gdsgate

gdsgate is an access gateway for catalogued resources. Authority owns the trust, identity, policy, and audit decisions. Proxy is the client-facing data path. Connector runs beside protected resources and dials out to Proxy.

The Quickstart is the primary path for an evaluator. It defines one disposable split lab and shows the evidence needed to call an allowed database request successful. There is no public download. The reader either installs an on-premise deployment or receives the Linux client and the version-matched lab bundle from the administrator of a deployment to which the reader has already been granted access.

What gdsgate protects

• Identity and policy decisions: When an identity provider is configured, Authority evaluates the identity and the request against the configured policy before the gateway serves a catalogued resource.
• The protected data path: Connector makes the protected-side connection and opens an outbound tunnel to Proxy. A client request is not an inbound connection to the protected backend.
• Short-lived access: An allowed request can receive a short-lived certificate or session credential. Expiry and later authorization checks are separate from network reachability.
• Recorded decisions: The configured audit store records authorization and session events. Listing rows shows what was recorded; audit-chain verification is a separate integrity check.

These controls do not make a host an isolated network. A process that has an independent route or backend credential can bypass the gateway. The Concepts page defines the trust boundary, and the Quickstart requires a direct-backend negative test before it calls the lab complete.

How it fits together

flowchart LR
  client["Client<br/>alice@example.test"] -->|client TLS| proxy["Proxy<br/>proxy-1"]
  proxy -->|control and policy| authority["Authority<br/>authority-1"]
  connector["Connector<br/>connector-1"] -.->|outbound tunnel| proxy
  connector -->|protected connection| db[("PostgreSQL<br/>lab-postgres")]
  idp[Identity provider] -.->|identity token| client
  idp -.->|issuer and keys| authority

The text equivalent is three steps:

1. The Client connects to Proxy after it verifies the Authority transport fingerprint.
2. Proxy asks Authority for the catalog and policy decision for the requested resource.
3. Connector reaches lab-postgres from the protected side and serves the authorized path over its outbound tunnel.

The data path between Proxy and Connector is distinct from the Authority control path. The fixture names and port conventions are documented in the evaluator Quickstart; they are not a production endpoint matrix.

Where to go next

Reader and outcome	Start here
Evaluator with deployment access: verify the administrator-supplied build, run the split lab, and collect positive and negative proof	Quickstart
End user: connect to an existing deployment and use a native client	User guide
Administrator: enroll roles, configure state, and harden a deployment	Admin guide
Policy author: understand actions, entities, and policy effects	Concepts and Policy
Integrator: connect a resource or identity system	Integrations
Operator: inspect health, sessions, audit, and recovery	Operations

The Configuration and CLI pages own exhaustive field and flag contracts. The Changelog records release-specific changes that can affect a task path. Use the Concepts glossary when a page uses a role, object, or security-boundary term.