Environment variables

Set these variables at deployment time. Unless stated otherwise, changing one requires a restart. The BYOC configuration reference covers the shared Lerian runtime: server, datastores, multi-tenancy, telemetry, authentication, streaming, outbox, and licensing. This page lists Consignado-specific settings and the few shared settings that materially change its rail behavior. — means no default. Variables carrying certificates, private keys, OAuth secrets, or HMAC keys are sensitive and must come from a secret manager.

Service and tenant mode

Variable	Default	Purpose
`SERVER_ADDRESS`	`:8080`	Main HTTP listener for the API and probes.
`ENV_NAME`	`development`	Arms production hardening when set to `production`.
`ENVIRONMENT_NAME`	—	Multi-tenant event-listener environment; falls back to `ENV_NAME`.
`SYSTEMPLANE_ENABLED`	`false`	Enables runtime configuration under `/system`.
`MULTI_TENANT_ENABLED`	`false`	Selects per-tenant Dataprev credential custody over the single-tenant static fallback.
`DEFAULT_TENANT_ID`	`default`	Tenant used in single-tenant mode.
`OUTBOX_ENABLED`	`true`	Must be `true`; startup refuses a deployment that cannot durably record rail facts.
`STREAMING_ENABLED`	`true`	Must be `true`; the streaming relay is the only publisher for outbox facts.
`STREAMING_BROKERS`	—	Required broker list. Startup refuses a relay with no destination.
`STREAMING_CLOUDEVENTS_SOURCE`	—	Must be exactly `consignado-gw`. Startup refuses any other value; a wrong source means no fact ever reaches a consumer.

Dataprev client and authentication

Variable	Default	Purpose
`DATAPREV_ENABLED`	`false`	Master switch for the Dataprev rail runtime.
`DATAPREV_BASE_URL`	—	Base URL for the main Dataprev API. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts.
`DATAPREV_TOMBAMENTO_BASE_URL`	—	Separate endpoint for tombamento operations. Empty keeps those operations unavailable. It follows the same HTTPS/loopback policy.
`DATAPREV_OAUTH_TOKEN_URL`	—	OAuth2 token endpoint. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts.
`DATAPREV_OAUTH_CLIENT_ID`	—	Single-tenant OAuth client ID fallback. Sensitive.
`DATAPREV_OAUTH_CLIENT_SECRET`	—	Single-tenant OAuth client secret fallback. Sensitive.
`DATAPREV_OAUTH_SCOPES`	—	Space-delimited OAuth scopes requested from Dataprev.
`DATAPREV_CERT_FILE`	—	Local ICP-Brasil certificate path for non-managed single-tenant development. Sensitive.
`DATAPREV_KEY_FILE`	—	Local private-key path paired with `DATAPREV_CERT_FILE`. Sensitive.
`DATAPREV_CODIGO_SOLICITANTE`	—	Three-digit requester-code fallback for single-tenant mode.
`DATAPREV_REQUEST_TIMEOUT_SEC`	`30`	Timeout for one Dataprev request.
`DATAPREV_REQUESTS_PER_SECOND`	`25`	Validated operator ceiling and Systemplane default for rail pacing.
`DATAPREV_CONSENT_CACHE_HMAC_KEY`	—	HMAC key used to index worker-consent cache entries without exposing CPF. Required when the rail uses Redis. Sensitive.

Managed deployments must use tenant credential custody. They fail closed instead of falling back to an unauthenticated or non-mTLS client.

Contract and portability windows

Variable	Default	Purpose
`DATAPREV_AVERBACAO_ENABLED`	`false`	Enables the averbação runtime and proposal-witness path.
`DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS`	`72`	Lookback window for portability proposals.
`DATAPREV_PORTABILIDADE_INCLUSAO_GARANTIAS_PATH`	—	Override for the Dataprev portability-guarantee submission path.
`DATAPREV_PORTABILIDADE_AVERBACAO_WINDOW_DAYS`	`20`	Window to complete outbound portability registration.
`DATAPREV_REFINANCIAMENTO_REVERSAO_WINDOW_BUSINESS_DAYS`	`7`	Business-day window for refinancing reversal.
`DATAPREV_SALDO_DEVEDOR_CLOCK_INTERVAL_SEC`	`86400`	Cadence for outstanding-balance obligations and month-end fallback.

