Operations configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [audit], [telemetry], [doctor], or [recording]. Each row gives the serde type and source default or unset meaning; key and recording files belong in protected locations. Check parsing and the checks exposed by the doctor command with gdsgate doctor --config <PATH> --json, then follow the audit export guide.

[audit]

Used by: Authority.

Integrity keys and off-cluster export for the audit chain. Each key is a 32-byte HMAC key, hex-encoded, mode 0o600, generated with the matching gdsgate authority init-* command (see CLI). The keys live on the Authority host, outside the database, so a writer with database access cannot forge the records they seal. Each is a distinct file and HMAC domain, so one can be rotated without the others. Back them up alongside the database: losing one means losing the ability to verify what it sealed.

Each path below also accepts the secret-reference notation in place of a bare path.

Key	Type	Default	Purpose
anchor_key_path	string	unset	Seals an anchor checkpoint on every audit batch, pinning the chain head. The periodic verifier cross-checks anchors against the log to catch a database-side truncate or rewrite. Unset means no external anchor; for dev and tests only, and production should set it.
approval_key_path	string	unset	Seals each JIT access-request row so a database-write-only attacker cannot forge an approval. Unset, the JIT approval flow is refused fail-closed.
revocation_key_path	string	unset	Seals each node-revocation receipt so restoring a pre-revocation database dump cannot silently un-revoke a node. Unset, revoke-node is refused fail-closed.
inventory_key_path	string	unset	Seals each published live-discovery inventory so a direct row rewrite cannot inject forged sub-resources into listings. Unset, snapshots are stored receipt-less and read back without verification; discovery is itself opt-in.
delegation_key_path	string	unset	Seals each delegation grant so a database-write-only attacker cannot forge one. Unset, gdsgate delegate is refused fail-closed. Needed only where delegation is used.
export_path	string	unset	Append-only JSON-lines file Authority writes committed audit rows and anchor checkpoints to. A SIEM forwarder (vector, fluent-bit, promtail) tails it. Unset means no off-cluster witness file.
verify_interval_secs	u64	300	How often the background verifier re-checks the chain and anchors. 0 disables the background loop.
checkpoint_interval_secs	u64	3600	How often Authority signs the chain head into audit_checkpoint. No value turns checkpoints off: they are written whenever the audit keyring holds a signing key.

[audit]
anchor_key_path     = "/var/lib/gdsgate/anchor.key"
approval_key_path   = "/var/lib/gdsgate/approvals.key"
revocation_key_path = "/var/lib/gdsgate/revocation.key"
inventory_key_path  = "/var/lib/gdsgate/inventory.key"   # only if you use live discovery
delegation_key_path = "/var/lib/gdsgate/delegation.key"  # only if you use delegation
export_path         = "/var/log/gdsgate/audit.jsonl"
verify_interval_secs = 300

[telemetry]

Used by: every long-running role (Authority, Proxy, Connector, all-in-one).

Operational observability. When metrics_listen is set, the service exposes a small HTTP server there: Prometheus /metrics, liveness /healthz, readiness /readyz. When otel_endpoint is set, the service exports OpenTelemetry traces to that collector. Both off by default. Plain HTTP and no secrets: bind or point at loopback or a mesh-internal address (a scrape target, a Kubernetes probe endpoint, a collector), never the public internet. Structured stderr logging (RUST_LOG, GDSGATE_LOG_FORMAT) is independent of this and always on.

Field	Type	Meaning	Default
metrics_listen	string	Address for the observability HTTP server; empty means not started	"" (off)
otel_endpoint	string	OTLP/HTTP collector URL for trace export; empty means off	"" (off)

[telemetry]
metrics_listen = "127.0.0.1:9090"
otel_endpoint  = "http://otel-collector:4318"

otel_endpoint is outbound: the service dials the collector and pushes spans to the collector's OTLP/HTTP receiver, commonly 4318, so it binds nothing for this, unlike the pull-scraped metrics_listen. The metric list, endpoint semantics, and the distributed-tracing details are in Operations → Metrics and health and Operations → Distributed tracing.

[doctor]

Used by: every long-running role (Authority, Proxy, Connector, all-in-one).

Periodic self-diagnosis. With check_interval_secs above zero, each daemon re-runs the gdsgate doctor checklist on that cadence: a proxy or connector pushes the summary to Authority, where gdsgate authority list-nodes --health reads it back, and, when metrics_listen is set, the result is also published locally as the gdsgate_doctor_* gauges. 0 disables the periodic check; the manual gdsgate doctor command is unaffected.

Field	Type	Meaning	Default
check_interval_secs	u64	How often a daemon re-runs the checklist; 0 disables it	300

[doctor]
check_interval_secs = 300

See Operations → Surviving a redeploy.

[recording]

Used by: Connector.

Where the connector persists SSH and Kubernetes exec/attach session recordings (asciicast v2), and whether stdin chunks land in them.

Key	Type	Default	Purpose
mode	enum	"disk"	"disk" keeps the cast on the connector host under ${enroll.state_dir}/recordings/<session_uid>.cast, and the session-close audit event names a file:// URI. "central" uploads the finalized cast to Authority at session close and a local copy stays as a DR fallback; the URI becomes recording://<session_uid>, fetched through gdsgate authority recordings show.
capture_stdin	bool	false	When true, the recorder writes client-to-server stdin bytes into the cast as asciicast "i" events alongside stdout and stderr. Off by default: echo-off password prompts (sudo, ssh, passwd, any read -s) hand the typed bytes to the server through stdin without echoing them back, so a stdin-on cast holds those passwords in plain text. Enable only where the deeper audit trail is worth the PII risk.

[recording]
mode = "central"
# capture_stdin = true   # opt-in for full keystroke capture

central mode requires the connector to reach Authority, over the same mTLS channel as audit shipping, and the cluster's policy must let the calling principal read AuditLog::"recordings" to browse the casts.