# Variables

Every runtime knob used by the in-scope stack. Unsigned JSON is rejected;
live ns1 values live in the **signed wrapper** and systemd units, not git.

This is not a HIPAA/SOC 2/ISO certificate.

## Signed config payload (`PFC_SIGNED_CONFIG`)

| Key | Live lab | Allowed | Purpose |
|---|---|---|---|
| `crypto.mode` | `lab-xor` | `npe` \| `lab-xor` \| `plain-lab` | Envelope algorithm |
| `crypto.system_key_id` | `lab-system` | string | Network Error Bundle `ct_system` key id |
| `routing.mode` | `passthrough` | `passthrough` | Dest/subject in the clear; body ciphertext |
| `admin.history_cube` | `admin-history` | cube id | Prev + new + diff chain |
| `logging.mode` | `summary` | `summary` | Codes + lookup_id + dest_class only |

Wrapper: `{payload, sig:{alg:ed25519,key_id,signature}}`.

## Process environment

| Variable | Default / live | Who |
|---|---|---|
| `PFC_REQUIRE_AUTH` | `1` on ns1 | pfc-py-admin |
| `PFC_REQUIRE_NPE` | **unset** on ns1 | bus; fail-closed if `1` |
| `PFC_DATA` | `/opt/pfc/data/admin` | cubes, users, admin-history |
| `PFC_ADMIN_HOST` / `PFC_ADMIN_PORT` | `127.0.0.1` / `18780` | console |
| `PFC_IPFS_URL` | `http://127.0.0.1:18782` | pin health |
| `PFC_REPL_URL` | `http://127.0.0.1:18784` | Go pfc-repl health |
| `NATS_URL` | `nats://10.10.10.21:4222` | untrusted broker |
| `PFC_NATS_KEY` | empty (plain lab envelope) | bus seal |
| `PFC_SIGNED_CONFIG` | `/opt/pfc/etc/secure-messaging.signed.json` | signed wrapper path |
| `PFC_CONFIG_KEY_PEM` | `/opt/pfc/etc/sm-keys/config.ed25519.pem` | host-only private |
| `SM_LEAF_HUB` | `nats://10.10.10.21:7422` | sm-leaf remote |
| `SM_HTTP` | `127.0.0.1:18783` | sm-leaf health |
| `PFC_REPL_HTTP` | `127.0.0.1:18784` | coordinator only |
| `PFC_STAMP_SYNC` | `15` seconds | unregistered hash flush |
| `PYTHONPATH` | `/opt/pfc/python/lib:/opt/pfc/python/admin:/opt/pfc/python` | admin + SM |

Private keys are never committed. Lab Ed25519 is generated on the host.

## Timeouts

| Path | Seconds |
|---|---|
| NATS request-reply | 5 |
| Replica ingest request | 4 |
| NPE sidecar seal | 15 |
| Kubo pin | 30 |
| Stamp batch | 15 |