Skip to main content
Lerian BC Correios carries your official correspondence with BACEN, so an instance that is not ready is an operational event.

​
Health and readiness

GET /health reports liveness. It answers 200 while the process runs, and it does not check dependencies. GET /readyz runs the dependency checks. It answers 200 when the service can take traffic, and 503 when it cannot or while it shuts down. It reuses a result for 250 milliseconds. In multi-tenant mode, /readyz also checks the Tenant Manager and its event Redis. /readyz does not call BC Correio, because each tenant has its own credentials. To check the link to BC Correio for a tenant, call POST /settings/test-connection. GET /version returns the build version of the service.

​
BACEN request quota and circuit breaker

Lerian BC Correios limits its calls to BC Correio per Sisbacen credential:
  • BC_CORREIO_RATE_LIMIT_PER_MINUTE calls per minute, 50 by default.
  • BC_CORREIO_RATE_LIMIT_PER_HOUR calls per hour, 2700 by default.
The service refuses a value above 60 per minute or 3000 per hour. When the cache is available, all replicas share one count per credential. A call waits up to BC_CORREIO_RATE_LIMIT_MAX_WAIT_SEC seconds for a free slot, 90 by default. Each tenant has its own circuit breaker for BC Correio. Five failures in a row open it. After 30 seconds, it lets one call through to test BC Correio again.

​
Credentials and keys

ENCRYPTION_KEY holds the AES-256-GCM key that encrypts the BC Correio credentials, the AI API keys, and the stored idempotency answers. It takes exactly 32 bytes. Outside the development environment, the service does not start without it. AMQP_SIGNING_KEY holds the key that signs the audit messages on RabbitMQ. Without it, the service derives a separate key from ENCRYPTION_KEY. When you set it, it takes exactly 32 bytes and must differ from ENCRYPTION_KEY.

​
Storage, outbox and retention

Lerian BC Correios stores mail in PostgreSQL. It stores attachments in S3-compatible object storage, or on the local filesystem when OBJECT_STORAGE_PROVIDER is local. User actions reach the audit trail through an outbox table and RabbitMQ. The outbox tries each event up to AUDIT_OUTBOX_MAX_ATTEMPTS times, 50 by default. The retention worker deletes published outbox rows after AUDIT_OUTBOX_RETENTION_DAYS days, 7 by default. The retention worker runs once every 24 hours and applies the retention period of each tenant. The service does not apply its own database schema. A separate migration step applies it before the service starts.

​
Metrics and tracing

Set TRACING_ENABLED=true to export traces, and METRICS_ENABLED=true to export metrics, over OTLP to OTEL_EXPORTER_OTLP_ENDPOINT. Set METRICS_PROMETHEUS_ENABLED=true to open a separate listener for a Prometheus scrape, on METRICS_PROMETHEUS_ADDRESS. The default address is 127.0.0.1:9076. The main port has no metrics endpoint. See Observability for the platform view.

​
Deployment posture

DEPLOYMENT_MODE takes local, byoc, or saas. In saas, every configured dependency must use TLS, or the service does not start. ENV_NAME decides how strict the startup checks are. With any value other than development, the service also requires:
  • POSTGRES_USER and POSTGRES_NAME, with a POSTGRES_SSLMODE other than disable.
  • RABBITMQ_URL, without the guest:guest credentials. The service does not start if it cannot connect to RabbitMQ.
  • ENCRYPTION_KEY, with exactly 32 bytes.
  • ALLOWED_ORIGINS, with a value other than *.
  • FEATURE_AUDIT_ENABLED not set to false.
Every environment needs LICENSE_KEY and an explicit true or false in PLUGIN_AUTH_ENABLED. A missing or invalid value stops the boot.