Lerian SISBAJUD Mensageria environment variables

This page lists the environment variables of the Mensageria. Lerian SISBAJUD executor environment variables lists the variables of the executor. BYOC configuration essentials documents the variables that every Lerian Go service shares: server, datastores, telemetry, and plugin authentication. In the tables below, the Default / Required column shows the default value. A bold qualifier (for example Required) marks the variables you must set. — means no default. A variable marked Sensitive holds a credential or key material. Inject it from your secret manager at deploy time. Do not commit its value.

Service and runtime

Variable	Default / Required	Description
`SERVER_ADDRESS`	`:4031`	Listen address of the main API. `/health`, `/readyz`, and `/version` use this port.
`ENVIRONMENT_NAME`	—	Runtime environment. `ENV_NAME` is an alternative name. `local`, `development`, `staging`, `e2e`, and `test` are non-production values. Any other value, and no value, runs the production checks.
`DEPLOYMENT_MODE`	`local`	`local`, `byoc`, or `saas`. Any other value refuses the boot. With `saas`, the boot refuses a PostgreSQL, Redis, or Tenant Manager connection without TLS.
`DEFAULT_TENANT_ID`	`11111111-1111-1111-1111-111111111111`	Tenant of a single-tenant deployment. One tenant can hold many institutions.
`SYSTEMPLANE_ENABLED`	`false`	Serve the Systemplane admin API under `/system` on the main port.

The production checks require POSTGRES_PASSWORD, refuse POSTGRES_SSLMODE=disable, and require the license variables. With STREAMING_ENABLED=true, they also require STREAMING_TLS_ENABLED=true.

Authentication

Variable	Default / Required	Description
`PLUGIN_AUTH_ENABLED`	Required	`true` or `false`. A blank value or any other value refuses the boot. The Mensageria accepts `false` only when `ENV_NAME` is `development`, `develop`, `dev`, `local`, or `test`, and `DEPLOYMENT_MODE` is not `saas`. With `false`, protected operations still require a bearer token.
`PLUGIN_AUTH_HOST`	Required if `PLUGIN_AUTH_ENABLED` or `STA_TRANSFERS_ENABLED` is `true`	Address of the Access Manager. The Lerian STA submission gets its M2M token from this address.
`AUTH_JWT_VERIFY_CERT`	Required, or `AUTH_JWT_VERIFY_CERT_PATH`	PEM public keys or certificates that verify the signature of bearer tokens. This value takes precedence over `AUTH_JWT_VERIFY_CERT_PATH`.
`AUTH_JWT_VERIFY_CERT_PATH`	Required, or `AUTH_JWT_VERIFY_CERT`	Path of a file that holds the same PEM content.
`AUTH_JWT_ISSUER`	Required	The `iss` value that bearer tokens must carry.

The boot accepts a missing verification key and a missing issuer only when all three conditions are true: PLUGIN_AUTH_ENABLED is true, DEPLOYMENT_MODE is local or unset, and ENV_NAME is local.

License

License Manager describes how the product checks the license.

Variable	Default / Required	Description
`LICENSE_KEY`	Required in production	The license key that Lerian issued for Lerian SISBAJUD.
`ORGANIZATION_IDS`	Required in production	License scope. Set it to `global`. Any other value refuses the boot.

“In production” means that ENVIRONMENT_NAME is not a non-production value.

Key management

Variable	Default / Required	Description
`KMS_PROVIDER`	Required when `ENVIRONMENT_NAME` is `production`	Key manager for envelope encryption: `vault` (HashiCorp Vault Transit) or `aws` (AWS KMS). Any other value refuses the boot. With any other environment, an unset value means `vault`.
`AWS_REGION`	Required with `aws`	Region of AWS KMS.
`SISBAJUD_DEK_CACHE_TTL`	`5m`	Time that an unwrapped data key stays in the memory cache. Go duration.
`KEK_REWRAP_BACKFILL_ENABLED`	`false`	Run the background job that re-wraps data keys under the new KEK version after a rotation.
`KEK_REWRAP_BACKFILL_SCAN_INTERVAL`	`300`	Interval of the re-wrap job, in seconds.
`KEK_REWRAP_BACKFILL_BATCH_SIZE`	`100`	Maximum number of data keys, per table, that one pass of the re-wrap job processes.

