Environment variables

Consignado-specific deployment variables for Dataprev connectivity, workers, auctions, credentials, artifacts, pacing, and operational windows.

Set these variables at deployment time. Unless stated otherwise, changing one requires a restart. The BYOC configuration reference covers the shared Lerian runtime: server, datastores, multi-tenancy, telemetry, authentication, streaming, outbox, and licensing. This page lists Consignado-specific settings and the few shared settings that materially change its rail behavior.

— means no default. Variables carrying certificates, private keys, OAuth secrets, or HMAC keys are sensitive and must come from a secret manager.

Service and tenant mode

Variable	Default	Purpose
SERVER_ADDRESS	:8080	Main HTTP listener for the API and probes.
ENV_NAME	development	Arms production hardening when set to production.
ENVIRONMENT_NAME	—	Multi-tenant event-listener environment; falls back to ENV_NAME.
SYSTEMPLANE_ENABLED	false	Enables runtime configuration under /system.
MULTI_TENANT_ENABLED	false	Selects per-tenant Dataprev credential custody over the single-tenant static fallback.
DEFAULT_TENANT_ID	default	Tenant used in single-tenant mode.
OUTBOX_ENABLED	true	Must be true; startup refuses a deployment that cannot durably record rail facts.
STREAMING_ENABLED	true	Must be true; the streaming relay is the only publisher for outbox facts.
STREAMING_BROKERS	—	Required broker list. Startup refuses a relay with no destination.
STREAMING_CLOUDEVENTS_SOURCE	—	Must be exactly consignado-gw. Startup refuses any other value; a wrong source means no fact ever reaches a consumer.

Dataprev client and authentication

Variable	Default	Purpose
DATAPREV_ENABLED	false	Master switch for the Dataprev rail runtime.
DATAPREV_BASE_URL	—	Base URL for the main Dataprev API. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts.
DATAPREV_TOMBAMENTO_BASE_URL	—	Separate endpoint for tombamento operations. Empty keeps those operations unavailable. It follows the same HTTPS/loopback policy.
DATAPREV_OAUTH_TOKEN_URL	—	OAuth2 token endpoint. HTTPS is required in managed deployments; local/dev permits HTTP only for loopback hosts.
DATAPREV_OAUTH_CLIENT_ID	—	Single-tenant OAuth client ID fallback. Sensitive.
DATAPREV_OAUTH_CLIENT_SECRET	—	Single-tenant OAuth client secret fallback. Sensitive.
DATAPREV_OAUTH_SCOPES	—	Space-delimited OAuth scopes requested from Dataprev.
DATAPREV_CERT_FILE	—	Local ICP-Brasil certificate path for non-managed single-tenant development. Sensitive.
DATAPREV_KEY_FILE	—	Local private-key path paired with DATAPREV_CERT_FILE. Sensitive.
DATAPREV_CODIGO_SOLICITANTE	—	Three-digit requester-code fallback for single-tenant mode.
DATAPREV_REQUEST_TIMEOUT_SEC	30	Timeout for one Dataprev request.
DATAPREV_REQUESTS_PER_SECOND	25	Validated operator ceiling and Systemplane default for rail pacing.
DATAPREV_CONSENT_CACHE_HMAC_KEY	—	HMAC key used to index worker-consent cache entries without exposing CPF. Required when the rail uses Redis. Sensitive.

Managed deployments must use tenant credential custody. They fail closed instead of falling back to an unauthenticated or non-mTLS client.

Contract and portability windows

Variable	Default	Purpose
DATAPREV_AVERBACAO_ENABLED	false	Enables the averbação runtime and proposal-witness path.
DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS	72	Lookback window for portability proposals.
DATAPREV_PORTABILIDADE_INCLUSAO_GARANTIAS_PATH	—	Override for the Dataprev portability-guarantee submission path.
DATAPREV_PORTABILIDADE_AVERBACAO_WINDOW_DAYS	20	Window to complete outbound portability registration.
DATAPREV_REFINANCIAMENTO_REVERSAO_WINDOW_BUSINESS_DAYS	7	Business-day window for refinancing reversal.
DATAPREV_SALDO_DEVEDOR_CLOCK_INTERVAL_SEC	86400	Cadence for outstanding-balance obligations and month-end fallback.

