Environment variables

Lerian CCS reads its configuration from the process environment at startup. You set these variables at deploy time. A service restart makes them take effect. BYOC configuration essentials documents the backbone every Lerian Go service shares. In the tables below, the Default / Required column shows the value the service applies when you leave the variable unset. A bold qualifier marks a variable you must set, such as Required or Required in production. — means the service applies no default. A variable flagged Sensitive. carries credential or key material. Inject it from your secret manager at deploy time. Never commit a value. Where a value in the shipped example file differs from the value the code applies, this page publishes the code value.

Service and runtime

Variable	Default / Required	Description
`APPLICATION_NAME`	Service name	Process application name that appears in logs and telemetry.
`ENV_NAME`	`—`	Deployment environment label, folded to lower case. The value `production` arms every production gate on this page.
`LOG_LEVEL`	`info`	Structured logger level: `debug`, `info`, `warn`, or `error`.
`DEPLOYMENT_MODE`	`local`	Operational posture: `local`, `byoc`, or `saas`. Another value stops the boot.
`CCS_RUN_MODE`	`all`	Selects the subsystems this process runs: `manager` for the HTTP API only, `worker` for background workers only, or `all` for both. An invalid value stops the boot.
`SERVER_ADDRESS`	`—`	Main HTTP listen address. An unset value makes the server bind a port the operating system assigns, so deployments set it.
`HTTP_BODY_LIMIT_BYTES`	`104857600`	Maximum inbound request body size, in bytes.
`DEFAULT_TENANT_ID`	`—`	Fallback tenant identifier for paths with no per-request tenant context.
`MIGRATIONS_PATH`	`—`	Filesystem path to the SQL migration files. The migration binaries read it directly. The service never applies migrations itself.
`INFRA_CONNECT_TIMEOUT_SEC`	`30`	Overall infrastructure dial budget in seconds. The service clamps a value of zero or less to 30 seconds.

License

Variable	Default / Required	Description
`LICENSE_KEY`	Required	License credential issued by Lerian. `Sensitive.`
`ORGANIZATION_IDS`	Required	Organization scope the license covers. Lerian CCS runs the license library in global mode, so the value is the literal `global`.

CORS, TLS, and proxies

Variable	Default / Required	Description
`CORS_ALLOWED_ORIGINS`	Required in production	Comma-separated list of allowed browser origins. A production boot refuses an empty list and refuses a wildcard.
`CORS_ALLOWED_METHODS`	`—`	Comma-separated list of allowed HTTP methods.
`CORS_ALLOWED_HEADERS`	`—`	Comma-separated list of allowed request headers.
`CORS_EXPOSE_HEADERS`	`—`	Comma-separated list of response headers the browser can read.
`CORS_ALLOW_CREDENTIALS`	`false`	Allows credentialed cross-origin requests.
`ALLOW_CORS_WILDCARD`	`false`	Applies when `CORS_ALLOWED_ORIGINS` is empty or `*`: `true` allows any origin without credentials, and `false` refuses every cross-origin request.
`SERVER_TLS_CERT_FILE`	`—`	Path to the TLS certificate when the service terminates TLS itself. Set it together with the key file.
`SERVER_TLS_KEY_FILE`	`—`	Path to the TLS private key. Set it together with the certificate file.
`TLS_TERMINATED_UPSTREAM`	`false`	Marks the request path as TLS-terminated by a proxy in front of the service.
`TRUSTED_PROXIES`	Required in production	Comma-separated CIDR ranges of the layer-7 proxies whose `X-Forwarded-For` header the service honours. A production boot refuses an empty list and refuses a wildcard range.

