Environment variables

Reference the environment variables used to configure Reporter, organized by category — HTTP server, database, storage, authentication, and telemetry.

This reference lists the environment variables used to configure Reporter, the service that generates regulatory, compliance, and accounting reports from configurable templates. Reporter ships as a single binary whose active surfaces are selected by RUN_MODE — the API manager, the report worker, or both. You set these at deploy time, through Helm values, Docker Compose, or your orchestrator’s environment. Variables marked as required cause the server to fail on startup if not set.

For the configuration blocks that every Lerian product shares — TLS posture, OpenTelemetry, Access Manager authentication, multi-tenancy, service discovery, and event streaming — see the BYOC configuration reference. This page focuses on what is distinctive to Reporter.

Run mode and ports

RUN_MODE decides which surfaces the process serves. Run the API and worker as one process (all) for small deployments, or split them into separate deployables (api and worker) to scale report generation independently. See the health and readiness reference for the probe contract.

Variable	Description	Default	Required
RUN_MODE	Surfaces to run: api, worker, or all	all	No
SERVER_PORT / SERVER_ADDRESS	API bind address (RUN_MODE=api/all), read from SERVER_ADDRESS; SERVER_PORT is the convention used to build it (:4005). Serves /health, /readyz, /version.	—	Yes (api/all)
HEALTH_PORT	Worker health port (RUN_MODE=worker). Serves /health, /readyz.	4006	No

Deployment and TLS

Variable	Description	Default	Required
DEPLOYMENT_MODE	Deployment flavor: local, byoc, or saas. In saas, TLS is mandatory for every dependency connection and the server refuses to start without it. In byoc, TLS is recommended and warned-on rather than enforced. Also tags the /readyz response.	local	No
ALLOW_INSECURE_TLS	Bypass per-connection TLS enforcement on infrastructure DSNs. Leave unset or false in production.	false	No

CORS and proxies

Variable	Description	Default	Required
CORS_ALLOWED_ORIGINS	Allowed CORS origins (CSV, or *). Lock to explicit origins in production.	*	No
CORS_ALLOWED_METHODS	Allowed CORS methods	varies	No
CORS_ALLOWED_HEADERS	Allowed CORS headers	varies	No
TRUSTED_PROXIES	Trusted proxy CIDRs for X-Forwarded-For parsing. Set when running behind a load balancer.	—	No
SWAGGER_ENABLED	Serve the OpenAPI/Swagger UI	false	No

API pagination

Variable	Description	Default	Required
MAX_PAGINATION_LIMIT	Largest limit a list operation accepts. A request above the ceiling is rejected with a pagination error rather than clamped.	100	No

Database (MongoDB)

Stores report metadata, templates, and run history.

Variable	Description	Default	Required
MONGO_URI	Connection scheme: mongodb or mongodb+srv	mongodb	No
MONGO_HOST	MongoDB host	—	Yes
MONGO_PORT	MongoDB port	—	Yes
MONGO_USER	Database user	—	Yes
MONGO_PASSWORD	Database password. Sensitive.	—	Yes
MONGO_NAME	Database name	—	Yes
MONGO_MAX_POOL_SIZE	Maximum connection pool size	varies	No
MONGO_TLS_CA_CERT	Base64-encoded PEM CA certificate for TLS (for example AWS DocumentDB)	—	No

Message broker (RabbitMQ)

Carries the generate-report command queue between the API and the worker.

Variable	Description	Default	Required
RABBITMQ_HOST	Broker host	—	Yes
RABBITMQ_PORT_AMQP	AMQP port	—	Yes
RABBITMQ_PORT_HOST	Management/HTTP port	—	No
RABBITMQ_URI	Connection scheme: amqp or amqps. Use amqps in production.	amqp	No
RABBITMQ_DEFAULT_USER	Broker user	—	Yes
RABBITMQ_DEFAULT_PASS	Broker password. Sensitive.	—	Yes
RABBITMQ_NUMBERS_OF_WORKERS	Worker consumer concurrency	5	No

Object storage (S3-compatible)

Where rendered reports are stored. Works with any S3-compatible endpoint.

Variable	Description	Default	Required
OBJECT_STORAGE_ENDPOINT	S3-compatible endpoint URL	—	Yes
OBJECT_STORAGE_REGION	Storage region	us-east-1	No
OBJECT_STORAGE_BUCKET	Bucket for rendered reports	reporter-storage	No
OBJECT_STORAGE_ACCESS_KEY_ID	Access key ID. Sensitive.	—	Yes
OBJECT_STORAGE_SECRET_KEY	Secret access key. Sensitive.	—	Yes
OBJECT_STORAGE_USE_PATH_STYLE	Use path-style addressing (needed by some S3-compatible stores)	false	No
OBJECT_STORAGE_DISABLE_SSL	Disable TLS to the storage endpoint. Leave false in production.	false	No

Cache (Redis / Valkey)

