marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

S16-S24: Remaining-Work plan, thesaurus occurrences, deploy docs
Some checks are pending
review / inventory (push) Waiting to run
Details

Browse source 
VARIABLES.md, MODULE writer, catalog review covers subjects.json,
deploy rsyncs system HTML/PDF and SM docs.
This commit is contained in:
George Lambert 2026-09-15 23:10:32 -04:00
parent 07f147fffb
commit 8c09abecae
21 changed files with 1009 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

50
docs/VARIABLES.md Normal file
View file

@ -0,0 +1,50 @@
# Variables
Every runtime knob used by the in-scope stack. Unsigned JSON is rejected;
live ns1 values live in the **signed wrapper** and systemd units, not git.
This is not a HIPAA/SOC 2/ISO certificate.
## Signed config payload (`PFC_SIGNED_CONFIG`)
| Key | Live lab | Allowed | Purpose |
|---|---|---|---|
| `crypto.mode` | `lab-xor` | `npe` \| `lab-xor` \| `plain-lab` | Envelope algorithm |
| `crypto.system_key_id` | `lab-system` | string | Network Error Bundle `ct_system` key id |
| `routing.mode` | `passthrough` | `passthrough` | Dest/subject in the clear; body ciphertext |
| `admin.history_cube` | `admin-history` | cube id | Prev + new + diff chain |
| `logging.mode` | `summary` | `summary` | Codes + lookup_id + dest_class only |
Wrapper: `{payload, sig:{alg:ed25519,key_id,signature}}`.
## Process environment
| Variable | Default / live | Who |
|---|---|---|
| `PFC_REQUIRE_AUTH` | `1` on ns1 | pfc-py-admin |
| `PFC_REQUIRE_NPE` | **unset** on ns1 | bus; fail-closed if `1` |
| `PFC_DATA` | `/opt/pfc/data/admin` | cubes, users, admin-history |
| `PFC_ADMIN_HOST` / `PFC_ADMIN_PORT` | `127.0.0.1` / `18780` | console |
| `PFC_IPFS_URL` | `http://127.0.0.1:18782` | pin health |
| `PFC_REPL_URL` | `http://127.0.0.1:18784` | Go pfc-repl health |
| `NATS_URL` | `nats://10.10.10.21:4222` | untrusted broker |
| `PFC_NATS_KEY` | empty (plain lab envelope) | bus seal |
| `PFC_SIGNED_CONFIG` | `/opt/pfc/etc/secure-messaging.signed.json` | signed wrapper path |
| `PFC_CONFIG_KEY_PEM` | `/opt/pfc/etc/sm-keys/config.ed25519.pem` | host-only private |
| `SM_LEAF_HUB` | `nats://10.10.10.21:7422` | sm-leaf remote |
| `SM_HTTP` | `127.0.0.1:18783` | sm-leaf health |
| `PFC_REPL_HTTP` | `127.0.0.1:18784` | coordinator only |
| `PFC_STAMP_SYNC` | `15` seconds | unregistered hash flush |
| `PYTHONPATH` | `/opt/pfc/python/lib:/opt/pfc/python/admin:/opt/pfc/python` | admin + SM |
Private keys are never committed. Lab Ed25519 is generated on the host.
## Timeouts
| Path | Seconds |
|---|---|
| NATS request-reply | 5 |
| Replica ingest request | 4 |
| NPE sidecar seal | 15 |
| Kubo pin | 30 |
| Stamp batch | 15 |