DhananjayPurohit
Dhananjay Purohit

Public Key

npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h

NIP-05 Address

Profile Code

nprofile1qqsqfh90y4fgqxfh68pqk6ddlztydusm20qhjp38r53v005metdedsqpp4mhxue69uhkummn9ekx7mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu0m9g8x

Publishing to

Author Public Key

npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h

Show more details

Last Notes

2026-08-19 16:36:26 UTC

- reply

Good point, and the frame is right.
One wrinkle on a literal price caveat: pricing here can be dynamic via Redis, so an amount baked into the macaroon means any price change invalidates every outstanding token. That hurts most in realms, since realm mode requires indefinite access and those tokens are lifetime credentials. Your tier id version avoids that, so tiers rather than amounts if it gets built.
Going with the boot check first though. No new caveat, no migration for tokens already out there, and it fails at boot rather than at the till.
Did you hit the price change case, or were yours static?

2026-08-18 18:18:44 UTC

- reply

Explicit route set, not prefix. Each location is tagged with l402_realm "name", so membership is opt in and a new route under the same tree doesn't silently join.
Your instinct still lands though, it just moves: nothing enforces uniform pricing inside a realm, so two locations sharing a name at different prices means the cheap token opens the dear route. That's documented, but documentation isn't a guard. Filing it, likely as a startup warning rather than a hard reject, since nginx merges each location independently and a reject would break anyone already running mixed prices.
On bearer tokens, the preimage is single use by default, claimed atomically with SET NX EX, so that's the spend counter. Realm mode requires l402_indefinite_access which turns that off by design, and there your point is exact: ExpiresAt is the only bound.
The idempotency hit is fair and unanswered today. Pay, lose the response, retry, preimage already claimed, 401 having paid for nothing. Filing it as a discussion rather than a task though, because a retry window is a replay window: anyone positioned to observe the preimage gets the same grace. Curious how you scoped the request id, is it bound to the payer or just to the request?

2026-08-18 17:50:00 UTC

- reply

Thanks! Small correction that actually helps your economics point: it's 10 sats per pull, not per layer. The macaroon is realm-scoped (blossom-read), so one payment covers the manifest, config and every layer for a ~10 min window. Scraping still costs 10 sats per fresh image, which is your point.
On expiry: the invoice gets paid up front in a couple of seconds, before any layer download starts, so a slow layer never races it. After that, each blob request is authorized by the macaroon (checked at request start), so an in-flight download isn't cut mid-stream.
The one edge case is a whole pull running past the window. The next layer just gets a fresh 402 and payblob pays again and continues, so worst case is a second settlement on a very large pull, not a failure. The window is configurable, so you size it to cover a normal image comfortably

2026-08-18 17:41:54 UTC

- reply

Within one pull: one payment covers the whole image. The paywall issues a realm-scoped macaroon (realm blossom-read, ~10 min, reusable), so payblob pays the first 402, caches the token in memory, and reuses it for the manifest, config and every layer. One settlement, not one per blob.
Across separate pulls (two CI runs, or the same digest twice) it re-pays today: the token isn't persisted to disk yet, so each process starts cold.
The server already supports what you want though. The macaroon is realm-scoped and valid for the whole window, so persisting it (plus a local sha256 cache) makes a repeat pull settle once, or zero if the blobs are already cached. That's the next step.

2026-08-18 12:29:09 UTC

I built payblob — a client that pays to pull container images.
The image is a signed Nostr event, its layers sit on Blossom behind a Lightning paywall. payblob settles the L402 invoice and pulls it — 10 sats, non-custodial, over Nostr.
Why? GitHub's bots flagged my repo twice and took it offline — images and all. So I moved images where nobody can flag them, and made them pay for their own hosting.
Built on @nprofile…awaw ncontainer + noci — he shipped that base in a weekend. I added the payments.
Video 👇 — and poke at the live server yourself (free upload, 10 sats to download):
https://blossom.ngx-l402.org
payblob: https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/payblob
paywalled blossom server:
https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/ngx-l402/tree/main/examples/paywalled-blossom
ncontainer: https://ncontainer.io
noci: https://gitworkshop.dev/[email protected]/git.shakespeare.diy/noci
#nostr #bitcoin #lightning #L402
https://blossom.primal.net/d5fa761098205eabb9e6a527a345f012bb1785f9579bba781ca9674ddf3740fc.mp4

