Redirecting...

This page has moved to https://docs.nats.io.

Click here if you are not redirected.

Configuration

Basic configuration revolves around 4 settings:

• The store to read JWTs from
• The HTTP/S configuration
• NATS (for cases where updates are enabled)
• Logging

For complete information on please refer to the project's Github.

nsc Configuration

For a basic usage of the server you can specify the -nsc flag, and specify the path to an operator in your environment.

If you have not yet created an operator or accounts, you'll need to do so before continuing. See NSC

You can easily locate the path by running nsc env to print your nsc settings:

> nsc env
╭──────────────────────────────────────────╮
│             NSC Environment              │
├──────────────────┬─────┬─────────────────┤
│ Setting          │ Set │ Effective Value │
├──────────────────┼─────┼─────────────────┤
│ $NKEYS_PATH      │ No  │ ~/.nkeys        │
│ $NSC_HOME        │ No  │ ~/.nsc          │
│ Config           │     │ ~/.nsc/nsc.json │
├──────────────────┼─────┼─────────────────┤
│ Stores Dir       │     │ ~/.nsc/nats     │
│ Default Operator │     │ Test            │
│ Default Account  │     │ TestAccount     │
│ Default Cluster  │     │                 │
╰──────────────────┴─────┴─────────────────╯

The path you are interested in the Stores Dir. This is the root of all operators, you'll also need the name of your operator. If your current operator is not listed, you can list all your available operators by doing:

> nsc list operators

To start the nats-account-server with the operator Test:

> nats-account-server -nsc ~/.nsc/nats/Test
2019/05/10 11:22:41.845148 [INF] starting NATS Account server, version 0.0-dev
2019/05/10 11:22:41.845241 [INF] server time is Fri May 10 11:22:41 CDT 2019
2019/05/10 11:22:41.845245 [INF] loading operator from /Users/synadia/.nsc/nats/Test/Test.jwt
2019/05/10 11:22:41.846367 [INF] creating a read-only store for the NSC folder at /Users/synadia/.nsc/nats/Test
2019/05/10 11:22:41.846459 [INF] NATS is not configured, server will not fire notifications on update
2019/05/10 11:22:41.855291 [INF] http listening on port 9090
2019/05/10 11:22:41.855301 [INF] nats-account-server is running
2019/05/10 11:22:41.855303 [INF] configure the nats-server with:
2019/05/10 11:22:41.855306 [INF]   resolver: URL(http://localhost:9090/jwt/v1/accounts/)

By default the server will serve JWTs on the localhost at port 9090. The last line in the shown in the printout is important, that is the resolver URL you'll have to provide on your NATS server configuration. You'll also need the matching operator JWT which is on ~/.nsc/nats/Test/Test.jwt if you are following the example above. On the server configuration you'll need to expand the ~ as necessary. Here's what my NATS server configuration looks like:

operator: /Users/synadia/.nsc/nats/Test/Test.jwt
resolver: URL(http://localhost:9090/jwt/v1/accounts/)

Note that servers you create with the -nsc option (or store option) are read-only. This means that the server will not accept POST requests to update the JWT store.

Directory Configuration

You can start a server using a plain directory. In this case you'll be responsible for adding any JWT that you want resolved.

The server looks for account JWTs by using the public key of the account as the file name followed by the extension .jwt. The server will not introspect the JWTs, so if you don't name the files correctly, it will fail to find them or serve a JWT that doesn't match the requested account.

> mkdir /tmp/jwts
nats-account-server -dir /tmp/jwts
2019/05/10 11:33:40.501305 [INF] starting NATS Account server, version 0.0-dev
2019/05/10 11:33:40.501383 [INF] server time is Fri May 10 11:33:40 CDT 2019
2019/05/10 11:33:40.501404 [INF] creating a store at /tmp/jwts
2019/05/10 11:33:40.501430 [INF] NATS is not configured, server will not fire notifications on update
2019/05/10 11:33:40.510273 [INF] http listening on port 9090
2019/05/10 11:33:40.510283 [INF] nats-account-server is running
2019/05/10 11:33:40.510285 [INF] configure the nats-server with:
2019/05/10 11:33:40.510291 [INF]   resolver: URL(http://localhost:9090/jwt/v1/accounts/)

Configuration for the NATS server is the same as in the previous example:

operator: /Users/synadia/.nsc/nats/Test/Test.jwt
resolver: URL(http://localhost:9090/jwt/v1/accounts/)

Configuration File

While the -nsc and -dir store flags are sufficient for some very simple developer setups, any production or non-read-only server will require a configuration file.

Let's take a look at the configuration options:

Configuration Options

store Configuration

logging Options

http Options

nats Options

tls Options