> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Config Sources

The Maverics Orchestrator loads its configuration from exactly one source at a time. The source is selected via an environment variable (or CLI flag for local file). Remote sources support hot-reload through ETag-based change detection when enabled.

<Note>
  **Console terminology:** In the Maverics Console, Orchestrator instances and
  configuration delivery are managed through **Deployments**. When working directly
  with configuration files, delivery is managed via the `-config` flag or
  `MAVERICS_CONFIG` environment variable.
</Note>

## How Config Sources Work

The Orchestrator selects its config source at startup using the following precedence:

1. **CLI flag** -- if `-config` is passed, the Orchestrator reads from the local filesystem at that path.
2. **Environment variable** -- if a config source environment variable is set (e.g., `MAVERICS_AWS_CONFIG`, `MAVERICS_GCP_CONFIG`), the Orchestrator fetches configuration from that remote location.
3. **Default** -- if no flag or environment variable is set, the Orchestrator reads from `/etc/maverics/maverics.yaml`.

Remote config sources deliver configuration as signed bundles (`maverics.tar.gz`). The Orchestrator downloads the bundle, verifies its signature using the public key specified by `MAVERICS_BUNDLE_PUBLIC_KEY_FILE`, and applies the configuration. The `MAVERICS_BUNDLE_PUBLIC_KEY_FILE` environment variable must be set when using a remote config source.

<Warning>
  Only one config source may be active at a time. If multiple config source environment variables are set, the Orchestrator will fail to start with a `multiple config providers defined` error. Ensure only one config source environment variable is set.
</Warning>

## Available Sources

| Source                                                                           | Environment Variable / Flag         | Use Case                                         |
| -------------------------------------------------------------------------------- | ----------------------------------- | ------------------------------------------------ |
| [File](/reference/orchestrator/configuration/config-sources/file)                | `MAVERICS_CONFIG` or `-config` flag | Local configuration file on disk                 |
| [Environment](/reference/orchestrator/configuration/config-sources/environment)  | N/A (substitution syntax)           | Override values via `{{ env.VAR }}` substitution |
| [Maverics Storage](/reference/orchestrator/configuration/config-sources/console) | Console Deployments                 | Managed config delivery from Maverics Storage    |
| [S3](/reference/orchestrator/configuration/config-sources/s3)                    | `MAVERICS_AWS_CONFIG`               | AWS S3 bucket                                    |
| [Azure Blob](/reference/orchestrator/configuration/config-sources/azure-blob)    | `MAVERICS_AZURE_CONFIG`             | Azure Blob Storage                               |
| [GCS](/reference/orchestrator/configuration/config-sources/gcs)                  | `MAVERICS_GCP_CONFIG`               | Google Cloud Storage                             |
| [GitHub](/reference/orchestrator/configuration/config-sources/github)            | `MAVERICS_GITHUB_CONFIG`            | GitHub repository                                |
| [GitLab](/reference/orchestrator/configuration/config-sources/gitlab)            | `MAVERICS_GITLAB_CONFIG`            | GitLab.com repository                            |

## ETag-Based Change Detection

Remote config sources (S3, Azure Blob, GCS, GitHub, GitLab) can periodically check for configuration changes using ETag headers. When a change is detected, the Orchestrator reloads the configuration automatically. Hot-reload is disabled by default -- enable it by setting the `MAVERICS_RELOAD_CONFIG` environment variable:

```bash theme={null}
export MAVERICS_RELOAD_CONFIG=true
export MAVERICS_POLLING_INTERVAL_SECONDS=30  # default is 30 seconds
```

<Warning>
  During a successful configuration reload, user sessions and tokens issued on
  behalf of resource owners are invalidated to ensure policy updates take effect
  immediately. Plan reload timing accordingly in production environments.
</Warning>

## Source Pages

<CardGroup cols={2}>
  <Card title="File" icon="file" href="/reference/orchestrator/configuration/config-sources/file">
    Load config from a local file via MAVERICS\_CONFIG or -config flag
  </Card>

  <Card title="Environment" icon="terminal" href="/reference/orchestrator/configuration/config-sources/environment">
    Substitute environment variables in config with \{\{ env.VAR }} syntax
  </Card>

  <Card title="Maverics Storage" icon="cloud" href="/reference/orchestrator/configuration/config-sources/console">
    Strata-managed config delivery for Console deployments
  </Card>

  <Card title="S3" icon="aws" href="/reference/orchestrator/configuration/config-sources/s3">
    Load config from an AWS S3 bucket via MAVERICS\_AWS\_CONFIG
  </Card>

  <Card title="Azure Blob" icon="microsoft" href="/reference/orchestrator/configuration/config-sources/azure-blob">
    Load config from Azure Blob Storage via MAVERICS\_AZURE\_CONFIG
  </Card>

  <Card title="GCS" icon="google" href="/reference/orchestrator/configuration/config-sources/gcs">
    Load config from Google Cloud Storage via MAVERICS\_GCP\_CONFIG
  </Card>

  <Card title="GitHub" icon="code-branch" href="/reference/orchestrator/configuration/config-sources/github">
    Load config from a GitHub repository via MAVERICS\_GITHUB\_CONFIG
  </Card>

  <Card title="GitLab" icon="code-branch" href="/reference/orchestrator/configuration/config-sources/gitlab">
    Load config from a GitLab.com repository via MAVERICS\_GITLAB\_CONFIG
  </Card>
</CardGroup>

## Related Pages

<CardGroup cols={2}>
  <Card title="Sessions" icon="code" href="/reference/orchestrator/sessions">
    Session configuration and storage options
  </Card>

  <Card title="Identity Fabric" icon="id-badge" href="/reference/orchestrator/identity-fabric">
    Identity provider integrations
  </Card>

  <Card title="Secret Providers" icon="vault" href="/reference/orchestrator/configuration/secret-providers">
    How the Orchestrator retrieves secrets at runtime
  </Card>

  <Card title="Configuration" icon="code" href="/reference/orchestrator/configuration">
    Complete configuration field reference
  </Card>
</CardGroup>