47 lines
2.6 KiB
Plaintext
47 lines
2.6 KiB
Plaintext
# The nats module's own server settings. Declared by the module, because a port, a TLS path
|
|
# and a store directory are properties of the container this module raises: they live in its
|
|
# image and its mounts and change when it does.
|
|
#
|
|
# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the
|
|
# whole file would have to be kept in step with a Dockerfile it never sees.
|
|
|
|
port: 4222
|
|
# Monitoring on every interface *inside* the container, so the publish below can reach it; the publish
|
|
# is 127.0.0.1:8222 on the machine, so nothing beyond the machine reaches it, and the module guards 8222
|
|
# too. Bound to the container's own loopback until 2026-10-04, the published port answered nothing
|
|
# (connection reset), and the only way in was `docker exec`.
|
|
http: 0.0.0.0:8222
|
|
|
|
# The mesh's own broker certificate — the one every machine already pins by fingerprint and the
|
|
# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no
|
|
# machine's pin changes when it moves, and no second certificate exists to be wrong about.
|
|
tls {
|
|
cert_file: "/tls/tls.crt"
|
|
key_file: "/tls/tls.key"
|
|
}
|
|
|
|
# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That
|
|
# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a
|
|
# host pins this server's exact certificate and authenticates with the password the mesh minted
|
|
# (novox/hq ADR 0004, design 25 §4), and so does a module's runtime. With it on, every connection
|
|
# in the mesh is refused at the TLS handshake, before any password is looked at — and the error is
|
|
# "client didn't provide a certificate", which reads as a client fault.
|
|
#
|
|
# TLS is still required: a tls block is what makes it required, and verify only decides whether
|
|
# client certificates are checked. What is given up is a second factor the mesh has no machinery
|
|
# to issue or rotate — a certificate per module per node — and what is kept is stronger than a
|
|
# name check in both directions: an exact pin outward, a per-user password inward.
|
|
|
|
jetstream {
|
|
store_dir: "/data"
|
|
}
|
|
|
|
# Every user of the mesh, composed by the controller and rewritten whenever a module is
|
|
# assigned, a node enrols or a person's access changes.
|
|
#
|
|
# **Relative, and in this same directory, because it has to be.** An absolute include path is
|
|
# resolved relative to the including file's directory, not from the root: nats-server given
|
|
# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for
|
|
# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.
|
|
include accounts.conf
|