Reconciliation and employment feeds

Variable	Default	Purpose
DATAPREV_RECONCILIATION_ENABLED	false	Enables payroll bookkeeping and repasse reconciliation.
DATAPREV_RECONCILIATION_INTERVAL_SEC	3600	Reconciliation cadence.
DATAPREV_RECONCILIATION_LOOKBACK_MONTHS	1	Previous payroll competences included in each pass.
DATAPREV_RECONCILIATION_CNPJS	—	Comma-separated employer scopes; empty reads the rail-wide feed.
DATAPREV_RECONCILIATION_TENANT_ID	—	Tenant used by single-tenant scheduled feeds.
DATAPREV_EMPLOYMENT_REPORT_ENABLED	false	Enables the employment-termination feed.
DATAPREV_EMPLOYMENT_REPORT_ADAPTER	disabled	dataprev for the real adapter; fake is local-only.
DATAPREV_EMPLOYMENT_REPORT_INTERVAL_SEC	3600	Employment-report cadence.
DATAPREV_EMPLOYMENT_REPORT_PAGE_SIZE	100	Records requested per page.
DATAPREV_EMPLOYMENT_REPORT_CONCURRENCY	4	Concurrent tenant workers.
DATAPREV_EMPLOYMENT_REPORT_TENANT_TIMEOUT_SEC	300	Maximum processing time for one tenant in a pass.

Exclusion and redirection

Variable	Default	Purpose
DATAPREV_EXCLUSION_ENABLED	false	Enables exclusion admission and recovery.
DATAPREV_EXCLUSION_PROVIDER_TIMEOUT_SEC	30	Timeout for one exclusion provider call.
DATAPREV_EXCLUSION_CLAIM_DWELL_SEC	60	Minimum dwell before claimed work can be retried.
DATAPREV_EXCLUSION_STATUS_CHECK_LEASE_SEC	60	Lease for exclusion status checks.
DATAPREV_EXCLUSION_RECOVERY_INTERVAL_SEC	30	Recovery-loop cadence.
DATAPREV_EXCLUSION_RECOVERY_BATCH	50	Operations claimed per pass.
DATAPREV_EXCLUSION_RECOVERY_CONCURRENCY	4	Concurrent recovery workers.
DATAPREV_EXCLUSION_RECOVERY_TENANT_TIMEOUT_SEC	60	Maximum processing time for one tenant in a pass.
DATAPREV_REDIRECTION_ADAPTER	disabled	Redirection adapter selection. fake is accepted only for local development.

DATAPREV_EXCLUSION_ADAPTER and DATAPREV_EXCLUSION_FAKE_BASE_URL are retired. Remove them from deployment manifests. Non-inert legacy values fail validation.

Outcome recovery

A rail command can end with its outcome unestablished: the process died mid-call, or Dataprev never answered. Two recovery loops converge that state against the rail’s own registry. Both loops are off by default. Enable them in any deployment that submits averbações or rail commands. Otherwise an unestablished outcome never resolves.

Variable	Default	Purpose
DATAPREV_AVERBACAO_RECOVERY_ENABLED	false	Enables averbação outcome convergence.
DATAPREV_AVERBACAO_RECOVERY_INTERVAL_SEC	60	Convergence cadence.
DATAPREV_AVERBACAO_RECOVERY_BATCH	50	Records claimed per pass.
DATAPREV_AVERBACAO_RECOVERY_CONCURRENCY	4	Concurrent tenant workers.
DATAPREV_AVERBACAO_RECOVERY_TENANT_TIMEOUT_SEC	60	Maximum processing time for one tenant in a pass.
DATAPREV_AVERBACAO_RECOVERY_MINIMUM_DWELL_SEC	300	Minimum age before an unestablished outcome is reconciled.
DATAPREV_AVERBACAO_RECOVERY_PROVIDER_TIMEOUT_SEC	30	Timeout for one registry read.
DATAPREV_RAIL_COMMAND_RECOVERY_ENABLED	false	Enables convergence for refinancing, reversal, renegotiation, and origin-side portability exclusion.
DATAPREV_RAIL_COMMAND_RECOVERY_INTERVAL_SEC	60	Convergence cadence.
DATAPREV_RAIL_COMMAND_RECOVERY_BATCH	50	Records claimed per pass.
DATAPREV_RAIL_COMMAND_RECOVERY_CONCURRENCY	4	Concurrent tenant workers.
DATAPREV_RAIL_COMMAND_RECOVERY_TENANT_TIMEOUT_SEC	60	Maximum processing time for one tenant in a pass.
DATAPREV_RAIL_COMMAND_RECOVERY_MINIMUM_DWELL_SEC	300	Minimum age before an unestablished outcome is reconciled.
DATAPREV_RAIL_COMMAND_RECOVERY_PROVIDER_TIMEOUT_SEC	30	Timeout for one registry read.

