# Lab accounts sketch. Loopback only. Do not publish 4222.
# INTERNAL: middleware, account-balance, authz, identity.
# LEAF: access-leaf and remote leaf nodes — no billing.

# Loopback sketch. The live 3-node test cluster is verae-nats-cluster
# (10.10.10.21–23 on vmbr1) and currently runs without accounts so every
# existing NATS_URL keeps working. Flip this file onto those guests only
# after clients use nats://internal:internal-dev@host:4222.
listen: 127.0.0.1:4222
http: 127.0.0.1:8222
jetstream {}

accounts {
  INTERNAL {
    users = [ { user: internal, password: internal-dev } ]
    jetstream: enabled
  }
  LEAF {
    users = [ { user: leaf, password: leaf-dev } ]
    exports = []
    imports = []
  }
}
# Subject restrictions for LEAF are enforced in policy.json + access-leaf
# until this nats-server is started with full auth callout.