From a8c5877412e6d495166e4812257dd4b0233c957a Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 14 Aug 2026 12:57:08 +0200
Subject: [PATCH] fix(3112): nkey only, no username on the callout-exempt user

Measured against a running server built from this module's own rendered
config, not a hand-written one -- which is the fix to the method as much
as to the file. Two shapes died in a row: a bare name authenticates
anyone who sends it, and a name plus an nkey refuses to start at all
(nkey users do not take usernames or passwords).

A malformed key is fail-closed too, so the only way to a live server
here is a real key whose seed nobody but the responder holds.
---
 nix/host-modules/swarm-nats.nix | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 2c799b5d..73c0b756 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -16,7 +16,6 @@ let
   # authorizes.
   calloutAccount = "AUTH";
   clientAccount = "APP";
-  calloutUser = "auth";
 in
 {
   # The swarm's message queue: one NATS server, reached by every hive.
@@ -227,12 +226,22 @@ in
                 # container on the shared netns — the same class of hole
                 # this module exists to close, moved rather than fixed.
                 # Caught in review on the first version of this file.
-                ${calloutAccount}.users = [
-                  {
-                    user = calloutUser;
-                    nkey = cfg.calloutUserPublicKey;
-                  }
-                ];
+                # An nkey and NOTHING else, both halves measured against a
+                # running server rather than reasoned about:
+                #
+                #   { user = "auth"; }               → `CONNECT {"user":"auth"}`
+                #                                      is accepted with no
+                #                                      credential at all
+                #   { user = "auth"; nkey = "U…"; }  → refuses to START:
+                #                                      "Nkey users do not take
+                #                                      usernames or passwords"
+                #   { nkey = "U…"; }                 → what this is
+                #
+                # A malformed key is fail-closed too: the server exits with
+                # "Not a valid public nkey for a user" rather than starting
+                # with a hole. So the only way to get a live server here is
+                # a real key whose seed nobody but the responder holds.
+                ${calloutAccount}.users = [ { nkey = cfg.calloutUserPublicKey; } ];
                 ${clientAccount} = { };
               };
 
@@ -260,7 +269,7 @@ in
                 # to say yes.
                 auth_callout = {
                   issuer = cfg.calloutIssuerPublicKey;
-                  auth_users = [ calloutUser ];
+                  auth_users = [ cfg.calloutUserPublicKey ];
                   account = calloutAccount;
                 };
               };