Omostrich 0.3: log in to Nostr apps by QR code

Omostrich keeps your Nostr key on your own computer. It holds the key encrypted, unlocks from the Omarchy bar, posts notes, and signs for other Nostr apps over NIP-46 (remote signing) so those apps never see your key. Version 0.3.0 makes that last part much easier: you can now connect a phone app by scanning a QR code instead of copying long connection strings around.

What’s new

Show a QR code, scan it from your phone. Under Remote signing there’s a new QR button next to Copy. It shows your bunker:// connection string as a QR code, which a phone app such as Amethyst can scan to log in with a remote signer. The string is public (your public key and your NIP-46 relays, no secret), and the app’s connect request still shows up in Omostrich for you to approve, like any other.

Connect apps that show their own QR code. Some apps go the other way and display a nostrconnect:// code. Scan QR reads it with your laptop camera, or Paste code takes a copied string. Omostrich checks the code, answers the app on the relays it names, and adds it to Authorized apps under its own name. After that it keeps listening for that app after every unlock until you revoke it.

The camera is handled carefully. Frames go straight to the decoder and are never saved, and the camera turns off as soon as a code is read, when you cancel or close the preview, or after two minutes. Laptop webcams are fixed-focus and these codes are dense, so hold the code inside the guide box about 25 to 35 cm away. Even then, reading a phone’s code with a laptop camera can be unreliable, so the bunker QR is the dependable direction.

Approve all or deny all. Right after you log in, Amethyst signs a burst of events at once. When several requests are waiting, you can now settle every one on screen in one click, each just this once. Anything that arrives after you click still waits for its own answer.

Smaller fixes

• Always allow no longer overwrites an app’s saved relays or name.
• A request delivered twice is handled only once.
• daemon.log now records each request’s method (such as sign_event) and whether the reply worked, never the content of the request or the reply.
• The About page’s privacy statement now covers camera use, the relays a scanned app names, and the new log details.

Also new since 0.2

Omostrich 0.2.1 added an optional listener on your Tailscale address so your own devices can reach the signer with a token, and NIP-46 requests are now heard on every bunker relay, not just your posting relays.

Get it

The QR features need three extra packages. Everything else works without them:

sudo pacman -S qrencode ffmpeg zbar

To update an existing install:

cd ~/Projects/omostrich
git pull
npm ci
./install-daemon.sh
./install-plugin.sh
systemctl --user restart omostrich

The restart matters, because the running signer keeps the old code until it’s restarted. More about Omostrich is at omostrich.com.