FROM nats:2.10.22-alpine
# No extra packages — config rendering uses busybox sed (already in base image)
COPY nats-server.conf.template /etc/nats/nats-server.conf.template
COPY docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh
# Runtime mounts:
# /etc/nats/operator.env — operator JWT env file (optional if OPERATOR_JWT is set)
# /var/nats/tls/ — TLS cert + key (read-only)
# /var/nats/jwt/ — account JWT resolver dir (read-write, persistent)
# /var/nats/jetstream/ — JetStream message storage (read-write, persistent)
#
# Required env vars (or sourced from /etc/nats/operator.env):
# OPERATOR_JWT — operator JWT from `nsc generate config --nats-resolver`
# SYS_ACCOUNT_KEY — SYS account pubkey from `nsc describe account --name SYS -R`
#
# TLS note: the cert in /var/nats/tls/ is issued for sync.craftdesign.group.
# When deploying elsewhere, replace the cert with one valid for your hostname,
# or update nats-server.conf.template to point to your own cert paths.
EXPOSE 4222
ENTRYPOINT ["/docker-entrypoint.sh"]