> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Environment variables > Consignado-specific deployment variables for Dataprev connectivity, workers, auctions, credentials, artifacts, pacing, and operational windows. Set these variables at deployment time. Unless stated otherwise, changing one requires a restart. The [BYOC configuration reference](/en/reference/byoc-configuration) covers the shared Lerian runtime: server, datastores, multi-tenancy, telemetry, authentication, streaming, outbox, and licensing. This page lists Consignado-specific settings and the few shared settings that materially change its rail behavior. `—` means no default. Variables carrying certificates, private keys, OAuth secrets, or HMAC keys are sensitive and must come from a secret manager. ## Service and tenant mode | Variable | Default | Purpose | | ------------------------------ | ------------- | ----------------------------------------------------------------------------------------------------------------------- | | `SERVER_ADDRESS` | `:8080` | Main HTTP listener for the API and probes. | | `ENV_NAME` | `development` | Arms production hardening when set to `production`. | | `ENVIRONMENT_NAME` | — | Multi-tenant event-listener environment; falls back to `ENV_NAME`. | | `SYSTEMPLANE_ENABLED` | `false` | Enables runtime configuration under `/system`. | | `MULTI_TENANT_ENABLED` | `false` | Selects per-tenant Dataprev credential custody over the single-tenant static fallback. | | `DEFAULT_TENANT_ID` | `default` | Tenant used in single-tenant mode. | | `OUTBOX_ENABLED` | `true` | Must be `true`; startup refuses a deployment that cannot durably record rail facts. | | `STREAMING_ENABLED` | `true` | Must be `true`; the streaming relay is the only publisher for outbox facts. | | `STREAMING_BROKERS` | — | Required broker list. Startup refuses a relay with no destination. | | `STREAMING_CLOUDEVENTS_SOURCE` | — | Must be exactly `consignado-gw`. Startup refuses any other value; a wrong source means no fact ever reaches a consumer. | ## Dataprev client and authentication | Variable | Default | Purpose | | --------------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------- | | `DATAPREV_ENABLED` | `false` | Master switch for the Dataprev rail runtime. | | `DATAPREV_BASE_URL` | — | Base URL for the main Dataprev API. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts. | | `DATAPREV_TOMBAMENTO_BASE_URL` | — | Separate endpoint for tombamento operations. Empty keeps those operations unavailable. It follows the same HTTPS/loopback policy. | | `DATAPREV_OAUTH_TOKEN_URL` | — | OAuth2 token endpoint. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts. | | `DATAPREV_OAUTH_CLIENT_ID` | — | Single-tenant OAuth client ID fallback. Sensitive. | | `DATAPREV_OAUTH_CLIENT_SECRET` | — | Single-tenant OAuth client secret fallback. Sensitive. | | `DATAPREV_OAUTH_SCOPES` | — | Space-delimited OAuth scopes requested from Dataprev. | | `DATAPREV_CERT_FILE` | — | Local ICP-Brasil certificate path for non-managed single-tenant development. Sensitive. | | `DATAPREV_KEY_FILE` | — | Local private-key path paired with `DATAPREV_CERT_FILE`. Sensitive. | | `DATAPREV_CODIGO_SOLICITANTE` | — | Three-digit requester-code fallback for single-tenant mode. | | `DATAPREV_REQUEST_TIMEOUT_SEC` | `30` | Timeout for one Dataprev request. | | `DATAPREV_REQUESTS_PER_SECOND` | `25` | Validated operator ceiling and Systemplane default for rail pacing. | | `DATAPREV_CONSENT_CACHE_HMAC_KEY` | — | HMAC key used to index worker-consent cache entries without exposing CPF. Required when the rail uses Redis. Sensitive. | Managed deployments must use tenant credential custody. They fail closed instead of falling back to an unauthenticated or non-mTLS client. ## Contract and portability windows | Variable | Default | Purpose | | -------------------------------------------------------- | ------- | ------------------------------------------------------------------- | | `DATAPREV_AVERBACAO_ENABLED` | `false` | Enables the averbação runtime and proposal-witness path. | | `DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS` | `72` | Lookback window for portability