Environment variables

Lerian STA is the Lerian-owned rail that transmits and receives files with BACEN’s STA hub. These variables are set at deploy time and require a service restart to take effect. The universal backbone that every Lerian Go service shares — server, datastores, multi-tenancy, telemetry, plugin authentication, and licensing — is documented once in BYOC configuration essentials; this page covers only the variables distinctive to Lerian STA. In the tables below, the Default / Required column shows the default value; a bold qualifier (e.g. Required, Required in production) marks variables that must be set. — means no default. Any variable flagged Sensitive carries credential or key material — inject it from your secret manager at deploy time and never commit a value.

Service and runtime

Variable	Default / Required	Description
`SERVER_ADDRESS`	`:4028`	Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port.
`SYSTEMPLANE_ENABLED`	`false`	Enable the Systemplane runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode).
`DEFAULT_TENANT_ID`	`11111111-1111-1111-1111-111111111111`	Tenant UUID used in single-tenant mode. Must be a valid UUID.
`BACEN_ENVIRONMENT`	`homologation`	Selects the upstream BACEN STA target for the connectivity probe: `homologation` (staging) or `production` (live). An unrecognized value falls back to `homologation` so a non-production stack cannot route traffic to the live BACEN service.

Lerian STA exposes /health (liveness) and /readyz (readiness) on the main port, plus /version and /metrics, and — when multi-tenancy is enabled — GET /readyz/tenant/{id}. See Health and readiness for the probe contract.

Object storage

Lerian STA persists transfer bytes and inbound downloads to an S3-compatible object store. Each subsystem configures its own connection through the AWS SDK, so the same wiring drives AWS S3, MinIO, or a local store.

Variable	Default / Required	Description
`TRANSFER_OBJECT_STORAGE_BUCKET`	Required in production	Bucket holding both transfer directions, keyed by direction prefix. Boot is refused if empty in production.
`TRANSFER_INBOUND_ENABLED`	`false`	Enable the inbound (BACEN-pulled) transfer pipeline. When `true`, `TRANSFER_OBJECT_STORAGE_BUCKET` is required in production.
`TRANSFER_INBOUND_MAX_FILE_SIZE_BYTES`	`5368709120`	Ceiling on the BACEN-advertised inbound file size (default 5 GiB). Larger files are skip-listed before any bytes are written.
`AWS_REGION`	`us-east-1`	Region for the object-store and M2M connections.
`AWS_ACCESS_KEY_ID`	—	Access key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials.
`AWS_SECRET_ACCESS_KEY`	—	Secret key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials.

Envelope encryption

Operator credentials are protected with AES-GCM envelope encryption. The master-key material is always required — the manager process aborts boot if it is missing or malformed.

Variable	Default / Required	Description
`MASTER_KEY_PROVIDER`	`envvar`	Source of the envelope-encryption key: `envvar` (key read from `MASTER_KEYS`) or `aws-kms` (key wrapped by a cloud KMS).
`MASTER_KEY_VERSION`	`v1` · Required	Selects the currently active master-key version.
`MASTER_KEYS`	Required	Comma-separated `version:key` pairs. Sensitive. Under `envvar` each key is a 32-byte AES-256 key; under `aws-kms` each value is a wrapped blob. Source from your secret manager — a missing or malformed value aborts boot.
`MASTER_KEY_KMS_KEY_ID`	Required if `aws-kms`	Reference to the cloud-KMS key that wraps the master keys. Key material never enters the process; only the reference is passed.
`CREDENTIALS_RECOVERY_ON_BOOT`	`true`	Run the worker-side credential-recovery sweep once at boot to resolve credentials left mid-rotation by a previous process.

Trust store

Each tenant uploads the X.509 root certificates Lerian STA trusts when establishing mutual TLS to BACEN. The trust-store module is always on. Certificate PEM bodies are persisted to the object store, so the trust-store bucket connection is required.

Variable	Default / Required	Description
`TRUST_STORE_S3_BUCKET`	Required	Bucket holding the per-tenant trust-store certificate PEMs. Boot fails without it.
`TRUST_STORE_S3_REGION`	`us-east-1`	Region for the trust-store bucket.
`TRUST_STORE_S3_ENDPOINT`	—	Object-store endpoint. Leave empty to fall back to the AWS S3 default endpoint.
`TRUST_STORE_S3_PATH_STYLE`	`false`	Use path-style addressing. Required for MinIO or a local store; leave `false` for AWS S3.
`TRUST_STORE_MAX_CERT_SIZE_BYTES`	`65536`	Maximum accepted size of an uploaded certificate PEM.
`TRUST_STORE_EXPIRING_SOON_DAYS`	`30`	Window, in days, at which a certificate is reported as expiring soon. Operator-tunable with hot reload.
`TRUST_STORE_DEFAULT_PAGE_SIZE`	`25`	Default page size for the trust-store listing API.
`TRUST_STORE_MAX_PAGE_SIZE`	`100`	Maximum page size for the trust-store listing API.

Lerian STA runs its audit pipeline in a dedicated worker: an outbox publisher, a hash-chained audit consumer, a partition manager, an outbox cleanup, and an asynchronous audit-export generator. These run when multi-tenancy and the broker are enabled and are tuned through the AUDIT_PUBLISHER_*, AUDIT_CONSUMER_*, AUDIT_PARTITION_*, AUDIT_CLEANUP_*, AUDIT_EXPORT_GENERATOR_*, and AUDIT_EXPORT_RATE_LIMIT_* families, each shipping working defaults.

Overview

Lerian SPB

Lerian SPI

Lerian SILOC

Lerian SLC

Lerian STA

Lerian SISBAJUD

Lerian Consignado — Dataprev

Environment variables

Service and runtime

Object storage

Envelope encryption

Trust store

​Service and runtime

​Object storage

​Envelope encryption

​Trust store

Service and runtime

Object storage

Envelope encryption

Trust store