2026-08-17 01:43:03 UTC

- reply

Caveats are the interesting bit, yeah. The macaroon carries four: RequestPath = /exact, Realm = name, RequestMethod = GET, ExpiresAt = <unix>. Method is always bound, otherwise a token bought for GET /x replays against POST /x, which is usually a different resource and often a different price.
Path is the default, metered per route. If you want one payment to cover a group of routes you set l402_realm and it binds to the realm instead of the exact path. There's a config-time guard on that one: realm without l402_indefinite_access refuses to start, because a realm token carries a single preimage across many paths, the first request claims it, the replay check kills everything after, and you've sold exactly one request without noticing. Time-bound is l402_macaroon_timeout → ExpiresAt, or indefinite access if you want subscription semantics.
On pricing, l402_amount_msat_default is per-location rather than global, so route granularity is just nginx config. Beyond that there's Redis-backed dynamic pricing: a per-path price key plus an lnurl:<path> override, both fetched in one pipelined round-trip, so you change a price with a single SET and it applies on the next request with no reload. That LNURL override is what makes multi-tenant work, different routes settling to different wallets.
Backends are direct, no intermediary. LND over gRPC (LNC if the node's remote, SOCKS5 for .onion-only), CLN over its unix socket, Eclair over HTTP, plus LNURL, NWC and BOLT12. No LNbits or facilitator in the path, which is most of the point. Anything in between is something that can freeze you or be leaned on.
There's a Cashu path too if you want payer privacy or a single round trip instead of 402 → pay → retry.
Binding logic is in l402_middleware/src/caveats.rs (https://github.com/DhananjayPurohit/l402_middleware/blob/main/src/caveats.rs) if you want to read it directly.

2026-08-16 19:00:29 UTC

- reply

OCI over nostr 😊

2026-08-16 18:59:45 UTC

- reply

Loved this 🥰
I wrote the spec a month ago:-
https://primal.net/e/nevent1qqspmysu52c8lf9ru36v45m2qvsywftzewl6ag4tk7spmey4f4qzehcyc05px

2026-07-23 10:07:21 UTC

- reply

ngit:- https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/ngx-l402

2026-07-23 10:03:34 UTC

ngx-l402 — an nginx module that puts a Lightning paywall (L402) in front of
any HTTP API.
Two directives:
l402 on;
l402_amount_msat_default 1000;
A request without payment gets a 402 with a macaroon + BOLT-11 invoice. Pay,
retry with the preimage, get your 200.
Non-custodial by design: sats settle straight to your own node or Lightning
address. No account, no intermediary, nothing routed through us.
Lightning backends: LND, CLN, Eclair, LNURL, NWC, BOLT12, LNC.
Cashu eCash works too — the client sends a token in the X-Cashu header
instead of paying an invoice. Proofs verify offline via NUT-12 DLEQ, so
there's no round-trip to the mint on the request path. Bearer, unlinkable,
and skipping the invoice round-trip makes it the fastest path of the lot.
It also publishes a capability manifest at /.well-known/l402-services, so
agents can discover your routes and prices and pay — no API key, no signup.
Live demo, 1 sat and learn more at: https://ngx-l402.org
Code (MIT): https://github.com/ngx-l402/ngx-l402
The repo is mirrored on Nostr via ngit (gitworkshop.dev) and release
binaries are on Blossom. GitHub flagged the org twice, so the project is
built to survive being deplatformed.
repo on ngit:- https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/ngx-l402
Release on blossom: https://nostr.download/03b6473139813e3c06361da15803a61e4c9f86111413a2467227825ed72b093d.gz
#bitcoin #lightning #l402

