George Lambert
8c09abecae
Some checks are pending
review / inventory (push) Waiting to run
VARIABLES.md, MODULE writer, catalog review covers subjects.json, deploy rsyncs system HTML/PDF and SM docs.
50 lines
2.1 KiB
Markdown
50 lines
2.1 KiB
Markdown
# Variables
|
|
|
|
Every runtime knob used by the in-scope stack. Unsigned JSON is rejected;
|
|
live ns1 values live in the **signed wrapper** and systemd units, not git.
|
|
|
|
This is not a HIPAA/SOC 2/ISO certificate.
|
|
|
|
## Signed config payload (`PFC_SIGNED_CONFIG`)
|
|
|
|
| Key | Live lab | Allowed | Purpose |
|
|
|---|---|---|---|
|
|
| `crypto.mode` | `lab-xor` | `npe` \| `lab-xor` \| `plain-lab` | Envelope algorithm |
|
|
| `crypto.system_key_id` | `lab-system` | string | Network Error Bundle `ct_system` key id |
|
|
| `routing.mode` | `passthrough` | `passthrough` | Dest/subject in the clear; body ciphertext |
|
|
| `admin.history_cube` | `admin-history` | cube id | Prev + new + diff chain |
|
|
| `logging.mode` | `summary` | `summary` | Codes + lookup_id + dest_class only |
|
|
|
|
Wrapper: `{payload, sig:{alg:ed25519,key_id,signature}}`.
|
|
|
|
## Process environment
|
|
|
|
| Variable | Default / live | Who |
|
|
|---|---|---|
|
|
| `PFC_REQUIRE_AUTH` | `1` on ns1 | pfc-py-admin |
|
|
| `PFC_REQUIRE_NPE` | **unset** on ns1 | bus; fail-closed if `1` |
|
|
| `PFC_DATA` | `/opt/pfc/data/admin` | cubes, users, admin-history |
|
|
| `PFC_ADMIN_HOST` / `PFC_ADMIN_PORT` | `127.0.0.1` / `18780` | console |
|
|
| `PFC_IPFS_URL` | `http://127.0.0.1:18782` | pin health |
|
|
| `PFC_REPL_URL` | `http://127.0.0.1:18784` | Go pfc-repl health |
|
|
| `NATS_URL` | `nats://10.10.10.21:4222` | untrusted broker |
|
|
| `PFC_NATS_KEY` | empty (plain lab envelope) | bus seal |
|
|
| `PFC_SIGNED_CONFIG` | `/opt/pfc/etc/secure-messaging.signed.json` | signed wrapper path |
|
|
| `PFC_CONFIG_KEY_PEM` | `/opt/pfc/etc/sm-keys/config.ed25519.pem` | host-only private |
|
|
| `SM_LEAF_HUB` | `nats://10.10.10.21:7422` | sm-leaf remote |
|
|
| `SM_HTTP` | `127.0.0.1:18783` | sm-leaf health |
|
|
| `PFC_REPL_HTTP` | `127.0.0.1:18784` | coordinator only |
|
|
| `PFC_STAMP_SYNC` | `15` seconds | unregistered hash flush |
|
|
| `PYTHONPATH` | `/opt/pfc/python/lib:/opt/pfc/python/admin:/opt/pfc/python` | admin + SM |
|
|
|
|
Private keys are never committed. Lab Ed25519 is generated on the host.
|
|
|
|
## Timeouts
|
|
|
|
| Path | Seconds |
|
|
|---|---|
|
|
| NATS request-reply | 5 |
|
|
| Replica ingest request | 4 |
|
|
| NPE sidecar seal | 15 |
|
|
| Kubo pin | 30 |
|
|
| Stamp batch | 15 |
|