Environment variables

Lerian SLC is the Lerian-owned rail for card-settlement messaging with Núclea’s SLC. You set these variables at deploy time. A service restart applies them. Every Lerian Go service shares a universal backbone: server, datastores, telemetry, and plugin authentication. BYOC configuration essentials documents that backbone once. This page covers the variables distinctive to Lerian SLC. In the tables below, the Default / Required column shows the default value. A bold qualifier (e.g. Required, Required in production) marks a variable you must set. — means no default. A variable marked Sensitive carries credential or key material. Inject it from your secret manager at deploy time. Never commit a value.

Service and runtime

Variable	Default / Required	Description
`SERVER_ADDRESS`	`:4111`	Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port.
`SYSTEMPLANE_ENABLED`	`false`	Enable the Systemplane runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode).
`TENANT_RUNTIME_CONFIG_ENABLED`	`false`	Enable the per-tenant runtime-config store and admin surface, resolving each tenant’s connectivity transport from a per-tenant record rather than the shared configuration. Selection and policy only.

Lerian SLC exposes /health (liveness) and /readyz (readiness) on the main port, plus /version and /metrics. See Health and readiness for the probe contract. One installation serves one client.

License

Variable	Default / Required	Description
`LICENSE_KEY`	Required	License credential issued by Lerian. Sensitive.
`ORGANIZATION_IDS`	Required	Organization scope the license covers.

Operation intake

Variable	Default / Required	Description
`INTAKE_BATCH_MAX_LINES`	`50000`	Line cap of the batch intake. A batch above it answers `413` and saves nothing.
`INTAKE_BATCH_SPOOL_MAX_BYTES`	`268435456`	Byte cap of the batch intake. A batch above it answers `413` and saves nothing.
`INTAKE_BATCH_SPOOL_DIR`	system temporary directory	Directory where the batch intake spools the body while it counts the lines. Point it at a writable volume when the root filesystem is read-only.

Núclea REST transport

This channel submits to Núclea online over mutual TLS. Leave NUCLEA_REST_BASE_URL empty to keep the transport unwired.

Variable	Default / Required	Description
`NUCLEA_REST_BASE_URL`	—	Base URL of the Núclea node. Empty disables the whole REST transport: online submission, return polling, queries, and file submission. Under `ENV_NAME=production` or `DEPLOYMENT_MODE=saas`, the URL must use `https`. Locally it points at a simulator.
`NUCLEA_REST_TIMEOUT_SEC`	`30`	Per-request timeout in seconds.
`NUCLEA_REST_CB_CONSECUTIVE_FAILURES`	`5`	Consecutive failures that trip the circuit breaker open.
`NUCLEA_REST_CB_OPEN_TIMEOUT_SEC`	`30`	How long the breaker stays open before half-open.
`NUCLEA_REST_ALLOW_INSECURE_TLS`	`false`	Relax Núclea TLS verification for local development only. Boot is rejected when this is `true` under `ENV_NAME=production` or `DEPLOYMENT_MODE=saas`.
`NUCLEA_REST_RESPONSE_CERT_PATH`	Required unless the base URL is a development target	Path to Núclea’s public certificate, which verifies the signature on each response. Boot fails when it is empty and the base URL points anywhere else.
`NUCLEA_REST_CLIENT_CERT_PATH`	Required in production/SaaS when the base URL is set	Path to the PEM client certificate presented to Núclea for mutual TLS.
`NUCLEA_REST_CLIENT_KEY_PATH`	Required in production/SaaS when the base URL is set	Path to the PEM client private key for mutual TLS. Sensitive — the file holds private key material.

RSFN inbound consumer

This channel receives inbound RSFN messages. It also observes XSD conformance.

