Console environment variables

The environment variables that connect Lerian Console to Midaz, Tracer, and Access Manager, and the ones that switch Console screens on or off.

Console reads these variables when its container starts. After you change one, restart the Console container. You do not need to rebuild the image.

To install or upgrade Console, see the Console chart README.

​

Product addresses

Variable	Required	What it does
MIDAZ_V2_BASE_PATH	Yes	The address of the Ledger /v2 API, ending in /v2/. Console reads Fees, Holders, Alias Accounts, accounting routes, and operation routes from it. Without it, these pages fail.
TRACER_BASE_PATH	Only with Tracer	The address of the Tracer service, without /v1.
MIDAZ_BASE_PATH	Yes	The address of the Ledger API for organizations, ledgers, assets, accounts, portfolios, segments, and account types. Without it, these pages fail.
MIDAZ_TRANSACTION_BASE_PATH	Yes	The address of the Ledger API for transactions, operations, and balances. Without it, these pages fail.
FLOWKER_BASE_PATH	Only with Flowker	The address of the Flowker API.
LENDER_BASE_PATH	Only with Lender	The address of the Lender API, ending in /api/v1.
PLUGIN_CONSIGNADO_BASE_PATH	Only with Consignado CLT	The address of the Consignado CLT API, ending in /v1.
REPORTER_BASE_PATH	Only with Reporter	The address of the Reporter API.
MATCHER_BASE_PATH	Only with Matcher	The address of Matcher, without a path.
NARYA_BASE_PATH	Only with the Matcher copilot	The address of the copilot service that serves the Matcher copilot, without /v1. Unset or empty, the copilot is off and Matcher pages show no panel. The copilot also needs PLUGIN_AUTH_ENABLED set to true.
STREAMING_HUB_BASE_PATH	Only with Streaming Hub	The address of the Streaming Hub API.
NOTIFICATION_BASE_PATH	Only with Notification	The address of Notification, without a path.
PLUGIN_PIX_INDIRECT_BTG_BASE_PATH	Only with Pix BTG	The address of Pix BTG, without a path.
PLUGIN_PAYMENTS_BASE_PATH	Only with Payments	The address of the Payments API.
PLUGIN_BANK_TRANSFER_BASE_PATH	Only with Bank Transfer	The address of the Bank Transfer API.

​

License

Variable	Required	What it does
LICENSE_KEY	Yes	The Lerian license key of your deployment. Console does not start without it. Its readiness check answers 503 until a license is accepted.

​

Access Manager

Variable	Default	What it does
PLUGIN_AUTH_ENABLED	true	Turns on sign-in through Access Manager. Console derives NEXT_PUBLIC_PLUGIN_AUTH_ENABLED from it when that variable is unset. Console does not start unless PLUGIN_AUTH_ENABLED or OAUTH_ENABLED is true.
PLUGIN_AUTH_BASE_PATH	http://plugin-auth:4000/v1	The address of the Access Manager Auth API, ending in /v1.
PLUGIN_AUTH_PUBLIC_BASE_PATH	—	The address of the same Auth API as the browser reaches it. Console sends the browser there to start an SSO sign-in. Without it, Console uses PLUGIN_AUTH_BASE_PATH.
PLUGIN_IDENTITY_BASE_PATH	http://plugin-identity:4001/v1	The address of the Access Manager Identity API, ending in /v1.
PLUGIN_AUTH_CLIENT_ID	—	The client ID of the Access Manager application that Console signs users in with. Its secret is PLUGIN_AUTH_CLIENT_SECRET.

​

Sign-in options

Variable	Default	What it does
ENABLE_FORGOT_PASSWORD	false	Turns on password reset from the sign-in page. It is on only when the value is true.
GOOGLE_DIRECTORY_ENABLED	false	Turns on the Google Workspace directory card in Settings > Security > Single Sign-On. It is on only when the value is true.
TRUSTED_PROXIES	—	The address ranges, in CIDR form and separated by commas, of the proxies in front of Console. Console reads the caller address from the forwarded address header only past these ranges. Without it, Console derives no caller address.
ALLOWED_ORIGINS	—	The origins, separated by commas, from which Console accepts write requests, for example https://console.example.com. Without it, Console refuses every create, update, and delete.

​

Data store

Console connects to MongoDB with these variables.

Variable	Default	What it does
MONGODB_URI	mongodb	The connection scheme, for example mongodb.
MONGO_HOST	midaz-mongodb	The MongoDB host.
MONGO_PORT	27017	The MongoDB port.
MONGODB_DB_NAME	midaz-console	The database name.
MONGODB_USER	midaz	The database user. Its password is MONGODB_PASS.
MONGO_PARAMETERS	directConnection=true	The connection options that Console appends to the connection string.
MONGO_TLS_CA_CERT	—	The CA certificate for the MongoDB connection, as a base64-encoded PEM.
MONGO_CONNECT_TIMEOUT	30000	The time, in milliseconds, that Console waits for MongoDB at startup.
MONGO_CONNECT_RETRIES	5	The number of connection attempts at startup.

​

Account types

Variable	Default	What it does
MIDAZ_ACCOUNT_TYPE_VALIDATION_ENABLED	false	Turns on account type validation in Console. It is on only when the value is true.
MIDAZ_ACCOUNT_TYPE_VALIDATION	—	The organization and ledger pairs, written as <organization-id>:<ledger-id> and separated by commas. Console skips a pair that does not have this shape.

​

Telemetry

Variable	Default	What it does
ENABLE_TELEMETRY	true	Turns on the export of traces, metrics, and logs. It is on only when the value is true.
OTEL_EXPORTER_OTLP_ENDPOINT	http://localhost:4318	The collector address that Console uses for an OTEL_URL_* variable that is empty.
OTEL_URL_TRACES	http://infra:4318/v1/traces	The address for traces.
OTEL_URL_METRICS	http://infra:4318/v1/metrics	The address for metrics.
OTEL_URL_LOGS	http://infra:4318/v1/logs	The address for logs.

​

Secrets

Keep NEXTAUTH_SECRET, MONGODB_PASS, and PLUGIN_AUTH_CLIENT_SECRET in your secret vault. Never put them in a file in your repository or in an image.

​

Screens

Variable	What it controls
NEXT_PUBLIC_MIDAZ_CONSOLE_AVATAR_ALLOWED_FORMAT	The image formats accepted for avatars, separated by commas, for example jpeg,jpg,png.
NEXT_PUBLIC_PARTNERS_ENABLED	The Partners entry of Settings and the Partners card on the home page. They are on unless the value is false.
NEXT_PUBLIC_BANK_TRANSFER_ENABLED	The Bank Transfer screens of the Midaz module. They are off unless the value is true.