PostgreSQL

Variable	Default / Required	Description
`POSTGRES_HOST`	`—`	Primary database host. The connection identity carries no defaults, so an incomplete block fails the dial at boot.
`POSTGRES_PORT`	`—`	Primary database port.
`POSTGRES_USER`	`—`	Primary database user.
`POSTGRES_PASSWORD`	Required in production	Primary database password. `Sensitive.`
`POSTGRES_NAME`	`—`	Primary database name.
`POSTGRES_SSLMODE`	Required	Primary database TLS mode. A production boot refuses the value `disable`.
`POSTGRES_REPLICA_HOST`	`—`	Read-replica host for query scaling. Each other replica field falls back to its primary value when unset.
`POSTGRES_REPLICA_PORT`	`—`	Read-replica port.
`POSTGRES_REPLICA_USER`	`—`	Read-replica user.
`POSTGRES_REPLICA_PASSWORD`	`—`	Read-replica password. `Sensitive.`
`POSTGRES_REPLICA_NAME`	`—`	Read-replica database name.
`POSTGRES_REPLICA_SSLMODE`	`—`	Read-replica TLS mode. A production boot refuses the value `disable`.
`POSTGRES_MAX_OPEN_CONNS`	`25`	Maximum open connections per pool.
`POSTGRES_MAX_IDLE_CONNS`	`—`	Maximum idle connections per pool. The service applies no default here.
`POSTGRES_CONN_MAX_LIFETIME_MINS`	`30`	Maximum connection lifetime in minutes.
`POSTGRES_CONN_MAX_IDLE_TIME_MINS`	`5`	Maximum connection idle time in minutes.
`POSTGRES_CONNECT_TIMEOUT_SEC`	`—`	Dial timeout in seconds.
`POSTGRES_POOL_FANOUT_ACK`	`—`	Operator consent to exceed the safe connection fan-out across the connection pools. Accepts `true`, `1`, `yes`, or `on`. Without it the boot refuses an oversized fan-out.

Redis

Variable	Default / Required	Description
`REDIS_HOST`	`localhost:6379`	Redis address as `host:port`. A non-empty value also arms the TLS posture gate in `saas` mode.
`REDIS_MASTER_NAME`	`—`	Sentinel master name when the deployment uses Redis Sentinel.
`REDIS_PASSWORD`	`—`	Redis password. `Sensitive.`
`REDIS_DB`	`0`	Redis logical database number.
`REDIS_PROTOCOL`	`3`	Redis wire-protocol version.
`REDIS_TLS`	`false`	Turns on TLS for the Redis client.
`REDIS_CA_CERT`	`—`	Base64-encoded PEM certificate authority for the Redis handshake. The client reads it only when `REDIS_TLS=true`.
`REDIS_POOL_SIZE`	`10`	Maximum Redis pool size. The client clamps a value above 1000.
`REDIS_MIN_IDLE_CONNS`	`—`	Minimum idle Redis connections kept warm. The client pre-warms none by default.
`REDIS_READ_TIMEOUT`	`3`	Redis read timeout in seconds.
`REDIS_WRITE_TIMEOUT`	`3`	Redis write timeout in seconds.
`REDIS_DIAL_TIMEOUT`	`5`	Redis dial timeout in seconds.
`REDIS_POOL_TIMEOUT`	`2`	Redis pool checkout timeout in seconds.
`REDIS_MAX_RETRIES`	`3`	Redis command retry budget.
`REDIS_MIN_RETRY_BACKOFF`	`8`	Minimum Redis retry backoff in milliseconds.
`REDIS_MAX_RETRY_BACKOFF`	`1`	Maximum Redis retry backoff in seconds.

