Environment variables

Lerian CCS reads its configuration from the process environment at startup. You set these variables at deploy time. A service restart makes them take effect. A small set of operational knobs also accepts changes at runtime through Systemplane. BYOC configuration essentials documents the backbone every Lerian Go service shares. In the tables below, the Default / Required column shows the value the service applies when you leave the variable unset. A bold qualifier marks a variable you must set, such as Required or Required in production. — means the service applies no default. A variable flagged Sensitive. carries credential or key material. Inject it from your secret manager at deploy time. Never commit a value. Where a value in the shipped example file differs from the value the code applies, this page publishes the code value.

Service and runtime

Variable	Default / Required	Description
`APPLICATION_NAME`	Service name	Process application name that appears in logs and telemetry.
`VERSION`	`1.0.0`	Released service version string.
`ENV_NAME`	`—`	Deployment environment label, folded to lower case. The value `production` arms every production gate on this page.
`LOG_LEVEL`	`info`	Structured logger level: `debug`, `info`, `warn`, or `error`.
`DEPLOYMENT_MODE`	`local`	Operational posture: `local`, `byoc`, `saas`, or `onprem`. The value `saas` enforces TLS on every dependency.
`CCS_RUN_MODE`	`all`	Selects the subsystems this process runs: `manager` for the HTTP API only, `worker` for background workers only, or `all` for both. An invalid value stops the boot.
`SERVER_ADDRESS`	`—`	Main HTTP listen address. An unset value makes the server bind a port the operating system assigns, so deployments set it.
`SERVER_PORT`	`4030`	Port the in-container health-check binary calls. Keep it aligned with the port in `SERVER_ADDRESS`.
`GRPC_PORT`	`7001`	gRPC listen port.
`HTTP_BODY_LIMIT_BYTES`	`104857600`	Maximum inbound request body size, in bytes.
`SYSTEMPLANE_ENABLED`	`false`	Mounts the Systemplane runtime-configuration admin API under `/system`. Off by default, which keeps the service in environment-variable-only mode.
`DEFAULT_TENANT_ID`	`—`	Fallback tenant identifier for paths with no per-request tenant context.
`MIGRATIONS_PATH`	`—`	Filesystem path to the SQL migration files. The migration binaries read it directly. The service never applies migrations itself.
`INFRA_CONNECT_TIMEOUT_SEC`	`30`	Overall infrastructure dial budget in seconds. The service clamps a value of zero or less to 30 seconds.

License

Variable	Default / Required	Description
`LICENSE_KEY`	Required in production	License credential issued by Lerian. `Sensitive.` Leave it blank in development, which turns enforcement off.
`ORGANIZATION_IDS`	Required in production	Organization scope the license covers. Lerian CCS runs the license library in global mode, so the value is the literal `global`.
`LICENSE_SERVICE_ADDRESS`	`—`	Optional license-manager base URL. In production the value must use `https` and must not point at a loopback, private, link-local, or metadata host.

CORS, TLS, and proxies

Variable	Default / Required	Description
`CORS_ALLOWED_ORIGINS`	Required in production	Comma-separated list of allowed browser origins. A production boot refuses an empty list and refuses a wildcard.
`CORS_ALLOWED_METHODS`	`—`	Comma-separated list of allowed HTTP methods.
`CORS_ALLOWED_HEADERS`	`—`	Comma-separated list of allowed request headers.
`CORS_EXPOSE_HEADERS`	`—`	Comma-separated list of response headers the browser can read.
`CORS_ALLOW_CREDENTIALS`	`false`	Allows credentialed cross-origin requests.
`SERVER_TLS_CERT_FILE`	`—`	Path to the TLS certificate when the service terminates TLS itself. Set it together with the key file.
`SERVER_TLS_KEY_FILE`	`—`	Path to the TLS private key. Set it together with the certificate file.
`TLS_TERMINATED_UPSTREAM`	`false`	Marks the request path as TLS-terminated by a proxy in front of the service.
`TRUSTED_PROXIES`	Required in production	Comma-separated CIDR ranges of the layer-7 proxies whose `X-Forwarded-For` header the service honours. A production boot refuses an empty list and refuses a wildcard range.