Variable	Default / Required	Description
`RSFN_CONSUMER_TRANSPORT`	`stub`	Inbound transport behind the RSFN consumer port: `stub` (a development REST channel) or `mq` (the RSFN network transport through the MQ bridge). Another value refuses boot. The consumer drains only when `SCHEDULE_RSFN_INGEST_ENABLED=true`.
`MQ_BRIDGE_URL`	Required when the MQ transport is in use	Base URL of the MQ bridge. You must declare it explicitly with `RSFN_CONSUMER_TRANSPORT=mq`, or with per-tenant transport selection on; it cannot inherit `http://localhost:9121`, because the correct address depends on your deployment topology.
`MQ_BRIDGE_QUEUE_MANAGER`, `MQ_BRIDGE_CHANNEL`, `MQ_BRIDGE_CONN_NAME`, `MQ_BRIDGE_QUEUE`	Required when the MQ transport is in use	IBM MQ connection details that the MQ transport hands to the bridge. With a blank queue, every drain fails closed.
`RSFN_CONSUMER_BASE_URL`	—	Base URL for the `stub` transport. Empty leaves the consumer unwired.
`RSFN_CONSUMER_TIMEOUT_SEC`	`30`	Per-request timeout in seconds.
`CIRCUIT_BREAKER_ENABLED`	`false`	Enable the shared circuit-breaker manager. The manager guards more than this consumer: startup fails closed without it when the `stub` channel has a base URL, when the MQ transport is in use, or when `NUCLEA_REST_BASE_URL` is set.
`RSFN_CONSUMER_CB_CONSECUTIVE_FAILURES`	`5`	Consecutive failures that trip the RSFN consumer breaker when `CIRCUIT_BREAKER_ENABLED=true`.
`RSFN_CONSUMER_CB_OPEN_TIMEOUT_SEC`	`30`	How long the breaker stays open before half-open.
`RSFN_CONSUMER_ALLOW_INSECURE_TLS`	`false`	Relax the stub-channel TLS verification for local development only. Under production or SaaS the stub channel always verifies TLS.
`RSFN_INBOUND_XSD_VALIDATION_ENABLED`	`true`	Observe-only XSD validation of inbound RSFN/SILOC messages against the official schemas. Logs and meters non-conformance without altering dispatch.
`ASLC_INBOUND_XSD_VALIDATION_ENABLED`	`true`	Observe-only XSD validation of inbound ASLC return messages. Logs and meters non-conformance without altering the return pipeline.
`RSFN_INBOUND_XSD_FAIL_CLOSED_CODMSGS`	—	Comma-separated RSFN and Lerian SILOC message types that leave observe-only mode: an XSD failure sends the message to the dead-letter queue. A message type the service does not route refuses boot.
`ASLC_INBOUND_XSD_FAIL_CLOSED_CODMSGS`	—	Comma-separated ASLC return types that leave observe-only mode: an XSD failure leaves the return unacknowledged for the next poll. A return type the service does not route refuses boot.
`XSD_VALIDATOR_URL`	`http://localhost:9091`	Base URL of the XSD-validation sidecar. The inbound observers call it, and so does the outbound file build, which fails closed when the sidecar does not answer.
`XSD_VALIDATOR_TIMEOUT_SEC`	`10`	Per-request timeout in seconds for XSD-validation calls.

SFN inbound bus

Lerian SILOC relays its messages to Lerian SLC on the SFN bus. SFN_INGEST_ENABLED turns on the ingest of the relayed messages. SFN_FACTS_INGEST_ENABLED turns on the ingest of the outcomes of the settlement commands that Lerian SLC sends. Both consumers use the same brokers and batch size.

