Environment variables

Lerian STA is the Lerian-owned rail that transmits and receives files with the BACEN STA hub. You set these variables at deploy time. A service restart makes them take effect. Every Lerian Go service shares a universal backbone: server, datastores, telemetry, and plugin authentication. BYOC configuration essentials documents that backbone once. This page covers the variables distinctive to Lerian STA. To install or upgrade Lerian STA, see the Lerian STA chart README. In the tables below, the Default / Required column shows the default value. A bold qualifier marks a variable you must set, such as Required or Required in production. — means no default. A variable flagged Sensitive carries credential or key material. Inject it from your secret manager at deploy time. Never commit a value.

Service and runtime

Variable	Default / Required	Description
`SERVER_ADDRESS`	`:4028`	Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port.
`DEPLOYMENT_MODE`	`local`	Deployment model: `local`, `byoc`, or `saas`, in any letter case. Another value stops the boot. With `saas`, the boot fails when a configured connection to PostgreSQL, Redis, RabbitMQ, object storage, the streaming brokers, or Tenant Manager does not require TLS.
`PLUGIN_AUTH_ENABLED`	Required	`true` or `false`. A blank value or another value stops the boot. `true` turns on authorization through Lerian Access Manager. Lerian STA accepts `false` only when `ENV_NAME` is `development`, `develop`, `dev`, `local`, or `test`, and `DEPLOYMENT_MODE` is not `saas`. With `false`, each gated request still needs a bearer token that names a principal, and Lerian STA skips only the Access Manager call.
`PLUGIN_AUTH_HOST`	Required when `PLUGIN_AUTH_ENABLED` is `true`	Lerian Access Manager address.
`SYSTEMPLANE_ENABLED`	`false`	Enable the Systemplane runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode).
`DEFAULT_TENANT_ID`	`11111111-1111-1111-1111-111111111111`	UUID fallback used only for the streaming/outbox `ce-tenantid` when an event has no tenant ID.
`BACEN_ENVIRONMENT`	`homologation`	Selects the BACEN STA environment that every BACEN call targets: `homologation` (staging) or `production` (live). An unrecognized value falls back to `homologation` so a non-production stack cannot route traffic to the live BACEN service.
`SCHEDULER_ENABLED`	`false`	Run the worker’s scheduled jobs, including the outbound status pollers, the credential sweep for stuck rotations, and the deletion of canceled and inconsistent transfers after 7 days.

Lerian STA exposes /health (liveness) and /readyz (readiness) on the main port, plus /version and /metrics. See Health and readiness for the probe contract.

License

Variable	Default / Required	Description
`LICENSE_FILE_PATH`	Required without `LICENSE_KEY`	Path of the signed license file that Lerian issues. Lerian STA verifies the file locally and does not call the license service. If the file does not license Lerian STA, the boot fails. Lerian STA does not try `LICENSE_KEY` instead. Lerian STA reads the file again about once an hour, so a renewed file takes effect without a restart. The file contains the license key, so store it in a secret. In Kubernetes, mount that Secret as a directory, without `subPath`, because Kubernetes does not update a `subPath` mount.
`LICENSE_KEY`	Required without `LICENSE_FILE_PATH`	License key issued by Lerian. Lerian STA ignores it when `LICENSE_FILE_PATH` is set. Sensitive.
`ORGANIZATION_IDS`	Required	Organization scope the license covers.

Transfers

Variable	Default / Required	Description
`TRANSFER_SCHEDULER_ENABLED`	`false`	Run the worker loop that uploads outbound transfers to BACEN. While it is `false`, Lerian STA accepts and stores new outbound transfers but sends none of them.
`TRANSFER_INBOUND_ENABLED`	`false`	Enable the inbound (BACEN-pulled) transfer pipeline. It does not change the production bucket requirement because outbound transfers also use the bucket.
`TRANSFER_MAX_ATTEMPTS`	`5`	Attempts an outbound transfer gets before Lerian STA cancels it, from 1 to 10. Runtime key: `sta.upload.max_attempts`.
`TRANSFER_TTL_HOURS`	`44`	Wall-clock lifetime of an outbound transfer after BACEN assigns its protocol, from 1 to 44 hours. Runtime key: `sta.upload.ttl_hours`.
`TRANSFER_MAX_FILE_SIZE_BYTES`	`5368709120`	Maximum size of the file a new outbound transfer references, in bytes (5 GiB).

