EQTY LabDocs

PDFGen Configuration

Chart values, environment variables, sizing, and startup validation for PDFGen.

View as Markdown

PDFGen is configured through the eqty-pdfgen values of the platform chart, and is enabled by default. This page describes the chart values operators set, the environment variables the service reads, how to size it, and the checks it runs at startup.

Required Configuration Areas

  • Network access to Auth Service, which signs every report. The chart points PDFGen at the in-cluster Auth Service.
  • A reachable RFC 3161 timestamp authority, or timestamping turned off.
  • CPU, memory, and ephemeral storage sized for the reports your projects export; see Sizing.
  • Governance Service pointed at PDFGen. With governance-service.config.pdfgenServiceUrl unset, the chart uses http://<release>-eqty-pdfgen:8080. Set it if you override the PDFGen chart’s nameOverride or fullnameOverride.

Chart Values

The platform chart sets the bind address, the working directories, and the font and package paths the image expects. <release> is your platform release name, such as guardian-platform.

yaml
eqty-pdfgen:
  enabled: true
  config:
    timestampUrl: "http://timestamp.digicert.com" # "" signs without a timestamp
    signingBound: false
  resources: {} # set CPU, memory, and ephemeral-storage; see Sizing
ValueDefaultNotes
enabledtrueWith PDFGen off, report exports fail.
replicaCount2Ignored when autoscaling.enabled is on.
config.signingUrlhttp://<release>-auth-service:8080/api/v1/protected/sign-pdfAuth Service’s PDF signing endpoint. Override only when Auth Service runs under another name.
config.signingBoundfalseBinds each signature to the certificate’s key version, so Auth Service refuses to sign once the key rotates. Without it, PDFGen catches the mismatch itself and fails the render. Needs an Auth Service that serves the certificate endpoint; with one that does not, every export fails.
config.timestampUrlhttp://timestamp.digicert.comThe RFC 3161 timestamp authority. Set it to "" to sign without a timestamp, for installs with no route to one.
config.tmpDirtmpEach render’s working directory. The chart mounts an emptyDir volume there, because the root filesystem is read-only.
config.typstFontPaths / config.typstPackageCachePaththe image’s pathsWhere the image keeps its fonts and template packages. Leave them as they are.
resourcesnoneSet CPU, memory, and ephemeral-storage; see Sizing.
autoscaling.enabledfalseScales between minReplicas and maxReplicas on CPU and memory use.
podDisruptionBudget.enabledtrueKeeps one pod available during node drains while replicaCount, or autoscaling.minReplicas with autoscaling on, is above 1. Otherwise any pod can be evicted.
networkPolicy.enabledfalseEnabled with no rules, the policy blocks all traffic. Allow ingress from Governance Service on port 8080, and egress to Auth Service, the timestamp authority, and DNS.
extraEnvVars[]Sets the environment variables the chart has no value for. extraEnvVarsSecret and extraEnvVarsConfigMap load them from a Secret or ConfigMap.

Environment Variables

The chart sets these variables from the values above:

VariableDefaultNotes
HOST / PORT127.0.0.1 / 8000From config.host and config.port, 0.0.0.0 and 8080. HOST must be an IP address.
PDFGEN_TMP_DIRthe system temp directoryFrom config.tmpDir.
EQTY_SIGNING_URLan EQTY Lab development environmentFrom config.signingUrl. Always set it outside the chart.
EQTY_SIGNING_BOUNDoffFrom config.signingBound. 1, true, yes, or on turns it on.
EQTY_TIMESTAMP_URLhttp://timestamp.digicert.comFrom config.timestampUrl.
TYPST_FONT_PATHSnoneFrom config.typstFontPaths. Colon-separated directories, searched recursively, ahead of typst’s built-in fonts. With none found, readiness fails.
TYPST_PACKAGE_CACHE_PATHtypst/packages in the OS cache directoryFrom config.typstPackageCachePath.

Set the rest through extraEnvVars. A variable listed there also overrides the chart’s value for it.

VariableDefaultNotes
PDFGEN_RENDER_CONCURRENCYthe CPUs the container may useRenders in flight at once, across the pod. Requests beyond it wait with their bodies unread.
PDFGEN_MAX_REQUEST_BYTES2147483648 (2 GiB)The largest manifest one request may send, attachments included. A larger one is rejected with 422.
PDFGEN_TYPST_TIMEOUT30Seconds a render’s layout may take before it is stopped and the request fails.
PDFGEN_IDLE_TIMEOUT30Seconds a client may take to send or read each 64 KiB. A slower upload gets 408; a slower download loses the connection.
PDFGEN_HTTP_TIMEOUT15Seconds for each call to Auth Service or the timestamp authority.
EQTY_TIMESTAMP_CA_FILEthe Mozilla root storeA PEM bundle of roots for a private timestamp authority. The chart has no value for mounting one.
LOG_LEVELINFODEBUG, INFO, WARNING, or ERROR; any other value means INFO. A valid RUST_LOG takes precedence.

Calls to Auth Service and the timestamp authority ignore proxy variables such as HTTPS_PROXY and NO_PROXY, and go direct. Where egress must go through a proxy, set config.timestampUrl to "".

WEB_CONCURRENCY, which earlier releases read, is ignored with a warning; use PDFGEN_RENDER_CONCURRENCY.

Sizing

Rendering is CPU-bound. PDFGEN_RENDER_CONCURRENCY follows the pod’s CPU limit, or the node’s CPUs without one, so give the pod the CPU it should render with and leave the variable unset. Set it lower only to bound memory. Add replicas, or turn on autoscaling, for more exports at once.

Memory grows with the number of statements in a report, and is used only while a render runs; an idle pod uses about 11 MiB. As a guide, an 800-statement report renders in about 0.7 GiB, above the 512 MiB limit Prerequisites suggests, so raise the limit for projects that large. Each render’s layout runs in its own process, which the kernel ends first when the pod runs out of memory, so that export fails rather than the service.

Attachments stream to the tmpDir volume as a request arrives, so they use disk, not memory. Each render in flight needs roughly the size of its attachments plus the finished bundle, freed once the response is sent. Size ephemeral-storage for PDFGEN_RENDER_CONCURRENCY of your largest reports.

Startup Validation

PDFGen exits at startup when:

  • HOST is not an IP address, or PORT is not a port number.
  • PDFGEN_RENDER_CONCURRENCY or PDFGEN_MAX_REQUEST_BYTES is not a positive integer, or a timeout is not a non-negative number of seconds.
  • EQTY_TIMESTAMP_CA_FILE cannot be read, or holds no usable certificates, while a timestamp URL is set.
  • The report template is missing.
  • The port is already in use or cannot be bound.

It does not check Auth Service, the signing URL, or the timestamp authority at startup; a problem with any of them shows only when a report is exported. Readiness checks the fonts and working directories; see PDFGen Operations.