> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.
# Environment variables
> Deploy-time environment variables distinctive to Lerian Consignado — Dataprev — the Dataprev integration adapters and the per-tenant credential custody store.
Lerian Consignado — Dataprev is the Lerian-owned gateway that integrates payroll-lending flows with Dataprev. You set these variables at deploy time, and the service must restart before they take effect. [BYOC configuration essentials](/en/reference/byoc-configuration) documents the universal backbone that every Lerian Go service shares: server, datastores, multi-tenancy, telemetry, plugin authentication, and licensing. This page covers only the variables distinctive to Lerian Consignado.
In the tables below, the **Default / Required** column shows the default value. A bold qualifier marks a variable that you must set, such as **Required** or **Required in managed deployments**. `—` means no default. A variable flagged **Sensitive** carries credential or key material. Inject it from your secret manager at deploy time, and never commit a value.
## Service and runtime
| Variable | Default / Required | Description |
| --------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SERVER_ADDRESS` | `:8080` | Main HTTP listen address. The liveness, readiness, metrics, and version probes bind this same port. |
| `ENV_NAME` | `development` | Runtime environment name read by the gateway's own security gate. Set it to `production` to arm production hardening (disables Swagger, forces rate limiting, runs production config validation). If you do not set it, it defaults to `development` and runs as non-production. |
| `ENVIRONMENT_NAME` | — | Environment for the multi-tenant tenant-event listener (`staging` or `production`; falls back to `ENV_NAME`). Required in multi-tenant mode. It does **not** arm the gateway's own security gate — set `ENV_NAME` for that. |
| `SYSTEMPLANE_ENABLED` | `false` | Enable the [Systemplane](/en/reference/systemplane/overview) runtime-configuration admin API under the `/system` prefix on the main port. Off by default (environment-variable-only mode). |
| `DEFAULT_TENANT_ID` | `default` | Tenant identifier used in single-tenant mode. |
Lerian Consignado exposes `/health` (liveness) and `/readyz` (readiness) on the main port, plus `/version` and `/metrics`. With multi-tenancy enabled, it also exposes `GET /readyz/tenant/{id}`. See [Health and readiness](/en/reference/health-and-readiness) for the probe contract.
## Dataprev integration
The master `DATAPREV_ENABLED` switch turns on the Dataprev integration. The averbação, reconciliation, and leilão-discovery flows each add their own enable switch. They also require `STREAMING_ENABLED` and run against the core Dataprev client. The employment-report, exclusion, and redirection flows are development-only. They ship only fake adapters today, so a managed deployment refuses to boot with any of them active.
`DATAPREV_REDIRECTION_ADAPTER` alone selects the redirection adapter, because redirection has no separate enable switch. Leave that adapter `disabled` in managed deployments. The custody store below provisions per-tenant credentials for the core Dataprev client (margin, averbação, reconciliation).
| Variable | Default / Required | Description |
| ------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DATAPREV_ENABLED` | `false` | Master switch for the Dataprev integration. The averbação, reconciliation, and leilão-discovery flows require this together with `STREAMING_ENABLED`. |
| `DATAPREV_AVERBACAO_ENABLED` | `false` | Independent opt-in for the averbação (margin-consumption) money path. Averbação stays unsubscribed unless this, `DATAPREV_ENABLED`, and streaming are all on. |
| `DATAPREV_CODIGO_SOLICITANTE` | — | Static single-tenant Dataprev integrator code: the institution's three-digit BACEN COMPE code. Public, not a secret. It is the fallback for the single-tenant path only — where per-tenant custody is required, the code resolves per tenant from the custody store, and a missing one fails closed rather than borrowing another institution's code. |
| `DATAPREV_CONSENT_CACHE_HMAC_KEY` | **Required when Redis is configured and the rail is enabled** | Key for the HMAC digest that keys the cross-pod worker-consent cache in Redis, so the cache key never carries a CPF. Boot fails closed without it rather than silently degrading to a per-pod cache. Sensitive. |
| `DATAPREV_RECONCILIATION_ENABLED` | `false` | Enable the per-competência reconciliation poller. Requires `DATAPREV_ENABLED` and streaming. |