Messaging and circuit breaker

Variable	Default / Required	Description
`CIRCUIT_BREAKER_ENABLED`	`false` (Required as `true`)	Wires the circuit-breaker manager. The Reporter integration and the object-storage adapters both need it, so the boot refuses a value of `false`.
`RABBITMQ_ENABLED`	`false`	Turns on the message-broker wiring.
`RABBITMQ_URL`	`—`	Full broker connection URL. `Sensitive.` Set this or the host, because the boot refuses both empty when the broker is on.
`RABBITMQ_HOST`	`—`	Broker host.
`RABBITMQ_PORT_AMQP`	`—`	Broker message port.
`RABBITMQ_DEFAULT_USER`	`—`	Broker username.
`RABBITMQ_DEFAULT_PASS`	`—`	Broker password. `Sensitive.`
`RABBITMQ_VHOST`	`—`	Broker virtual host.
`RABBITMQ_QUEUE`	`—`	Default queue name.
`RABBITMQ_EXCHANGE`	Required with the broker on	Business-events exchange. The service declares it on the broker, which refuses a blank name.
`RABBITMQ_HEALTH_CHECK_URL`	`—`	HTTP endpoint the readiness probe calls to check the broker.
`RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS`	`—`	Comma-separated allow-list of hosts the health probe can target.
`RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS`	`false`	Forces the health-probe allow-list to be non-empty.
`RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK`	`false`	`true` lets the broker health check send the broker credentials to an `http://` `RABBITMQ_HEALTH_CHECK_URL`, and limits the check only by `RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS`. A production boot refuses `true`.
`RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS`	`5000`	Publisher confirm timeout in milliseconds.
`RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS`	`1000`	First publisher recovery backoff in milliseconds.
`RABBITMQ_PUBLISHER_RECOVERY_MAX_MS`	`30000`	Maximum publisher recovery backoff in milliseconds.
`RABBITMQ_PUBLISHER_MAX_RECOVERIES`	`10`	Maximum publisher recovery attempts before the publisher gives up.
`CCS_CONSUMER_MAX_REDELIVERIES`	`5`	Maximum retry cycles a transiently failed message can take before the consumer moves it to the terminal dead-letter queue.

Outbox

Lerian CCS writes outbound work to a transactional outbox in the same database transaction as the state change. The OUTBOX_ family below configures the dispatcher that the shared platform library runs.

Variable	Default / Required	Description
`OUTBOX_ENABLED`	`false` (Required as `true`)	Turns on the outbox worker. The Reporter integration needs it, so the boot refuses `false`.
`OUTBOX_TABLE_NAME`	`—`	Outbox table name. The boot refuses an empty value when the outbox is on.
`OUTBOX_DISPATCH_INTERVAL_SEC`	`2`	Interval in seconds between dispatch cycles.
`OUTBOX_BATCH_SIZE`	`50`	Maximum events drained per dispatch cycle.
`OUTBOX_PUBLISH_MAX_ATTEMPTS`	`3`	Maximum publish attempts per event within one cycle.
`OUTBOX_PUBLISH_BACKOFF_MS`	`200`	Publish retry backoff in milliseconds.
`OUTBOX_RETRY_WINDOW_SEC`	`300`	Minimum age in seconds before a failed event becomes eligible for a retry.
`OUTBOX_MAX_DISPATCH_ATTEMPTS`	`10`	Maximum dispatch attempts per event before the dispatcher stops retrying it.
`OUTBOX_PROCESSING_TIMEOUT_SEC`	`600`	Timeout in seconds after which the dispatcher reclaims a stuck event.
`OUTBOX_MAX_FAILED_PER_BATCH`	`25`	Maximum failed events the dispatcher reclaims for a retry in one cycle.
`OUTBOX_INCLUDE_TENANT_METRICS`	`false`	Adds per-tenant labels to the outbox metrics.
`OUTBOX_PRIORITY_EVENT_TYPES`	`—`	Comma-separated event types the dispatcher sends first.
`OUTBOX_ALLOW_EMPTY_TENANT`	`false`	Accepts an event with no tenant context.

CCS outbox overrides

Variable	Default / Required	Description
`CCS_OUTBOX_OVERRIDES_ENABLED`	`false`	Applies the three overrides below. While it is `false`, the service ignores them.
`CCS_OUTBOX_DISPATCH_INTERVAL_MS`	`1000`	Dispatch interval in milliseconds. It takes precedence over the seconds-based interval, which preserves sub-second precision.
`CCS_OUTBOX_BATCH_SIZE`	`50`	Maximum events the registered handlers process per cycle.
`CCS_OUTBOX_MAX_ATTEMPTS`	`10`	Maximum dispatch attempts before the dispatcher marks an event permanently undeliverable.

