overview/03-nats-cluster.md

3. Central Verae NATS.IO 3-server cluster

All durable messaging for this product is NATS JetStream, not Zapier queues and not a public TCP API.

Cluster

Three nats-server -js nodes form the Verae cluster (routes between them, JetStream replication). Clients (middleware, poller, aggregator, WORM, tree nodes, account-balance, zappier-edge billing, CS/sales/accounting, and any new process cloned from verae-nats-process) connect with a cluster URL list, for example:

nats://127.0.0.1:4222,nats://127.0.0.1:4223,nats://127.0.0.1:4224

On a given machine the listener stays on loopback (or a private interface). Operators reach it with scripts/nats-tunnel.sh / ssh -L 14222:127.0.0.1:4222. Do not bind 4222 on 0.0.0.0 without auth.

Today’s NS1 box (NS1.GEORGELAMBERT.ORG, 70.88.205.138) already runs JetStream on 127.0.0.1:4222. The target is three clustered nodes so losing one server does not lose the stream. Fleet SSH hosts (ns1, later lan-134) run workers, not extra public NATS listeners.

Who may connect

Allowed	Forbidden
access-authz, access-leaf (after token), middleware, fleet workers, WORM, tree, account-balance, access planes, CS/sales	Zapier cloud, customer browsers (HTTPS to access-web / access-api / access-zapier only)

Address families already in use

Address	Kind	Notes
verae.zapier.jobs.watch	work queue	poller
verae.zapier.jobs.events	events	wait + webhooks
verae.zapier.webhooks.deliver	work queue	HTTPS to Zapier REST Hook
verae.zapier.usage	optional	metering
verae.billing.statement.get	request-reply	portal, CS, sales, admin
verae.billing.balance.adjust	request-reply	CS credits, portal reload
verae.billing.usage.recorded	pub	zappier-edge meter
verae.archive.put	JetStream	splitter / merkle builder
verae.archive.query	broadcast (no queue group)	every WORM and tree node
verae.archive.reply.<correlationId>	replies	only on bloom hit

New functions get new verae.<area>.<resource>.<action> addresses — see 06-address-routing.md.