fschade · Oct 15, 2026 · Oct 14, 2026
diff --git a/pkg/checks/checknats_test.go b/pkg/checks/checknats_test.go
@@ -0,0 +1,51 @@
+package checks_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/test-go/testify/require"
+
+	"github.com/opencloud-eu/opencloud/pkg/checks"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
+)
+
+func TestNewNatsCheckWithAuth(t *testing.T) {
+	ns, err := server.NewServer(&server.Options{
+		Host:     "127.0.0.1",
+		Port:     server.RANDOM_PORT,
+		NoLog:    true,
+		NoSigs:   true,
+		Username: "opencloud",
+		Password: "secret",
+	})
+	require.NoError(t, err)
+	go ns.Start()
+	t.Cleanup(ns.Shutdown)
+	require.True(t, ns.ReadyForConnections(5*time.Second))
+
+	addr := ns.ClientURL()
+	ctx := context.Background()
+
+	require.Error(t, checks.NewNatsCheck(addr)(ctx), "anonymous connection must be rejected")
+	require.Error(t, checks.NewNatsCheck(addr, nats.Auth("opencloud", "wrong"))(ctx))
+	require.NoError(t, checks.NewNatsCheck(addr, nats.Auth("opencloud", "secret"))(ctx))
+}
+
+func TestNewNatsCheckWithoutAuth(t *testing.T) {
+	ns, err := server.NewServer(&server.Options{
+		Host:   "127.0.0.1",
+		Port:   server.RANDOM_PORT,
+		NoLog:  true,
+		NoSigs: true,
+	})
+	require.NoError(t, err)
+	go ns.Start()
+	t.Cleanup(ns.Shutdown)
+	require.True(t, ns.ReadyForConnections(5*time.Second))
+
+	// no username configured: Auth adds no option and the secure option may be nil as well
+	require.NoError(t, checks.NewNatsCheck(ns.ClientURL(), nats.Secure(false, false, ""), nats.Auth("", ""))(context.Background()))
+}
diff --git a/pkg/nats/options.go b/pkg/nats/options.go
@@ -18,3 +18,11 @@ func Secure(enableTLS, insecure bool, rootCA string) nats.Option {
 	}
 	return nil
 }
+
+// Auth returns the option to authenticate with the given credentials, nil when no username is set.
+func Auth(username, password string) nats.Option {
+	if username != "" {
+		return nats.UserInfo(username, password)
+	}
+	return nil
+}
diff --git a/services/activitylog/pkg/server/debug/server.go b/services/activitylog/pkg/server/debug/server.go
@@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/antivirus/pkg/server/debug/server.go b/services/antivirus/pkg/server/debug/server.go
@@ -26,7 +26,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))).
 		WithCheck("antivirus reachability", func(ctx context.Context) error {
 			cfg := options.Config
 			switch cfg.Scanner.Type {

diff --git a/services/audit/pkg/server/debug/server.go b/services/audit/pkg/server/debug/server.go
@@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/auth-guest/pkg/server/debug/server.go b/services/auth-guest/pkg/server/debug/server.go
@@ -27,7 +27,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/clientlog/pkg/server/debug/server.go b/services/clientlog/pkg/server/debug/server.go
@@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/eventhistory/pkg/server/debug/server.go b/services/eventhistory/pkg/server/debug/server.go
@@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/gateway/pkg/server/debug/server.go b/services/gateway/pkg/server/debug/server.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,8 +19,15 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if options.Config.Cache.ProviderCacheStore == "nats-js-kv" && len(options.Config.Cache.ProviderCacheNodes) > 0 {
-				// no secureOption because we cannot yet configure tls for the cache store
-				return checks.NewNatsCheck(options.Config.Cache.ProviderCacheNodes[0])(ctx)
+				return checks.NewNatsCheck(
+					options.Config.Cache.ProviderCacheNodes[0],
+					nats.Secure(
+						options.Config.Cache.ProviderCacheEnableTLS,
+						options.Config.Cache.ProviderCacheTLSInsecure,
+						options.Config.Cache.ProviderCacheTLSRootCACertificate,
+					),
+					nats.Auth(options.Config.Cache.ProviderCacheAuthUsername, options.Config.Cache.ProviderCacheAuthPassword),
+				)(ctx)
 			}
 			return nil
 		})