Multi-tenancy

Variable	Default / Required	Description
`MULTI_TENANT_ENABLED`	`false`	Turns on the multi-tenant profile and the tenant-manager client.
`MULTI_TENANT_URL`	`—`	Tenant-manager HTTP base URL.
`MULTI_TENANT_SERVICE_API_KEY`	`—`	Static API key for the tenant-manager client. `Sensitive.`
`MULTI_TENANT_REDIS_HOST`	`—`	Host of the Redis instance that carries tenant pub/sub.
`MULTI_TENANT_REDIS_PORT`	`6379`	Port of the tenant pub/sub Redis instance.
`MULTI_TENANT_REDIS_PASSWORD`	`—`	Password for the tenant pub/sub Redis instance. `Sensitive.`
`MULTI_TENANT_REDIS_TLS`	`false` — Required in production when a tenant Redis host is set	Turns on TLS for the tenant pub/sub Redis client.
`MULTI_TENANT_REDIS_CA_CERT`	`—`	Base64-encoded PEM certificate-authority bundle for the tenant Redis handshake. Set it only when the managed cluster uses a certificate authority outside the system trust store.
`MULTI_TENANT_MAX_TENANT_POOLS`	`0`	Caps the number of per-tenant connection pools. A value of `0` means unlimited and disables pool eviction.
`MULTI_TENANT_IDLE_TIMEOUT_SEC`	`300`	Per-tenant connection idle timeout in seconds.
`MULTI_TENANT_TIMEOUT`	`30`	Tenant-manager client timeout in seconds.
`MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD`	`0`	Consecutive-failure trip threshold for the tenant-manager circuit breaker. A value of `0` disables the breaker.
`MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC`	`30`	Open-state cooldown in seconds for the tenant-manager circuit breaker.
`MULTI_TENANT_CACHE_TTL_SEC`	`120`	Per-tenant cache lifetime in seconds.
`MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC`	`30`	Interval in seconds between idle-tenant connection sweeps.
`MULTI_TENANT_CONSUMER_PREFETCH_COUNT`	`10`	Message prefetch count per per-tenant broker channel.

PostgreSQL

Variable	Default / Required	Description
`POSTGRES_HOST`	`—`	Primary database host. The connection identity carries no defaults, so an incomplete block fails the dial at boot.
`POSTGRES_PORT`	`—`	Primary database port.
`POSTGRES_USER`	`—`	Primary database user. An empty value makes the driver fall back to the process operating-system user.
`POSTGRES_PASSWORD`	`—`	Primary database password. `Sensitive.`
`POSTGRES_NAME`	`—`	Primary database name.
`POSTGRES_SSLMODE`	Required in production	Primary database TLS mode. A production boot refuses the value `disable`.
`POSTGRES_REPLICA_HOST`	`—`	Read-replica host for query scaling.
`POSTGRES_REPLICA_PORT`	`—`	Read-replica port.
`POSTGRES_REPLICA_USER`	`—`	Read-replica user.
`POSTGRES_REPLICA_PASSWORD`	`—`	Read-replica password. `Sensitive.`
`POSTGRES_REPLICA_NAME`	`—`	Read-replica database name.
`POSTGRES_REPLICA_SSLMODE`	`—`	Read-replica TLS mode. A production boot refuses the value `disable`.
`POSTGRES_MAX_OPEN_CONNS`	`25`	Maximum open connections per pool.
`POSTGRES_MAX_IDLE_CONNS`	`—`	Maximum idle connections per pool. The effective value differs between the single-tenant and multi-tenant paths, so the service applies no default here.
`POSTGRES_CONN_MAX_LIFETIME_MINS`	`30`	Maximum connection lifetime in minutes.
`POSTGRES_CONN_MAX_IDLE_TIME_MINS`	`5`	Maximum connection idle time in minutes.
`POSTGRES_CONNECT_TIMEOUT_SEC`	`—`	Dial timeout in seconds. An unset value leaves the dial bounded only by the operating-system timeout.
`POSTGRES_POOL_FANOUT_ACK`	`—`	Operator consent to exceed the safe connection fan-out across the control-plane pool and the per-tenant pools. Accepts `true`, `1`, `yes`, or `on`. Without it the boot refuses an oversized fan-out.

