# NATS JetStream for a split deployment: the control plane runs on a container
# host, the fleet runs on machines you own, and both reach this.
#
# The bus crosses the public internet here, so it is TLS and it is
# authenticated. A token in the URL is what every Warmbly service (including
# the Rust tracking publisher) already understands:
#
#   NATS_URL=tls://<token>@bus.example.com:4222

listen: 0.0.0.0:4222

# Monitoring stays on loopback. It exposes stream and consumer state to anyone
# who can reach it, and nothing outside this machine needs it.
http: 127.0.0.1:8222

jetstream {
  store_dir: "/data"
  # Give JetStream a bound rather than the whole disk, so a stuck consumer
  # fills a quota instead of the filesystem the container runtime is on.
  max_file_store: 8GB
}

authorization {
  # openssl rand -hex 32
  token: $NATS_TOKEN
}

tls {
  cert_file: "/certs/fullchain.pem"
  key_file:  "/certs/privkey.pem"
}