Environment variables

Lerian SRC reads its configuration from the process environment at startup. You set these variables at deploy time. A service restart makes them take effect. BYOC configuration essentials covers the BYOC configuration model. In the tables below, the Default / Required column shows the value that Lerian SRC applies when you leave the variable unset. A bold qualifier marks a variable that you must set, in every environment or under a stated condition. The condition “outside local development” means every environment except an ENV_NAME of develop or development with DEPLOYMENT_MODE empty or local. The value — means that Lerian SRC applies no default. A description that ends with “Sensitive.” marks a variable that holds a secret. A production deployment is one where ENV_NAME names production or DEPLOYMENT_MODE is saas or byoc. Lerian SRC applies stricter checks there.

Where a value in the shipped example file differs from the value the code applies, this page publishes the code value.

Service and runtime

Variable	Default / Required	Description
`SERVICE_NAME`	`br-src`	Service name in logs and telemetry.
`ENV_NAME`	`development`	Deployment environment: `local`, `develop`, `development`, `uat`, `staging`, `prod`, or `production`. Another value stops the boot.
`DEPLOYMENT_MODE`	`local`. Required in production	Deployment model: `local`, `byoc`, or `saas`. Another value stops the boot.
`LOG_LEVEL`	`info`	Log level at startup: `debug`, `info`, `warn`, or `error`. The `src.log.level` runtime key changes it while the service runs.
`SERVER_PORT`	`3006`	HTTP listen port.
`TRUSTED_PROXIES`	`—`	Comma-separated list of proxy addresses or CIDR ranges that Lerian SRC trusts for the client IP address. Empty trusts no proxy.
`PROXY_HEADER`	`X-Forwarded-For` when `TRUSTED_PROXIES` is set	Header that carries the client IP address from a trusted proxy.

License

Variable	Default / Required	Description
`LICENSE_KEY`	Required	License key that Lerian issues. Sensitive.
`ORGANIZATION_IDS`	Required	Comma-separated list of the organization IDs that the license covers. Set at least one.

Institution identity

Variable	Default / Required	Description
`SRC_CNPJ_BASE8`	Required	The CNPJ base of your institution: 8 characters from `0-9` and `A-Z`, not all zeros. Lerian SRC derives the IBM MQ queue names and the operation numbers from it.
`SRC_SENDER_ISPB`	Required in production, or when `SRC_MQ_HOST` is set	The ISPB of your institution: 8 digits, not all zeros.

PostgreSQL

Variable	Default / Required	Description
`POSTGRES_HOST`	Required in production	Database host.
`POSTGRES_PORT`	`5432`	Database port.
`POSTGRES_USER`	Required in production	Database user.
`POSTGRES_PASSWORD`	`—`	Database password. Sensitive.
`POSTGRES_DB`	Required in production	Database name.
`POSTGRES_SSLMODE`	`disable`	PostgreSQL `sslmode`.
`POSTGRES_MAX_OPEN_CONNS`	`25`	Maximum open connections in the pool.
`POSTGRES_MAX_IDLE_CONNS`	`10`	Maximum idle connections in the pool.
`POSTGRES_CONN_LIFETIME`	`30m`	Maximum lifetime of a connection, as a Go duration.
`POSTGRES_CONN_IDLE_TIME`	`5m`	Maximum idle time of a connection, as a Go duration.

Events

Variable	Default / Required	Description
`SRC_STREAMING_BROKERS`	`—`. Required in production, unless `SRC_STREAMING_EMISSION_DISABLED` is `true`	Comma-separated list of broker addresses.
`SRC_STREAMING_CLIENT_ID`	`br-src`	Producer client ID.
`SRC_STREAMING_SOURCE`	`br-src`	CloudEvents source. Leave it unset, or set it to exactly `br-src`. Another value stops the boot.
`SRC_STREAMING_TLS`	`false`	Turns on TLS for the broker connection.
`SRC_STREAMING_EMISSION_DISABLED`	`false`	Set it to `true` to run without a broker. The events then stay pending in the outbox.

Access Manager

Variable	Default / Required	Description
`PLUGIN_AUTH_ENABLED`	Required	Turns on Access Manager authentication. Set it to `true`. A production deployment refuses `false`.
`PLUGIN_AUTH_ADDRESS`	Required in production	Access Manager address.
`IDP_DECLARATION_ENABLED`	`false`	Set it to `true` to publish the Lerian SRC permission manifest to Access Manager at startup.
`IDP_HOST`	Required when `IDP_DECLARATION_ENABLED` is `true`	Address of the Access Manager identity service that receives the manifest.
`IDP_M2M_CLIENT_ID`	Required when `IDP_DECLARATION_ENABLED` is `true`	Client ID that Lerian SRC uses to publish the manifest.
`IDP_M2M_CLIENT_SECRET`	Required when `IDP_DECLARATION_ENABLED` is `true`	Client secret that Lerian SRC uses to publish the manifest. Sensitive.