Redis

Variable	Default / Required	Description
`REDIS_HOST`	`—`	Redis address as `host:port`. A non-empty value also arms the TLS posture gate in `saas` mode.
`REDIS_MASTER_NAME`	`—`	Sentinel master name when the deployment uses Redis Sentinel.
`REDIS_PASSWORD`	`—`	Redis password. `Sensitive.`
`REDIS_DB`	`0`	Redis logical database number.
`REDIS_PROTOCOL`	`3`	Redis wire-protocol version.
`REDIS_TLS`	`false` — Required in production when multi-tenancy is on	Turns on TLS for the Redis client.
`REDIS_CA_CERT`	`—`	Path to an extra certificate authority for the Redis handshake.
`REDIS_POOL_SIZE`	`10`	Maximum Redis pool size. The client clamps a value above 1000.
`REDIS_MIN_IDLE_CONNS`	`—`	Minimum idle Redis connections kept warm. The client pre-warms none by default.
`REDIS_READ_TIMEOUT`	`3`	Redis read timeout in seconds.
`REDIS_WRITE_TIMEOUT`	`3`	Redis write timeout in seconds.
`REDIS_DIAL_TIMEOUT`	`5`	Redis dial timeout in seconds.
`REDIS_POOL_TIMEOUT`	`2`	Redis pool checkout timeout in seconds.
`REDIS_MAX_RETRIES`	`3`	Redis command retry budget.
`REDIS_MIN_RETRY_BACKOFF`	`8`	Minimum Redis retry backoff in milliseconds.
`REDIS_MAX_RETRY_BACKOFF`	`1`	Maximum Redis retry backoff in seconds.

Messaging and circuit breaker

Variable	Default / Required	Description
`CIRCUIT_BREAKER_ENABLED`	`false` — Required as `true`	Wires the circuit-breaker manager. The Reporter integration and the object-storage adapters both need it, so the boot refuses a value of `false`.
`RABBITMQ_ENABLED`	`false`	Turns on the message-broker wiring.
`RABBITMQ_URL`	`—`	Full broker connection URL. `Sensitive.` Set this or the host, because the boot refuses both empty when the broker is on.
`RABBITMQ_HOST`	`—`	Broker host.
`RABBITMQ_PORT_AMQP`	`—`	Broker message port.
`RABBITMQ_PORT_HOST`	`—`	Broker management port.
`RABBITMQ_DEFAULT_USER`	`—`	Broker username.
`RABBITMQ_DEFAULT_PASS`	`—`	Broker password. `Sensitive.`
`RABBITMQ_VHOST`	`—`	Broker virtual host.
`RABBITMQ_QUEUE`	`—`	Default queue name.
`RABBITMQ_EXCHANGE`	`—`	Default exchange name. An empty value publishes through the broker default exchange, which reads the routing key as a queue name.
`RABBITMQ_HEALTH_CHECK_URL`	`—`	HTTP endpoint the readiness probe calls to check the broker.
`RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS`	`—`	Comma-separated allow-list of hosts the health probe can target.
`RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS`	`false`	Forces the health-probe allow-list to be non-empty.
`RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS`	`5000`	Publisher confirm timeout in milliseconds.
`RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS`	`1000`	First publisher recovery backoff in milliseconds.
`RABBITMQ_PUBLISHER_RECOVERY_MAX_MS`	`30000`	Maximum publisher recovery backoff in milliseconds.
`RABBITMQ_PUBLISHER_MAX_RECOVERIES`	`10`	Maximum publisher recovery attempts before the publisher gives up.
`CCS_CONSUMER_MAX_REDELIVERIES`	`5`	Maximum retry cycles a transiently failed message can take before the consumer moves it to the terminal dead-letter queue.

