qriton 0.4.0 → 0.4.1

package/README.md

@@ -203,14 +203,14 @@ A backup that sends your conversation from a local model to a hosted provider al
 
 ## Several qritons on one network
 
-Qriton instances on different machines can see each other and pass messages, for example asking the one on your Windows box to run the tests there. They meet through a [NATS](https://nats.io) server: any machine on your local network, or a relay on the internet ([Azure setup](https://unpkg.com/qriton/deploy/nats/README.md) is one option).
+Qriton instances on different machines can see each other and pass messages, for example asking the one on your Windows box to run the tests there. They meet through a [NATS](https://nats.io) server: any machine on your local network, or a relay on the internet ([Azure setup](https://unpkg.com/qriton/deploy/nats/README.md) is one option). `qriton mesh server` prints a ready server configuration that admits your machines.
 
 ```bash
 qriton mesh init nats://10.0.0.5:4222      # first machine: creates a group, prints an invite code
 qriton mesh join <code>                    # every other machine
 ```
 
-Then set `"mesh": { "enabled": true, "name": "laptop" }` in `~/.qriton/config.json` on each machine. In a session, `/peers` shows who is online (machine, project, model, busy or idle, and a fingerprint), `/tell <peer> <text>` sends a message, and `/mesh scan` finds NATS servers on your network. The model can also list peers and send messages; sending asks for approval unless you run in `full-auto`.
+Then set `"mesh": { "enabled": true, "name": "laptop" }` in `~/.qriton/config.json` on each machine. Interactive sessions join the mesh; one-off `-p` runs stay private. In a session, `/peers` shows who is online (machine, project, model, busy or idle, and a fingerprint), `/tell <peer> <text>` sends a message, and `/mesh scan` finds NATS servers on your network. The model can also list peers and send messages; sending asks for approval unless you run in `full-auto`.
 
 **Everything is end-to-end encrypted.** Each machine has its own keys, and every message is encrypted and signed before it leaves, so the NATS server, or anyone on the network, sees only random bytes on random-looking channels. Direct messages can be read by their recipient only, not even by other machines in the group. The invite code contains the group secret, so pass it only over a channel you trust. A relay on the internet also needs `tls://`, and per-machine keys (`qriton mesh status` prints the one to add to the server).
 

package/deploy/nats/README.md

@@ -40,7 +40,13 @@ Then close port 80 again (`az network nsg rule delete ...`, or open it only for
 
 ## 4. Configuration and machine keys
 
-Copy `nats-server.conf` and `nats-server.service` from this folder to `/etc/nats/nats-server.conf` and `/etc/systemd/system/nats-server.service`. On each machine that will join, run `qriton mesh status` and add its **NATS user key** to the `users` list:
+Copy `nats-server.service` from this folder to `/etc/systemd/system/nats-server.service`. For the configuration, collect each machine's **NATS user key** (`qriton mesh status` on it) and let qriton write the file, with your own machine's key included:
+
+```bash
+qriton mesh server tls /etc/nats/tls/fullchain.pem /etc/nats/tls/privkey.pem UD4K2P7Q... > nats-server.conf
+```
+
+Copy it to `/etc/nats/nats-server.conf`. Or start from `nats-server.conf` in this folder and add a line per machine to the `users` list:
 
 ```
 users = [