Configuration¶

Group	Pages
Start	Loading and global settings, profiles: dev, pilot, production
Roles	Authority, Proxy, Connector, Agent host, Client
Network and nodes	Endpoints, Enrollment, Transport
Access	Identity, Policy, Security, Administration
Operations	High availability, Operations, Discovery
Agents and integrations	Agents, MCP, Workload
Examples	Recipes

The sections below link to those pages.

Host names such as auth and proxy in examples are placeholders for your own endpoints. Deployment scenarios show how to set them.

gdsgate reads one TOML configuration file given with --config. A subcommand is required: gdsgate with no subcommand prints help and exits. A missing top-level section takes its defaults. A declared nested table or array entry must still have its required fields. Without a configuration file the loopback development profile is used. GDSGATE_* variables override the file.

gdsgate --config <PATH> <authority|proxy|connector|all|client-command>

Service and client commands use the same file shape. Each command reads only the sections listed for it below.

Section or field	Authority	Proxy	Connector	Client or CLI
profile	service telemetry and logs	service telemetry and logs	service telemetry and logs	Resident client journal only (`up --foreground`)
security	hold start-up to the declared profile	hold start-up to the declared profile	hold start-up to the declared profile
security.integrity	name the keyrings `production` requires
kms_keys	wrap the two keyrings and the CA signing seeds
store_url	yes
store_auto_migrate	yes
endpoints	bind and advertise Authority listeners	bind Proxy listeners and dial Authority	dial Proxy or Authority	dial the published Proxy endpoint
enroll		enroll and renew	enroll and renew
transport	issue transport identities	terminate transport mTLS	terminate transport mTLS
client		publish client bundle values		consume client addressing and resolver settings
proxy		bind Proxy and browser listeners
authority	bind Authority listeners
policy	load and edit policy
oidc	validate identities			client sign-in and token refresh
identity	sanitize human and workload claims		enforce Kubernetes impersonation limits
workload	issue workload identities
mcp	seed MCP policy defaults
mfa	verify and enroll factors
ca_rotation	rotate configured CAs
ha	elect the Authority audit writer
audit	seal, verify, and export audit records
approvals	resolve JIT thresholds			request or approve access
discovery	seed the catalog			list published resources
recording			write session recordings	view through CLI
telemetry	expose daemon metrics and traces	expose daemon metrics and traces	expose daemon metrics and traces
doctor	periodic checks	periodic checks	periodic checks	manual doctor command
admin				operator workstation certificate
policy.editor	policy-edit quorum
agent_profiles				delegate --exec profile registry
delegation_profiles				saved delegation dispatch
connector			register resources and serve backends

all starts the Authority, Proxy, and Connector roles together and reads their sections. It does not read [admin] or the CLI profile entries. See Per-role recipes for the dispatch map and [Configuration templates] (../admin-guide.md#configuration-templates) for deployment examples.