Environment variables

Every environment variable the framework reads at runtime, harvested directly from lib/ and the example app. The canonical reader is b.safeEnv.readVar(name, schema) — it coerces the raw string into the declared type, applies the declared default when unset, and (for secrets) strips the value from process.env after the first read so a later process.env dump cannot leak it.

Total variables harvested: 51 across 3 categories. Generated 2026-10-12T14:21:52.482Z.

Core framework (BLAMEJS_*) #

Operator knobs read by the framework's lib/ modules during boot and on first use. All optional unless marked required in the schema column.

Name	Type	Default	Effect	Where read
`BLAMEJS_BOOT_LOG_LEVEL`	string	—	allow:raw-process-env-bootstrap — see header comment above	`lib/log.js:518`
`BLAMEJS_DNS_TRANSPORT`	string	—	(no prose; consult source)	`lib/network-dns.js:112`
`BLAMEJS_NTP_DRIFT_FATAL_MS`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2732`
`BLAMEJS_NTP_DRIFT_WARN_MS`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2731`
`BLAMEJS_NTP_REQUIRE_REACHABLE`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2768` `lib/ntp-check.js:499`
`BLAMEJS_NTP_SERVERS`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2729`
`BLAMEJS_NTP_STRICT`	string	`"1"`	schema: `{ default: "1" }`	`lib/db.js:2816` `lib/security-assert.js:195`
`BLAMEJS_NTP_TIMEOUT_MS`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2730`
`BLAMEJS_NTS_REQUIRE`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2705`
`BLAMEJS_NTS_SERVERS`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2733`
`BLAMEJS_SKIP_NTP_CHECK`	string	`""`	schema: `{ default: "" }`	`lib/db.js:2713`
`BLAMEJS_TMPDIR`	string	—	(no prose; consult source)	`lib/db.js:579`
`BLAMEJS_VALIDATE_RESPONSES`	string	—	(no prose; consult source)	`lib/router.js:234` `lib/router.js:522`
`BLAMEJS_VENDOR_DATA_DEFER_BOOT_VERIFY`	string	`""`	schema: `{ default: "" }`	`lib/vendor-data.js:347`
`BLAMEJS_VENDOR_DATA_DEFER_BOOT_VERIFY_REASON`	string	`""`	schema: `{ default: "" }`	`lib/vendor-data.js:349`
`BLAMEJS_VENDOR_DATA_PUBKEY_FINGERPRINT`	string	`""`	schema: `{ default: "" }`	`lib/vendor-data.js:160`
`LOG_LEVEL`	string	—	allow:raw-process-env-bootstrap — see header comment above	`lib/log.js:518`
`NODE_ENV`	string	—	(no prose; consult source)	`lib/dev.js:196` `lib/error-page.js:299` `lib/security-assert.js:290`
`NOTIFY_SOCKET`	string	—	(no prose; consult source)	`lib/sd-notify.js:57`
`PATH`	string	`""`	schema: `{ default: "" }`	`lib/keychain.js:108`
`TZ`	string	—	(no prose; consult source)	`lib/compliance.js:335`

Security & secrets #

Passphrases and signing-mode selectors. The framework reads these once at vault / audit init and then strips them from process.env. Set them via the operator's secret manager — never bake into a Dockerfile or shell history.

Name	Type	Default	Effect	Where read
`BLAMEJS_AUDIT_SIGNING_MODE`	string	`"wrapped"`	schema: `{ default: "wrapped", enum: ["wrapped", "plaintext"], }`	`lib/db.js:1436`
`BLAMEJS_AUDIT_SIGNING_PASSPHRASE`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:357`
`BLAMEJS_KEYCHAIN_PASSPHRASE`	string	—	(no prose; consult source)	`lib/keychain.js:552` `lib/keychain.js:626` `lib/keychain.js:723`
`BLAMEJS_VAULT_PASSPHRASE`	string	—	---- Posture auto-detect ---- The wiki ships in plaintext defaults so a quick local boot just works. When the operator sets BLAMEJS_VAULT_PASSPHRASE in the env, the wiki takes that as the production-posture signal and flips to wrapped vault + encrypted DB at rest. Same for BLAMEJS_AUDIT_SIGNING_PASSPHRASE → wrapped audit-sign key. WIKI_VAULT_MODE / WIKI_DB_AT_REST / WIKI_AUDIT_SIGNING_MODE override the auto-detect explicitly.	`examples/wiki/lib/build-app.js:356`

Wiki example app (WIKI_*) #

Knobs read only by examples/wiki — the operator's downstream app reads its own equivalents and these will not appear in framework deployments.

