- Shipped
- September 23, 2026 at 12:16 PM UTC
- Author
- Kamo
- Commit
- cd6a7e3
NATS mapped every credential-less connection to the KAMO account (no_auth_user), and it listens on the host network of k1m1 — so any pod, the desktop VM or a machine on the LAN could read and forge the platform's realtime traffic without a password. That mapping is being removed (klusterservices 926986d). RAGService built its own jnats Options and never sent a login, so once it goes this service's KB_EVENTS / NOTE_EVENTS consumers would be refused. It now binds nats.username / nats.password — the NATS_USERNAME / NATS_PASSWORD env vars every Java service already receives from the *** Secret, the same pair the shared library's NatsConfig reads — and adds them to the Options when both are set. NatsConfigTest pins it (red without the userInfo call).