Skip to main content

​
Overview

Running the on-prem collector in hybrid mode, you can store a Git personal access token (PAT) that Navigara can never read. You encrypt the token on your own collector host; Navigara only ever stores and forwards the ciphertext. The collector holds the private key and decrypts each token in memory, only when it authenticates to the Git host — the plaintext token and the private key never leave your network. If a blob can’t be decrypted (wrong key, tampering, or a paste error), the collector drops it and fails the task — it is never forwarded to the Git host.
For the step-by-step setup (create the PAT, mount the key, paste the blob), see On-Prem Collector → Provider Tokens, End-to-End Encrypted. This page is the CLI and rotation reference.

​
Collector CLI

The collector binary handles key generation and encryption — you already have it on the collector host. Tokens are read from stdin. 
# Generate an X25519 keypair → private.pem (0600) + public.pem, and print the fingerprint.
# Refuses to overwrite an existing private.pem.
collector keygen --out /etc/navigara/keys

# Encrypt a token → prints the navigara-enc-v1: blob to paste into the dashboard.
echo -n 'ghp_yourtoken' | collector encrypt-token --public-key /etc/navigara/keys/public.pem

# Verify a blob decrypts back to the original token.
echo 'navigara-enc-v1:...' | collector decrypt-token --private-key /etc/navigara/keys/private.pem
Keep private.pem on the collector host — it is never shared. Then point the running collector at it for decryption:
Env varDescription
COLLECTOR_PRIVATE_KEY_PATHPath to a PEM private key. Comma-separate multiple files for rotation.
COLLECTOR_PRIVATE_KEY_PEMInline PEM private key(s), as an alternative to the path.

​
Key rotation

Both env vars accept multiple keys, and the collector picks the right one per blob. So you can roll a new key without downtime: generate it, add it to COLLECTOR_PRIVATE_KEY_PATH alongside the old one, re-encrypt and re-paste tokens at your own pace, then drop the old key once nothing uses it.