marchon/verae-access-leaf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
verae-access-leaf/README.md

616 B
Raw Blame History

verae-access-leaf

Server-to-server leaf node access plane. Remote machines connect as NATS leaf nodes (or POST /forward with a leaf token). They never get the core billing subjects.

Forgejo: https://git.georgelambert.org/marchon/verae-access-leaf

remote leaf  →  verae.access.leaf.in  →  authz.check  →  verae.archive.put | jobs.*

Denied: verae.billing.balance.adjust, verae.billing.statement.get. A compromised WORM/leaf cannot credit customers.

LEAF_TOKEN required. Port :3023. Do not publish NATS 4222 to the internet; leaf nodes use a private leafnode port / tunnel.