feat: enhance with nkey authentication

docs/config.md

@@ -157,6 +157,7 @@ NATS can be configured with the following properties:
 * `maxreconnects` - the maximum number of reconnects to try before exiting the bridge with an error.
 * `tls` - (optional) [TLS configuration](#tls). If the NATS server uses unverified TLS with a valid certificate, this setting isn't required.
 * `usercredentials` - (optional) the path to a credentials file for connecting to NATs.
+* `NKeySeedPath` - (optional) the path to nkey file for authenticating to NATS
 
 <a name="stan"></a>
 

server/conf/conf.go

@@ -155,6 +155,7 @@ type NATSConfig struct {
 	ReconnectWait  int // milliseconds
 	MaxReconnects  int
 
+	NKeySeedPath    string
 	TLS             TLSConf
 	UserCredentials string
 }

server/core/nats.go

@@ -21,6 +21,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/nats-io/nkeys"
 	nats "github.com/nats-io/nats.go"
 	stan "github.com/nats-io/stan.go"
 )
@@ -80,7 +81,6 @@ func (server *NATSKafkaBridge) connectToNATS() error {
 	if !server.running {
 		return nil // already stopped
 	}
-
 	server.logger.Noticef("connecting to NATS core")
 
 	config := server.config.NATS
@@ -108,6 +108,24 @@ func (server *NATSKafkaBridge) connectToNATS() error {
 		options = append(options, nats.UserCredentials(config.UserCredentials))
 	}
 
+	if config.NKeySeedPath != "" {
+		// Read the NKey seed from a file
+		nkeySeed, err := os.ReadFile(config.NKeySeedPath)
+		if err != nil {
+			return nil
+		}
+
+		keyPair, err := nkeys.FromSeed([]byte(nkeySeed))
+		if err != nil {
+			return nil
+		}
+		signatureHandler := func(nonce []byte) ([]byte, error) {
+			return keyPair.Sign(nonce)
+		}
+		options = append(options, nats.Nkey(string(nkeySeed), signatureHandler))
+		server.logger.Noticef("Using nkey authentication")
+	}
+
 	nc, err := nats.Connect(strings.Join(config.Servers, ","),
 		options...,
 	)