marchon/verae-access-leaf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial import of verae-access-leaf from zapier monorepo

Browse source
This commit is contained in:
George Lambert 2026-09-11 16:19:48 -04:00
commit e729537150
6 changed files with 239 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md Normal file
View file

@ -0,0 +1,13 @@
# verae-access-leaf
**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.
**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf
```text
remote leaf → verae.access.leaf.in → authz.check → verae.archive.put | jobs.*
```
Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.
`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.