A minimal, self-hosted NIP-46 remote signing server for Nostr.

One dependency. One binary. One SQLite file.

You want to use your Nostr identity across multiple devices (phone, laptop, tablet) without copying your nsec everywhere. MicroBunker holds your key securely on a server and signs events on behalf of connected clients using the NIP-46 protocol.

• NIP-46 compliant — works with any client that supports bunker:// URIs (Primal, Amethyst, Coracle, etc.)
• Encrypted at rest — keys stored with AES-256-GCM, derived from passphrase via scrypt
• Rotatable encryption — change your passphrase without losing keys
• Multi-key — manage multiple Nostr identities from one bunker
• Device management — connect/revoke devices, see activity
• Web dashboard — minimal UI for status and device management
• 1 dependency — just nostr-tools. Everything else is Bun built-ins.

• Bun v1.1+

# Install
git clone https://github.com/opencollective/microbunker.git
cd microbunker
bun install

# Initialize (generates bunker keypair, stores your nsec encrypted)
export BUNKER_PASSPHRASE="your-secret-passphrase"
bun run src/index.ts init

# Start the daemon
bun run src/index.ts start

# Generate a connection URI for your Nostr client
bun run src/index.ts connect
# → bunker://abc123...?relay=wss://relay.nsec.app&secret=xyz789...
# Paste this into Primal, Amethyst, etc.

• --data-dir <path> — Custom data directory (default: ~/.microbunker)

• BUNKER_PASSPHRASE — Required. Used to encrypt/decrypt keys at rest.

┌─────────────────────────────────────────────┐
│  MicroBunker                                │
│                                             │
│  ┌─────────────────┐  ┌──────────────────┐  │
│  │  NIP-46 Daemon  │  │  Web Dashboard   │  │
│  │  (relay listener)│  │  (Bun.serve)     │  │
│  └────────┬────────┘  └──────────────────┘  │
│           │                                  │
│  ┌────────▼────────────────────────────────┐│
│  │  SQLite (bun:sqlite)                    ││
│  │  • keys (encrypted nsecs)               ││
│  │  • devices (connected clients)          ││
│  │  • connection_tokens                    ││
│  │  • bunker_identity                      ││
│  └─────────────────────────────────────────┘│
└─────────────────────────────────────────────┘

1. Your bunker listens on Nostr relays for kind:24133 events addressed to it
2. When a client (e.g., Primal) wants to sign as you, it sends an encrypted request
3. The bunker decrypts the request, signs the event with your key, and sends back the signed event
4. The client publishes the signed event — it looks like it came from you

• Keys are encrypted at rest using AES-256-GCM
• The encryption key is derived from your passphrase using scrypt (N=16384, r=8, p=1)
• Each key has a unique salt and IV
• Format: version:salt:iv:ciphertext:tag
• Use rotate-key to re-encrypt everything with a new passphrase

Stored in ~/.microbunker/config.json:

{
  "relays": ["wss://relay.nsec.app", "wss://relay.damus.io"],
  "port": 7547,
  "host": "127.0.0.1",
  "dashboardToken": "your-dashboard-access-token",
  "tokenExpiryMinutes": 15,
  "logLevel": "info"
}

[Unit]
Description=MicroBunker NIP-46 Server
After=network.target

[Service]
Type=simple
User=microbunker
Environment=BUNKER_PASSPHRASE=your-passphrase
ExecStart=/usr/local/bin/bun /opt/microbunker/src/index.ts start
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

The dashboard runs on 127.0.0.1:7547 by default. Put nginx/caddy in front if you want HTTPS access.

server {
    server_name bunker.yourdomain.com;
    location / {
        proxy_pass http://127.0.0.1:7547;
    }
}

• Custodial: This bunker holds your private key. The passphrase protects it at rest.
• Network: The dashboard should be behind a reverse proxy or accessed only over a trusted network.
• Tokens: Connection tokens are single-use and expire (default: 15 minutes).
• Revocation: Revoked devices are immediately rejected for all subsequent requests.

• connect — Establish a new session
• get_public_key — Return the user's public key
• sign_event — Sign an event
• nip04_encrypt / nip04_decrypt — NIP-04 encryption/decryption
• nip44_encrypt / nip44_decrypt — NIP-44 encryption/decryption
• ping — Health check

MIT