271 lines
10 KiB
Markdown
271 lines
10 KiB
Markdown
# Developer credentials and connection info
|
||
|
||
Lab pack for the Verae Time × Zapier stack on **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`). Values below were checked **2026-09-14**. These are **lab defaults**, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment.
|
||
|
||
Zapier cloud **never** gets a NATS URL or a Verae password.
|
||
|
||
## 1. Who you are talking to
|
||
|
||
| Host | Role |
|
||
|------|------|
|
||
| `70.88.205.138` | NS1 Proxmox. Public HTTPS + public NATS **client** edge |
|
||
| `10.10.10.20` | LXC 510 `verae-px-worker` (worm + tree) |
|
||
| `10.10.10.21–23` | LXC 511–513 `nats-a/b/c` JetStream cluster `verae` |
|
||
|
||
SSH to the box: `ssh marchon@70.88.205.138`
|
||
Git SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (port **2223**)
|
||
|
||
## 2. Public HTTPS doors (live)
|
||
|
||
Wildcard `*.zapier.georgelambert.org` → `70.88.205.138`.
|
||
|
||
| URL | Process | Port | Last check |
|
||
|-----|---------|------|------------|
|
||
| https://zapier.georgelambert.org/ | docs catalog | files | 200 |
|
||
| https://git.georgelambert.org/ | Forgejo | :443 / SSH :2223 | 200 |
|
||
| https://portal.zapier.georgelambert.org/ | access-web → `/portal/` | :3021 | 302 → portal |
|
||
| https://api.zapier.georgelambert.org/health | access-api | :3022 | 200 |
|
||
| https://leaf.zapier.georgelambert.org/health | access-leaf | :3023 | 200 |
|
||
| https://zap.zapier.georgelambert.org/health | access-zapier | :3024 | 200 |
|
||
| https://staff.zapier.georgelambert.org/ | access-staff | :3025 | 302 login |
|
||
| https://login.zapier.georgelambert.org/ | staff-session | :3027 | 200 |
|
||
| https://iam.zapier.georgelambert.org/health | staff-iam | :3028 | 200 (`users: 5`) |
|
||
| https://cs.zapier.georgelambert.org/ | customer-service | :3011 | 302 |
|
||
| https://sales.zapier.georgelambert.org/ | sales-pricing | :3012 | 302 |
|
||
| https://acct.zapier.georgelambert.org/ | accounting-export | :3013 | 302 |
|
||
| https://mw.zapier.georgelambert.org/health | middleware | :3100 | 200 `mockVerae:true` `natsConnected:true` |
|
||
| https://fleet.zapier.georgelambert.org/ | fleet console | :3850 | 302 |
|
||
| https://nats.zapier.georgelambert.org/ | NATS WebSocket (Caddy) | 14422 | **400** on GET (expected; it is WS) |
|
||
|
||
Loopback on NS1 (not public): zappier-edge **`127.0.0.1:13000`** (admin + Stripe + SQLite). Tunnel:
|
||
|
||
```bash
|
||
ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138
|
||
# then http://127.0.0.1:13000/admin and /docs
|
||
```
|
||
|
||
Operator console tunnel: `ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138`
|
||
|
||
## 3. NATS
|
||
|
||
### Internal cluster (workers, keep, fleet)
|
||
|
||
No token. Private `vmbr1` only.
|
||
|
||
```text
|
||
NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
|
||
JETSTREAM_REPLICAS=3
|
||
```
|
||
|
||
| Port | Bind | Use |
|
||
|------|------|-----|
|
||
| `:4222` | `10.10.10.21–23` | clients |
|
||
| `:6222` | same, `vmbr1` | cluster routes — **do not publish** |
|
||
| `:7422` | same | leaf hubs for the public edge — **do not publish** |
|
||
| `:8222` | `127.0.0.1` on each LXC | monitor |
|
||
|
||
From a laptop you **cannot** reach `10.10.10.x` unless you are on NS1 or you tunnel:
|
||
|
||
```bash
|
||
ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138
|
||
export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224
|
||
```
|
||
|
||
### Public client edge (token)
|
||
|
||
Live token (file `/etc/nats/public-edge.token` on NS1):
|
||
|
||
```text
|
||
4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9
|
||
```
|
||
|
||
```text
|
||
nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
|
||
wss://nats.zapier.georgelambert.org
|
||
```
|
||
|
||
`CONNECT` with that token returns `PONG` (checked 2026-09-14). `auth_required: true`. Server name `nats-public-edge`. **Do not** put this URL in Zapier. Recreate: `bash packages/verae-nats-cluster/scripts/expose-public.sh` on NS1.
