fix(nix): wrap relay-owner-nsec file read in bash shell for systemd

systemd's ExecStart doesn't execute shell commands by default, so the
 command substitution was being passed literally to ngit-grasp
instead of being evaluated. This caused a panic at startup when using
relayOwnerNsecFile option.

Wrap the command in bash -c to properly execute the file read.

1 files changed, 2 insertions, 2 deletions

diff --git a/nix/module.nix b/nix/module.nix
index a175639..8136ae1 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -241,8 +241,8 @@ let
 
       # Command to run
       ExecStart = if cfg.relayOwnerNsecFile != null then
-      # Use nsec from file
-        "${ngit-grasp}/bin/ngit-grasp --relay-owner-nsec $(cat ${cfg.relayOwnerNsecFile})"
+      # Use nsec from file - need to use shell to read the file
+        "${pkgs.bash}/bin/bash -c '${ngit-grasp}/bin/ngit-grasp --relay-owner-nsec \"$(cat ${cfg.relayOwnerNsecFile})\"'"
       else
       # Let ngit-grasp auto-generate nsec in .relay-owner.nsec file in dataDir
         "${ngit-grasp}/bin/ngit-grasp";