Streaming

The Lerian streaming library reads the STREAMING_ family, not the service configuration. Lerian Streaming Hub delivers the published events.

Variable	Default / Required	Description
`STREAMING_ENABLED`	`false`	Master switch for business-event emission. While it is off, the service wires a no-operation emitter and publishes nothing. It also needs `OUTBOX_ENABLED=true`.
`STREAMING_BROKERS`	Required when streaming is on	Comma-separated broker bootstrap list. An enabled configuration with an empty list refuses to boot.
`STREAMING_CLOUDEVENTS_SOURCE`	Fixed	This service’s CloudEvents source. It sets the topic namespace and the event-type prefix. Leave it unset. Any value other than the built-in source refuses the boot, even when streaming is off.
`STREAMING_CLIENT_ID`	The service’s target name	Broker client identifier used for broker-side diagnostics.
`STREAMING_CB_FAILURE_RATIO`	`0.5`	Failure ratio that opens the producer circuit breaker.
`STREAMING_CB_MIN_REQUESTS`	`10`	Minimum requests before the producer circuit breaker evaluates the failure ratio.
`STREAMING_CB_TIMEOUT_S`	`30`	Open-state cooldown in seconds for the producer circuit breaker.
`STREAMING_CLOSE_TIMEOUT_S`	`30`	Maximum drain and flush window in seconds when the producer closes.
`STREAMING_TLS_ENABLED`	`false` (Required as `true` in `saas`)	Turns on TLS for the broker dial. The minimum version is TLS 1.2. In `saas` mode a plaintext broker dial refuses the boot.
`STREAMING_TLS_CA_CERT`	`—`	Base64-encoded PEM certificate authority for a private or on-premises broker. An empty value uses the host trust store. A malformed value refuses the boot.
`STREAMING_SASL_MECHANISM`	`—`	Broker authentication mechanism: `PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`. An empty value disables broker authentication. A mechanism without its credentials refuses the boot.
`STREAMING_SASL_USERNAME`	`—`	Broker authentication username.
`STREAMING_SASL_PASSWORD`	`—`	Broker authentication password. `Sensitive.`
`STREAMING_SASL_ALLOW_PLAINTEXT`	`false`	Allows broker authentication over a plaintext connection, which sends the credentials in the clear. The service refuses that combination unless you set this flag.

STA integration

Lerian CCS sends every outbound file to BACEN through Lerian STA and receives the answers back from it.

Variable	Default / Required	Description
`STA_ENABLED`	`false`	Wires the STA client, the submission handler, and the STA readiness probe. It also needs `STA_BASE_URL`, `CIRCUIT_BREAKER_ENABLED=true` and `OUTBOX_ENABLED=true`.
`STA_BASE_URL`	Required when STA is on	Base URL of the STA service. An empty value refuses the boot.
`STA_HTTP_TIMEOUT_SEC`	`30`	Per-request timeout in seconds on the STA client. The service falls back to 30 seconds for a value of zero or less.
`STA_FILE_HASH_VERIFY_ENABLED`	`false`	Verifies the SHA-256 digest of a downloaded inbound file against the digest on the file event.
`STA_EVENT_HMAC_VERIFY_ENABLED`	`false`	Authenticates inbound STA business events against the shared signature scheme. A boot with verification on and an incomplete key catalogue fails loudly.
`STA_EVENT_HMAC_MASTER_KEYS`	`—`	Catalogue of `version:hex` master keys shared with the STA service. `Sensitive.`
`STA_EVENT_HMAC_MASTER_KEY_VERSION`	`—`	Catalogue version the verifier treats as active.
`STA_EVENT_HMAC_TOLERANCE_SECONDS`	`300`	Window in seconds outside which an authentic event is logged as late or early.

