Coordinator secret sources and resolution

This export describes where the coordinator discovers secrets and how competing sources are resolved. It never contains a secret value.

Owned by ngit-ciVerified 0.1.0-rc.2 @ 68b12d3236b6upcoming generated reference

Upcoming CI surface

These pages are generated from an unreleased ngit-ci commit. The interface may change before the next release.

Grouped precedence

Priority restarts at 1 inside each named group. Sources in different groups are not compared.

coordinator identity

1. systemd_credential — Read the coordinator_nsec systemd credential when it exists.
   • Location: environment CREDENTIALS_DIRECTORY; name coordinator_nsec
   • Reload: restart required; generates when absent: no
2. environment — Read the process environment, including an automatically loaded .env file; an existing process variable wins over .env.
   • Location: environment NGIT_CI_COORDINATOR_NSEC
   • Reload: restart required; generates when absent: no
3. file — Read .coordinator.nsec from the working directory, or generate it with owner-only permissions when absent.
   • Location: path .coordinator.nsec
   • Reload: restart required; generates when absent: yes

operator bunker

1. systemd_credential — Read the operator_bunker systemd credential when it exists.
   • Location: environment CREDENTIALS_DIRECTORY; name operator_bunker
   • Reload: restart required; generates when absent: no
2. environment — Read the process environment, including an automatically loaded .env file; an existing process variable wins over .env.
   • Location: environment NGIT_CI_OPERATOR_BUNKER
   • Reload: restart required; generates when absent: no

Repository-secret sources

These pattern sources are resolved by the qualified rules below; they do not join either numbered group above.

• systemd_credential_pattern — Read one <ALIAS>__<NAME> systemd credential per secret. Credentials override environment values for the same repository alias and name.
  • Location: environment CREDENTIALS_DIRECTORY; name <ALIAS>__<NAME>
  • Reload: restart required
• environment_pattern — Read matching process environment variables after .env loading. Exact-repository aliases override wildcard-pubkey aliases for the same secret name.
  • Location: environment NGIT_CI_SECRET_<ALIAS>__<NAME>
  • Reload: restart required
• nostr_provisioning — Use authenticated Nostr-provisioned repository secrets when no operator-provisioned value wins for the resolved name across authorized repository scopes.
  • Location: Nostr provisioning
  • Reload: live

Qualified resolution rules

Each ordering applies only when its exported qualifier matches; these are not global priority chains.

• operator_provisioned_value over nostr_provisioned_value — For each resolved secret name across authorized repository scopes, all Nostr-provisioned values are inserted first and all operator-provisioned values are inserted afterward. Within each layer, scopes are processed by ascending repository coordinate and later scopes overwrite earlier scopes.
  • Applies when: same_resolved_secret_name_across_authorized_repository_scopes
  • Kind: source_authority; stable ID ngit-ci.secret-resolution.repository-source-authority
• exact_repository_alias over wildcard_pubkey_alias — For each resolved secret name across authorized operator repository scopes, all bare-pubkey wildcard values are inserted before all exact-coordinate values. Within each layer, scopes are processed by ascending repository coordinate and later scopes overwrite earlier scopes.
  • Applies when: same_resolved_secret_name_across_authorized_operator_repository_scopes
  • Kind: scope_specificity; stable ID ngit-ci.secret-resolution.repository-scope-specificity
• systemd_credential over process_environment — A systemd credential overlays an environment value only when both use the same repository alias and secret name.
  • Applies when: same_operator_alias_and_secret_name
  • Kind: source_authority; stable ID ngit-ci.secret-resolution.repository-operator-source
• maintainer_bunker_binding over operator_fallback_bunker — A maintainer-supplied bunker binding for a repository scope overrides the operator fallback bunker when sealing Nostr-provisioned secrets.
  • Applies when: same_repository_scope
  • Kind: scope_specificity; stable ID ngit-ci.secret-resolution.sealing-bunker-specificity

Treat every resolved value as a secret: keep it out of process arguments, logs, shell history, screenshots, and documentation artifacts.