Initial import of verae-bootstrap from zapier monorepo

types/control-plane/README.md

@@ -0,0 +1,5 @@
+# Server type: control-plane
+
+HTTP control plane only: fleet, access doors, IAM, billing, middleware. Archive floors run on an `ns1-archive` host.
+
+Public doors: access-web `:3021`, access-api `:3022`, access-leaf `:3023`, access-zapier `:3024`, access-staff `:3025`. Edge loopback `:3000`. Fleet `:3850`.

types/control-plane/repos.txt

@@ -0,0 +1,23 @@
+zappier-edge
+verae-middleware
+verae-request-splitter
+verae-zapier-simulator
+verae-fleet
+zappier-account-balance
+zappier-customer-service
+zappier-sales-pricing
+zappier-accounting-export
+verae-access-authz
+verae-access-web
+verae-access-api
+verae-access-leaf
+verae-access-zapier
+verae-access-staff
+zappier-identity
+verae-jobs-events
+verae-staff-session
+verae-staff-ui
+verae-staff-iam
+verae-keep
+verae-ops
+verae-bootstrap

types/lan-worker/README.md

@@ -0,0 +1,10 @@
+# Server type: lan-worker
+
+Extra SSH worker (example: `lan-134` at 70.88.205.134). Roles: `tree-node`, `archive-worm`.
+
+Leave this type **disabled** in fleet `machines.json` until SSH works. The operator console shows a grey card for an intentionally off host.
+
+```bash
+bash scripts/fetch.sh lan-worker
+# enable in fleet only after: ssh -i ~/.ssh/id_ed25519 marchon@70.88.205.134 true
+```

types/lan-worker/repos.txt

@@ -0,0 +1,5 @@
+verae-archive-worm
+verae-tree-node
+verae-fleet
+verae-keep
+verae-bootstrap

types/ns1-all-in-one/README.md

@@ -0,0 +1,29 @@
+# Server type: ns1-all-in-one
+
+Dedicated NS1 box (`70.88.205.138`): NATS loopback, archive workers, HTTP doors, fleet, IAM, keep.
+
+## Layout
+
+- NATS `127.0.0.1:4222` (already running on NS1)
+- Archive workers: keep (`:3860`) — job-poller, webhook-deliver, aggregator, worm ×3, tree-node ×3
+- HTTP: fleet `serve` on this host (`local` machine only)
+- zappier-edge **`:13000` loopback** (host `:3000` is taken)
+- Public portal: `:3021/portal/`
+- Operator console: `:3850`
+- IAM `:3028`, staff-session `:3027`
+
+## Fetch
+
+```bash
+export VERAE_SRC=$HOME/verae-src
+bash scripts/fetch.sh ns1-all-in-one
+```
+
+## Start (from a monorepo-shaped tree)
+
+```bash
+export VERAE_STACK=$HOME/verae-stack   # packages/ sibling layout
+bash types/ns1-all-in-one/start.sh
+```
+
+`start.sh` disables fleet spawn of archive workers (keep already owns those ports), points edge at `:13000`, starts `verae-fleet serve`.

types/ns1-all-in-one/repos.txt

@@ -0,0 +1,27 @@
+zappier-edge
+verae-middleware
+verae-request-splitter
+verae-archive-worm
+verae-archive-aggregator
+verae-tree-node
+verae-zapier-simulator
+verae-fleet
+zappier-account-balance
+zappier-customer-service
+zappier-sales-pricing
+zappier-accounting-export
+verae-access-authz
+verae-access-web
+verae-access-api
+verae-access-leaf
+verae-access-zapier
+verae-access-staff
+zappier-identity
+verae-jobs-events
+verae-nats-accounts
+verae-staff-session
+verae-staff-ui
+verae-staff-iam
+verae-keep
+verae-ops
+verae-bootstrap

