From 721149eda18d4acc4f132a229365c1f26fde7de3 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 28 Sep 2026 00:15:59 +0200
Subject: [PATCH] nats declares the certificate directory it mounts

The mesh's broker certificate is the operator's, kept outside any module and
mounted read-only by whatever serves the bus; the controller declares that
access and now so does nats, the same way. A mount nothing declares is refused
at registration (ADR 0030), which is how this was found.
---
 modules/nats/module.json | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nats/module.json b/modules/nats/module.json
index ffb5a29..defc4fd 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -70,6 +70,10 @@
     {
       "path": "/var/lib/mesh-broker-nats-tls",
       "mode": "read"
+    },
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
     }
   ],
   "build": {