etc/nginx/conf.d/default.conf.backup.* /etc/nginx/conf.d/default.conf 2>/dev/null || true
+        exit 1
+    fi
+
+    echo "Cleaning up temporary file..."
+    rm ~/remote.nginx.config
+EOF
+
+echo
+echo "=== Update Complete ==="
+echo "The remote nginx configuration has been updated."