00cff51ce5
All checks were successful
Closes the open broker (anonymous publish to any tenant's corrosion.*).
Per-license isolation via NATS user/password + subject permissions:
each license -> user=license_id, password=HMAC-SHA256(license_id,
NATS_TOKEN_SECRET), scoped to corrosion.{license_id}.> + _INBOX. Backend
uses a privileged internal user.
- Agent (alpha.5): nats_user/nats_password config + env, user_and_password
auth; falls back to token/anonymous (transition-safe)
- Backend: connects with NATS_INTERNAL_USER/PASSWORD when set, else anon
- scripts/generate-nats-auth.mjs: regenerates nats-auth.conf from the
licenses table; NATS_AUTH_STAGE=open keeps a no_auth_user fallback
(verify creds first), =enforce rejects anonymous
- committed nats-auth.conf is the SAFE OPEN default (no secrets); the
host copy carries real users and is not committed
- compose: NATS_INTERNAL_USER/PASSWORD/NATS_TOKEN_SECRET, mount nats-auth.conf
Entirely non-breaking until secrets+config deployed; staged cutover next.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
39 lines
1.0 KiB
Plaintext
39 lines
1.0 KiB
Plaintext
# Corrosion NATS Configuration
|
|
# JetStream enabled for persistent messaging
|
|
|
|
listen: 0.0.0.0:4222
|
|
|
|
# JetStream configuration
|
|
jetstream {
|
|
store_dir: /data
|
|
max_mem: 256MB
|
|
max_file: 2GB
|
|
}
|
|
|
|
# WebSocket listener for frontend real-time updates
|
|
websocket {
|
|
listen: "0.0.0.0:9222"
|
|
no_tls: true # TLS terminated at Nginx/Cloudflare
|
|
}
|
|
|
|
# HTTP monitoring
|
|
http: 0.0.0.0:8222
|
|
|
|
# Logging
|
|
debug: false
|
|
trace: false
|
|
logtime: true
|
|
|
|
# Limits
|
|
max_payload: 8MB # Support map file transfer metadata
|
|
max_connections: 10000
|
|
|
|
# Authorization — per-license isolation.
|
|
# The committed nats-auth.conf is the SAFE OPEN default (anonymous full access,
|
|
# no secrets — same as before). On deploy, scripts/generate-nats-auth.mjs
|
|
# regenerates this file from the licenses table with the privileged internal
|
|
# user + per-license scoped users; flip NATS_AUTH_STAGE=enforce to reject
|
|
# anonymous. The host copy carries secrets and is NOT committed
|
|
# (git update-index --assume-unchanged docker/nats-auth.conf).
|
|
include "nats-auth.conf"
|