Name	Type	Default	Effect	Where read
`WIKI_ADMIN_ALLOWED_CIDRS`	string	—	Network allowlist for /admin paths — when WIKI_ADMIN_ALLOWED_CIDRS is set (comma-separated CIDR list), the wiki mounts b.middleware.networkAllowlist as the in-process CIDR fence above the application-layer auth gate. Operators behind a reverse proxy typically configure this at the proxy / NACL layer instead and leave the env var unset; this is the in-process fallback.	`examples/wiki/lib/build-app.js:253`
`WIKI_ADMIN_DENIED_CIDRS`	string	—	Optional deny-list for the same paths — "10.0.0.0/8 except 10.0.99.0/24" patterns. Comma-separated CIDR list; empty = no deny rules.	`examples/wiki/lib/build-app.js:258`
`WIKI_ADMIN_EMAIL`	string	—	(no prose; consult source)	`examples/wiki/server.js:66`
`WIKI_ADMIN_PASSWORD`	string	—	(no prose; consult source)	`examples/wiki/server.js:67`
`WIKI_ADMIN_TRUSTED_PROXIES`	string	—	Reverse-proxy CIDRs for the deployment. X-Forwarded-For / -Proto are honored only when the request's immediate peer is one of these (peer-gating) — without it the framework uses the socket address / real TLS state and ignores the forgeable headers, so a direct caller can't spoof an allowed IP or claim https. Drives both the /admin CIDR gate and the admin Secure-cookie HTTPS detection.	`examples/wiki/lib/build-app.js:266`
`WIKI_AUDIT_SIGNING_MODE`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:362`
`WIKI_BIND`	string	—	Default bind: 0.0.0.0 so a containerized wiki accepts connections from the Docker port-forward and reverse proxies on the same host network. Operators with a stricter posture (e.g. listening only on localhost behind a same-host reverse proxy) set WIKI_BIND=127.0.0.1.	`examples/wiki/server.js:65`
`WIKI_DATA_DIR`	string	—	(no prose; consult source)	`examples/wiki/server.js:58`
`WIKI_DB_AT_REST`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:360`
`WIKI_INTEGRATION_MTLS_DIR`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:336`
`WIKI_INTEGRATION_S3_ACCESS_KEY`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:327`
`WIKI_INTEGRATION_S3_BUCKET`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:326`
`WIKI_INTEGRATION_S3_ENDPOINT`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:319`
`WIKI_INTEGRATION_S3_REGION`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:325`
`WIKI_INTEGRATION_S3_SECRET_KEY`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:328`
`WIKI_INTEGRATION_SMTP_EHLO`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:314`
`WIKI_INTEGRATION_SMTP_HOST`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:309`
`WIKI_INTEGRATION_SMTP_PORT`	number	`1025`	schema: `{ type: "number", default: 1025 }`	`examples/wiki/lib/build-app.js:313`
`WIKI_INTEGRATION_SMTP_REJECT_UNAUTHORIZED`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:316`
`WIKI_INTEGRATION_TEST`	boolean	`false`	Integration-test mode — mount /test/* routes and wire test-only primitives (alt cache, mail transport, object-store backend) when WIKI_INTEGRATION_TEST=1. Production deploys MUST NOT set this var; the routes are guarded by the mount-gate below and otherwise unreachable.	`examples/wiki/lib/build-app.js:299`
`WIKI_PORT`	number	—	schema: `{ type: "number", default: b.constants.BYTES.bytes(3008) }`	`examples/wiki/server.js:59`
`WIKI_REQUIRE_PROD_ASSERTS`	boolean	`false`	Boot-time security policy assertions. WIKI_REQUIRE_PROD_ASSERTS=1 makes the wiki refuse to boot when the operator's production posture is incomplete (vault not wrapped, db not encrypted, etc.). Default off so a developer's `npm start` doesn't have to set every production knob; production deploys flip this on in the .env.	`examples/wiki/lib/build-app.js:347`
`WIKI_SITE_URL`	string	—	(no prose; consult source)	`examples/wiki/server.js:60`
`WIKI_VAULT_MODE`	string	—	(no prose; consult source)	`examples/wiki/lib/build-app.js:358`
`WIKI_WEBHOOK_SECRET`	string	—	(no prose; consult source)	`examples/wiki/server.js:69`
`WIKI_WEBHOOK_URL`	string	—	(no prose; consult source)	`examples/wiki/server.js:68`

Computed names

Variables read via a computed key — process.env[someVar] or safeEnv.readVar(prefix + suffix) — are intentionally not harvested. The catalog only records statically-resolvable names. Operators relying on runtime-computed env keys should document them in their own deploy manifest.

Last updated 2026-10-12T14:21:56.879Z by seeder.