# 4. Virtual servers (cloud / hypervisor)

Same topology as Proxmox, without the Proxmox UI: three small VMs or one VM for lab.

## Single VM lab

Install Docker, clone `verae-ops`, `docker compose up`. Put Caddy/nginx TLS in front of `:3000` and `:3100`. Do **not** open 4222 on the security group.

## Three-VM prod-shaped

| VM | Security group | Software |
|----|----------------|----------|
| nats | private SG only 4222/6222 between the three | nats-server -js cluster |
| edge | 80/443 public; 4222 egress to nats SG | zappier + middleware + Caddy |
| workers | private; SSH from operator IP | Node; fleet identity file |

Cloud-init example (edge):

```yaml
packages: [curl, git, ca-certificates]
runcmd:
  - curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
  - apt-get install -y nodejs
```

Set `MIDDLEWARE_BASE_URL` in Zapier to the **public zappier hostname**.

Snapshots: SQLite (`ZAPPIER_DB`) and worm/tree state directories. NATS JetStream store (`/var/lib/nats`).