Outbox

Lerian CCS writes each outbound message to a transactional outbox in the same database transaction as the state change. The OUTBOX_ family below configures the dispatcher that the shared platform library runs.

Variable	Default / Required	Description
`OUTBOX_ENABLED`	`false`	Turns on the outbox worker.
`OUTBOX_TABLE_NAME`	`—`	Outbox table name. The boot refuses an empty value when the outbox is on.
`OUTBOX_DISPATCH_INTERVAL_SEC`	`2`	Interval in seconds between dispatch cycles.
`OUTBOX_BATCH_SIZE`	`50`	Maximum events drained per dispatch cycle.
`OUTBOX_PUBLISH_MAX_ATTEMPTS`	`3`	Maximum publish attempts per event within one cycle.
`OUTBOX_PUBLISH_BACKOFF_MS`	`200`	Publish retry backoff in milliseconds.
`OUTBOX_RETRY_WINDOW_SEC`	`300`	Retry window in seconds for a failed event.
`OUTBOX_MAX_DISPATCH_ATTEMPTS`	`10`	Maximum dispatch attempts per event before the dispatcher stops retrying it.
`OUTBOX_PROCESSING_TIMEOUT_SEC`	`600`	Timeout in seconds after which the dispatcher reclaims a stuck event.
`OUTBOX_MAX_FAILED_PER_BATCH`	`25`	Maximum failed events in one batch before the dispatcher stops that batch.
`OUTBOX_INCLUDE_TENANT_METRICS`	`false`	Adds per-tenant labels to the outbox metrics.
`OUTBOX_PRIORITY_EVENT_TYPES`	`—`	Comma-separated event types the dispatcher sends first.
`OUTBOX_ALLOW_EMPTY_TENANT`	`false`	Accepts an event that carries no tenant context.

CCS outbox overrides

Variable	Default / Required	Description
`CCS_OUTBOX_OVERRIDES_ENABLED`	`false`	Arms the four overrides below. While it is `false`, the service loads them and never applies them.
`CCS_OUTBOX_DISPATCH_INTERVAL_MS`	`1000`	Dispatch interval in milliseconds. It takes precedence over the seconds-based interval, which preserves sub-second precision.
`CCS_OUTBOX_BATCH_SIZE`	`50`	Maximum events the registered handlers process per cycle.
`CCS_OUTBOX_MAX_ATTEMPTS`	`10`	Maximum dispatch attempts before the dispatcher marks an event permanently undeliverable.
`CCS_OUTBOX_DLQ_ROUTING_KEY`	`ccs.outbox.dlq`	Routing key the dead-letter publisher stamps on a permanently undeliverable event.

Streaming

The Lerian streaming library reads the STREAMING_ family, not the service configuration. Lerian Streaming Hub delivers the published events.

Variable	Default / Required	Description
`STREAMING_ENABLED`	`false`	Master switch for business-event emission. While it is off, the service wires a no-operation emitter and publishes nothing.
`STREAMING_BROKERS`	Required when streaming is on	Comma-separated broker bootstrap list. An enabled configuration with an empty list refuses to boot.
`STREAMING_CLOUDEVENTS_SOURCE`	Fixed	This service’s CloudEvents source. It sets the topic namespace and the event-type prefix. Leave it unset. Any value other than the built-in source refuses the boot, even when streaming is off.
`STREAMING_CLIENT_ID`	Host name	Broker client identifier used for broker-side diagnostics.
`STREAMING_CB_FAILURE_RATIO`	`0.5`	Failure ratio that opens the producer circuit breaker.
`STREAMING_CB_MIN_REQUESTS`	`10`	Minimum requests before the producer circuit breaker evaluates the failure ratio.
`STREAMING_CB_TIMEOUT_S`	`30`	Open-state cooldown in seconds for the producer circuit breaker.
`STREAMING_CLOSE_TIMEOUT_S`	`30`	Maximum drain and flush window in seconds when the producer closes.
`STREAMING_TLS_ENABLED`	`false` — Required as `true` in `saas`	Turns on TLS for the broker dial. The minimum version is TLS 1.2. In `saas` mode a plaintext broker dial refuses the boot.
`STREAMING_TLS_CA_CERT`	`—`	Base64-encoded PEM certificate authority for a private or on-premises broker. An empty value uses the host trust store. A malformed value refuses the boot.
`STREAMING_SASL_MECHANISM`	`—`	Broker authentication mechanism: `PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`. An empty value disables broker authentication. A mechanism without its credentials refuses the boot.
`STREAMING_SASL_USERNAME`	`—`	Broker authentication username.
`STREAMING_SASL_PASSWORD`	`—`	Broker authentication password. `Sensitive.`
`STREAMING_SASL_ALLOW_PLAINTEXT`	`false`	Allows broker authentication over a plaintext connection, which sends the credentials in the clear. The service refuses that combination unless you set this flag.

