> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Config Sources

The Maverics Orchestrator loads its configuration from exactly one source at a time. The source is selected via an environment variable (or CLI flag for local file). Remote sources support hot-reload through ETag-based change detection when enabled.

> [!NOTE]
>
> **Console terminology:** In the Maverics Console, Orchestrator instances and
> configuration delivery are managed through **Deployments**. When working directly
> with configuration files, delivery is managed via the `-config` flag or
> `MAVERICS_CONFIG` environment variable.

## How Config Sources Work

The Orchestrator selects its config source at startup using the following precedence:

1. **CLI flag** -- if `-config` is passed, the Orchestrator reads from the local filesystem at that path.
2. **Environment variable** -- if a config source environment variable is set (e.g., `MAVERICS_AWS_CONFIG`, `MAVERICS_GCP_CONFIG`), the Orchestrator fetches configuration from that remote location.
3. **Default** -- if no flag or environment variable is set, the Orchestrator reads from `/etc/maverics/maverics.yaml`.

Remote config sources deliver configuration as signed bundles (`maverics.tar.gz`). The Orchestrator downloads the bundle, verifies its signature using the public key specified by `MAVERICS_BUNDLE_PUBLIC_KEY_FILE`, and applies the configuration. The `MAVERICS_BUNDLE_PUBLIC_KEY_FILE` environment variable must be set when using a remote config source.

> [!WARNING]
>
> Only one config source may be active at a time. If multiple config source environment variables are set, the Orchestrator will fail to start with a `multiple config providers defined` error. Ensure only one config source environment variable is set.

## Available Sources

| Source | Environment Variable / Flag | Use Case |
| - | - | - |
| [File](/reference/orchestrator/configuration/config-sources/file) | `MAVERICS_CONFIG` or `-config` flag | Local configuration file on disk |
| [Environment](/reference/orchestrator/configuration/config-sources/environment) | N/A (substitution syntax) | Override values via `{{ env.VAR }}` substitution |
| [S3](/reference/orchestrator/configuration/config-sources/s3) | `MAVERICS_AWS_CONFIG` | AWS S3 bucket |
| [Azure Blob](/reference/orchestrator/configuration/config-sources/azure-blob) | `MAVERICS_AZURE_CONFIG` | Azure Blob Storage |
| [GCS](/reference/orchestrator/configuration/config-sources/gcs) | `MAVERICS_GCP_CONFIG` | Google Cloud Storage |
| [GitHub](/reference/orchestrator/configuration/config-sources/github) | `MAVERICS_GITHUB_CONFIG` | GitHub repository |
| [GitLab](/reference/orchestrator/configuration/config-sources/gitlab) | `MAVERICS_GITLAB_CONFIG` | GitLab.com repository |

## ETag-Based Change Detection

Remote config sources (S3, Azure Blob, GCS, GitHub, GitLab) can periodically check for configuration changes using ETag headers. When a change is detected, the Orchestrator reloads the configuration automatically. Hot-reload is disabled by default -- enable it by setting the `MAVERICS_RELOAD_CONFIG` environment variable:

```bash theme={null}
export MAVERICS_RELOAD_CONFIG=true
export MAVERICS_POLLING_INTERVAL_SECONDS=30  # default is 30 seconds
```

> [!WARNING]
>
> During a successful configuration reload, user sessions and tokens issued on
> behalf of resource owners are invalidated to ensure policy updates take effect
> immediately. Plan reload timing accordingly in production environments.

## Source Pages

> **[File](/reference/orchestrator/configuration/config-sources/file)**
>
> Load config from a local file via MAVERICS\_CONFIG or -config flag

> **[Environment](/reference/orchestrator/configuration/config-sources/environment)**
>
> Substitute environment variables in config with \{\{ env.VAR }} syntax

> **[S3](/reference/orchestrator/configuration/config-sources/s3)**
>
> Load config from an AWS S3 bucket via MAVERICS\_AWS\_CONFIG

> **[Azure Blob](/reference/orchestrator/configuration/config-sources/azure-blob)**
>
> Load config from Azure Blob Storage via MAVERICS\_AZURE\_CONFIG

> **[GCS](/reference/orchestrator/configuration/config-sources/gcs)**
>
> Load config from Google Cloud Storage via MAVERICS\_GCP\_CONFIG

> **[GitHub](/reference/orchestrator/configuration/config-sources/github)**
>
> Load config from a GitHub repository via MAVERICS\_GITHUB\_CONFIG

> **[GitLab](/reference/orchestrator/configuration/config-sources/gitlab)**
>
> Load config from a GitLab.com repository via MAVERICS\_GITLAB\_CONFIG

## Related Pages

> **[Sessions](/reference/orchestrator/sessions)**
>
> Session configuration and storage options

> **[Identity Fabric](/reference/orchestrator/identity-fabric)**
>
> Identity provider integrations

> **[Secret Providers](/reference/orchestrator/configuration/secret-providers)**
>
> How the Orchestrator retrieves secrets at runtime

> **[Configuration](/reference/orchestrator/configuration)**
>
> Complete configuration field reference