Where .vault/ lives, which need not be where the plaintext lives.
The long-standing assumption was that the vault sits inside the repository you are standing in. That works until the repository is public, which is the common case for dotfiles: the ciphertext is then archived forever by anyone who clones or forks, and on GitHub it stays fetchable through the fork network even after a history rewrite. Rotating a key does not reach it and neither does --rekey, because both act on the working tree.
Keeping the vault in a separate private repository removes that exposure for everything stored from then on. It is a bigger improvement than any feature, and it costs nothing at read time: the manifest already stores target paths as ~/..., so entries do not care which repository the blobs came from.
Resolution order, most explicit first:
- --vault DIR
- NIMVAULT_VAULT_REPO
- a .nimvault pointer file in the current git repository
- the current git repository, which is the behaviour that predates this
Consts
PointerFile = ".nimvault"
Procs
proc gitRoot(): string {....raises: [OSError, IOError], tags: [ExecIOEffect, ReadIOEffect, RootEffect], forbids: [].}
proc readPointer(dir: string): string {....raises: [IOError], tags: [ReadDirEffect, ReadIOEffect, ReadEnvEffect], forbids: [].}
-
First non-comment line of <dir>/.nimvault, or empty.
The pointer lives in the content repository rather than in the vault, because a vault cannot tell you where to find itself.
proc resolveVaultRepo(cliVault = ""): string {. ...raises: [ValueError, OSError, IOError, NimvaultError], tags: [ReadEnvEffect, ReadIOEffect, ExecIOEffect, RootEffect, ReadDirEffect], forbids: [].}
- Directory that owns .vault/. Raises when nothing can be resolved, since every alternative silently operates on the wrong vault.
proc warnIfRootIsAmbiguous(vaultRepo, configuredRoot: string) {. ...raises: [OSError, IOError, NimvaultError], tags: [ExecIOEffect, ReadIOEffect, RootEffect], forbids: [].}
- root = repo means "paths are relative to the repository". With the vault in its own repository that is ambiguous, and resolving it against the vault would silently point every entry at the wrong tree.