> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Reference the environment variables used to configure Reporter, organized by category — HTTP server, database, storage, authentication, and telemetry.

This reference lists the environment variables used to configure **Reporter**, the service that generates regulatory, compliance, and accounting reports from configurable templates. Reporter ships as a single binary whose active surfaces are selected by `RUN_MODE` — the API manager, the report worker, or both. You set these at deploy time, through Helm values, Docker Compose, or your orchestrator's environment. Variables marked as required cause the server to fail on startup if not set.

For the configuration blocks that every Lerian product shares — TLS posture, OpenTelemetry, Access Manager authentication, multi-tenancy, service discovery, and event streaming — see the [BYOC configuration reference](/en/reference/byoc-configuration). This page focuses on what is distinctive to Reporter.

## Run mode and ports

`RUN_MODE` decides which surfaces the process serves. Run the API and worker as one process (`all`) for small deployments, or split them into separate deployables (`api` and `worker`) to scale report generation independently. See the [health and readiness reference](/en/reference/health-and-readiness) for the probe contract.

| Variable                         | Description                                                                                                                                                               | Default | Required          |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------- |
| `RUN_MODE`                       | Surfaces to run: `api`, `worker`, or `all`                                                                                                                                | `all`   | No                |
| `SERVER_PORT` / `SERVER_ADDRESS` | API bind address (`RUN_MODE=api`/`all`), read from `SERVER_ADDRESS`; `SERVER_PORT` is the convention used to build it (`:4005`). Serves `/health`, `/readyz`, `/version`. | —       | Yes (`api`/`all`) |
| `HEALTH_PORT`                    | Worker health port (`RUN_MODE=worker`). Serves `/health`, `/readyz`.                                                                                                      | `4006`  | No                |

## Deployment and TLS

| Variable             | Description                                                                                                                                                                                                                                                | Default | Required |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
| `DEPLOYMENT_MODE`    | Deployment flavor: `local`, `byoc`, or `saas`. In `saas`, TLS is mandatory for every dependency connection and the server refuses to start without it. In `byoc`, TLS is recommended and warned-on rather than enforced. Also tags the `/readyz` response. | `local` | No       |
| `ALLOW_INSECURE_TLS` | Bypass per-connection TLS enforcement on infrastructure DSNs. Leave unset or `false` in production.                                                                                                                                                        | `false` | No       |

## CORS and proxies

| Variable               | Description                                                                                 | Default | Required |
| ---------------------- | ------------------------------------------------------------------------------------------- | ------- | -------- |
| `CORS_ALLOWED_ORIGINS` | Allowed CORS origins (CSV, or `*`). Lock to explicit origins in production.                 | `*`     | No       |
| `CORS_ALLOWED_METHODS` | Allowed CORS methods                                                                        | varies  | No       |
| `CORS_ALLOWED_HEADERS` | Allowed CORS headers                                                                        | varies  | No       |
| `TRUSTED_PROXIES`      | Trusted proxy CIDRs for `X-Forwarded-For` parsing. Set when running behind a load balancer. | —       | No       |
| `SWAGGER_ENABLED`      | Serve the OpenAPI/Swagger UI                                                                | `false` | No       |

## API pagination

| Variable               | Description                                                                                                                    | Default | Required |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------- | -------- |
| `MAX_PAGINATION_LIMIT` | Largest `limit` a list operation accepts. A request above the ceiling is rejected with a pagination error rather than clamped. | `100`   | No       |

## Database (MongoDB)

Stores report metadata, templates, and run history.

| Variable              | Description                                                            | Default   | Required |
| --------------------- | ---------------------------------------------------------------------- | --------- | -------- |
| `MONGO_URI`           | Connection scheme: `mongodb` or `mongodb+srv`                          | `mongodb` | No       |
| `MONGO_HOST`          | MongoDB host                                                           | —         | Yes      |
| `MONGO_PORT`          | MongoDB port                                                           | —         | Yes      |
| `MONGO_USER`          | Database user                                                          | —         | Yes      |
| `MONGO_PASSWORD`      | Database password. Sensitive.                                          | —         | Yes      |
| `MONGO_NAME`          | Database name                                                          | —         | Yes      |
| `MONGO_MAX_POOL_SIZE` | Maximum connection pool size                                           | varies    | No       |
| `MONGO_TLS_CA_CERT`   | Base64-encoded PEM CA certificate for TLS (for example AWS DocumentDB) | —         | No       |