proposals. | | `DATAPREV_PORTABILIDADE_INCLUSAO_GARANTIAS_PATH` | — | Override for the Dataprev portability-guarantee submission path. | | `DATAPREV_PORTABILIDADE_AVERBACAO_WINDOW_DAYS` | `20` | Window to complete outbound portability registration. | | `DATAPREV_REFINANCIAMENTO_REVERSAO_WINDOW_BUSINESS_DAYS` | `7` | Business-day window for refinancing reversal. | | `DATAPREV_SALDO_DEVEDOR_CLOCK_INTERVAL_SEC` | `86400` | Cadence for outstanding-balance obligations and month-end fallback. | ## Reconciliation and employment feeds | Variable | Default | Purpose | | ----------------------------------------------- | ---------- | ---------------------------------------------------------------- | | `DATAPREV_RECONCILIATION_ENABLED` | `false` | Enables payroll bookkeeping and repasse reconciliation. | | `DATAPREV_RECONCILIATION_INTERVAL_SEC` | `3600` | Reconciliation cadence. | | `DATAPREV_RECONCILIATION_LOOKBACK_MONTHS` | `1` | Previous payroll competences included in each pass. | | `DATAPREV_RECONCILIATION_CNPJS` | — | Comma-separated employer scopes; empty reads the rail-wide feed. | | `DATAPREV_RECONCILIATION_TENANT_ID` | — | Tenant used by single-tenant scheduled feeds. | | `DATAPREV_EMPLOYMENT_REPORT_ENABLED` | `false` | Enables the employment-termination feed. | | `DATAPREV_EMPLOYMENT_REPORT_ADAPTER` | `disabled` | `dataprev` for the real adapter; `fake` is local-only. | | `DATAPREV_EMPLOYMENT_REPORT_INTERVAL_SEC` | `3600` | Employment-report cadence. | | `DATAPREV_EMPLOYMENT_REPORT_PAGE_SIZE` | `100` | Records requested per page. | | `DATAPREV_EMPLOYMENT_REPORT_CONCURRENCY` | `4` | Concurrent tenant workers. | | `DATAPREV_EMPLOYMENT_REPORT_TENANT_TIMEOUT_SEC` | `300` | Maximum processing time for one tenant in a pass. | ## Exclusion and redirection | Variable | Default | Purpose | | ------------------------------------------------ | ---------- | ----------------------------------------------------------------------------- | | `DATAPREV_EXCLUSION_ENABLED` | `false` | Enables exclusion admission and recovery. | | `DATAPREV_EXCLUSION_PROVIDER_TIMEOUT_SEC` | `30` | Timeout for one exclusion provider call. | | `DATAPREV_EXCLUSION_CLAIM_DWELL_SEC` | `60` | Minimum dwell before claimed work can be retried. | | `DATAPREV_EXCLUSION_STATUS_CHECK_LEASE_SEC` | `60` | Lease for exclusion status checks. | | `DATAPREV_EXCLUSION_RECOVERY_INTERVAL_SEC` | `30` | Recovery-loop cadence. | | `DATAPREV_EXCLUSION_RECOVERY_BATCH` | `50` | Operations claimed per pass. | | `DATAPREV_EXCLUSION_RECOVERY_CONCURRENCY` | `4` | Concurrent recovery workers. | | `DATAPREV_EXCLUSION_RECOVERY_TENANT_TIMEOUT_SEC` | `60` | Maximum processing time for one tenant in a pass. | | `DATAPREV_REDIRECTION_ADAPTER` | `disabled` | Redirection adapter selection. `fake` is accepted only for local development. | `DATAPREV_EXCLUSION_ADAPTER` and `DATAPREV_EXCLUSION_FAKE_BASE_URL` are retired. Remove them from deployment manifests. Non-inert legacy values fail validation. ## Outcome recovery A rail command can end with its outcome unestablished: the process died mid-call, or Dataprev never answered. Two recovery loops converge that state against the rail's own registry. Both loops are off by default. Enable them in any deployment that submits averbações or rail commands. Otherwise an unestablished outcome never resolves. | Variable | Default | Purpose | | ----------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------- | | `DATAPREV_AVERBACAO_RECOVERY_ENABLED` | `false` | Enables averbação outcome convergence. | | `DATAPREV_AVERBACAO_RECOVERY_INTERVAL_SEC` | `60` | Convergence cadence. | | `DATAPREV_AVERBACAO_RECOVERY_BATCH` | `50` | Records claimed per pass. | | `DATAPREV_AVERBACAO_RECOVERY_CONCURRENCY` | `4` | Concurrent tenant workers. | | `DATAPREV_AVERBACAO_RECOVERY_TENANT_TIMEOUT_SEC` | `60` | Maximum processing time for one tenant in a pass. | | `DATAPREV_AVERBACAO_RECOVERY_MINIMUM_DWELL_SEC` | `300` | Minimum age before an unestablished outcome is reconciled. | | `DATAPREV_AVERBACAO_RECOVERY_PROVIDER_TIMEOUT_SEC` | `30` | Timeout for one registry read. | | `DATAPREV_RAIL_COMMAND_RECOVERY_ENABLED` | `false` | Enables convergence for refinancing, reversal, renegotiation, and