Variable	Default / Required	Description
`SFN_INGEST_ENABLED`	`false`	Master switch for the SFN ingest path (bus consumer and driver).
`SFN_BUS_PROVIDER`	`kafka`	Consumer adapter: `kafka` or `stub` (development/CI).
`SFN_KAFKA_BROKERS`	Required if ingest is on with provider `kafka`, or if facts ingest is on	Comma-separated Kafka/RedPanda bootstrap broker list.
`SFN_KAFKA_TOPIC`	`siloc.inbound`	Topic the SILOC relay publishes to.
`SFN_KAFKA_GROUP_ID`	service-scoped default	Kafka consumer group id; override per deployment when needed.
`SFN_KAFKA_BATCH_SIZE`	`100`	Records read per batch.
`SFN_STUB_TIMEOUT_SEC`	`30`	Per-request timeout in seconds for the `stub` adapter.
`SFN_FACTS_INGEST_ENABLED`	`false`	Master switch for the consumer of the settlement-command outcomes.
`SFN_FACTS_KAFKA_TOPIC`	`siloc.outbound.facts`	Topic on which Lerian SILOC publishes the command outcomes.
`SFN_FACTS_KAFKA_GROUP_ID`	service-scoped default	Kafka consumer group id of the facts consumer, distinct from `SFN_KAFKA_GROUP_ID`.

Signing sidecar

Lerian SLC signs the SPB security envelope through a stateless signing sidecar. The signing private key never enters the service process. You select the custody backend per deployment with SIGNING_CUSTODY_ADAPTER. The sidecar turns on each custody adapter only when that adapter’s own settings are present.

Variable	Default / Required	Description
`SIGNING_CUSTODY_ADAPTER`	`softkey`	Custody backend of the deployment: `softkey`, `pkcs11`, or `awskms`. Under `DEPLOYMENT_MODE=saas` it is always `awskms`.
`SIGNER_URL`	`http://localhost:9101`	Base URL of the signing sidecar.
`SIGNER_TIMEOUT_SEC`	`10`	Per-request timeout in seconds for signing calls.
`SIGNER_SOFTKEY_PFX_PATH`	—	Path to the PKCS#12 file of the software-key adapter. Setting it turns the adapter on.
`SIGNER_SOFTKEY_PFX_PASSPHRASE`	—	Passphrase for the software-key custody adapter. Sensitive.
`SIGNER_SOFTKEY_ALLOW_IN_PRODUCTION`	`false`	Under `ENV_NAME=production`, the signing sidecar starts only when this is `true`, whatever custody adapter you use.
`SIGNER_AWSKMS_REGION`	—	AWS region of the KMS keys. Setting it turns on the cloud-KMS adapter and the signing-key import.
`SIGNER_PKCS11_MODULE`	image default	Path to the PKCS#11 module of the HSM.
`SIGNER_PKCS11_TOKEN_LABEL` or `SIGNER_PKCS11_SLOT`	—	HSM token, by label or by slot. Setting one turns on the HSM adapter, which then requires the module, the PIN, and the key label.
`SIGNER_PKCS11_PIN`	Required with an HSM token	PIN of the HSM token. Sensitive.
`SIGNER_PKCS11_KEY_LABEL`	Required with an HSM token	Label of the signing key inside the token.

Settlement schedule

Lerian SLC gates dispatch to Núclea’s settlement windows and runs a schedule worker.

Variable	Default / Required	Description
`SCHEDULE_CREDIT_WINDOW_OPEN`	Required in every environment	Credit-acceptance window open, as `HH:MM` São Paulo local time (half-open interval, opening boundary inclusive). Declare it explicitly for the grade in force.
`SCHEDULE_CREDIT_WINDOW_CLOSE`	Required in every environment	Credit-acceptance window close, as `HH:MM` São Paulo local time (exclusive). Declare it explicitly for the grade in force. `HH:MM+1` crosses midnight, and only the `especial1` grade accepts it.
`SCHEDULE_SPECIAL_GRADE`	`none`	Núclea grade that the credit window must obey: `none`, `especial1`, or `especial2`. Another value refuses boot. Under `ENV_NAME=production` or `DEPLOYMENT_MODE=saas`, the credit window must fit the grade.
`SCHEDULE_WORKER_ENABLED`	`true`	Enable the recurring schedule worker (cutoff alerting and, when enabled, the dispatch and return drivers).
`SCHEDULE_WORKER_INTERVAL_SEC`	`30`	Schedule worker tick period in seconds.
`SCHEDULE_GRID_GATE_ENABLED`	`false`	Gate dispatch to the calendar-backed STR grid instead of the single credit window.
`SCHEDULE_CUTOFF_ALERT_LEAD_MIN`	`30`	Minutes before an STR cutoff at which the window enters pre-cutoff and one alert is emitted.
`SCHEDULE_DISPATCH_MAX_TRANSMIT_ATTEMPTS`	`20`	Consecutive counterpart refusals an outbound submission may take before Lerian SLC parks the operation for operator review. A transport fault does not count, and a success resets the count. At the default 30-second tick, 20 refusals is about ten minutes before the first alert.
`SCHEDULE_HOLIDAYS`	—	Comma-separated `YYYY-MM-DD` banking holidays in São Paulo local time; no window opens on a holiday. A malformed date refuses boot.