STA integration

Lerian CCS sends every outbound file to BACEN through Lerian STA and receives the answers back from it.

Variable	Default / Required	Description
`STA_ENABLED`	`false`	Wires the STA client, the submission handler, and the STA readiness probe.
`STA_BASE_URL`	Required when STA is on	Base URL of the STA service. An empty value refuses the boot.
`STA_HTTP_TIMEOUT_SEC`	`30`	Per-request timeout in seconds on the STA client. The service falls back to 30 seconds for a value of zero or less.
`STA_SD_SERVICE_NAME`	`sta`	Service-catalog name the discovery client resolves for the STA upstream.
`STA_FILE_HASH_VERIFY_ENABLED`	`false`	Verifies the SHA-256 digest of a downloaded inbound file against the digest on the file event.
`STA_EVENT_HMAC_VERIFY_ENABLED`	`false`	Authenticates inbound STA business events against the shared signature scheme. A boot with verification on and an incomplete key catalogue fails loudly.
`STA_EVENT_HMAC_MASTER_KEYS`	`—`	Catalogue of `version:hex` master keys shared with the STA service. `Sensitive.`
`STA_EVENT_HMAC_MASTER_KEY_VERSION`	`—`	Catalogue version the verifier treats as active.
`STA_EVENT_HMAC_TOLERANCE_SECONDS`	`300`	Freshness window in seconds for the signed timestamp. The service clamps a value of zero or less to 300.

Reporter integration

Lerian Reporter renders the daily ACCS001 file, so it is a mandatory upstream. The readiness probe treats it as a hard dependency. Start Lerian Reporter before you expect Lerian CCS to become ready.

Variable	Default / Required	Description
`REPORTER_URL`	Required	Base URL of the Reporter service. An empty value refuses the boot.
`REPORTER_HTTP_TIMEOUT_SEC`	`30`	Per-request timeout in seconds on the Reporter client. The service falls back to 30 seconds for a value of zero or less.
`REPORTER_TEMPLATE_ID_ACCS001`	`—`	Identifier of the Reporter template the ACCS001 render targets. The Reporter mints this identifier per environment when you register the template. An empty value refuses the batch approval with error `MYS-0008` and HTTP 503.
`REPORTER_TEMPLATE_NAME_ACCS001`	`—`	Description of the ACCS001 template in the Reporter. The service resolves the template by this description when you leave the identifier unset.
`REPORTER_SD_SERVICE_NAME`	`reporter`	Service-catalog name the discovery client resolves for the Reporter upstream.
`DETAIL_RENDER_MODE`	`inline`	Render path for a detail response. Only `inline` starts the service. Every other value refuses the boot.
`CCS_REPORTER_POLL_INITIAL_DELAY_MS`	`2000`	First backoff delay in milliseconds on the render poll loop.
`CCS_REPORTER_POLL_MAX_DELAY_MS`	`30000`	Maximum backoff delay in milliseconds on the render poll loop.
`CCS_REPORTER_POLL_TOTAL_TIMEOUT_SEC`	`1800`	Total poll budget in seconds. A render older than this budget ends as a timeout.
`CCS_REPORTER_POLL_BACKOFF_MULTIPLIER`	`2.0`	Multiplier applied to the delay after each poll. The boot refuses a value below `1.0`.

