我的书签
添加书签
移除书签Streams
To add a stream to your account:
To review the stream export:
╭──────────────────────────────────────────────────────────────────────────────────────╮│ Account Details │├───────────────────────────┬──────────────────────────────────────────────────────────┤│ Name │ A ││ Account ID │ ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE ││ Issuer ID │ OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG ││ Issued │ 2019-12-05 13:35:42 UTC ││ Expires │ │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Max Connections │ Unlimited ││ Max Leaf Node Connections │ Unlimited ││ Max Data │ Unlimited ││ Max Exports │ Unlimited ││ Max Imports │ Unlimited ││ Max Msg Payload │ Unlimited ││ Max Subscriptions │ Unlimited ││ Exports Allows Wildcards │ True │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Imports │ None │╰───────────────────────────┴──────────────────────────────────────────────────────────╯╭───────────────────────────────────────────────────────────╮│ Exports │├──────┬────────┬─────────┬────────┬─────────────┬──────────┤│ Name │ Type │ Subject │ Public │ Revocations │ Tracking │├──────┼────────┼─────────┼────────┼─────────────┼──────────┤│ abc │ Stream │ a.b.c.> │ Yes │ 0 │ N/A │╰──────┴────────┴─────────┴────────┴─────────────┴──────────╯
Messages this account publishes on a.b.c.> will be forwarded to all accounts that import this stream.
Importing a Stream
Importing a stream enables you to receive messages that are published by a different Account. To import a Stream, you have to create an Import. To create an Import you need to know:
- The exporting account’s public key
- The subject where the stream is published
- You can map the stream’s subject to a different subject
- Self-imports are not valid; you can only import streams from other accounts.
To learn how to inspect a JWT from an account server, check this article.
> nsc add account B[ OK ] generated and stored account key "AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"[ OK ] added account "B"> nsc add import --src-account ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE --remote-subject "a.b.c.>"[ OK ] added stream import "a.b.c.>"
And verifying it:
> nsc describe account╭──────────────────────────────────────────────────────────────────────────────────────╮│ Account Details │├───────────────────────────┬──────────────────────────────────────────────────────────┤│ Name │ B ││ Account ID │ AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H ││ Issuer ID │ OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG ││ Issued │ 2019-12-05 13:39:55 UTC ││ Expires │ │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Max Connections │ Unlimited ││ Max Leaf Node Connections │ Unlimited ││ Max Exports │ Unlimited ││ Max Imports │ Unlimited ││ Max Msg Payload │ Unlimited ││ Max Subscriptions │ Unlimited ││ Exports Allows Wildcards │ True ││ Exports │ None │╰───────────────────────────┴──────────────────────────────────────────────────────────╯╭─────────────────────────────────────────────────────────────────────────────╮│ Imports │├─────────┬────────┬─────────┬──────────────┬─────────┬──────────────┬────────┤│ Name │ Type │ Remote │ Local/Prefix │ Expires │ From Account │ Public │├─────────┼────────┼─────────┼──────────────┼─────────┼──────────────┼────────┤│ a.b.c.> │ Stream │ a.b.c.> │ │ │ A │ Yes │╰─────────┴────────┴─────────┴──────────────┴─────────┴──────────────┴────────╯
Let’s also add a user to make requests from the service:
> nsc add user b[ OK ] generated and stored user key "UDKNTNEL5YD66U2FZZ2B3WX2PLJFKEFHAPJ3NWJBFF44PT76Y2RAVFVE"[ OK ] generated user creds file "~/.nkeys/creds/O/B/b.creds"[ OK ] added user "b" to account "B"
If you want to create a stream that is only accessible to accounts you designate you can create a private stream. The export will be visible in your account, but subscribing accounts will require an authorization token that must be created by you and generated specifically for the subscribing account.
The authorization token is simply a JWT signed by your account where you authorize the client account to import your export.
Creating a Private Stream Export
> nsc add export --subject "private.abc.*" --private --account A[ OK ] added private stream export "private.abc.*"
Similarly when we defined an export, but this time we added the --private flag. The other thing to note is that the subject for the request has a wildcard. This enables the account to map specific subjects to specifically authorized accounts.
