> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring dependencies

> Configure the bundled or externally managed Valkey, PostgreSQL, MongoDB, and RabbitMQ services used by Midaz.

The Midaz chart enables Valkey, PostgreSQL, MongoDB, and RabbitMQ by default. You can disable a bundled service and configure each enabled workload to use an external service instead.

| Dependency | Chart dependency version | Disable with                |
| :--------- | :----------------------- | :-------------------------- |
| Valkey     | `2.4.7`                  | `valkey.enabled: false`     |
| PostgreSQL | `16.3.5`                 | `postgresql.enabled: false` |
| MongoDB    | `16.4.0`                 | `mongodb.enabled: false`    |
| RabbitMQ   | `2.1.11`                 | `rabbitmq.enabled: false`   |

<Warning>
  When you disable a bundled dependency, provide all connection and credential values required by every enabled workload before deploying.
</Warning>

## Valkey

Configure an external Valkey or Redis service through the Ledger configuration and Secret:

```yaml theme={null}
valkey:
  enabled: false

ledger:
  configmap:
    REDIS_HOST: redis.example.internal:6379
  secrets:
    REDIS_PASSWORD: <password>
```

## PostgreSQL

For an external PostgreSQL service, configure the Ledger connections and, when enabled, Tracer. The optional bootstrap Job creates the `onboarding` and `transaction` databases, the configured Tracer database when you enable Tracer, and the `midaz` role.

```yaml theme={null}
postgresql:
  enabled: false

ledger:
  configmap:
    DB_ONBOARDING_HOST: postgres.example.internal
    DB_ONBOARDING_REPLICA_HOST: postgres.example.internal
    DB_TRANSACTION_HOST: postgres.example.internal
    DB_TRANSACTION_REPLICA_HOST: postgres.example.internal
  secrets:
    DB_ONBOARDING_PASSWORD: <midaz-password>
    DB_ONBOARDING_REPLICA_PASSWORD: <midaz-password>
    DB_TRANSACTION_PASSWORD: <midaz-password>
    DB_TRANSACTION_REPLICA_PASSWORD: <midaz-password>

tracer:
  configmap:
    DB_HOST: postgres.example.internal
    DB_NAME: tracer
    DB_USER: midaz
  secrets:
    DB_PASSWORD: <midaz-password>

global:
  externalPostgresDefinitions:
    enabled: true
    connection:
      host: postgres.example.internal
      port: "5432"
    postgresAdminLogin:
      useExistingSecret:
        name: postgres-admin
    midazCredentials:
      useExistingSecret:
        name: midaz-postgres
```

The referenced Secrets must provide `DB_USER_ADMIN` and `DB_ADMIN_PASSWORD`, or `DB_PASSWORD_MIDAZ`, respectively. The chart does not wire the bootstrap Secret into Ledger or Tracer automatically: their password values must match the `midaz` role password. If Tracer uses an existing Secret, add `DB_PASSWORD` there instead. When you enable Tracer, the bootstrap Job also creates the database named by `tracer.configmap.DB_NAME` (default `tracer`) and grants the `midaz` role access. The Job waits up to 300 seconds for PostgreSQL and retries up to three times. It remains for 300 seconds after completion.

## MongoDB

Configure an external MongoDB service in Ledger and, when enabled, CRM:

```yaml theme={null}
mongodb:
  enabled: false

ledger:
  configmap:
    MONGO_ONBOARDING_HOST: mongo.example.internal
    MONGO_TRANSACTION_HOST: mongo.example.internal
    MONGO_CRM_HOST: mongo.example.internal
    MONGO_FEES_HOST: mongo.example.internal
  secrets:
    MONGO_ONBOARDING_PASSWORD: <password>
    MONGO_TRANSACTION_PASSWORD: <password>
    MONGO_CRM_PASSWORD: <password>
    MONGO_FEES_PASSWORD: <password>

crm:
  configmap:
    MONGO_HOST: mongo.example.internal
  secrets:
    MONGO_PASSWORD: <password>
```

When the optional CRM workload uses `crm.useExistingSecret: true`, put `MONGO_PASSWORD` in that existing Secret instead of `crm.secrets`.

## RabbitMQ

For an external RabbitMQ service, set the application connection values and load the definitions required by Midaz. The file `charts/midaz/files/rabbitmq/load_definitions.json` contains the definitions.

```yaml theme={null}
rabbitmq:
  enabled: false

ledger:
  configmap:
    RABBITMQ_URI: amqp
    RABBITMQ_PROTOCOL: http
    RABBITMQ_HOST: rabbitmq.example.internal
    RABBITMQ_PORT_HOST: "5672"
    RABBITMQ_PORT_AMQP: "15672"
  secrets:
    RABBITMQ_DEFAULT_PASS: <transaction-password>
    RABBITMQ_CONSUMER_PASS: <consumer-password>

global:
  externalRabbitmqDefinitions:
    enabled: true # Local evaluation only; see the security warning below.
    connection:
      protocol: http
      host: rabbitmq.example.internal
      port: "15672"
      portAmqp: "5672"
    rabbitmqAdminLogin:
      useExistingSecret:
        name: rabbitmq-admin
    appCredentials:
      useExistingSecret:
        name: rabbitmq-app
```

The bootstrap Job applies the definitions through the management API and provisions the `transaction` and `consumer` application users. Before importing anything, it checks only whether both users already exist. If they do, the Job exits without loading definitions or reconciling their passwords. The referenced Secrets use `RABBITMQ_ADMIN_USER` and `RABBITMQ_ADMIN_PASS`, or `RABBITMQ_DEFAULT_PASS` and `RABBITMQ_CONSUMER_PASS`. The chart does not wire the bootstrap Secret into Ledger automatically: the two `ledger.secrets` values must match the passwords in `rabbitmq-app`.

<Warning>
  At the audited revision, the bootstrap Job imports the same bundled definitions file before changing the `transaction` and `consumer` passwords. That file also creates an administrator named `midaz` with the public, fixed password `lerian`, and the Job does not rotate or remove that account. Do not run this Job against a shared or production broker. Provision the required vhost, queues, exchanges, bindings, and application users independently without importing the static users.
</Warning>

## Bundled RabbitMQ

The Midaz chart requires `ledger.secrets.RABBITMQ_DEFAULT_PASS` and `ledger.secrets.RABBITMQ_CONSUMER_PASS` even when you use bundled RabbitMQ. At the audited revision, both must be `lerian` to match the fixed password hashes for the `transaction` and `consumer` users in the bundled definitions file. The bundled RabbitMQ chart also requires a non-empty Erlang cookie. Set it to a printable string of at least 32 characters without spaces.

<Warning>
  The bundled definitions use public, fixed credentials. The chart does not generate them from `ledger.secrets`. Use bundled RabbitMQ only for local evaluation. For shared or production environments, use externally managed RabbitMQ and provision its definitions without the chart's bootstrap Job.
</Warning>

```yaml theme={null}
ledger:
  secrets:
    RABBITMQ_DEFAULT_PASS: lerian
    RABBITMQ_CONSUMER_PASS: lerian

rabbitmq:
  authentication:
    erlangCookie:
      value: "<32-or-more-printable-characters-without-spaces>"
```

## Production operations

For a production deployment, assess managed-service requirements such as backups, recovery, availability, monitoring, and access controls before choosing bundled or external dependencies.