Overview
Running the on-prem collector in hybrid mode, you can store a Git personal access token (PAT) that Navigara can never read. You encrypt the token on your own collector host; Navigara only ever stores and forwards the ciphertext. The collector holds the private key and decrypts each token in memory, only when it authenticates to the Git host. The plaintext token and the private key never leave your network. If a blob can’t be decrypted (wrong key, tampering, or a paste error), the collector drops it and fails the task; it is never forwarded to the Git host.For the step-by-step setup (create the PAT, mount the key, paste the blob), see On-Prem Collector → Provider Tokens, End-to-End Encrypted. This page is the CLI and rotation reference.
Collector CLI
The collector binary handles key generation and encryption, and you already have it on the collector host. Tokens are read from stdin.private.pem on the collector host; it is never shared. Then point the running collector at it for decryption:
Key rotation
Both env vars accept multiple keys, and the collector picks the right one per blob. So you can roll a new key without downtime: generate it, add it toCOLLECTOR_PRIVATE_KEY_PATH alongside the old one, re-encrypt and re-paste tokens at your own pace, then drop the old key once nothing uses it.