verae-access-leaf/README.md

13 lines
616 B
Markdown

# verae-access-leaf
**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.
**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf
```text
remote leaf → verae.access.leaf.in → authz.check → verae.archive.put | jobs.*
```
Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.
`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.