Installation

Requirements

You need:

A server you control.
Podman Compose, or Docker Compose.
A domain name and HTTPS in front of Bancwr. Sign-in only works over HTTPS, except on localhost.

Bancwr runs as two containers: the bunker and the dashboard (the frontend). Both are released together under one version.

Container images

The images are published to the GitHub Container Registry:

ghcr.io/diogel-io/bancwr-diogel-backend (the bunker)
ghcr.io/diogel-io/bancwr-diogel-frontend (the dashboard)

Use :latest for the newest release, or a version such as :0.1.0. Always run the same version for both images.

podman pull ghcr.io/diogel-io/bancwr-diogel-backend:0.1.0
podman pull ghcr.io/diogel-io/bancwr-diogel-frontend:0.1.0

Until Bancwr 0.1.0 is tagged, only trunk builds are published, as :edge. These are the latest merged code, not a reviewed release. Use :edge for both images until then.

See Updating for every tag and what it tracks.

Get the compose file

Copy compose.yaml and .env.example from the Bancwr repository into a directory on your server.

compose.yaml pins an exact version of both images. Change the two image: lines if you want another version.

Configure the environment

Create a .env file from the example:

cp .env.example .env

Then edit .env.

Required settings

Variable	What it is
`BUNKER_NSEC`	The bunker's own private key, as an `nsec`. Every connected app signs with it.
`BANCWR_ADMIN_PUBKEY`	Your own public key, as an `npub` or hex. It becomes the first administrator.
`BANCWR_PROXY_SECRET`	A shared secret between the dashboard and the bunker. At least 32 characters.
`NUXT_SESSION_PASSWORD`	A secret that seals the dashboard's sign-in cookie.
`NUXT_SITE_ORIGIN`	The `https://` address people open Bancwr on, such as `https://bancwr.example`.

Generate each secret with:

openssl rand -hex 32

Use a different value for BANCWR_PROXY_SECRET and NUXT_SESSION_PASSWORD.

A few rules:

BUNKER_NSEC should be a key made for the bunker. It can never sign in to the dashboard, so do not use your own key.
BANCWR_ADMIN_PUBKEY must not be the bunker's key. The bunker refuses to start if it is, or if the value is not a valid key. See First administrator and signing in.
NUXT_SITE_ORIGIN has no path and no trailing slash. It must match the address in the browser's address bar exactly, or sign-in is refused. Plain http:// is accepted only for localhost.

The bunker does not start without BUNKER_NSEC and BANCWR_PROXY_SECRET. Compose refuses to start without BANCWR_PROXY_SECRET, NUXT_SESSION_PASSWORD and NUXT_SITE_ORIGIN.

Optional settings

These change which relays and image server the dashboard uses for members' profiles. Leave them empty to use the defaults.

Variable	What it does	Default when empty
`NUXT_PUBLIC_PROFILE_RELAYS`	Relays used to read and publish members' profiles, besides each member's own relays. Comma-separated.	damus, nos.lol, primal
`NUXT_PUBLIC_INDEXER_RELAYS`	Indexer relays, used to find profiles and relay lists from across the network.	purplepag.es, profiles.nostr1.com, relay.nos.social
`NUXT_PUBLIC_BLOSSOM_SERVER`	The Blossom server profile images are uploaded to, when a member has none of their own.	blossom.primal.net

NIP-46 and the bunker's relays

Apps connect to the bunker over NIP-46. NIP-46 is on by default. To turn it off, set NIP46_ENABLED=false in .env.

Turning NIP-46 on connects no app by itself. An administrator still has to issue a connection token for each app. See Connecting apps.

Apps reach the bunker through its relays. After you first sign in, choose them on the Config page, under Bunker relays. You can pick from a search of known relays or add one by its address. Up to six are allowed, and at least two are advised. The bunker uses them straight away, without a restart.

To fix the relays in .env instead, set NIP46_RELAYS to a comma-separated list, such as wss://relay.nsec.app,wss://relay.damus.io. While it is set, it overrides the relays chosen on the Config page, and that list is shown read-only.

Earlier versions of this guide said to add NIP46_ENABLED and NIP46_RELAYS to the bunker service in compose.yaml yourself. compose.yaml now passes both, so you can remove those two lines.

Port and database

compose.yaml sets these itself:

The bunker listens on port 3000 inside the compose network. Its port is not published on the host; only the dashboard reaches it.
The bunker's database is /data/bancwr.db in the container, which is the ./data directory next to compose.yaml.
The dashboard is published on 127.0.0.1:3001 only.

Prepare the data directory

Both containers run as user ID 65532, not root. The bunker must be able to write to ./data. Before the first start, create the directory and hand it over.

With rootless Podman:

mkdir -p data
podman unshare chown -R 65532:65532 ./data

With Docker:

mkdir -p data
sudo chown -R 65532:65532 ./data

Put HTTPS in front

Sign-in needs HTTPS. The dashboard is published on 127.0.0.1:3001, so put a TLS reverse proxy in front of it.

With Caddy, which obtains and renews certificates itself:

bancwr.example {
    reverse_proxy 127.0.0.1:3001
}

On a local network without a public name, add tls internal to that block. Caddy then uses its own certificate authority, which each browser has to trust.

For testing on one machine, NUXT_SITE_ORIGIN=http://localhost:3001 works without TLS.

Start Bancwr

If you use Podman, make sure the Podman socket is running:

systemctl --user enable --now podman.socket

Start the containers:

podman compose up -d

Check it is running

Bunker health

The bunker checks itself. To run the check by hand:

podman exec bancwr-bunker bunker healthcheck

It exits without an error when the bunker answers. Compose also runs this check every 30 seconds. To see the result:

podman inspect --format='{{json .State.Health}}' $(podman compose ps -q bunker)

The images have no shell, so podman exec … sh does not work.

Versions

The dashboard reports its version at /api/version:

curl -s http://localhost:3001/api/version

The bunker's first log line also carries its version, such as Bancwr Diogel 0.1.0 starting....

In the dashboard

Open Bancwr at your NUXT_SITE_ORIGIN address and sign in with the key you set in BANCWR_ADMIN_PUBKEY.

The health indicator at the top of every page shows whether the bunker is healthy. The sidebar footer shows the bunker and dashboard versions. See Health, versions and logs.

What is Bancwr

First administrator and signing in