Skip to main content

types.NATSAccountConfig

types.NATSAccountConfig API schema defining 3 fields, including auth callout enabled, expected public key, and path.

auth_callout_enabledboolean

AuthCalloutEnabled is a TEMPORARY migration toggle, retired once the fleet has fully moved to token-based NATS authentication. It controls whether the orchestrator actually subscribes the constructed callout handler to the NATS auth-callout subject at boot. The handler is always built when both this struct's Path and the signing-key path are set; this flag separately governs whether the embedded NATS server enables auth-callout and whether the orchestrator's own NATS client switches to the callout-exempt authentication path that the callout requires.

Default false: ship the activation code without changing runtime behaviour. Every edge agent MUST be running a build that presents Node Access Tokens before this flag is flipped true for any workspace; flipping the flag on rejects every CONNECT that does not present a Node Access Token. Auth-callout configuration for production external NATS is delivered separately.

expected_public_keystring

ExpectedPublicKey, if set, pins the account public address (A-prefixed nkeys string) that Path's seed MUST derive to. Mismatch is a fail-fast startup error. Closes the silent-failure mode where the wrong network's Secret is mounted into the orchestrator pod — without this knob, a mis-mount surfaces only as "every NATS CONNECT is rejected" with no breadcrumb pointing at the seed.

cell-operator (which provisioned the Secret) already knows the public key; writing it alongside Path closes the loop. Empty means no verification — the loader accepts any account seed.

pathstring

Path is the filesystem path to the NATS account seed file. Empty means the orchestrator does not load an account seed — the auth- callout subscription stays unregistered and the embedded NATS server continues to accept the legacy decentralised-auth path (or the no-auth dev path). Required to enable per-connection user-JWT minting.

types.NATSAccountConfig
{
  "auth_callout_enabled": true,
  "expected_public_key": "string",
  "path": "string"
}