# Developer credentials and connection info

Lab pack for the Verae Time × Zapier stack on **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`). Values below were checked **2026-09-14**. These are **lab defaults**, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment.

Zapier cloud **never** gets a NATS URL or a Verae password.

## 1. Who you are talking to

| Host | Role |
|------|------|
| `70.88.205.138` | NS1 Proxmox. Public HTTPS + public NATS **client** edge |
| `10.10.10.20` | LXC 510 `verae-px-worker` (worm + tree) |
| `10.10.10.21–23` | LXC 511–513 `nats-a/b/c` JetStream cluster `verae` |

SSH to the box: `ssh marchon@70.88.205.138`  
Git SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (port **2223**)

## 2. Public HTTPS doors (live)

Wildcard `*.zapier.georgelambert.org` → `70.88.205.138`.

| URL | Process | Port | Last check |
|-----|---------|------|------------|
| https://zapier.georgelambert.org/ | docs catalog | files | 200 |
| https://git.georgelambert.org/ | Forgejo | :443 / SSH :2223 | 200 |
| https://portal.zapier.georgelambert.org/ | access-web → `/portal/` | :3021 | 302 → portal |
| https://api.zapier.georgelambert.org/health | access-api | :3022 | 200 |
| https://leaf.zapier.georgelambert.org/health | access-leaf | :3023 | 200 |
| https://zap.zapier.georgelambert.org/health | access-zapier | :3024 | 200 |
| https://staff.zapier.georgelambert.org/ | access-staff | :3025 | 302 login |
| https://login.zapier.georgelambert.org/ | staff-session | :3027 | 200 |
| https://iam.zapier.georgelambert.org/health | staff-iam | :3028 | 200 (`users: 5`) |
| https://cs.zapier.georgelambert.org/ | customer-service | :3011 | 302 |
| https://sales.zapier.georgelambert.org/ | sales-pricing | :3012 | 302 |
| https://acct.zapier.georgelambert.org/ | accounting-export | :3013 | 302 |
| https://mw.zapier.georgelambert.org/health | middleware | :3100 | 200 `mockVerae:true` `natsConnected:true` |
| https://fleet.zapier.georgelambert.org/ | fleet console | :3850 | 302 |
| https://nats.zapier.georgelambert.org/ | NATS WebSocket (Caddy) | 14422 | **400** on GET (expected; it is WS) |

Loopback on NS1 (not public): zappier-edge **`127.0.0.1:13000`** (admin + Stripe + SQLite). Tunnel:

```bash
ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138
# then http://127.0.0.1:13000/admin  and  /docs
```

Operator console tunnel: `ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138`

## 3. NATS

### Internal cluster (workers, keep, fleet)

No token. Private `vmbr1` only.

```text
NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
JETSTREAM_REPLICAS=3
```

| Port | Bind | Use |
|------|------|-----|
| `:4222` | `10.10.10.21–23` | clients |
| `:6222` | same, `vmbr1` | cluster routes — **do not publish** |
| `:7422` | same | leaf hubs for the public edge — **do not publish** |
| `:8222` | `127.0.0.1` on each LXC | monitor |

From a laptop you **cannot** reach `10.10.10.x` unless you are on NS1 or you tunnel:

```bash
ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138
export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224
```

### Public client edge (token)

Live token (file `/etc/nats/public-edge.token` on NS1):

```text
4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9
```

```text
nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
wss://nats.zapier.georgelambert.org
```

`CONNECT` with that token returns `PONG` (checked 2026-09-14). `auth_required: true`. Server name `nats-public-edge`. **Do not** put this URL in Zapier. Recreate: `bash packages/verae-nats-cluster/scripts/expose-public.sh` on NS1.

Leftover lab listeners (ignore for new clients): host `127.0.0.1:4222` docker-proxy, `10.10.10.1:4222` socat. zappier-edge process still has `NATS_URL=nats://127.0.0.1:4222` — billing pubs may miss the 3-node cluster until that env is flipped.

nkeys/mTLS: **not** on. Isolation is LAN + token.

## 4. Middleware (jobs)

Live: `MOCK_VERAE=true`, `NATS_ENABLED=true`, cluster URL as above, `ADMIN_SECRET=change-me-admin` (default), `TOKEN_SECRET=dev-secret-change-me` (default).

### Lab tenant (created 2026-09-14 for this pack)

| Field | Value |
|-------|--------|
| tenantId | `tenant-dev-lab-local-89ab82de` |
| plan | free |
| API key | `zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun` |
| mock Verae user | `lab-dev` / `lab-dev-pass` |
| veraeUserId | `vu_20ed6029b99efb2e` |

Proven: `GET /zapier/v1/auth/me` → valid; `POST /zapier/v1/timestamp` → 202 `jobId`; wait → mock certificate `blockIndex: 42`.

```bash
KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun

curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me

curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
  -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
  https://mw.zapier.georgelambert.org/zapier/v1/timestamp

curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
  -d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \
  https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait
```

Customer API plane (forwards `x-api-key` to middleware):

```bash
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
  -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
  https://api.zapier.georgelambert.org/v1/timestamp
```

`https://zap.zapier.georgelambert.org` is the Zapier **plane**. It does **not** currently forward `x-api-key` on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` and use a `zmw_…` key in the Zap.

