--- title: "PDFGen Configuration" description: "Chart values, environment variables, sizing, and startup validation for PDFGen." source: "Guardian Platform" --- PDFGen is configured through the `eqty-pdfgen` values of the platform chart, and is enabled by default. This page describes the chart values operators set, the environment variables the service reads, how to size it, and the checks it runs at startup. ## Required Configuration Areas - Network access to Auth Service, which signs every report. The chart points PDFGen at the in-cluster Auth Service. - A reachable RFC 3161 timestamp authority, or timestamping turned off. - CPU, memory, and ephemeral storage sized for the reports your projects export; see [Sizing](#sizing). - Governance Service pointed at PDFGen. With `governance-service.config.pdfgenServiceUrl` unset, the chart uses `http://-eqty-pdfgen:8080`. Set it if you override the PDFGen chart's `nameOverride` or `fullnameOverride`. ## Chart Values The platform chart sets the bind address, the working directories, and the font and package paths the image expects. `` is your platform release name, such as `guardian-platform`. ```yaml title="values.yaml" eqty-pdfgen: enabled: true config: timestampUrl: "http://timestamp.digicert.com" # "" signs without a timestamp signingBound: false resources: {} # set CPU, memory, and ephemeral-storage; see Sizing ``` | Value | Default | Notes | | -------------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `enabled` | `true` | With PDFGen off, report exports fail. | | `replicaCount` | `2` | Ignored when `autoscaling.enabled` is on. | | `config.signingUrl` | `http://-auth-service:8080/api/v1/protected/sign-pdf` | Auth Service's PDF signing endpoint. Override only when Auth Service runs under another name. | | `config.signingBound` | `false` | Binds each signature to the certificate's key version, so Auth Service refuses to sign once the key rotates. Without it, PDFGen catches the mismatch itself and fails the render. Needs an Auth Service that serves the certificate endpoint; with one that does not, every export fails. | | `config.timestampUrl` | `http://timestamp.digicert.com` | The RFC 3161 timestamp authority. Set it to `""` to sign without a timestamp, for installs with no route to one. | | `config.tmpDir` | `tmp` | Each render's working directory. The chart mounts an `emptyDir` volume there, because the root filesystem is read-only. | | `config.typstFontPaths` / `config.typstPackageCachePath` | the image's paths | Where the image keeps its fonts and template packages. Leave them as they are. | | `resources` | none | Set CPU, memory, and `ephemeral-storage`; see [Sizing](#sizing). | | `autoscaling.enabled` | `false` | Scales between `minReplicas` and `maxReplicas` on CPU and memory use. | | `podDisruptionBudget.enabled` | `true` | Keeps one pod available during node drains while `replicaCount`, or `autoscaling.minReplicas` with autoscaling on, is above 1. Otherwise any pod can be evicted. | | `networkPolicy.enabled` | `false` | Enabled with no rules, the policy blocks all traffic. Allow ingress from Governance Service on port `8080`, and egress to Auth Service, the timestamp authority, and DNS. | | `extraEnvVars` | `[]` | Sets the environment variables the chart has no value for. `extraEnvVarsSecret` and `extraEnvVarsConfigMap` load them from a Secret or ConfigMap. | ## Environment Variables The chart sets these variables from the values above: | Variable | Default | Notes | | -------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `HOST` / `PORT` | `127.0.0.1` / `8000` | From `config.host` and `config.port`, `0.0.0.0` and `8080`. `HOST` must be an IP address. | | `PDFGEN_TMP_DIR` | the system temp directory | From `config.tmpDir`. | | `EQTY_SIGNING_URL` | an EQTY Lab development environment | From `config.signingUrl`. Always set it outside the chart. | | `EQTY_SIGNING_BOUND` | off | From `config.signingBound`. `1`, `true`, `yes`, or `on` turns it on. | | `EQTY_TIMESTAMP_URL` | `http://timestamp.digicert.com` | From `config.timestampUrl`. | | `TYPST_FONT_PATHS` | none | From `config.typstFontPaths`. Colon-separated directories, searched recursively, ahead of typst's built-in fonts. With none found, readiness fails. | | `TYPST_PACKAGE_CACHE_PATH` | `typst/packages` in the OS cache directory | From `config.typstPackageCachePath`. | Set the rest through `extraEnvVars`. A variable listed there also overrides the chart's value for it. | Variable | Default | Notes | | --------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------- | | `PDFGEN_RENDER_CONCURRENCY` | the CPUs the container may use | Renders in flight at once, across the pod. Requests beyond it wait with their bodies unread. | | `PDFGEN_MAX_REQUEST_BYTES` | `2147483648` (2 GiB) | The largest manifest one request may send, attachments included. A larger one is rejected with `422`. | | `PDFGEN_TYPST_TIMEOUT` | `30` | Seconds a render's layout may take before it is stopped and the request fails. | | `PDFGEN_IDLE_TIMEOUT` | `30` | Seconds a client may take to send or read each 64 KiB. A slower upload gets `408`; a slower download loses the connection. | | `PDFGEN_HTTP_TIMEOUT` | `15` | Seconds for each call to Auth Service or the timestamp authority. | | `EQTY_TIMESTAMP_CA_FILE` | the Mozilla root store | A PEM bundle of roots for a private timestamp authority. The chart has no value for mounting one. | | `LOG_LEVEL` | `INFO` | `DEBUG`, `INFO`, `WARNING`, or `ERROR`; any other value means `INFO`. A valid `RUST_LOG` takes precedence. | Calls to Auth Service and the timestamp authority ignore proxy variables such as `HTTPS_PROXY` and `NO_PROXY`, and go direct. Where egress must go through a proxy, set `config.timestampUrl` to `""`. `WEB_CONCURRENCY`, which earlier releases read, is ignored with a warning; use `PDFGEN_RENDER_CONCURRENCY`. ## Sizing Rendering is CPU-bound. `PDFGEN_RENDER_CONCURRENCY` follows the pod's CPU limit, or the node's CPUs without one, so give the pod the CPU it should render with and leave the variable unset. Set it lower only to bound memory. Add replicas, or turn on autoscaling, for more exports at once. Memory grows with the number of statements in a report, and is used only while a render runs; an idle pod uses about 11 MiB. As a guide, an 800-statement report renders in about 0.7 GiB, above the 512 MiB limit [Prerequisites](../deployment/prerequisites.mdx#cluster-capacity) suggests, so raise the limit for projects that large. Each render's layout runs in its own process, which the kernel ends first when the pod runs out of memory, so that export fails rather than the service. Attachments stream to the `tmpDir` volume as a request arrives, so they use disk, not memory. Each render in flight needs roughly the size of its attachments plus the finished bundle, freed once the response is sent. Size `ephemeral-storage` for `PDFGEN_RENDER_CONCURRENCY` of your largest reports. ## Startup Validation PDFGen exits at startup when: - `HOST` is not an IP address, or `PORT` is not a port number. - `PDFGEN_RENDER_CONCURRENCY` or `PDFGEN_MAX_REQUEST_BYTES` is not a positive integer, or a timeout is not a non-negative number of seconds. - `EQTY_TIMESTAMP_CA_FILE` cannot be read, or holds no usable certificates, while a timestamp URL is set. - The report template is missing. - The port is already in use or cannot be bound. It does not check Auth Service, the signing URL, or the timestamp authority at startup; a problem with any of them shows only when a report is exported. Readiness checks the fonts and working directories; see [PDFGen Operations](./operations.mdx#health-checks). ## Related - [PDFGen Overview](./overview.mdx) — what PDFGen owns and depends on - [PDFGen Operations](./operations.mdx) — health checks and symptom checks for these settings - [Chart Values](../deployment/chart-values.mdx#other-settings) — where the `eqty-pdfgen` values sit in the platform chart - [Governance Service Configuration](../governance-service/configuration.mdx) — the `PDFGEN_SERVICE_URL` Governance Service calls PDFGen at - [Prerequisites](../deployment/prerequisites.mdx#cluster-capacity) — cluster capacity for every platform component