GP_GRIN1_RAIL now defaults OFF. Unset/off, GoblinPay behaves like the pre-rail
server: no arti/Tor code path runs, no loopback Foreign API listener, no
invoice slates issued, and the pay page shows ONLY 'Pay with Goblin' (no
switcher, no grin1 UI, footer unchanged) — even for an invoice armed while the
rail was on. Enabled, the two-rail switcher renders with the Goblin tab
default-selected; the switcher chrome appears only when BOTH rails are
available (a single rail renders its panel directly).
- config: default flip + docs; env example + README gain the opt-in block.
- checkout: build_info gates all grin1 UI on the flag; tests for both states
(off => no rail-tab/rail-radio/panel-grin/grin1 strings; on => switcher with
rail-goblin checked).
- sqlx 0.8 -> 0.9 (workspace): its libsqlite3-sys range (<0.38) unifies with
arti's rusqlite, resolving the one-links-per-native-lib conflict that
otherwise forbids sqlx-sqlite + in-process arti in one binary. Feature map:
runtime-tokio + sqlite (bundled, as before); dynamic COLUMNS queries wrapped
in sqlx::AssertSqlSafe (compile-time composed strings).
Production has run GP_NYM=off for over a day: GoblinPay already reaches its
relays over clearnet, which is the end state the ecosystem's Nym → Tor move
aims for. This removes the now-dead ported Nym client and its plumbing. Pure
subtraction — the code path that remains is exactly the one already running
live, so there is no behavior change beyond "GoblinPay still boots and still
moves money." Per TOR-MIGRATION-PLAN.md.
Removed:
- crates/gp-nostr/src/nym/ (mod, transport, nymproc, dns — 599 lines).
- smolmix + hickory-proto (and the nym-only rand) deps from gp-nostr, and
their transitive tree from Cargo.lock.
- GP_NYM config plumbing (gp-core config: field, parse, default, summary),
the opts.nym service branch, the main.rs warm-up wiring, and the admin
dashboard Nym row.
- The nym leg of the CI sibling-checkout gate (.github + .gitea), the
`COPY nym` / sibling mentions in Dockerfile/compose/install.sh, and the
GP_NYM copy in README, .env.example, and the three connector docs.
GoblinPay does not gain a Tor transport of its own: it is receive-only
infrastructure, and the sender privacy that matters rides the paying
customer's own Goblin Wallet. Content encryption (NIP-44 in a NIP-59
gift-wrap) and the slatepack (grin1) path are untouched. The optional
onion-dialing and relay-list trim the plan flags are left for the owner.
Multi-stage non-root Dockerfile (builds -p gp-server against the nip44/nym siblings; excludes the goblin-tree dev crate), a full docker-compose (server + bundled nostr-rs-relay + auto-HTTPS Caddy), a hardened systemd unit (DynamicUser, ProtectSystem=strict, NoNewPrivileges, seed via LoadCredential), an install.sh bare-metal bootstrap, .env.example, and an fmt+clippy+test CI workflow for Gitea and GitHub.
Make bundled mode actually self-contained: resolve() now leads the relay set with GP_BUNDLED_RELAY_URL (default ws://127.0.0.1:7777), which the checkout nprofile advertises, so a merchant needs no third-party relay. External mode uses only GP_RELAYS. Ship the relay as a vendored, unmodified nostr-rs-relay config (deploy/relay/nostr-rs-relay.toml); the compose service arrives with the deploy pipeline. Fix the stale "bundled is a later milestone" comment and reconcile the GP_NYM=off wording to a supported server-side-clearnet posture.
2ro