BYOC configuration essentials

Environment variables that recur across Lerian Go services when you run BYOC in your own cloud or on-prem.

In a BYOC (bring your own cloud) deployment, you run Lerian products inside your own AWS, GCP, or on-prem infrastructure. You own the data and the runtime. You configure each service through environment variables, and most of them are service-specific. This page covers variables that recur across Lerian Go services. Use each product’s own page for the rest.

These variables are not the full list. Variable names and defaults differ between services, and services add their own keys. See Per-product variables.

​

Deployment mode and TLS

Variable	Description	Default	Allowed values
DEPLOYMENT_MODE	Deployment posture. Its effect, default and accepted values vary per service.	Varies per service	Varies per service
ALLOW_INSECURE_TLS	Bypass per-connection TLS enforcement on infrastructure DSNs. Intended for local development only. Pix JD also uses it to accept http:// addresses for its outbound connections, in every environment.	false	true, false

For a production BYOC deployment, set DEPLOYMENT_MODE=byoc, connect every datastore over TLS, and leave ALLOW_INSECURE_TLS unset (false).

​

Server

Variable	Description	Default	Allowed values
SERVER_ADDRESS	Main HTTP listen address (host:port, usually :port). Probe locations depend on the service release.	Varies per service	host:port
LOG_LEVEL	Log verbosity. Use info or higher in production.	Varies per service	debug, info, warn, error
ENV_NAME	Environment label. In SLC, it is normalized to an allowlist.	Varies per service	SLC: production, staging, uat, development, local

Some services use a numeric SERVER_PORT instead of or alongside SERVER_ADDRESS. For releases that adopt the health port, HEALTH_PORT enables a separate listener. If unset, there is no health listener. Charts and examples configure 8099. Keep that port internal. Older releases can use the main port or a dedicated worker port. See Default network ports and Health and readiness.

For releases using the current shared server lifecycle, SHUTDOWN_DRAIN_DELAY accepts a nonnegative Go duration. An invalid or negative value prevents startup. When the service owns SIGTERM in a Kubernetes pod, the default is 15s; otherwise it is 0. At the signal, stopping is announced and listeners keep serving during the drain. After the drain, SHUTDOWN_TIMEOUT is one shared budget for HTTP, gRPC, admin, and shutdown hooks.

Before you upgrade a BYOC deployment to a release that moves readiness to the health port:

1. Check the product release and match its image and chart using the product chart README.
2. Allow node-to-pod TCP traffic on 8099 in your internal network, including host firewalls or security groups. Keep the health port private.
3. Point load balancer health checks to /health on the main port. GKE Ingress and AGIC can fall back to GET /, which returns 404.
4. Update internal probes and monitoring to use the health port for the adopting release. Keep the main API port unchanged. Check readiness, liveness, and the shutdown budget before completing the upgrade.

​

Datastores

Every service that persists state connects to one or more datastores. The variable prefix depends on the store, and in some services on the logical database. The table below shows the common shape. Consult each product’s page for the exact names.

Variable	Description	Default	Allowed values
POSTGRES_HOST / POSTGRES_PORT	PostgreSQL host and port.	Varies per service	Host / port
POSTGRES_USER / POSTGRES_PASSWORD	Connection credentials. The password is a secret. Inject it at deploy time, and never commit it.	Varies per service	String / secret
POSTGRES_NAME / POSTGRES_DB / DB_NAME	Database name. The exact key varies by service: POSTGRES_NAME (for example STA, SLC, SISBAJUD, Consignado), POSTGRES_DB (SPB, SPI, Boleto), or DB_NAME (Pix Indirect). Midaz namespaces it per logical database as DB_{MODULE}_NAME. Consult each product’s page.	Varies per service	String
POSTGRES_SSLMODE	libpq TLS mode. Use require or stronger in production.	Varies per service	disable, require, verify-ca, verify-full
POSTGRES_REPLICA_*	Optional read-replica connection (same shape as the primary).	—	Host / port / credentials
MONGO_URI / MONGO_HOST / MONGO_PORT	MongoDB connection, as a full URI or discrete host and port.	—	Connection string / host / port
MONGO_TLS_CA_CERT	Base64-encoded PEM CA certificate for TLS (for example, a managed MongoDB service).	—	Base64 PEM
REDIS_HOST / REDIS_PASSWORD	Redis/Valkey endpoint and auth password (secret).	Varies per service	host:port / secret
REDIS_TLS / REDIS_CA_CERT	Enable TLS to Redis and supply a base64-encoded PEM CA certificate. In SLC, REDIS_TLS=true requires a nonblank REDIS_CA_CERT.	false / —	true, false / base64 PEM
RABBITMQ_HOST / RABBITMQ_URI	Broker host and connection scheme. Use amqps in production.	Varies per service	Host / amqp, amqps
RABBITMQ_DEFAULT_USER / RABBITMQ_DEFAULT_PASS	Broker credentials (password is a secret). In SLC, when RabbitMQ is enabled and its URL has no credentials, explicitly declare both RABBITMQ_DEFAULT_USER and RABBITMQ_DEFAULT_PASS.	—	String / secret

Not every service uses every store, and prefixes vary. Midaz namespaces connections per logical database (for example DB_ONBOARDING_*, DB_TRANSACTION_*, MONGO_CRM_*).