## Message broker (RabbitMQ)

Carries the generate-report command queue between the API and the worker.

| Variable                      | Description                                                      | Default | Required |
| ----------------------------- | ---------------------------------------------------------------- | ------- | -------- |
| `RABBITMQ_HOST`               | Broker host                                                      | —       | Yes      |
| `RABBITMQ_PORT_AMQP`          | AMQP port                                                        | —       | Yes      |
| `RABBITMQ_PORT_HOST`          | Management/HTTP port                                             | —       | No       |
| `RABBITMQ_URI`                | Connection scheme: `amqp` or `amqps`. Use `amqps` in production. | `amqp`  | No       |
| `RABBITMQ_DEFAULT_USER`       | Broker user                                                      | —       | Yes      |
| `RABBITMQ_DEFAULT_PASS`       | Broker password. Sensitive.                                      | —       | Yes      |
| `RABBITMQ_NUMBERS_OF_WORKERS` | Worker consumer concurrency                                      | `5`     | No       |

## Object storage (S3-compatible)

Where rendered reports are stored. Works with any S3-compatible endpoint.

| Variable                        | Description                                                       | Default            | Required |
| ------------------------------- | ----------------------------------------------------------------- | ------------------ | -------- |
| `OBJECT_STORAGE_ENDPOINT`       | S3-compatible endpoint URL                                        | —                  | Yes      |
| `OBJECT_STORAGE_REGION`         | Storage region                                                    | `us-east-1`        | No       |
| `OBJECT_STORAGE_BUCKET`         | Bucket for rendered reports                                       | `reporter-storage` | No       |
| `OBJECT_STORAGE_ACCESS_KEY_ID`  | Access key ID. Sensitive.                                         | —                  | Yes      |
| `OBJECT_STORAGE_SECRET_KEY`     | Secret access key. Sensitive.                                     | —                  | Yes      |
| `OBJECT_STORAGE_USE_PATH_STYLE` | Use path-style addressing (needed by some S3-compatible stores)   | `false`            | No       |
| `OBJECT_STORAGE_DISABLE_SSL`    | Disable TLS to the storage endpoint. Leave `false` in production. | `false`            | No       |

## Cache (Redis / Valkey)

| Variable            | Description                                                    | Default | Required |
| ------------------- | -------------------------------------------------------------- | ------- | -------- |
| `REDIS_HOST`        | Redis/Valkey host and port                                     | —       | Yes      |
| `REDIS_PASSWORD`    | Authentication password. Sensitive.                            | —       | No       |
| `REDIS_DB`          | Logical database index                                         | `0`     | No       |
| `REDIS_PROTOCOL`    | RESP protocol version                                          | varies  | No       |
| `REDIS_TLS`         | Enable TLS for the connection                                  | `false` | No       |
| `REDIS_CA_CERT`     | Base64-encoded PEM CA certificate for TLS                      | —       | No       |
| `REDIS_MASTER_NAME` | Sentinel master name (Sentinel deployments)                    | —       | No       |
| `REDIS_USE_GCP_IAM` | Authenticate to GCP Memorystore with IAM instead of a password | `false` | No       |

## PDF rendering (worker)

| Variable              | Description                             | Default | Required |
| --------------------- | --------------------------------------- | ------- | -------- |
| `PDF_POOL_WORKERS`    | Concurrent PDF render workers           | `2`     | No       |
| `PDF_TIMEOUT_SECONDS` | Per-report PDF render timeout (seconds) | `90`    | No       |

## Report datasources

Reports read from PostgreSQL and MongoDB datasources declared in the environment, one block per source. Replace `{NAME}` with your datasource identifier, and use the same identifier in every key of the block.

`DATASOURCE_{NAME}_CONFIG_NAME` is the variable that makes a block exist. Reporter discovers datasources by scanning the environment for keys that match `DATASOURCE_*_CONFIG_NAME` — the prefix counts as much as the suffix, so a key that only ends in `_CONFIG_NAME` declares nothing. Reporter reads the rest of a block only for a name it found that way. The value is the name your templates use to address the source.