Reporter integration

Lerian Reporter renders the daily ACCS001 file, so it is a mandatory upstream. The readiness probe treats it as a hard dependency. Start Lerian Reporter before you expect Lerian CCS to become ready.

Variable	Default / Required	Description
`REPORTER_URL`	Required	Base URL of the Reporter service. An empty value refuses the boot.
`REPORTER_HTTP_TIMEOUT_SEC`	`30`	Per-request timeout in seconds on the Reporter client. The service falls back to 30 seconds for a value of zero or less.
`REPORTER_TEMPLATE_ID_ACCS001`	`—`	Identifier of the Reporter template the ACCS001 render targets. The Reporter mints this identifier per environment when you register the template. An empty identifier together with an empty template name refuses the batch approval with error `MYS-0008` and HTTP 503.
`REPORTER_TEMPLATE_NAME_ACCS001`	`—`	Description of the ACCS001 template in the Reporter. The service resolves the template by this description when you leave the identifier unset.
`DETAIL_RENDER_MODE`	`inline`	Render path for a detail response. Only `inline` starts the service. Every other value refuses the boot.
`CCS_REPORTER_POLL_INITIAL_DELAY_MS`	`2000`	First backoff delay in milliseconds on the render poll loop.
`CCS_REPORTER_POLL_MAX_DELAY_MS`	`30000`	Maximum backoff delay in milliseconds on the render poll loop.
`CCS_REPORTER_POLL_TOTAL_TIMEOUT_SEC`	`1800`	Total poll budget in seconds. A render older than this budget ends as a timeout.
`CCS_REPORTER_POLL_BACKOFF_MULTIPLIER`	`2.0`	Multiplier applied to the delay after each poll. The boot refuses a value below `1.0`.

Authentication

Variable	Default / Required	Description
`PLUGIN_AUTH_ENABLED`	Required: `true` or `false`. A blank or other value stops the boot. A development `ENV_NAME` is `development`, `develop`, `dev`, `local` or `test`	`true` sends each gated `/v1` request to Lerian Access Manager for a decision. `false` skips that call; a bearer token that names a principal is still required. Only a development `ENV_NAME` outside `saas` accepts `false`. The value also decides whether the service mints outbound tokens.
`PLUGIN_AUTH_HOST`	Required when authentication is on	Base URL of Lerian Access Manager.
`AUTH_JWT_VERIFY_CERT`	`—`	One or more PEM RSA public keys or X.509 certificates, separated by newlines. With a loaded certificate, the service checks the RS256 signature and the expiry of each bearer token before it calls Access Manager, and answers 401 when the check fails. It takes precedence over `AUTH_JWT_VERIFY_CERT_PATH`. It takes effect only with `PLUGIN_AUTH_ENABLED=true`.
`AUTH_JWT_VERIFY_CERT_PATH`	`—`	Path to a file with the same content. The service reads it only when `AUTH_JWT_VERIFY_CERT` is empty.
`AUTH_JWT_ISSUER`	`—`	With a loaded certificate, the service answers 401 to any token whose `iss` claim differs from this value.

Machine-to-machine credentials

Lerian CCS mints an outbound token per upstream through Lerian Access Manager. Each upstream carries its own credential pair.

Variable	Default / Required	Description
`REPORTER_CLIENT_ID`	Required when authentication is on outside `saas`	Client identifier for the Reporter upstream.
`REPORTER_CLIENT_SECRET`	Required when authentication is on outside `saas`	Client secret for the Reporter upstream. `Sensitive.`
`STA_CLIENT_ID`	Required when authentication is on outside `saas`	Client identifier for the STA upstream.
`STA_CLIENT_SECRET`	Required when authentication is on outside `saas`	Client secret for the STA upstream. `Sensitive.`
`REPORTER_M2M_TARGET_SERVICE`	`—`	Metrics label for the Reporter upstream. An empty value falls back to the canonical upstream name.
`STA_M2M_TARGET_SERVICE`	`—`	Metrics label for the STA upstream. An empty value falls back to the canonical upstream name.

