ZAP (luxfi/zap) listener on port 9222 for binary RPC control plane
operations (create/delete/list streams, publish, health check).
HTTP management API on port 9280 wrapping NATS monitoring endpoints
and JetStream stream info. NATS client protocol on 4222 unchanged.
Makes the server generate a digest representing the expanded version of
the parsed configuration:
```
$ nats-server -c foo.conf -t
nats-server: configuration file configs/foo.conf is valid (sha256:e14d9fd914ee4a83c481c6bf97b44d7bc23d8f475f7f30af0c4e96ab4e5ad00c)
```
It can be inspected via `/varz`:
```
"config_load_time": "2023-07-19T14:28:28.77128Z",
"config_digest": "sha256:6a383afa5fa6e00262105fbf061cabf48db892d1aa677f491dbabe7894393413",
"system_account": "$SYS"
```
And it is also logged at runtime making it possible to check whether the
reload had side effects:
```
[1935] 2023/07/19 02:57:29.245020 [INF] Using configuration file: configs/foo.conf (sha256:6a383afa5fa6e00262105fbf061cabf48db892d1aa677f491dbabe7894393413)
...
[1935] 2023/07/19 02:58:06.993874 [DBG] Trapped "hangup" signal
...
[1935] 2023/07/19 02:58:06.996113 [INF] Reloaded server configuration (sha256:6a383afa5fa6e00262105fbf061cabf48db892d1aa677f491dbabe7894393413)
...
[1935] 2023/07/19 02:58:32.895492 [INF] Reloaded server configuration (sha256:a622fb453f3464b041de668b82229aef155175824f3c3a6d126a33268d172987)
[1935] 2023/07/19 02:58:44.615983 [DBG] Trapped "hangup" signal
...
[1935] 2023/07/19 02:58:44.617870 [INF] Reloaded server configuration (sha256:6a383afa5fa6e00262105fbf061cabf48db892d1aa677f491dbabe7894393413)
```
- [x] Reloader tests
- [x] Monitoring test
- [x] Build is green in Travis CI
- [X] You have certified that the contribution is your original work and
that you license the work to the project under the [Apache 2
license](https://github.com/nats-io/nats-server/blob/main/LICENSE)
---------
Signed-off-by: Waldemar Quevedo <wally@nats.io>
This is handy for client libraries that start the server as
external executable and pass command line arguments. Without
specifying the cluster name, routes can take time to establish
and cause some tests to fail.
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
This is the first checkin for JetStream. Has some rudimentary basics working.
TODO
1. Push vs pull mode for observables. (work queues)
2. Disk/File store, memory only for now.
3. clustering code - design shaping up well.
4. Finalize account import semantics.
5. Lots of other little things.
Signed-off-by: Derek Collison <derek@nats.io>
Changed code on Windows to not use svc code if running in interactive
mode. The original code was running svc.debug.Run() which uses service
code (Execute()) but from the command line. We don't need that.
Also reduced salt on bcrypt password for a config file that started
to cause failures due to test taking too long to finish.
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
Changed account lookup and validation failures to be more understandable by users.
Changed limits to be -1 for unlimited to match jwt pkg.
The limits changed exposed problems with options holding real objects causing issues with reload tests under race mode.
Longer term this code should be reworked such that options only hold config data, not real structs, etc.
Signed-off-by: Derek Collison <derek@nats.io>
Added update to parse and load operator JWTs.
Changed to add in signing keys from operator JWT to list of trusted keys.
Added URL account resolver.
Added account claim updates by system messages.
Signed-off-by: Derek Collison <derek@nats.io>
When changing something in the cluster, such as Timeout and doing
a config reload, the route could be closed with an `Authorization
Error` report. Moreover, the route would not try to reconnect,
even if specified as an explicit route.
There were 2 issues:
- When checking if a solicited route is still valid, we need to
check the Routes' URL against the URL that we try to connect
to but not compare the pointers, but either do a reflect
deep equal, or compare their String representation (this is
what I do in the PR).
- We should check route authorization only if this is an accepted
route, not an explicit one. The reason is that we a server
explicitly connect to another server, it does not get the remote
server's username and password. So the check would always fail.
Note: It is possible that a config reload even without any change
in the cluster triggers the code checking if routes are properly
authorized, and that happens if there is TLS specified. When
the reload code checks if config has changed, the TLSConfig
between the old and new seem to indicate a change, eventhough there
is apparently none. Another reload does not detect a change. I
suspect some internal state in TLSConfig that causes the
reflect.DeepEqual() to report a difference.
Note2: This commit also contains fixes to regex that staticcheck
would otherwise complain about (they did not have any special
character), and I have removed printing the usage on startup when
getting an error. The usage is still correctly printed if passing
a parameter that is unknown.
Resolves#719
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
There were some cases where override would not work. Any command
line parameter that would be set to the type default value (false
for boolean, "" for string, etc) would not be taken into account.
I moved all the flags parsing and options configuration into
a new function, which may help reduce code duplication in
NATS Streaming.
The other advantage of moving this in a function is that it
can now be unit tested.
I am also removing call to `RemoveSelfReference()` which attempted
to remove a route to self, which has been already solved at runtime
with detecting and ignoring a route to self.
This function would be invoked only when routes were defined in
the configuration file, not in the command line parameter.
Removing this call also solves an user issue (#577)
Resolves#574Resolves#577
Hanzo AI