DanConwayDev a16e5001cd fix(config): keep relay owner secrets out of process arguments ...

The NixOS module expanded relayOwnerNsecFile into --relay-owner-nsec, making the private key visible through process listings and routine service diagnostics. Removing the flag at the parser boundary prevents other deployments from recreating the same exposure.

Load a protected systemd credential before the environment and persistent key file, fail closed for empty or invalid configured values, and preserve auto-generation only when no identity was provisioned. The NixOS service can now execute the binary directly and generated fallback keys are created with private permissions.

2026-07-27 15:23:08 +01:00

..

example-configuration.nix

fix(config): keep relay owner secrets out of process arguments

2026-07-27 15:23:08 +01:00

module.nix

fix(config): keep relay owner secrets out of process arguments

2026-07-27 15:23:08 +01:00