2026-07-22 14:20:49 UTC

🐋 Back in 2021 I did my Google Summer of Code with Orcasound — an open-source project running a cooperative network of hydrophones (underwater mics) off the Pacific Northwest coast. Anyone can put on headphones and listen live for endangered orcas, helping scientists detect and protect them. Open-source software + hardware + a distributed community of listeners.
My contribution there wrapped a while back, but they haven't forgotten me — a kind surprise recently landed in the mail. 👕📦
Grateful to have played a small part in helping orcas be heard.
#OpenSource #ListenForWhales #Orcasound
https://blossom.primal.net/446408ae0561c76d5eeb4086f95211f674296267aa84baf9c0d4870b18fd41d8.jpg

2026-07-15 18:25:54 UTC

GitHub trying to sabotage solid open source projects.
#BTCBreakdown
https://blossom.primal.net/3832e8a15e44b5bde1d957824d2c9e77f1eadd04f55b3138695c7f5b5a2164a3.jpg

2026-07-14 15:43:40 UTC

Censorship doesn't erase anything. It just moves it somewhere they can't reach.
https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/oci-over-nostr
https://blossom.primal.net/d8b5b577f8fc8e1222bf3a47b4be80d47c181b265e425dfe41e9f7b01bf00eb3.jpg

2026-07-09 19:22:23 UTC

git clone does NOT include your issues and PRs.
git made code portable. Your community's bug reports, reviews, and discussions live in GitHub's database — on GitHub's terms.
When a bot flagged our org, the issues API returned [] to me, the owner. 17 open issues & PRs, frozen. Day 6, no human.
Back yours up today or make it un-confiscatable by migrating to ngit.
Your code has infinite copies. Your community's work has zero.

2026-07-08 19:23:22 UTC

What GitHub is doing to open-source maintainers is unethical — and our project is this week's proof.
Issues and PRs are community property. Contributors wrote those bug reports, reviews, and discussions — and one unreviewed algorithm decision made all of it inaccessible even through API, indefinitely. For an active project, that's not moderation; that's silently strangling development.
Here's what happened to us. ngx-l402 — an MIT-licensed nginx module for Lightning L402 API paywalls, self-hosted, non-custodial, 53 stars, 21 releases, active contributors — was auto-flagged five days ago. No human has reviewed it. Since then:
- The repo is hidden from every user on earth
- 17 open issues & PRs frozen — the API returns an empty list to the project owner
- Repository transfers blocked — my own code, and I cannot move it
- Docs, CI, container images — dark
A Lightning project, flagged for publishing software, on the platform that markets itself as the home of open source. Draw your own conclusions.
We drew ours. Everything now lives where no algorithm can take it:
📂 Code — Nostr/ngit: https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/ngx-l402
📦 Release — Blossom, hash-verifiable: https://nostr.download/03b6473139813e3c06361da15803a61e4c9f86111413a2467227825ed72b093d.gz
🔜 Website — nsite, next
Your project is one false positive away from this. Mirror it somewhere sovereign today.
#nostr #bitcoin #lightning #opensource #ngit #githubsucks
https://blossom.primal.net/ef189b6d65d6ddbb422ff5d82ab83d91c5f3582429b75146941731e1971a4f96.jpg

2026-07-07 19:43:19 UTC

- reply

Yes. The more GRASP servers, the healthier the ecosystem 😄

2026-07-07 19:41:46 UTC

- reply

Yes 😄 The more GRASP servers, the healthier the ecosystem.

2026-07-07 18:17:53 UTC

- reply

Yes they intentionally round it off badly.

