{"record":{"id":"4229325a56ff6eab","repo":"nats-io/nats-server","slug":"system-account-q-can-not-be-in-default-js-domain","errorCode":null,"errorMessage":"system account %q can not be in default_js_domain","messagePattern":"system account %q can not be in default_js_domain","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jetstream.go","lineNumber":2917,"sourceCode":"\t\t\t\t}\n\t\t\t\tif !found {\n\t\t\t\t\treturn fmt.Errorf(\"in non operator mode, `default_js_domain` references non existing account %q\", a)\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tfor a := range o.JsAccDefaultDomain {\n\t\t\t\tif !nkeys.IsValidPublicAccountKey(a) {\n\t\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account name %q, which is not a valid public account nkey\", a)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor a, d := range o.JsAccDefaultDomain {\n\t\t\tsacc := DEFAULT_SYSTEM_ACCOUNT\n\t\t\tif o.SystemAccount != _EMPTY_ {\n\t\t\t\tsacc = o.SystemAccount\n\t\t\t}\n\t\t\tif a == sacc {\n\t\t\t\treturn fmt.Errorf(\"system account %q can not be in default_js_domain\", a)\n\t\t\t}\n\t\t\tif d == _EMPTY_ {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {\n\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account %q with invalid domain name %q\", a, d)\n\t\t\t}\n\t\t}\n\t}\n\tif o.JetStreamDomain != _EMPTY_ {\n\t\tif subj := fmt.Sprintf(jsDomainAPI, o.JetStreamDomain); !IsValidSubject(subj) {\n\t\t\treturn fmt.Errorf(\"invalid domain name: derived %q is not a valid subject\", subj)\n\t\t}\n\n\t\tif !isValidName(o.JetStreamDomain) {\n\t\t\treturn fmt.Errorf(\"invalid domain name: may not contain ., * or >\")\n\t\t}\n\t}","sourceCodeStart":2899,"sourceCodeEnd":2935,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream.go#L2899-L2935","documentation":"During JetStream option validation (ProcessOptions/JetStream config check), the server rejects a configuration where the system account appears as a key in jsacc_default_domain. The system account cannot be assigned a default JetStream domain because JetStream API domain routing for the system account is fixed. This is a pure startup configuration error: the server refuses to start or enable JetStream until the mapping is removed.","triggerScenarios":"Setting `jsacc_default_domain` (JsAccDefaultDomain map) with an entry whose key equals the system account (either the built-in default \"$SYS\" account or the explicitly configured `system_account`).","commonSituations":"Operators bulk-generating jsacc_default_domain entries for all accounts and accidentally including the system account; configs migrated from single-domain to multi-domain JetStream where the $SYS account was included by a template.","solutions":["Remove the system account (the value of `system_account`, or \"$SYS\" if unset) from the `jsacc_default_domain` map in the config file.","If you intended to set a domain for application accounts only, keep only non-system account entries in the map.","Restart the server; validation runs again at startup."],"exampleFix":"// before\njsacc_default_domain: {\n  \"$SYS\": \"domainA\"\n  \"APP\": \"domainA\"\n}\n// after\njsacc_default_domain: {\n  \"APP\": \"domainA\"\n}","handlingStrategy":"validation","validationCode":"sacc := \"$SYS\" // or your configured system_account\nif _, ok := cfg.JsAccDefaultDomain[sacc]; ok {\n    return fmt.Errorf(\"system account %q must not appear in jsacc_default_domain\", sacc)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the system account out of any programmatically generated jsacc_default_domain map.","Filter by configured system_account value before writing the map.","Validate server config in CI with nats-server --config ... --signal=quit style dry checks."],"tags":["jetstream","configuration","system-account"],"backgroundTag":"invalid-server-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}