nats declares the certificate directory it mounts

The mesh's broker certificate is the operator's, kept outside any module and mounted read-only by whatever serves the bus; the controller declares that access and now so does nats, the same way. A mount nothing declares is refused at registration (ADR 0030), which is how this was found.
2026-09-28 00:15:59 +02:00
parent f1212620e4
commit 721149eda1
1 changed files with 4 additions and 0 deletions
@@ -70,6 +70,10 @@
    {
      "path": "/var/lib/mesh-broker-nats-tls",
      "mode": "read"
+    },
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
    }
  ],
  "build": {