Service discovery

The Lerian service-discovery library reads the SD_ family, not the service configuration. Lerian CCS resolves other services and does not register itself, so it needs no advertised address.

Variable	Default / Required	Description
`SD_ENABLED`	`false`	Turns on upstream resolution through the discovery server. While it is off, the service uses the static upstream URLs.
`SD_ADDRESS`	`—`	Discovery server address as `host:port`.
`SD_TLS`	`false`	Uses HTTPS to reach the discovery server.
`SD_TLS_SKIP_VERIFY`	`false`	Skips certificate verification on the discovery server connection.
`SD_TOKEN`	`—`	Access-control token for the discovery server. `Sensitive.`
`SD_DIAL_TIMEOUT`	`5s`	Dial timeout for the discovery client.
`SD_TLS_HANDSHAKE_TIMEOUT`	`5s`	TLS handshake timeout for the discovery client.
`SD_RESPONSE_HEADER_TIMEOUT`	`10s`	Response-header timeout for the discovery client.
`SD_SEED_TIMEOUT`	`3s`	Timeout for the first catalogue read at startup.
`SD_ALLOW_STALE`	`true`	Allows stale catalogue reads, which keeps resolution available during a leader change.
`SD_EXTERNAL_ADDRESS`	`—`	Advertised external address for self-registration.
`SD_EXTERNAL_PORT`	`0`	Advertised external port for self-registration.
`SD_INTERNAL_ADDRESS`	`—`	Advertised internal address for self-registration.
`SD_INTERNAL_PORT`	`0`	Advertised internal port for self-registration.
`SD_INTERNAL_SCHEME`	`—`	Scheme, `http` or `https`, for the internal view of a registration.
`SD_PREFER_VIEW`	`external`	View the client prefers when a service registers both an external and an internal address.

Authentication

Variable	Default / Required	Description
`PLUGIN_AUTH_ENABLED`	`false` — Required as `true` in `saas` multi-tenant	Turns on bearer-token authentication on every `/v1` route. It also drives the outbound token mint.
`PLUGIN_AUTH_HOST`	Required when authentication is on	Base URL of Lerian Access Manager.

Machine-to-machine credentials

Lerian CCS mints an outbound token per upstream through Lerian Access Manager. Each upstream carries its own credential pair. No upstream shares a credential, and the service has no fallback.

Variable	Default / Required	Description
`REPORTER_CLIENT_ID`	Required when authentication is on	Client identifier for the Reporter upstream.
`REPORTER_CLIENT_SECRET`	Required when authentication is on	Client secret for the Reporter upstream. `Sensitive.`
`STA_CLIENT_ID`	Required when authentication is on	Client identifier for the STA upstream.
`STA_CLIENT_SECRET`	Required when authentication is on	Client secret for the STA upstream. `Sensitive.`
`REPORTER_M2M_TARGET_SERVICE`	`—`	Metrics label for the Reporter upstream. An empty value falls back to the canonical upstream name.
`STA_M2M_TARGET_SERVICE`	`—`	Metrics label for the STA upstream. An empty value falls back to the canonical upstream name.
`M2M_CREDENTIAL_CACHE_TTL_SEC`	`300`	Lifetime in seconds of a cached outbound credential.
`AWS_REGION`	`—`	Region for the AWS Secrets Manager client that resolves per-tenant credentials in `saas` mode. An empty value leaves region resolution to the cloud SDK.

Encryption and idempotency

Variable	Default / Required	Description
`CCS_CRYPTO_MASTER_KEY`	Required	Hex-encoded 32-byte AES-256 master key that protects personal data at rest. `Sensitive.` The boot fails when the value is absent, shorter or longer than 64 hexadecimal characters, or not hexadecimal.
`IDEMPOTENCY_KEY_PREFIX`	`idempotency:`	Base prefix on every idempotency cache key.
`IDEMPOTENCY_KEY_TTL_HRS`	`168`	Retention window in hours for a cached response.
`IDEMPOTENCY_RETRY_WINDOW_SEC`	`—`	Legacy retry budget in seconds, kept for compatibility.

