> ## Documentation Index
> Fetch the complete documentation index at: https://docs.varianz.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Environment variables and config files for the Varianz SDKs: enabling the SDK, registry endpoints, TLS, environment tags, and build-time switches.

## Enabling the SDK

Varianz is **opt-in: the SDK is disabled by default.** A service that carries the SDK but is given no configuration stays dormant — VPoints pass through, nothing registers, no native library is touched, and every SDK call succeeds as a no-op.

Resolution order (first match wins):

1. **`VARIANZ_ENABLED`** environment variable — wins unconditionally when set.
2. **`enabled` key in a config file** — `VARIANZ_CONFIG=<path>` if set, else `./varianz.toml`, else `~/.varianz/sdk.toml`. First existing file wins; files are not merged.
3. **Built-in default: disabled.**

Accepted boolean tokens (case-insensitive): true = `true, 1, on, yes, enabled`; false = `false, 0, off, no, disabled`. An unparseable value or unreadable config resolves to **disabled** with a single warning — the same fail-open posture as the rest of Varianz: when anything is wrong, VPoints simply run your original code.

The config file schema is a single top-level key; unknown keys are ignored:

```toml theme={null}
# varianz.toml
enabled = true
```

The state is resolved **once at SDK initialization** and cached for the process lifetime — there is no hot reload. The SDK logs exactly one startup line stating its state and source, e.g.:

```
[varianz] ENABLED (source: env:VARIANZ_ENABLED)
[varianz] DISABLED (source: default; set VARIANZ_ENABLED=true to activate)
```

<Note>
  The toggle behaves identically in every SDK. For Java/Kotlin, interception additionally requires the `varianz-agent` to be attached (Gradle `weave`, Maven `-Dvarianz.skipAgent=true`) — see [Java SDK](/sdks/java#disabling-interception).
</Note>

## Registry endpoint

The endpoint is normally passed in code (`Varianz("http://...")`, `initRegistry({ endpoint })`, `varianz.WithEndpoint(...)`, `RegistryBinding.init(...)`). Environment overrides where supported:

| Variable                | Read by                                                                                                           | Notes                                                                                           |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| `VARIANZ_REGISTRY_ADDR` | pytest plugin (backs `--varianz-endpoint`), Node client                                                           | Default `http://localhost:50051`                                                                |
| `VARIANZ_ENDPOINT`      | JVM test extensions (after `-Dvarianz.endpoint`), Node client (after `VARIANZ_REGISTRY_ADDR`), Playwright fixture | JVM default `http://127.0.0.1:50051`; for Playwright, set it explicitly in the test environment |

## TLS

SDK clients **always verify TLS against the platform trust store by default**. There is no code-side override for plaintext — only the environment:

| Variable                           | Behavior                                                                                                                                                                                                                                                            |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `VARIANZ_INSECURE_ALLOW_PLAINTEXT` | `true` permits a plaintext (`http://`) endpoint — required for the local dev registry. It *permits*, never forces: an `https://` endpoint always dials TLS. Setting it to `false` explicitly re-enables TLS enforcement even where a harness defaulted to plaintext |
| `VARIANZ_TLS_TRUST`                | Trust mode: `system` (default), `jdk`, or `file`                                                                                                                                                                                                                    |
| `VARIANZ_TLS_CA`                   | Path to a CA bundle (PEM) or truststore                                                                                                                                                                                                                             |
| `VARIANZ_TLS_CA_PASSWORD`          | Password for the truststore, if any                                                                                                                                                                                                                                 |
| `VARIANZ_TLS_SERVER_NAME`          | Override the SNI / certificate hostname                                                                                                                                                                                                                             |

Every SDK client (Python, TypeScript, Go, JVM) reads these identically. Rotating a CA file on disk doesn't affect established connections — reconnect or restart the client.

## Environment tags

Stages can be [scoped to deployment environments](/reference/naming-and-routing#environment-filters). Clients advertise theirs via SDK options (for example `initRegistry({ region, cluster, tags })`) or environment variables:

| Variable                   | Field            |
| -------------------------- | ---------------- |
| `VARIANZ_APPLICATION_NAME` | Application name |
| `VARIANZ_REGION`           | Region           |
| `VARIANZ_CLUSTER`          | Cluster          |

## Git provenance

VPoints record their code location (file, line, git commit) for tooling. Detection reads the local `.git`; production artifacts usually run without one, so set these in your build/deploy pipeline:

| Variable             | Content                           |
| -------------------- | --------------------------------- |
| `VARIANZ_REPO_URL`   | Repository URL                    |
| `VARIANZ_GIT_BRANCH` | Branch                            |
| `VARIANZ_GIT_COMMIT` | Commit SHA                        |
| `VARIANZ_GIT_DIRTY`  | `1`/`0` — working tree dirty flag |

Values merge field-by-field on top of whatever was auto-detected.

## Build-time switches

| Variable                    | Effect                                                                                                        |
| --------------------------- | ------------------------------------------------------------------------------------------------------------- |
| `VARIANZ_SKIP_CODEGEN`      | [Build-integration tools](/guides/build-integration) emit no generated code. Independent of `VARIANZ_ENABLED` |
| `VARIANZ_DISABLE_AUTO_LOAD` | Node only, exact value `1`: skip auto-loading the scanner manifest from `node_modules/.varianz/`              |

JVM equivalent for the processor: `-Avarianz.proc.enabled=false`.

## The standard local-dev environment

For the common case — local plaintext registry on 50051 — every service and test process needs:

```bash theme={null}
export VARIANZ_ENABLED=true
export VARIANZ_INSECURE_ALLOW_PLAINTEXT=true   # plaintext registry only
```