HTTPS reverse-proxy for portal, api, leaf, zap, staff, iam, login,
cs, sales, acct, mw, and fleet. Staff HTML login redirects use
X-Forwarded-Proto so next= is https on the public host.
CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.
Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can
credit (agent is the IAM user) and cannot export; operator can fleet
POST; admin /me is owner. Portal is the public web door at :3021/portal/.
IAM sessions persist; login is rate-limited per user; receipt PDF is
branded. lan-134 stays disabled.
verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.
Staff pages typeahead customers by name (Ada, not cust_1). Add-machine is
two rows with a wide identity path and filename picker. Overflow menus
flip up near the viewport edge. Customer list no longer leaks password
hashes. UI-REVIEW.pdf remaining list is the three leftover items.
Account-balance stores display names and looks up by name. Edge writes
names on customer create/edit; staff UIs join from edge when needed.
New verae-staff-session issues a host cookie; department HTML redirects
when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable
consumer. Catalog index is cards; disabled fleet machines are grey.
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
Internal billing now uses verae.billing.* request-reply and pubs. zappier-account-balance tracks prepaid, credits, usage, and payments. Portal, admin, CS, and sales all review the same statement. Independent Forgejo repos stay split via push-module-repos.
Fleet now spawns the real zappier and middleware processes. Metered
timestamp/receipt/hash calls proxy to middleware when ZAPPIER_UPSTREAM
is set. CS credits, sales per-customer pricing, and QuickBooks export
are separate repos plugged into zappier-edge admin.