API documentation

Variable	Default / Required	Description
`SWAGGER_ENABLED`	`false`	Mounts the interactive API-documentation route.
`SWAGGER_TITLE`	Service name	Title rendered in the API specification.
`SWAGGER_DESCRIPTION`	`—`	Description rendered in the API specification.
`SWAGGER_VERSION`	`1.0.0`	API version label rendered in the specification.
`SWAGGER_HOST`	`—`	Host override for the API specification.
`SWAGGER_SCHEMES`	`https`	Comma-separated URL schemes the specification accepts.

Telemetry and metrics

Variable	Default / Required	Description
`ENABLE_TELEMETRY`	`false`	Wires the OpenTelemetry exporter. See Observability for the platform view.
`OTEL_LIBRARY_NAME`	`—`	Instrumentation library name.
`OTEL_RESOURCE_SERVICE_NAME`	`—`	Service name resource attribute.
`OTEL_RESOURCE_SERVICE_VERSION`	`—`	Service version resource attribute. It also feeds the readiness version chain.
`OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT`	`—`	Deployment environment resource attribute.
`OTEL_EXPORTER_OTLP_ENDPOINT`	`—`	Collector address for the OpenTelemetry exporter.

Rate limits

Lerian CCS applies five rate-limit tiers to the /v1 routes. The export tier covers heavy reads such as audit and reconciliation queries. The dispatch tier covers heavy writes that call an upstream.

Variable	Default / Required	Description
`RATE_LIMIT_ENABLED`	`false` — Required in production as `true`	Turns on the rate-limit subsystem. A production boot refuses the value `false`.
`RATE_LIMIT_MAX`	`500`	Default tier request ceiling per window.
`RATE_LIMIT_WINDOW_SEC`	`60`	Default tier window in seconds.
`AGGRESSIVE_RATE_LIMIT_MAX`	`100`	Aggressive tier request ceiling per window.
`AGGRESSIVE_RATE_LIMIT_WINDOW_SEC`	`60`	Aggressive tier window in seconds.
`RELAXED_RATE_LIMIT_MAX`	`1000`	Relaxed tier request ceiling per window.
`RELAXED_RATE_LIMIT_WINDOW_SEC`	`60`	Relaxed tier window in seconds.
`EXPORT_RATE_LIMIT_MAX`	`60`	Export tier request ceiling per window.
`EXPORT_RATE_LIMIT_WINDOW_SEC`	`60`	Export tier window in seconds.
`DISPATCH_RATE_LIMIT_MAX`	`30`	Dispatch tier request ceiling per window.
`DISPATCH_RATE_LIMIT_WINDOW_SEC`	`60`	Dispatch tier window in seconds.

Readiness and shutdown

Variable	Default / Required	Description
`READYZ_PROBE_TIMEOUT_SEC`	`5`	Timeout in seconds for each dependency probe.
`READYZ_DEP_SLOW_THRESHOLD_MS`	`500`	Threshold in milliseconds above which a probe reports a dependency as slow without failing readiness.
`STARTUP_SELF_PROBE_MAX_DURATION_SEC`	`120`	Maximum window in seconds for the startup self-probe.
`STARTUP_SELF_PROBE_INITIAL_DELAY_MS`	`1000`	First self-probe backoff in milliseconds.
`STARTUP_SELF_PROBE_MAX_DELAY_MS`	`30000`	Maximum self-probe backoff in milliseconds.
`SHUTDOWN_DRAIN_GRACE_PERIOD_SEC`	`15`	Window in seconds after a termination signal during which the service answers 503 before it closes the listener.
`SHUTDOWN_TOTAL_TIMEOUT_SEC`	`30`	Overall shutdown deadline in seconds.

Lerian CCS exposes GET /health for liveness and GET /readyz for readiness on the main port, plus GET /version and GET /metrics. With multi-tenancy on it also exposes GET /readyz/tenant/{id}. See Health and readiness for the probe contract and Operating Lerian CCS for the probe list.

Object storage

Lerian CCS reads inbound files from one bucket and writes outbound files to another. Both accept any S3-compatible store. An empty bucket name marks the matching readiness check as skipped.

