Fleet/keep/middleware NATS_URL lists 10.10.10.21–23. Product streams
are replicas=3. px-worker worm/tree run on that cluster. Backup timer
and px-worker uptime watch are on. MOCK_VERAE and Zapier push unchanged.
CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.
verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
Internal billing now uses verae.billing.* request-reply and pubs. zappier-account-balance tracks prepaid, credits, usage, and payments. Portal, admin, CS, and sales all review the same statement. Independent Forgejo repos stay split via push-module-repos.
Fleet now spawns the real zappier and middleware processes. Metered
timestamp/receipt/hash calls proxy to middleware when ZAPPIER_UPSTREAM
is set. CS credits, sales per-customer pricing, and QuickBooks export
are separate repos plugged into zappier-edge admin.
Central fleet.json sets min/max copies. Tree-node keepFloor respawns
until three healthy unpaused replicas remain. CLI and loopback UI
pause, resume, stop, and restart instances that fail health checks.
