10 KiB
Developer credentials and connection info
Lab pack for the Verae Time × Zapier stack on NS1.GEORGELAMBERT.ORG (70.88.205.138). Values below were checked 2026-09-14. These are lab defaults, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment.
Zapier cloud never gets a NATS URL or a Verae password.
1. Who you are talking to
| Host | Role |
|---|---|
70.88.205.138 |
NS1 Proxmox. Public HTTPS + public NATS client edge |
10.10.10.20 |
LXC 510 verae-px-worker (worm + tree) |
10.10.10.21–23 |
LXC 511–513 nats-a/b/c JetStream cluster verae |
SSH to the box: ssh marchon@70.88.205.138
Git SSH: ssh://git@git.georgelambert.org:2223/marchon/<repo>.git (port 2223)
2. Public HTTPS doors (live)
Wildcard *.zapier.georgelambert.org → 70.88.205.138.
Loopback on NS1 (not public): zappier-edge 127.0.0.1:13000 (admin + Stripe + SQLite). Tunnel:
ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138
# then http://127.0.0.1:13000/admin and /docs
Operator console tunnel: ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138
3. NATS
Internal cluster (workers, keep, fleet)
No token. Private vmbr1 only.
NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
JETSTREAM_REPLICAS=3
| Port | Bind | Use |
|---|---|---|
:4222 |
10.10.10.21–23 |
clients |
:6222 |
same, vmbr1 |
cluster routes — do not publish |
:7422 |
same | leaf hubs for the public edge — do not publish |
:8222 |
127.0.0.1 on each LXC |
monitor |
From a laptop you cannot reach 10.10.10.x unless you are on NS1 or you tunnel:
ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138
export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224
Public client edge (token)
Live token (file /etc/nats/public-edge.token on NS1):
4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9
nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
wss://nats.zapier.georgelambert.org
CONNECT with that token returns PONG (checked 2026-09-14). auth_required: true. Server name nats-public-edge. Do not put this URL in Zapier. Recreate: bash packages/verae-nats-cluster/scripts/expose-public.sh on NS1.
Leftover lab listeners (ignore for new clients): host 127.0.0.1:4222 docker-proxy, 10.10.10.1:4222 socat. zappier-edge process still has NATS_URL=nats://127.0.0.1:4222 — billing pubs may miss the 3-node cluster until that env is flipped.
nkeys/mTLS: not on. Isolation is LAN + token.
4. Middleware (jobs)
Live: MOCK_VERAE=true, NATS_ENABLED=true, cluster URL as above, ADMIN_SECRET=change-me-admin (default), TOKEN_SECRET=dev-secret-change-me (default).
Lab tenant (created 2026-09-14 for this pack)
| Field | Value |
|---|---|
| tenantId | tenant-dev-lab-local-89ab82de |
| plan | free |
| API key | zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun |
| mock Verae user | lab-dev / lab-dev-pass |
| veraeUserId | vu_20ed6029b99efb2e |
Proven: GET /zapier/v1/auth/me → valid; POST /zapier/v1/timestamp → 202 jobId; wait → mock certificate blockIndex: 42.
KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun
curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
https://mw.zapier.georgelambert.org/zapier/v1/timestamp
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \
https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait
Customer API plane (forwards x-api-key to middleware):
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
https://api.zapier.georgelambert.org/v1/timestamp
https://zap.zapier.georgelambert.org is the Zapier plane. It does not currently forward x-api-key on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org and use a zmw_… key in the Zap.
Mint another key (mock Verae accepts any username/password):
curl -sS -H "content-type: application/json" \
-d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \
https://mw.zapier.georgelambert.org/zapier/v1/signup
Admin list/provision:
curl -sS -H "x-admin-secret: change-me-admin" \
https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants
5. Portal / zappier-edge (billing users)
SQLite /SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db. Bind 127.0.0.1:13000.
Seed customer API keys (x-api-key on edge /v1/*, not middleware zmw_):
| Customer | tier | key |
|---|---|---|
| Ada (free) | free | key-ada |
| Grace (pro) | pro | key-grace |
| Linus (business) | business | key-linus |
| Docs Capture | free | key-021851970d8a22c6 |
These keys are for the edge meter / portal. Middleware jobs need a zmw_… key (section 4).
Seed admin console (/admin, x-admin-key or login):
| username | password |
|---|---|
admin |
admin-dev-key |
demo |
$$$Adm1n### |
ZAPPIER_ADMIN_KEY default on CS/sales/staff processes: admin-dev-key.
Stripe: not live (lab quotes only). Env STRIPE_* unset on the sampled edge process.
Signup more customers at https://portal.zapier.georgelambert.org/portal/
6. Staff IAM
https://login.zapier.georgelambert.org/ · https://iam.zapier.georgelambert.org/
Seed users (defaults; live IAM has these five):
| username | password | role |
|---|---|---|
admin |
admin-dev-key |
owner |
cs |
cs-dev-key |
cs |
sales |
sales-dev-key |
sales |
accounting |
acct-dev-key |
accounting |
operator |
fleet-dev-key |
operator |
STAFF_KEY / session fallback: admin-dev-key.
7. Leaf plane
https://leaf.zapier.georgelambert.org/health → verae.access.leaf.in
Live: LEAF_TOKEN=leaf-dev-token
curl -sS -H "content-type: application/json" \
-d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \
https://leaf.zapier.georgelambert.org/
Billing targets are denied on this plane.
8. Git (Forgejo)
| Web | https://git.georgelambert.org/marchon/ |
| SSH | ssh://git@git.georgelambert.org:2223/marchon/<name>.git |
| User | marchon |
| Overview of routes | https://git.georgelambert.org/marchon/dev-overview |
| Monorepo | master-zapier-plan-draft |
| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |
GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git
Add your SSH public key on Forgejo (user marchon or a new account). Do not commit deploy tokens.
Clone-all:
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
cd verae-bootstrap
export VERAE_SRC=$HOME/verae-src
bash scripts/fetch.sh ns1-all-in-one
9. Environment cheat sheet (new worker on the cluster)
export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
export JETSTREAM_REPLICAS=3
export NATS_ENABLED=true
export MOCK_VERAE=true # flip to false only with live Verae login
export VERAE_API_BASE_URL=https://api.veraetime.net
export AUTHZ_URL=http://127.0.0.1:3020
export ZAPPIER_UPSTREAM=http://127.0.0.1:3100
export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000
export ZAPPIER_ADMIN_KEY=admin-dev-key
export LEAF_TOKEN=leaf-dev-token
export STAFF_IAM_URL=http://127.0.0.1:3028
Template worker: clone verae-nats-process, rename verae.example.process.*.
10. Not issued yet (blocked)
| Item | Why |
|---|---|
Zapier Platform deploy key / zapier login |
operator has not logged the CLI in |
Live api.veraetime.net username/password |
MOCK_VERAE=true; JWT would stay in middleware |
| NATS nkeys / account creds | cluster is $G + LAN |
| Stripe live secret | lab only |
| lan-134 SSH worker | disabled |
When Zapier login exists: MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org, auth field api_key = zmw_….
When live Verae exists: middleware MOCK_VERAE=false + VERAE_API_BASE_URL=https://api.veraetime.net + working login. Zapier still never sees that password.
11. Related docs
- Routes: 01-nats-routes.md
- Endpoint I/O: 02-endpoint-io.md
- Job path: 03-zapier-verae-path.md
- Gaps: 04-gaps-and-finish.md
- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf
- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf