Environment variables

Deploy-time environment variables for Lerian SRC: runtime posture, license, institution identity, PostgreSQL, events, Access Manager, IBM MQ, key custody, data at rest, and telemetry.

Lerian SRC reads its configuration from the process environment at startup. You set these variables at deploy time. A service restart makes them take effect. BYOC configuration essentials covers the BYOC configuration model.

In the tables below, the Default / Required column shows the value that Lerian SRC applies when you leave the variable unset. A bold qualifier marks a variable that you must set, in every environment or under a stated condition. The condition “outside local development” means every environment except an ENV_NAME of develop or development with DEPLOYMENT_MODE empty or local. The value — means that Lerian SRC applies no default. A description that ends with “Sensitive.” marks a variable that holds a secret.

A production deployment is one where ENV_NAME names production or DEPLOYMENT_MODE is saas or byoc. Lerian SRC applies stricter checks there.

Where a value in the shipped example file differs from the value the code applies, this page publishes the code value.

Service and runtime

Variable	Default / Required	Description
SERVICE_NAME	br-src	Service name in logs and telemetry.
ENV_NAME	development	Deployment environment: local, develop, development, uat, staging, prod, or production. Another value stops the boot.
DEPLOYMENT_MODE	local. Required in production	Deployment model: local, byoc, or saas. Another value stops the boot.
LOG_LEVEL	info	Log level at startup: debug, info, warn, or error. The src.log.level runtime key changes it while the service runs.
SERVER_PORT	3006	HTTP listen port.
TRUSTED_PROXIES	—	Comma-separated list of proxy addresses or CIDR ranges that Lerian SRC trusts for the client IP address. Empty trusts no proxy.
PROXY_HEADER	X-Forwarded-For when TRUSTED_PROXIES is set	Header that carries the client IP address from a trusted proxy.

License

Variable	Default / Required	Description
LICENSE_KEY	Required	License key that Lerian issues. Sensitive.
ORGANIZATION_IDS	Required	Comma-separated list of the organization IDs that the license covers. Set at least one.

Institution identity

Variable	Default / Required	Description
SRC_CNPJ_BASE8	Required	The CNPJ base of your institution: 8 characters from 0-9 and A-Z, not all zeros. Lerian SRC derives the IBM MQ queue names and the operation numbers from it.
SRC_SENDER_ISPB	Required in production, or when SRC_MQ_HOST is set	The ISPB of your institution: 8 digits, not all zeros.

PostgreSQL

Variable	Default / Required	Description
POSTGRES_HOST	Required in production	Database host.
POSTGRES_PORT	5432	Database port.
POSTGRES_USER	Required in production	Database user.
POSTGRES_PASSWORD	—	Database password. Sensitive.
POSTGRES_DB	Required in production	Database name.
POSTGRES_SSLMODE	disable	PostgreSQL sslmode.
POSTGRES_MAX_OPEN_CONNS	25	Maximum open connections in the pool.
POSTGRES_MAX_IDLE_CONNS	10	Maximum idle connections in the pool.
POSTGRES_CONN_LIFETIME	30m	Maximum lifetime of a connection, as a Go duration.
POSTGRES_CONN_IDLE_TIME	5m	Maximum idle time of a connection, as a Go duration.

Events

Variable	Default / Required	Description
SRC_STREAMING_BROKERS	—. Required in production, unless SRC_STREAMING_EMISSION_DISABLED is true	Comma-separated list of broker addresses.
SRC_STREAMING_CLIENT_ID	br-src	Producer client ID.
SRC_STREAMING_SOURCE	br-src	CloudEvents source. Leave it unset, or set it to exactly br-src. Another value stops the boot.
SRC_STREAMING_TLS	false	Turns on TLS for the broker connection.
SRC_STREAMING_EMISSION_DISABLED	false	Set it to true to run without a broker. The events then stay pending in the outbox.

Access Manager

Variable	Default / Required	Description
PLUGIN_AUTH_ENABLED	Required	Turns on Access Manager authentication. Set it to true. A production deployment refuses false.
PLUGIN_AUTH_ADDRESS	Required in production	Access Manager address.
IDP_DECLARATION_ENABLED	false	Set it to true to publish the Lerian SRC permission manifest to Access Manager at startup.
IDP_HOST	Required when IDP_DECLARATION_ENABLED is true	Address of the Access Manager identity service that receives the manifest.
IDP_M2M_CLIENT_ID	Required when IDP_DECLARATION_ENABLED is true	Client ID that Lerian SRC uses to publish the manifest.
IDP_M2M_CLIENT_SECRET	Required when IDP_DECLARATION_ENABLED is true	Client secret that Lerian SRC uses to publish the manifest. Sensitive.