Vault (when `KMS_PROVIDER=vault`)

Variable	Default / Required	Description
`VAULT_ADDR`	Required	Address of your Vault.
`VAULT_AUTH_METHOD`	`token`	`token` or `approle`. Any other value refuses the boot.
`VAULT_TOKEN`	Required for `token` when `ENVIRONMENT_NAME` is `production`	Vault token. Sensitive.
`VAULT_APPROLE_ROLE_ID`	Required for `approle`	AppRole role ID. Sensitive.
`VAULT_APPROLE_SECRET_ID`	Required for `approle`	AppRole secret ID. Sensitive.
`VAULT_TRANSIT_MOUNT_PATH`	`transit`	Mount path of the Transit engine.
`VAULT_TIMEOUT_SEC`	`15`	Timeout of each Vault request, in seconds.
`VAULT_TOKEN_RENEW_ENABLED`	`true`	Renew the Vault token in the background.
`VAULT_TOKEN_RENEW_MIN_INTERVAL_SEC`	`60`	Minimum time between two renewals, in seconds.

Execution API and sweeper

The executor reads orders and reports results through the execution API. Integrating with Lerian SISBAJUD describes it.

Variable	Default / Required	Description
`SISBAJUD_EXECUTION_ADDRESS`	`:4032`	Listen address of the execution API. This listener accepts TLS only.
`SISBAJUD_EXECUTION_TLS_CERT_FILE`	Required	Path of the server certificate of the execution API.
`SISBAJUD_EXECUTION_TLS_KEY_FILE`	Required	Path of the private key of that certificate. Sensitive.
`SISBAJUD_EXECUTION_MTLS_ENABLED`	`false`	`true` makes the listener require a client certificate. Any value other than `true`, `false`, or blank refuses the boot.
`SISBAJUD_EXECUTION_CLIENT_CA_FILE`	Required if `SISBAJUD_EXECUTION_MTLS_ENABLED=true`	Path of the CA bundle that verifies client certificates.
`RESPONSE_DEADLINE_MARGIN`	Required	Go duration greater than 0, for example `2h`. For an order that waits behind an earlier revision with an uncertain result, the sweeper keeps this margin before the response deadline.
`EXECUTION_DRAINED_HEAD_ALARM_AFTER`	Required	Go duration greater than 0, for example `30m`. How long a parked order can block its subject before the sweeper raises an alarm.
`EXECUTION_SWEEP_INTERVAL_SEC`	`60`	Interval of the execution sweeper, in seconds.
`EXECUTION_DEADLINE_MARGIN_SEC`	`RETURN_FILE_GENERATION_SCAN_INTERVAL`	Time, in seconds, between the `deadlineAt` of an order and its response deadline. It must be greater than 0 and less than `21600`.
`EXECUTION_CANARY_INTERVAL_SEC`	`300`	Interval of the canary probe, in seconds. Each run sends one probe for each enabled institution.

Event streaming

Variable	Default / Required	Description
`STREAMING_ENABLED`	Required: `true`	Publish events. The default is `false`, and `false` refuses the boot: the execution notices need a real publisher.
`STREAMING_BROKERS`	Required	Comma-separated list of Kafka brokers for the events that the Mensageria publishes.
`STREAMING_CLOUDEVENTS_SOURCE`	Required	Set it to `br-sisbajud`. Any other value refuses the boot.
`STREAMING_TLS_ENABLED`	`false` · `true` in production	Connect to the brokers over TLS.
`STREAMING_SASL_MECHANISM`	—	SASL mechanism of the brokers. With a mechanism and no TLS, the boot refuses unless `STREAMING_SASL_ALLOW_PLAINTEXT` is `true`.
`OUTBOX_ENABLED`	`true`	Durable delivery path of events. `STREAMING_ENABLED=true` requires it.

