Node Environment Variables

A node works out of the box and requires no configuration. Environment variables are for cases where the client’s behavior needs to be adapted to your infrastructure: changing ports, restricting TLS versions, enabling the live request log or metrics.

How to Set Variables#

The client is installed in /opt/wafclient and runs as the privateflare systemd service. Variables are read from the /opt/wafclient/.env file — the installer creates it empty.

Open the file and add the variables, one per line, in the NAME=value format:

nano /opt/wafclient/.env

Restart the service — variables are read only when the client starts:

systemctl restart privateflare

Example .env file:

TLSMIN=1.2
LOGROUTE=/my-secret-log
LOGPASS=strong-password
LOGFORMAT=json

To undo a setting, remove its line from .env and restart the service. For switch variables (PFNOH3, PFNOBAN and others), what matters is that a value is present at all: PFNOH3=0 will also disable HTTP/3.

Network and TLS#

Variable	Description	Default
`HTTPP`	HTTP port. A non-numeric value or `0` is ignored	`80`
`HTTPSP`	HTTPS and HTTP/3 port	`443`
`TLSMIN`	Minimum TLS version: `1.0`, `1.1`, `1.2` or `1.3`	`1.0`
`TLSMAX`	Maximum TLS version: `1.0`, `1.1`, `1.2` or `1.3`	`1.3`

An invalid TLSMIN or TLSMAX value does not cause an error — the default value is used.

HTTP/3 and Fingerprints#

Variable	What It Does
`PFNOH3`	Disables HTTP/3: QUIC is not started, the `Alt-Svc` header is not sent, visitors stay on TCP
`PFNOJA`	Disables JA3/JA4 calculation: the `PF-JA3` and `PF-JA4` headers are not sent to the backend
`PFNOSYN`	Disables the passive TCP fingerprint: the `PF-TCP-Fingerprint`, `PF-TCP-Signature` and `PF-TCP-OS` headers are not sent to the backend

Any non-empty value is enough, for example PFNOH3=1. The variables are independent of each other.

Important: JA3/JA4 are calculated only for TCP connections. A browser that has switched to HTTP/3 will reach the backend without PF-JA3/PF-JA4. If you need the fingerprints in every request, set PFNOH3. This does not apply to the TLSFingerprint header: it is sent over both TCP and HTTP/3, and PFNOJA does not affect it.

Passive TCP fingerprint headers:

Header	Example	What It Is
`PF-TCP-Signature`	`4:64:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	Connection signature in p0f v3 format
`PF-TCP-Fingerprint`	`cd79d39f578d`	Short hash of the signature
`PF-TCP-OS`	`Linux 2.2.x-3.x`	Detected client OS. Absent if there is no match

System Settings#

On startup, the client optimizes the kernel’s network parameters, configures the firewall, and blocks IPs via iptables/ipset. If the server is managed by your own automation, these actions can be disabled.

Variable	What It Does
`PFNOBAN`	Disables IP blocking via iptables/ipset
`PFNOTUNE`	Disables sysctl optimization and firewall configuration
`PFNOFW`	Disables firewall configuration only

Any non-empty value is enough.

Live Request Log#

Variable	Description	Default
`LOGROUTE`	Address of the live log page, for example `/log`. If not set, the log is disabled	disabled
`LOGUSER`	Login	`log`
`LOGPASS`	Password	`log`
`LOGFORMAT`	Line format: `json` or text (any other value)	text

More details are in the Logging section.

Metrics#

A node can expose metrics in Prometheus format — convenient for connecting to your own monitoring.

Variable	Description	Default
`METRICSROUTE`	Address of the metrics page, for example `/metrics`. If not set, metrics are disabled	disabled
`METRICSUSER`	Login	`metrics`
`METRICSPASS`	Password	`metrics`

Important: the log and metrics pages are available on any domain the node serves. Be sure to set your own password and a non-obvious address — the default values are publicly known.