IBM MQ

Variable	Default / Required	Description
SRC_MQ_HOST	Required in production	Host of your institution’s IBM MQ queue manager.
SRC_MQ_PORT	Required when SRC_MQ_HOST is set	Listener port of your queue manager.
SRC_MQ_CHANNEL	Required when SRC_MQ_HOST is set	Server-connection channel on your queue manager. At most 20 characters from A-Z, a-z, 0-9, ., /, _, and %.
SRC_MQ_QUEUE_MANAGER	Required in production	Name of your queue manager.
SRC_MQ_USER	—	IBM MQ user ID.
SRC_MQ_PASSWORD	—	IBM MQ password. Sensitive.
SRC_MQ_TLS_ENABLED	false	Turns on TLS for the IBM MQ connection. A production deployment requires true.
SRC_MQ_SSL_KEY_REPOSITORY	—	Path stem of the IBM MQ key repository.
SRC_MQ_CERT_LABEL	—	Label of the certificate in the key repository that the IBM MQ connection presents.
SRC_MQ_CIPHER_SPEC	TLS_RSA_WITH_AES_256_CBC_SHA256	IBM MQ cipher spec.
SRC_MQ_SEND_QUEUE	Derived from SRC_CNPJ_BASE8	Name of the send queue.
SRC_MQ_RECEIVE_QUEUE	Derived from SRC_CNPJ_BASE8	Name of the receive queue.
SRC_MQ_BACKOUT_QUEUE	The receive queue name followed by .BACKOUT	Queue that takes a message after it fails delivery SRC_MQ_BACKOUT_THRESHOLD times.
SRC_MQ_BACKOUT_THRESHOLD	5	Failed deliveries before a message moves to the backout queue. 0 turns the move off.
SRC_MQ_BACKOUT_DELAY	2s	Pause after a failed delivery, as a Go duration.
SRC_MQ_STALE_AFTER	30s	Time with no completed IBM MQ call before the src_mq check reports degraded. 0 turns this off.
SRC_MQ_HEARTBEAT_INTERVAL	30s	IBM MQ heartbeat interval, as a Go duration in whole seconds. 0 uses the value of the channel.

Certificates and key custody

Variable	Default / Required	Description
SRC_LOCAL_CERT_FILE	Required in production, or when SRC_MQ_HOST is set	Path to your institution’s certificate. It must match the private key in PKCS#11 or KMIP.
SRC_BACEN_CERT_FILE	Required in production, or when SRC_MQ_HOST is set	Path to BACEN’s certificate. Restart Lerian SRC after you replace it.
SRC_PKCS11_MODULE_PATH	—	Path to the PKCS#11 client library.
SRC_PKCS11_TOKEN_LABEL	—	Label of the PKCS#11 token.
SRC_PKCS11_PIN_FILE	—	Path to the file that holds the PKCS#11 PIN.
SRC_PKCS11_KEY_LABEL	—	Label of the key pair in the PKCS#11 token.
SRC_KMIP_BASE_URL	—	Base URL of the KMIP server.
SRC_KMIP_VHSM	—	Identifier of the virtual HSM.
SRC_KMIP_CRYPTO_USER	—	KMIP crypto user.
SRC_KMIP_CRYPTO_USER_TOKEN	—	Token of the KMIP crypto user. Sensitive.
SRC_KMIP_SIGN_PRIVATE_KEY_UID	—	Identifier of the signing private key.
SRC_KMIP_SIGN_PUBLIC_KEY_UID	—	Identifier of the matching public key.
SRC_KMIP_DECRYPT_KEY_UID	—	Identifier of the decryption key.

Data at rest

Variable	Default / Required	Description
SRC_ATREST_ENCRYPTION_KEY	Required outside local development	The 32-byte key that encrypts document data at rest. Sensitive.
SRC_ATREST_BLIND_INDEX_KEY	Required outside local development	The key Lerian SRC uses to search by document number. At least 32 characters, and different from SRC_ATREST_ENCRYPTION_KEY. Sensitive.

Telemetry

Variable	Default / Required	Description
ENABLE_TELEMETRY	false. A production deployment requires true	Turns on the export of traces and metrics over OTLP.
OTEL_EXPORTER_OTLP_ENDPOINT	Required in production	Address of the OTLP collector.