# Host names

All of the running Verae Time × Zapier processes on **2026-09-11** live on one machine unless noted.

## Machines

| Fleet id | Hostname | Address | Role |
|----------|----------|---------|------|
| `local` (NS1 all-in-one) | **NS1.GEORGELAMBERT.ORG** | `70.88.205.138` | Control plane + archive workers + keep |
| `ns1` (SSH worker profile) | **NS1.GEORGELAMBERT.ORG** | `70.88.205.138` | Same box; SSH spawn unused while all-in-one is local |
| `lan-134` | *(none yet)* | `70.88.205.134` | Disabled until SSH works |
| `px-worker` | **verae-px-worker** (LXC **510**) | `10.10.10.20` on `vmbr1` | Extra worm/tree; enable after `verae-proxmox` create-worker |
| *(nats-cluster)* | **nats-a** (LXC **511**) | `10.10.10.21` | JetStream node A (`:4222` / `:6222`) |
| *(nats-cluster)* | **nats-b** (LXC **512**) | `10.10.10.22` | JetStream node B |
| *(nats-cluster)* | **nats-c** (LXC **513**) | `10.10.10.23` | JetStream node C |

Loopback on that box is `127.0.0.1`. Do **not** publish NATS `:4222`.

## DNS that already exists

| Hostname | What it is |
|----------|------------|
| **NS1.GEORGELAMBERT.ORG** | The server |
| **zapier.georgelambert.org** | Documentation catalog (Caddy → `/SSD2/sites/zapier.georgelambert.org`) |
| **git.georgelambert.org** | Forgejo (SSH **2223**) |
| **api.veraetime.net** | Live Verae chain (not this lab; lab uses `MOCK_VERAE`) |

## Service → hostname (NS1 all-in-one)

HTTPS names under `*.zapier.georgelambert.org` are live in Caddy on NS1 (wildcard DNS already pointed here). Loopback services stay off the public internet.

| Service | Port | Bind now | Machine hostname | Suggested service hostname | Public? |
|---------|------|----------|------------------|----------------------------|---------|
| Operator console (fleet) | 3850 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `fleet.zapier.georgelambert.org` | LAN/operator |
| Customer portal (access-web) | 3021 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `portal.zapier.georgelambert.org` | **yes** (`/portal/`) |
| Customer API (access-api) | 3022 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `api.zapier.georgelambert.org` | **yes** (API keys) |
| S2S leaf (access-leaf) | 3023 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `leaf.zapier.georgelambert.org` | partners only |
| Zapier plane (access-zapier) | 3024 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `zap.zapier.georgelambert.org` | **yes** (Zapier HTTPS) |
| Staff plane (access-staff) | 3025 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `staff.zapier.georgelambert.org` | staff |
| Staff IAM | 3028 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `iam.zapier.georgelambert.org` | staff |
| Staff session | 3027 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `login.zapier.georgelambert.org` | staff |
| Customer service | 3011 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `cs.zapier.georgelambert.org` | staff |
| Sales | 3012 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `sales.zapier.georgelambert.org` | staff |
| Accounting | 3013 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `acct.zapier.georgelambert.org` | staff |
| Middleware | 3100 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `mw.zapier.georgelambert.org` | internal HTTPS |
| Docs catalog | 443 | Caddy | NS1.GEORGELAMBERT.ORG | **zapier.georgelambert.org** | **yes** |
| Forgejo | 443 / SSH 2223 | Caddy | NS1.GEORGELAMBERT.ORG | **git.georgelambert.org** | **yes** |
| zappier-edge (admin) | 13000 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `edge.zapier.georgelambert.org` (tunnel only) | **no** — host `:3000` is another app |
| Access authz | 3020 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `authz.zapier.georgelambert.org` | no (internal) |
| Identity | 3026 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `id.zapier.georgelambert.org` | no |
| Account-balance | 3010 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `books.zapier.georgelambert.org` | no |
| jobs.events mailbox | 3030 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `events.zapier.georgelambert.org` | no |
| Keep | 3860 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `keep.zapier.georgelambert.org` | no |
| Keep watch | 3861 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(same host, watch)* | no |
| NATS JetStream | 4222 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `nats.zapier.georgelambert.org` | **never public** |
| NATS monitor | 8222 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(loopback)* | no |
| job-poller-0 | 13200 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| webhook-deliver-0 | 13300 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| archive-aggregator-0 | 13400 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| archive-worm-0 | 13500 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| archive-worm-1 | 13501 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| archive-worm-2 | 13502 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| tree-node-0 | 13600 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| tree-node-1 | 13601 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| tree-node-2 | 13602 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
| Simulator | 3847 | off (`min 0`) | — | `sim.zapier.georgelambert.org` | no |

Reach loopback ports from a laptop with:

```bash
ssh -L 13000:127.0.0.1:13000 -L 4222:127.0.0.1:4222 -L 3860:127.0.0.1:3860 marchon@NS1.GEORGELAMBERT.ORG
```