Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

packages/verae-ops/GETTING-STARTED.md

@@ -10,6 +10,8 @@ This is the **top document** for install, first-up, and monitoring. Platform-spe
 
 | Piece | Job | Default |
 |-------|-----|---------|
+| **access-authz** | NATS authorization step for every access plane | `:3020` |
+| **access-web / api / leaf / zapier** | Separated ingress (browser, x-api-key, S2S, Zapier) | `:3021–:3024` |
 | **zappier-edge** | Billing, API keys, customer portal, admin, Stripe; meters then **proxies** to middleware | `:3000` public HTTPS |
 | **account-balance** | NATS prepaid balances (SoT) | `:3010` |
 | **customer-service** | CS credit additions + review | `:3011` |

packages/verae-ops/docker-compose.yml

@@ -51,9 +51,89 @@ services:
       PORT: "3000"
       ZAPPIER_UPSTREAM: http://middleware:3100
       NATS_URL: nats://nats1:4222
+      AUTHZ_URL: http://access-authz:3020
     ports:
       - "3000:3000"
-    depends_on: [nats1, account-balance]
+    depends_on: [nats1, account-balance, access-authz]
+
+  access-authz:
+    <<: *node
+    image: node:22-alpine
+    working_dir: /app
+    volumes:
+      - ${MONOREPO:-..}/packages/verae-access-authz:/app
+    command: ["node", "src/server.js"]
+    environment:
+      PORT: "3020"
+      NATS_URL: nats://nats1:4222
+    ports:
+      - "3020:3020"
+    depends_on: [nats1]
+
+  access-web:
+    <<: *node
+    image: node:22-alpine
+    working_dir: /app
+    volumes:
+      - ${MONOREPO:-..}/packages/verae-access-web:/app
+    command: ["node", "src/server.js"]
+    environment:
+      PORT: "3021"
+      AUTHZ_URL: http://access-authz:3020
+      ACCOUNT_BALANCE_URL: http://account-balance:3010
+      NATS_URL: nats://nats1:4222
+    ports:
+      - "3021:3021"
+    depends_on: [access-authz, account-balance]
+
+  access-api:
+    <<: *node
+    image: node:22-alpine
+    working_dir: /app
+    volumes:
+      - ${MONOREPO:-..}/packages/verae-access-api:/app
+    command: ["node", "src/server.js"]
+    environment:
+      PORT: "3022"
+      AUTHZ_URL: http://access-authz:3020
+      ACCOUNT_BALANCE_URL: http://account-balance:3010
+      ZAPPIER_UPSTREAM: http://middleware:3100
+      NATS_URL: nats://nats1:4222
+    ports:
+      - "3022:3022"
+    depends_on: [access-authz, middleware]
+
+  access-leaf:
+    <<: *node
+    image: node:22-alpine
+    working_dir: /app
+    volumes:
+      - ${MONOREPO:-..}/packages/verae-access-leaf:/app
+    command: ["node", "src/server.js"]
+    environment:
+      PORT: "3023"
+      AUTHZ_URL: http://access-authz:3020
+      LEAF_TOKEN: leaf-dev-token
+      NATS_URL: nats://nats1:4222
+    ports:
+      - "3023:3023"
+    depends_on: [access-authz, nats1]
+
+  access-zapier:
+    <<: *node
+    image: node:22-alpine
+    working_dir: /app
+    volumes:
+      - ${MONOREPO:-..}/packages/verae-access-zapier:/app
+    command: ["node", "src/server.js"]
+    environment:
+      PORT: "3024"
+      AUTHZ_URL: http://access-authz:3020
+      ZAPPIER_UPSTREAM: http://middleware:3100
+      NATS_URL: nats://nats1:4222
+    ports:
+      - "3024:3024"
+    depends_on: [access-authz, middleware]
 
   account-balance:
     <<: *node
@@ -81,6 +161,7 @@ services:
       ZAPPIER_ADMIN_URL: http://zappier-edge:3000
       ACCOUNT_BALANCE_URL: http://account-balance:3010
       NATS_URL: nats://nats1:4222
+      AUTHZ_URL: http://access-authz:3020
     ports:
       - "3011:3011"
     depends_on: [zappier-edge, account-balance, nats1]