Buy, sell, and run a relay.

First steps in the app

Lightning Stream never holds your money. It pays from your node, within spending rules you sign, and only after you confirm that it may pay with real money.

1. Make your approval key and keep its backup file. The backup file is not your passphrase: keep both.
2. Settings → Spending rules → start from the safe starter rules, review, and sign. They allow 2,000 sat a payment, 10,000 a day and 30,000 a week, cap what any one shop is paid, and ask you above 1,000.
3. Settings → Your node → tick Pay with real money and press Start paying.
4. Services → Sellers → add a shop. A shop can be added by its key alone: it needs no web address. Press Allow this seller to be paid, and sign.

Your node needs a funded channel with a route to the shop first: 20,000 to 50,000 sat is plenty to try things out. Any well-connected XBT Lightning node works. One option is Lightning Stream Genesis, the demo shop's own node: a channel to it lets you try buying straight away. It is reachable over Tor, so your node needs Tor:

More in Get a channel.

Buying

A shop is never paid more than the price its listing shows, and a file never past its listed size. Shops publish signed listings on Nostr; the app reads them from four relays by default, and the prices are the shops' own: the app shows the current one before it pays. The shops page shows what is listed now.

A web app

On Browse, open a shop's web app, for example a Jellyfin with films. It opens inside the app, with an account made for you, under a limit you set for the visit; the page shows what has been spent, and Stop ends it.

Files

Under Files on Browse, each file shows its size and price. Download it, or Open in your player to get a link for VLC, mpv or a TV app; a player that seeks pays only for what it reads.

AI

Services → AI gives your box an OpenAI-compatible address on your network. See AI for your programs.

Hashrate

Services → Hashrate rents a seller's miners into your own Stream Gateway. See Hashrate.

A VPN exit

Services → VPN: add a device and choose its rules. See VPN exits.

The demo shop: Lightning Stream Genesis

A shop to try the app with: a Jellyfin web app with Creative Commons films at 20 sat per MiB, Files at 1,000 sat per GB, and a small AI model at 10 sat per 1,000 tokens of its answers. The app offers it in one click; you can also find it by name under Browse → Found on Nostr, or paste its shop key under Sellers:

It is a shop in the app, not a web page to open in a browser. Its prices can change; the app shows the current one before it pays.

Selling

On the Sell page, first say how buyers reach you. Directly, through the app is recommended: buyers reach your shop by its key over an encrypted link, with no domain, certificate or port forward, and where the two boxes cannot connect directly a relay carries the traffic without seeing it. Tick Private to always go through a relay, so buyers never learn your box's address. You can use your own https address instead. Then add a service and set its price; your shop is listed on Nostr as soon as it has one.

A web app

Pick Media server for Jellyfin or Plex, or Web service or API for anything else, give its address on your network, and tick Buyers can open its own web page inside their app. For Jellyfin, make a guest user for buyers, limited to the libraries you sell; never an owner or admin account. Video is priced per MiB (20 sat is suggested) and the rest of the app per request. For 4K, turn on hardware transcoding and tone mapping in Jellyfin: a 2 to 4 core box cannot convert 4K as it plays.

Files

Pick Files; there is no address to type. Choose the folder: on Umbrel, all of Downloads or a folder in it (put files there with Umbrel's Files app); on StartOS, a folder of File Browser's files, chosen with the package's Files folder action; on Linux, any folder you point the app at. Stream only reads the folder and never changes a file. Press Update the file list after adding files. 1,000 sat per GB is suggested.

An AI model

Pick AI model and give the address of an OpenAI-compatible model server on your box. It is priced per 1,000 tokens of its answers (10 sat is suggested).

Hashrate

On Sell → Hashrate, tick Rent out my miners. See Hashrate.

A VPN exit

On Sell → VPN exit, read the warning, then offer your internet connection as an exit. See VPN exits.

How many at once. A shop takes 100 sessions and 512 connections by default. Under a service, How many buyers at once sets how many it serves together; a buyer turned away is told so before paying. For Jellyfin on a small box, 5 buyers and 3 streams is a good start.

Your keys on StartOS. Selling needs the shop's own keys, made in Lightning Fork's dashboard (the Sell page lists the permissions) and pasted there. A shop reached directly through the app also asks for a link signing key (message:write only), so your node vouches for your shop's link.