diff --git a/services/graph/pkg/server/debug/server.go b/services/graph/pkg/server/debug/server.go
@@ -39,7 +39,7 @@ func Server(opts ...Option) (*http.Server, error) {
 			options.Config.Events.TLSRootCACertificate,
 		)
 		readyHandlerConfiguration = readyHandlerConfiguration.
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 	}
 
 	return debug.NewService(

diff --git a/services/notifications/pkg/server/debug/server.go b/services/notifications/pkg/server/debug/server.go
@@ -22,7 +22,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption, nats.Auth(options.Config.Notifications.Events.AuthUsername, options.Config.Notifications.Events.AuthPassword))).
 		WithCheck("smtp-check", checks.NewTCPCheck(options.Config.Notifications.SMTP.Host+":"+strconv.Itoa(options.Config.Notifications.SMTP.Port)))
 
 	return debug.NewService(

diff --git a/services/ocm/pkg/server/debug/server.go b/services/ocm/pkg/server/debug/server.go
@@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
 	return debug.NewService(

diff --git a/services/ocs/pkg/server/debug/server.go b/services/ocs/pkg/server/debug/server.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -21,8 +22,15 @@ func Server(opts ...Option) (*http.Server, error) {
 	readyHandlerConfiguration := healthHandlerConfiguration.
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if len(options.Config.SigningKeys.Nodes) > 0 {
-				// no secureOption because we cannot configure it
-				return checks.NewNatsCheck(options.Config.SigningKeys.Nodes[0])(ctx)
+				return checks.NewNatsCheck(
+					options.Config.SigningKeys.Nodes[0],
+					nats.Secure(
+						options.Config.SigningKeys.EnableTLS,
+						options.Config.SigningKeys.TLSInsecure,
+						options.Config.SigningKeys.TLSRootCACertificate,
+					),
+					nats.Auth(options.Config.SigningKeys.AuthUsername, options.Config.SigningKeys.AuthPassword),
+				)(ctx)
 			}
 			return nil
 		})

diff --git a/services/policies/pkg/server/debug/server.go b/services/policies/pkg/server/debug/server.go
@@ -29,7 +29,7 @@ func Server(opts ...Option) (*http.Server, error) {
 			options.Config.Events.TLSRootCACertificate,
 		)
 		readyHandlerConfiguration := healthHandlerConfiguration.
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 		natsCheckFactory = func() debug.Option { return debug.Ready(handlers.NewCheckHandler(readyHandlerConfiguration)) }
 	}

diff --git a/services/postprocessing/pkg/server/debug/server.go b/services/postprocessing/pkg/server/debug/server.go
@@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption, nats.Auth(options.Config.Postprocessing.Events.AuthUsername, options.Config.Postprocessing.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/proxy/pkg/server/debug/server.go b/services/proxy/pkg/server/debug/server.go
@@ -28,7 +28,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	var configDumpFunc http.HandlerFunc = configDump(options.Config)
 	return debug.NewService(

diff --git a/services/search/pkg/server/debug/server.go b/services/search/pkg/server/debug/server.go
@@ -26,7 +26,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))).
 		WithCheck("tika-check", func(ctx context.Context) error {
 			if options.Config.Extractor.Type == "tika" {
 				u, err := url.Parse(options.Config.Extractor.Tika.TikaURL)

diff --git a/services/sharing/pkg/server/debug/server.go b/services/sharing/pkg/server/debug/server.go
@@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
 	return debug.NewService(

diff --git a/services/sse/pkg/server/debug/server.go b/services/sse/pkg/server/debug/server.go
@@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

diff --git a/services/storage-users/pkg/server/debug/server.go b/services/storage-users/pkg/server/debug/server.go
@@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	)
 	readyHandler := handlers.NewCheckHandler(handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)),
 	)
 

diff --git a/services/userlog/pkg/server/debug/server.go b/services/userlog/pkg/server/debug/server.go
@@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		options.Config.Events.TLSRootCACertificate,
 	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword)))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),