Put zapier.georgelambert.org service names on Caddy.

HTTPS reverse-proxy for portal, api, leaf, zap, staff, iam, login,
cs, sales, acct, mw, and fleet. Staff HTML login redirects use
X-Forwarded-Proto so next= is https on the public host.

packages/verae-ops/05-dedicated-hardware.md

@@ -8,7 +8,7 @@ NS1-style: a box that already runs NATS on **127.0.0.1:4222** (never a public bi
 2. `nats-server -js` listening **127.0.0.1:4222** only (cluster later on a private NIC).
 3. Clone `zappier-edge`, `verae-middleware`, `verae-fleet`.
 4. systemd units (below) or `verae-fleet serve` which keepFloor-spawns workers.
-5. Caddy/nginx for public HTTPS to **access-web `:3021/portal/`** and **access-zapier `:3024`**. zappier-edge stays loopback (`:3000`, or `:13000` on NS1 if `:3000` is already taken).
+5. Caddy file `caddy/zapier-services.georgelambert.org.caddy` on NS1: `portal`/`zap`/`api`/staff/fleet hostnames → local ports. zappier-edge stays loopback (`:3000`, or `:13000` on NS1 if `:3000` is already taken).
 6. Operator console: `0.0.0.0:3850`. `verae-keep` (`:3860`) + `watch` (`:3861`) + `guard.sh` keep workers up unless you paused/stopped them in the console.
 7. Clone/install: [verae-bootstrap](https://git.georgelambert.org/marchon/verae-bootstrap) type `ns1-all-in-one`.
 

packages/verae-ops/caddy/zapier-services.georgelambert.org.caddy

@@ -0,0 +1,87 @@
+# Verae Time × Zapier HTTP doors on NS1.
+# DNS: wildcard *.zapier.georgelambert.org → 70.88.205.138
+# Do not proxy NATS :4222, keep, archive workers, or loopback edge :13000.
+
+(zapier_headers) {
+	header {
+		X-Content-Type-Options nosniff
+		Referrer-Policy strict-origin-when-cross-origin
+	}
+	encode gzip zstd
+}
+
+http://portal.zapier.georgelambert.org,
+http://api.zapier.georgelambert.org,
+http://leaf.zapier.georgelambert.org,
+http://zap.zapier.georgelambert.org,
+http://staff.zapier.georgelambert.org,
+http://iam.zapier.georgelambert.org,
+http://login.zapier.georgelambert.org,
+http://cs.zapier.georgelambert.org,
+http://sales.zapier.georgelambert.org,
+http://acct.zapier.georgelambert.org,
+http://mw.zapier.georgelambert.org,
+http://fleet.zapier.georgelambert.org {
+	redir https://{host}{uri} permanent
+}
+
+portal.zapier.georgelambert.org {
+	import zapier_headers
+	redir / /portal/ 302
+	reverse_proxy 127.0.0.1:3021
+}
+
+api.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3022
+}
+
+leaf.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3023
+}
+
+zap.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3024
+}
+
+staff.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3025
+}
+
+iam.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3028
+}
+
+login.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3027
+}
+
+cs.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3011
+}
+
+sales.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3012
+}
+
+acct.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3013
+}
+
+mw.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3100
+}
+
+fleet.zapier.georgelambert.org {
+	import zapier_headers
+	reverse_proxy 127.0.0.1:3850
+}