origin-side portability exclusion. | | `DATAPREV_RAIL_COMMAND_RECOVERY_INTERVAL_SEC` | `60` | Convergence cadence. | | `DATAPREV_RAIL_COMMAND_RECOVERY_BATCH` | `50` | Records claimed per pass. | | `DATAPREV_RAIL_COMMAND_RECOVERY_CONCURRENCY` | `4` | Concurrent tenant workers. | | `DATAPREV_RAIL_COMMAND_RECOVERY_TENANT_TIMEOUT_SEC` | `60` | Maximum processing time for one tenant in a pass. | | `DATAPREV_RAIL_COMMAND_RECOVERY_MINIMUM_DWELL_SEC` | `300` | Minimum age before an unestablished outcome is reconciled. | | `DATAPREV_RAIL_COMMAND_RECOVERY_PROVIDER_TIMEOUT_SEC` | `30` | Timeout for one registry read. | ## Auctions and client bids | Variable | Default | Purpose | | --------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `LEILAO_ENABLED` | `false` | Enables scheduled discovery of open loan requests. | | `LEILAO_CLIENT_BID_ENABLED` | `false` | Enables the authenticated client bid command surface. | | `LEILAO_INTERVAL_SEC` | `3600` | Auction-discovery cadence. | | `LEILAO_TENANT_ID` | — | Tenant used by the M001 auction and M011 portability-discovery flows. Required when either enabled flow needs it. | | `LEILAO_PORTAL_BASE_URL` | — | Optional single-tenant worker portal base URL fallback. Leaving it unset is a valid deployment: bids then travel with the client's own contacts. A value that is set is validated at boot and an unsafe one fails the boot closed. | | `LEILAO_DISCOVERY_LOOKBACK_HOURS` | `8760` | Initial and recovery lookback for open requests. | | `LEILAO_DISCOVERY_CLOCK_SKEW_SEC` | `300` | Clock-skew overlap applied to discovery windows. | | `LEILAO_PORTABILITY_ENABLED` | `false` | Enables M011 portability discovery. This is independent from `LEILAO_ENABLED`. | | `LEILAO_PORTABILITY_INTERVAL_SEC` | `3600` | Cadence of the M011 portability-discovery pass. | | `LEILAO_BID_MANAGER_RPS` | `25` | Request budget for bid-manager fan-out. | | `LEILAO_BID_MANAGER_BURST` | `25` | Immediate burst budget for bid-manager fan-out. | | `LEILAO_DECIDE_DEADLINE_SEC` | `5` | Decision deadline per bid manager. | M011 portability discovery requires `LEILAO_PORTABILITY_ENABLED=true`, `LEILAO_TENANT_ID`, `DATAPREV_ENABLED=true`, `STREAMING_ENABLED=true`, a primary database, and the canonical outbox. It does not require `LEILAO_ENABLED=true`. The portability listing window is 72 hours by default (`DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS`). The service refuses to boot unless that window is wider than `LEILAO_PORTABILITY_INTERVAL_SEC` plus the 300-second `LEILAO_DISCOVERY_CLOCK_SKEW_SEC` margin. ## Credential custody and artifacts | Variable | Default | Purpose | | --------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `CREDENTIALS_STORE_ENABLED` | `false` | Enables tenant credential custody. Required when the Dataprev rail runs in a managed deployment. | | `CREDENTIALS_CLEANUP_INTERVAL_SEC` | `30` | Credential-cleanup cadence. | | `CREDENTIALS_CLEANUP_BATCH_SIZE` | `50` | Credentials claimed per cleanup pass. | | `CREDENTIALS_CLEANUP_CONCURRENCY` | `4` | Concurrent cleanup workers. | | `CREDENTIALS_CLEANUP_LEASE_SEC` | `60` | Cleanup lease. | | `CREDENTIALS_CLEANUP_PERSISTENCE_TIMEOUT_SEC` | `5` | Persistence timeout for one cleanup operation. | | `AVERBACAO_ARTIFACTS_BUCKET` | — | Private object-store bucket for CCB and rail artifacts. Required when `DATAPREV_AVERBACAO_ENABLED=true`. | | `AVERBACAO_ARTIFACTS_ENDPOINT_URL` | — | S3-compatible endpoint override for local or private object stores. | | `AVERBACAO_ARTIFACTS_USE_PATH_STYLE` | `false` | Uses path-style S3 addressing when enabled. | | `AWS_REGION` | — | Region used by credential custody and artifact storage. Deliberately has no default: an unset value lets the AWS SDK resolve the institution's own region, and a hardcoded one would override it. Set it explicitly for the region your data must stay in. | | `AWS_ENDPOINT_URL` | — | AWS-compatible endpoint override for local development. Do not set it in managed AWS production. | Consignado has no non-event-driven startup mode: outbox, streaming, and brokers are mandatory even though the platform shares those settings. Keep the CloudEvent source pinned to `consignado-gw`.