> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Environment variables > Deploy-time environment variables for Lerian SCR: the BACEN consultation channel, the datastores, event streaming, the secret store, and the at-rest keys. Lerian SCR is the Lerian-owned rail that consults borrower positions at BACEN. You set these variables at deploy time. A service restart makes them take effect. The system plane holds a second set of knobs an operator changes after deployment. See [Operations](/en/rails/native/scr/scr-operations) and [System plane](/en/reference/systemplane/overview). In the tables below, the **Default / Required** column shows the default value. `—` means no default. A bold qualifier marks a value you must set. A row marked `Sensitive.` carries credential or key material. Inject it from your secret manager at deploy time, and never commit a value. The strict posture covers a production environment name and the `saas` deployment mode. **Required in production** marks a value that the strict posture demands. A missing or insecure value there refuses the boot. ## Service and runtime *** | Variable | Default / Required | Description | | ------------------------------ | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SERVICE_NAME` | `br-scr` | Service identity stamped on logs and telemetry. | | `ENV_NAME` | `development` | Deployment environment. The values `production` and `prod` select the strict posture. | | `LOG_LEVEL` | `info` | Minimum log level. One of `debug`, `info`, `warn`, `error`. Another value refuses the boot. | | `SERVER_PORT` | `3003` | Inbound HTTP listen port. | | `DEPLOYMENT_MODE` | `local`, **Required in production** | TLS posture. One of `local`, `byoc`, `saas`. The value `saas` selects the strict posture. The strict posture demands an explicit value. | | `TRUSTED_PROXIES` | — | Comma-separated proxy addresses or CIDR ranges whose forwarded client IP the service trusts. Empty trusts no proxy and reads the direct peer. A wildcard range refuses a strict boot. | | `PROXY_HEADER` | `X-Forwarded-For` | Header the service reads the client IP from. It applies only when the trusted proxy list is set. | | `MULTI_TENANT_ENABLED` | `false` | The value `true` serves many institutions from one instance through the tenant directory. The value `false` serves one. | | `MULTI_TENANT_URL` | **Required with multi-tenancy** | Tenant directory base URL. | | `MULTI_TENANT_SERVICE_API_KEY` | **Required with multi-tenancy** | Service key sent as `X-API-Key` on every tenant directory request. Sensitive. | | `READYZ_DRAIN_DELAY` | `3s` | Window held open after readiness reports 503 on shutdown, before the listener closes. A `0` disables the wait. An invalid or a negative value falls back to the default. The service caps the window at a third of the shutdown budget. | Lerian SCR exposes `/health`, `/readyz`, and `/version` on the main port. See [Health and readiness](/en/reference/health-and-readiness) for the probe contract, and [Operations](/en/rails/native/scr/scr-operations) for the readiness checks. ## Postgres *** Postgres holds the audit trail, the credential metadata, and the outbox. An operator applies the schema before the first start. The service reads the schema and never creates it. | Variable | Default / Required | Description | | ------------------------- | ------------------------------------- | ---------------------------------------------------------------------------------------------- | | `POSTGRES_HOST` | **Required in production** | Database host. | | `POSTGRES_PORT` | `5432` | Database port. | | `POSTGRES_USER` | **Required in production** | Database user. | | `POSTGRES_PASSWORD` | — | Password for that user. Sensitive. | | `POSTGRES_DB` | **Required in production** | Database name. | | `POSTGRES_SSLMODE` | `disable`, **Required in production** | Connection TLS mode. The strict posture accepts only `require`, `verify-ca`, or `verify-full`. | | `POSTGRES_MAX_OPEN_CONNS` | `25` | Maximum open connections in the pool. A value of `0` or less restores the default. | | `POSTGRES_MAX_IDLE_CONNS` | `10` | Maximum idle connections in the pool. A value of `0` or less restores the default. | | `POSTGRES_CONN_LIFETIME` | `30m` | Maximum lifetime of a pooled connection. An unparseable value falls back to the default. | | `POSTGRES_CONN_IDLE_TIME` | `5m` | Maximum idle time of a pooled connection. An unparseable value falls back to the default. | ## Redis *** Redis backs the result cache, the idempotency window, and the inbound rate limit. | Variable | Default / Required | Description | | -------------------- | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `REDIS_HOST` | **Required** | Cache host. Every deployment mode requires it, unless the operator states the opt-out below. A blank host otherwise refuses the boot. | | `REDIS_PORT` | `6379` | Cache port. | | `REDIS_PASSWORD` | — | Cache password. Sensitive. | | `REDIS_TLS_ENABLED` | `false`, **Required in production** | The strict posture demands `true` when Redis is configured. | | `SCR_REDIS_DISABLED` | `false` | The value `true` is the explicit statement that this deployment runs without Redis. The result cache, the idempotency window, and the rate limit then degrade. | ## Streaming *** The outbox dispatcher publishes the consultation events. No variable sets the topic, because the