Neon Law
  • Fractional CTO
  • Litigation
  • Fractional GC
  • Legal Services
  • Sign in
← Operating Neon Law Navigator

Environment Matrix

Chapter 4 of 7 · Section 20 of 44

Sections

1. Intro

  • 1. Deploy your own
  • 2. Agenda

2. Prepare Google Cloud

  • 3. Bring your own project
  • 4. Dry-run first
  • 5. Private assets and domain restricted sharing
  • 6. The one project that is public on purpose
  • 7. The Navigator deployment matrix
  • 8. The `/app` mount and HTTP route ownership
  • 9. `neon` — the whole brand seam
  • 10. Live rollout checkpoint
  • 11. Set one site to one version

3. Provision the Infrastructure

  • 12. The APIs that light up
  • 13. Network and five buckets
  • 14. How a Project portal reaches a client
  • 15. One matter's document never backs another matter's
  • 16. A private image registry
  • 17. The cluster comes up

4. Environment Matrix

  • 18. Three operating modes, two deployment profiles
  • 19. Configuration precedence: the first source wins
  • 20. Local dev controls: inputs read by `navigator dev`
  • 21. Local runtime: what `.devx/env` generates
  • 22. The store: SurrealDB
  • 23. Where SurrealDB authorization lives
  • 24. Deployed runtime: core web and worker wiring
  • 25. Deployed runtime: identity and access
  • 26. Deployed runtime: email, signatures, and billing
  • 27. Deployed runtime: repositories, content, AI, and scheduled work
  • 28. Provision and ship: variables read by the operator CLI
  • 29. Ancillary operations and opt-in test controls
  • 30. When simulated data appears

5. Configure the Trust Boundaries

  • 31. Secrets: the invariants that gate the boot
  • 32. Sign-in: bring an OIDC provider; passwords live there, not here
  • 33. Role rings: who can do what
  • 34. Provider signup and parity across the deployments
  • 35. The external surface — every third party, in one place
  • 36. The two service deployments
  • 37. Security architecture

6. Ship the Instance

  • 38. Ship and verify
  • 39. Post the verified handoff in `#navigator`
  • 40. Point your domain at the instance (optional)
  • 41. Drive it from the CLI
  • 42. Make it yours — white-label under your own brand
  • 43. This is how we set up Neon Law Foundation

7. Wrap Up

  • 44. Canonical references

Local dev controls: inputs read by navigator dev

ConcernEnvironment variablesDefaults / effect
TopologyNAVIGATOR_KIND_CLUSTER, NAVIGATOR_K8S_NAMESPACEnavigator, navigator
Dependency overlayNAVIGATOR_KIND_DEPS_OVERLAYdeps-only KIND
Full KIND overlayNAVIGATOR_KIND_OVERLAYfull KIND
GKE overlayNAVIGATOR_GKE_OVERLAYexample GKE manifests
Private mode gatewayNAVIGATOR_PRIVATE_MODEoff; on puts Pingora network + basic auth before web
Second store portNAVIGATOR_KIND_SURREAL_PORT18000
Restate portsNAVIGATOR_KIND_RESTATE_INGRESS_PORT, NAVIGATOR_KIND_RESTATE_ADMIN_PORT9080, 9070
Identity portNAVIGATOR_KIND_RAUTHY_PORT30080
Storage portNAVIGATOR_KIND_GARAGE_S3_PORT30900
Web portNAVIGATOR_KIND_WEB_PORT3001
ObservabilityNAVIGATOR_KIND_OPENOBSERVE_PORT, NAVIGATOR_KIND_OPENOBSERVE_OTLP_PORT5080, 5081
Documents keyNAVIGATOR_GARAGE_ACCESS_KEYdeterministic KIND-only default
Documents secretNAVIGATOR_GARAGE_SECRET_KEYdeterministic KIND-only default
Assets keyNAVIGATOR_GARAGE_ASSETS_ACCESS_KEYdeterministic KIND-only default
Assets secretNAVIGATOR_GARAGE_ASSETS_SECRET_KEYdeterministic KIND-only default
Applications keyNAVIGATOR_GARAGE_APPLICATIONS_ACCESS_KEYdeterministic KIND-only default
Applications secretNAVIGATOR_GARAGE_APPLICATIONS_SECRET_KEYdeterministic KIND-only default
LFS keyNAVIGATOR_GARAGE_LFS_ACCESS_KEYdeterministic KIND-only default
LFS secretNAVIGATOR_GARAGE_LFS_SECRET_KEYdeterministic KIND-only default
Published demo imageNAVIGATOR_IMAGE_TAGlatest dated YY.M.D tag when dev deploy pulls images

Presenter notes

These variables configure the CLI that creates or reconnects the local KIND fixture. They are inputs to orchestration, not the application runtime. Every one is optional; unset or empty values use the defaults shown. Invalid local port values also fall back to their defaults. The Garage values are development credentials, written into the generated runtime environment and the KIND secrets; they are never suitable for a public deployment.

View all slidesOpen display
← PreviousNext →
Neon Law
BlogContactFoundationNavigatorPresentationsWorkshops
Contact us — contact@neonlaw.com+1 510 800 2080
  • Nevada
    5150 Mae Anne AveSte 405-9002Reno, NV 89523
  • New York
    12 E 49th St18th FloorNew York, NY 10017
  • Washington
    720 Seneca StSte 107-715Seattle, WA 98101

© 2026 Shook Law PLLC and Neon Law Foundation

This is attorney advertisement. Nothing on this site is legal advice. Neon Law is the trade name of Shook Law PLLC, and an attorney-client relationship begins only with a signed retainer between you and Shook Law PLLC. Published flat fees cover the scope each one names and do not include third-party filing fees. Every legal matter is different, and past results do not guarantee a similar result.

Shook Law PLLC is a proud supporter of the Neon Law Foundation , a 501(c)(3) nonprofit.

Neon Law Foundation is a Nevada nonprofit corporation and a 501(c)(3) tax-exempt organization. It does not practice law and cannot represent you.

Nothing on this site is legal advice, and nothing here creates an attorney-client relationship.

5150 Mae Anne Ave Ste 405-9999, Reno, NV 89523
support@neonlaw.orgTransparency & public disclosures

Powered by Neon Law Navigator #26.8.20-hotfix.4

Open source — neon-law-foundation/navigator GitHub stars 2