offline / test (push) Waiting to run

Details

Put zapier.georgelambert.org service names on Caddy.

HTTPS reverse-proxy for portal, api, leaf, zap, staff, iam, login,
cs, sales, acct, mw, and fleet. Staff HTML login redirects use
X-Forwarded-Proto so next= is https on the public host.

2026-09-11 20:04:57 -04:00

2 KiB

Raw Blame History

5. Dedicated hardware

NS1-style: a box that already runs NATS on 127.0.0.1:4222 (never a public bind), plus optional extra hosts for SSH workers.

This host (control + edges)

Node 22+, git (SSH port 2223 to Forgejo).
nats-server -js listening 127.0.0.1:4222 only (cluster later on a private NIC).
Clone zappier-edge, verae-middleware, verae-fleet.
systemd units (below) or verae-fleet serve which keepFloor-spawns workers.
Caddy file caddy/zapier-services.georgelambert.org.caddy on NS1: portal/zap/api/staff/fleet hostnames → local ports. zappier-edge stays loopback (:3000, or :13000 on NS1 if :3000 is already taken).
Operator console: 0.0.0.0:3850. verae-keep (:3860) + watch (:3861) + guard.sh keep workers up unless you paused/stopped them in the console.
Clone/install: verae-bootstrap type ns1-all-in-one.

systemd (middleware)

[Unit]
Description=verae-middleware
After=network.target nats.service

[Service]
WorkingDirectory=/opt/verae/verae-middleware
Environment=PORT=3100
Environment=NATS_ENABLED=true
Environment=NATS_URL=nats://127.0.0.1:4222
Environment=VERAE_API_BASE_URL=https://api.veraetime.net
ExecStart=/usr/bin/node src/index.js
Restart=on-failure
User=verae

[Install]
WantedBy=multi-user.target

zappier-edge similar with PORT=3000 and WorkingDirectory of that clone.

Extra machines

Add to fleet machines.json:

{
  "id": "ns1",
  "kind": "ssh",
  "user": "marchon",
  "host": "70.88.205.138",
  "port": 22,
  "identityFile": "~/.ssh/id_ed25519",
  "capacity": 8,
  "roles": ["tree-node", "archive-worm"]
}

Never commit private key bytes. Optional machines.secrets.json is gitignored.

NATS 3-server cluster on metal

Three boxes, private IPs, same cluster_name, routes to each other, listen on the private IP only. Clients (NATS_URL) list all three URLs. Target architecture: https://zapier.georgelambert.org/overview/03-nats-cluster.pdf

2 KiB Raw Blame History