These are the process-level coordinates shared by Kubernetes manifests and non-Kubernetes installs. Production requires
GCS and rejects NAVIGATOR_STORAGE_ENDPOINT; the dev profile may use disposable storage, while every hosted
deployment's GCS also rejects an emulator endpoint. SESSION_SECRET must contain at least 32 bytes. The worker reads
the same database, document bucket, email backend, branding bundle, and deployment profile as web so a journaled step
never crosses environments. Published images bake the release identity in; local source builds leave it unknown.
The Neon Law-controlled Workspace service account has domain-wide delegation. Keep its shared Drive coordinate and
credential together: NAVIGATOR_DRIVE_NEON_LAW_PROJECTS_DRIVE_ID, NAVIGATOR_DRIVE_NEON_LAW_DELEGATED_USER, and
NAVIGATOR_DRIVE_NEON_LAW_SERVICE_ACCOUNT_JSON.
The typed workspace map selects one root by deployment: neon-law-stg uses
NAVIGATOR_DRIVE_NEON_LAW_STAGING_PROJECTS_ROOT_FOLDER_ID, neon-law-prod uses
NAVIGATOR_DRIVE_NEON_LAW_PRODUCTION_PROJECTS_ROOT_FOLDER_ID, and neon-law-prod uses
NAVIGATOR_DRIVE_NEON_LAW_NLF_PROJECTS_ROOT_FOLDER_ID. Each root is distinct; an unknown deployment fails closed rather
than borrowing another root. NAVIGATOR_PROJECTS_DRIVE_MOUNT is an optional machine-local override, never a deployed
credential. The regional GCP command enables the Drive and Admin SDK APIs, but a Workspace administrator must still
grant domain-wide delegation and create the selected Drive root.
For each deployment, setup creates the identity named by NAVIGATOR_DRIVE_GCP_SERVICE_ACCOUNT_ID with no runtime GCP
roles. Complete the global Workspace attachment once:
-
Read that service account's OAuth client ID:
gcloud iam service-accounts describe \
"$NAVIGATOR_DRIVE_GCP_SERVICE_ACCOUNT_ID@$NAVIGATOR_GCP_PROJECT_ID.iam.gserviceaccount.com" \
--project "$NAVIGATOR_GCP_PROJECT_ID" --format 'value(oauth2ClientId)'
-
In the selected Workspace Admin console, authorize that client ID for https://www.googleapis.com/auth/drive. Do not
grant a broader Admin SDK scope merely because the API is enabled.
-
Create that deployment's otherwise-empty Projects shared drive and record its ID. Staging creates its own drive,
separate from production's.
-
Create one JSON key for the dedicated Drive account and place the complete JSON value directly into the selected
deployment's secrets.enc.yaml under the *_SERVICE_ACCOUNT_JSON key (sops set — never an editor buffer for a key
this size). Never paste it into Slack, a ticket, shell history, or this repository in plaintext; revoke the key
immediately after its encrypted replacement is proven during rotation.
-
Set the selected *_PROJECTS_DRIVE_ID and *_DELEGATED_USER coordinates in the same deployment's config.toml, run
navigator ops secrets apply --deployment <name>, and verify the key names with its --dry-run plan — see
docs/deployment-secrets.md.