Artifact [95c8234871]

Artifact 95c8234871195c9d35d604a980a4ca2825b6d8bf5644f3499a19e9aa6e24ef9d:

• File nats/README.md — part of check-in [eb06a8ac37] at 2026-03-15 16:42:30 on branch trunk — Add NATS repo scaffolding and static config files (user: dmestas, size: 2394) [annotate] [blame] [check-ins using]

# NATS Server Configuration

NATS server for decentralized Fossil repository synchronization across leaf nodes.

## Public Endpoint

```
tls://sync.craftdesign.group:4222
```

Requires TLS client certificates (mutual TLS authentication).

## Local Admin Access

```
tls://localhost:4222 --tlsskipverify
```

Used for admin commands like `nsc push` and stream provisioning.

## JetStream Streams

Two persistent streams are configured:

| Stream | Purpose | Retention |
|--------|---------|-----------|
| `EDGESYNC` | Sync events for edgesync repository | 7 days, 1 GB |
| `GO_LIBFOSSIL` | Sync events for go-libfossil repository | 7 days, 1 GB |

## NATS Spec

Full NATS documentation: https://docs.nats.io/

## Installation (4 Phases)

Follow these steps in order on a fresh Ubuntu 24.04 LTS system:

### Phase 0: Prerequisites

Place your Cloudflare API token first. This is used for TLS certificate generation:

```bash
sudo mkdir -p /etc/nats
echo 'CF_Token="<your-cloudflare-api-token>"' | sudo tee /etc/nats/cf-token.env
sudo chmod 0600 /etc/nats/cf-token.env
```

### Phase 1-4: Run Installation Script

```bash
export NATS_VERSION=2.10.22
sudo --preserve-env=NATS_VERSION bash nats/install.sh
bash nats/bootstrap-creds.sh
sudo bash nats/start.sh
bash nats/provision-streams.sh
```

Each phase is idempotent and can be re-run safely.

## Service Management

View service status:

```bash
sudo systemctl status nats
sudo journalctl -u nats -f   # Follow logs
```

Restart the server:

```bash
sudo systemctl restart nats
```

Enable on boot:

```bash
sudo systemctl enable nats
```

## Verification Commands

Check server is running and accessible:

```bash
# From local machine with nats-cli installed
nats -s tls://localhost:4222 --tlsskipverify server info

# List accounts
nsc list accounts

# List users in edgesync account
nsc list users --account edgesync

# Show stream info
nats -s tls://localhost:4222 --tlsskipverify stream info EDGESYNC
nats -s tls://localhost:4222 --tlsskipverify stream info GO_LIBFOSSIL
```

Test publishing/subscribing (admin user):

```bash
# Subscribe to events
nats -s tls://localhost:4222 --tlsskipverify \
  --creds nats/creds/edgesync-admin.creds \
  sub 'fossil.edgesync.>'

# In another terminal, publish
nats -s tls://localhost:4222 --tlsskipverify \
  --creds nats/creds/edgesync-admin.creds \
  pub 'fossil.edgesync.test' 'Hello from NATS'
```