Environment variables

This reference lists the environment variables used to configure Reporter, the service that generates regulatory, compliance, and accounting reports from configurable templates. Reporter ships as a single binary whose active surfaces are selected by RUN_MODE — the API manager, the report worker, or both. You set these at deploy time, through Helm values, Docker Compose, or your orchestrator’s environment. Variables marked as required cause the server to fail on startup if not set. For the configuration blocks that every Lerian product shares — TLS posture, OpenTelemetry, Access Manager authentication, multi-tenancy, service discovery, and event streaming — see the BYOC configuration reference. This page focuses on what is distinctive to Reporter.

Run mode and ports

RUN_MODE decides which surfaces the process serves. Run the API and worker as one process (all) for small deployments, or split them into separate deployables (api and worker) to scale report generation independently. See the health and readiness reference for the probe contract.

Variable	Description	Default	Required
`RUN_MODE`	Surfaces to run: `api`, `worker`, or `all`	`all`	No
`APP_CONTEXT`	Route prefix for the API surface	`/manager/v1`	No
`SERVER_PORT` / `SERVER_ADDRESS`	API port (`RUN_MODE=api`/`all`). Serves `/health`, `/readyz`, `/version`.	`4005`	No
`HEALTH_PORT`	Worker health port (`RUN_MODE=worker`). Serves `/health`, `/readyz`.	`4006`	No

Deployment and TLS

Variable	Description	Default	Required
`DEPLOYMENT_MODE`	Deployment flavor: `local`, `byoc`, or `saas`. In `saas`, TLS is mandatory for every dependency connection and the server refuses to start without it. In `byoc`, TLS is recommended and warned-on rather than enforced. Also tags the `/readyz` response.	`local`	No
`ALLOW_INSECURE_TLS`	Bypass per-connection TLS enforcement on infrastructure DSNs. Leave unset or `false` in production.	`false`	No

CORS and proxies

Variable	Description	Default	Required
`CORS_ALLOWED_ORIGINS`	Allowed CORS origins (CSV, or `*`). Lock to explicit origins in production.	`*`	No
`CORS_ALLOWED_METHODS`	Allowed CORS methods	varies	No
`CORS_ALLOWED_HEADERS`	Allowed CORS headers	varies	No
`TRUSTED_PROXIES`	Trusted proxy CIDRs for `X-Forwarded-For` parsing. Set when running behind a load balancer.	—	No
`SWAGGER_ENABLED`	Serve the OpenAPI/Swagger UI	`true`	No

Database (MongoDB)

Stores report metadata, templates, and run history.

Variable	Description	Default	Required
`MONGO_URI`	Connection scheme: `mongodb` or `mongodb+srv`	`mongodb`	No
`MONGO_HOST`	MongoDB host	—	Yes
`MONGO_PORT`	MongoDB port	—	Yes
`MONGO_USER`	Database user	—	Yes
`MONGO_PASSWORD`	Database password. Sensitive.	—	Yes
`MONGO_NAME`	Database name	`reporter-db`	Yes
`MONGO_MAX_POOL_SIZE`	Maximum connection pool size	varies	No
`MONGO_TLS_CA_CERT`	Base64-encoded PEM CA certificate for TLS (for example AWS DocumentDB)	—	No

Message broker (RabbitMQ)

Carries the generate-report command queue between the API and the worker.

Variable	Description	Default	Required
`RABBITMQ_HOST`	Broker host	—	Yes
`RABBITMQ_PORT_AMQP`	AMQP port	—	Yes
`RABBITMQ_PORT_HOST`	Management/HTTP port	—	No
`RABBITMQ_URI`	Connection scheme: `amqp` or `amqps`. Use `amqps` in production.	`amqp`	No
`RABBITMQ_DEFAULT_USER`	Broker user	—	Yes
`RABBITMQ_DEFAULT_PASS`	Broker password. Sensitive.	—	Yes
`RABBITMQ_NUMBERS_OF_WORKERS`	Worker consumer concurrency	`5`	No

Object storage (S3-compatible)

Where rendered reports are stored. Works with any S3-compatible endpoint.

