# 6. Linking dependent services

Every process learns peers from **environment variables** and **fleet service JSON**. There is no service mesh.

## Environment map

| Process | Variable | Points at |
|---------|----------|-----------|
| Zapier cloud app | `MIDDLEWARE_BASE_URL` | Public **zappier-edge** HTTPS (prod) or middleware (lab) |
| zappier-edge | `ZAPPIER_UPSTREAM` or internal proxy target | middleware `:3100` |
| middleware | `NATS_URL` | `nats://nats1:4222,nats://nats2:4222,nats://nats3:4222` |
| middleware | `VERAE_API_BASE_URL` | `https://api.veraetime.net` |
| middleware | `MOCK_VERAE` | `true` only in lab |
| worm / tree-node / aggregator / poller | `NATS_URL` | same cluster |
| fleet | `NATS_URL` (monitor only) | same; **publicBind=false** |
| fleet SSH | `identityFile` | path on the operator disk |

## HTTPS hops (must work)

```text
curl -H "x-api-key: $KEY" https://zappier.example.com/v1/status
# edge meters, then
curl http://127.0.0.1:3100/health
```

If Zapier gets 401/402, fix keys and the rate card on zappier-edge — not NATS.

## NATS hops (must stay private)

| Address | From | To |
|---------|------|----|
| `verae.zapier.jobs.watch` | middleware | job-poller (queue) |
| `verae.zapier.jobs.events` | poller | middleware wait |
| `verae.zapier.webhooks.deliver` | middleware | webhook-deliver |
| `verae.archive.put` | splitter | worm / tree-node |
| `verae.archive.query` | aggregator | **all** worm/tree (broadcast) |
| `verae.archive.reply.<id>` | worm/tree on **hit only** | aggregator |

Bloom **miss = silence**. Do not “fix” that with a negative reply.

## Fleet floors

https://zapier.georgelambert.org/docs/02-architecture/fleet.pdf

| Service | min (keepFloor) |
|---------|-----------------|
| archive-worm | 3 |
| tree-node | 3 |
| middleware-http | 1 |
| zappier-edge | 1 |
| aggregator / poller / webhook | 1 |

Link a new host: operator console → Add machine → `ssh-check` → reconcile.

## Adding an unplanned function

Copy `verae-nats-process`, pick `verae.<area>.<resource>.*`, add a fleet service, and if Zapier must see the result, add **one HTTPS route on middleware**. Do not teach Zapier NATS. https://zapier.georgelambert.org/overview/06-address-routing.pdf