Okay, reporting back. Looks like the async-nats crate cannot connect to the Fly.io NATS server at fdaa::3.
I couldn’t remember how to do iptables things, so I SSH’d into a Fly.io instance, and from there did a ssh -R 1234:[fdaa::3]:4223 sam@my-dev-machine to access the NATS endpoint from my local machine for testing. I then wrote a simple Rust client that does this:
use color_eyre::Report;
#[tokio::main]
async fn main() -> Result<(), Report> {
let nc = async_nats::Options::with_user_pass("fly-org", "fly-token").connect("nats://127.0.0.1:1234").await?;
let sub = nc.subscribe("logs.>").await?;
while let Some(msg) = sub.next().await {
println!("{}", String::from_utf8(msg.data)?.to_owned());
}
Ok(())
}
This does not work, running it yields the following result:
$ cargo run
Error: cannot parse server info
I can, however, run the following successfully with the Go client:
package main
import (
"fmt"
"github.com/nats-io/nats.go"
"time"
)
func main() {
nc, err := nats.Connect("nats://fly-org:authToken@127.0.0.1:1234")
if err != nil {
panic(err)
}
sub, err := nc.SubscribeSync("logs.>")
if err != nil {
panic (err)
}
for {
msg, err := sub.NextMsg(time.Minute)
if err != nil {
panic (err)
}
fmt.Printf("%s\n", string(msg.Data))
}
}
That successfully yields the log stream in my Fly.io org.
Here’s the thing, I only just learned that NATS isn’t a terrifying shouted plural of Network Address Translation a couple of days ago. It’s possible my understanding of NATS is so limited that I’m doing something wrong in my Rust client code. Though I did confirm that authentication via with_user_pass in async-nats works via an integration test as part of that PR I previously linked so … 
From a cursory glance at fly.rs, it looks like it’s expecting to be able to get server info immediately on a new connection. I noticed that if I tried to run something like this with the natscli, I’d see this:
$ nats -s 'nats://127.0.0.1:1234' --user invidious --password $(fly auth token) server info
nats: error: no results received, ensure the account used has system privileges and appropriate permissions, try --help
And this is despite direct subscription working:
$ nats -s 'nats://127.0.0.1:1234' --user invidious --password $(fly auth token) sub 'logs.>'
14:06:20 Subscribing on logs.>
[#1] Received on "logs.>"
--SNIP--
/cc @steveberryman
). It’s much easier from one of your VMs though!