Object storage

Lerian STA persists transfer bytes and inbound downloads to an S3-compatible object store.

Variable	Default / Required	Description
`TRANSFER_OBJECT_STORAGE_BUCKET`	Required in production	Bucket holding both transfer directions. Production boot is refused if it is empty, regardless of whether inbound transfers are enabled.
`TRANSFER_S3_REGION`	`us-east-1`	Region of the transfer bucket.
`TRANSFER_S3_ENDPOINT`	—	Endpoint of an S3-compatible store, such as MinIO. Leave unset for AWS S3.
`TRANSFER_S3_PATH_STYLE`	`false`	Use path-style addressing, which most S3-compatible stores require.
`TRANSFER_INBOUND_MAX_FILE_SIZE_BYTES`	`5368709120`	Maximum BACEN-advertised inbound file size, in bytes (5 GiB). A value of `0` or less disables this admission bound.
`TRANSFER_INBOUND_EXTRACT_MAX_EXPANSION_RATIO`	`100`	Maximum ratio between the extracted entry size and its delivered ZIP envelope. A value of `0` or less disables the ratio check.
`TRANSFER_INBOUND_EXTRACT_MAX_EXTRACTED_BYTES`	`5368709120`	Absolute maximum size of the single extracted ZIP entry, in bytes (5 GiB). A value of `0` or less disables this bound.
`AWS_REGION`	—	Region for M2M AWS Secrets Manager (`us-east-1` when unset) and, when `MASTER_KEY_KMS_REGION` is empty, for AWS KMS. It does not configure object storage.
`AWS_ACCESS_KEY_ID`	—	Access key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials.
`AWS_SECRET_ACCESS_KEY`	—	Secret key for the object store. Sensitive. Leave unset when an attached IAM role supplies credentials.

Envelope encryption

Lerian STA protects operator credentials with AES-GCM envelope encryption. Every Lerian STA process needs the master-key material. A missing or malformed value aborts boot.

Variable	Default / Required	Description
`MASTER_KEY_PROVIDER`	`envvar`	Source of the envelope-encryption key: `envvar` (key read from `MASTER_KEYS`) or `aws-kms` (key wrapped by a cloud KMS).
`MASTER_KEY_VERSION`	Required	Selects the currently active master-key version. Must match a version present in `MASTER_KEYS`.
`MASTER_KEYS`	Required	Comma-separated `version:key` pairs. Sensitive. With `envvar`, each value is a 64-hex-character AES-256 key: `version:<64-hex-key>`. With `aws-kms`, each value is base64 KMS ciphertext: `version:<base64-ciphertext>`, decrypted in process. Source from your secret manager. A missing or malformed value aborts boot.
`MASTER_KEY_KMS_KEY_ID`	Required if `aws-kms`	Identifier of the AWS KMS key used to decrypt the `MASTER_KEYS` ciphertext. With `aws-kms`, the ciphertext is decrypted in the STA process.
`MASTER_KEY_KMS_REGION`	—	Region of the AWS KMS key. When empty, Lerian STA uses `AWS_REGION`.
`CREDENTIALS_RECOVERY_ON_BOOT`	`false`	Set explicitly to `true` to run the worker-side credential-recovery sweep once at boot for credentials left mid-rotation by a previous process.

Lerian STA runs its audit pipeline in a dedicated worker. The export generator also needs its S3 bucket.Configure the enabled flags and required knobs through the AUDIT_PUBLISHER_*, AUDIT_CONSUMER_*, AUDIT_PARTITION_*, AUDIT_CLEANUP_*, AUDIT_VERIFIER_*, AUDIT_EXPORT_GENERATOR_*, and AUDIT_EXPORT_RATE_LIMIT_* families. The runtime applies their declared defaults. The partition manager runs by default. Enable each other job before you expect it to run.

