| Agent | The small program that runs on each pfSense firewall. It connects out to pfCentral, answers requests and sends telemetry. Installed by the pfSense-pkg-nats-agent package; the service is nats_agent. |
| Alias | A pfSense name for a list of hosts, networks, ports or URLs. Rules that use the alias change when the alias changes. |
| Apply | The step that reloads a pfSense service so the running firewall uses the saved configuration. In pfCentral, Save and Apply are separate, as in pfSense. |
| Audit event | A record pfCentral writes in PostgreSQL for sign-ins, member and device events, and refused actions. There is no viewer in the UI yet. |
| Bootstrap token | Same as enrollment token. |
| Callout | The NATS feature pfCentral uses to check each agent login. NATS asks pfCentral “may this firewall connect?” and pfCentral answers with a pass. See Enrollment and identity. |
| CA (NATS CA) | The certificate authority pfCentral makes for the NATS port when TLS is on. Agents download it from /nats-ca.crt and use it to check the server. |
| Connect-secret | The long-term secret a firewall gets at enrollment. It proves the firewall’s identity at each login. pfCentral stores only a hash of it. |
| Credentials (creds) file | A NATS file that holds a user’s signed JWT and private key. pfCentral uses creds files for its own internal NATS users. |
| Device ID | A firewall’s identity in pfCentral: its SMBIOS system UUID (kenv smbios.system.uuid). It appears in every NATS subject for that firewall. |
| Embedded broker | The NATS server built into pfCentral, on port 24222. The default. |
| Enrollment | The one-time exchange in which a firewall trades an enrollment token for its connect-secret, over HTTPS at POST /enroll. |
| Enrollment token | A one-time code that lets one firewall enroll. Made in the UI (Add device, valid 1 hour, bound to a UUID) or with pf-central admin enroll token (unbound). |
| Envelope | One telemetry message: a snapshot of CPU, memory, disk, interfaces, gateways and more, sent every 2 seconds by default. |
| External broker | A NATS server you run yourself (or Synadia Cloud) that pfCentral connects to instead of the embedded one. See Bring your own NATS. |
| Heartbeat | A tiny “I am here” message each agent sends every 5 seconds. It keeps the device’s presence entry alive. |
| JetStream | The part of NATS that stores messages on disk. pfCentral uses it for the telemetry stream and the key-value buckets. |
| JWT | A signed token. NATS uses JWTs as passes; pfCentral signs a 1-hour pass for each agent login, scoped to that firewall’s subjects. |
| KV bucket | A JetStream key-value store. pfCentral keeps device presence and the latest device state in KV buckets. |
| Member | A person with an account in pfCentral. Each member has one role. |
| Micro service | The NATS pattern the agent uses to answer requests: it listens on a set of subjects and replies to each request. |
| NATS | The messaging system that connects pfCentral and the agents. Firewalls connect out to it, so no inbound port is needed at the sites. See NATS in five minutes. |
| Owner | The highest role. The first account, made from the setup link, is an owner. |
| PAT (personal access token) | An API token that starts with pat_. It acts as the member who made it, on /api/* only. |
| Pepper | A server-side secret mixed into every stored hash. Set by PFCENTRAL_TOKEN_PEPPER_*. See Rotate certificates and secrets. |
| Presence | Whether pfCentral sees a firewall as online. Based on heartbeats and a 15-second expiry. See Online, offline and telemetry. |
| Request-reply | A NATS pattern: pfCentral sends a request to a subject and waits for one reply. All device operations use it, with a 5-second timeout. |
| Role | What a member may do: owner, admin, operator or viewer. See Roles and permissions. |
| Sentinel credentials | A shared NATS login with no permissions. Agents present it with their connect-secret; the callout replaces it with a real, scoped pass. |
| SMBIOS UUID | The hardware ID of the firewall’s board or VM. pfCentral uses it as the device ID. |
| SSE (server-sent events) | The browser connection pfCentral uses to push live updates to the UI. Proxies must not buffer it. |
| State volume | The server’s data directory (/data/state in the container). It holds NATS keys, internal credentials, the NATS CA and JetStream data. Back it up with the database. |
| Subject | The “address” of a NATS message, such as pfsense.<device_id>.firewall.rules.list. See NATS subjects. |
| Telemetry | The live data (envelopes) agents send. pfCentral keeps 6 hours of it in the TELEMETRY stream. |
