These are the process-level coordinates shared by Kubernetes manifests and non-Kubernetes installs. Production requires
GCS and rejects NAVIGATOR_STORAGE_ENDPOINT; the dev profile may use disposable storage, while every hosted
deployment's GCS also rejects an emulator endpoint. SESSION_SECRET must contain at least 32 bytes. The worker reads
the same database, document bucket, email backend, branding bundle, and deployment profile as web so a journaled step
never crosses environments. Published images bake the release identity in; local source builds leave it unknown.
The Neon Law-controlled Workspace service account has domain-wide delegation. Keep its shared Drive coordinate and
credential together: NAVIGATOR_DRIVE_NEON_LAW_PROJECTS_DRIVE_ID, NAVIGATOR_DRIVE_NEON_LAW_DELEGATED_USER, and
NAVIGATOR_DRIVE_NEON_LAW_SERVICE_ACCOUNT_JSON. The two Projects-root variables are
NAVIGATOR_DRIVE_NEON_LAW_PRODUCTION_PROJECTS_ROOT_FOLDER_ID and
NAVIGATOR_DRIVE_NEON_LAW_STAGING_PROJECTS_ROOT_FOLDER_ID; configure each only in the approved operator-managed
environment that uses that root.
The typed workspace map selects a distinct Projects root for each configured deployment. An unknown deployment fails
closed rather than borrowing another root. Drive ingest is optional: configure the shared Drive ID, delegated user, and
service-account JSON together with the matching Projects-root ID, or omit the set. The regional GCP command enables the
Drive and Admin SDK APIs, but a Workspace administrator must still grant domain-wide delegation and create the selected
Drive root.
For each deployment, setup creates the identity named by NAVIGATOR_DRIVE_GCP_SERVICE_ACCOUNT_ID with no runtime GCP
roles. Complete the global Workspace attachment once:
-
Read that service account's OAuth client ID:
gcloud iam service-accounts describe \
"$NAVIGATOR_DRIVE_GCP_SERVICE_ACCOUNT_ID@$NAVIGATOR_GCP_PROJECT_ID.iam.gserviceaccount.com" \
--project "$NAVIGATOR_GCP_PROJECT_ID" --format 'value(oauth2ClientId)'
-
In the selected Workspace Admin console, authorize that client ID for https://www.googleapis.com/auth/drive. Do not
grant a broader Admin SDK scope merely because the API is enabled.
-
Create that deployment's otherwise-empty Projects shared drive and record its ID. Staging creates its own drive,
separate from production's.
-
Create one JSON key for the dedicated Drive account and place the complete JSON value directly into the selected
deployment's secrets.enc.yaml under the *_SERVICE_ACCOUNT_JSON key (sops set — never an editor buffer for a key
this size). Never paste it into Slack, a ticket, shell history, or this repository in plaintext; revoke the key
immediately after its encrypted replacement is proven during rotation.
-
Set the selected *_PROJECTS_DRIVE_ID and *_DELEGATED_USER coordinates in the same deployment's config.toml, run
navigator ops secrets apply --deployment "$ROW" --deployments-dir "$NAVIGATOR_DEPLOYMENTS_DIR", and verify the key
names with its --dry-run plan — see docs/deployment-secrets.md.