Skip to content

Service commands

Common global behavior is documented in the CLI hub. These are the complete service-mode command contracts; lifecycle guidance is kept after the exact command sections.

gdsgate proxy

Run the Proxy: public listener, internal reverse-tunnel listener, WebSocket fallback listener, single Authority client. Stateless.

Reads: [endpoints], [enroll], [proxy].

TOKEN_FILE="<proxy-enrollment-token-file>"
GDSGATE_ENROLL_TOKEN="$(<"$TOKEN_FILE")" \
    gdsgate --config proxy.toml proxy

The Proxy registers on first start, consuming the token, persists its identity to [enroll].state_dir, and on subsequent starts reuses the persisted identity. With no [enroll].endpoint, the Proxy runs plaintext, for dev and loopback only.

gdsgate connector

Run the Connector: dials the Proxy's reverse-tunnel listener, registers the resources declared in [[connector.backends]], and serves them.

Reads: [endpoints], [enroll], [connector].

TOKEN_FILE="<connector-enrollment-token-file>"
GDSGATE_ENROLL_TOKEN="$(<"$TOKEN_FILE")" \
    gdsgate --config connector.toml connector

For SSH backends in model A (kind = "ssh" with no addr), the connector loads its persistent host key from <state_dir>/ssh_host_ed25519_key, generating one on first start.

gdsgate all

Run Authority, Proxy and an embedded Connector in one process. store_url defaults to a persistent file SQLite (~/.gdsgate/state/store.db), so this is a self-contained single-node deployment that survives restarts and still accepts externally registered connectors on the registration listener.

Reads: every section.

gdsgate --config all.toml all

Service lifecycle

Run a service directly under its supervisor; proxy, connector, authority, and all remain in the foreground until they are stopped. Then check /healthz and /readyz before declaring a replacement ready. A process can be live while dependencies are not ready.