Test env NATS cluster cut-over

nats.conf

@@ -0,0 +1,25 @@
+# Lab accounts sketch. Loopback only. Do not publish 4222.
+# INTERNAL: middleware, account-balance, authz, identity.
+# LEAF: access-leaf and remote leaf nodes — no billing.
+
+# Loopback sketch. The live 3-node test cluster is verae-nats-cluster
+# (10.10.10.21–23 on vmbr1) and currently runs without accounts so every
+# existing NATS_URL keeps working. Flip this file onto those guests only
+# after clients use nats://internal:internal-dev@host:4222.
+listen: 127.0.0.1:4222
+http: 127.0.0.1:8222
+jetstream {}
+
+accounts {
+  INTERNAL {
+    users = [ { user: internal, password: internal-dev } ]
+    jetstream: enabled
+  }
+  LEAF {
+    users = [ { user: leaf, password: leaf-dev } ]
+    exports = []
+    imports = []
+  }
+}
+# Subject restrictions for LEAF are enforced in policy.json + access-leaf
+# until this nats-server is started with full auth callout.