diff --git a/leafnodes/README.md b/leafnodes/README.md index 36d4260..ab9292c 100644 --- a/leafnodes/README.md +++ b/leafnodes/README.md @@ -1,17 +1,17 @@ ## Leaf Nodes -A _Leaf Node_ allows an extension to a cluter or supercluster that bridges accounts and security domains. This is useful in IoT and Edge scenarios and when the local server trafic should be low RTT and local unless routed to the super cluster. +A _Leaf Node_ allows an extension to a cluter or supercluster that bridges accounts and security domains. This is useful in IoT and edge scenarios and when the local server traffic should be low RTT and local unless routed to the super cluster. -Leaf Nodes leverage [Accounts](../nats_server/jwt_auth.md) and JWT to enable a server to connect to another and filter messages as per the leaf node's account User configuration. +Leaf Nodes leverage [accounts](../nats_server/jwt_auth.md) and JWTs to enable a server to connect to another and filter messages as per the leaf node's account user configuration. -This effectively means that the leaf node cluster's with the other server at an Account level: +This effectively means that the leaf node clusters with the other server at an account level: - Leaf nodes clients authenticate locally (or just connect if authentication is not required) -- Traffic between the leaf node and the cluster assume the restrictions of the User configuration used to create the leaf connection. +- Traffic between the leaf node and the cluster assumes the restrictions of the user configuration used to create the leaf connection. - Subjects that the user is allowed to publish are exported to the cluster. - Subjects the user is allowed to subscribe to, are imported into the leaf node. -> Leaf Nodes are an important component as a way to bridge traffic between local nats-servers you control and servers that are managed by a third-party. The Synadia's [NATS Global Service (NGS)](https://www.synadia.com/) allows accounts to use leaf nodes, but gain accessibility to the global network to inexpensively connect geographically distributed servers or small clusters. +> Leaf Nodes are an important component as a way to bridge traffic between local nNATS Servers you control and servers that are managed by a third-party. Synadia's [NATS Global Service (NGS)](https://www.synadia.com/) allows accounts to use leaf nodes, but gain accessibility to the global network to inexpensively connect geographically distributed servers or small clusters. [LeafNode Configuration Options](leafnode_conf.md) @@ -201,7 +201,7 @@ Both subscribers will receive the message as expected. As you can see: -- Messages to and from the leaf node to the server are limitted by the user associated with the leaf node connection. +- Messages to and from the leaf node to the server are limited by the user associated with the leaf node connection. - Messages within the leaf node are as per the server's authentication and authorization configuration diff --git a/nats_server/clustering.md b/nats_server/clustering.md index d138621..4210390 100644 --- a/nats_server/clustering.md +++ b/nats_server/clustering.md @@ -29,7 +29,7 @@ Here is a simple cluster running on the same machine: The _seed server_ simply declares its client and clustering port. All other servers delegate to the nats-server to auto-select a port that is not in use for both clients and cluster connections, and route to the seed server. Because the clustering protocol gossips members of the cluster, all servers are able to discover other server servers in the cluster. When a server is discovered, the discovering server will automatically attempt to connect to it in order to form a _full mesh_. Typically only one instance of the server will run per machine, so you can reuse the client port (4222) and the cluster port (5222), and simply the route to the host/port of the seed server. -Similarly, clients connecting to any server in the cluster will discover other servers in cluster. If connection to the server is interrupted, the client will attempt to connect to all other known servers. +Similarly, clients connecting to any server in the cluster will discover other servers in the cluster. If the connection to the server is interrupted, the client will attempt to connect to all other known servers. ## Command Line Options @@ -38,7 +38,7 @@ The following cluster options are supported: --routes [rurl-1, rurl-2] Routes to solicit and connect --cluster nats://host:port Cluster URL for solicited routes -When a NATS server routes to a specified URL, it will advertise its own cluster URL to all other servers in the route route effectively creating a routing mesh to all other servers. +When a NATS server routes to a specified URL, it will advertise its own cluster URL to all other servers in the route effectively creating a routing mesh to all other servers. **Note:** when using the `-routes` option, you must also specify a `-cluster` option. @@ -80,7 +80,7 @@ This will produce an output similar to: [75653] 2016/04/26 15:14:47.340825 [INF] server is ready ``` -It is also possible to specify the hostname and port independently. At least the port is required. If you leave the hostname off it will bind to all the interfaces ('0.0.0.0'). +It is also possible to specify the hostname and port independently. At the minimum, the port is required. If you leave the hostname off it will bind to all the interfaces ('0.0.0.0'). ```ascii cluster { diff --git a/nats_server/installation.md b/nats_server/installation.md index 96e67d5..12a38d5 100644 --- a/nats_server/installation.md +++ b/nats_server/installation.md @@ -11,7 +11,7 @@ NATS philosophy is simplicity. Installation is just decompressing a zip file and ### Installing via Docker -With docker you can install the server easily without scattering binaries and other artifacts on your system. Only pre-requisite is to [install docker](https://docs.docker.com/install). +With docker you can install the server easily without scattering binaries and other artifacts on your system. The only pre-requisite is to [install docker](https://docs.docker.com/install). ``` > docker pull nats:latest @@ -21,7 +21,7 @@ Status: Image is up to date for nats:latest docker.io/library/nats:latest ``` -To run nats on docker: +To run NATS on Docker: ``` > docker run -p 4222:4222 -ti nats:latest @@ -38,8 +38,8 @@ More information on [containerized NATS is available here](/nats_docker/README.m ### Installing on Kubernetes with NATS Operator -Installation via the NATS operator is beyond this tutorial. You can read about the [NATS -operator](https://github.com/nats-io/nats-operator) here. +Installation via the NATS Operator is beyond this tutorial. You can read about the [NATS +Operator](https://github.com/nats-io/nats-operator) here. ### Installing via a Package Manager @@ -69,7 +69,7 @@ To test your installation (provided the executable