verae-ops/04-virtual-servers.md

4. Virtual servers (cloud / hypervisor)

Same topology as Proxmox, without the Proxmox UI: three small VMs or one VM for lab.

Single VM lab

Install Docker, clone verae-ops, docker compose up. Put Caddy/nginx TLS in front of :3000 and :3100. Do not open 4222 on the security group.

Three-VM prod-shaped

VM	Security group	Software
nats	private SG only 4222/6222 between the three	nats-server -js cluster
edge	80/443 public; 4222 egress to nats SG	zappier + middleware + Caddy
workers	private; SSH from operator IP	Node; fleet identity file

Cloud-init example (edge):

packages: [curl, git, ca-certificates]
runcmd:
  - curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
  - apt-get install -y nodejs

Set MIDDLEWARE_BASE_URL in Zapier to the public zappier hostname.

Snapshots: SQLite (ZAPPIER_DB) and worm/tree state directories. NATS JetStream store (/var/lib/nats).