Configuring dependencies

Configure the bundled or externally managed Valkey, PostgreSQL, MongoDB, and RabbitMQ services used by Midaz.

The Midaz chart enables Valkey, PostgreSQL, MongoDB, and RabbitMQ by default. You can disable a bundled service and configure each enabled workload to use an external service instead.

Dependency	Chart dependency version	Disable with
Valkey	2.4.7	valkey.enabled: false
PostgreSQL	16.3.5	postgresql.enabled: false
MongoDB	16.4.0	mongodb.enabled: false
RabbitMQ	2.1.11	rabbitmq.enabled: false

When you disable a bundled dependency, provide all connection and credential values required by every enabled workload before deploying.

Valkey

Configure an external Valkey or Redis service through the Ledger configuration and Secret:

valkey:
  enabled: false

ledger:
  configmap:
    REDIS_HOST: redis.example.internal:6379
  secrets:
    REDIS_PASSWORD: <password>

PostgreSQL

For an external PostgreSQL service, configure the Ledger connections and, when enabled, Tracer. The optional bootstrap Job creates the onboarding and transaction databases, the configured Tracer database when you enable Tracer, and the midaz role.

postgresql:
  enabled: false

ledger:
  configmap:
    DB_ONBOARDING_HOST: postgres.example.internal
    DB_ONBOARDING_REPLICA_HOST: postgres.example.internal
    DB_TRANSACTION_HOST: postgres.example.internal
    DB_TRANSACTION_REPLICA_HOST: postgres.example.internal
  secrets:
    DB_ONBOARDING_PASSWORD: <midaz-password>
    DB_ONBOARDING_REPLICA_PASSWORD: <midaz-password>
    DB_TRANSACTION_PASSWORD: <midaz-password>
    DB_TRANSACTION_REPLICA_PASSWORD: <midaz-password>

tracer:
  configmap:
    DB_HOST: postgres.example.internal
    DB_NAME: tracer
    DB_USER: midaz
  secrets:
    DB_PASSWORD: <midaz-password>

global:
  externalPostgresDefinitions:
    enabled: true
    connection:
      host: postgres.example.internal
      port: "5432"
    postgresAdminLogin:
      useExistingSecret:
        name: postgres-admin
    midazCredentials:
      useExistingSecret:
        name: midaz-postgres

The referenced Secrets must provide DB_USER_ADMIN and DB_ADMIN_PASSWORD, or DB_PASSWORD_MIDAZ, respectively. The chart does not wire the bootstrap Secret into Ledger or Tracer automatically: their password values must match the midaz role password. If Tracer uses an existing Secret, add DB_PASSWORD there instead. When you enable Tracer, the bootstrap Job also creates the database named by tracer.configmap.DB_NAME (default tracer) and grants the midaz role access. The Job waits up to 300 seconds for PostgreSQL and retries up to three times. It remains for 300 seconds after completion.

MongoDB

Configure an external MongoDB service in Ledger and, when enabled, CRM:

mongodb:
  enabled: false

ledger:
  configmap:
    MONGO_ONBOARDING_HOST: mongo.example.internal
    MONGO_TRANSACTION_HOST: mongo.example.internal
    MONGO_CRM_HOST: mongo.example.internal
    MONGO_FEES_HOST: mongo.example.internal
  secrets:
    MONGO_ONBOARDING_PASSWORD: <password>
    MONGO_TRANSACTION_PASSWORD: <password>
    MONGO_CRM_PASSWORD: <password>
    MONGO_FEES_PASSWORD: <password>

crm:
  configmap:
    MONGO_HOST: mongo.example.internal
  secrets:
    MONGO_PASSWORD: <password>

When the optional CRM workload uses crm.useExistingSecret: true, put MONGO_PASSWORD in that existing Secret instead of crm.secrets.

RabbitMQ

For an external RabbitMQ service, set the application connection values and load the definitions required by Midaz. The file charts/midaz/files/rabbitmq/load_definitions.json contains the definitions.

rabbitmq:
  enabled: false

ledger:
  configmap:
    RABBITMQ_URI: amqp
    RABBITMQ_PROTOCOL: http
    RABBITMQ_HOST: rabbitmq.example.internal
    RABBITMQ_PORT_HOST: "5672"
    RABBITMQ_PORT_AMQP: "15672"
  secrets:
    RABBITMQ_DEFAULT_PASS: <transaction-password>
    RABBITMQ_CONSUMER_PASS: <consumer-password>

global:
  externalRabbitmqDefinitions:
    enabled: true # Local evaluation only; see the security warning below.
    connection:
      protocol: http
      host: rabbitmq.example.internal
      port: "15672"
      portAmqp: "5672"
    rabbitmqAdminLogin:
      useExistingSecret:
        name: rabbitmq-admin
    appCredentials:
      useExistingSecret:
        name: rabbitmq-app

The bootstrap Job applies the definitions through the management API and provisions the transaction and consumer application users. Before importing anything, it checks only whether both users already exist. If they do, the Job exits without loading definitions or reconciling their passwords. The referenced Secrets use RABBITMQ_ADMIN_USER and RABBITMQ_ADMIN_PASS, or RABBITMQ_DEFAULT_PASS and RABBITMQ_CONSUMER_PASS. The chart does not wire the bootstrap Secret into Ledger automatically: the two ledger.secrets values must match the passwords in rabbitmq-app.

At the audited revision, the bootstrap Job imports the same bundled definitions file before changing the transaction and consumer passwords. That file also creates an administrator named midaz with the public, fixed password lerian, and the Job does not rotate or remove that account. Do not run this Job against a shared or production broker. Provision the required vhost, queues, exchanges, bindings, and application users independently without importing the static users.

Bundled RabbitMQ

The Midaz chart requires ledger.secrets.RABBITMQ_DEFAULT_PASS and ledger.secrets.RABBITMQ_CONSUMER_PASS even when you use bundled RabbitMQ. At the audited revision, both must be lerian to match the fixed password hashes for the transaction and consumer users in the bundled definitions file. The bundled RabbitMQ chart also requires a non-empty Erlang cookie. Set it to a printable string of at least 32 characters without spaces.

The bundled definitions use public, fixed credentials. The chart does not generate them from ledger.secrets. Use bundled RabbitMQ only for local evaluation. For shared or production environments, use externally managed RabbitMQ and provision its definitions without the chart’s bootstrap Job.

ledger:
  secrets:
    RABBITMQ_DEFAULT_PASS: lerian
    RABBITMQ_CONSUMER_PASS: lerian

rabbitmq:
  authentication:
    erlangCookie:
      value: "<32-or-more-printable-characters-without-spaces>"

Production operations

For a production deployment, assess managed-service requirements such as backups, recovery, availability, monitoring, and access controls before choosing bundled or external dependencies.