From ca2c415bcc402d54e9350727a9fa0bbfd55b1a0b Mon Sep 17 00:00:00 2001
From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:59:15 +0200
Subject: [PATCH] docs: do not promise NATS TLS instructions the HA guide does
 not have

---
 .../maintenance/scaling/high-availability-from-installer.mdx    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
index 35ceefda..159996e2 100644
--- a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
+++ b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
@@ -176,7 +176,7 @@ docker compose logs --since 2m netbird-server | grep -E 'redis cache|Connected t
 
 You should see `using redis cache at redis://redis.example.com:6379`, `Connected to NATS cluster` and `license validated`.
 
-Protect Redis and NATS with TLS and authentication, as the High Availability guide describes. Their credentials go in these two URLs, and the server writes both URLs to its log at startup, credentials included; the command above prints them. Keep the server's logs as private as `config.yaml`.
+Protect Redis and NATS with authentication, and with TLS if their traffic crosses a network you do not trust. Their credentials go in these two URLs, and the server writes both URLs to its log at startup, credentials included; the command above prints them. Keep the server's logs as private as `config.yaml`.
 
 ## Step 3: Move Relay to separate instances