--- title: "Governance Service Configuration" description: "Customer-facing configuration categories for Governance Service." source: "Guardian Platform" --- Governance Service configuration is managed through the deployment chart and customer environment values. This page describes the configuration areas operators should understand before release, and the environment variables the service reads, including a few the chart does not set. ## Required Configuration Areas - Auth Service connection for identity and authorization checks. - Platform database connection for durable governance records. - Object storage provider for attachments. - Integrity Service connection for signed governance records. Creating projects, creating or applying policies, submitting declarations, reviews, and attachments, exporting reports, and issuing credentials all fail without it. - PDFGen connection for downloadable reports, `PDFGEN_SERVICE_URL`. PDFGen's own settings are in [PDFGen Configuration](../pdfgen/configuration.mdx). ## Object Storage Supported attachment storage providers are Azure Blob Storage, Google Cloud Storage, AWS S3, and a mock provider for local or non-production use. Use production-grade object storage for customer environments. Confirm bucket or container access before enabling attachment-heavy workflows. ## Identity Provider Alignment Governance Service does not replace Auth Service. It must be configured to trust the Auth Service deployment that owns users, roles, API keys, and service accounts. ## Environment Variables The main variables Governance Service reads, by category: | Category | Variable | Default | | -------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | Server | `PORT` | `10001` | | Server | `ENVIRONMENT` | `local` | | Server | `SERVICE_VERSION` | `dev`; the chart sets its version | | Server | `SERVER_READ_TIMEOUT_SECONDS` | `30` | | Server | `SERVER_WRITE_TIMEOUT_SECONDS` | `30` | | Server | `SERVER_IDLE_TIMEOUT_SECONDS` | `120` | | Server | `SWAGGER_ENABLED` | `true` | | Database | `DB_HOST` / `DB_USER` / `DB_NAME` | none, required | | Database | `DB_PASSWORD` | none | | Database | `DB_PORT` | none | | Database | `DB_SSLMODE` | `disable` | | Database | `MIGRATIONS_RUN_AT_STARTUP` | `false`; the chart sets `true` | | Database | `MIGRATIONS_PATH` | `migrations`; the chart sets `/app/migrations` | | Auth Service | `AUTH_SERVICE_URL` | `http://localhost:8080` | | Auth Service | `AUTH_SERVICE_API_KEY` | none | | Auth Service | `AUTH_CACHE_TTL` | `30s` | | Auth Service | `AUTH_CACHE_SIZE` | `10000` | | Auth Service | `AUTH_CLIENT_TIMEOUT` | `10s` | | Identity | `AUTH0_DOMAIN` / `AUTH0_CLIENT_ID` / `AUTH0_CLIENT_SECRET` | none | | Identity | `AUTH0_SYNC_AT_STARTUP` | `false`; the chart sets `true` | | Identity | `AUTH0_SYNC_PAGE_SIZE` | `50` | | Identity | `KEYCLOAK_URL` / `KEYCLOAK_REALM` / `KEYCLOAK_CLIENT_ID` / `KEYCLOAK_CLIENT_SECRET` | none | | Identity | `ENTRA_TENANT_ID` / `ENTRA_CLIENT_ID` / `ENTRA_CLIENT_SECRET` | none | | Integrations | `INTEGRITY_SERVICE_URL` | `http://localhost/integrityService` | | Integrations | `PDFGEN_SERVICE_URL` | `http://localhost:8000` | | Integrations | `CONTROL_PLANE_URL` | none; the chart sets it from `config.controlPlaneUrl`, empty by default | | Object storage | `STORAGE_PROVIDER` | detected, else `mock` | | Object storage | `AZURE_STORAGE_ACCOUNT_NAME` / `AZURE_STORAGE_CONTAINER_NAME` | none | | Object storage | `AZURE_STORAGE_ACCOUNT_KEY` / `AZURE_STORAGE_CONNECTION_STRING` | none | | Object storage | `AZURE_USE_MANAGED_IDENTITY` | `false` | | Object storage | `GCS_BUCKET_NAME` | none | | Object storage | `GCS_CREDENTIALS_FILE` / `GCS_CREDENTIALS_JSON` | Application Default Credentials | | Object storage | `AWS_S3_BUCKET_NAME` / `AWS_REGION` | none | | Object storage | `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` | the default AWS credential chain | | Idempotency | `IDEMPOTENCY_TTL_HOURS` | `24` | | Idempotency | `IDEMPOTENCY_CLEANUP_INTERVAL_MINUTES` | `60` | | Logging | `LOG_LEVEL` | `info` | | Logging | `LOG_FORMAT` | text when `ENVIRONMENT` is `local`, otherwise JSON; the chart sets `json` | | Logging | `LOGGER_SKIP_PATHS` | `/health` | `STORAGE_PROVIDER` accepts `azure_blob`, `gcs`, `aws_s3`, or `mock`. When it is unset, the service picks `gcs` if `GCS_BUCKET_NAME` is set, then `azure_blob` if `AZURE_STORAGE_ACCOUNT_NAME` is set, then `aws_s3` if `AWS_S3_BUCKET_NAME` is set, and `mock` otherwise. Azure Blob Storage needs a connection string, an account key, or `AZURE_USE_MANAGED_IDENTITY=true`; startup fails without one. Without `AUTH_SERVICE_API_KEY`, Governance Service cannot get the governance worker's service-account token from Auth Service. Indicator-generated declarations fail, and so does most of an agent assessment: pinning configurations, registering declaration files, reviewing controls, issuing agent certifications, and a reviewer revoking a certification they authorized. Without `CONTROL_PLANE_URL`, agent assessments cannot reach the agent registry, so starting an assessment fails, no agent certification can be issued, and certifications are never attached to or refreshed in the gateway. The chart sets it only when `config.controlPlaneUrl` is set, so with the Gateway Stack set that value to the Control Plane's in-cluster URL; see [Agent Certification](../deployment/chart-values.mdx#agent-certification). The chart does not set `AUTH_CACHE_TTL`, `AUTH_CACHE_SIZE`, `AUTH_CLIENT_TIMEOUT`, `IDEMPOTENCY_TTL_HOURS`, `IDEMPOTENCY_CLEANUP_INTERVAL_MINUTES`, or `GCS_CREDENTIALS_JSON`, so a chart deployment uses their defaults. ## Operational Settings Operators should confirm health checks, readiness behavior, idempotency settings, database migration behavior, and upgrade notes before release. Keep customer-specific secrets out of product documentation and store them in the deployment's secret management system. ## Related - [Governance Service Operations](./operations.mdx) — readiness checks for each configured dependency - [Chart Values](../deployment/chart-values.mdx) — where these settings live in values.yaml and secrets.yaml - [Object Storage](../deployment/object-storage.mdx) — setup guides for each attachment storage provider - [Auth Service Configuration](../auth-service/configuration.mdx) — the Auth Service settings this service must trust - [Integrity Service Operations](../integrity-service/operations.mdx) — what the Integrity Service connection needs on the other side - [Control Plane Configuration](../control-plane/configuration.mdx) — the service `CONTROL_PLANE_URL` points at