Account Demolisher

Self host

Run the app on your own infrastructure.

The deployment is a standard Next.js 16 application. You can clone the source, install, configure environment variables, and run it.

Requirements

  • Node.js 22
  • pnpm 10

Clone and install

git clone https://github.com/bytemaster333/account-demolisher.git
cd account-demolisher
pnpm install

Configure environment

cp .env.example .env.local

The relevant variables:

VariableWhat it controls
NEXT_PUBLIC_STELLAR_NETWORKmainnet, testnet, or futurenet. Defaults to testnet.
NEXT_PUBLIC_HORIZON_URLOverride the Horizon endpoint. Optional; the per-network defaults in src/lib/config/networks.ts apply when unset.
NEXT_PUBLIC_RPC_URLOverride the Soroban RPC endpoint. Optional; same fallback as Horizon.
NEXT_PUBLIC_DEPLOYMENT_MODEreference (uses the server-side mediator at /api/mediator/sign) or self-hosted. Defaults to reference. The self-hosted mode currently refuses any CEX-routed closure; use it only when you do not need the mediator path.
NEXT_PUBLIC_REFRACTOR_URLOverride the Refractor base URL. Defaults to https://api.refractor.space.
MEDIATOR_SECRETServer-only. The mediator account's secret key (S...). Required if you want the exchange-merge path to work. Generate per deployment; do not share.
ORION_API_URL, ORION_API_KEYServer-only. Orion DeFi positions API. Optional.
OCTOPOS_API_URL, OCTOPOS_API_KEYServer-only. OctoPos DeFi positions API. Optional.
SOROSWAP_API_URL, SOROSWAP_API_KEYServer-only. Soroswap aggregator. Required only if you want the Soroswap path to work in your deployment.

Server-only variables are processed through an emptyToUndefined preprocess: an empty string in .env.local is treated as not set. You can leave any of them blank instead of removing them.

Run

pnpm dev

The dev server is at localhost:3000.

For a production build:

pnpm build
pnpm start

The production server binds to port 3000 by default. Override with PORT= if needed.

Reverse-proxy under your own domain

Any TLS-terminating reverse proxy works. A minimal Caddy config is a single site block:

yourdomain.example {
    encode zstd gzip
    reverse_proxy 127.0.0.1:3000
}

The docs site (this site) lives in docs/ as a separate Next.js app (port 3020 in dev, per docs/package.json). docs/ is gitignored in the main repo, so it does not ship with a fresh clone.

Mediator key generation

If you want the exchange-merge path:

  1. Generate a fresh Stellar testnet keypair. The Stellar Laboratory's account creator works. Keep the seed private.
  2. Fund the public key with at least a few XLM (the mediator needs a base reserve to exist on chain).
  3. Set MEDIATOR_SECRET to the seed in your .env.local.
  4. Restart the production server. The seed is loaded once at first call and memoized.

For mainnet, do the same on mainnet. Use a dedicated key. Do not reuse a personal account.

CSP

The production CSP is defined in next.config.ts. If you add a new upstream the app needs to talk to, add the URL to CONNECT_SRC_ENDPOINTS in that file. The browser will block any request to an endpoint not on the list.

What is excluded from the published source

tests/, docs/, researches/, design/, and local-only planning notes (plan.md, completion.md, ad-hoc markdown) are gitignored per .gitignore. The source you clone is the shippable surface only.

Security

What the demolisher signs, what it never signs, and the threat model.

FAQ

Short answers to the questions we hear most.

On this page

RequirementsClone and installConfigure environmentRunReverse-proxy under your own domainMediator key generationCSPWhat is excluded from the published source