Operations configuration

Paths in the tables are relative to [audit], [telemetry], [doctor], or [recording]. Check parsing with gdsgate doctor --config <PATH> --json. See the audit export guide.

[audit]

Used by: Authority.

Audit chain export and verification, and the five deprecated key parameters.

Deprecated: the five *_key_path parameters

anchor_key_path, approval_key_path, revocation_key_path, inventory_key_path and delegation_key_path are deprecated. The keys they name belong in the keyrings of [security.integrity], which gdsgate authority init creates. Existing key files go into the keyrings with gdsgate authority keys migrate-legacy. The parameters are still read. When any is set, Authority logs a warning at start-up and gdsgate doctor reports config.audit.legacy_keys.

Each deprecated key is a 32-byte HMAC key, hex-encoded; on Linux the file mode is 0600. Each path accepts a secret reference. A keyring that holds an active key for the same purpose takes precedence over the file.

Key	Type	Default	Purpose
anchor_key_path	string	unset	Deprecated. Seals an anchor checkpoint on each audit batch. The periodic verifier compares anchors with the log to detect truncation or rewriting in the database.
approval_key_path	string	unset	Deprecated. Seals each JIT access-request row. Unset and no keyring: JIT approvals are refused.
revocation_key_path	string	unset	Deprecated. Seals each node-revocation receipt, so a restored older database dump does not un-revoke a node. Unset and no keyring: revoke-node is refused.
inventory_key_path	string	unset	Deprecated. Seals each published live-discovery inventory. Unset and no keyring: inventories are stored and read without verification.
delegation_key_path	string	unset	Deprecated. Seals each delegation grant. Unset and no keyring: gdsgate delegate is refused.
export_path	string	unset	Append-only JSON-lines file of committed audit rows and anchor checkpoints, for a SIEM forwarder (vector, fluent-bit, promtail). Unset: no export file.
verify_interval_secs	u64	300	Interval of the background chain and anchor verification. 0 disables it.
checkpoint_interval_secs	u64	3600	How often Authority signs the chain head into audit_checkpoint. Checkpoints are written whenever the audit keyring holds a signing key; no value turns them off.

[audit]
export_path          = "/var/lib/gdsgate/authority/audit.jsonl"
verify_interval_secs = 300

[telemetry]

Used by: every long-running role (Authority, Proxy, Connector, all-in-one).

With metrics_listen set, the service serves Prometheus /metrics, liveness /healthz and readiness /readyz over plain HTTP. With otel_endpoint set, it exports OpenTelemetry traces. Both are off by default. Use loopback or an internal address; do not expose them publicly. Structured stderr logging (RUST_LOG, GDSGATE_LOG_FORMAT) is always on.

Field	Type	Meaning	Default
metrics_listen	string	Address for the observability HTTP server; empty means not started	"" (off)
otel_endpoint	string	OTLP/HTTP collector URL for trace export; empty means off	"" (off)

[telemetry]
metrics_listen = "127.0.0.1:9090"
otel_endpoint  = "http://otel-collector:4318"

otel_endpoint is outbound: the service pushes spans to the collector's OTLP/HTTP receiver, usually port 4318. Metrics and tracing details: Operations → Metrics and health and Operations → Distributed tracing.

[doctor]

Used by: every long-running role (Authority, Proxy, Connector, all-in-one).

Each daemon runs the gdsgate doctor checks every check_interval_secs. A Proxy or Connector sends the summary to Authority; gdsgate authority list-nodes --health shows it. With metrics_listen set, the result is also exported as gdsgate_doctor_* gauges. 0 disables the periodic check; the gdsgate doctor command still works.

Field	Type	Meaning	Default
check_interval_secs	u64	How often a daemon re-runs the checklist; 0 disables it	300

[doctor]
check_interval_secs = 300

See Operations → Surviving a redeploy.

[recording]

Used by: Connector.

Where the connector stores SSH and Kubernetes exec/attach session recordings (asciicast v2), and whether stdin is recorded.

Key	Type	Default	Purpose
mode	enum	"disk"	"disk": the cast stays on the connector host under ${enroll.state_dir}/recordings/<session_uid>.cast. "central": the finished cast is uploaded to Authority after the session-close event is sealed. The event's URI is file://<path> in both modes and is never rewritten. gdsgate authority recordings show reads a cast from wherever it is; see CLI → recordings list.
capture_stdin	bool	false	Record client stdin as asciicast "i" events. Passwords typed at echo-off prompts (sudo, ssh, passwd, read -s) are then stored in plain text.
sweep_interval_secs	u64	900	central mode: interval at which the connector retries casts not delivered at session close. Also runs once at start-up. 0 turns delivery off, including the start-up pass; casts then leave only through gdsgate connector recordings push.

[recording]
mode = "central"
# capture_stdin = true
# sweep_interval_secs = 900

central mode needs the connector's mTLS connection to Authority. To browse casts, policy must allow the caller to read AuditLog::"recordings".

After upload, the local cast is removed when Authority's receipt names the same digest. The local copy stays when the receipt has no digest (an older Authority), the digests differ, or the removal fails. The first two cases are logged once per connector process. The periodic pass retries what remains; see gdsgate doctor for what is waiting and why, and the admin guide for delivering by hand.