Recipes configuration

The flat configuration hub remains the compatibility route. This page is a role and topology dispatch table, not a second field reference or onboarding path. Use the linked family pages for canonical fields, types, defaults, and constraints. store_url is a top-level scalar assignment in the top-level configuration.

Every recipe has the same preflight: parse the selected file and inspect unknown or cross-field failures with gdsgate doctor --config <PATH> --json. The public task guide named in each row is the operational starting point.

Per-role recipes

Shape	Reads	Start with	Validate and continue
Authority-only	[endpoints], [authority], top-level store_url scalar, [policy], identity, catalog, HA, and audit sections	Authority fields, top-level store fields	Multi-node control plane; run the doctor check above and the policy validator where a policy file is configured.
Proxy-only	endpoint listeners, [enroll], [proxy], [transport], and published client-addressing values	Endpoints, enrollment, Proxy	Network zoning; check listener and enrollment cross-fields with the doctor command.
Connector-only	endpoint dials, [enroll], [connector], backend rows, and optional recording/telemetry	Connector, backend rows	Registration lifecycle; parse and validate each backend with the doctor command.
Connector-only, tunneled	Proxy dial and join values, [enroll], and [connector].authority_transport = "tunneled"	Tunnelled connector, join relay	Registration lifecycle; confirm join and renewal addresses are reachable before starting the connector.
Client	client-facing endpoint, [client], identity, and command-specific settings	Client, sign-in	Connect to the cluster; run the doctor command before a client command.
All-in-one	the service sections for Authority, Proxy, and Connector in one process	Deployment shapes, Authority, Proxy, Connector	The all subcommand is explicit. It does not implicitly run when no subcommand is supplied, and it does not consume operator-only [admin] or CLI-only profile entries.

Authority-only (multi-node, control plane)

Use this shape for an Authority fleet sharing a persistent store. Keep store_url as a scalar in the top-level configuration, set store_auto_migrate according to the rollout plan, and pair it with the HA fields and audit fields. The required sequence and approval points are in bringing up a multi-node cluster.

The configuration surface is Authority, policy, discovery, and operations. Validate with gdsgate doctor --config <PATH> --json and gdsgate authority policy validate <POLICY_PATH> when a policy file is used.

Proxy-only

Bind the Proxy listeners in endpoints, configure identity enrollment in enroll, and use the Proxy reference for admission and join limits. Proxy-published client addressing is described in client and is consumed by client commands.

Follow network zoning. Validate with gdsgate doctor --config <PATH> --json; do not treat the client bundle as a second copy of the Proxy listener configuration.

Connector-only

Set the endpoint and enrollment dial paths, then choose one or more complete [[connector.backends]] rows from the backend reference. Add recording or telemetry only when the deployment needs them. Keep upstream credentials in the protected files named by the canonical rows.

Use the registration lifecycle as the task guide. Validate parse, unknown keys, and backend cross-field rules with gdsgate doctor --config <PATH> --json.

Connector-only, one address (tunneled)

Use authority_transport = "tunneled" when the connector may reach only the Proxy. The Proxy must publish a reachable proxy_join; registration and token-less renewal use that relay, while later Authority calls ride the reverse tunnel. The full route and its failure boundary are in tunneled connector behavior.

Follow registration lifecycle and PKI and check the derived join and renewal addresses with gdsgate doctor --config <PATH> --json before starting the connector.

Client

Client commands use the published Proxy endpoint and the client reference for trust, addressing, resolver pools, and intercept behavior. Sign in through the identity reference, then use the command-specific CLI reference for a protocol command.

Follow connect to the cluster. Validate the selected file with gdsgate doctor --config <PATH> --json; the doctor command does not replace the remote identity-provider or Proxy availability checks.

All-in-one (single-node deployment)

The explicit all service command starts Authority, Proxy, and Connector in a single process. It reads their service sections and can use a persistent store_url scalar for restart-safe state. It does not run implicitly and does not turn [admin], agent_profiles, or delegation_profiles into daemon configuration.

Use deployment shapes and the canonical Authority, Proxy, and Connector references. Validate the combined service file with gdsgate doctor --config <PATH> --json, then perform the guide's explicit bootstrap and enrollment steps.