Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-bootstrap/types/ns1-all-in-one/start.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Start HTTP control plane on NS1. Archive workers stay with verae-keep.
+# Does not rewrite fleet.json / machines.json — use overlays/ns1/.
 set -euo pipefail
 STACK="${VERAE_STACK:-$HOME/verae-stack}"
 FLEET="$STACK/packages/verae-fleet"
@@ -8,75 +9,29 @@ export STAFF_IAM_URL="${STAFF_IAM_URL:-https://iam.zapier.georgelambert.org}"
 export STAFF_COOKIE_DOMAIN="${STAFF_COOKIE_DOMAIN:-.zapier.georgelambert.org}"
 export NATS_URL="${NATS_URL:-nats://127.0.0.1:4222}"
 export FLEET_ENABLE_LAN134="${FLEET_ENABLE_LAN134:-}"
+export FLEET_FILE="${FLEET_FILE:-$FLEET/overlays/ns1/fleet.json}"
+export FLEET_MACHINES="${FLEET_MACHINES:-$FLEET/overlays/ns1/machines.json}"
 test -d "$FLEET" || { echo "missing $FLEET" >&2; exit 1; }
-
-python3 - "$FLEET" "$EDGE_PORT" <<'PY'
-import json, sys
-from pathlib import Path
-root = Path(sys.argv[1])
-edge_port = sys.argv[2]
-fleet_path = root / "fleet.json"
-fleet = json.loads(fleet_path.read_text())
-for sid in ("tree-node", "archive-worm", "archive-aggregator", "job-poller", "webhook-deliver", "nats"):
-    if sid in fleet.get("services", {}):
-        fleet["services"][sid]["enabled"] = False
-        fleet["services"][sid]["keepFloor"] = False
-fleet_path.write_text(json.dumps(fleet, indent=2) + "\n")
-machines_path = root / "machines.json"
-machines = json.loads(machines_path.read_text())
-for m in machines.get("machines", []):
-    if m.get("id") == "ns1":
-        m["enabled"] = False
-    if m.get("id") == "lan-134":
-        m["enabled"] = False
-    if m.get("id") == "local":
-        m["enabled"] = True
-        m["roles"] = ["*"]
-        m["capacity"] = 32
-machines_path.write_text(json.dumps(machines, indent=2) + "\n")
-edge = json.loads((root / "services" / "zappier-edge.json").read_text())
-edge.setdefault("env", {})["PORT"] = edge_port
-edge["env"]["BIND"] = "127.0.0.1"
-edge["ports"] = {"healthBase": int(edge_port)}
-(root / "services" / "zappier-edge.json").write_text(json.dumps(edge, indent=2) + "\n")
-admin = f"http://127.0.0.1:{edge_port}"
-for name in (
-    "customer-service",
-    "sales-pricing",
-    "accounting-export",
-    "access-staff",
-    "access-web",
-    "staff-iam",
-    "staff-session",
-    "zappier-edge",
-):
-    p = root / "services" / f"{name}.json"
-    if not p.exists():
-        continue
-    spec = json.loads(p.read_text())
-    env = spec.setdefault("env", {})
-    if "ZAPPIER_ADMIN_URL" in env:
-        env["ZAPPIER_ADMIN_URL"] = admin
-    if name == "access-web":
-        env["ZAPPIER_EDGE_URL"] = admin
-    env["STAFF_IAM_URL"] = "https://iam.zapier.georgelambert.org"
-    env["STAFF_COOKIE_DOMAIN"] = ".zapier.georgelambert.org"
-    env["STAFF_AUTH"] = "1"
-    p.write_text(json.dumps(spec, indent=2) + "\n")
-print("overlay applied edge", edge_port)
-PY
+test -f "$FLEET_FILE" || { echo "missing $FLEET_FILE" >&2; exit 1; }
 
 cd "$FLEET"
 if curl -sf http://127.0.0.1:3850/health >/dev/null; then
   echo "fleet already up"
   exit 0
 fi
-nohup env STAFF_IAM_URL="$STAFF_IAM_URL" STAFF_COOKIE_DOMAIN="$STAFF_COOKIE_DOMAIN" NATS_URL="$NATS_URL" node src/cli.js serve \
+nohup env \
+  STAFF_IAM_URL="$STAFF_IAM_URL" \
+  STAFF_COOKIE_DOMAIN="$STAFF_COOKIE_DOMAIN" \
+  NATS_URL="$NATS_URL" \
+  FLEET_FILE="$FLEET_FILE" \
+  FLEET_MACHINES="$FLEET_MACHINES" \
+  FLEET_ENABLE_LAN134="$FLEET_ENABLE_LAN134" \
+  node src/cli.js serve \
   >/tmp/verae-fleet-serve.out 2>&1 &
 echo "fleet pid $!"
 for i in $(seq 1 40); do
   if curl -sf http://127.0.0.1:3850/health >/dev/null; then
-    echo "fleet up"
+    echo "fleet up (overlay $FLEET_FILE)"
     exit 0
   fi
   sleep 0.5

packages/verae-bootstrap/types/proxmox-worker/README.md

@@ -0,0 +1,17 @@
+# Server type: proxmox-worker
+
+Ubuntu LXC on **NS1 Proxmox** (`vmbr1` `10.10.10.20`, VMID 510). Extra `archive-worm` + `tree-node` copies so replica floors are not all on the host PID namespace.
+
+Provision from the Proxmox host: [verae-proxmox](https://git.georgelambert.org/marchon/verae-proxmox) `scripts/create-worker.sh`.
+
+```bash
+export VERAE_SRC=$HOME/verae-src
+export NATS_URL=nats://10.10.10.1:4222
+bash scripts/host-deps.sh --type proxmox-worker
+bash scripts/fetch.sh proxmox-worker
+# keep extra copies:
+KEEP_UNITS=$HOME/verae-src/verae-keep/units.px-worker.json \
+  bash $HOME/verae-src/verae-keep/scripts/guard.sh
+```
+
+Fleet machine id `px-worker`. Enable after `ssh-check`.

packages/verae-bootstrap/types/proxmox-worker/repos.txt

@@ -0,0 +1,6 @@
+verae-archive-worm
+verae-tree-node
+verae-fleet
+verae-keep
+verae-bootstrap
+verae-proxmox