No TLS, With Credentials

Plain ws://, but clients must authenticate — also enables System Service ($SYS.>) monitoring.

TLS off (ws://)

Credentials required

WS port 8080

nats-server.2.ok-cred.conf

1. Setup (nats-server.conf)

nats-server.conf

listen: 0.0.0.0:4222
http_port: 8222

# WebSocket transport — required for the browser to connect at all.
websocket {
  port: 8080
  no_tls: true
}

# JetStream — required for KV buckets and Streams.
jetstream {}

# Accounts + system account — required to receive $SYS.> events.
# JetStream cannot be enabled on the system account, so it lives only in
# APP; SYS exports its $SYS.> events to APP under a "sys." prefix so a
# single connection (user "app") sees everything.
system_account: SYS

accounts {
  SYS: {
    users: [
      { user: sys, password: "change-me-sys" }
    ]
    exports: [
      { stream: "$SYS.>", accounts: [APP] }
    ]
  }
  APP: {
    jetstream: enabled
    users: [
      { user: joes, password: "mypassword" }
    ]
    imports: [
      { stream: { account: SYS, subject: "$SYS.>" }, prefix: "sys" }
    ]
  }
}

One-time nats-cli setup

nats context add tutorial-with-auth \
  --server="nats://10.135.32.227:4222" \
  --user="app" --password="change-me-app" \
  --select

In Connection section, enter:

NATS server host: 10.135.32.227
WS port: 8080
TLS (wss): off
Username: app
Password: change-me-app

2. Creation of subject / KV bucket / stream

Subject

In the Subscriptions form: Type: Subject · Target: orders.>

No setup required — just add the subscription above.

KV Bucket

In the Subscriptions form: Type: KV Bucket · Target: my-bucket

nats kv add my-bucket

JetStream Stream

In the Subscriptions form: Type: JetStream Stream · Target: ORDERS · Filter: orders.created (optional)

nats stream add ORDERS --subjects "orders.>" --storage file \
  --retention limits --max-msgs=-1 --max-bytes=-1 --max-age=0 --defaults

System Service

In the Subscriptions form: Type: System Service · Target: sys.$SYS.>

No setup required — just add the subscription above.

No client-side setup needed — the SYS → APP export/import in nats-server.conf above already forwards every $SYS.> event to the "app" user under a "sys." prefix.

3. Message generation

Subject

nats pub orders.created '{"id": 1, "total": 42.5}'

KV Bucket

nats kv put my-bucket hello world

JetStream Stream

nats pub orders.created '{"id": 1}'

System Service

# any client activity produces $SYS events, e.g. a connect/disconnect:
nats pub foo bar

# to see the RAW (unprefixed) $SYS.> feed directly, connect as the sys user instead:
nats sub -s "nats://sys:[email protected]:4222" "\$SYS.>"

In the viewer, subscribe to sys.$SYS.> — not the raw $SYS.> — since that’s the prefix APP imports it under.

Open Spy NATS