marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
master-zapier-plan-draft/docs/sphinx/repos/verae-access-leaf.md
George Lambert 1b199ca4d4
Some checks are pending
offline / test (push) Waiting to run
Details
Separate Zapier, web, API, and leaf access planes with NATS authz 
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
2026-09-11 16:05:05 -04:00

616 B
Raw Blame History

verae-access-leaf

Server-to-server leaf node access plane. Remote machines connect as NATS leaf nodes (or POST /forward with a leaf token). They never get the core billing subjects.

Forgejo: https://git.georgelambert.org/marchon/verae-access-leaf

remote leaf  →  verae.access.leaf.in  →  authz.check  →  verae.archive.put | jobs.*

Denied: verae.billing.balance.adjust, verae.billing.statement.get. A compromised WORM/leaf cannot credit customers.

LEAF_TOKEN required. Port :3023. Do not publish NATS 4222 to the internet; leaf nodes use a private leafnode port / tunnel.