docker-compose.yml

---
version: '3'
services:
  external.example.net:
    image: nats
    command: >-
      --tlscert /etc/nats/tls/external.example.net.cert
      --tlskey /etc/nats/tls/external.example.net_u.key
      --tlscacert /etc/nats/tls/ca-cert.pem
      --client_advertise external.example.net:4222
      --config /etc/nats/external.conf
    networks:
      - external
      - shared
    volumes:
      - "./tls:/etc/nats/tls"
      - "./external.conf:/etc/nats/external.conf"
    ports:
      - 4222:4222

  internal1.example.net: &internal
    image: nats
    command: >-
      --cluster nats://0.0.0.0:6222
      --routes nats://internal1.example.net:6222,nats://internal2.example.net:6222
      --config /etc/nats/internal.conf
    networks:
      - shared
    volumes:
      - "./internal.conf:/etc/nats/internal.conf"
    ports:
      - 4223:4222

  internal2.example.net:
    <<: *internal
    ports:
      - 4224:4222

networks:
  shared: {}
  external: {}

external.conf

gateway {
    name: "EXTERNAL"
    listen: "0.0.0.0:7222"
    authorization {
        user: gwu
        password: gwp
    }

    gateways: [
        {name: "INTERNAL", url: "nats://gwu:gwp@internal1.example.net:7222"},
        {name: "INTERNAL", url: "nats://gwu:gwp@internal2.example.net:7222"}
    ]
}

internal.conf

gateway {
    name: "INTERNAL"
    listen: "0.0.0.0:7222"
    authorization {
        user: gwu
        password: gwp
    }

    gateways: [
        {name: "EXTERNAL", url: "nats://gwu:gwp@external.example.net:7222"}
    ]
}