2026-07-07 18:15:10 UTC

Github sucks.
ngit is what open-source deserves 🫶🏻
https://blossom.primal.net/1c829331b1010a98cdb0978402fc3d47d19ba8931be28595096adc14f152bae2.jpg

2026-07-06 16:09:32 UTC

Every `docker pull` on earth asks a central company for permission. We need a decentralized container registry.

2026-07-05 12:27:41 UTC

- reply

nice hallucination 🤖 — ngx-l402 is non-custodial, there's no treasury 😄

2026-07-05 09:14:19 UTC

GitHub flagged our org (ngx-l402) and hid it from the public — almost certainly a false positive. We've appealed. We moved to rails no one can deplatform.
📂 Source now on Nostr via ngit:
https://gitworkshop.dev/npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6h/relay.ngit.dev/ngx-l402
📦 Release v1.2.7 (nginx 1.28.0, linux/x86_64), on Blossom — content-addressed and verifiable:
https://nostr.download/03b6473139813e3c06361da15803a61e4c9f86111413a2467227825ed72b093d.gz
ngx-l402 is an open-source nginx module that puts a Lightning (L402) paywall in front of any HTTP API — non-custodial, self-hosted. Fitting that it now lives on rails no one can take down.
#nostr #bitcoin #lightning #ngit #L402

2026-03-22 18:34:30 UTC

Introducing Paygress: Permissionless Cloud Compute ⚡
Spinning up a VM today usually means:
hand over your ID, add a credit card, and trust some company that logs everything
Paygress flips that.
A decentralized compute marketplace built on Nostr + Cashu.
No accounts. No KYC.
How it works:
→ Providers advertise compute on Nostr relays
→ You discover and request a VM — all communication flows through Nostr
→ Cashu tokens settle instantly, carry zero identity
→ No central server sits in between
Have a Linux box collecting dust? One command turns it into a provider LXC or Proxmox backend. Workloads are isolated. Expired ones get cleaned up automatically.
Everything happens over Nostr
Paygress can be used to run:
- Nostr relays
- CI pipeline
- OpenClaw
- anything you’d normally throw on a VM.
Permissionless infrastructure for a permissionless internet.
Check it out here: https://paygress.net
Github → https://github.com/DhananjayPurohit/paygress
CLI → https://lib.rs/crates/paygress-cli
https://blossom.primal.net/a6f3041e7064154552ce7d98a1866406ad0b5b8fd46e249faf6851532fa51ef0.mp4

2026-03-22 18:28:56 UTC

2026-02-17 20:14:05 UTC

ngx_l402 v1.2.3 — Stronger rails, smarter routing ⚡
Improved Cashu handling to prevent unintended LNURL routing in multi-tenant mode (@iamthesvn) and native support for Eclair nodes (@DhananjayPurohit).
Also included: dynamic Cashu mint parameter discovery (NUT-05, NUT-08) (@iamthesvn) and Redis-backed replay protection to prevent double-spend/replay attacks (@DhananjayPurohit).
Better multi-tenant reliability, broader node compatibility, and stronger Cashu security—steady progress toward production-ready Lightning infrastructure. 🚀
https://github.com/DhananjayPurohit/ngx_l402/releases/tag/v1.2.3

2026-02-17 14:52:50 UTC

- reply

- https://402.markets marketplace for APIs powered by cashu and lightning

2026-02-07 06:12:23 UTC

- reply

Coming soon paygress.net

2026-01-23 13:38:39 UTC

ngx_l402 v1.2.1 — New updates landed ⚡
Multi-tenant Redis support for LNURL across API routes (@nprofile…5xpd), and Lightning Node Connect (LNC) support for LND (@nprofile…9g8x).
Smoother multi-tenant setups and easier, more secure LND connectivity—steady progress toward flexible, production-ready Lightning integrations. 🚀
https://github.com/DhananjayPurohit/ngx_l402/releases/tag/v1.2.1

