- Shipped
- September 23, 2026 at 12:08 PM UTC
- Author
- Kamo
- Commit
- 926986d
NATS runs on the host network of k1m1 and listens on 0.0.0.0, and its config mapped every credential-less connection to the KAMO account (no_auth_user: anon). So any pod in any namespace, the desktop VM and any machine on the LAN could open 192.168.4.22:4222 with no password and subscribe to `>` or publish into the platform's realtime traffic — chat, SMS, email and presence events for every org. Verified from the desktop namespace: CONNECT {} answered +OK / PONG. A NetworkPolicy cannot select a hostNetwork pod, so the password has to be the boundary. This is the first, non-breaking half: - KAMO gets a real user, kamo_svc. Its password lives only in Secrets (SECRETS.md); every password in nats.conf is now a bcrypt hash — the ratestack one keeps its value (its clients are outside this repo), sys is rotated, kamo_svc is new. - anon and no_auth_user stay for now, marked TRANSITION, so clients that do not present credentials yet keep working while they are moved over. The second half deletes both once /connz?auth=1 shows no connection authorized as anon. - The stream-bootstrap Job authenticates (the nats CLI reads NATS_USER / NATS_PASSWORD). - The deploy step now reloads nats-server after a ConfigMap change. It used to read the file only at start, so every config change silently waited for the next restart. Applied by hand before this commit: the ConfigMap plus a reload ("Reloaded: accounts"), the three Secrets, and NATS_USERNAME / NATS_PASSWORD added to ***. Checked live: kamo_svc gets PONG, a wrong password gets Authorization Violation, and the 53 existing connections stayed up.