Overview
Running the on-prem collector in hybrid mode, you can store a Git personal access token (PAT) that Navigara can never read. You encrypt the token on your own collector host; Navigara only ever stores and forwards the ciphertext. The collector holds the private key and decrypts each token in memory, only when it authenticates to the Git host — the plaintext token and the private key never leave your network. If a blob can’t be decrypted (wrong key, tampering, or a paste error), the collector drops it and fails the task — it is never forwarded to the Git host.For the step-by-step setup (create the PAT, mount the key, paste the blob), see On-Prem Collector → Provider Tokens, End-to-End Encrypted. This page is the CLI and rotation reference.
Collector CLI
The collector binary handles key generation and encryption — you already have it on the collector host. Tokens are read from stdin.private.pem on the collector host — it is never shared. Then point the running collector at it for decryption:
Key rotation
Both env vars accept multiple keys, and the collector picks the right one per blob. So you can roll a new key without downtime: generate it, add it toCOLLECTOR_PRIVATE_KEY_PATH alongside the old one, re-encrypt and re-paste tokens at your own pace, then drop the old key once nothing uses it.