From bb23e6ded0cf316d218a35b3b5f197a5c57deb27 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Mon, 14 Sep 2026 13:50:43 -0400 Subject: [PATCH] Add developer credentials pack to dev-overview Lab URLs, NATS token, zmw_ key, staff/IAM seeds, git SSH, and env cheat sheet. --- .../dev-overview/05-developer-credentials.md | 271 ++++++++++++++++++ packages/dev-overview/README.md | 1 + packages/dev-overview/SUMMARY.md | 2 +- 3 files changed, 273 insertions(+), 1 deletion(-) create mode 100644 packages/dev-overview/05-developer-credentials.md diff --git a/packages/dev-overview/05-developer-credentials.md b/packages/dev-overview/05-developer-credentials.md new file mode 100644 index 0000000..916afea --- /dev/null +++ b/packages/dev-overview/05-developer-credentials.md @@ -0,0 +1,271 @@ +# Developer credentials and connection info + +Lab pack for the Verae Time × Zapier stack on **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`). Values below were checked **2026-09-14**. These are **lab defaults**, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment. + +Zapier cloud **never** gets a NATS URL or a Verae password. + +## 1. Who you are talking to + +| Host | Role | +|------|------| +| `70.88.205.138` | NS1 Proxmox. Public HTTPS + public NATS **client** edge | +| `10.10.10.20` | LXC 510 `verae-px-worker` (worm + tree) | +| `10.10.10.21–23` | LXC 511–513 `nats-a/b/c` JetStream cluster `verae` | + +SSH to the box: `ssh marchon@70.88.205.138` +Git SSH: `ssh://git@git.georgelambert.org:2223/marchon/.git` (port **2223**) + +## 2. Public HTTPS doors (live) + +Wildcard `*.zapier.georgelambert.org` → `70.88.205.138`. + +| URL | Process | Port | Last check | +|-----|---------|------|------------| +| https://zapier.georgelambert.org/ | docs catalog | files | 200 | +| https://git.georgelambert.org/ | Forgejo | :443 / SSH :2223 | 200 | +| https://portal.zapier.georgelambert.org/ | access-web → `/portal/` | :3021 | 302 → portal | +| https://api.zapier.georgelambert.org/health | access-api | :3022 | 200 | +| https://leaf.zapier.georgelambert.org/health | access-leaf | :3023 | 200 | +| https://zap.zapier.georgelambert.org/health | access-zapier | :3024 | 200 | +| https://staff.zapier.georgelambert.org/ | access-staff | :3025 | 302 login | +| https://login.zapier.georgelambert.org/ | staff-session | :3027 | 200 | +| https://iam.zapier.georgelambert.org/health | staff-iam | :3028 | 200 (`users: 5`) | +| https://cs.zapier.georgelambert.org/ | customer-service | :3011 | 302 | +| https://sales.zapier.georgelambert.org/ | sales-pricing | :3012 | 302 | +| https://acct.zapier.georgelambert.org/ | accounting-export | :3013 | 302 | +| https://mw.zapier.georgelambert.org/health | middleware | :3100 | 200 `mockVerae:true` `natsConnected:true` | +| https://fleet.zapier.georgelambert.org/ | fleet console | :3850 | 302 | +| https://nats.zapier.georgelambert.org/ | NATS WebSocket (Caddy) | 14422 | **400** on GET (expected; it is WS) | + +Loopback on NS1 (not public): zappier-edge **`127.0.0.1:13000`** (admin + Stripe + SQLite). Tunnel: + +```bash +ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138 +# then http://127.0.0.1:13000/admin and /docs +``` + +Operator console tunnel: `ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138` + +## 3. NATS + +### Internal cluster (workers, keep, fleet) + +No token. Private `vmbr1` only. + +```text +NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222 +JETSTREAM_REPLICAS=3 +``` + +| Port | Bind | Use | +|------|------|-----| +| `:4222` | `10.10.10.21–23` | clients | +| `:6222` | same, `vmbr1` | cluster routes — **do not publish** | +| `:7422` | same | leaf hubs for the public edge — **do not publish** | +| `:8222` | `127.0.0.1` on each LXC | monitor | + +From a laptop you **cannot** reach `10.10.10.x` unless you are on NS1 or you tunnel: + +```bash +ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138 +export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224 +``` + +### Public client edge (token) + +Live token (file `/etc/nats/public-edge.token` on NS1): + +```text +4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9 +``` + +```text +nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222 +wss://nats.zapier.georgelambert.org +``` + +`CONNECT` with that token returns `PONG` (checked 2026-09-14). `auth_required: true`. Server name `nats-public-edge`. **Do not** put this URL in Zapier. Recreate: `bash packages/verae-nats-cluster/scripts/expose-public.sh` on NS1. + +Leftover lab listeners (ignore for new clients): host `127.0.0.1:4222` docker-proxy, `10.10.10.1:4222` socat. zappier-edge process still has `NATS_URL=nats://127.0.0.1:4222` — billing pubs may miss the 3-node cluster until that env is flipped. + +nkeys/mTLS: **not** on. Isolation is LAN + token. + +## 4. Middleware (jobs) + +Live: `MOCK_VERAE=true`, `NATS_ENABLED=true`, cluster URL as above, `ADMIN_SECRET=change-me-admin` (default), `TOKEN_SECRET=dev-secret-change-me` (default). + +### Lab tenant (created 2026-09-14 for this pack) + +| Field | Value | +|-------|--------| +| tenantId | `tenant-dev-lab-local-89ab82de` | +| plan | free | +| API key | `zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun` | +| mock Verae user | `lab-dev` / `lab-dev-pass` | +| veraeUserId | `vu_20ed6029b99efb2e` | + +Proven: `GET /zapier/v1/auth/me` → valid; `POST /zapier/v1/timestamp` → 202 `jobId`; wait → mock certificate `blockIndex: 42`. + +```bash +KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun + +curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me + +curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \ + -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \ + https://mw.zapier.georgelambert.org/zapier/v1/timestamp + +curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \ + -d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \ + https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait +``` + +Customer API plane (forwards `x-api-key` to middleware): + +```bash +curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \ + -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \ + https://api.zapier.georgelambert.org/v1/timestamp +``` + +`https://zap.zapier.georgelambert.org` is the Zapier **plane**. It does **not** currently forward `x-api-key` on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` and use a `zmw_…` key in the Zap. + +Mint another key (mock Verae accepts any username/password): + +```bash +curl -sS -H "content-type: application/json" \ + -d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \ + https://mw.zapier.georgelambert.org/zapier/v1/signup +``` + +Admin list/provision: + +```bash +curl -sS -H "x-admin-secret: change-me-admin" \ + https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants +``` + +## 5. Portal / zappier-edge (billing users) + +SQLite `/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db`. Bind `127.0.0.1:13000`. + +Seed **customer API keys** (`x-api-key` on edge `/v1/*`, **not** middleware `zmw_`): + +| Customer | tier | key | +|----------|------|-----| +| Ada (free) | free | `key-ada` | +| Grace (pro) | pro | `key-grace` | +| Linus (business) | business | `key-linus` | +| Docs Capture | free | `key-021851970d8a22c6` | + +These keys are for the **edge meter / portal**. Middleware jobs need a `zmw_…` key (section 4). + +Seed **admin console** (`/admin`, `x-admin-key` or login): + +| username | password | +|----------|----------| +| `admin` | `admin-dev-key` | +| `demo` | `$$$Adm1n###` | + +`ZAPPIER_ADMIN_KEY` default on CS/sales/staff processes: `admin-dev-key`. + +Stripe: **not** live (lab quotes only). Env `STRIPE_*` unset on the sampled edge process. + +Signup more customers at https://portal.zapier.georgelambert.org/portal/ + +## 6. Staff IAM + +https://login.zapier.georgelambert.org/ · https://iam.zapier.georgelambert.org/ + +Seed users (defaults; live IAM has these five): + +| username | password | role | +|----------|----------|------| +| `admin` | `admin-dev-key` | owner | +| `cs` | `cs-dev-key` | cs | +| `sales` | `sales-dev-key` | sales | +| `accounting` | `acct-dev-key` | accounting | +| `operator` | `fleet-dev-key` | operator | + +`STAFF_KEY` / session fallback: `admin-dev-key`. + +## 