80 lines
2.9 KiB
Text
80 lines
2.9 KiB
Text
|
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
NATS = {
|
||
|
|
name | String,
|
||
|
|
version | String,
|
||
|
|
port | Number | default = 4222,
|
||
|
|
monitor_port | Number | default = 8222,
|
||
|
|
data_dir | String | default = "/data",
|
||
|
|
mode | [| 'taskserv, 'cluster, 'container |] | default = 'cluster,
|
||
|
|
|
||
|
|
namespace | String | optional,
|
||
|
|
image | String | optional,
|
||
|
|
storage_class | String | optional,
|
||
|
|
|
||
|
|
jetstream | {
|
||
|
|
max_mem | String | default = "256MB",
|
||
|
|
max_file | String | default = "1GB",
|
||
|
|
} | default = {},
|
||
|
|
|
||
|
|
# NKey-based authorization (single user; back-compat). When enabled = true,
|
||
|
|
# the broker accepts NKey-authenticated clients in addition to user/password.
|
||
|
|
# Public NKey is read from the env var $NATS_NKEY_PUB at config-load time.
|
||
|
|
# Prefer `nkey_users` (multi-user, per-account subject scoping) for new deployments.
|
||
|
|
nkey | {
|
||
|
|
enabled | Bool | default = false,
|
||
|
|
allow_publish | Array String | default = [],
|
||
|
|
allow_subscribe | Array String | default = ["_INBOX.>"],
|
||
|
|
} | default = {},
|
||
|
|
|
||
|
|
# Multi-user NKey authorization. When non-empty, this list replaces the
|
||
|
|
# single-user `nkey` block above. Each entry registers an independent
|
||
|
|
# NATS account with its own pubkey + subject scope, providing real
|
||
|
|
# isolation between consumers (the daemon, the agent, each tenant
|
||
|
|
# workspace). The broker reads each pubkey from `$NATS_${PUB_ENV_VAR}_PUB`
|
||
|
|
# at config-load time — operator-side credential delivery materialises
|
||
|
|
# one Secret data field per user (uppercased name + `_PUB` suffix).
|
||
|
|
#
|
||
|
|
# Each user MUST include `_INBOX.>` in BOTH allow_publish AND
|
||
|
|
# allow_subscribe — required for NATS request/reply patterns.
|
||
|
|
nkey_users | Array {
|
||
|
|
name | String,
|
||
|
|
pub_env_var | String,
|
||
|
|
allow_publish | Array String,
|
||
|
|
allow_subscribe | Array String,
|
||
|
|
} | default = [],
|
||
|
|
|
||
|
|
requires | {
|
||
|
|
storage | { size | String, persistent | Bool } | optional,
|
||
|
|
ports | Array {
|
||
|
|
port | Number,
|
||
|
|
protocol | String | default = "TCP",
|
||
|
|
exposure | [| 'public, 'private, 'internal |] | default = 'internal,
|
||
|
|
} | default = [],
|
||
|
|
credentials | Array String | default = [],
|
||
|
|
} | default = {},
|
||
|
|
|
||
|
|
provides | {
|
||
|
|
service | String | optional,
|
||
|
|
port | Number | optional,
|
||
|
|
protocol | String | optional,
|
||
|
|
} | default = {},
|
||
|
|
|
||
|
|
operations | {
|
||
|
|
install | Bool | default = true,
|
||
|
|
update | Bool | default = false,
|
||
|
|
delete | Bool | default = false,
|
||
|
|
backup | Bool | default = false,
|
||
|
|
restore | Bool | default = false,
|
||
|
|
health | Bool | default = false,
|
||
|
|
restart | Bool | default = false,
|
||
|
|
} | default = {},
|
||
|
|
|
||
|
|
# ServiceConcerns umbrella (ADR-008). NATS/JetStream message bus.
|
||
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
||
|
|
|
||
|
|
..
|
||
|
|
},
|
||
|
|
}
|