Reconciliation and employment feeds

Variable	Default	Purpose
`DATAPREV_RECONCILIATION_ENABLED`	`false`	Enables payroll bookkeeping and repasse reconciliation.
`DATAPREV_RECONCILIATION_INTERVAL_SEC`	`3600`	Reconciliation cadence.
`DATAPREV_RECONCILIATION_LOOKBACK_MONTHS`	`1`	Previous payroll competences included in each pass.
`DATAPREV_RECONCILIATION_CNPJS`	—	Comma-separated employer scopes; empty reads the rail-wide feed.
`DATAPREV_RECONCILIATION_TENANT_ID`	—	Tenant used by single-tenant scheduled feeds.
`DATAPREV_EMPLOYMENT_REPORT_ENABLED`	`false`	Enables the employment-termination feed.
`DATAPREV_EMPLOYMENT_REPORT_ADAPTER`	`disabled`	`dataprev` for the real adapter; `fake` is local-only.
`DATAPREV_EMPLOYMENT_REPORT_INTERVAL_SEC`	`3600`	Employment-report cadence.
`DATAPREV_EMPLOYMENT_REPORT_PAGE_SIZE`	`100`	Records requested per page.
`DATAPREV_EMPLOYMENT_REPORT_CONCURRENCY`	`4`	Concurrent tenant workers.
`DATAPREV_EMPLOYMENT_REPORT_TENANT_TIMEOUT_SEC`	`300`	Maximum processing time for one tenant in a pass.

Exclusion and redirection

Variable	Default	Purpose
`DATAPREV_EXCLUSION_ENABLED`	`false`	Enables exclusion admission and recovery.
`DATAPREV_EXCLUSION_PROVIDER_TIMEOUT_SEC`	`30`	Timeout for one exclusion provider call.
`DATAPREV_EXCLUSION_CLAIM_DWELL_SEC`	`60`	Minimum dwell before claimed work can be retried.
`DATAPREV_EXCLUSION_STATUS_CHECK_LEASE_SEC`	`60`	Lease for exclusion status checks.
`DATAPREV_EXCLUSION_RECOVERY_INTERVAL_SEC`	`30`	Recovery-loop cadence.
`DATAPREV_EXCLUSION_RECOVERY_BATCH`	`50`	Operations claimed per pass.
`DATAPREV_EXCLUSION_RECOVERY_CONCURRENCY`	`4`	Concurrent recovery workers.
`DATAPREV_EXCLUSION_RECOVERY_TENANT_TIMEOUT_SEC`	`60`	Maximum processing time for one tenant in a pass.
`DATAPREV_REDIRECTION_ADAPTER`	`disabled`	Redirection adapter selection. `fake` is accepted only for local development.

DATAPREV_EXCLUSION_ADAPTER and DATAPREV_EXCLUSION_FAKE_BASE_URL are retired. Remove them from deployment manifests; non-inert legacy values fail validation.

Outcome recovery

A rail command can end with its outcome unestablished: the process died mid-call, or Dataprev never answered. Two recovery loops converge that state against the rail’s own registry. Both are disabled by default; enable them in any deployment that submits averbações or rail commands, or an unestablished outcome is never resolved.

Variable	Default	Purpose
`DATAPREV_AVERBACAO_RECOVERY_ENABLED`	`false`	Enables averbação outcome convergence.
`DATAPREV_AVERBACAO_RECOVERY_INTERVAL_SEC`	`60`	Convergence cadence.
`DATAPREV_AVERBACAO_RECOVERY_BATCH`	`50`	Records claimed per pass.
`DATAPREV_AVERBACAO_RECOVERY_CONCURRENCY`	`4`	Concurrent tenant workers.
`DATAPREV_AVERBACAO_RECOVERY_TENANT_TIMEOUT_SEC`	`60`	Maximum processing time for one tenant in a pass.
`DATAPREV_AVERBACAO_RECOVERY_MINIMUM_DWELL_SEC`	`300`	Minimum age before an unestablished outcome is reconciled.
`DATAPREV_AVERBACAO_RECOVERY_PROVIDER_TIMEOUT_SEC`	`30`	Timeout for one registry read.
`DATAPREV_RAIL_COMMAND_RECOVERY_ENABLED`	`false`	Enables convergence for refinancing, reversal, renegotiation, and origin-side portability exclusion.
`DATAPREV_RAIL_COMMAND_RECOVERY_INTERVAL_SEC`	`60`	Convergence cadence.
`DATAPREV_RAIL_COMMAND_RECOVERY_BATCH`	`50`	Records claimed per pass.
`DATAPREV_RAIL_COMMAND_RECOVERY_CONCURRENCY`	`4`	Concurrent tenant workers.
`DATAPREV_RAIL_COMMAND_RECOVERY_TENANT_TIMEOUT_SEC`	`60`	Maximum processing time for one tenant in a pass.
`DATAPREV_RAIL_COMMAND_RECOVERY_MINIMUM_DWELL_SEC`	`300`	Minimum age before an unestablished outcome is reconciled.
`DATAPREV_RAIL_COMMAND_RECOVERY_PROVIDER_TIMEOUT_SEC`	`30`	Timeout for one registry read.