|
||
|
||
Leftover lab listeners (ignore for new clients): host `127.0.0.1:4222` docker-proxy, `10.10.10.1:4222` socat. zappier-edge process still has `NATS_URL=nats://127.0.0.1:4222` — billing pubs may miss the 3-node cluster until that env is flipped.
|
||
|
||
nkeys/mTLS: **not** on. Isolation is LAN + token.
|
||
|
||
## 4. Middleware (jobs)
|
||
|
||
Live: `MOCK_VERAE=true`, `NATS_ENABLED=true`, cluster URL as above, `ADMIN_SECRET=change-me-admin` (default), `TOKEN_SECRET=dev-secret-change-me` (default).
|
||
|
||
### Lab tenant (created 2026-09-14 for this pack)
|
||
|
||
| Field | Value |
|
||
|-------|--------|
|
||
| tenantId | `tenant-dev-lab-local-89ab82de` |
|
||
| plan | free |
|
||
| API key | `zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun` |
|
||
| mock Verae user | `lab-dev` / `lab-dev-pass` |
|
||
| veraeUserId | `vu_20ed6029b99efb2e` |
|
||
|
||
Proven: `GET /zapier/v1/auth/me` → valid; `POST /zapier/v1/timestamp` → 202 `jobId`; wait → mock certificate `blockIndex: 42`.
|
||
|
||
```bash
|
||
KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun
|
||
|
||
curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me
|
||
|
||
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
|
||
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
|
||
https://mw.zapier.georgelambert.org/zapier/v1/timestamp
|
||
|
||
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
|
||
-d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \
|
||
https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait
|
||
```
|
||
|
||
Customer API plane (forwards `x-api-key` to middleware):
|
||
|
||
```bash
|
||
curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
|
||
-d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
|
||
https://api.zapier.georgelambert.org/v1/timestamp
|
||
```
|
||
|
||
`https://zap.zapier.georgelambert.org` is the Zapier **plane**. It does **not** currently forward `x-api-key` on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` and use a `zmw_…` key in the Zap.
|
||
|
||
Mint another key (mock Verae accepts any username/password):
|
||
|
||
```bash
|
||
curl -sS -H "content-type: application/json" \
|
||
-d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \
|
||
https://mw.zapier.georgelambert.org/zapier/v1/signup
|
||
```
|
||
|
||
Admin list/provision:
|
||
|
||
```bash
|
||
curl -sS -H "x-admin-secret: change-me-admin" \
|
||
https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants
|
||
```
|
||
|
||
## 5. Portal / zappier-edge (billing users)
|
||
|
||
SQLite `/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db`. Bind `127.0.0.1:13000`.
|
||
|
||
Seed **customer API keys** (`x-api-key` on edge `/v1/*`, **not** middleware `zmw_`):
|
||
|
||
| Customer | tier | key |
|
||
|----------|------|-----|
|
||
| Ada (free) | free | `key-ada` |
|
||
| Grace (pro) | pro | `key-grace` |
|
||
| Linus (business) | business | `key-linus` |
|
||
| Docs Capture | free | `key-021851970d8a22c6` |
|
||
|
||
These keys are for the **edge meter / portal**. Middleware jobs need a `zmw_…` key (section 4).
|
||
|
||
Seed **admin console** (`/admin`, `x-admin-key` or login):
|
||
|
||
| username | password |
|
||
|----------|----------|
|
||
| `admin` | `admin-dev-key` |
|
||
| `demo` | `$$$Adm1n###` |
|
||
|
||
`ZAPPIER_ADMIN_KEY` default on CS/sales/staff processes: `admin-dev-key`.
|
||
|
||
Stripe: **not** live (lab quotes only). Env `STRIPE_*` unset on the sampled edge process.