Variable	Default / Required	Description
`OBJECT_STORAGE_STA_ENDPOINT`	`—`	Endpoint of the inbound bucket. An empty value selects the default cloud endpoint.
`OBJECT_STORAGE_STA_REGION`	`us-east-1`	Region of the inbound bucket.
`OBJECT_STORAGE_STA_BUCKET`	`—`	Name of the read-only inbound bucket.
`OBJECT_STORAGE_STA_ACCESS_KEY`	`—`	Access key for the inbound bucket. `Sensitive.` Leave it unset when an attached cloud role supplies the credentials.
`OBJECT_STORAGE_STA_SECRET_KEY`	`—`	Secret key for the inbound bucket. `Sensitive.`
`OBJECT_STORAGE_STA_USE_PATH_STYLE`	`false`	Uses path-style addressing on the inbound bucket.
`OBJECT_STORAGE_STA_DISABLE_SSL`	`false`	Disables TLS on the inbound bucket connection.
`OBJECT_STORAGE_STA_MAX_OBJECT_BYTES`	`536870912`	Maximum size of one inbound object, in bytes.
`OBJECT_STORAGE_CCS_ENDPOINT`	`—`	Endpoint of the outbound bucket. An empty value selects the default cloud endpoint.
`OBJECT_STORAGE_CCS_REGION`	`us-east-1`	Region of the outbound bucket.
`OBJECT_STORAGE_CCS_BUCKET`	`—`	Name of the outbound bucket that holds the rendered regulatory files.
`OBJECT_STORAGE_CCS_ACCESS_KEY`	`—`	Access key for the outbound bucket. `Sensitive.` Leave it unset when an attached cloud role supplies the credentials.
`OBJECT_STORAGE_CCS_SECRET_KEY`	`—`	Secret key for the outbound bucket. `Sensitive.`
`OBJECT_STORAGE_CCS_USE_PATH_STYLE`	`false`	Uses path-style addressing on the outbound bucket.
`OBJECT_STORAGE_CCS_DISABLE_SSL`	`false`	Disables TLS on the outbound bucket connection.
`OBJECT_STORAGE_CCS_MAX_OBJECT_BYTES`	`536870912`	Maximum size of one outbound object, in bytes.

Retention and regulatory settings

Variable	Default / Required	Description
`CCS_OUTBOUND_RETENTION_DAYS`	`30`	Lifetime in days of an uploaded outbound file in the bucket. The service applies 30 days for a value of zero or less.
`CCS_ACCS009_RETENTION_DAYS`	`30`	Lifetime in days of a stored ACCS009 penalty report.
`CCS_NON_SUBMISSION_SCAN_INTERVAL_SEC`	`3600`	Interval in seconds between non-submission scans. The boot refuses a value of zero or less and a value above 86400.
`CCS_BACEN_DESTINATARIO_CNPJ_BASE`	`00000000`	Eight-digit BACEN recipient stamped on the file envelope. Set the real value before you go live.
`CCS_ACCS010_DTFIM_MODE`	`transfer_date`	Rule that resolves the mandatory end date on a relationship transfer.

Integrating with Lerian CCS covers the API surface, the error codes, and the published events.

​Service and runtime

​License

​CORS, TLS, and proxies

​Multi-tenancy

​PostgreSQL

​Redis

​Messaging and circuit breaker

​Outbox

​CCS outbox overrides

​Streaming

​STA integration

​Reporter integration

​Service discovery

​Authentication

​Machine-to-machine credentials

​Encryption and idempotency

​API documentation

​Telemetry and metrics

​Rate limits

​Readiness and shutdown

​Object storage

​Retention and regulatory settings

Service and runtime

License

CORS, TLS, and proxies

Multi-tenancy

PostgreSQL

Redis

Messaging and circuit breaker

Outbox

CCS outbox overrides

Streaming

STA integration

Reporter integration

Service discovery

Authentication

Machine-to-machine credentials

Encryption and idempotency

API documentation

Telemetry and metrics

Rate limits

Readiness and shutdown

Object storage

Retention and regulatory settings