7. Leaf plane + +https://leaf.zapier.georgelambert.org/health → `verae.access.leaf.in` + +Live: `LEAF_TOKEN=leaf-dev-token` + +```bash +curl -sS -H "content-type: application/json" \ + -d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \ + https://leaf.zapier.georgelambert.org/ +``` + +Billing targets are **denied** on this plane. + +## 8. Git (Forgejo) + +| | | +|--|--| +| Web | https://git.georgelambert.org/marchon/ | +| SSH | `ssh://git@git.georgelambert.org:2223/marchon/.git` | +| User | `marchon` | +| Overview of routes | https://git.georgelambert.org/marchon/dev-overview | +| Monorepo | `master-zapier-plan-draft` | +| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap | + +```bash +GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git +``` + +Add your SSH public key on Forgejo (user **marchon** or a new account). Do not commit deploy tokens. + +Clone-all: + +```bash +git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git +cd verae-bootstrap +export VERAE_SRC=$HOME/verae-src +bash scripts/fetch.sh ns1-all-in-one +``` + +## 9. Environment cheat sheet (new worker on the cluster) + +```bash +export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222 +export JETSTREAM_REPLICAS=3 +export NATS_ENABLED=true +export MOCK_VERAE=true # flip to false only with live Verae login +export VERAE_API_BASE_URL=https://api.veraetime.net +export AUTHZ_URL=http://127.0.0.1:3020 +export ZAPPIER_UPSTREAM=http://127.0.0.1:3100 +export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000 +export ZAPPIER_ADMIN_KEY=admin-dev-key +export LEAF_TOKEN=leaf-dev-token +export STAFF_IAM_URL=http://127.0.0.1:3028 +``` + +Template worker: clone `verae-nats-process`, rename `verae.example.process.*`. + +## 10. Not issued yet (blocked) + +| Item | Why | +|------|-----| +| Zapier Platform deploy key / `zapier login` | operator has not logged the CLI in | +| Live `api.veraetime.net` username/password | `MOCK_VERAE=true`; JWT would stay in middleware | +| NATS nkeys / account creds | cluster is `$G` + LAN | +| Stripe live secret | lab only | +| lan-134 SSH worker | disabled | + +When Zapier login exists: `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org`, auth field `api_key` = `zmw_…`. + +When live Verae exists: middleware `MOCK_VERAE=false` + `VERAE_API_BASE_URL=https://api.veraetime.net` + working login. Zapier still never sees that password. + +## 11. Related docs + +- Routes: [01-nats-routes.md](01-nats-routes.md) +- Endpoint I/O: [02-endpoint-io.md](02-endpoint-io.md) +- Job path: [03-zapier-verae-path.md](03-zapier-verae-path.md) +- Gaps: [04-gaps-and-finish.md](04-gaps-and-finish.md) +- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf +- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf diff --git a/packages/dev-overview/README.md b/packages/dev-overview/README.md index ce81f30..4be046f 100644 --- a/packages/dev-overview/README.md +++ b/packages/dev-overview/README.md @@ -18,6 +18,7 @@ Zapier cloud **never** connects to NATS. It talks HTTPS to `https://zap.zapier.g | [02-endpoint-io.md](02-endpoint-io.md) | Per-address: purpose, inbound from, outbound to, how to connect Verae API | | [03-zapier-verae-path.md](03-zapier-verae-path.md) | Zapier → middleware → Verae timestamp server → poll → events → Zapier | | [04-gaps-and-finish.md](04-gaps-and-finish.md) | Modules not connected; billing/event/aux; ordered finish list | +| [05-developer-credentials.md](05-developer-credentials.md) | URLs, tokens, lab API keys, staff/IAM, git, env cheat sheet | ## Cluster (running) diff --git a/packages/dev-overview/SUMMARY.md b/packages/dev-overview/SUMMARY.md index da8e035..15ad1b3 100644 --- a/packages/dev-overview/SUMMARY.md +++ b/packages/dev-overview/SUMMARY.md @@ -5,4 +5,4 @@ Developer map of **designed vs running** NATS addresses, transport ports, per-en **Forgejo:** https://git.georgelambert.org/marchon/dev-overview **Catalog:** https://zapier.georgelambert.org/packages/dev-overview/ -Start: [README.md](README.md). +Start: [README.md](README.md). Credentials: [05-developer-credentials.md](05-developer-credentials.md).