taigrr/nats.docs
1
0
Fork 0
mirror of https://github.com/taigrr/nats.docs synced 2025-01-18 04:03:23 -08:00
Code Issues Projects Releases Wiki Activity

wip clustering and other auth configurations

Browse Source
This commit is contained in:
Alberto Ricart 2019-05-20 11:52:39 -05:00
parent 984632d020
commit 6cd3bcc24e
7 changed files with 129 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
SUMMARY.md
View File

@ -20,6 +20,7 @@
* [Authentication Timeout](nats_server/auth_timeout.md) * [Authentication Timeout](nats_server/auth_timeout.md)
* [Authorization](nats_server/authorization.md) * [Authorization](nats_server/authorization.md)
* [Clustering](nats_server/clustering.md) * [Clustering](nats_server/clustering.md)
* [Configuration](nats_server/cluster_config.md)
* [TLS Authentication](nats_server/cluster_tls.md) * [TLS Authentication](nats_server/cluster_tls.md)
* [Gateways](gateways/README.md) * [Gateways](gateways/README.md)
* [Configuration](gateways/gateway.md) * [Configuration](gateways/gateway.md)
@ -36,20 +37,21 @@
* [Configuration](sys_accounts/sysaccounts.md) * [Configuration](sys_accounts/sysaccounts.md)
### NATS Tools ### NATS Tools
* [mkpasswd](nats_tools/mkpasswd.md) * [Tools](nats_tools/README.md)
* [nk](nats_tools/nk.md) * [mkpasswd](nats_tools/mkpasswd.md)
* [nsc](nats_tools/nsc/README.md) * [nk](nats_tools/nk.md)
* [nsc](nats_tools/nsc/README.md)
* [Basics](nats_tools/nsc/nsc.md) * [Basics](nats_tools/nsc/nsc.md)
* [Streams](nats_tools/nsc/streams.md) * [Streams](nats_tools/nsc/streams.md)
* [Services](nats_tools/nsc/services.md) * [Services](nats_tools/nsc/services.md)
* [Signing Keys](nats_tools/nsc/signing_keys.md) * [Signing Keys](nats_tools/nsc/signing_keys.md)
* [nats account server](nats_tools/nas/README.md) * [nats-account-server](nats_tools/nas/README.md)
* [Basics](nats_tools/nas/nas_conf.md) * [Basics](nats_tools/nas/nas_conf.md)
* [Inspecting JWTs](nats_tools/nas/inspecting_jwts.md) * [Inspecting JWTs](nats_tools/nas/inspecting_jwts.md)
* [Memory Resolver](nats_tools/nas/mem_resolver.md) * [Memory Resolver](nats_tools/nas/mem_resolver.md)
* [NATS Top](nats_tools/nats_top/README.md) * [nats-top](nats_tools/nats_top/README.md)
* [Tutorial](nats_tools/nats_top/tutorial.md) * [Tutorial](nats_tools/nats_top/tutorial.md)
* [Benchmarking](nats_tools/natsbench.md) * [nats-bench](nats_tools/natsbench.md)
### NATS Containerization ### NATS Containerization
* [NATS.docker](nats_docker/README.md) * [NATS.docker](nats_docker/README.md)