You must declare both credit-window variables, even when you use the standing schedule. The service refuses to start if either value is omitted or blank. It never assumes a credit grade from a default.

Each flow runs in the schedule worker only when its toggle is true. Every toggle defaults to false: SCHEDULE_DISPATCH_ENABLED, SCHEDULE_FORWARD_ENABLED, SCHEDULE_DEBIT_DISPATCH_ENABLED, SCHEDULE_DEBIT_FORWARD_ENABLED, SCHEDULE_ANTICIPATION_DISPATCH_ENABLED, SCHEDULE_ANTICIPATION_FORWARD_ENABLED, SCHEDULE_ANTICIPATION_SETTLE_ENABLED, SCHEDULE_CANCELLATION_DISPATCH_ENABLED, SCHEDULE_CANCELLATION_FORWARD_ENABLED, SCHEDULE_RETURN_POLL_ENABLED, SCHEDULE_RELAY_STATUS_ENABLED, SCHEDULE_VARREDURA_ENABLED, SCHEDULE_RSFN_INGEST_ENABLED, SCHEDULE_D1_CONFIRMATION_ENABLED, SCHEDULE_CONFIRMATION_OVERDUE_ENABLED, SCHEDULE_OPERATION_STUCK_ENABLED, SCHEDULE_CERT_EXPIRY_ENABLED, SCHEDULE_SILOC_WINDOWS_ENABLED, SCHEDULE_STR_SETTLED_ENABLED, and OP107_VERDICT_POLL_ENABLED.

Webhooks

Lerian SLC can deliver settlement events to a subscriber endpoint. In BYOC the client supplies the credential material through their own Kubernetes secret.

Variable	Default / Required	Description
`WEBHOOK_WORKER_ENABLED`	`false`	Enable the webhook delivery worker.
`WEBHOOK_DELIVERY_PROVIDER`	`direct`	Delivery adapter. `direct` delivers each webhook over HTTP with an HMAC signature.
`WEBHOOK_API_KEY`	Required if delivering	Client-defined API key sent in the webhook API-key header. Sensitive.
`WEBHOOK_API_KEY_FILE`	—	Path to a file holding the API key (a mounted secret volume). When set, the inline value is ignored.
`WEBHOOK_HMAC_SECRET`	Required if delivering	Client-defined shared secret used to sign each webhook. Sensitive. Never comes from the runtime-config plane or the database.
`WEBHOOK_HMAC_SECRET_FILE`	—	Path to a file holding the HMAC secret (a mounted secret volume). When set, the inline value is ignored.
`WEBHOOK_MAX_ATTEMPTS`	`6`	Per-subscription retry budget before a delivery is parked on the dead-letter queue.
`WEBHOOK_ALLOW_PRIVATE_NETWORK`	`false`	Development-only relaxation of the delivery SSRF block. Must stay `false` in production/SaaS — boot fails closed otherwise.

​Service and runtime

​License

​Operation intake

​Núclea REST transport

​RSFN inbound consumer

​SFN inbound bus

​Signing sidecar

​Settlement schedule

​Webhooks

Service and runtime

License

Operation intake

Núclea REST transport

RSFN inbound consumer

SFN inbound bus

Signing sidecar

Settlement schedule

Webhooks