# The nats module's own server settings. Declared by the module, because a port, a TLS path
# and a store directory are properties of the container this module raises: they live in its
# image and its mounts and change when it does.
#
# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the
# whole file would have to be kept in step with a Dockerfile it never sees.

port: 4222
# Monitoring on every interface *inside* the container, so the publish below can reach it; the publish
# is 127.0.0.1:8222 on the machine, so nothing beyond the machine reaches it, and the module guards 8222
# too. Bound to the container's own loopback until 2026-10-04, the published port answered nothing
# (connection reset), and the only way in was `docker exec`.
http: 0.0.0.0:8222

# The mesh's own broker certificate — the one every machine already pins by fingerprint and the
# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no
# machine's pin changes when it moves, and no second certificate exists to be wrong about.
tls {
  cert_file: "/tls/tls.crt"
  key_file: "/tls/tls.key"
}

# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That
# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a
# host pins this server's exact certificate and authenticates with the password the mesh minted
# (novox/hq ADR 0004, design 25 §4), and so does a module's runtime. With it on, every connection
# in the mesh is refused at the TLS handshake, before any password is looked at — and the error is
# "client didn't provide a certificate", which reads as a client fault.
#
# TLS is still required: a tls block is what makes it required, and verify only decides whether
# client certificates are checked. What is given up is a second factor the mesh has no machinery
# to issue or rotate — a certificate per module per node — and what is kept is stronger than a
# name check in both directions: an exact pin outward, a per-user password inward.

jetstream {
  store_dir: "/data"
}

# Every user of the mesh, composed by the controller and rewritten whenever a module is
# assigned, a node enrols or a person's access changes.
#
# **Relative, and in this same directory, because it has to be.** An absolute include path is
# resolved relative to the including file's directory, not from the root: nats-server given
# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for
# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.
include accounts.conf