marchon/dev-overview
Watch
1
0
Fork
You've already forked dev-overview
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add developer credentials: URLs, lab keys, NATS token, staff IAM, git

Browse source
This commit is contained in:
George Lambert 2026-09-14 13:50:45 -04:00
commit f850002f1c
1 changed files with 3364 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

271
05-developer-credentials.md Normal file
View file

@ -0,0 +1,271 @@
# Developer credentials and connection info
Lab pack for the Verae Time × Zapier stack on **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`). Values below were checked **2026-09-14**. These are **lab defaults**, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment.
Zapier cloud **never** gets a NATS URL or a Verae password.
## 1. Who you are talking to
| Host | Role |
|------|------|
| `70.88.205.138` | NS1 Proxmox. Public HTTPS + public NATS **client** edge |
| `10.10.10.20` | LXC 510 `verae-px-worker` (worm + tree) |
| `10.10.10.21–23` | LXC 511–513 `nats-a/b/c` JetStream cluster `verae` |
SSH to the box: `ssh marchon@70.88.205.138`
Git SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (port **2223**)
## 2. Public HTTPS doors (live)
Wildcard `*.zapier.georgelambert.org` → `70.88.205.138`.
| URL | Process | Port | Last check |
|-----|---------|------|------------|
| https://zapier.georgelambert.org/ | docs catalog | files | 200 |
| https://git.georgelambert.org/ | Forgejo | :443 / SSH :2223 | 200 |
| https://portal.zapier.georgelambert.org/ | access-web → `/portal/` | :3021 | 302 → portal |
| https://api.zapier.georgelambert.org/health | access-api | :3022 | 200 |
| https://leaf.zapier.georgelambert.org/health | access-leaf | :3023 | 200 |
| https://zap.zapier.georgelambert.org/health | access-zapier | :3024 | 200 |
| https://staff.zapier.georgelambert.org/ | access-staff | :3025 | 302 login |
| https://login.zapier.georgelambert.org/ | staff-session | :3027 | 200 |
| https://iam.zapier.georgelambert.org/health | staff-iam | :3028 | 200 (`users: 5`) |
| https://cs.zapier.georgelambert.org/ | customer-service | :3011 | 302 |
| https://sales.zapier.georgelambert.org/ | sales-pricing | :3012 | 302 |
| https://acct.zapier.georgelambert.org/ | accounting-export | :3013 | 302 |
| https://mw.zapier.georgelambert.org/health | middleware | :3100 | 200 `mockVerae:true` `natsConnected:true` |
| https://fleet.zapier.georgelambert.org/ | fleet console | :3850 | 302 |
| https://nats.zapier.georgelambert.org/ | NATS WebSocket (Caddy) | 14422 | **400** on GET (expected; it is WS) |
Loopback on NS1 (not public): zappier-edge **`127.0.0.1:13000`** (admin + Stripe + SQLite). Tunnel:
```bash
ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138
# then http://127.0.0.1:13000/admin and /docs
```
Operator console tunnel: `ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138`
## 3. NATS
### Internal cluster (workers, keep, fleet)
No token. Private `vmbr1` only.
```text
NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
JETSTREAM_REPLICAS=3
```
| Port | Bind | Use |
|------|------|-----|
| `:4222` | `10.10.10.21–23` | clients |
| `:6222` | same, `vmbr1` | cluster routes — **do not publish** |
| `:7422` | same | leaf hubs for the public edge — **do not publish** |
| `:8222` | `127.0.0.1` on each LXC | monitor |
From a laptop you **cannot** reach `10.10.10.x` unless you are on NS1 or you tunnel:
```bash
ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138
export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224
```
### Public client edge (token)
Live token (file `/etc/nats/public-edge.token` on NS1):
```text
4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9
```
```text
nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
wss://nats.zapier.georgelambert.org
```
`CONNECT` with that token returns `PONG` (checked 2026-09-14). `auth_required: true`. Server name `nats-public-edge`. **Do not** put this URL in Zapier. Recreate: `bash packages/verae-nats-cluster/scripts/expose-public.sh` on NS1.
Leftover lab listeners (ignore for new clients): host `127.0.0.1:4222` docker-proxy, `10.10.10.1:4222` socat. zappier-edge process still has `NATS_URL=nats://127.0.0.1:4222` — billing pubs may miss the 3-node cluster until that env is flipped.
nkeys/mTLS: **not** on. Isolation is LAN + token.
## 4. Middleware (jobs)
Live: `MOCK_VERAE=true`, `NATS_ENABLED=true`, cluster URL as above, `ADMIN_SECRET=change-me-admin` (default), `TOKEN_SECRET=dev-secret-change-me` (default).
### Lab tenant (created 2026-09-14 for this pack)
| Field | Value |
|-------|--------|
| tenantId | `tenant-dev-lab-local-89ab82de` |
| plan | free |
| API key | `zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun` |
| mock Verae user | `lab-dev` / `lab-dev-pass` |
| veraeUserId | `vu_20ed6029b99efb2e` |
Proven: `GET /zapier/v1/auth/me` → valid; `POST /zapier/v1/timestamp` → 202 `jobId`; wait → mock certificate `blockIndex: 42`.
```bash
KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun
curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
https://mw.zapier.georgelambert.org/zapier/v1/timestamp
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \
https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait
```
Customer API plane (forwards `x-api-key` to middleware):
```bash
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
https://api.zapier.georgelambert.org/v1/timestamp
```
`https://zap.zapier.georgelambert.org` is the Zapier **plane**. It does **not** currently forward `x-api-key` on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` and use a `zmw_…` key in the Zap.
Mint another key (mock Verae accepts any username/password):
```bash
curl -sS -H "content-type: application/json" \
-d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \
https://mw.zapier.georgelambert.org/zapier/v1/signup
```
Admin list/provision:
```bash
curl -sS -H "x-admin-secret: change-me-admin" \
https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants
```
## 5. Portal / zappier-edge (billing users)
SQLite `/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db`. Bind `127.0.0.1:13000`.
Seed **customer API keys** (`x-api-key` on edge `/v1/*`, **not** middleware `zmw_`):
| Customer | tier | key |
|----------|------|-----|
| Ada (free) | free | `key-ada` |
| Grace (pro) | pro | `key-grace` |
| Linus (business) | business | `key-linus` |
| Docs Capture | free | `key-021851970d8a22c6` |
These keys are for the **edge meter / portal**. Middleware jobs need a `zmw_…` key (section 4).
Seed **admin console** (`/admin`, `x-admin-key` or login):
| username | password |
|----------|----------|
| `admin` | `admin-dev-key` |
| `demo` | `$$$Adm1n###` |
`ZAPPIER_ADMIN_KEY` default on CS/sales/staff processes: `admin-dev-key`.
Stripe: **not** live (lab quotes only). Env `STRIPE_*` unset on the sampled edge process.
Signup more customers at https://portal.zapier.georgelambert.org/portal/
## 6. Staff IAM
https://login.zapier.georgelambert.org/ · https://iam.zapier.georgelambert.org/
Seed users (defaults; live IAM has these five):
| username | password | role |
|----------|----------|------|
| `admin` | `admin-dev-key` | owner |
| `cs` | `cs-dev-key` | cs |
| `sales` | `sales-dev-key` | sales |
| `accounting` | `acct-dev-key` | accounting |
| `operator` | `fleet-dev-key` | operator |
`STAFF_KEY` / session fallback: `admin-dev-key`.
## 7. Leaf plane
https://leaf.zapier.georgelambert.org/health → `verae.access.leaf.in`
Live: `LEAF_TOKEN=leaf-dev-token`
```bash
curl -sS -H "content-type: application/json" \
-d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \
https://leaf.zapier.georgelambert.org/
```
Billing targets are **denied** on this plane.
## 8. Git (Forgejo)
| | |
|--|--|
| Web | https://git.georgelambert.org/marchon/ |
| SSH | `ssh://git@git.georgelambert.org:2223/marchon/<name>.git` |
| User | `marchon` |
| Overview of routes | https://git.georgelambert.org/marchon/dev-overview |
| Monorepo | `master-zapier-plan-draft` |
| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |
```bash
GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git
```
Add your SSH public key on Forgejo (user **marchon** or a new account). Do not commit deploy tokens.
Clone-all:
```bash
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
cd verae-bootstrap
export VERAE_SRC=$HOME/verae-src
bash scripts/fetch.sh ns1-all-in-one
```
## 9. Environment cheat sheet (new worker on the cluster)
```bash
export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
export JETSTREAM_REPLICAS=3
export NATS_ENABLED=true
export MOCK_VERAE=true # flip to false only with live Verae login
export VERAE_API_BASE_URL=https://api.veraetime.net
export AUTHZ_URL=http://127.0.0.1:3020
export ZAPPIER_UPSTREAM=http://127.0.0.1:3100
export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000
export ZAPPIER_ADMIN_KEY=admin-dev-key
export LEAF_TOKEN=leaf-dev-token
export STAFF_IAM_URL=http://127.0.0.1:3028
```
Template worker: clone `verae-nats-process`, rename `verae.example.process.*`.
## 10. Not issued yet (blocked)
| Item | Why |
|------|-----|
| Zapier Platform deploy key / `zapier login` | operator has not logged the CLI in |
| Live `api.veraetime.net` username/password | `MOCK_VERAE=true`; JWT would stay in middleware |
| NATS nkeys / account creds | cluster is `$G` + LAN |
| Stripe live secret | lab only |
| lan-134 SSH worker | disabled |
When Zapier login exists: `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org`, auth field `api_key` = `zmw_…`.
When live Verae exists: middleware `MOCK_VERAE=false` + `VERAE_API_BASE_URL=https://api.veraetime.net` + working login. Zapier still never sees that password.
## 11. Related docs
- Routes: [01-nats-routes.md](01-nats-routes.md)
- Endpoint I/O: [02-endpoint-io.md](02-endpoint-io.md)
- Job path: [03-zapier-verae-path.md](03-zapier-verae-path.md)
- Gaps: [04-gaps-and-finish.md](04-gaps-and-finish.md)
- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf
- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf