13 lines
616 B
Markdown
13 lines
616 B
Markdown
# verae-access-leaf
|
|
|
|
**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.
|
|
|
|
**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf
|
|
|
|
```text
|
|
remote leaf → verae.access.leaf.in → authz.check → verae.archive.put | jobs.*
|
|
```
|
|
|
|
Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.
|
|
|
|
`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.
|