is visible to your shell): You can find the latest release of nats-server [here](https://github.com/nats-io/nats-server/releases/latest). -Download the zip file matching your systems architecture, and unzip. For this example, assuming version 2.0.0 of the server, and a Linux AMD64: +Download the zip file matching your systems architecture, and unzip. For this example, assuming version 2.0.0 of the server and a Linux AMD64: ``` > curl -L https://github.com/nats-io/nats-server/releases/download/v2.0.0/nats-server-v2.0.0-linux-amd64.zip -o nats-server.zip @@ -87,13 +87,13 @@ Archive: nats-server.zip ### Installing from the source -If you have go installed, installing the binary is easy: +If you have Go installed, installing the binary is easy: ``` > go get github.com/nats-io/nats-server ``` -This mechanism will install a build of [master](https://github.com/nats-io/nats-server), which almost certainly will not be a released version. If you are a developer and want to play with the latest, this is the easiest way of obtaining it. +This mechanism will install a build of [master](https://github.com/nats-io/nats-server), which almost certainly will not be a released version. If you are a developer and want to play with the latest, this is the easiest way. To test your installation (provided the $GOPATH/bin is set): diff --git a/nats_server/jwt_auth.md b/nats_server/jwt_auth.md index 1d5d2d9..e83ad70 100644 --- a/nats_server/jwt_auth.md +++ b/nats_server/jwt_auth.md @@ -3,9 +3,9 @@ _Accounts_ expand on [Accounts](accounts.md) and [NKeys](nkey_auth.md) authentication foundation to create a decentralized authentication and authorization model. -With other authentication mechanisms, configuration for identifying an user or an account is in the server configuration file. JWT authentication leverage [JSON Web Tokens (JWT)](https://jwt.io/) to describe the various entities supported. When a client connects, servers query for account JWTs and validate a trust chain. Users are not directly tracked by the server, but rather verified as belonging to an account. This enables the managing of users without requiring server configuration updates. +With other authentication mechanisms, configuration for identifying a user or an account is in the server configuration file. JWT authentication leverages [JSON Web Tokens (JWT)](https://jwt.io/) to describe the various entities supported. When a client connects, servers query for account JWTs and validate a trust chain. Users are not directly tracked by the server, but rather verified as belonging to an account. This enables the management of users without requiring server configuration updates. -Effectively, Accounts provide for a distributed configuration paradigm. Previously each user (or client) needed to be known and authorized a priori in the server’s configuration requiring an administrator to modify and update server configurations. Accounts eliminate these chores. +Effectively, accounts provide for a distributed configuration paradigm. Previously each user (or client) needed to be known and authorized a priori in the server’s configuration requiring an administrator to modify and update server configurations. Accounts eliminate these chores. ### JSON Web Tokens @@ -38,7 +38,7 @@ When a _User_ connects to a server, it presents a JWT issued by its _Account_. T ### The Authorization Process -From an authorization point of view, the Account provides information on messaging subjects that are imported from other accounts (including any ancillary related authorization) as well as messaging subjects exported to other accounts. Accounts can also bear limits, such as the maximum number of connections they may have. A user JWT can express restrictions on the messaging subjects that it can publish or subscribe to. +From an authorization point of view, the account provides information on messaging subjects that are imported from other accounts (including any ancillary related authorization) as well as messaging subjects exported to other accounts. Accounts can also bear limits, such as the maximum number of connections they may have. A user JWT can express restrictions on the messaging subjects to which it can publish or subscribe. When a new user is added to an account, the account configuration need not change, as each user can and should have its own user JWT that can be verified by simply resolving its parent account. @@ -50,7 +50,7 @@ One crucial detail to keep in mind is that while in other systems JWTs are used - the public ID of the entity that issued it - capabilities of the entity -Authentication is a public key cryptographic process — a client signs a nonce proving identity while the trust chain and configuration provides the authorization. +Authentication is a public key cryptographic process — a client signs a nonce proving identity while the trust chain and configuration provides the authorization. The server is never aware of private keys but can verify that a signer or issuer indeed matches a specified or known public key. @@ -58,7 +58,7 @@ Lastly, all NATS JWTs (Operators, Accounts, Users and others) are expected to be ### Sharing Between Accounts -While accounts provide isolation, there are many cases where you want to be able to consume messages produced by one account in another. There are two kinds of shares that an account can _export_: +While accounts provide isolation, there are many cases where you want to be able to consume messages produced by one account in another. There are two kinds of shares an account can _export_: - Streams - Services @@ -71,7 +71,7 @@ Streams and Services can be public; Public exports can be imported by any accoun An importing account can remap the subject where a stream subscriber will receive messages or where a service requestor can make requests. This enables the importing account to simplify their subject space. -Exports and imports from an account are explicit, and they are visible in the account's JWT. For private exports, the import will embed an authorization token or a URL storing the token. Imports and exports make it easy to audit where data is coming or going. +Exports and imports from an account are explicit, and they are visible in the account's JWT. For private exports, the import will embed an authorization token or a URL storing the token. Imports and exports make it easy to audit where data is coming from or going to. ### Configuration @@ -81,4 +81,4 @@ Entity JWT configuration is done using the [`nsc` tool](/nats_tools/nsc/README.m - [Configuring an Account Server](/nats_tools/nsc/nsc.md#account-server-configuration) - [Setting up the NATS server to resolve Accounts](/nats_tools/nsc/nsc.md#nats-server-configuration) -After that, `nsc` is used to create and edit accounts and users. \ No newline at end of file +After that, `nsc` is used to create and edit accounts and users.