# --- Required ---
# Space-separated list of NATS URLs. Use tls:// if your server requires TLS.
# Examples:
#   NATS_SERVERS="tls://nats01.example:4222"
#   NATS_SERVERS="nats://127.0.0.1:4222"
NATS_SERVERS="nats://cloud.ikeja.co.za:4222"

# --- Optional ---
# Queue group (leave empty to receive every registration message)
# NATS_QUEUE="registration-listeners"
NATS_NAME="registration-listener"
NATS_SUBJECT=v1.registration
# PRINT_RAW=1

# --- Auth (pick one; comment the rest) ---
# NATS_TOKEN="REDACTED_TOKEN"
# NATS_USER="username"
# NATS_PASS="password"

# If your NATS uses username/password:
NATS_USER="app"
NATS_PASS="quo3rooB-ooMaeph7-ao6Zohng-choh4ieM-ohNgieh5-Toh2vahy"

# If you have a .creds file mounted by the volume, reference it directly:
# NATS_CREDS="/opt/containers/nats-registration-listener/data/user.creds"

# Or inject it dynamically as base64 (entrypoint will write to DATA_DIR):
# NATS_CREDS_B64="BASE64_OF_USER.CREDS"

# --- TLS (server-auth only) ---
# Option A: pre-mounted CA path (host ./data -> container /opt/.../data)
# TLS_CA="/opt/containers/nats-registration-listener/data/8devices-root-ca.pem"

# Option B: inline PEM (entrypoint writes to DATA_DIR/tls-ca.pem)
TLS_CA_PEM="-----BEGIN CERTIFICATE-----
MIICbDCCAdUCFCFi1ReBpGi0EQ+iZylOYXXF15elMA0GCSqGSIb3DQEBCwUAMHQx
CzAJBgNVBAYTAkxUMQowCAYDVQQIDAEtMRAwDgYDVQQHDAdWaWxuaXVzMRUwEwYD
VQQKDAw4REVWSUNFUyBVQUIxDDAKBgNVBAsMA1ImRDEiMCAGA1UEAwwZOERFVklD
RVMgUHJvZHVjdHMgUm9vdCBDQTAgFw0yMDA0MTYxMzIzMjBaGA8yMTIwMDMyMzEz
MjMyMFowdDELMAkGA1UEBhMCTFQxCjAIBgNVBAgMAS0xEDAOBgNVBAcMB1ZpbG5p
dXMxFTATBgNVBAoMDDhERVZJQ0VTIFVBQjEMMAoGA1UECwwDUiZEMSIwIAYDVQQD
DBk4REVWSUNFUyBQcm9kdWN0cyBSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQC0e3L19mgARZgb7yc331S03L85F/q0MHhXGeNA8XJCnzfSIny0EzgM
nrWKVvPSUdmb6lF/M7SCnbw3Suf1UD8AQYgjDNNh513zK5MhnZCwNfnXxv6upx78
PAMzLgKmEixErl8syRB1pfkz1Fc6GbOtdtAvzbFBD8FsHuNBYJxgqQIDAQABMA0G
CSqGSIb3DQEBCwUAA4GBADq6R9k9Ob6aqHda9ZZ+0BbPtQzC38QNJ8QCh4AFSIsK
RrJEcyns1Qnh7/5+ZOY/UhU4h++uBuUVacH4DmOJgbxae/OXNAMcpbvYM2SZ6KfR
5eSeEAJ+t49b2SaanYhZFusrn1fi8JhJQ0wi5LYfmLz/Kf4zGGZj+IgR9QmwIcLf
-----END CERTIFICATE-----"

# Option C: base64 of the PEM (safer for .env with multi-line)
# TLS_CA_PEM_B64="BASE64_OF_PEM"

# Option D: fetch from URL at startup
# TLS_CA_URL="https://example.internal/8devices-root-ca.pem"

# Only disable hostname verification if absolutely necessary:
TLS_INSECURE=1