Encryption and idempotency

Variable	Default / Required	Description
`CCS_CRYPTO_MASTER_KEY`	Required	Hex-encoded 32-byte AES-256 master key that encrypts the document values the service keeps encrypted. `Sensitive.` The boot fails when the value is absent, shorter or longer than 64 hexadecimal characters, or not hexadecimal.
`IDEMPOTENCY_KEY_PREFIX`	`idempotency:`	Base prefix on every idempotency cache key.
`IDEMPOTENCY_KEY_TTL_HRS`	`168`	Retention window in hours for a cached response.

API documentation

Variable	Default / Required	Description
`SWAGGER_ENABLED`	`false`	Mounts the interactive API-documentation route. Production keeps it off.
`SWAGGER_TITLE`	Service name	Title rendered in the API specification.
`SWAGGER_DESCRIPTION`	`—`	Description rendered in the API specification.
`SWAGGER_VERSION`	`1.0.0`	API version label rendered in the specification.
`SWAGGER_HOST`	`—`	Host override for the API specification.
`SWAGGER_SCHEMES`	`https`	Comma-separated URL schemes the specification accepts.

Telemetry and metrics

Variable	Default / Required	Description
`ENABLE_TELEMETRY`	`false`	Wires the OpenTelemetry exporter. See Observability for the platform view.
`OTEL_LIBRARY_NAME`	`—`	Instrumentation library name.
`OTEL_RESOURCE_SERVICE_NAME`	Service name	Service name resource attribute.
`OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT`	`—`	Deployment environment resource attribute.
`OTEL_EXPORTER_OTLP_ENDPOINT`	`—`	Collector address for the OpenTelemetry exporter.

Rate limits

Lerian CCS applies three rate-limit tiers to the /v1 routes: the default tier, the aggressive tier on mutating requests, and the export tier on heavy reads such as audit queries.

Variable	Default / Required	Description
`RATE_LIMIT_ENABLED`	`false`	Turns on the rate-limit subsystem. Production forces it to `true`.
`RATE_LIMIT_MAX`	`500`	Default tier request ceiling per window.
`RATE_LIMIT_WINDOW_SEC`	`60`	Default tier window in seconds.
`AGGRESSIVE_RATE_LIMIT_MAX`	`100`	Aggressive tier request ceiling per window.
`AGGRESSIVE_RATE_LIMIT_WINDOW_SEC`	`60`	Aggressive tier window in seconds.
`EXPORT_RATE_LIMIT_MAX`	`60`	Export tier request ceiling per window.
`EXPORT_RATE_LIMIT_WINDOW_SEC`	`60`	Export tier window in seconds.

Health endpoints

Lerian CCS exposes GET /health for liveness and GET /readyz for readiness on the main port, plus GET /version and GET /metrics. See Health and readiness for the probe contract and Operating Lerian CCS for the probe list.

Object storage

Lerian CCS reads inbound files from one bucket and writes outbound files to another. Both accept any S3-compatible store. An empty bucket name marks the matching readiness check as skipped.

