Environment variables

Lerian SCR is the Lerian-owned rail that consults borrower positions at BACEN. You set these variables at deploy time. A service restart makes them take effect. The system plane holds a second set of knobs an operator changes after deployment. See Operations and System plane. In the tables below, the Default / Required column shows the default value. — means no default. A bold qualifier marks a value you must set. A row marked Sensitive. carries credential or key material. Inject it from your secret manager at deploy time, and never commit a value. The strict posture covers a production environment name and the saas deployment mode. Required in production marks a value that the strict posture demands. A missing or insecure value there refuses the boot.

Service and runtime

Variable	Default / Required	Description
`SERVICE_NAME`	`br-scr`	Service identity stamped on logs and telemetry.
`ENV_NAME`	`development`	Deployment environment. The values `production` and `prod` select the strict posture.
`LOG_LEVEL`	`info`	Minimum log level. One of `debug`, `info`, `warn`, `error`. Another value refuses the boot.
`SERVER_PORT`	`3003`	Inbound HTTP listen port.
`DEPLOYMENT_MODE`	`local`, Required in production	TLS posture. One of `local`, `byoc`, `saas`. The value `saas` selects the strict posture. The strict posture demands an explicit value.
`TRUSTED_PROXIES`	—	Comma-separated proxy addresses or CIDR ranges whose forwarded client IP the service trusts. Empty trusts no proxy and reads the direct peer. A wildcard range refuses a strict boot.
`PROXY_HEADER`	`X-Forwarded-For`	Header the service reads the client IP from. It applies only when the trusted proxy list is set.
`MULTI_TENANT_ENABLED`	`false`	The value `true` serves many institutions from one instance through the tenant directory. The value `false` serves one.
`MULTI_TENANT_URL`	Required with multi-tenancy	Tenant directory base URL.
`MULTI_TENANT_SERVICE_API_KEY`	Required with multi-tenancy	Service key sent as `X-API-Key` on every tenant directory request. Sensitive.
`READYZ_DRAIN_DELAY`	`3s`	Window held open after readiness reports 503 on shutdown, before the listener closes. A `0` disables the wait. An invalid or a negative value falls back to the default. The service caps the window at a third of the shutdown budget.

Lerian SCR exposes /health, /readyz, and /version on the main port. See Health and readiness for the probe contract, and Operations for the readiness checks.

Postgres

Postgres holds the audit trail, the credential metadata, and the outbox. An operator applies the schema before the first start. The service reads the schema and never creates it.

Variable	Default / Required	Description
`POSTGRES_HOST`	Required in production	Database host.
`POSTGRES_PORT`	`5432`	Database port.
`POSTGRES_USER`	Required in production	Database user.
`POSTGRES_PASSWORD`	—	Password for that user. Sensitive.
`POSTGRES_DB`	Required in production	Database name.
`POSTGRES_SSLMODE`	`disable`, Required in production	Connection TLS mode. The strict posture accepts only `require`, `verify-ca`, or `verify-full`.
`POSTGRES_MAX_OPEN_CONNS`	`25`	Maximum open connections in the pool. A value of `0` or less restores the default.
`POSTGRES_MAX_IDLE_CONNS`	`10`	Maximum idle connections in the pool. A value of `0` or less restores the default.
`POSTGRES_CONN_LIFETIME`	`30m`	Maximum lifetime of a pooled connection. An unparseable value falls back to the default.
`POSTGRES_CONN_IDLE_TIME`	`5m`	Maximum idle time of a pooled connection. An unparseable value falls back to the default.

Redis

Redis backs the result cache, the idempotency window, and the inbound rate limit.

Variable	Default / Required	Description
`REDIS_HOST`	Required	Cache host. Every deployment mode requires it, unless the operator states the opt-out below. A blank host otherwise refuses the boot.
`REDIS_PORT`	`6379`	Cache port.
`REDIS_PASSWORD`	—	Cache password. Sensitive.
`REDIS_TLS_ENABLED`	`false`, Required in production	The strict posture demands `true` when Redis is configured.
`SCR_REDIS_DISABLED`	`false`	The value `true` is the explicit statement that this deployment runs without Redis. The result cache, the idempotency window, and the rate limit then degrade.

Streaming

The outbox dispatcher publishes the consultation events. No variable sets the topic, because the service derives it from the event source. The first five variables belong to Lerian SCR. The rest belong to the streaming library, which applies the broker TLS and the SASL credentials to the dial.

