add config option to enable or disable TLS for nats

services/nats/pkg/command/server.go

@@ -38,25 +38,28 @@ func Server(cfg *config.Config) *cli.Command {
 
 			defer cancel()
 
-			// Generate a self-signing cert if no certificate is present
-			if err := pkgcrypto.GenCert(cfg.Nats.TLSCert, cfg.Nats.TLSKey, logger); err != nil {
-				logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
-			}
+			var tlsConf *tls.Config
+			if cfg.Nats.EnableTLS {
+				// Generate a self-signing cert if no certificate is present
+				if err := pkgcrypto.GenCert(cfg.Nats.TLSCert, cfg.Nats.TLSKey, logger); err != nil {
+					logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
+				}
 
-			crt, err := tls.LoadX509KeyPair(cfg.Nats.TLSCert, cfg.Nats.TLSKey)
-			if err != nil {
-				return err
-			}
+				crt, err := tls.LoadX509KeyPair(cfg.Nats.TLSCert, cfg.Nats.TLSKey)
+				if err != nil {
+					return err
+				}
 
-			clientAuth := tls.RequireAndVerifyClientCert
-			if cfg.Nats.TLSSkipVerifyClientCert {
-				clientAuth = tls.NoClientCert
-			}
+				clientAuth := tls.RequireAndVerifyClientCert
+				if cfg.Nats.TLSSkipVerifyClientCert {
+					clientAuth = tls.NoClientCert
+				}
 
-			tlsConf := &tls.Config{
-				MinVersion:   tls.VersionTLS12,
-				ClientAuth:   clientAuth,
-				Certificates: []tls.Certificate{crt},
+				tlsConf = &tls.Config{
+					MinVersion:   tls.VersionTLS12,
+					ClientAuth:   clientAuth,
+					Certificates: []tls.Certificate{crt},
+				}
 			}
 			natsServer, err := nats.NewNATSServer(
 				ctx,
@@ -66,6 +69,7 @@ func Server(cfg *config.Config) *cli.Command {
 				nats.ClusterID(cfg.Nats.ClusterID),
 				nats.StoreDir(cfg.Nats.StoreDir),
 				nats.TLSConfig(tlsConf),
+				nats.AllowNonTLS(!cfg.Nats.EnableTLS),
 			)
 			if err != nil {
 				return err