Neon Law
  • Fractional CTO
  • Litigation
  • Fractional GC
  • Legal Services
  • Sign in
← Operating Neon Law Navigator

Environment Matrix

Chapter 4 of 7 · Section 21 of 44

Sections

1. Intro

  • 1. Deploy your own
  • 2. Agenda

2. Prepare Google Cloud

  • 3. Bring your own project
  • 4. Dry-run first
  • 5. Private assets and domain restricted sharing
  • 6. The one project that is public on purpose
  • 7. The Navigator deployment matrix
  • 8. The `/app` mount and HTTP route ownership
  • 9. `neon` — the whole brand seam
  • 10. Live rollout checkpoint
  • 11. Set one site to one version

3. Provision the Infrastructure

  • 12. The APIs that light up
  • 13. Network and five buckets
  • 14. How a Project portal reaches a client
  • 15. One matter's document never backs another matter's
  • 16. A private image registry
  • 17. The cluster comes up

4. Environment Matrix

  • 18. Three operating modes, two deployment profiles
  • 19. Configuration precedence: the first source wins
  • 20. Local dev controls: inputs read by `navigator dev`
  • 21. Local runtime: what `.devx/env` generates
  • 22. The store: SurrealDB
  • 23. Where SurrealDB authorization lives
  • 24. Deployed runtime: core web and worker wiring
  • 25. Deployed runtime: identity and access
  • 26. Deployed runtime: email, signatures, and billing
  • 27. Deployed runtime: repositories, content, AI, and scheduled work
  • 28. Provision and ship: variables read by the operator CLI
  • 29. Ancillary operations and opt-in test controls
  • 30. When simulated data appears

5. Configure the Trust Boundaries

  • 31. Secrets: the invariants that gate the boot
  • 32. Sign-in: bring an OIDC provider; passwords live there, not here
  • 33. Role rings: who can do what
  • 34. Provider signup and parity across the deployments
  • 35. The external surface — every third party, in one place
  • 36. The two service deployments
  • 37. Security architecture

6. Ship the Instance

  • 38. Ship and verify
  • 39. Post the verified handoff in `#navigator`
  • 40. Point your domain at the instance (optional)
  • 41. Drive it from the CLI
  • 42. Make it yours — white-label under your own brand
  • 43. This is how we set up Neon Law Foundation

7. Wrap Up

  • 44. Canonical references

Local runtime: what .devx/env generates

ConcernGenerated environment variables
Profile and listenerPORT, NAVIGATOR_ENVIRONMENT, NAVIGATOR_CI_HARNESS
Repository writerNAVIGATOR_GIT_REPO_ROOT
StoreNAVIGATOR_SURREAL_ENDPOINT, NAVIGATOR_SURREAL_NAMESPACE, NAVIGATOR_SURREAL_DATABASE
Store credentialsNAVIGATOR_SURREAL_USER, NAVIGATOR_SURREAL_PASSWORD
Storage driverNAVIGATOR_STORAGE_BACKEND, NAVIGATOR_STORAGE_ENDPOINT
Storage bucketsNAVIGATOR_STORAGE_BUCKET, NAVIGATOR_ASSETS_BUCKET, NAVIGATOR_LFS_BUCKET
Applications bucketNAVIGATOR_APPLICATIONS_BUCKET
Archive bucketsNAVIGATOR_ICEBERG_BUCKET, NAVIGATOR_TELEMETRY_BUCKET
Storage regionNAVIGATOR_STORAGE_REGION
Documents credentialsNAVIGATOR_STORAGE_ACCESS_KEY, NAVIGATOR_STORAGE_SECRET_KEY
Assets credentialsNAVIGATOR_ASSETS_ACCESS_KEY, NAVIGATOR_ASSETS_SECRET_KEY
Applications credentialsNAVIGATOR_APPLICATIONS_ACCESS_KEY, NAVIGATOR_APPLICATIONS_SECRET_KEY
LFS credentialsNAVIGATOR_LFS_ACCESS_KEY, NAVIGATOR_LFS_SECRET_KEY
Browser OIDCOAUTH_ISSUER_URL, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_REDIRECT_URI, SESSION_SECRET
Policy and workflowsRESTATE_BROKER_URL
Attachment scannerNAVIGATOR_CLAMD_ADDR
Harness-only integration placeholdersSENDGRID_API_KEY, SENDGRID_INBOUND_SECRET
Harness sink URLSENDGRID_BASE_URL, NAVIGATOR_SENDGRID_HARNESS_SECRET
Telemetry endpoint and UIOTEL_EXPORTER_OTLP_ENDPOINT, NAVIGATOR_OPENOBSERVE_URL
Telemetry credentialsNAVIGATOR_OPENOBSERVE_USERNAME, NAVIGATOR_OPENOBSERVE_PASSWORD
Telemetry routingNAVIGATOR_OPENOBSERVE_ORGANIZATION, NAVIGATOR_OPENOBSERVE_STREAM

Presenter notes

Do not edit .devx/env; the next navigator dev up overwrites it. The file is a connection descriptor for the host-side web, not a secret store. In the default loop the host web and in-cluster worker share the navigator database. A worktree environment can use another database and port, but Restate-backed flows require the worker and web database coordinates to agree; navigator dev worktree-env status reports a mismatch.

View all slidesOpen display
← PreviousNext →
Neon Law
BlogContactFoundationNavigatorPresentationsWorkshops
Contact us — contact@neonlaw.com+1 510 800 2080
  • Nevada
    5150 Mae Anne AveSte 405-9002Reno, NV 89523
  • New York
    12 E 49th St18th FloorNew York, NY 10017
  • Washington
    720 Seneca StSte 107-715Seattle, WA 98101

© 2026 Shook Law PLLC and Neon Law Foundation

This is attorney advertisement. Nothing on this site is legal advice. Neon Law is the trade name of Shook Law PLLC, and an attorney-client relationship begins only with a signed retainer between you and Shook Law PLLC. Published flat fees cover the scope each one names and do not include third-party filing fees. Every legal matter is different, and past results do not guarantee a similar result.

Shook Law PLLC is a proud supporter of the Neon Law Foundation , a 501(c)(3) nonprofit.

Neon Law Foundation is a Nevada nonprofit corporation and a 501(c)(3) tax-exempt organization. It does not practice law and cannot represent you.

Nothing on this site is legal advice, and nothing here creates an attorney-client relationship.

5150 Mae Anne Ave Ste 405-9999, Reno, NV 89523
support@neonlaw.orgTransparency & public disclosures

Powered by Neon Law Navigator #26.8.20-hotfix.4

Open source — neon-law-foundation/navigator GitHub stars 2