Test env NATS cluster cut-over

05-dedicated-hardware.md

@@ -0,0 +1,59 @@
+# 5. Dedicated hardware
+
+NS1-style: a box that already runs NATS on **127.0.0.1:4222** (never a public bind), plus optional extra hosts for SSH workers.
+
+## This host (control + edges)
+
+1. Node 22+, git (SSH port **2223** to Forgejo).
+2. `nats-server -js` listening **127.0.0.1:4222** only (cluster later on a private NIC).
+3. Clone `zappier-edge`, `verae-middleware`, `verae-fleet`.
+4. systemd units (below) or `verae-fleet serve` which keepFloor-spawns workers.
+5. Caddy file `caddy/zapier-services.georgelambert.org.caddy` on NS1: `portal`/`zap`/`api`/staff/fleet hostnames → local ports. zappier-edge stays loopback (`:3000`, or `:13000` on NS1 if `:3000` is already taken).
+6. Operator console: `0.0.0.0:3850`. `verae-keep` (`:3860`) + `watch` (`:3861`) + `guard.sh` keep workers up unless you paused/stopped them in the console.
+7. Clone/install: [verae-bootstrap](https://git.georgelambert.org/marchon/verae-bootstrap) type `ns1-all-in-one`.
+
+## systemd (middleware)
+
+```
+[Unit]
+Description=verae-middleware
+After=network.target nats.service
+
+[Service]
+WorkingDirectory=/opt/verae/verae-middleware
+Environment=PORT=3100
+Environment=NATS_ENABLED=true
+Environment=NATS_URL=nats://127.0.0.1:4222
+Environment=VERAE_API_BASE_URL=https://api.veraetime.net
+ExecStart=/usr/bin/node src/index.js
+Restart=on-failure
+User=verae
+
+[Install]
+WantedBy=multi-user.target
+```
+
+zappier-edge similar with `PORT=3000` and `WorkingDirectory` of that clone.
+
+## Extra machines
+
+Add to fleet `machines.json`:
+
+```json
+{
+  "id": "ns1",
+  "kind": "ssh",
+  "user": "marchon",
+  "host": "70.88.205.138",
+  "port": 22,
+  "identityFile": "~/.ssh/id_ed25519",
+  "capacity": 8,
+  "roles": ["tree-node", "archive-worm"]
+}
+```
+
+Never commit private key bytes. Optional `machines.secrets.json` is gitignored.
+
+## NATS 3-server cluster on metal
+
+Three boxes, private IPs, same `cluster_name`, routes to each other, `listen` on the private IP only. Clients (`NATS_URL`) list all three URLs. Target architecture: https://zapier.georgelambert.org/overview/03-nats-cluster.pdf