service derives it from the event source. The first five variables belong to Lerian SCR. The rest belong to the streaming library, which applies the broker TLS and the SASL credentials to the dial. | Variable | Default / Required | Description | | --------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SCR_STREAMING_BROKERS` | **Required** | Comma-separated broker addresses. Every deployment mode requires them, unless the operator states the opt-out below. A blank list otherwise refuses the boot. | | `SCR_STREAMING_CLIENT_ID` | `br-scr` | Producer client identifier. | | `SCR_STREAMING_SOURCE` | `br-scr` | CloudEvents source, and the origin of the topic name. The boot refuses any other value. The service compares the raw value, so padding also refuses the boot. | | `SCR_STREAMING_TLS` | `false`, **Required in production** | The strict posture demands `true` when brokers are configured. A `true` here also demands `STREAMING_TLS_ENABLED=true`. | | `SCR_STREAMING_EMISSION_DISABLED` | `false` | The value `true` stops the dispatcher. The events stay as pending outbox rows, and they ship once a broker is configured. | | `STREAMING_TLS_ENABLED` | `false` | Enables the TLS dial to the broker. | | `STREAMING_TLS_CA_CERT` | — | Base64-encoded PEM certificate authority. A broker behind a private authority needs it. Without it only a publicly trusted broker certificate validates. | | `STREAMING_SASL_MECHANISM` | — | SASL mechanism for the producer. Without a mechanism the producer connects anonymously and presents no principal for the write grant. | | `STREAMING_SASL_USERNAME` | — | SASL user. | | `STREAMING_SASL_PASSWORD` | — | SASL password. Sensitive. | | `STREAMING_SASL_ALLOW_PLAINTEXT` | `false` | The value `true` puts the SASL credentials on the wire in the clear. Keep it `false`. | ## Authentication *** | Variable | Default / Required | Description | | --------------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | `PLUGIN_AUTH_ENABLED` | `false`, **Required in production** | The value `true` enables the authorization round trip on every gated request. The strict posture demands `true`. | | `PLUGIN_AUTH_ADDRESS` | **Required in production** | Authorization server base URL. The strict posture demands an `https` scheme. | ## BACEN channel *** The outbound channel reaches the BACEN consultation web service over HTTPS with HTTP Basic credentials. The service reads the two credential variables only when the secret store kind is the environment. | Variable | Default / Required | Description | | ---------------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SCR_WSSCR2N_BASE_URL` | **Required in production** | Full base URL, including the BACEN context path. The adapter appends only the operation path. The homologation host is `www9.bcb.gov.br` and the production host is `scr.bcb.gov.br`. The strict posture demands an `https` scheme. | | `SCR_WSSCR2N_BASIC_USER` | **Required in production with the environment secret store** | The institution's virtual service user, in BACEN's `UUUUUDDDD.OPERADOR` format. It is not the name of the Sisbacen transaction. | | `SCR_WSSCR2N_BASIC_PASSWORD` | **Required in production with the environment secret store** | Password for that service user. Sensitive. | ## Secret store *** The secret store resolves the BACEN channel credential. | Variable | Default / Required | Description | | --------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `SECRET_STORE_KIND` | `env` | Credential backing. The value `env` reads the credential from the environment. The value `aws` reads it per institution from the managed vault, and it mounts the credential operations. Another value refuses the boot. | | `AWS_REGION` | **Required in production with the managed vault** | Region the managed vault client resolves its endpoint from. | | `SECRET_STORE_PREFIX` | — | Vault path prefix for the per-institution credentials. Not a secret. | ## At-rest encryption *** The audit trail encrypts the borrower data and indexes it blind. Two independent keys do that work. One key for both would leak the relation between the ciphertext and the index. Outside the strict posture the service falls back to well-known development keys, which must never reach a regulated runtime. | Variable | Default / Required | Description | | ---------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | `SCR_ATREST_ENCRYPTION_KEY` | **Required in production** | AES-256 envelope key, as base64 or as 32 raw bytes. Sensitive. | | `SCR_ATREST_BLIND_INDEX_KEY` | **Required in production** | HMAC key for the searchable document index. It must hold at least 32 characters, and it must differ from the envelope key. Sensitive. | ## Telemetry and metrics *** | Variable | Default / Required | Description | | ----------------------------- | ------------------ | ------------------------------------------------------------------------------------ | | `ENABLE_TELEMETRY` | `false` | The value `true` wires the OpenTelemetry providers. | | `OTEL_EXPORTER_OTLP_ENDPOINT` | — | Collector endpoint. With telemetry on, the strict posture demands an `https` scheme. | | `METRICS_PROMETHEUS_ENABLED` | `false` | The value `true` opts into a dedicated Prometheus scrape listener. | | `METRICS_PROMETHEUS_ADDRESS` | `127.0.0.1:9075` | Bind address of that listener. The application port carries no `/metrics` route. |