AI for your programs

Lightning Stream gives programs on your own network an address that works like OpenAI's API. Open WebUI, coding agents and your own scripts use AI models from the sellers you allowed through it, and each answer is paid by the token as it arrives.

1. Add an AI seller on Services → Sellers, press Allow this seller to be paid, and sign the change.
2. Services → AI shows your AI address, such as http://umbrel.local:33540/v1, and the AI sellers on your list.
3. Make a key for each program, with a limit in sats. The key is shown once: copy it into the program now. Each key can be revoked.
4. In the program's settings, put the address where it asks for the OpenAI base URL, and the key where it asks for the API key.

It picks the cheapest seller that answers and moves on if one fails before answering. On Linux the address is on 127.0.0.1 unless you open it to your LAN. The details are in INFERENCE.md.

Hashrate

The two sides are named after the direction of the hash: the hashmaker brings the miners and publishes a signed listing; the hashtaker takes a listing and points the work at its own gateway. (Names from Kilombino.)

Renting miners (hashtaker)

1. Services → Hashrate. Under Your gateway, choose solo and your XBT payout address (the default), or Lazarus Pool. Check that it says Ready to rent: the Stream Gateway answers and its jobs are masked.
2. Miners for rent lists the offers hashmakers publish on Nostr. For a hashmaker you haven't paid before, press Allow this hashmaker to be paid and sign.
3. Choose the machines, how long, and the most the rental may cost, then press Rent. You can buy a short paid test slice first.

The gateway masks every job, so a rented miner can't tell which share is a block and can't withhold one, and the app pays nothing until it has seen the first job masked. Work is counted only from shares your gateway accepts, weighted by difficulty. You never have more paid for and not yet received than a minute of the miner's hashing, or one share, one slice and one ticket if that is more, plus any start fee shown on the offer. The rental ends at its time or its budget, and Cut ends it at once. On armv7 the app has no Stream Gateway and rents nothing; selling hashrate works there.

Renting out your miners (hashmaker)

On Sell → Hashrate, tick Rent out my miners. By default the price is the mining value at live difficulty, and you can set your own. A renter gets no work it hasn't paid for: if it stops paying, your miners go back to your own pool within seconds. You rent out only miners that have connected and named themselves. With the direct link up, hashtakers reach you by key, with no port forward. More: P2P-HASH.md.

VPN exits

Using one. Services → VPN: add a device (a phone, a laptop, a TV, a router), choose its rules (a country, the most it may cost a GB), and scan the WireGuard settings the page shows once. Its traffic goes out through another box's internet connection, paid by the GB. If no exit fits its rules, the device's traffic stops; it never falls back to your own connection. An exit's country is checked, not believed.

Selling one. On Sell → VPN exit, read the warning, then offer your internet connection as an exit: price a GB, choose private or filtered, and set protections under Advanced (port 25 is blocked by default). Your exit never reaches your own network. A shop that sells only its exit is listed too. More: VPN-EXITS.md.

Agents

An AI agent pays through the same wallet over MCP, the Model Context Protocol, and never holds a key: it asks the wallet to pay, and the wallet decides, within the rules you signed. The wallet holds the keys and the ticket secrets, and books what your own node paid, never a number a seller sends.

Run a relay

When two routers won't let the apps connect directly, a relay passes the traffic between them. Anyone can run one. It can't read anything: the link is encrypted from one app to the other. It does see both apps' IP addresses and how much passes; the setup keeps no logs of those. It isn't an exit: nothing it carries goes out to the rest of the internet from your address.

1. On a small rented server with a public IPv4 address, install the Linux package and answer 1 when the installer asks about the Stream relay.
2. Point a domain at the server (with Cloudflare, DNS only, not proxied), and open TCP 443 (and UDP 7842 for QUIC address discovery, if you can).
3. In the app, Settings → Stream relays → Run a relay for the Stream network: enter the domain and an e-mail address for Let's Encrypt, and switch it on. Then Announce a relay lists it for other apps.

Umbrel and StartOS can't run it: an Umbrel app can't take the box's port 443, and StartOS keeps 443 for itself. 4K video through a relay is about 11 to 36 GB per hour of watching, per stream. Relays are free today; Coming paid relays, where a shop pays the relays it uses by the GB. Full instructions: RUN-A-RELAY.md.

Help and feedback

Report a bug or a confusing screen as an issue on GitHub; confusing screens are as useful to hear about as bugs. What changed in each version is in the changelog.