nullwire-node

Run a NullWire relay — add a strand to a network built for censorship resistance and metadata privacy.

NullWire is a post-quantum, end-to-end-encrypted messenger whose traffic is onion-routed through a mixnet. A message is bounced through several relays — and once those relays are run by different people in different places, no single party can see who is talking to whom. The network's anonymity is only as strong as the number of independent people running relays. Today the mesh is small and run by one operator, so that anonymity is still aspirational — that's where you come in.

A relay is a stateless onion forwarder: it never sees message content (end-to-end encrypted), never holds anyone's keys, and never learns the end-to-end who-talks-to-whom. It peels one layer of encryption and passes the packet on — much like running a Tor relay.

Install (one command)

On a fresh Linux VPS (a $4–6/mo box with a public IP is plenty), as root:

curl -fsSL https://raw.githubusercontent.com/yunomiwell/nullwire-node/main/install-nullwire-node.sh | sudo bash

Prefer to read first? The installer is a single short script in this repo — read it, then run it. It downloads the (checksum-verified) relay binary, generates your node identity, writes a hardened systemd service, and prints your next two steps.

Two steps the installer prints for you

1. Register on-chain (announces your node so others can route through it — on Solana devnet today, so the tx fee is devnet SOL, free from a faucet).
2. Get admitted — send us your node_id + endpoint and we approve it (anti-spam). Then:

   sudo systemctl start nullwire-relay && journalctl -u nullwire-relay -f

   You'll watch it start forwarding packets. You're now part of the mesh.

What it does / doesn't expose

Never sees	message content, the end-to-end who's-talking-to-whom, or anyone's keys — it sees only its previous and next hop, plus onion-wrapped packets it cannot open
Does	carry mixnet traffic on your IP (like a Tor relay); talk to peers over plain HTTP for now — packets are already onion-encrypted end-to-end, and per-node mesh-TLS is built but not yet live
Wants	a stable public IP + steady uptime (a relay that flaps hurts routing)

Requirements

• Linux VPS, public IP, 1 vCPU / 1 GB RAM, one open inbound TCP port (default 9201).
• ~5 minutes.

Verify before you trust

Every release ships SHA256SUMS covering both binaries; the installer verifies the relay and the CLI and fails closed on any mismatch — or if SHA256SUMS is missing entirely. The installer is open — read exactly what it runs before you run it.

The relay source is open too (MIT): https://github.com/yunomiwell/nullwire-mesh — the same source these binaries are built from. Builds are byte-for-byte reproducible with the pinned toolchain: RELAY_BUILD_ATTESTATION.txt lists the expected SHA256s (x86_64 and aarch64) and REPRODUCIBLE_BUILDS.md the exact command. Rebuild and compare — no backdoor can hide at the build step.

Why this matters (the honest version)

NullWire the app is already private — post-quantum E2E encryption, the server never reads your messages. But anonymity — hiding who talks to whom — is a property of the network: it exists only when relays are run by enough genuinely independent operators that no one can watch the whole path. If you run a relay, you're not "helping a company" — you're adding a strand that, with enough others like it, no single party (including us) can unpick.

---

Want to run a gateway (carries mailbox state, needs a bit more setup + trust)? Open an issue and we'll onboard you directly. Questions: relay@nullwire.xyz.

MIT licensed. Post-quantum (ML-KEM-1024 + X25519). No token, no ads, no tracking.