pubsub

gochannel is in-process; NATS is required for multi-instance and split-process deployments. gochannel (in-process) is the default and suitable for single-instance deployments. NATS is required for multi-instance deployments where multiple ssoosshd processes share a database.

Key	Type	Default
pubsub.backend	string	gochannel
pubsub.nats.url	string	empty
pubsub.nats.cert_file	string	empty
pubsub.nats.key_file	string	empty
pubsub.nats.ca_file	string	empty

backend

string, default gochannel

Selects which message-broker implementation to use. “gochannel” (default) is in-process, suitable for single-instance. “nats” is required for multi-instance deployments.

pubsub:
  backend: "gochannel"

nats

Holds NATS-specific configuration. Required when Backend is “nats”.

nats.url

string, default empty

The NATS server connection string, e.g. “nats://nats.example.com:4222”. Empty disables NATS (leaves Backend at gochannel).

pubsub:
  nats:
    url: ""

nats.cert_file

string, default empty

The path to the client certificate for mTLS authentication. Required when URL is set.

pubsub:
  nats:
    cert_file: ""

nats.key_file

string, default empty

The path to the client certificate’s private key. Required when URL is set.

pubsub:
  nats:
    key_file: ""

nats.ca_file

string, default empty

The path to the CA certificate to verify the NATS server. Required when URL is set.

pubsub:
  nats:
    ca_file: ""