The container
Lender builds from a multi-stage Dockerfile — a Go Alpine builder producing a static binary, copied into a distroless nonroot runtime — and listens on port
8080. It ships as a container image you deploy into your cluster with the platform’s standard lifecycle tooling; this page does not assume any particular packaging beyond the image.
Operational probes:
| Endpoint | Purpose |
|---|---|
GET /health | Liveness. |
GET /readyz | Dependency readiness. |
GET /version | Build and version metadata. |
Dependencies
| Dependency | Role |
|---|---|
| PostgreSQL 17 | Primary data store, with primary/replica support and schema-per-tenant isolation in multi-tenant mode. |
| Valkey 8 (Redis-compatible) | Cache, rate limiting, and the M2M-credential cache. |
| RabbitMQ | Event publisher transport, driven by a transactional outbox dispatcher. |
| RedPanda | Streaming backbone for the lifecycle event catalog (via Lerian’s streaming library). |
| Midaz | The double-entry , reached through the official SDK. Lender authenticates via Access Manager with per-tenant machine-to-machine (M2M) credentials, retrieved from AWS Secrets Manager and cached in Valkey. |
| Casdoor | Identity provider backing route authorization (via Lerian’s auth library). |
| Systemplane | Runtime configuration plane, mounted under /api/v1/systemplane. |
Configuration surface
Configuration is entirely environment-driven. The keys below are a curated subset — the ones that shape behavior — not the full list.
| Group | Key | What it controls |
|---|---|---|
| App | ENV_NAME, LOG_LEVEL, DEPLOYMENT_MODE, SERVER_ADDRESS | Environment name, log verbosity, deployment mode, and listen address. |
| Tenancy | MULTI_TENANT_ENABLED, DEFAULT_TENANT_ID | Switch between single- and multi-tenant modes, and the tenant used when single-tenant. |
| Tenancy (MT) | MULTI_TENANT_MAX_TENANT_POOLS, MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | Per-tenant connection-pool ceiling and circuit-breaker trip point. |
| Postgres | POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_NAME, POSTGRES_SSLMODE, MIGRATIONS_PATH | Primary database connection and migrations. |
| Cache | REDIS_HOST, REDIS_PASSWORD, M2M_CREDENTIAL_CACHE_TTL_SEC | Valkey connection and how long M2M credentials are cached. |
| Messaging | RABBITMQ_ENABLED, RABBITMQ_HOST, OUTBOX_ENABLED, OUTBOX_DISPATCH_INTERVAL_SEC | RabbitMQ transport and the outbox dispatcher cadence. |
| Streaming | STREAMING_ENABLED, STREAMING_BROKERS, STREAMING_TLS_ENABLED | Event streaming toggle, broker addresses, and TLS. |
| Auth | PLUGIN_AUTH_ENABLED | Enable route authorization against the identity provider. |
| Ledger M2M | AWS_REGION | Region for the Secrets Manager holding per-tenant Midaz credentials. |
| Observability | ENABLE_TELEMETRY, OTEL_EXPORTER_OTLP_ENDPOINT | Telemetry toggle and OTLP collector endpoint. |
| Limits | RATE_LIMIT_ENABLED | Request rate limiting. |
| Docs | SWAGGER_ENABLED | Serve the OpenAPI document and API reference UI. |
Multi-tenant modes
Lender runs in one of two modes:
- Single-tenant — one tenant (
DEFAULT_TENANT_ID), one database schema, and a construction-time ledger organization and ledger used as the posting default. - Multi-tenant (
MULTI_TENANT_ENABLED=true) — schema-per-tenant persistence, a per-tenant Midaz client pool, and tenant-scoped events and postings. In this mode there is no env ledger default: the ledger target comes per transaction from the product’s accounting profile.
Ledger posting and fails-closed routing
Every financial event books to the ledger through a durable posting intent and an asynchronous relay — the full path is in Lender in the platform. The operationally important property: routing fails closed. A posting books into the ledger organization and ledger resolved from the accounting profile (single-tenant falls back to the env default); if neither resolves a non-empty target, Lender refuses to post rather than book into an empty or wrong ledger. Under multi-tenant mode, a product with no accounting profile therefore cannot post — which is the intended safeguard.
Next steps
Lender in the platform
The posting path, event catalog, and tenant isolation in detail.