Hephaestus is the code host for the BCH ecosystem — Cauldron contributors, Sirius developers, wallet authors, indexer maintainers. Sign in with a wallet, push a repo, host a release. No email, no password reset, no middleman.
Three moving parts, no magic. Forgejo does the git and issue tracking, an auth-proxy translates
Bitcoin Cash message signatures into OpenID Connect tokens Forgejo understands, and Caddy fronts the whole
thing behind the two hostnames — hephaestus.x for BCNR-aware browsers, code.silentmode.st
as a public DNS mirror.
Generate or import a BCH wallet in the browser. Sign one BIP-137 "Bitcoin Signed Message" challenge,
and Forgejo auto-provisions bch_<first-20-of-your-cashaddr>. Rename it later — even to a
plain name like BitcoinCash. The private key never leaves your device.
Live git repos + Postgres stay on the VPS SSD for speed. LFS objects, release archives, container images,
package registry blobs and issue attachments spill to the Sia
network via s3.silentmode.st:8600. Encrypted client-side, sharded across independent hosts.
hephaestus.x is the primary — an on-chain BCNR certificate, chipnet, owner-controlled, TLS via the Silent Mode CA. code.silentmode.st is the public-DNS mirror for browsers without a BCNR resolver. Same Forgejo, same accounts, same repos.
git clone, git push, PRs, issues, releases, container/npm registries, the
Forgejo API. Bring your existing muscle memory — the only unusual bit is that you signed in with a wallet
instead of an email.
Nothing to install, nothing to remember except your recovery phrase.
localStorage.
Minimum 8 characters. Never leaves your device.The whole forge — the Docker Compose stack, the Caddyfile, the auth-proxy that verifies wallet signatures, the Forgejo Dockerfile with our CA baked in, every helper script — is on Hephaestus itself. Clone it, read it, run it.
The full stack. docker-compose.yml, caddy/Caddyfile,
auth-proxy/ (Fastify OIDC provider), forgejo/Dockerfile,
scripts/, PROTOCOL.md.
The wallet-to-OIDC bridge. ~250 lines of TypeScript that produces an Ed25519-signed id_token
after verifying a BIP-137 signature against a claimed CashAddr. The whole crypto path is in
src/verify.ts.
Wallet-auth flow, message format, replay-protection, prefix handling (bitcoincash / bchtest / bchreg). The document a third-party wallet needs to add native support.
Nothing here needs Hephaestus.X's operator — the same compose stack runs on any Linux box with
Docker. Bring your own domain, a TLS cert, and a Sia bucket (the sia.storage free tier is enough for a small
forge). Then docker compose up.
# 1. clone git clone https://code.silentmode.st/silentmode/hephaestus.git cd hephaestus # 2. configure — copy .env.example, fill in your domain, Sia S3 creds, and OIDC secret cp .env.example .env $EDITOR .env # 3. run — Caddy + Postgres + Forgejo + auth-proxy come up together docker compose up -d # 4. first wallet signs in and takes the admin seat open https://your-domain.example/user/oauth2/hephaestus-wallet
Hephaestus is one of seven sibling .x names. Each project is its own on-chain certificate, each site is reachable through any BCNR resolver, plus the silentmode.st gateway for browsers without one.
The project umbrella. Redirects to silentmode.st where every pillar has its own landing.
The browser that speaks BCNR natively — Chromium build with the resolver baked in, no OS-level daemon.
The forge. Forgejo instance for the ecosystem's git repos, backed by BCH wallet auth. This site.
Fire from the chain. Foresight and experimentation layer. Redirects to silentmode.st/prometheus/.
Public gaze — analytics, dashboards, transparency. Redirects to silentmode.st/helios/.
You do not have to trust that hephaestus.x is served by anyone specific. The name's
certificate is on the Bitcoin Cash chain; the records point to a specific IP and a specific Sia bucket; every
path is independently checkable.
The same content should be served from at least two independent paths. If one mirror disappears, the others still work. If two disagree, the on-chain record is the tiebreaker.
https://hephaestus.x/ (requires the local root CA)https://navigate.st/bns/hephaestus.xhttps://silentmode.st/hephaestus/https://code.silentmode.st/s3.silentmode.st:8600, client-side encrypted · static landing mirrored to a Sia bucket as DR backup