Security

Credentials and TLS are ConnectOptions settings: a user and password, a token, an NKey, a creds file, TLS with the service's own certificates.

Each login has a constructor that starts the options: with_user_and_password, with_token, with_nkey with the seed, and with_credentials with the contents of a .creds file (a JWT and its NKey seed). with_credentials_file reads the file itself and is async, so the synchronous app builder reads the file and passes its contents to with_credentials instead. An address may carry a user and a password as well: nats://user:password@host:4222.

A tls:// address or require_tls(true) makes the connection use TLS. add_root_certificates adds the certificate authority a private server is verified against, and add_client_certificate the certificate and key of mutual TLS. tls_client_config hands the client a whole rustls configuration. The certificate files are read when the broker connects, so a missing one fails startup.

Logging in and the TLS handshake happen on the server, so a TestApp test starts the same app in process and runs it without them. The generated AsyncAPI document reports the host and port of each address and never a credential.

Example

The service reaches a cluster over TLS and verifies it against its own certificate authority. The password comes from the environment.

Macros
Manual

examples/nats_broker_security.rs
/// The cluster over TLS: the server is verified against the service's own certificate
/// authority, and the service logs in with its user and password.
fn broker(password: &str) -> NatsBroker {
    NatsBroker::new("tls://nats-1.internal:4222,tls://nats-2.internal:4222").with_options(
        ConnectOptions::with_user_and_password("orders-svc".to_owned(), password.to_owned())
            .require_tls(true)
            .add_root_certificates(PathBuf::from("/etc/nats/ca.pem")),
    )
}

#[ruststream::app]
fn app() -> impl App {
    let password = env::var("NATS_PASSWORD").unwrap_or_default();
    RustStream::new(AppInfo::new("orders", "0.1.0")).with_broker(broker(&password), |b| {
        b.include(place);
    })
}

examples/manual/nats_broker_security.rs
/// The cluster over TLS: the server is verified against the service's own certificate
/// authority, and the service logs in with its user and password.
fn broker(password: &str) -> NatsBroker {
    NatsBroker::new("tls://nats-1.internal:4222,tls://nats-2.internal:4222").with_options(
        ConnectOptions::with_user_and_password("orders-svc".to_owned(), password.to_owned())
            .require_tls(true)
            .add_root_certificates(PathBuf::from("/etc/nats/ca.pem")),
    )
}

fn app() -> impl App {
    let password = env::var("NATS_PASSWORD").unwrap_or_default();
    RustStream::new(AppInfo::new("orders", "0.1.0")).with_broker(broker(&password), |b| {
        b.include(subscriber("orders.created", Place).build());
    })
}

Example​

Example