apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ taskserv.name }}-config
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.name }}
    app.kubernetes.io/managed-by: provisioning
data:
  nats.conf: |
    port: {{ taskserv.port }}
    http_port: {{ taskserv.monitor_port }}

    jetstream {
      store_dir: "{{ taskserv.data_dir }}"
      max_memory_store: {{ jetstream_max_mem | default(value="256MB") }}
      max_file_store: {{ jetstream_max_file | default(value="1GB") }}
    }

    authorization {
      users: [
        { user: $NATS_USER, password: $NATS_PASS }
{% if taskserv.nkey_users is defined and taskserv.nkey_users | length > 0 %}
{# Multi-user mode: one nkey block per registered consumer, with subject scope. #}
{% for u in taskserv.nkey_users %}
        { nkey: ${{ "$" }}NATS_{{ u.pub_env_var }}_PUB,
          permissions {
            publish   { allow: [{% for s in u.allow_publish %}"{{ s }}"{% if not loop.last %}, {% endif %}{% endfor %}] }
            subscribe { allow: [{% for s in u.allow_subscribe %}"{{ s }}"{% if not loop.last %}, {% endif %}{% endfor %}] }
          }
        }
{% endfor %}
{% elif taskserv.nkey.enabled %}
{# Legacy single-user mode (back-compat). #}
        { nkey: $NATS_NKEY_PUB,
          permissions {
            publish   { allow: [{% for s in taskserv.nkey.allow_publish %}"{{ s }}"{% if not loop.last %}, {% endif %}{% endfor %}] }
            subscribe { allow: [{% for s in taskserv.nkey.allow_subscribe %}"{{ s }}"{% if not loop.last %}, {% endif %}{% endfor %}] }
          }
        }
{% endif %}
      ]
    }