Response files and workers

Variable	Default / Required	Description
`RETURN_FILE_GENERATION_ENABLED`	`false`	Generate block response files for the finished orders that have no response file.
`RETURN_FILE_GENERATION_SCAN_INTERVAL`	`3600`	Interval of block response-file generation, in seconds.
`RETURN_FILE_GENERATION_LIMIT`	`500`	Number of orders that one generation pass processes.
`INFORMATION_RETURN_FILE_GENERATION_ENABLED`	`false`	Generate information response files (AJUD309).
`INFORMATION_RETURN_FILE_GENERATION_SCAN_INTERVAL`	`3600`	Interval of information response-file generation, in seconds.
`INFORMATION_RETURN_FILE_GENERATION_LIMIT`	`500`	Number of orders that one information generation pass processes.
`RETURN_FILE_ENVIRONMENT`	`HOMOLOGATION`	`PRODUCTION` or `HOMOLOGATION`. A response file takes the environment of the remittance file behind its orders. This value applies only when no remittance file backs them. An invalid value turns off response-file generation.
`SISBAJUD_REMITTANCE_LAYOUTS`	`v111,v2026`	Comma-separated remittance layouts that the Mensageria accepts: `v111` and `v2026`. Reception rejects a file in any other layout. An invalid value refuses the boot.
`SISBAJUD_RESPONSE_LAYOUT`	`auto`	Layout of the block response. `auto` answers each remittance in the layout it arrived in. `v111` or `v2026` forces one layout. An invalid value refuses the boot.
`SLA_ALERT_ENABLED`	`false`	Classify the active orders by SLA-risk band and publish the bands as metrics.
`SLA_ALERT_SCAN_INTERVAL`	`60`	Interval of the SLA classification, in seconds.
`PROCESSING_LOCK_REAPER_ENABLED`	`true`	Delete expired processing locks in the background.
`PROCESSING_LOCK_REAPER_INTERVAL_SEC`	`300`	Interval of the lock cleanup, in seconds.

Object storage

Variable	Default / Required	Description
`SEAWEEDFS_S3_ENDPOINT`	`http://localhost:8333`	Endpoint of the S3-compatible object store.
`SEAWEEDFS_BUCKET`	`sisbajud`	Bucket for the encrypted files of the Mensageria.
`SEAWEEDFS_REGION`	`us-east-1`	S3 region.
`SEAWEEDFS_CREDENTIALS_SOURCE`	`static`	`static` signs with the two keys below, or sends unsigned requests when both are blank. `default-chain` uses the AWS SDK credential chain, and then both keys must be blank.
`SEAWEEDFS_ACCESS_KEY`	—	Access key of the object store. Sensitive.
`SEAWEEDFS_SECRET_KEY`	—	Secret key of the object store. Sensitive.
`STA_INBOUND_BUCKET`	Required	Bucket that holds the remittance files that Lerian STA delivers. It uses the same endpoint as `SEAWEEDFS_S3_ENDPOINT`.
`STA_FILE_LOCK_TTL`	`5`	Lifetime of the processing lock of one file, in minutes.

Lerian STA consumer

The Mensageria receives remittance files only from the events that Lerian STA publishes. The consumer uses its own broker settings, STA_STREAM_*. It does not read the STREAMING_* variables.