Variable	Default / Required	Description
`SCR_STREAMING_BROKERS`	Required	Comma-separated broker addresses. Every deployment mode requires them, unless the operator states the opt-out below. A blank list otherwise refuses the boot.
`SCR_STREAMING_CLIENT_ID`	`br-scr`	Producer client identifier.
`SCR_STREAMING_SOURCE`	`br-scr`	CloudEvents source, and the origin of the topic name. The boot refuses any other value. The service compares the raw value, so padding also refuses the boot.
`SCR_STREAMING_TLS`	`false`, Required in production	The strict posture demands `true` when brokers are configured. A `true` here also demands `STREAMING_TLS_ENABLED=true`.
`SCR_STREAMING_EMISSION_DISABLED`	`false`	The value `true` stops the dispatcher. The events stay as pending outbox rows, and they ship once a broker is configured.
`STREAMING_TLS_ENABLED`	`false`	Enables the TLS dial to the broker.
`STREAMING_TLS_CA_CERT`	—	Base64-encoded PEM certificate authority. A broker behind a private authority needs it. Without it only a publicly trusted broker certificate validates.
`STREAMING_SASL_MECHANISM`	—	SASL mechanism for the producer. Without a mechanism the producer connects anonymously and presents no principal for the write grant.
`STREAMING_SASL_USERNAME`	—	SASL user.
`STREAMING_SASL_PASSWORD`	—	SASL password. Sensitive.
`STREAMING_SASL_ALLOW_PLAINTEXT`	`false`	The value `true` puts the SASL credentials on the wire in the clear. Keep it `false`.

Authentication

Variable	Default / Required	Description
`PLUGIN_AUTH_ENABLED`	`false`, Required in production	The value `true` enables the authorization round trip on every gated request. The strict posture demands `true`.
`PLUGIN_AUTH_ADDRESS`	Required in production	Authorization server base URL. The strict posture demands an `https` scheme.

BACEN channel

The outbound channel reaches the BACEN consultation web service over HTTPS with HTTP Basic credentials. The service reads the two credential variables only when the secret store kind is the environment.

Variable	Default / Required	Description
`SCR_WSSCR2N_BASE_URL`	Required in production	Full base URL, including the BACEN context path. The adapter appends only the operation path. The homologation host is `www9.bcb.gov.br` and the production host is `scr.bcb.gov.br`. The strict posture demands an `https` scheme.
`SCR_WSSCR2N_BASIC_USER`	Required in production with the environment secret store	The institution’s virtual service user, in BACEN’s `UUUUUDDDD.OPERADOR` format. It is not the name of the Sisbacen transaction.
`SCR_WSSCR2N_BASIC_PASSWORD`	Required in production with the environment secret store	Password for that service user. Sensitive.

Secret store

The secret store resolves the BACEN channel credential.

Variable	Default / Required	Description
`SECRET_STORE_KIND`	`env`	Credential backing. The value `env` reads the credential from the environment. The value `aws` reads it per institution from the managed vault, and it mounts the credential operations. Another value refuses the boot.
`AWS_REGION`	Required in production with the managed vault	Region the managed vault client resolves its endpoint from.
`SECRET_STORE_PREFIX`	—	Vault path prefix for the per-institution credentials. Not a secret.

At-rest encryption

The audit trail encrypts the borrower data and indexes it blind. Two independent keys do that work. One key for both would leak the relation between the ciphertext and the index. Outside the strict posture the service falls back to well-known development keys, which must never reach a regulated runtime.

Variable	Default / Required	Description
`SCR_ATREST_ENCRYPTION_KEY`	Required in production	AES-256 envelope key, as base64 or as 32 raw bytes. Sensitive.
`SCR_ATREST_BLIND_INDEX_KEY`	Required in production	HMAC key for the searchable document index. It must hold at least 32 characters, and it must differ from the envelope key. Sensitive.

Telemetry and metrics

Variable	Default / Required	Description
`ENABLE_TELEMETRY`	`false`	The value `true` wires the OpenTelemetry providers.
`OTEL_EXPORTER_OTLP_ENDPOINT`	—	Collector endpoint. With telemetry on, the strict posture demands an `https` scheme.
`METRICS_PROMETHEUS_ENABLED`	`false`	The value `true` opts into a dedicated Prometheus scrape listener.
`METRICS_PROMETHEUS_ADDRESS`	`127.0.0.1:9075`	Bind address of that listener. The application port carries no `/metrics` route.

​Service and runtime

​Postgres

​Redis

​Streaming

​Authentication

​BACEN channel

​Secret store

​At-rest encryption

​Telemetry and metrics

Service and runtime

Postgres

Redis

Streaming

Authentication

BACEN channel

Secret store

At-rest encryption

Telemetry and metrics