# NATS Credentials

This directory holds `.creds` files that are **fossil-ignored** and must never be committed to the repository. These are sensitive authentication credentials.

## Credential Structure

Credentials are organized per repository per user role:

- `edgesync-admin.creds` — Admin user for the edgesync account
- `edgesync-bridge.creds` — Bridge user for the edgesync account (restricted publish/subscribe)
- `go-libfossil-admin.creds` — Admin user for the go-libfossil account
- `go-libfossil-bridge.creds` — Bridge user for the go-libfossil account (restricted publish/subscribe)
- `leaf-*.creds` — Leaf node users (added per-hostname as needed)

## Full Regeneration Sequence

Run this entire sequence to rebuild the credential tree from scratch:

```bash
# 1. Add operator (only if nsc store is empty)
nsc add operator --name fossil-sync
nsc edit operator --account-jwt-server-url tls://localhost:4222

# 2. Add accounts
nsc add account --name edgesync
nsc add account --name go-libfossil

# 3. Add users
nsc add user --account edgesync     --name admin --allow-pub '>' --allow-sub '>'
nsc add user --account go-libfossil --name admin --allow-pub '>' --allow-sub '>'

nsc add user --account edgesync \
  --name bridge \
  --allow-pub  'fossil.edgesync.>' \
  --allow-sub  'fossil.edgesync.>'

nsc add user --account go-libfossil \
  --name bridge \
  --allow-pub  'fossil.go-libfossil.>' \
  --allow-sub  'fossil.go-libfossil.>'

# 4. Generate .creds files into this directory
nsc generate creds --account edgesync     --name bridge > edgesync-bridge.creds
nsc generate creds --account go-libfossil --name bridge > go-libfossil-bridge.creds
nsc generate creds --account edgesync     --name admin  > edgesync-admin.creds
nsc generate creds --account go-libfossil --name admin  > go-libfossil-admin.creds

# 5. Re-extract operator JWT
OPERATOR_JWT=$(nsc generate config --nats-resolver 2>/dev/null \
  | grep '^operator:' | awk '{print $2}')
echo "OPERATOR_JWT=${OPERATOR_JWT}" > /etc/nats/operator.env
chmod 0600 /etc/nats/operator.env

# 6. Push JWTs to running server
nsc push --all --server tls://localhost:4222 --tlsskipverify
```

## Adding a New Leaf Node

To add a new leaf node (e.g., a developer laptop or additional server):

```bash
PROJECT=edgesync   # or go-libfossil
HOSTNAME=m4-macbook

nsc add user --account "$PROJECT" \
  --name "leaf-${HOSTNAME}" \
  --allow-pub  "fossil.${PROJECT}.igot,fossil.${PROJECT}.file,fossil.${PROJECT}.delta" \
  --allow-sub  "fossil.${PROJECT}.gimme,fossil.${PROJECT}.file,fossil.${PROJECT}.meta,fossil.${PROJECT}.events"

nsc generate creds --account "$PROJECT" --name "leaf-${HOSTNAME}" > "leaf-${HOSTNAME}.creds"
nsc push --all --server tls://localhost:4222 --tlsskipverify

# Transfer to leaf node over Tailscale
scp "leaf-${HOSTNAME}.creds" "${HOSTNAME}:/path/to/agent/creds/"
```

## Security Notes

- These `.creds` files are in `.fossil-ignore` — never commit them
- Store them securely; they grant full access to NATS subjects they're authorized for
- Rotate credentials periodically by regenerating and re-pushing JWTs
- Keep the operator JWT in `/etc/nats/operator.env` on the server only