Variable	Default / Required	Description
`STA_CONSUMER_ENABLED`	`false`	Receive remittance files from Lerian STA events.
`STA_STREAM_BROKERS`	Required if the consumer is on	Comma-separated list of the Kafka brokers of Lerian STA.
`STA_STREAM_SASL_MECHANISM`	Required if the consumer is on	`PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`.
`STA_STREAM_SASL_USERNAME`	Required if the consumer is on	SASL user name.
`STA_STREAM_SASL_PASSWORD`	Required if the consumer is on	SASL password. Sensitive.
`STA_STREAM_TLS_ENABLED`	`false`	Connect to the brokers over TLS. With the consumer on, `false` requires `STA_STREAM_SASL_ALLOW_PLAINTEXT=true`.
`STA_STREAM_TLS_CA_CERT`	Required if TLS is on	Base64-encoded PEM CA certificate of the brokers.
`STA_STREAM_SASL_ALLOW_PLAINTEXT`	`false`	Accept SASL without TLS. Production refuses `true`.
`STA_CONSUMER_RETRY_BUDGET`	`3`	Number of retries of a transient failure inside one delivery.
`STA_SOURCE_PRODUCT`	Required if the consumer or the submission is on	Product name that Lerian STA records for this rail. The Mensageria keeps only the events with this name. The example configuration uses `br-sisbajud`.
`STA_BACEN_SYSTEM_CODE`	Required if the consumer is on	The example configuration uses `JUD`.
`STA_EXPECTED_TENANT_ST`	Required if the consumer is on	Tenant that Lerian STA writes on its events. Set the `DEFAULT_TENANT_ID` of your Lerian STA. A single-tenant Mensageria refuses an empty value.
`STA_MAX_INBOUND_SIZE_BYTES`	Required if the consumer is on	Largest remittance file, in bytes, that the consumer downloads. It must be greater than 0. The example configuration uses `52428800`.
`STA_OBJECT_STORAGE_ENDPOINT`	Required if the consumer or the submission is on	Object-store endpoint of Lerian STA. It must name the same store as `SEAWEEDFS_S3_ENDPOINT`. A different store refuses the boot.

Lerian STA submission

Variable	Default / Required	Description
`STA_TRANSFERS_ENABLED`	`false`	Submit the response files to Lerian STA. It requires `PLUGIN_AUTH_HOST`.
`STA_TRANSFERS_BASE_URL`	Required if the submission is on	Base URL of the Lerian STA API.
`STA_DOCUMENT_TYPE_AJUD302`	Required if the submission is on	Lerian STA document type of the block response. The example configuration uses `AJUD302`.
`STA_DOCUMENT_TYPE_AJUD309`	Required if the submission is on	Lerian STA document type of the information response. The example configuration uses `AJUD309`.
`TRANSFER_OBJECT_STORAGE_BUCKET`	Required if the submission is on	Bucket shared with Lerian STA for the response files. It must name the same bucket as `STA_INBOUND_BUCKET`. A different bucket refuses the boot.
`STA_CLIENT_ID`	Required if the submission is on	OAuth client ID that gets the token for Lerian STA.
`STA_CLIENT_SECRET`	Required if the submission is on	OAuth client secret for Lerian STA. Sensitive.

Values that must match the executor

RESPONSE_DEADLINE_MARGIN. The executor reads the same variable. Set the same value on both components.
Mutual TLS. The executor has its own switch, MENSAGERIA_MTLS_ENABLED. Set it to the same value as SISBAJUD_EXECUTION_MTLS_ENABLED. With mutual TLS on the Mensageria and off on the executor, the TLS handshake fails.
Executor identity. The M2M client of the executor holds the role br-sisbajud-executor-role. Integrating with Lerian SISBAJUD describes its permissions.

​Service and runtime

​Authentication

​License

​Key management

​Vault (when KMS_PROVIDER=vault)

​Execution API and sweeper

​Event streaming

​Response files and workers

​Object storage

​Lerian STA consumer

​Lerian STA submission

​Values that must match the executor

Service and runtime

Authentication

License

Key management

Vault (when `KMS_PROVIDER=vault`)

Execution API and sweeper

Event streaming

Response files and workers

Object storage

Lerian STA consumer

Lerian STA submission

Values that must match the executor