#nats — Public Fediverse posts

Harden NATS listener: TLS 1.3 min, NKey auth, per-account subject permissions, and cert reload on SIGHUP without dropping connections. Config block for nats-server 2.10+. #nats #tls #ValtersIT https://www.valtersit.com/vault/harden-nats-listener-with-tls-13-nkey-auth-and-authorization-bdb8d0/

I've had #Forgejo webhooks set up in my #homelab for about a year. These notify machines of package builds so they can immediately update without waiting for a full deploy.

Prior to today I had Forgejo doing the fanout, with each machine configured as a webhook target. That's ~fine, except that it's maintenance when I add a machine or need to expand the webhooks to another org on my server, since they were just set up on my personal account.

Enter #NATS. If you know what #mqtt is, NATS is kind of like that with out of the box clustering.

I set up Core NATS on each machine in the lab and meshed them all together, such that I can publish a message on one machine on localhost and it shows up on every other machine on localhost ~immediately.

Now, Forgejo calls a single system webhook with every event, those events get copied directly onto a NATS topic, and each machine listens to whatever topic is relevant. Today that's just packages.

The neat thing that this adds is the ability for agents to subscribe to events ad hoc. For example, if an agent makes a Forgejo issue and asks for a decision from me, it will be able to set up a NATS subscriber for that specific issue. No polling and no requests back to Forgejo, it'll just get my response directly from the webhook message.

NATS: https://nats.io