17
gateways/gateway.md
View File

@ -69,7 +69,7 @@ Listening on [>]
| `name` | Name for this cluster, all gateways belonging to the same cluster, should specify the same name. | | `name` | Name for this cluster, all gateways belonging to the same cluster, should specify the same name. |
| `port` | Port where the gateway will listen for incomming gateway connections. | | `port` | Port where the gateway will listen for incomming gateway connections. |
| `reject_unknown` | If `true`, gateway will reject connections from gateways that are not configured in `gateways`. | | `reject_unknown` | If `true`, gateway will reject connections from gateways that are not configured in `gateways`. |
| `tls` | TLS configuration block (same as other nats-server `tls` configuration). | | `tls` | TLS configuration block (same as other [nats-server `tls` configuration](/nats_server/tls.md#tls-configuration)). |
@ -83,18 +83,3 @@ The `gateways` configuration block is a list of gateway entries with the followi
| `url` | Hostport `<host>:<port>` describing where the remote gateway can be reached. If multiple IPs are returned, one is randomly selected. | | `url` | Hostport `<host>:<port>` describing where the remote gateway can be reached. If multiple IPs are returned, one is randomly selected. |
| `urls` | A list of `url` | | `urls` | A list of `url` |
### `TLS` Configuration Block
| Property | Description |
| :------ | :---- |
| `ca_file` | TLS certificate authority file. |
| `cert_file` | TLS certificate file. |
| `cipher_suites` | When set, only the specified TLS cipher suites will be allowed. Values must match golang version used to build the server. |
| `curve_preferences` | List of TLS cypher curves to use in order. |
| `insecure` | Skip certificate verfication. |
| `key_file` | TLS certificate key file. |
| `timeout` | TLS handshake timeout in fractional seconds. |
| `verify_and_map` | If `true`, require and verify client certificates and use values map certificate values for authentication purposes. |
| `verify` | If `true`, require and verify client certificates. |

36
nats_server/auth_intro.md
View File

@ -11,3 +11,39 @@ The NATS server provides various ways of authenticating clients:
Authentication deals with allowing a NATS client to connect to the server. Authentication deals with allowing a NATS client to connect to the server.
With the exception of JWT authentication, authentication and authorization configuration is in the `authorization` block of the configuration. With the exception of JWT authentication, authentication and authorization configuration is in the `authorization` block of the configuration.
## Authorization Block
The `authorization` block provides _authentication_ configuration as well as _authorization_:
| Property | Description |
| :------ | :---- |
| [`token`](tokens.md) | Specifies a token that can be used to authenticate to the server |
| [`user`](username_password.md) | Specifies a single user name for clients to the server |
| [`password`](username_password.md) | Specifies a single password for clients to the server |
| `users` | A list of `user` configuration maps |
| `timeout` | Maximum number of seconds to wait for client authentication |
### User Configuration Map
A `user` configuration map specifies credentials and permissions options for a single user:
| Property | Description |
| :------ | :---- |
| [`user`](username_password.md) | username for client authentication |
| [`password`](username_password.md) | password for the user entry |
| [`nkey`](nkey_auth.md) | public nkey identifying an user |
| `permissions` | permissions map configuring subjects accessible to the user |
### Permissions Configuration Map
The `permissions` map specify subjects that can be subscribed to or published by the specified client.

34
nats_server/cluster_config.md Normal file
View File

@ -0,0 +1,34 @@
## Cluster Configuration
The `cluster` configuration map has the following configuration options:
| Property | Description |
| :------ | :---- |
| `listen` | host/port for inbound route connections |
| `authorization` | [authorization](authorization.md) map for configuring cluster clients. Supports `token`, `username`/`password` and `TLS authentication`. `permissions` are ignored. |
| `timeout` | Maximum amount of time (in seconds) to wait for a clustering connection to complete
| `tls` | A [`tls` configuration map](tls.md#tls-configuration) for securing the clustering connection |
| `routes` | A list of other servers (URLs) to cluster with. Self-routes are ignored. |
```ascii
cluster {
listen: localhost:4244 # host/port for inbound route connections
# Authorization for route connections
authorization {
user: route_user
# ./util/mkpasswd -p T0pS3cr3tT00!
password: $2a$11$xH8dkGrty1cBNtZjhPeWJewu/YPbSU.rXJWmS6SFilOBXzmZoMk9m
timeout: 0.5
}
# Routes are actively solicited and connected to from this server.
# Other servers can connect to us if they supply the correct credentials
# in their routes definitions from above.
routes = [
nats-route://user1:pass1@127.0.0.1:4245
nats-route://user2:pass2@127.0.0.1:4246
]
}
```