Variable	Description	Default	Required
`OBJECT_STORAGE_ENDPOINT`	S3-compatible endpoint URL	—	Yes
`OBJECT_STORAGE_REGION`	Storage region	`us-east-1`	No
`OBJECT_STORAGE_BUCKET`	Bucket for rendered reports	—	Yes
`OBJECT_STORAGE_ACCESS_KEY_ID`	Access key ID. Sensitive.	—	Yes
`OBJECT_STORAGE_SECRET_KEY`	Secret access key. Sensitive.	—	Yes
`OBJECT_STORAGE_USE_PATH_STYLE`	Use path-style addressing (needed by some S3-compatible stores)	`true`	No
`OBJECT_STORAGE_DISABLE_SSL`	Disable TLS to the storage endpoint. Leave `false` in production.	`true`	No

Cache (Redis / Valkey)

Variable	Description	Default	Required
`REDIS_HOST`	Redis/Valkey host and port	—	Yes
`REDIS_PASSWORD`	Authentication password. Sensitive.	—	No
`REDIS_DB`	Logical database index	`0`	No
`REDIS_PROTOCOL`	RESP protocol version	varies	No
`REDIS_TLS`	Enable TLS for the connection	`false`	No
`REDIS_CA_CERT`	Base64-encoded PEM CA certificate for TLS	—	No
`REDIS_MASTER_NAME`	Sentinel master name (Sentinel deployments)	—	No
`REDIS_USE_GCP_IAM`	Authenticate to GCP Memorystore with IAM instead of a password	`false`	No

PDF rendering (worker)

Variable	Description	Default	Required
`PDF_POOL_WORKERS`	Concurrent PDF render workers	`5`	No
`PDF_TIMEOUT_SECONDS`	Per-report PDF render timeout (seconds)	`30`	No

Report datasources

Reports can read directly from single-tenant datasources declared with a dynamic prefix. Replace {NAME} with your datasource identifier; declare one block per source.

Variable	Description	Default	Required
`DATASOURCE_{NAME}_HOST`	Datasource host	—	No
`DATASOURCE_{NAME}_PORT`	Datasource port	—	No
`DATASOURCE_{NAME}_USER`	Datasource user	—	No
`DATASOURCE_{NAME}_PASSWORD`	Datasource password. Sensitive.	—	No
`DATASOURCE_{NAME}_DATABASE`	Database name	—	No
`DATASOURCE_{NAME}_TYPE`	Datasource engine type	—	No
`DATASOURCE_{NAME}_SSLMODE`	SSL mode for the datasource connection	—	No
`DATASOURCE_{NAME}_SSLROOTCERT`	Path to the datasource SSL root certificate	—	No
`DATASOURCE_{NAME}_SCHEMAS`	Schemas to expose from the datasource	—	No
`CRYPTO_HASH_SECRET_KEY_CRM`	Hashing key to read CRM datasource PII. Sensitive.	—	No
`CRYPTO_ENCRYPT_SECRET_KEY_CRM`	Encryption key to read CRM datasource PII. Sensitive.	—	No

Shared configuration backbone

The following blocks are identical across Lerian products and are documented in full in the BYOC configuration reference. They default off.

Access Manager authentication — PLUGIN_AUTH_ENABLED, PLUGIN_AUTH_ADDRESS. Enable in production.
Multi-tenancy — MULTI_TENANT_*, plus RABBITMQ_MULTI_TENANT_SYNC_INTERVAL and RABBITMQ_MULTI_TENANT_DISCOVERY_TIMEOUT. Off by default.
Service discovery — SD_* (Consul; Reporter also accepts the legacy SD_ADVERTISE_* / CONSUL_ADDR aliases). Off by default.
Event streaming — STREAMING_ENABLED, STREAMING_BROKERS, STREAMING_CLOUDEVENTS_SOURCE, plus RABBITMQ_REPORT_EVENTS_EXCHANGE for the events exchange. Off by default.
OpenTelemetry — ENABLE_TELEMETRY, OTEL_*, OTEL_INSECURE_EXPORTER. Telemetry is OTLP push.

Overview

Guides

Console

Operations

Environment variables

Run mode and ports

Deployment and TLS

CORS and proxies

Database (MongoDB)

Message broker (RabbitMQ)

Object storage (S3-compatible)

Cache (Redis / Valkey)

PDF rendering (worker)

Report datasources

Shared configuration backbone

​Run mode and ports

​Deployment and TLS

​CORS and proxies

​Database (MongoDB)

​Message broker (RabbitMQ)

​Object storage (S3-compatible)

​Cache (Redis / Valkey)

​PDF rendering (worker)

​Report datasources

​Shared configuration backbone

Run mode and ports

Deployment and TLS

CORS and proxies

Database (MongoDB)

Message broker (RabbitMQ)

Object storage (S3-compatible)

Cache (Redis / Valkey)

PDF rendering (worker)

Report datasources

Shared configuration backbone