From 646dcf857f839ee42caa57a4e228d94d8efd79e4 Mon Sep 17 00:00:00 2001
From: DanConwayDev <DanConwayDev@protonmail.com>
Date: Sun, 11 Jan 2026 20:40:38 +0000
Subject: fix(nix): wrap relay-owner-nsec file read in bash shell for systemd

systemd's ExecStart doesn't execute shell commands by default, so the
 command substitution was being passed literally to ngit-grasp
instead of being evaluated. This caused a panic at startup when using
relayOwnerNsecFile option.

Wrap the command in bash -c to properly execute the file read.
---
 nix/module.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/module.nix b/nix/module.nix
index a175639..8136ae1 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -241,8 +241,8 @@ let
 
       # Command to run
       ExecStart = if cfg.relayOwnerNsecFile != null then
-      # Use nsec from file
-        "${ngit-grasp}/bin/ngit-grasp --relay-owner-nsec $(cat ${cfg.relayOwnerNsecFile})"
+      # Use nsec from file - need to use shell to read the file
+        "${pkgs.bash}/bin/bash -c '${ngit-grasp}/bin/ngit-grasp --relay-owner-nsec \"$(cat ${cfg.relayOwnerNsecFile})\"'"
       else
       # Let ngit-grasp auto-generate nsec in .relay-owner.nsec file in dataDir
         "${ngit-grasp}/bin/ngit-grasp";
-- 
cgit v1.2.3