Private repositories
Private repositories keep Git data and repository events behind authenticated infrastructure via GRASP-08, while retaining the repository's signed Nostr identity.
Self-hosted today, multi-provider hosting planned
The current path is to run an ngit-grasp service and manage its npub whitelist. One-click provisioning from private GRASP providers such as relay.ngit.dev is planned, making it practical to use several for backup and redundancy, with permissions tied to existing Nostr-based groups such as Concord. See the Roadmap.
1. Run a private GRASP service
Follow Host private repositories to enable GRASP-08 and configure the initial npub whitelist.
Private mode applies to the whole service rather than one repository. Add the npub of every account that should be able to access repositories in that trust domain.
2. Publish the repository
Run this inside the existing Git repository:
bash
ngit init \
--name "Private Project" \
--grasp-server private-grasp.example.com \
--private \
--defaultsThe explicit GRASP server supplies both authenticated endpoints. --private marks the repository private so ngit publishes its announcement, state, and collaboration events only to the repository's relays.
Inspect the result from the local cache:
bash
ngit repo --json --offlineCheck the private marker and confirm that every listed GRASP server belongs to the private trust domain.
Use only private GRASP services for a private repository. Do not add a public relay, public GRASP service, or public Git mirror: private repository events and Git data must stay inside the authenticated trust domain.
3. Add people to the service
The service operator adds a person's npub to the ngit-grasp whitelist. That is all they need to read repositories through the service. Once admitted, repository permissions work normally; private mode does not introduce another role system.
Being on the whitelist does not make someone a maintainer. Grant and revoke repository roles through the normal maintainer workflow.
The whitelist is service-wide, and private mode provides access control rather than end-to-end encryption. The operator and every authorised person can copy data they are allowed to read.
4. Clone with the authorised account
Make sure ngit is logged in with an authorised account before cloning or interacting with the repository:
bash
git clone nostr://<MAINTAINER_NPUB>/<PRIVATE_GRASP_DOMAIN>/<IDENTIFIER>The private GRASP domain is a relay hint, and generated clone URLs normally include it. ngit can also decrypt the active account's private Git service list and search those services, so the hint is not required once the service is in that list.
Use private repositories in GitWorkshop
Authorised accounts can access private repositories at gitworkshop.dev/<MAINTAINER_NPUB>/<PRIVATE_GRASP_DOMAIN>/<IDENTIFIER>. For notifications and improved discovery, add each service to the private GRASP list through Private Git services in Settings.
ngit reads the same list and automatically adds a missing service when publishing a private repository, but does not add services for contributors or provide a general-purpose list editor.
Buzz interoperability
ngit has basic, limited support for Buzz repositories: it can clone them, view pull requests and their status, and push new or updated pull requests and status changes through Buzz's authenticated relay and Git transport. GitWorkshop also provides early support for browsing Buzz repositories and collaboration, but this interoperability is evolving. Buzz and GRASP-08 remain distinct private repository models.