BYOC configuration essentials

In a BYOC (bring your own cloud) deployment, you run Lerian products inside your own AWS, GCP, or on-prem infrastructure. You own the data and the runtime. You configure each service through environment variables, and most of them are service-specific. This page covers variables that recur across Lerian Go services. Use each product’s own page for the rest.

These variables are not the full list. Variable names and defaults differ between services, and services add their own keys. See Per-product variables.

Deployment mode and TLS

Variable	Description	Default	Allowed values
`DEPLOYMENT_MODE`	Deployment posture. Its effect, default and accepted values vary per service.	Varies per service	Varies per service
`ALLOW_INSECURE_TLS`	Bypass per-connection TLS enforcement on infrastructure DSNs. Intended for local development only. Pix JD also uses it to accept `http://` addresses for its outbound connections, in every environment.	`false`	`true`, `false`

For a production BYOC deployment, set DEPLOYMENT_MODE=byoc, connect every datastore over TLS, and leave ALLOW_INSECURE_TLS unset (false).

Server

Variable	Description	Default	Allowed values
`SERVER_ADDRESS`	Main HTTP listen address (`host:port`, usually `:port`). The probes bind this same port.	Varies per service	`host:port`
`LOG_LEVEL`	Log verbosity. Use `info` or higher in production.	Varies per service	`debug`, `info`, `warn`, `error`
`ENV_NAME`	Environment label. In SLC, it is normalized to an allowlist.	Varies per service	SLC: `production`, `staging`, `uat`, `development`, `local`

Some services expose a numeric SERVER_PORT instead of, or alongside, SERVER_ADDRESS. Some worker components expose a dedicated health port (for example HEALTH_PORT or WORKER_SERVER_PORT). See Default network ports and Health and readiness.

Datastores

Every service that persists state connects to one or more datastores. The variable prefix depends on the store, and in some services on the logical database. The table below shows the common shape. Consult each product’s page for the exact names.

Variable	Description	Default	Allowed values
`POSTGRES_HOST` / `POSTGRES_PORT`	PostgreSQL host and port.	Varies per service	Host / port
`POSTGRES_USER` / `POSTGRES_PASSWORD`	Connection credentials. The password is a secret. Inject it at deploy time, and never commit it.	Varies per service	String / secret
`POSTGRES_NAME` / `POSTGRES_DB` / `DB_NAME`	Database name. The exact key varies by service: `POSTGRES_NAME` (for example STA, SLC, SISBAJUD, Consignado), `POSTGRES_DB` (SPB, SPI, Boleto), or `DB_NAME` (Pix Indirect). Midaz namespaces it per logical database as `DB_{MODULE}_NAME`. Consult each product’s page.	Varies per service	String
`POSTGRES_SSLMODE`	libpq TLS mode. Use `require` or stronger in production.	Varies per service	`disable`, `require`, `verify-ca`, `verify-full`
`POSTGRES_REPLICA_*`	Optional read-replica connection (same shape as the primary).	—	Host / port / credentials
`MONGO_URI` / `MONGO_HOST` / `MONGO_PORT`	MongoDB connection, as a full URI or discrete host and port.	—	Connection string / host / port
`MONGO_TLS_CA_CERT`	Base64-encoded PEM CA certificate for TLS (for example, a managed MongoDB service).	—	Base64 PEM
`REDIS_HOST` / `REDIS_PASSWORD`	Redis/Valkey endpoint and auth password (secret).	Varies per service	`host:port` / secret
`REDIS_TLS` / `REDIS_CA_CERT`	Enable TLS to Redis and supply a base64-encoded PEM CA certificate. In SLC, `REDIS_TLS=true` requires a nonblank `REDIS_CA_CERT`.	`false` / —	`true`, `false` / base64 PEM
`RABBITMQ_HOST` / `RABBITMQ_URI`	Broker host and connection scheme. Use `amqps` in production.	Varies per service	Host / `amqp`, `amqps`
`RABBITMQ_DEFAULT_USER` / `RABBITMQ_DEFAULT_PASS`	Broker credentials (password is a secret). In SLC, when RabbitMQ is enabled and its URL has no credentials, explicitly declare both `RABBITMQ_DEFAULT_USER` and `RABBITMQ_DEFAULT_PASS`.	—	String / secret

Not every service uses every store, and prefixes vary. Midaz namespaces connections per logical database (for example DB_ONBOARDING_*, DB_TRANSACTION_*, MONGO_CRM_*).

Runtime configuration

Variable	Description	Default	Allowed values
`SYSTEMPLANE_ENABLED`	Enable the systemplane runtime-configuration admin API, in services that expose the switch. Check each service’s page.	Varies per service	`true`, `false`

When enabled, the service exposes a plane for reading and writing runtime configuration. See Systemplane for the API and namespaces.

Streaming and outbox

Whether event publication is on by default, and which switch controls it, differs by service. Check each product’s page for its contract, for example SPI and SILOC.