> nsc describe account A╭──────────────────────────────────────────────────────────────────────────────────────╮│ Account Details │├───────────────────────────┬──────────────────────────────────────────────────────────┤│ Name │ A ││ Account ID │ ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE ││ Issuer ID │ OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG ││ Issued │ 2019-12-05 14:24:02 UTC ││ Expires │ │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Max Connections │ Unlimited ││ Max Leaf Node Connections │ Unlimited ││ Max Data │ Unlimited ││ Max Exports │ Unlimited ││ Max Imports │ Unlimited ││ Max Msg Payload │ Unlimited ││ Max Subscriptions │ Unlimited ││ Exports Allows Wildcards │ True │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Imports │ None │╰───────────────────────────┴──────────────────────────────────────────────────────────╯╭──────────────────────────────────────────────────────────────────────────╮│ Exports │├───────────────┬────────┬───────────────┬────────┬─────────────┬──────────┤│ Name │ Type │ Subject │ Public │ Revocations │ Tracking │├───────────────┼────────┼───────────────┼────────┼─────────────┼──────────┤│ abc │ Stream │ a.b.c.> │ Yes │ 0 │ N/A ││ private.abc.* │ Stream │ private.abc.* │ No │ 0 │ N/A │╰───────────────┴────────┴───────────────┴────────┴─────────────┴──────────╯
To generate a token, you’ll need to know the public key of the account importing the service. We can easily find the public key for account B by running:
> nsc list keys --account B╭──────────────────────────────────────────────────────────────────────────────────────────╮│ Keys │├────────┬──────────────────────────────────────────────────────────┬─────────────┬────────┤│ Entity │ Key │ Signing Key │ Stored │├────────┼──────────────────────────────────────────────────────────┼─────────────┼────────┤│ O │ OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG │ │ * ││ B │ AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H │ │ * │╰────────┴──────────────────────────────────────────────────────────┴─────────────┴────────╯
> nsc generate activation --account A --target-account AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H --subject private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H -o /tmp/activation.jwt[ OK ] wrote account description to "/tmp/activation.jwt"
The command took the account that has the export (‘A’), the public key of account B, the subject where the stream will publish to account B.
For completeness, the contents of the JWT file look like this:
When decoded it looks like this:
> nsc describe jwt -f /tmp/activation.jwt╭────────────────────────────────────────────────────────────────────────────────────────╮│ Activation │├─────────────────┬──────────────────────────────────────────────────────────────────────┤│ Name │ private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H ││ Account ID │ AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H ││ Issuer ID │ ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE ││ Issued │ 2019-12-05 14:26:13 UTC ││ Expires │ │├─────────────────┼──────────────────────────────────────────────────────────────────────┤│ Hash ID │ GWIS5YCSET4EXEOBXVMQKXAR4CLY4IIXFV4MEMRUXPSQ7L4YTZ4Q==== │├─────────────────┼──────────────────────────────────────────────────────────────────────┤│ Import Type │ Stream ││ Import Subject │ private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H │├─────────────────┼──────────────────────────────────────────────────────────────────────┤│ Max Messages │ Unlimited ││ Max Msg Payload │ Unlimited ││ Network Src │ Any ││ Time │ Any │╰─────────────────┴──────────────────────────────────────────────────────────────────────╯
The token can be shared directly with the client account.
Importing a Private Stream
> nsc add import --account B --token /tmp/activation.jwt[ OK ] added stream import "private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"
> nsc describe account B╭──────────────────────────────────────────────────────────────────────────────────────╮│ Account Details │├───────────────────────────┬──────────────────────────────────────────────────────────┤│ Name │ B ││ Account ID │ AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H ││ Issuer ID │ OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG ││ Issued │ 2019-12-05 14:29:16 UTC ││ Expires │ │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Max Connections │ Unlimited ││ Max Leaf Node Connections │ Unlimited ││ Max Data │ Unlimited ││ Max Exports │ Unlimited ││ Max Imports │ Unlimited ││ Max Msg Payload │ Unlimited ││ Max Subscriptions │ Unlimited ││ Exports Allows Wildcards │ True │├───────────────────────────┼──────────────────────────────────────────────────────────┤│ Exports │ None │╰───────────────────────────┴──────────────────────────────────────────────────────────╯╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Imports │├──────────────────────────────────────────────────────────────────────┬────────┬──────────────────────────────────────────────────────────────────────┬──────────────┬─────────┬──────────────┬────────┤│ Name │ Type │ Remote │ Local/Prefix │ Expires │ From Account │ Public │├──────────────────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────────────────┼──────────────┼─────────┼──────────────┼────────┤│ a.b.c.> │ Stream │ a.b.c.> │ │ │ A │ Yes ││ private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H │ Stream │ private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H │ │ │ A │ No │╰──────────────────────────────────────────────────────────────────────┴────────┴──────────────────────────────────────────────────────────────────────┴──────────────┴─────────┴──────────────┴────────╯
Testing the Private Stream
Testing a private stream is no different than a public one:
> nsc sub --account B --user b private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2HListening on [private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H]...> nsc pub --account A --user U private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H hello
