Add leafnode sys bridge example

[bruth]

@jnmoyne I believe this is what Kevin asked for.. hub user that can bridge the system account in leaf nodes. Here is the output. If you scroll to the bottom the nats server list reports the leaf nodes.

[bruth]

@matthiashanel One follow-up question is that the single ops user in this example is being used for both leaf nodes, rather than a separate one per leaf node. I not sure if this is desirable or there is another way of handling this. Another question I had was regarding an explicit permissions that can/should be set on the ops user.

[bruth]

Just thought of something else.. this is a multi-operator setup, but if the leaf nodes use the same operator, could we instead create separate system accounts per leaf node? (Maybe that was the original, correct idea in the first place).

[bruth]

could we instead create separate system accounts per leaf node?

Nope, that doesn't work. When trying to use a different account in a leaf..

nats-server: system_account in config and operator JWT must be identical

[bruth]

What did work is this kind of config for a leaf in non-operator mode, which makes sense since its a separate auth model for the leaf.

server_name: leaf1
port: 4223
leafnodes: {
  remotes: [
    {
      url: "nats-leaf://0.0.0.0:7422",
      credentials: "path/to/ops.creds",
      account: "$SYS",
    }
  ]
}

accounts: {}

[matthiashanel]

is this using the signing key?

[matthiashanel]

I'm not sure if it helps this example if there is another operator.
Most users have one.

I wonder if for separate operators, ngs could serve as a showcase?

[matthiashanel]

could we instead create separate system accounts per leaf node?

Nope, that doesn't work. When trying to use a different account in a leaf..

nats-server: system_account in config and operator JWT must be identical

It could work if you clear the system_account from the operator jwt.
But then I'm not sure what that would get us.
Even if you have the same system account, you can always use it with remote credentials pointing to not the system account in the hub.