24
nats_server/configuration.md
View File

@ -97,6 +97,30 @@ authorization: {
> nats-server -c server.conf > nats-server -c server.conf
``` ```
### Configuration Properties
| Property | Description |
| :------ | :---- |
| [`authorization`](auth_intro.md) | configuration map for client authentication/authorization |
| [`cluster`](cluster_config.md) | configuration map for clustering configuration |
| `debug` | if `true` enable debug log messages |
| [`gateway`](/gateways/gateway.md) | Gateway configuration map |
| `host` | host for client connections |
| [`http_port`](monitoring.md) | http port for server monitoring |
| [`https_port`](monitoring.md) | https port for server monitoring |
| [`leafnode`](/leafnodes/leafnode_conf.md) | Leafnode configuration map |
| `listen` | host/port for client connections |
| `max_connections` | Maximum number of active client connections |
| `max_control_line` | Maximum length of a protocol line (including subject length) |
| `max_payload` | Maximum number of bytes in a message payload |
| `max_subscriptions` | Maximum numbers of subscriptions for a client connection |
| [`operator`](/nats_tools/nsc/nsc.md#nats-server-configuration) | path to an operator JWT |
| `port` | port for client connections |
| [`resolver`](/nats_tools/nsc/nsc.md#nats-server-configuration) | Resolver type `MEMORY` or `URL` for account JWTs |
| [`tls`](tls.md#tls-configuration) | configuration map for tls for client and http monitoring |
| `trace` | if `true` enable protocol trace log messages |
| `write_deadline` | Maximum number of seconds the server will block when writing a to a client (slow consumer) |
### Configuration Reloading ### Configuration Reloading

17
nats_server/tls.md
View File

@ -3,12 +3,17 @@
The NATS server uses modern TLS semantics to encrypt client, route and monitoring connections. The NATS server uses modern TLS semantics to encrypt client, route and monitoring connections.
Server configuration revolves around a `tls` map, which has the following properties: Server configuration revolves around a `tls` map, which has the following properties:
- `cert_file` - the server's certificate | Property | Description |
- `key_file` - the server's key file | :------ | :---- |
- `ca_file` - a certificate file providing the trust chain for the certificate authority (CA). Used to validate client certificates. | `ca_file` | TLS certificate authority file. |
- `timeout` - max seconds to allow for a TLS connection upgrade (default is 2 seconds) | `cert_file` | TLS certificate file. |
- `verify` - set to `true` if you want to verify client certs against the `ca_file` certificate. | `cipher_suites` | When set, only the specified TLS cipher suites will be allowed. Values must match golang version used to build the server. |
| `curve_preferences` | List of TLS cypher curves to use in order. |
| `insecure` | Skip certificate verfication. |
| `key_file` | TLS certificate key file. |
| `timeout` | TLS handshake timeout in fractional seconds. |
| `verify_and_map` | If `true`, require and verify client certificates and map certificate values for authentication purposes. |
| `verify` | If `true`, require and verify client certificates. |
The simplest configuration: The simplest configuration:
``` ```

9
nats_tools/README.md
View File

@ -1,5 +1,10 @@
## NATS Tools ## NATS Tools
The NATS Ecosystem has many tools, some interesting tools include: The NATS Ecosystem has many tools to support server configuration, enhance monitoring or tune performance:
- [NATS TOP (statistics)](nats_top/README.md) - [mkpasswd](nats_tools/mkpasswd.md) - Generates or bcrypts passwords
- [nk](nats_tools/nk.md) - Generate NKeys
- [nsc](nats_tools/nsc/README.md) - Configure Operators, Accounts and Users
- [nats account server](nats_tools/nas/README.md) - Serve Account JWTs
- [nats top](nats_tools/nats_top/README.md) - Monitor NATS Server
- [nats-bench](nats_tools/natsbench.md) - Benchmark NATS Server