types/ns1-all-in-one/start.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Start HTTP control plane on NS1. Archive workers stay with verae-keep.
+set -euo pipefail
+STACK="${VERAE_STACK:-$HOME/verae-stack}"
+FLEET="$STACK/packages/verae-fleet"
+EDGE_PORT="${EDGE_PORT:-13000}"
+export STAFF_IAM_URL="${STAFF_IAM_URL:-http://127.0.0.1:3028}"
+export NATS_URL="${NATS_URL:-nats://127.0.0.1:4222}"
+export FLEET_ENABLE_LAN134="${FLEET_ENABLE_LAN134:-}"
+test -d "$FLEET" || { echo "missing $FLEET" >&2; exit 1; }
+
+python3 - "$FLEET" "$EDGE_PORT" <<'PY'
+import json, sys
+from pathlib import Path
+root = Path(sys.argv[1])
+edge_port = sys.argv[2]
+fleet_path = root / "fleet.json"
+fleet = json.loads(fleet_path.read_text())
+for sid in ("tree-node", "archive-worm", "archive-aggregator", "job-poller", "webhook-deliver", "nats"):
+    if sid in fleet.get("services", {}):
+        fleet["services"][sid]["enabled"] = False
+        fleet["services"][sid]["keepFloor"] = False
+fleet_path.write_text(json.dumps(fleet, indent=2) + "\n")
+machines_path = root / "machines.json"
+machines = json.loads(machines_path.read_text())
+for m in machines.get("machines", []):
+    if m.get("id") == "ns1":
+        m["enabled"] = False
+    if m.get("id") == "lan-134":
+        m["enabled"] = False
+    if m.get("id") == "local":
+        m["enabled"] = True
+        m["roles"] = ["*"]
+        m["capacity"] = 32
+machines_path.write_text(json.dumps(machines, indent=2) + "\n")
+edge = json.loads((root / "services" / "zappier-edge.json").read_text())
+edge.setdefault("env", {})["PORT"] = edge_port
+edge["env"]["BIND"] = "127.0.0.1"
+edge["ports"] = {"healthBase": int(edge_port)}
+(root / "services" / "zappier-edge.json").write_text(json.dumps(edge, indent=2) + "\n")
+admin = f"http://127.0.0.1:{edge_port}"
+for name in (
+    "customer-service",
+    "sales-pricing",
+    "accounting-export",
+    "access-staff",
+    "access-web",
+):
+    p = root / "services" / f"{name}.json"
+    if not p.exists():
+        continue
+    spec = json.loads(p.read_text())
+    env = spec.setdefault("env", {})
+    if "ZAPPIER_ADMIN_URL" in env or name != "access-web":
+        env["ZAPPIER_ADMIN_URL"] = admin
+    if name == "access-web":
+        env["ZAPPIER_EDGE_URL"] = admin
+    env["STAFF_IAM_URL"] = "http://127.0.0.1:3028"
+    env["STAFF_AUTH"] = "1"
+    p.write_text(json.dumps(spec, indent=2) + "\n")
+print("overlay applied edge", edge_port)
+PY
+
+cd "$FLEET"
+if curl -sf http://127.0.0.1:3850/health >/dev/null; then
+  echo "fleet already up"
+  exit 0
+fi
+nohup env STAFF_IAM_URL="$STAFF_IAM_URL" NATS_URL="$NATS_URL" node src/cli.js serve \
+  >/tmp/verae-fleet-serve.out 2>&1 &
+echo "fleet pid $!"
+for i in $(seq 1 40); do
+  if curl -sf http://127.0.0.1:3850/health >/dev/null; then
+    echo "fleet up"
+    exit 0
+  fi
+  sleep 0.5
+done
+echo "fleet did not become healthy; see /tmp/verae-fleet-serve.out" >&2
+exit 1

types/ns1-archive/README.md

@@ -0,0 +1,5 @@
+# Server type: ns1-archive
+
+NATS JetStream on loopback plus fleet/keep workers: tree-node ×3, archive-worm ×3, aggregator, job-poller, webhook-deliver.
+
+Do not bind NATS on a public NIC. Keep (`:3860`) restarts workers unless the operator console paused or stopped them.

types/ns1-archive/repos.txt

@@ -0,0 +1,8 @@
+verae-archive-worm
+verae-archive-aggregator
+verae-tree-node
+verae-fleet
+verae-keep
+verae-nats-accounts
+verae-ops
+verae-bootstrap