Variable	Description	Default	Allowed values
`STREAMING_ENABLED`	Enable the event producer, in services that expose the switch.	Varies per service	`true`, `false`
`STREAMING_BROKERS`	Kafka/RedPanda bootstrap brokers, as a `host:port` comma-separated list. Required at startup by services whose streaming has no disabled mode.	—	`host:port` CSV
`STREAMING_CLOUDEVENTS_SOURCE`	The CloudEvents `source` stamped on every event the service emits. Several products accept exactly one literal and refuse to boot on any other, so take the value from the product’s own page.	Varies per service	The literal the product requires
`STREAMING_EVENT_POLICIES`	Per-event delivery-policy overrides, as `event.key.attribute=value` entries separated by commas, semicolons, or newlines (for example `transaction.created.enabled=true,transaction.created.outbox=always`). The attributes are `enabled`, `direct`, `outbox`, and `dlq`. Empty keeps each event’s default policy.	—	`event.key.attribute=value` list
`STREAMING_COMPRESSION`	Producer compression codec.	`lz4`	`none`, `gzip`, `snappy`, `lz4`, `zstd`
`STREAMING_REQUIRED_ACKS`	Producer acknowledgement level.	`all`	`all`, `leader`, `none`
`OUTBOX_ENABLED`	Enable the transactional outbox dispatcher (where the service exposes it separately).	Varies per service	`true`, `false`

The variables that secure the broker connection differ by service. Some services read STREAMING_SASL_* and STREAMING_TLS_*, and Consignado reads STREAMING_KAFKA_SASL_* and STREAMING_KAFKA_TLS_*. Set them when your broker requires authentication or TLS, and take the names from the product’s own page.

Service discovery

In services that support Consul service discovery, it is off by default. When enabled, the service registers itself and resolves peers through Consul instead of static addresses.

Variable	Description	Default	Allowed values
`SD_ENABLED`	Enable Consul service discovery.	`false`	`true`, `false`
`SD_EXTERNAL_ADDRESS` / `SD_INTERNAL_ADDRESS`	Advertised addresses. Required when enabled.	—	`host:port`
`SD_TLS` / `SD_TLS_SKIP_VERIFY`	Enable TLS to Consul, and (separately) bypass certificate verification.	`false`	`true`, `false`
`SD_TOKEN`	Consul ACL token (secret).	—	Secret

Some services use legacy aliases (SD_ADVERTISE_*, CONSUL_ADDR) for the same behavior.

Observability

Telemetry is push-based (OTLP). Some services additionally expose a /metrics endpoint for Prometheus scraping. See Health and readiness.

Variable	Description	Default	Allowed values
`ENABLE_TELEMETRY`	Enable OpenTelemetry instrumentation.	`false`	`true`, `false`
`OTEL_EXPORTER_OTLP_ENDPOINT`	OTLP collector endpoint. Use an `https://` endpoint in production.	Varies per service	URL
`ALLOW_INSECURE_OTEL`	Lets a service send telemetry to a plaintext OTLP endpoint (`http://` or no scheme) in production. Without it, many services refuse to start with a plaintext endpoint in production. Any non-empty value turns it on, so use a short reason. To keep TLS required, leave it unset.	Unset	String
`OTEL_RESOURCE_SERVICE_NAME`	Service name attached to exported telemetry.	Service default	String
`OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT`	Environment label attached to exported telemetry.	Varies per service	String

Plugin authentication

Lerian services can authenticate protected routes through Access Manager (Caradhras-backed). The authentication toggle, its variable name, and its default differ by service. Always enable authentication in production. Check each product or rail’s own environment-variables page for the authoritative toggle name, its default, and the routes it protects.

Variable	Description	Default	Allowed values
`PLUGIN_AUTH_ENABLED` / `AUTH_ENABLED`	Require Access Manager authentication on protected routes. The name and default vary by service.	Varies per service	`true`, `false`
`PLUGIN_AUTH_ADDRESS` / `PLUGIN_AUTH_HOST` / `AUTH_ADDRESS`	Access Manager service address. Required when enabled.	—	Address

Per-product variables

Each product adds its own variables: datastore prefixes, integration URLs, worker tuning, and feature toggles. Its own page holds the full, current list, for example:

Overview

Integration essentials

Stability & quality

Field dictionary

Event streaming

BYOC configuration essentials

Deployment mode and TLS

Server

Datastores

Runtime configuration

Streaming and outbox

Service discovery

Observability

Plugin authentication

Per-product variables

Midaz

Tracer

Reporter

Lender

​Deployment mode and TLS

​Server

​Datastores

​Runtime configuration

​Streaming and outbox

​Service discovery

​Observability

​Plugin authentication

​Per-product variables

Midaz

Tracer

Reporter

Lender

Deployment mode and TLS

Server

Datastores

Runtime configuration

Streaming and outbox

Service discovery

Observability

Plugin authentication

Per-product variables