Configuration¶

The source-checked split references are overview, endpoints, enrollment, transport, client, proxy, authority, policy, identity, workload, MCP, security, HA, operations, administration, discovery, connector, agents, and recipes. This flat route and its existing anchors remain compatibility targets.

Executable configuration walkthroughs use the shared Quickstart fixtures. Host names such as auth and proxy in reference fragments are deployment-local endpoint names, not a supported public endpoint matrix. Use the Quickstart fixture contract when connecting these fields to the disposable lab.

gdsgate reads one TOML cluster configuration file given with --config. An explicit subcommand is required: gdsgate with no subcommand prints help and exits. Defaults apply after a service or client subcommand is selected. A missing top-level section uses its source default where one exists, while a declared nested table or array entry still has its own required fields. The loopback development profile is used when no configuration is supplied, and GDSGATE_* variables overlay the file.

gdsgate --config <PATH> <authority|proxy|connector|all|client-command>

The same file shape serves service and client commands, but each command reads only the sections it owns. The matrix is a consumer map, not a claim that every process loads every section.

Section or field	Authority	Proxy	Connector	Client or CLI
profile	service telemetry and logs	service telemetry and logs	service telemetry and logs	Resident client journal only (`up --foreground`)
security	hold start-up to the declared profile	hold start-up to the declared profile	hold start-up to the declared profile
security.integrity	name the keyrings `production` requires
kms_keys	wrap the two keyrings and the CA signing seeds
store_url	yes
store_auto_migrate	yes
endpoints	bind and advertise Authority listeners	bind Proxy listeners and dial Authority	dial Proxy or Authority	dial the published Proxy endpoint
enroll		enroll and renew	enroll and renew
transport	issue transport identities	terminate transport mTLS	terminate transport mTLS
client		publish client bundle values		consume client addressing and resolver settings
proxy		bind Proxy and browser listeners
authority	bind Authority listeners
policy	load and edit policy
oidc	validate identities			client sign-in and token refresh
identity	sanitize human and workload claims		enforce Kubernetes impersonation limits
workload	issue workload identities
mcp	seed MCP policy defaults
mfa	verify and enroll factors
ca_rotation	rotate configured CAs
ha	elect the Authority audit writer
audit	seal, verify, and export audit records
approvals	resolve JIT thresholds			request or approve access
discovery	seed the catalog			list published resources
recording			write session recordings	view through CLI
telemetry	expose daemon metrics and traces	expose daemon metrics and traces	expose daemon metrics and traces
doctor	periodic checks	periodic checks	periodic checks	manual doctor command
admin				operator workstation certificate
policy.editor	policy-edit quorum
agent_profiles				delegate --exec profile registry
delegation_profiles				saved delegation dispatch
connector			register resources and serve backends

all starts the Authority, Proxy, and Connector service roles together and therefore consumes their service sections. It does not make operator-only [admin] or CLI-only profile entries part of those daemons. See Per-role recipes for the dispatch map and [Configuration templates] (../admin-guide.md#configuration-templates) for deployment examples.