​

Runtime configuration

Variable	Description	Default	Allowed values
SYSTEMPLANE_ENABLED	Enable the systemplane runtime-configuration admin API, in services that expose the switch. Check each service’s page.	Varies per service	true, false

When enabled, the service exposes a plane for reading and writing runtime configuration. See Systemplane for the API and namespaces.

​

Streaming and outbox

Whether event publication is on by default, and which switch controls it, differs by service. Check each product’s page for its contract, for example SPI and SILOC.

Variable	Description	Default	Allowed values
STREAMING_ENABLED	Enable the event producer, in services that expose the switch.	Varies per service	true, false
STREAMING_BROKERS	Kafka/RedPanda bootstrap brokers, as a host:port comma-separated list. Required at startup by services whose streaming has no disabled mode.	—	host:port CSV
STREAMING_CLOUDEVENTS_SOURCE	The CloudEvents source stamped on every event the service emits. Several products accept exactly one literal and refuse to boot on any other, so take the value from the product’s own page.	Varies per service	The literal the product requires
STREAMING_EVENT_POLICIES	Per-event delivery-policy overrides, as event.key.attribute=value entries separated by commas, semicolons, or newlines (for example transaction.created.enabled=true,transaction.created.outbox=always). The attributes are enabled, direct, outbox, and dlq. Empty keeps each event’s default policy.	—	event.key.attribute=value list
STREAMING_COMPRESSION	Producer compression codec, in services that read it.	lz4	none, gzip, snappy, lz4, zstd
STREAMING_REQUIRED_ACKS	Producer acknowledgement level, in services that read it.	all	all, leader, none
OUTBOX_ENABLED	Enable the transactional outbox dispatcher (where the service exposes it separately).	Varies per service	true, false

The variables that secure the broker connection differ by service. Some services read STREAMING_SASL_* and STREAMING_TLS_*, and Consignado reads STREAMING_KAFKA_SASL_* and STREAMING_KAFKA_TLS_*. Set them when your broker requires authentication or TLS, and take the names from the product’s own page.

​

Service discovery

In services that support Consul service discovery, it is off by default. When enabled, the service registers itself and resolves peers through Consul instead of static addresses.

Variable	Description	Default	Allowed values
SD_ENABLED	Enable Consul service discovery.	false	true, false
SD_EXTERNAL_ADDRESS / SD_INTERNAL_ADDRESS	Advertised addresses. Required when enabled.	—	host:port
SD_TLS / SD_TLS_SKIP_VERIFY	Enable TLS to Consul, and (separately) bypass certificate verification.	false	true, false
SD_TOKEN	Consul ACL token (secret).	—	Secret

Some services use legacy aliases (SD_ADVERTISE_*, CONSUL_ADDR) for the same behavior.

​

Observability

Telemetry is push-based (OTLP). Some services additionally expose a /metrics endpoint for Prometheus scraping. See Health and readiness.

Variable	Description	Default	Allowed values
ENABLE_TELEMETRY	Enable OpenTelemetry instrumentation.	false	true, false
OTEL_EXPORTER_OTLP_ENDPOINT	OTLP collector endpoint. Use an https:// endpoint in production.	Varies per service	URL
ALLOW_INSECURE_OTEL	Lets a service send telemetry to a plaintext OTLP endpoint (http:// or no scheme) in production. Without it, many services refuse to start with a plaintext endpoint in production. Use a short reason. To keep TLS required, leave it unset.	Unset	String
OTEL_RESOURCE_SERVICE_NAME	Service name attached to exported telemetry.	Service default	String
OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT	Environment label attached to exported telemetry.	Varies per service	String

​

Plugin authentication

Lerian services can authenticate protected routes through Access Manager (Caradhras-backed). The authentication toggle, its variable name, and its default differ by service. Always enable authentication in production. Check each product or rail’s own environment-variables page for the authoritative toggle name, its default, and the routes it protects.

Variable	Description	Default	Allowed values
PLUGIN_AUTH_ENABLED / AUTH_ENABLED	Require Access Manager authentication on protected routes. The name and default vary by service.	Varies per service	true, false
PLUGIN_AUTH_ADDRESS / PLUGIN_AUTH_HOST / AUTH_ADDRESS	Access Manager service address. Required when enabled.	—	Address

​

Per-product variables

Each product adds its own variables: datastore prefixes, integration URLs, worker tuning, and feature toggles. Its own page holds the full, current list, for example:

Midaz

Tracer

Reporter

Lender