Auctions and client bids

Variable	Default	Purpose
`LEILAO_ENABLED`	`false`	Enables scheduled discovery of open loan requests.
`LEILAO_CLIENT_BID_ENABLED`	`false`	Enables the authenticated client bid command surface.
`LEILAO_INTERVAL_SEC`	`3600`	Auction-discovery cadence.
`LEILAO_TENANT_ID`	—	Tenant used by the M001 auction and M011 portability-discovery flows. Required when either enabled flow needs it.
`LEILAO_PORTAL_BASE_URL`	—	Optional single-tenant worker portal base URL fallback. Leaving it unset is a valid deployment: bids then travel with the client’s own contacts. A value that is set is validated at boot and an unsafe one fails the boot closed.
`LEILAO_DISCOVERY_LOOKBACK_HOURS`	`8760`	Initial and recovery lookback for open requests.
`LEILAO_DISCOVERY_CLOCK_SKEW_SEC`	`300`	Clock-skew overlap applied to discovery windows.
`LEILAO_PORTABILITY_ENABLED`	`false`	Enables M011 portability discovery. This is independent from `LEILAO_ENABLED`.
`LEILAO_PORTABILITY_INTERVAL_SEC`	`3600`	Cadence of the M011 portability-discovery pass.
`LEILAO_BID_MANAGER_RPS`	`25`	Request budget for bid-manager fan-out.
`LEILAO_BID_MANAGER_BURST`	`25`	Immediate burst budget for bid-manager fan-out.
`LEILAO_DECIDE_DEADLINE_SEC`	`5`	Decision deadline per bid manager.

M011 portability discovery requires LEILAO_PORTABILITY_ENABLED=true, LEILAO_TENANT_ID, DATAPREV_ENABLED=true, STREAMING_ENABLED=true, a primary database, and the canonical outbox. It does not require LEILAO_ENABLED=true. The portability listing window is 72 hours by default (DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS); the service refuses to boot unless that window is wider than LEILAO_PORTABILITY_INTERVAL_SEC plus the 300-second LEILAO_DISCOVERY_CLOCK_SKEW_SEC margin.

Credential custody and artifacts

Variable	Default	Purpose
`CREDENTIALS_STORE_ENABLED`	`false`	Enables tenant credential custody. Required when the Dataprev rail runs in a managed deployment.
`CREDENTIALS_CLEANUP_INTERVAL_SEC`	`30`	Credential-cleanup cadence.
`CREDENTIALS_CLEANUP_BATCH_SIZE`	`50`	Credentials claimed per cleanup pass.
`CREDENTIALS_CLEANUP_CONCURRENCY`	`4`	Concurrent cleanup workers.
`CREDENTIALS_CLEANUP_LEASE_SEC`	`60`	Cleanup lease.
`CREDENTIALS_CLEANUP_PERSISTENCE_TIMEOUT_SEC`	`5`	Persistence timeout for one cleanup operation.
`AVERBACAO_ARTIFACTS_BUCKET`	—	Private object-store bucket for CCB and rail artifacts. Required when `DATAPREV_AVERBACAO_ENABLED=true`.
`AVERBACAO_ARTIFACTS_ENDPOINT_URL`	—	S3-compatible endpoint override for local or private object stores.
`AVERBACAO_ARTIFACTS_USE_PATH_STYLE`	`false`	Uses path-style S3 addressing when enabled.
`AWS_REGION`	—	Region used by credential custody and artifact storage. Deliberately has no default: an unset value lets the AWS SDK resolve the institution’s own region, and a hardcoded one would override it. Set it explicitly for the region your data must stay in.
`AWS_ENDPOINT_URL`	—	AWS-compatible endpoint override for local development. Do not set it in managed AWS production.

Consignado has no non-event-driven startup mode: outbox, streaming, and brokers are mandatory even though they are shared platform settings. Keep the CloudEvent source pinned to consignado-gw.

​Service and tenant mode

​Dataprev client and authentication

​Contract and portability windows

​Reconciliation and employment feeds

​Exclusion and redirection

​Outcome recovery

​Auctions and client bids

​Credential custody and artifacts

Service and tenant mode

Dataprev client and authentication

Contract and portability windows

Reconciliation and employment feeds

Exclusion and redirection

Outcome recovery

Auctions and client bids

Credential custody and artifacts