Streaming

Lerian STA and the Lerian streaming library read the STREAMING_ family. Lerian Streaming Hub delivers the published events.

Variable	Default / Required	Description
`STREAMING_ENABLED`	`false`	Master switch for business-event emission to the streaming brokers. It also needs `BUSINESS_EVENTS_ENABLED` and `RABBITMQ_ENABLED`, both `true` by default. While it is off, the service sends no event to the brokers.
`STREAMING_BROKERS`	Required when streaming is on	Comma-separated broker bootstrap list. An enabled configuration with an empty list refuses to boot.
`STREAMING_CLOUDEVENTS_SOURCE`	`br-sta` (fixed)	This service’s CloudEvents source. It sets the topic namespace and the event-type prefix. Leave it unset. Any non-empty value other than `br-sta` refuses the boot, even when streaming is off.
`STREAMING_CLIENT_ID`	`br-sta`	Broker client identifier used for broker-side diagnostics.
`STREAMING_CB_FAILURE_RATIO`	`0.5`	Failure ratio that opens the producer circuit breaker. With streaming on, a value of 0 or less, or above 1, refuses the boot.
`STREAMING_CB_MIN_REQUESTS`	`10`	Minimum requests before the producer circuit breaker evaluates the failure ratio.
`STREAMING_CB_TIMEOUT_S`	`30`	Open-state cooldown in seconds for the producer circuit breaker.
`STREAMING_CLOSE_TIMEOUT_S`	`30`	Maximum drain and flush window in seconds when the producer closes.
`STREAMING_TOPIC_AUTO_PROVISION`	`true`	With streaming on, the service creates its event topic `lerian.streaming.br-sta` and its dead-letter topic `lerian.streaming.br-sta.dlq` on the brokers at startup when they do not exist. A failed creation logs a warning and the boot continues. Set it to `false` when you create the topics in advance.
`STREAMING_TOPIC_PARTITIONS`	`-1`	Partition count for a topic the service creates. A value below 1 uses the broker default.
`STREAMING_TOPIC_REPLICATION_FACTOR`	`-1`	Replication factor for a topic the service creates. A value below 1 uses the broker default.
`STREAMING_TLS_ENABLED`	`false` (Required as `true` with `DEPLOYMENT_MODE=saas` when streaming is on)	Turns on TLS for the broker dial. The minimum version is TLS 1.2.
`STREAMING_TLS_CA_CERT`	—	PEM certificate authority for a private or on-premises broker, as plain or base64-encoded PEM. It applies when `STREAMING_TLS_ENABLED` is `true`. An empty value uses the host trust store.
`STREAMING_SASL_MECHANISM`	—	Broker authentication mechanism: `PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`. An empty value disables broker authentication. With streaming on, a mechanism without its credentials, or without `STREAMING_TLS_ENABLED=true`, refuses the boot.
`STREAMING_SASL_USERNAME`	—	Broker authentication username.
`STREAMING_SASL_PASSWORD`	—	Broker authentication password. Sensitive.

Reporter filings

These variables control the consumer that files Reporter’s approved regulatory reports at BACEN. See Regulatory filings from Reporter.

Variable	Default / Required	Description
`REPORTER_EVENTS_CONSUMER_ENABLED`	`false`	Consume the regulatory filing approvals from Reporter and file the approved reports at BACEN.
`REPORTER_EVENTS_CONSUMER_EXCHANGE`	Required if the consumer is enabled	Reporter events exchange that the consumer binds to.
`REPORTER_EVENTS_DOCTYPE_RESOLVER`	Required if the consumer is enabled	How Lerian STA gets the BACEN document type of a report. Set `payload` to read it from the event.

​Service and runtime

​License

​Transfers

​Object storage

​Envelope encryption

​Streaming

​Reporter filings

Service and runtime

License

Transfers

Object storage

Envelope encryption

Streaming

Reporter filings