Reference

Server Config

While the NATS server has many flags that allow for simple testing of features, the NATS server products provide a flexible configuration format that combines the best of traditional formats and newer styles such as JSON and YAML.

Syntax

The NATS configuration file supports the following syntax:

  • Lines can be commented with # and //
  • Values can be assigned to properties with:
    • Equals sign: foo = 2
    • Colon: foo: 2
    • Whitespace: foo 2
  • Arrays are enclosed in brackets: ["a", "b", "c"]
  • Maps are enclosed in braces: {foo: 2}
  • Maps can be assigned with no key separator
  • Semicolons can be used as terminators

The NATS configuration file is parsed with UTF-8 encoding.

The NATS configuration in the file can also be rendered as a JSON object (with comments!), but to combine it with variables the variables still have to be unquoted.

Strings and Numbers

The configuration parser is very forgiving, as you have seen:

  • values can be a primitive, or a list, or a map
  • strings and numbers typically do the right thing
  • numbers support units such as, 1K for 1000, 1KB for 1024

String values that start with a digit or a dot '.' can create issues. To force such values as strings, quote them.

Bad Config:

listen: 127.0.0.1:4222
authorization: {
    # BAD!
    token: 3secret
}

Good Config:

listen: 127.0.0.1:4222
authorization: {
    token: "3secret"
}

Variables

Server configurations can specify variables. Variables allow you to reference a value from one or more sections in the configuration. Variables:

  • Are block-scoped
  • Are referenced with a $ prefix. They have to be unquoted when being referenced, for example an assigment like foo = "$example" will result in foo being the literal string "$example".
  • Can be resolved from environment variables having the same name

If the environment variable value begins with a number you may have trouble resolving it depending on the server version you are running.

# Define a variable in the config
TOKEN: "secret"

# Reference the variable
authorization {
    token: $TOKEN
}

A similar configuration, but this time, the value is in the environment:

# TOKEN is defined in the environment
authorization {
    token: $TOKEN
}

The environment variable can either be inlined (below) or previously exported.

TOKEN="hello" nats-server -c /config/file

Include Directive

The include directive allows you to split a server configuration into several files. This is useful for separating configuration into chunks that you can easily reuse between different servers.

Includes must use relative paths, and are relative to the main configuration (the one specified via the -c option):

server.conf:

listen: 127.0.0.1:4222
include ./auth.conf

Note that include is not followed by = or :, as it is a directive.

auth.conf:

authorization: {
    token: "f0oBar"
}

Starting the server only needs to refer to the top-level config containing the include.

nats-server -c server.conf
  • Default value: n/a
  • Hot reloadable: No

Values

TypeDescriptionChoices
object-

Properties

Connectivity

NameDescriptionTypeDefault
hostHost for client connections.string0.0.0.0
portPort for client connections. Use -1 for a random available port.integer4222
listen<host>:<port> for a client connections.string-
client_advertiseAdvertised client <host>:<port>. Useful for cluster setups behind a NAT.string-
tlsTLS configuration for client and HTTP monitoring.object-
allow_non_tlsAllow mixed TLS and non-TLS on the same port.boolean-
ocspOCSP Stapling is honored by default for certificates that have the status_request Must-Staple flag. If explicitly disabled, the server will not request staples even if Must-Staple is present.(multiple)true
mqttConfiguration for enabling the MQTT interface.object-
websocketConfiguration for enabling the WebSocket interface.object-

Centralized Auth

NameDescriptionTypeDefault
authorizationStatic single or multi-user declaration.object-
accountsStatic config-defined accounts.object-
no_auth_userName of the user that non-authenticated clients will inherit the authorization controls of. This must be a user defined in either the authorization or accounts block.string-

Decentralized Auth

NameDescriptionTypeDefault
operatorOne or more operator JWTs, either in files or inlined.(multiple)-
trusted_keysOne or more operator public keys to trust.string-
resolverTakes precedence over the value obtained from the operator if defined. If a string value is used, it must be MEMORY or URL(<url>) where where url is an HTTP endpoint pointing to the NATS account resolver. Note: the NATS account resolver is deprecated and the built-in NATS-based resolver should be used.(multiple)-
resolver_tlsobject-
resolver_preloadMap of account public key to the account JWT.string-
resolver_pinned_accounts(multiple)-
system_accountName or public key of the account that will be deemed the system account.string$SYS
no_system_accountboolean-