Variable	Default / Required	Description
`OBJECT_STORAGE_STA_ENDPOINT`	`—`	Endpoint of the inbound bucket. An empty value selects the default cloud endpoint.
`OBJECT_STORAGE_STA_REGION`	`us-east-1`	Region of the inbound bucket.
`OBJECT_STORAGE_STA_BUCKET`	`—`	Name of the read-only inbound bucket.
`OBJECT_STORAGE_STA_ACCESS_KEY`	`—`	Access key for the inbound bucket. `Sensitive.` Leave it unset when an attached cloud role supplies the credentials.
`OBJECT_STORAGE_STA_SECRET_KEY`	`—`	Secret key for the inbound bucket. `Sensitive.`
`OBJECT_STORAGE_STA_USE_PATH_STYLE`	`false`	Uses path-style addressing on the inbound bucket.
`OBJECT_STORAGE_STA_DISABLE_SSL`	`false`	Disables TLS on the inbound bucket connection.
`OBJECT_STORAGE_STA_MAX_OBJECT_BYTES`	`536870912`	Maximum size of one inbound object, in bytes.
`OBJECT_STORAGE_STA_SSE_ALGORITHM`	Required when the inbound bucket is set	Encryption at rest for the inbound bucket: `AES256`, `aws:kms` or `none`. A blank or other value stops the boot. `none` boots only with a development `ENV_NAME` outside `saas`.
`OBJECT_STORAGE_STA_SSE_KMS_KEY_ID`	Required with `aws:kms`	Key identifier for `aws:kms` on the inbound bucket.
`OBJECT_STORAGE_CCS_ENDPOINT`	`—`	Endpoint of the outbound bucket. An empty value selects the default cloud endpoint.
`OBJECT_STORAGE_CCS_REGION`	`us-east-1`	Region of the outbound bucket.
`OBJECT_STORAGE_CCS_BUCKET`	`—`	Name of the outbound bucket that holds the rendered regulatory files.
`OBJECT_STORAGE_CCS_ACCESS_KEY`	`—`	Access key for the outbound bucket. `Sensitive.` Leave it unset when an attached cloud role supplies the credentials.
`OBJECT_STORAGE_CCS_SECRET_KEY`	`—`	Secret key for the outbound bucket. `Sensitive.`
`OBJECT_STORAGE_CCS_USE_PATH_STYLE`	`false`	Uses path-style addressing on the outbound bucket.
`OBJECT_STORAGE_CCS_DISABLE_SSL`	`false`	Disables TLS on the outbound bucket connection.
`OBJECT_STORAGE_CCS_SSE_ALGORITHM`	Required when the outbound bucket is set	Encryption at rest for the outbound bucket: `AES256`, `aws:kms` or `none`. A blank or other value stops the boot. `none` boots only with a development `ENV_NAME` outside `saas`.
`OBJECT_STORAGE_CCS_SSE_KMS_KEY_ID`	Required with `aws:kms`	Key identifier for `aws:kms` on the outbound bucket.

Retention and regulatory settings

Variable	Default / Required	Description
`CCS_OUTBOUND_RETENTION_DAYS`	`30`	Lifetime in days of an uploaded outbound file in the bucket. The service applies 30 days for a value of zero or less.
`CCS_ACCS009_RETENTION_DAYS`	`30`	Lifetime in days of a stored ACCS009 penalty report.
`CCS_NON_SUBMISSION_SCAN_INTERVAL_SEC`	`3600`	Interval in seconds between non-submission scans. The boot refuses a value of zero or less and a value above 86400.
`CCS_BACEN_DESTINATARIO_CNPJ_BASE`	`00000000`	Eight-digit BACEN recipient stamped on the file envelope. Set the real value before you go live.
`CCS_ACCS010_DTFIM_MODE`	`transfer_date`	Rule that resolves the mandatory end date on a relationship transfer.

Integrating with Lerian CCS covers the API surface, the error codes, and the published events.

​Service and runtime

​License

​CORS, TLS, and proxies

​PostgreSQL

​Redis

​Messaging and circuit breaker

​Outbox

​CCS outbox overrides

​Streaming

​STA integration

​Reporter integration

​Authentication

​Machine-to-machine credentials

​Encryption and idempotency

​API documentation

​Telemetry and metrics

​Rate limits

​Health endpoints

​Object storage

​Retention and regulatory settings

Service and runtime

License

CORS, TLS, and proxies

PostgreSQL

Redis

Messaging and circuit breaker

Outbox

CCS outbox overrides

Streaming

STA integration

Reporter integration

Authentication

Machine-to-machine credentials

Encryption and idempotency

API documentation

Telemetry and metrics

Rate limits

Health endpoints

Object storage

Retention and regulatory settings