|
||
|
||
Signup more customers at https://portal.zapier.georgelambert.org/portal/
|
||
|
||
## 6. Staff IAM
|
||
|
||
https://login.zapier.georgelambert.org/ · https://iam.zapier.georgelambert.org/
|
||
|
||
Seed users (defaults; live IAM has these five):
|
||
|
||
| username | password | role |
|
||
|----------|----------|------|
|
||
| `admin` | `admin-dev-key` | owner |
|
||
| `cs` | `cs-dev-key` | cs |
|
||
| `sales` | `sales-dev-key` | sales |
|
||
| `accounting` | `acct-dev-key` | accounting |
|
||
| `operator` | `fleet-dev-key` | operator |
|
||
|
||
`STAFF_KEY` / session fallback: `admin-dev-key`.
|
||
|
||
## 7. Leaf plane
|
||
|
||
https://leaf.zapier.georgelambert.org/health → `verae.access.leaf.in`
|
||
|
||
Live: `LEAF_TOKEN=leaf-dev-token`
|
||
|
||
```bash
|
||
curl -sS -H "content-type: application/json" \
|
||
-d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \
|
||
https://leaf.zapier.georgelambert.org/
|
||
```
|
||
|
||
Billing targets are **denied** on this plane.
|
||
|
||
## 8. Git (Forgejo)
|
||
|
||
| | |
|
||
|--|--|
|
||
| Web | https://git.georgelambert.org/marchon/ |
|
||
| SSH | `ssh://git@git.georgelambert.org:2223/marchon/<name>.git` |
|
||
| User | `marchon` |
|
||
| Overview of routes | https://git.georgelambert.org/marchon/dev-overview |
|
||
| Monorepo | `master-zapier-plan-draft` |
|
||
| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |
|
||
|
||
```bash
|
||
GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git
|
||
```
|
||
|
||
Add your SSH public key on Forgejo (user **marchon** or a new account). Do not commit deploy tokens.
|
||
|
||
Clone-all:
|
||
|
||
```bash
|
||
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
|
||
cd verae-bootstrap
|
||
export VERAE_SRC=$HOME/verae-src
|
||
bash scripts/fetch.sh ns1-all-in-one
|
||
```
|
||
|
||
## 9. Environment cheat sheet (new worker on the cluster)
|
||
|
||
```bash
|
||
export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
|
||
export JETSTREAM_REPLICAS=3
|
||
export NATS_ENABLED=true
|
||
export MOCK_VERAE=true # flip to false only with live Verae login
|
||
export VERAE_API_BASE_URL=https://api.veraetime.net
|
||
export AUTHZ_URL=http://127.0.0.1:3020
|
||
export ZAPPIER_UPSTREAM=http://127.0.0.1:3100
|
||
export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000
|
||
export ZAPPIER_ADMIN_KEY=admin-dev-key
|
||
export LEAF_TOKEN=leaf-dev-token
|
||
export STAFF_IAM_URL=http://127.0.0.1:3028
|
||
```
|
||
|
||
Template worker: clone `verae-nats-process`, rename `verae.example.process.*`.
|
||
|
||
## 10. Not issued yet (blocked)
|
||
|
||
| Item | Why |
|
||
|------|-----|
|
||
| Zapier Platform deploy key / `zapier login` | operator has not logged the CLI in |
|
||
| Live `api.veraetime.net` username/password | `MOCK_VERAE=true`; JWT would stay in middleware |
|
||
| NATS nkeys / account creds | cluster is `$G` + LAN |
|
||
| Stripe live secret | lab only |
|
||
| lan-134 SSH worker | disabled |
|
||
|
||
When Zapier login exists: `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org`, auth field `api_key` = `zmw_…`.
|
||
|
||
When live Verae exists: middleware `MOCK_VERAE=false` + `VERAE_API_BASE_URL=https://api.veraetime.net` + working login. Zapier still never sees that password.
|
||
|
||
## 11. Related docs
|
||
|
||
- Routes: [01-nats-routes.md](01-nats-routes.md)
|
||
- Endpoint I/O: [02-endpoint-io.md](02-endpoint-io.md)
|
||
- Job path: [03-zapier-verae-path.md](03-zapier-verae-path.md)
|
||
- Gaps: [04-gaps-and-finish.md](04-gaps-and-finish.md)
|
||
- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf
|
||
- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf
|