NATS Server Configuration

NATS server for decentralized Fossil repository synchronization across leaf nodes.

Public Endpoint

tls://sync.craftdesign.group:4222

Requires TLS client certificates (mutual TLS authentication).

Local Admin Access

tls://localhost:4222 --tlsskipverify

Used for admin commands like nsc push and stream provisioning.

JetStream Streams

Two persistent streams are configured:

Stream	Purpose	Retention
EDGESYNC	Sync events for edgesync repository	7 days, 1 GB
GO_LIBFOSSIL	Sync events for go-libfossil repository	7 days, 1 GB

NATS Spec

Full NATS documentation: https://docs.nats.io/

Installation (4 Phases)

Follow these steps in order on a fresh Ubuntu 24.04 LTS system:

Phase 0: Prerequisites

Place your Cloudflare API token first. This is used for TLS certificate generation:

sudo mkdir -p /etc/nats
echo 'CF_Token="<your-cloudflare-api-token>"' | sudo tee /etc/nats/cf-token.env
sudo chmod 0600 /etc/nats/cf-token.env

Phase 1-4: Run Installation Script

export NATS_VERSION=2.10.22
sudo --preserve-env=NATS_VERSION bash nats/install.sh
bash nats/bootstrap-creds.sh
sudo bash nats/start.sh
bash nats/provision-streams.sh

Each phase is idempotent and can be re-run safely.

Service Management

View service status:

sudo systemctl status nats
sudo journalctl -u nats -f   # Follow logs

Restart the server:

sudo systemctl restart nats

Enable on boot:

sudo systemctl enable nats

Verification Commands

Check server is running and accessible:

# From local machine with nats-cli installed
nats -s tls://localhost:4222 --tlsskipverify server info

# List accounts
nsc list accounts

# List users in edgesync account
nsc list users --account edgesync

# Show stream info
nats -s tls://localhost:4222 --tlsskipverify stream info EDGESYNC
nats -s tls://localhost:4222 --tlsskipverify stream info GO_LIBFOSSIL

Test publishing/subscribing (admin user):

# Subscribe to events
nats -s tls://localhost:4222 --tlsskipverify \
  --creds nats/creds/edgesync-admin.creds \
  sub 'fossil.edgesync.>'

# In another terminal, publish
nats -s tls://localhost:4222 --tlsskipverify \
  --creds nats/creds/edgesync-admin.creds \
  pub 'fossil.edgesync.test' 'Hello from NATS'