nexus/cloud

15 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Connect Workers to Temporal Cloud with API keys

Run Workers with API key authentication: go run ./worker -target-host <namespace.account>.tmprl.cloud:7233 -namespace <namespace.account> -api-key <api-key>. This alternative to mTLS certificate authentication uses API keys for secure connection to Temporal Cloud.

Install tcld CLI for Temporal Cloud

To install the latest version of the tcld CLI on MacOS, run: brew install temporalio/brew/tcld. The tcld CLI is used to manage Temporal Cloud resources including Namespaces and Nexus Endpoints.

Connect caller Worker to Temporal Cloud with TLS certificates

Run the caller Worker with mTLS certificates: go run ./worker -target-host <namespace.account>.tmprl.cloud:7233 -namespace <namespace.account> -client-cert 'path/to/ca.pem' -client-key 'path/to/ca.key'

Run Worker connected to Temporal Cloud with mTLS

Run a Worker connected to Temporal Cloud using: `./gradlew -q execute -PmainClass=io.temporal.samples.nexus.handler.HandlerWorker --args="-target-host <your-target-namespace.account>.tmprl.cloud:7233 -namespace <your-target-namespace.account> -client-cert 'path/to/your/ca.pem' -client-key 'path/to/your/ca.key'"`. Use mTLS client certificates for secure authentication.

Standalone Nexus Operations with Temporal Cloud

The same code for Standalone Nexus Operations works against Temporal Cloud. Build the client from a ClientConfigProfile loaded from a TOML profile, pointing it at your Cloud Namespace or override the connection via TEMPORAL_* environment variables. No code changes are needed. For full details on connecting to Temporal Cloud, including Namespace creation, Nexus Endpoint setup, certificate generation, and authentication options, see the Nexus feature guide for Temporal Cloud configuration.

Generate mTLS certificates for Temporal Cloud Nexus

Generate mTLS client certificates for Temporal Cloud using tcld: ``` tcld gen ca --org $YOUR_ORG_NAME --validity-period 1y --ca-cert ca.pem --ca-key ca.key ``` These certificates will be valid for one year. Install the latest `tcld` CLI first (on macOS: `brew install temporalio/brew/tcld`).

Standalone Nexus Operations with Temporal Cloud

Code samples for Standalone Nexus Operations use loadClientConnectConfig() from @temporalio/envconfig, so the same code works against Temporal Cloud — just configure the connection via environment variables or a TOML profile. No code changes are needed.

Temporal Cloud Nexus Registry scope and access

Temporal Cloud includes a Global Nexus Registry scoped to your entire Account across all Namespaces. Workers in any Namespace can host Nexus Services for others to use.

Temporal Cloud Nexus built-in access controls

Temporal Cloud provides built-in access controls that allow you to restrict which caller Namespaces can use a Nexus Endpoint at runtime.

Temporal Cloud Nexus audit logging

Temporal Cloud streams Nexus Registry actions (create, update, delete Endpoints) to your audit log integration for audit logging of Nexus Registry activities.

Temporal Cloud Nexus multi-region connectivity

Nexus requests in Temporal Cloud route across Namespaces within and across AWS and GCP using a global mTLS-secured Envoy mesh. This is compatible with Namespaces that have High Availability as Endpoint targets.

Temporal Cloud Nexus Terraform support

Temporal Cloud supports managing Nexus Endpoints with the Temporal Cloud Terraform provider.

Create Nexus Endpoint in Temporal Cloud

In Temporal Cloud, create a Nexus Endpoint with: `tcld nexus endpoint create --name <my-nexus-endpoint-name> --target-task-queue my-handler-task-queue --target-namespace <my-target-namespace.account> --allow-namespace <my-caller-namespace.account>`. You must have a Developer account role or higher and NamespaceAdmin permission on the target-namespace. The `--allow-namespace` flag builds an allowlist of caller Namespaces that can use the endpoint.

Generate mTLS certificates for Temporal Cloud

Generate mTLS certificates for Temporal Cloud using: `tcld gen ca --org $YOUR_ORG_NAME --validity-period 1y --ca-cert ca.pem --ca-key ca.key`. These certificates will be valid for one year and are used for secure mTLS Worker authentication to Temporal Cloud.

Create Namespaces in Temporal Cloud for Nexus

Create caller and handler Namespaces in Temporal Cloud using: `tcld namespace create --namespace <namespace-name> --cloud-provider aws --region us-west-2 --ca-certificate-file 'path/to/ca.pem' --retention-days 1`. Do this for both the caller and target (handler) namespaces before deploying Nexus.

Give your agent this brain