Within a block, the variables marked required are the ones Reporter needs before it reads the block.

| Variable                        | Description                                                             | Default  | Required |
| ------------------------------- | ----------------------------------------------------------------------- | -------- | -------- |
| `DATASOURCE_{NAME}_CONFIG_NAME` | Name that templates use to address this datasource. Declares the block. | —        | Yes      |
| `DATASOURCE_{NAME}_TYPE`        | Datasource engine: `postgresql` or `mongodb`                            | —        | Yes      |
| `DATASOURCE_{NAME}_HOST`        | Datasource host                                                         | —        | Yes      |
| `DATASOURCE_{NAME}_PORT`        | Datasource port                                                         | —        | Yes      |
| `DATASOURCE_{NAME}_DATABASE`    | Database name                                                           | —        | Yes      |
| `DATASOURCE_{NAME}_USER`        | Datasource user                                                         | —        | No       |
| `DATASOURCE_{NAME}_PASSWORD`    | Datasource password. Sensitive.                                         | —        | No       |
| `DATASOURCE_{NAME}_SCHEMAS`     | Schemas to expose from the datasource (CSV)                             | `public` | No       |
| `DATASOURCE_{NAME}_SSLMODE`     | SSL mode for a PostgreSQL connection                                    | —        | No       |
| `DATASOURCE_{NAME}_SSLROOTCERT` | Path to the PostgreSQL SSL root certificate                             | —        | No       |
| `DATASOURCE_{NAME}_SSL`         | Enable TLS on a MongoDB connection                                      | —        | No       |
| `DATASOURCE_{NAME}_SSLCA`       | Path to the MongoDB CA certificate file                                 | —        | No       |
| `DATASOURCE_{NAME}_OPTIONS`     | Extra MongoDB URI options                                               | —        | No       |
| `CRYPTO_HASH_SECRET_KEY_CRM`    | Hashing key to read CRM datasource PII. Sensitive.                      | —        | No       |
| `CRYPTO_ENCRYPT_SECRET_KEY_CRM` | Encryption key to read CRM datasource PII. Sensitive.                   | —        | No       |

A complete block. We recommend that you set the `CONFIG_NAME` value to the same string as the `{NAME}` segment, as every example on this page does — one name across the environment and your templates:

```bash theme={null}
DATASOURCE_ONBOARDING_CONFIG_NAME=onboarding
DATASOURCE_ONBOARDING_TYPE=postgresql
DATASOURCE_ONBOARDING_HOST=midaz-postgres-replica
DATASOURCE_ONBOARDING_PORT=5702
DATASOURCE_ONBOARDING_DATABASE=onboarding
DATASOURCE_ONBOARDING_USER=reporter
DATASOURCE_ONBOARDING_PASSWORD=<secret>
DATASOURCE_ONBOARDING_SCHEMAS=public
```

A template then addresses that source by its config name, as in `{{ onboarding.accounts }}`. Datasources are declared only in the environment, so adding one is a configuration change and a restart.

## Shared configuration backbone

The following blocks are identical across Lerian products and are documented in full in the [BYOC configuration reference](/en/reference/byoc-configuration). They default off.

* **Access Manager authentication** — `PLUGIN_AUTH_ENABLED`, `PLUGIN_AUTH_ADDRESS`. Enable in production.
* **Multi-tenancy** — `MULTI_TENANT_*`, plus `RABBITMQ_MULTI_TENANT_SYNC_INTERVAL` and `RABBITMQ_MULTI_TENANT_DISCOVERY_TIMEOUT`. Off by default.
* **Service discovery** — `SD_*` (Consul; Reporter also accepts the legacy `SD_ADVERTISE_*` / `CONSUL_ADDR` aliases). Off by default.
* **Event streaming** — `STREAMING_ENABLED`, `STREAMING_BROKERS`, `STREAMING_CLOUDEVENTS_SOURCE`, plus `RABBITMQ_REPORT_EVENTS_EXCHANGE` for the events exchange. Off by default.
* **OpenTelemetry** — `ENABLE_TELEMETRY`, `OTEL_*`, `OTEL_INSECURE_EXPORTER`. Telemetry is OTLP push.