The Sovereign Architecture Behind Jotstr
A deep dive into the open protocols, cryptographic event schemas, Blossom media pipelines, DNS routing mechanics, and zero-database edge SSR engine powering the platform.
Protocol & RFC Standards
| Standard | Platform Role | Implementation Details |
|---|---|---|
| NIP-23 | Long-Form Content | Parameterized replaceable event (kind:30023) with Markdown body & metadata tags. |
| BUD-01 / NIP-94 | Blossom Media Storage | SHA-256 content addressing with client signed authorization (kind:24242) headers. |
| NIP-78 | App Metadata & Theme | Portable theme settings & layout configurations stored directly on the author's public key. |
| NIP-05 / DNS | Identity & Custom Domains | DNS TXT record validation (_nostr) and human-readable internet handles. |
| NIP-07 / NIP-46 | Cryptographic Authentication | Browser extension signer bridge (window.nostr) and remote Bunker signing connections. |
| LUD-16 / NIP-57 | Direct Lightning Zaps | Instant peer-to-peer Bitcoin Lightning tipping directly to author's Lightning address. |
1. NIP-23 Long-Form Content Schema
Long-form articles are authored and syndicated as parameterized replaceable events (`kind:30023`). Each article is uniquely indexed by its author public key and the `d` tag identifier, enabling edits and updates without breaking permalinks or syndicate links.
{
"id": "e4a89f72c1d30023a1e2f4581290bb345718a90123efd6718290abc123456789",
"pubkey": "fa3b8172901bca981249871234123412341234123412341234123412341298c1",
"created_at": 1727196000,
"kind": 30023,
"tags": [
["d", "sovereign-publishing-era"],
["title", "The Era of Sovereign Publishing"],
["summary", "Why writing on open cryptographic relays changes independent publishing forever."],
["published_at", "1727196000"],
["t", "writing"],
["t", "nostr"],
["image", "https://media.emre.xyz/9f0a8172bc9102938475819230.webp"],
["client", "Jotstr", "31990:fa3b...98c1:jotstr"]
],
"content": "# The Era of Sovereign Publishing\n\nWords matter. When you write on an open protocol...",
"sig": "98124019283401928340192834019283401928340192834019283401928340192834019283401928340192834019283401928340192834019283401928340192"
}2. Blossom BUD-01 Media Storage & Verification
Photography, illustrations, and media assets are hosted across decentralized Blossom servers following the BUD-01 and NIP-94 standards. Every media upload requires a signed authorization event (`kind:24242`) and is referenced by its immutable SHA-256 hash.
kind:24242)
Authorization: Nostr {
"kind": 24242,
"created_at": 1727196000,
"tags": [
["t", "upload"],
["x", "9f0a8172bc9102938475819230..."],
["expiration", "1727196300"]
],
"content": "Upload cover image"
}3. Custom Domain & DNS Edge Resolution
Authors can bind custom domains (e.g. `blog.alice.com`) without deploying server infrastructure or managing SSL certificates. Jotstr resolves ownership via DNS TXT records (`_nostr`) matching the author’s public key or NIP-05 identifier.
4. Zero-Database Edge SSR Execution Engine
Jotstr executes on Cloudflare Workers global edge nodes. The server architecture maintains zero SQL or NoSQL central databases. On every incoming request, articles, author profiles, and themes are fetched concurrently from global Nostr relays, cached in edge memory, and rendered to HTML in under 50ms.
+-----------------------------------------------------------------------------+
| 1. HTTP Request (e.g. alice.jotstr.com or blog.alice.com) |
+-----------------------------------------------------------------------------+
│
▼
+-----------------------------------------------------------------------------+
| 2. Cloudflare Edge Worker SSR (No SQL Database) |
| - Hostname Resolver: extracts npub/NIP-05 or DNS TXT _nostr validation |
| - In-Memory Edge Cache check (TTL: 60s) |
+-----------------------------------------------------------------------------+
│
┌──────────────────┴──────────────────┐
▼ ▼
+------------------------------------+ +------------------------------------+
| 3. Concurrent Relay Fetch | | 4. Blossom Media Mirror |
| - kind:0 (Profile Metadata) | | - SHA-256 Verified CDN Assets |
| - kind:30023 (Articles List) | | - Automatic failover endpoints |
| - kind:78 (Theme Settings) | | |
+------------------------------------+ +------------------------------------+
│ │
└──────────────────┬──────────────────┘
│
▼
+-----------------------------------------------------------------------------+
| 5. Stream HTML Response to Client (< 50ms TTFB worldwide) |
+-----------------------------------------------------------------------------+5. Cryptographic Identity & Authentication
Authentication is fully client-side and sovereign. Jotstr supports browser extensions (NIP-07), remote signers/bunkers (NIP-46), and encrypted local key storage (nsec). Private keys are never transmitted to or stored on server infrastructure.
Browser-based key store (Alby, nos2x) manages private keys. Jotstr requests cryptographic signatures via window.nostr.
Sign from mobile devices (Amber, nsecBunker) over encrypted Nostr relays with fine-grained authorization policies.
Local private keys (nsec) remain strictly in browser sessionStorage. Zero key material is sent to servers.
Build on open protocols
Jotstr is fully open source. Inspect the code, contribute, or host your own relay cluster.