review / inventory (push) Waiting to run

Details

VARIABLES.md, MODULE writer, catalog review covers subjects.json,
deploy rsyncs system HTML/PDF and SM docs.

2026-09-15 23:10:32 -04:00

Variables

Every runtime knob used by the in-scope stack. Unsigned JSON is rejected; live ns1 values live in the signed wrapper and systemd units, not git.

This is not a HIPAA/SOC 2/ISO certificate.

Signed config payload (`PFC_SIGNED_CONFIG`)

Key	Live lab	Allowed	Purpose
`crypto.mode`	`lab-xor`	`npe` \| `lab-xor` \| `plain-lab`	Envelope algorithm
`crypto.system_key_id`	`lab-system`	string	Network Error Bundle `ct_system` key id
`routing.mode`	`passthrough`	`passthrough`	Dest/subject in the clear; body ciphertext
`admin.history_cube`	`admin-history`	cube id	Prev + new + diff chain
`logging.mode`	`summary`	`summary`	Codes + lookup_id + dest_class only

Wrapper: {payload, sig:{alg:ed25519,key_id,signature}}.

Variable	Default / live	Who
`PFC_REQUIRE_AUTH`	`1` on ns1	pfc-py-admin
`PFC_REQUIRE_NPE`	unset on ns1	bus; fail-closed if `1`
`PFC_DATA`	`/opt/pfc/data/admin`	cubes, users, admin-history
`PFC_ADMIN_HOST` / `PFC_ADMIN_PORT`	`127.0.0.1` / `18780`	console
`PFC_IPFS_URL`	`http://127.0.0.1:18782`	pin health
`PFC_REPL_URL`	`http://127.0.0.1:18784`	Go pfc-repl health
`NATS_URL`	`nats://10.10.10.21:4222`	untrusted broker
`PFC_NATS_KEY`	empty (plain lab envelope)	bus seal
`PFC_SIGNED_CONFIG`	`/opt/pfc/etc/secure-messaging.signed.json`	signed wrapper path
`PFC_CONFIG_KEY_PEM`	`/opt/pfc/etc/sm-keys/config.ed25519.pem`	host-only private
`SM_LEAF_HUB`	`nats://10.10.10.21:7422`	sm-leaf remote
`SM_HTTP`	`127.0.0.1:18783`	sm-leaf health
`PFC_REPL_HTTP`	`127.0.0.1:18784`	coordinator only
`PFC_STAMP_SYNC`	`15` seconds	unregistered hash flush
`PYTHONPATH`	`/opt/pfc/python/lib:/opt/pfc/python/admin:/opt/pfc/python`	admin + SM

Private keys are never committed. Lab Ed25519 is generated on the host.