Improve NATS config

server/config.go

@@ -7,9 +7,15 @@ import (
 )
 
 type Config struct {
-	ListenAddr  string `toml:"ListenAddr"`
-	NATSAddr    string `toml:"NATSAddr"`
-	NATSSubject string `toml:"NATSSubject"`
+	ListenAddr string      `toml:"ListenAddr"`
+	NATS       *NATSConfig `toml:"NATS"`
+}
+
+type NATSConfig struct {
+	Enabled  bool   `toml:"Enabled"`
+	NKeySeed string `toml:"NKeySeed"`
+	Addr     string `toml:"Addr"`
+	Subject  string `toml:"Subject"`
 }
 
 func ConfigFromReader(r io.Reader) (*Config, error) {

server/server.go

@@ -17,6 +17,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nkeys"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
 	"go.opentelemetry.io/otel/propagation"
@@ -77,12 +78,29 @@ func NewServer(config *Config) (*UserServer, error) {
 
 	srv.Logger.Warn("Initial admin-user created.", "username", u.Username, "password", password)
 
-	conn, err := nats.Connect(config.NATSAddr)
+	if config.NATS.Enabled {
+		var opts []nats.Option
+		if config.NATS.NKeySeed != "" {
+			keys, err := nkeys.FromSeed([]byte(config.NATS.NKeySeed))
+			if err != nil {
+				return nil, err
+			}
+			pubkey, err := keys.PublicKey()
+			if err != nil {
+				return nil, err
+			}
+			srv.Logger.Debug("NATS enabled with NKeys", "pubkey", pubkey)
+			creds := nats.Nkey(pubkey, keys.Sign)
+			opts = append(opts, creds)
+		}
+
+		conn, err := nats.Connect(config.NATS.Addr, opts...)
 	if err != nil {
 		return nil, err
 	}
 
 	srv.nats = conn
+	}
 
 	return srv, nil
 }
@@ -162,7 +180,7 @@ func (s *UserServer) CreateUserHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Message
-	sub := fmt.Sprintf("%s.%s", s.config.NATSSubject, "create")
+	sub := fmt.Sprintf("%s.%s", s.config.NATS.Subject, "create")
 
 	var buf bytes.Buffer
 	msg := &users.MsgUserCreate{
@@ -267,7 +285,7 @@ func (s *UserServer) SetPasswordHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	sub := fmt.Sprintf("%s.%s", s.config.NATSSubject, "update")
+	sub := fmt.Sprintf("%s.%s", s.config.NATS.Subject, "update")
 	var buf bytes.Buffer
 	encoder := json.NewEncoder(&buf)
 	_ = encoder.Encode(&users.MsgUserUpdate{Message: "Password updated", ID: u.ID})