Mint another key (mock Verae accepts any username/password):

```bash
curl -sS -H "content-type: application/json" \
  -d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \
  https://mw.zapier.georgelambert.org/zapier/v1/signup
```

Admin list/provision:

```bash
curl -sS -H "x-admin-secret: change-me-admin" \
  https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants
```

## 5. Portal / zappier-edge (billing users)

SQLite `/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db`. Bind `127.0.0.1:13000`.

Seed **customer API keys** (`x-api-key` on edge `/v1/*`, **not** middleware `zmw_`):

| Customer | tier | key |
|----------|------|-----|
| Ada (free) | free | `key-ada` |
| Grace (pro) | pro | `key-grace` |
| Linus (business) | business | `key-linus` |
| Docs Capture | free | `key-021851970d8a22c6` |

These keys are for the **edge meter / portal**. Middleware jobs need a `zmw_…` key (section 4).

Seed **admin console** (`/admin`, `x-admin-key` or login):

| username | password |
|----------|----------|
| `admin` | `admin-dev-key` |
| `demo` | `$$$Adm1n###` |

`ZAPPIER_ADMIN_KEY` default on CS/sales/staff processes: `admin-dev-key`.

Stripe: **not** live (lab quotes only). Env `STRIPE_*` unset on the sampled edge process.

Signup more customers at https://portal.zapier.georgelambert.org/portal/

## 6. Staff IAM

https://login.zapier.georgelambert.org/  ·  https://iam.zapier.georgelambert.org/

Seed users (defaults; live IAM has these five):

| username | password | role |
|----------|----------|------|
| `admin` | `admin-dev-key` | owner |
| `cs` | `cs-dev-key` | cs |
| `sales` | `sales-dev-key` | sales |
| `accounting` | `acct-dev-key` | accounting |
| `operator` | `fleet-dev-key` | operator |

`STAFF_KEY` / session fallback: `admin-dev-key`.

## 7. Leaf plane

https://leaf.zapier.georgelambert.org/health → `verae.access.leaf.in`

Live: `LEAF_TOKEN=leaf-dev-token`

```bash
curl -sS -H "content-type: application/json" \
  -d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \
  https://leaf.zapier.georgelambert.org/
```

Billing targets are **denied** on this plane.

## 8. Git (Forgejo)

| | |
|--|--|
| Web | https://git.georgelambert.org/marchon/ |
| SSH | `ssh://git@git.georgelambert.org:2223/marchon/<name>.git` |
| User | `marchon` |
| Overview of routes | https://git.georgelambert.org/marchon/dev-overview |
| Monorepo | `master-zapier-plan-draft` |
| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |

```bash
GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git
```

Add your SSH public key on Forgejo (user **marchon** or a new account). Do not commit deploy tokens.

Clone-all:

```bash
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
cd verae-bootstrap
export VERAE_SRC=$HOME/verae-src
bash scripts/fetch.sh ns1-all-in-one
```

## 9. Environment cheat sheet (new worker on the cluster)

```bash
export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
export JETSTREAM_REPLICAS=3
export NATS_ENABLED=true
export MOCK_VERAE=true          # flip to false only with live Verae login
export VERAE_API_BASE_URL=https://api.veraetime.net
export AUTHZ_URL=http://127.0.0.1:3020
export ZAPPIER_UPSTREAM=http://127.0.0.1:3100
export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000
export ZAPPIER_ADMIN_KEY=admin-dev-key
export LEAF_TOKEN=leaf-dev-token
export STAFF_IAM_URL=http://127.0.0.1:3028
```

Template worker: clone `verae-nats-process`, rename `verae.example.process.*`.

## 10. Not issued yet (blocked)

| Item | Why |
|------|-----|
| Zapier Platform deploy key / `zapier login` | operator has not logged the CLI in |
| Live `api.veraetime.net` username/password | `MOCK_VERAE=true`; JWT would stay in middleware |
| NATS nkeys / account creds | cluster is `$G` + LAN |
| Stripe live secret | lab only |
| lan-134 SSH worker | disabled |

When Zapier login exists: `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org`, auth field `api_key` = `zmw_…`.

When live Verae exists: middleware `MOCK_VERAE=false` + `VERAE_API_BASE_URL=https://api.veraetime.net` + working login. Zapier still never sees that password.

## 11. Related docs

- Routes: [01-nats-routes.md](01-nats-routes.md)
- Endpoint I/O: [02-endpoint-io.md](02-endpoint-io.md)
- Job path: [03-zapier-verae-path.md](03-zapier-verae-path.md)
- Gaps: [04-gaps-and-finish.md](04-gaps-and-finish.md)
- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf
- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf