Organize local infrastructure and Vault secrets by service ownership

infra/local/nats/start.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+umask 077
+# Generated by Vault with hexadecimal encoding; never interpolates user input.
+case "$NATS_TOKEN" in ''|*[!0-9a-f]*) exit 1;; esac
+cat > /run/sxchnge/nats.conf <<CONFIG
+port: 4222
+http_port: 8222
+authorization { token: "$NATS_TOKEN" }
+jetstream { store_dir: "/data/jetstream" }
+CONFIG
+unset NATS_TOKEN
+exec nats-server -c /run/sxchnge/nats.conf