# NATS gateway

JetStream for job watch, events, and webhook delivery lives on **NS1** (`70.88.205.138`, host `NS1.GEORGELAMBERT.ORG`).

The client port is **not public**. `nats-server -js` listens on `127.0.0.1:4222` (monitoring `8222`) with JetStream enabled (NATS 2.11.17).

## Tunnel from this Mac

```bash
ssh -fN -L 14222:127.0.0.1:4222 marchon@70.88.205.138
export NATS_URL=nats://127.0.0.1:14222
export NATS_ENABLED=true
```

Local isolated tests use a laptop `nats-server -js -p 4222`.

## Streams created by middleware

`ZAPIER_JOBS`, `ZAPIER_EVENTS`, `ZAPIER_WEBHOOKS` (optional `ZAPIER_USAGE`).

Do not expose 4222 on `0.0.0.0` without auth; keep SSH tunnel or private network.