Unrestricted admin (same shape as admin/volcanic-agents), password
delivered via Coolify env var NATS_EXTERNAL_APPS_PASSWORD. Doc updated
in both places that enumerate users. Plan file included for the record.
NATS's authorization.users entries don't accept a `token` field
(only `user+password`, `nkey`, or JWT). `token` at the top of the
authorization block is a single global token. NATS was crash-looping
with "unknown field 'token'" at line 20 col 32 of nats-server.conf.
Wire the NATS_VOLCANIC_AGENTS_TOKEN env var through the password
field instead. Env-var name stays the same — semantically the value
is still a bearer token, only the NATS field it's carried in changes.
CLAUDE.md and credentials.local.json updated accordingly.
Second entry in authorization.users with token auth, no permissions
block (so full admin). Token is supplied via NATS_VOLCANIC_AGENTS_TOKEN
Coolify env var and substituted into the inline config at compose parse
time. Local credentials.local.json (gitignored) holds the connection
details for both users.
Coolify's compose executor rewrites relative bind mounts to a persistent
app dir with no source file, causing docker to auto-create the mount
target as a directory and fail with "not a directory". Delivering the
config through configs.content instead avoids the rewrite entirely and
lets Docker Compose substitute NATS_USER/NATS_PASSWORD at parse time.
Configures a single NATS 2.10 service exposing a WebSocket listener on
:8080 (no_tls; Traefik terminates TLS at nats.volcanic.tes.gd) with
env-driven username/password auth and a persisted JetStream store.
tes