Secret precedence
ngit-grasp checks relay-owner secret sources in this order. The export describes discovery only; it never contains a secret value.
Upcoming operator surface
This page is generated from an unreleased ngit-grasp commit. Its interface may change before the next release.
| Priority | Source | Location | Generates when absent | Behaviour |
|---|---|---|---|---|
| 1 | systemd_credential | environment CREDENTIALS_DIRECTORY; name relay_owner_nsec | no | Read the relay_owner_nsec systemd credential when it exists. |
| 2 | environment | environment NGIT_RELAY_OWNER_NSEC | no | Read the process environment, including an automatically loaded .env file; an existing process variable wins over .env. |
| 3 | file | path .relay-owner.nsec | yes | Read .relay-owner.nsec from the working directory, or generate it with owner-only permissions when absent. |
Treat every resolved value as a secret: keep it out of process arguments, logs, shell history, screenshots, and documentation artifacts.