> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.
# Environment variables
> Deploy-time environment variables distinctive to Lerian STA — the BACEN environment target, S3-compatible object storage, envelope-encryption master keys, and the trust store.
Lerian STA is the Lerian-owned rail that transmits and receives files with BACEN's STA hub. These variables are set at deploy time and require a service restart to take effect. The universal backbone that every Lerian Go service shares — server, datastores, multi-tenancy, telemetry, plugin authentication, and licensing — is documented once in [BYOC configuration essentials](/en/reference/byoc-configuration); this page covers only the variables distinctive to Lerian STA.
In the tables below, the **Default / Required** column shows the default value; a bold qualifier (e.g. **Required**, **Required in production**) marks variables that must be set. `—` means no default. Any variable flagged **Sensitive** carries credential or key material — inject it from your secret manager at deploy time and never commit a value.
## Service and runtime
| Variable | Default / Required | Description |
| --------------------- | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SERVER_ADDRESS` | `:4028` | Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port. |
| `SYSTEMPLANE_ENABLED` | `false` | Enable the [Systemplane](/en/reference/systemplane/overview) runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode). |
| `DEFAULT_TENANT_ID` | `11111111-1111-1111-1111-111111111111` | Tenant UUID used in single-tenant mode. Must be a valid UUID. |
| `BACEN_ENVIRONMENT` | `homologation` | Selects the upstream BACEN STA target for the connectivity probe: `homologation` (staging) or `production` (live). An unrecognized value falls back to `homologation` so a non-production stack cannot route traffic to the live BACEN service. |
Lerian STA exposes `/health` (liveness) and `/readyz` (readiness) on the main port, plus `/version` and `/metrics`, and — when multi-tenancy is enabled — `GET /readyz/tenant/{id}`. See [Health and readiness](/en/reference/health-and-readiness) for the probe contract.
## Object storage
Lerian STA persists transfer bytes and inbound downloads to an S3-compatible object store. Each subsystem configures its own connection through the AWS SDK, so the same wiring drives AWS S3, MinIO, or a local store.
| Variable | Default / Required | Description |
| -------------------------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| `TRANSFER_OBJECT_STORAGE_BUCKET` | **Required in production** | Bucket holding both transfer directions, keyed by direction prefix. Boot is refused if empty in production. |
| `TRANSFER_INBOUND_ENABLED` | `false` | Enable the inbound (BACEN-pulled) transfer pipeline. When `true`, `TRANSFER_OBJECT_STORAGE_BUCKET` is required in production. |
| `TRANSFER_INBOUND_MAX_FILE_SIZE_BYTES` | `5368709120` | Ceiling on the BACEN-advertised inbound file size (default 5 GiB). Larger files are skip-listed before any bytes are written. |
| `AWS_REGION` | `us-east-1` | Region for the object-store and M2M connections. |
| `AWS_ACCESS_KEY_ID` | — | Access key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials. |
| `AWS_SECRET_ACCESS_KEY` | — | Secret key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials. |
## Envelope encryption
Operator credentials are protected with AES-GCM envelope encryption. The master-key material is always required — the manager process aborts boot if it is missing or malformed.
| Variable | Default / Required | Description |
| ------------------------------ | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `MASTER_KEY_PROVIDER` | `envvar` | Source of the envelope-encryption key: `envvar` (key read from `MASTER_KEYS`) or `aws-kms` (key wrapped by a cloud KMS). |
| `MASTER_KEY_VERSION` | `v1` · **Required** | Selects the currently active master-key version. |
| `MASTER_KEYS` | **Required** | Comma-separated `version:key` pairs. Sensitive. Under `envvar` each key is a 32-byte AES-256 key; under `aws-kms` each value is a wrapped blob. Source from your secret manager — a missing or malformed value aborts boot. |
| `MASTER_KEY_KMS_KEY_ID` | **Required if `aws-kms`** | Reference to the cloud-KMS key that wraps the master keys. Key material never enters the process; only the reference is passed. |
| `CREDENTIALS_RECOVERY_ON_BOOT` | `true` | Run the worker-side credential-recovery sweep once at boot to resolve credentials left mid-rotation by a previous process. |
## Trust store
Each tenant uploads the X.509 root certificates Lerian STA trusts when establishing mutual TLS to BACEN. The trust-store module is always on. Certificate PEM bodies are persisted to the object store, so the trust-store bucket connection is required.
| Variable | Default / Required | Description |
| --------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------- |
| `TRUST_STORE_S3_BUCKET` | **Required** | Bucket holding the per-tenant trust-store certificate PEMs. Boot fails without it. |
| `TRUST_STORE_S3_REGION` | `us-east-1` | Region for the trust-store bucket. |
| `TRUST_STORE_S3_ENDPOINT` | — | Object-store endpoint. Leave empty to fall back to the AWS S3 default endpoint. |
| `TRUST_STORE_S3_PATH_STYLE` | `false` | Use path-style addressing. Required for MinIO or a local store; leave `false` for AWS S3. |
| `TRUST_STORE_MAX_CERT_SIZE_BYTES` | `65536` | Maximum accepted size of an uploaded certificate PEM. |
| `TRUST_STORE_EXPIRING_SOON_DAYS` | `30` | Window, in days, at which a certificate is reported as expiring soon. Operator-tunable with hot reload. |
| `TRUST_STORE_DEFAULT_PAGE_SIZE` | `25` | Default page size for the trust-store listing API. |
| `TRUST_STORE_MAX_PAGE_SIZE` | `100` | Maximum page size for the trust-store listing API. |
Lerian STA runs its audit pipeline in a dedicated worker: an outbox publisher, a hash-chained audit consumer, a partition manager, an outbox cleanup, and an asynchronous audit-export generator. These run when multi-tenancy and the broker are enabled and are tuned through the `AUDIT_PUBLISHER_*`, `AUDIT_CONSUMER_*`, `AUDIT_PARTITION_*`, `AUDIT_CLEANUP_*`, `AUDIT_EXPORT_GENERATOR_*`, and `AUDIT_EXPORT_RATE_LIMIT_*` families, each shipping working defaults.