Variable	Description	Default	Required
REDIS_HOST	Redis/Valkey host and port	—	Yes
REDIS_PASSWORD	Authentication password. Sensitive.	—	No
REDIS_DB	Logical database index	0	No
REDIS_PROTOCOL	RESP protocol version	varies	No
REDIS_TLS	Enable TLS for the connection	false	No
REDIS_CA_CERT	Base64-encoded PEM CA certificate for TLS	—	No
REDIS_MASTER_NAME	Sentinel master name (Sentinel deployments)	—	No
REDIS_USE_GCP_IAM	Authenticate to GCP Memorystore with IAM instead of a password	false	No

PDF rendering (worker)

Variable	Description	Default	Required
PDF_POOL_WORKERS	Concurrent PDF render workers	2	No
PDF_TIMEOUT_SECONDS	Per-report PDF render timeout (seconds)	90	No

Report datasources

Reports read from PostgreSQL and MongoDB datasources declared in the environment, one block per source. Replace {NAME} with your datasource identifier, and use the same identifier in every key of the block.

DATASOURCE_{NAME}_CONFIG_NAME is the variable that makes a block exist. Reporter discovers datasources by scanning the environment for keys that match DATASOURCE_*_CONFIG_NAME — the prefix counts as much as the suffix, so a key that only ends in _CONFIG_NAME declares nothing. Reporter reads the rest of a block only for a name it found that way. The value is the name your templates use to address the source.

Within a block, the variables marked required are the ones Reporter needs before it reads the block.

Variable	Description	Default	Required
DATASOURCE_{NAME}_CONFIG_NAME	Name that templates use to address this datasource. Declares the block.	—	Yes
DATASOURCE_{NAME}_TYPE	Datasource engine: postgresql or mongodb	—	Yes
DATASOURCE_{NAME}_HOST	Datasource host	—	Yes
DATASOURCE_{NAME}_PORT	Datasource port	—	Yes
DATASOURCE_{NAME}_DATABASE	Database name	—	Yes
DATASOURCE_{NAME}_USER	Datasource user	—	No
DATASOURCE_{NAME}_PASSWORD	Datasource password. Sensitive.	—	No
DATASOURCE_{NAME}_SCHEMAS	Schemas to expose from the datasource (CSV)	public	No
DATASOURCE_{NAME}_SSLMODE	SSL mode for a PostgreSQL connection	—	No
DATASOURCE_{NAME}_SSLROOTCERT	Path to the PostgreSQL SSL root certificate	—	No
DATASOURCE_{NAME}_SSL	Enable TLS on a MongoDB connection	—	No
DATASOURCE_{NAME}_SSLCA	Path to the MongoDB CA certificate file	—	No
DATASOURCE_{NAME}_OPTIONS	Extra MongoDB URI options	—	No
CRYPTO_HASH_SECRET_KEY_CRM	Hashing key to read CRM datasource PII. Sensitive.	—	No
CRYPTO_ENCRYPT_SECRET_KEY_CRM	Encryption key to read CRM datasource PII. Sensitive.	—	No

A complete block. We recommend that you set the CONFIG_NAME value to the same string as the {NAME} segment, as every example on this page does — one name across the environment and your templates:

DATASOURCE_ONBOARDING_CONFIG_NAME=onboarding
DATASOURCE_ONBOARDING_TYPE=postgresql
DATASOURCE_ONBOARDING_HOST=midaz-postgres-replica
DATASOURCE_ONBOARDING_PORT=5702
DATASOURCE_ONBOARDING_DATABASE=onboarding
DATASOURCE_ONBOARDING_USER=reporter
DATASOURCE_ONBOARDING_PASSWORD=<secret>
DATASOURCE_ONBOARDING_SCHEMAS=public

A template then addresses that source by its config name, as in {{ onboarding.accounts }}. Datasources are declared only in the environment, so adding one is a configuration change and a restart.

Shared configuration backbone

The following blocks are identical across Lerian products and are documented in full in the BYOC configuration reference. They default off.

• Access Manager authentication — PLUGIN_AUTH_ENABLED, PLUGIN_AUTH_ADDRESS. Enable in production.
• Multi-tenancy — MULTI_TENANT_*, plus RABBITMQ_MULTI_TENANT_SYNC_INTERVAL and RABBITMQ_MULTI_TENANT_DISCOVERY_TIMEOUT. Off by default.
• Service discovery — SD_* (Consul; Reporter also accepts the legacy SD_ADVERTISE_* / CONSUL_ADDR aliases). Off by default.
• Event streaming — STREAMING_ENABLED, STREAMING_BROKERS, STREAMING_CLOUDEVENTS_SOURCE, plus RABBITMQ_REPORT_EVENTS_EXCHANGE for the events exchange. Off by default.
• OpenTelemetry — ENABLE_TELEMETRY, OTEL_*, OTEL_INSECURE_EXPORTER. Telemetry is OTLP push.