Add nostr-rs-relay service

Runs the relay on localhost:8880, proxied publicly via Caddy at
wss://relay.otherwhere.app. Allows event kinds 0, 3, 37515, 37518.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -45,6 +45,7 @@
           ./modules/services/firewall.nix
           ./modules/services/tailscale.nix
           ./modules/services/tor-bridge.nix
+          ./modules/services/nostr-rs-relay.nix
           ./modules/services/podman.nix
           ./modules/services/static-sites
           ./modules/users/tobias.nix

modules/services/caddy.nix

@@ -59,6 +59,10 @@ nmns.place, www.nmns.place {
 	file_server
 }
 
+relay.otherwhere.app {
+	reverse_proxy localhost:8880
+}
+
 import Caddyfile.d/*.caddyfile
 '';
 }

modules/services/nostr-rs-relay.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+let
+  config = pkgs.writeText "nostr-rs-relay-config.toml" ''
+    [info]
+    relay_url = "wss://relay.otherwhere.app/"
+    name = "Otherwhere Relay"
+    description = "Test Relay"
+    pubkey = ""
+    contact = "trl@posteo.net"
+
+    [database]
+    data_directory = "/var/lib/nostr-rs-relay"
+
+    [network]
+    address = "127.0.0.1"
+    port = 8880
+
+    [limits]
+    event_kind_allowlist = [0, 3, 37515, 37518]
+  '';
+in
+{
+  users.users.nostr-rs-relay = {
+    isSystemUser = true;
+    group = "nostr-rs-relay";
+    home = "/var/lib/nostr-rs-relay";
+  };
+  users.groups.nostr-rs-relay = {};
+
+  systemd.services.nostr-rs-relay = {
+    description = "Nostr relay";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "nostr-rs-relay";
+      Group = "nostr-rs-relay";
+      ExecStart = "${pkgs.nostr-rs-relay}/bin/nostr-rs-relay --config ${config}";
+      StateDirectory = "nostr-rs-relay";
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+  };
+}