IBM MQ

Variable	Default / Required	Description
`SRC_MQ_HOST`	Required in production	Host of your institution’s IBM MQ queue manager.
`SRC_MQ_PORT`	Required when `SRC_MQ_HOST` is set	Listener port of your queue manager.
`SRC_MQ_CHANNEL`	Required when `SRC_MQ_HOST` is set	Server-connection channel on your queue manager. At most 20 characters from `A-Z`, `a-z`, `0-9`, `.`, `/`, `_`, and `%`.
`SRC_MQ_QUEUE_MANAGER`	Required in production	Name of your queue manager.
`SRC_MQ_USER`	`—`	IBM MQ user ID.
`SRC_MQ_PASSWORD`	`—`	IBM MQ password. Sensitive.
`SRC_MQ_TLS_ENABLED`	`false`	Turns on TLS for the IBM MQ connection. A production deployment requires `true`.
`SRC_MQ_SSL_KEY_REPOSITORY`	`—`	Path stem of the IBM MQ key repository.
`SRC_MQ_CERT_LABEL`	`—`	Label of the certificate in the key repository that the IBM MQ connection presents.
`SRC_MQ_CIPHER_SPEC`	`TLS_RSA_WITH_AES_256_CBC_SHA256`	IBM MQ cipher spec.
`SRC_MQ_SEND_QUEUE`	Derived from `SRC_CNPJ_BASE8`	Name of the send queue.
`SRC_MQ_RECEIVE_QUEUE`	Derived from `SRC_CNPJ_BASE8`	Name of the receive queue.
`SRC_MQ_BACKOUT_QUEUE`	The receive queue name followed by `.BACKOUT`	Queue that takes a message after it fails delivery `SRC_MQ_BACKOUT_THRESHOLD` times.
`SRC_MQ_BACKOUT_THRESHOLD`	`5`	Failed deliveries before a message moves to the backout queue. `0` turns the move off.
`SRC_MQ_BACKOUT_DELAY`	`2s`	Pause after a failed delivery, as a Go duration.
`SRC_MQ_STALE_AFTER`	`30s`	Time with no completed IBM MQ call before the `src_mq` check reports `degraded`. `0` turns this off.
`SRC_MQ_HEARTBEAT_INTERVAL`	`30s`	IBM MQ heartbeat interval, as a Go duration in whole seconds. `0` uses the value of the channel.

Certificates and key custody

Variable	Default / Required	Description
`SRC_LOCAL_CERT_FILE`	Required in production, or when `SRC_MQ_HOST` is set	Path to your institution’s certificate. It must match the private key in PKCS#11 or KMIP.
`SRC_BACEN_CERT_FILE`	Required in production, or when `SRC_MQ_HOST` is set	Path to BACEN’s certificate. Restart Lerian SRC after you replace it.
`SRC_PKCS11_MODULE_PATH`	`—`	Path to the PKCS#11 client library.
`SRC_PKCS11_TOKEN_LABEL`	`—`	Label of the PKCS#11 token.
`SRC_PKCS11_PIN_FILE`	`—`	Path to the file that holds the PKCS#11 PIN.
`SRC_PKCS11_KEY_LABEL`	`—`	Label of the key pair in the PKCS#11 token.
`SRC_KMIP_BASE_URL`	`—`	Base URL of the KMIP server.
`SRC_KMIP_VHSM`	`—`	Identifier of the virtual HSM.
`SRC_KMIP_CRYPTO_USER`	`—`	KMIP crypto user.
`SRC_KMIP_CRYPTO_USER_TOKEN`	`—`	Token of the KMIP crypto user. Sensitive.
`SRC_KMIP_SIGN_PRIVATE_KEY_UID`	`—`	Identifier of the signing private key.
`SRC_KMIP_SIGN_PUBLIC_KEY_UID`	`—`	Identifier of the matching public key.
`SRC_KMIP_DECRYPT_KEY_UID`	`—`	Identifier of the decryption key.

Data at rest

Variable	Default / Required	Description
`SRC_ATREST_ENCRYPTION_KEY`	Required outside local development	The 32-byte key that encrypts document data at rest. Sensitive.
`SRC_ATREST_BLIND_INDEX_KEY`	Required outside local development	The key Lerian SRC uses to search by document number. At least 32 characters, and different from `SRC_ATREST_ENCRYPTION_KEY`. Sensitive.

Telemetry

Variable	Default / Required	Description
`ENABLE_TELEMETRY`	`false`. A production deployment requires `true`	Turns on the export of traces and metrics over OTLP.
`OTEL_EXPORTER_OTLP_ENDPOINT`	Required in production	Address of the OTLP collector.

​Service and runtime

​License

​Institution identity

​PostgreSQL

​Events

​Access Manager

​IBM MQ

​Certificates and key custody

​Data at rest

​Telemetry

Service and runtime

License

Institution identity

PostgreSQL

Events

Access Manager

IBM MQ

Certificates and key custody

Data at rest

Telemetry