Auctions and client bids

Variable	Default	Purpose
LEILAO_ENABLED	false	Enables scheduled discovery of open loan requests.
LEILAO_CLIENT_BID_ENABLED	false	Enables the authenticated client bid command surface.
LEILAO_INTERVAL_SEC	3600	Auction-discovery cadence.
LEILAO_TENANT_ID	—	Tenant used by the M001 auction and M011 portability-discovery flows. Required when either enabled flow needs it.
LEILAO_PORTAL_BASE_URL	—	Optional single-tenant worker portal base URL fallback. Leaving it unset is a valid deployment: bids then travel with the client’s own contacts. A value that is set is validated at boot and an unsafe one fails the boot closed.
LEILAO_DISCOVERY_LOOKBACK_HOURS	8760	Initial and recovery lookback for open requests.
LEILAO_DISCOVERY_CLOCK_SKEW_SEC	300	Clock-skew overlap applied to discovery windows.
LEILAO_PORTABILITY_ENABLED	false	Enables M011 portability discovery. This is independent from LEILAO_ENABLED.
LEILAO_PORTABILITY_INTERVAL_SEC	3600	Cadence of the M011 portability-discovery pass.
LEILAO_BID_MANAGER_RPS	25	Request budget for bid-manager fan-out.
LEILAO_BID_MANAGER_BURST	25	Immediate burst budget for bid-manager fan-out.
LEILAO_DECIDE_DEADLINE_SEC	5	Decision deadline per bid manager.

M011 portability discovery requires LEILAO_PORTABILITY_ENABLED=true, LEILAO_TENANT_ID, DATAPREV_ENABLED=true, STREAMING_ENABLED=true, a primary database, and the canonical outbox. It does not require LEILAO_ENABLED=true. The portability listing window is 72 hours by default (DATAPREV_PORTABILIDADE_SOLICITACAO_WINDOW_HOURS). The service refuses to boot unless that window is wider than LEILAO_PORTABILITY_INTERVAL_SEC plus the 300-second LEILAO_DISCOVERY_CLOCK_SKEW_SEC margin.

Credential custody and artifacts

Variable	Default	Purpose
CREDENTIALS_STORE_ENABLED	false	Enables tenant credential custody. Required when the Dataprev rail runs in a managed deployment.
CREDENTIALS_CLEANUP_INTERVAL_SEC	30	Credential-cleanup cadence.
CREDENTIALS_CLEANUP_BATCH_SIZE	50	Credentials claimed per cleanup pass.
CREDENTIALS_CLEANUP_CONCURRENCY	4	Concurrent cleanup workers.
CREDENTIALS_CLEANUP_LEASE_SEC	60	Cleanup lease.
CREDENTIALS_CLEANUP_PERSISTENCE_TIMEOUT_SEC	5	Persistence timeout for one cleanup operation.
AVERBACAO_ARTIFACTS_BUCKET	—	Private object-store bucket for CCB and rail artifacts. Required when DATAPREV_AVERBACAO_ENABLED=true.
AVERBACAO_ARTIFACTS_ENDPOINT_URL	—	S3-compatible endpoint override for local or private object stores.
AVERBACAO_ARTIFACTS_USE_PATH_STYLE	false	Uses path-style S3 addressing when enabled.
AWS_REGION	—	Region used by credential custody and artifact storage. Deliberately has no default: an unset value lets the AWS SDK resolve the institution’s own region, and a hardcoded one would override it. Set it explicitly for the region your data must stay in.
AWS_ENDPOINT_URL	—	AWS-compatible endpoint override for local development. Do not set it in managed AWS production.

Consignado has no non-event-driven startup mode: outbox, streaming, and brokers are mandatory even though the platform shares those settings. Keep the CloudEvent source pinned to consignado-gw.