Clustering

NameDescriptionTypeDefault
clusterConfiguration for clustering a set of servers.object-
gatewayConfiguration for setting up gateway connections between clusters.object-

Leafnodes

NameDescriptionTypeDefault
leafnodesConfiguration for setting up leaf node connections.object-

JetStream

NameDescriptionTypeDefault
jetstream(multiple)false
store_dirDirectory to use for file-based JetStream storage.string-

Subject Mapping

NameDescriptionTypeDefault
mappings(multiple)-

Logging

NameDescriptionTypeDefault
debugIf true, enables debug log messages.booleanfalse
traceIf true, enables protocol trace log messages, excluding the system account.booleanfalse
trace_verboseIf true, enables protocol trace log messages, including the system account.booleanfalse
logtimeIf false, log without timestamps.stringtrue
logtime_utcIf true, log timestamps with be in UTC rather than the local timezone.stringfalse
logfileLog file name.string-
logfile_size_limitSize in bytes after the log file rolls over to a new one.integer0
syslogLog to syslog.booleanfalse
remote_syslogRemote syslog address.string-

Monitoring and Tracing

NameDescriptionTypeDefault
server_nameThe servers name, shows up in logging. Defaults to the generated server ID. When JetStream is used, within a domain, all server names need to be unique.string-
server_tagsOne or more tags associated with the server. This is currently used for placement of JetStream streams and consumers.(multiple)-
httpListen specification <host>:<port> for server monitoring.string-
httpsListen specification <host>:<port> for TLS server monitoring.string-
http_portHTTP port for server monitoring.integer-
https_portHTTPS port for server monitoring.integer-
http_base_pathBase path for monitoring endpoints.string-
connect_error_reportsNumber of attempts at which a repeated failed route, gateway or leaf node connection is reported. Connect attempts are made once every second.integer3600
reconnect_error_reportsNumber of failed attempt to reconnect a route, gateway or leaf node connection. Default is to report every attempt.integer1
max_traced_msg_lenSet a limit to the trace of the payload of a message.integer0

Runtime Configuration

NameDescriptionTypeDefault
max_control_lineMaximum length of a protocol line (including combined length of subject and queue group). Increasing this value may require client changes to be used. Applies to all traffic.string4KB
max_connectionsMaximum number of active client connections.string64K
max_payloadMaximum number of bytes in a message payload. Reducing this size may force you to implement chunking in your clients. Applies to client and leafnode payloads. It is not recommended to use values over 8MB but max_payload can be set up to 64MB. The max payload must be equal or smaller to the max_pending value.string1MB
max_pendingMaximum number of bytes buffered for a connection Applies to client connections. Note that applications can also set PendingLimits (number of messages and total size) for their subscriptions.string64MB
max_subscriptionsMaximum numbers of subscriptions per client and leafnode accounts connection. A value of 0 means unlimited.string0
max_subscription_tokensinteger-
ping_intervalDuration at which pings are sent to clients, leaf nodes and routes. In the presence of client traffic, such as messages or client side pings, the server will not send pings. Therefore it is recommended to keep this value bigger than what clients use.string2m
ping_maxAfter how many unanswered pings the server will allow before closing the connection.integer2
write_deadlineMaximum number of seconds the server will block when writing. Once this threshold is exceeded the connection will be closed. See slow consumer on how to deal with this on the client.duration10s
no_header_supportDisables support for message headers.boolean-
disable_sublist_cacheIf true, disable subscription caches for all accounts. This saves resources in situations where different subjects are used all the time.booleanfalse
lame_duck_durationMust be at least 30s.duration2m
lame_duck_grace_periodThis is the duration the server waits, after entering lame duck mode, before starting to close client connectionsduration10s
pidfilestring-
ports_file_dirstring-
prof_portinteger-
default_js_domainAccount to domain name mapping.string-
Previous
Overview