2025-12-13 10:27:19 UTC

- reply

npub1gl0yeke7735y3lkcpcnhsu66kn56cja4psj8mq3sthf5n06guj7qsgxn9u

2025-12-13 10:27:00 UTC

- reply

npub1tluqksht0ndvy3uw6mdldhq50we5uma4gzyg8hgnn4725c3x3snskkayx2

2025-12-13 09:58:46 UTC

🚀 ngx_l402 release v1.2.0
https://github.com/DhananjayPurohit/ngx_l402/releases/tag/v1.2.0
New updates landed: multi-LNURL support across API routes (@ritik), BOLT12 Lightning Offers for generating static BOLT11 invoices per request (@iamthesvn), and Tor/SOCKS5 proxy support for connecting to .onion LND nodes (@dhananjaypurohit).
Steady progress toward more private, flexible Lightning integrations.

2025-11-26 16:52:18 UTC

🚀 ngx_l402 release v1.1.3
https://github.com/DhananjayPurohit/ngx_l402/releases/tag/v1.1.3
A massive shout-out to @nprofile…5xpd for powering most of the improvements in this release — from feature upgrades to CI/CD enhancements. Incredible work! 👏🔥

2025-11-11 09:54:05 UTC

- reply

Can’t wait to experience this feature on 402.markets !

2025-11-11 09:51:38 UTC

- reply

Exactly right 👍

2025-11-11 09:47:07 UTC

- reply

Contributions are always welcome!
👉 https://github.com/DhananjayPurohit/ngx_l402
You can also build and list your own API on 402.markets:
👉 https://402.markets/

2025-11-06 10:05:56 UTC

Delivered a talk on L402 at the BOSS Summit! Huge thanks to @nprofile…2cgl. The future of web payments is here.
https://github.com/DhananjayPurohit/ngx_l402
#L402 #BOSSSummit #LightningNetwork
https://blossom.primal.net/d94ef49323fd0025390a191f59848c6aece8e7752d87eae93d8fb177ea10ca11.jpg
https://blossom.primal.net/7de8d57eae89d57efa9805bfeece2e0691279f1e33ad8d6c804806eb59bd0507.jpg

2025-11-01 12:44:34 UTC

- reply

Sure. Thanks. 🤟🏻

2025-10-30 14:51:53 UTC

- reply

Friends don't kyc friends 🥹
Thanks @nprofile…4e6p and @nprofile…2cgl for the bitcoin movie night.
@nprofile…nuzl #bitcoinfilmfest #bossindia
https://blossom.primal.net/162fe6013fba3aa69702ba1277c43cd9b0a2564e0ec89c6cbc59d526a28eb5c5.jpg

2025-10-30 14:39:02 UTC

🤟🏻
#bitcoinfilmfest #bossindia
https://blossom.primal.net/ab8ed8b32d9d4ec3ac02a47048bc5c7756dc3d0c5af4577b9f69aa8bf07cc267.jpg

2025-10-27 23:28:56 UTC

- reply

Proudly built with ngx_l402 🛠️ and the power of Cashu 🥜, Lightning ⚡, and HTTP 402. The future of markets is here.
https://github.com/DhananjayPurohit/ngx_l402
#nevent1q…h6uq

2025-10-27 23:19:55 UTC

- reply

@nprofile…xg2f Its working fine with both minibits and phoenix wallet now. Thanks for testing it out.

2025-10-24 16:45:33 UTC

- reply

Thanks for using it and pointing that out! You’re right — the transport field is missing, and I’ll fix that. I’m planning to add "t" as an empty array for now, since L402 currently uses an implicit transport method via X-Cashu headers. However, I’m open to discussing whether we should introduce explicit transport methods (like Nostr or HTTP POST) for receiving eCash, though that might add unnecessary complexity to the otherwise simple L402 protocol.

2025-09-22 12:11:38 UTC

A rainbow arcs gracefully over Funchal, Madeira 🌈
https://blossom.primal.net/a3669cc83282c01be23ce59fc0c1f29120d71527c8f3dd1a73a202ec9f23b99f.jpg