feat(media): self-host Blossom at blossom.skate-spots.org (primary upload target)

Newlay's Blossom enabled on the relay box (blobs inside the data volume); Caddy + DNS + TLS wired. The app now uploads there first, keeping blossom.primal.net and blossom.band as mirrors, and includes it in BLOSSOM_MIRROR_HOSTS for read fallback.

AGENTS.md

@@ -2079,8 +2079,8 @@ The community relay moved off the hosted relay.tools instance
   the proxy for ai/push/relay.
 - **Repo on the box:** `~/newlay`; config `~/newlay/deploy/docker/newlay.toml`
   (bind-mounted read-only into the container). `sudo docker compose up -d`.
-- **Config choices:** `[tier.anon]` open read+write (no WoT gate, no spider, no
+- **Config choices:** `[tier.anon]` open read+write (no WoT gate, no spider);
-  Blossom); `created_at_msecs_ago = 315360000000` (10 years — the default 365-day
+  `created_at_msecs_ago = 315360000000` (10 years — the default 365-day
   window silently dropped an old spot on restore); publishing/filter limits raised
   from the tight defaults. The relay is keyless (no NIP-43/NIP-29 membership).
 - **Data:** restored from the archive — **115/115 events, 17 authors**, every kind
@@ -2105,6 +2105,16 @@ The community relay moved off the hosted relay.tools instance
   "recovered" message). The topic is in `/home/ubuntu/skatespots-health.env`
   (mode 600, not tracked) — subscribe to it in the ntfy app. Units tracked at
   `scripts/systemd/skatespots-health.{service,timer}`.
+- **Media / Blossom (2026-10-12):** the relay also serves Newlay's Blossom at
+  **`blossom.skate-spots.org`** (a Caddy site block → the same `127.0.0.1:7777`;
+  blobs stored at `/var/lib/newlay/data/blobs`, INSIDE the data volume so they
+  survive container recreation). `[blossom] enabled = true`,
+  `upload_requires_membership = false` (no membership model), `public_base_url`
+  set. The app uploads there first (`useUploadFile` `UPLOAD_SERVERS`) and keeps
+  `blossom.primal.net` + `blossom.band` as mirrors; `BLOSSOM_MIRROR_HOSTS`
+  (`lib/imageFallback.ts`) includes it so reads fall back across all three.
+  Verified end-to-end (signed PUT /upload → 201, GET /<sha> → 200). To fully
+  self-host media later, drop the two public hosts from both lists.
 - **Cutover (2026-10-12):** `SKATE_RELAY` (`src/lib/types.ts`) → the new relay; the
   default pools, the DM/CVM/zap relay arrays, the `cvm-server` + `push-service`
   defaults, and the archive default all point at the new relay.

src/hooks/useUploadFile.ts

@@ -4,13 +4,14 @@ import { BlossomUploader } from '@nostrify/nostrify/uploaders';
 import { useCurrentUser } from "./useCurrentUser";
 
 /**
- * Two Blossom hosts. `BlossomUploader` signs ONE auth event and PUTs to every
+ * Our own Blossom (blossom.skate-spots.org, on our relay box) plus two public
- * server in parallel, resolving with the first success — so the same bytes
+ * mirrors. `BlossomUploader` signs ONE auth event and PUTs to every server in
- * normally land on both from a single signature (no double Amber prompt). We then
+ * parallel, resolving with the first success — so the same bytes normally land on
- * record a mirror URL on the returned tags so photo redundancy is explicit in the
+ * all of them from a single signature (no double Amber prompt). We then record a
- * event; the read side also derives it from the sha256 (lib/imageFallback).
+ * mirror URL on the returned tags so photo redundancy is explicit in the event;
+ * the read side also derives it from the sha256 (lib/imageFallback).
  */
-const UPLOAD_SERVERS = ['https://blossom.primal.net/', 'https://blossom.band/'];
+const UPLOAD_SERVERS = ['https://blossom.skate-spots.org/', 'https://blossom.primal.net/', 'https://blossom.band/'];
 
 function hostOf(url: string): string {
   try {

src/lib/imageFallback.ts

@@ -11,7 +11,7 @@
  */
 
 /** Hosts the app uploads to, and therefore the hosts we can mirror across. */
-export const BLOSSOM_MIRROR_HOSTS = ['blossom.primal.net', 'blossom.band'];
+export const BLOSSOM_MIRROR_HOSTS = ['blossom.skate-spots.org', 'blossom.primal.net', 'blossom.band'];
 
 /** `<64-hex>` or `<64-hex>.<ext>` */
 const HASH_RE = /^([0-9a-f]{64})(\.[a-z0-9]+)?$/i;