| `DATAPREV_RECONCILIATION_INTERVAL_SEC` | `3600` | Reconciliation poll cadence, in seconds. |
| `DATAPREV_RECONCILIATION_LOOKBACK_MONTHS` | `1` | Competências before the current one to include on each tick. |
| `DATAPREV_RECONCILIATION_CNPJS` | — | Comma-separated consignante employer CNPJs to reconcile. |
| `DATAPREV_RECONCILIATION_TENANT_ID` | — | Tenant that owns the reconciliation run. Required in single-tenant mode. |
| `LEILAO_ENABLED` | `false` | Enable loan-auction (leilão) discovery. Requires `DATAPREV_ENABLED` and streaming. |
| `LEILAO_INTERVAL_SEC` | `3600` | Auction-discovery poll cadence, in seconds. |
| `LEILAO_TENANT_ID` | — | Tenant used by the auction-discovery path in single-tenant mode. Discovery relays offers only: no external bid manager is registered yet, so the automatic path submits no gateway-originated proposal. |
| `LEILAO_BID_MANAGER_RPS` | `25` | Outbound requests-per-second budget for the bid-manager fan-out, independent of the rail's shared limiter. Active and validated at boot: a value above the code-locked 25 req/s per-institution ceiling refuses to start. The fan-out stays idle until external bid managers are registered. |
| `LEILAO_BID_MANAGER_BURST` | `25` | Burst allowance for the bid-manager fan-out, validated at boot against the same 25 req/s ceiling. |
| `LEILAO_DECIDE_DEADLINE_SEC` | `5` | Per-bid-manager decision deadline; a manager that exceeds it is skipped for that auction. It takes effect when external bid managers are registered. |
| `DATAPREV_EMPLOYMENT_REPORT_ENABLED` | `false` | Enable the employment-status report flow. |
| `DATAPREV_EMPLOYMENT_REPORT_ADAPTER` | `disabled` | Employment-report adapter. `disabled` is the no-op default. |
| `DATAPREV_EMPLOYMENT_REPORT_INTERVAL_SEC` | `3600` | Employment-report poll cadence, in seconds. |
| `DATAPREV_EMPLOYMENT_REPORT_PAGE_SIZE` | `100` | Records read per employment-report page. |
| `DATAPREV_EMPLOYMENT_REPORT_CONCURRENCY` | `4` | Concurrent employment-report workers. |
| `DATAPREV_EXCLUSION_ENABLED` | `false` | Enable the exclusion flow. |
| `DATAPREV_EXCLUSION_ADAPTER` | `disabled` | Exclusion adapter. `disabled` is the no-op default. |
| `DATAPREV_EXCLUSION_PROVIDER_TIMEOUT_SEC` | `30` | Per-request timeout, in seconds, for exclusion provider calls. |
| `DATAPREV_EXCLUSION_CLAIM_DWELL_SEC` | `60` | Dwell before a claimed exclusion item is retried. |
| `DATAPREV_EXCLUSION_STATUS_CHECK_LEASE_SEC` | `60` | Lease for the exclusion status-check worker. |
| `DATAPREV_EXCLUSION_RECOVERY_INTERVAL_SEC` | `30` | Exclusion recovery-sweep cadence, in seconds. |
| `DATAPREV_EXCLUSION_RECOVERY_BATCH` | `50` | Exclusion items processed per recovery pass. |
| `DATAPREV_EXCLUSION_RECOVERY_CONCURRENCY` | `4` | Concurrent exclusion recovery workers. |
| `DATAPREV_REDIRECTION_ADAPTER` | `disabled` | Redirection adapter. `disabled` is the no-op default. |
In a managed deployment (production, multi-tenant, SaaS, or BYOC), the boot guard fails closed. The service refuses to start when any of these is true:
* A Dataprev flow selects a fake or otherwise non-`disabled` adapter.
* A Dataprev endpoint URL (base or OAuth token) uses plain HTTP instead of HTTPS.
* The Dataprev rail runs with the credential custody store off.
## Credential custody
A managed secret store custodies per-tenant Dataprev certificate and OAuth credentials. A managed deployment that runs the Dataprev rail must enable the store. The boot guard refuses to start while the store is off.
| Variable | Default / Required | Description |
| --------------------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CREDENTIALS_STORE_ENABLED` | `false` · **Required in managed deployments** | Enable the per-tenant credential custody store. With the Dataprev rail enabled, a production, multi-tenant, SaaS, or BYOC deployment refuses to boot while it is `false`. |
| `CREDENTIALS_CLEANUP_INTERVAL_SEC` | `30` | Credential-cleanup sweep cadence, in seconds. |
| `CREDENTIALS_CLEANUP_BATCH_SIZE` | `50` | Credentials processed per cleanup pass. |
| `CREDENTIALS_CLEANUP_CONCURRENCY` | `4` | Concurrent credential-cleanup workers. |
| `CREDENTIALS_CLEANUP_LEASE_SEC` | `60` | Lease for the credential-cleanup worker. |
| `CREDENTIALS_CLEANUP_PERSISTENCE_TIMEOUT_SEC` | `5` | Per-operation persistence timeout, in seconds. |
| `AWS_REGION` | `us-east-1` | Region for the secrets-manager custody backend. Credentials resolve through the default AWS SDK chain. |
| `AWS_ENDPOINT_URL` | — | AWS-compatible endpoint override for local development. Leave unset in real AWS environments; production must not set it. |