Configuration loading and global settings

This page covers how the configuration is loaded, secret references, external keys, the top-level keys, and environment overrides. The configuration hub links every section.

Paths in the tables are relative to the section heading. Each row gives the type and the default, or what an unset value means. Keep secrets in protected files or environment variables. Check parsing, unknown keys, and cross-field rules with gdsgate doctor --config <PATH> --json. Examples: configuration templates.

Layering

The effective config is built in three layers:

1. Defaults: the loopback development profile and each field's default. Fields without a default stay unset until configured.
2. TOML file from --config. A field present in the file overrides the default.
3. Environment. A GDSGATE_* variable that is set overrides the file. See Environment overrides.

Secret references

A secret value, or a path to one, can be written as a reference to where the secret is kept. A value whose whole string is ${scheme:argument} is a reference. Any other value is read literally: ${file:unclosed and $TOKEN are literal values.

Scheme	Value
(no prefix)	The value; for a parameter that names a path, the file at that path.
file:PATH	The file's contents, trailing newline stripped.
env:NAME	An environment variable of the process.
exec:COMMAND ARG...	Standard output of a command, trailing newline stripped.
kms.<name>+<source>	The ciphertext <source> yields (file:, env: or exec:), unwrapped by the key <name> of [[kms_keys]]. See Wrapping a source.

store_password_file = "${exec:/usr/local/bin/gdsgate-unwrap store}"  # a helper's standard output

[security.integrity]
control_keyring = "/var/lib/gdsgate/authority/control.keys"          # bare path, unchanged
audit_keyring   = "${file:/var/lib/gdsgate/authority/audit.keys}"    # the same thing, written out

[proxy]
public_key_file = "${env:PUBLIC_TLS_KEY}"                            # a variable of this process

A parameter that names a path reads a bare value as a file path: control_keyring = "/var/lib/gdsgate/authority/control.keys" and control_keyring = "${file:/var/lib/gdsgate/authority/control.keys}" are the same. A parameter that holds a value (a delegation profile's env entries, the enrollment token) reads a bare value as the value.

What accepts it

Parameter	Documented at
[security.integrity].control_keyring	Security
[security.integrity].audit_keyring	Security
[audit].anchor_key_path (deprecated)	Operations
[audit].approval_key_path (deprecated)	Operations
[audit].revocation_key_path (deprecated)	Operations
[audit].delegation_key_path (deprecated)	Operations
[audit].inventory_key_path (deprecated)	Operations
[authority].enroll_key_file	Authority
[proxy].web_key_file	Proxy
[proxy].webapps_key_file	Proxy
[proxy].public_key_file	Proxy
store_password_file	Top level
[enroll].token	Enrollment
[[connector.backends]].service_account_password_file	Connector
[[connector.backends]].token_path	Connector
[[connector.backends]].credential_file	Connector
[connector.backends.discovery].password_file	Connector

Running a command

exec: runs a helper and uses its standard output as the value. Use it for a hardware module or a secret store gdsgate has no driver for.

Rule	Behavior
No shell	The string is split on whitespace and the first word is executed. Pipelines, redirects and arguments with spaces are not possible; use a wrapper script.
Input and output	The value is read from standard output. Standard input is empty.
Exit code	A nonzero exit leaves the parameter unresolved; the process does not start.
Environment	Inherited unchanged. The helper's own credentials must already be in it.
Timeout	30 seconds, then the command is killed and the reference refused.

References are resolved when the configuration loads. Listener certificate keys (web_key_file, webapps_key_file, public_key_file, enroll_key_file) are resolved again each time the certificate file changes.

env: and where it shows up

env: reads a variable of the process environment. Use it for values passed on to a child process's environment, such as a delegation profile's env entries. For the parameters in the table above, use file: or exec:. The process environment is readable through /proc/<pid>/environ on Linux and appears in crash dumps.

gdsgate doctor reports which form each covered parameter is using, without reading the material behind it.

Wrapping a source: ${kms.<name>+<source>}

A file:, env: or exec: source can hold ciphertext under a key held by an external service. The kms.<name>+ prefix names the [[kms_keys]] entry that unwraps it. <name> can be left out only while [[kms_keys]] declares one key. An undeclared name, or a missing name with more than one key declared, is refused when the configuration loads.

Written	Means
${kms.<name>+file:PATH}	The file holds ciphertext; the key <name> unwraps it.
${kms.<name>+env:VAR}	The variable holds ciphertext; the key <name> unwraps it.
${kms.<name>+exec:CMD}	The command's standard output is ciphertext; the key <name> unwraps it.
${kms+file:PATH} (name left out)	As above, meaning the single key [[kms_keys]] declares.

Nested wrappers (${kms.a+kms.b+file:PATH}) are refused. A wrapped source that holds a plain keyring document is refused before the key is called.

Only [security.integrity].control_keyring and .audit_keyring accept the prefix. The other parameters in What accepts it refuse a ${kms...} value; the error names the parameter.

A wrapping key supports three actions:

Action	Given	Gets back
unwrap	ciphertext	the material
wrap	the material	ciphertext
generate	nothing	fresh material and its ciphertext, together, in one answer

authority init and keys rotate --prepare call generate for a wrapped keyring. wrap writes a wrapped keyring back; a keyring is wrapped as one document, so adding a key or converting from the five legacy key files calls it. Material is never passed in an argument. A nonzero exit is a refusal; a start that cannot reach the key stops. The output of a refused call is not copied into the error message.

For the exec kind, command runs with the action word appended. The rules of running a command apply: no shell, a 30-second timeout.

Action	Argument appended	Standard input	Standard output
unwrap	unwrap	the ciphertext	the material
wrap	wrap	the material	the ciphertext
generate	generate	nothing	{"ciphertext":"...","plaintext":"..."}, both base64

The native kinds perform the same three actions through their service's API; see [[kms_keys]] for the build features.

[[kms_keys]]

Used by: Authority.

External wrapping keys: what a ${kms.<name>+...} reference names, and what [authority].ca_kms_key names. A key here wraps and unwraps; it never leaves its service. A key-value secret store is read through exec: as a source and is not declared here. For Vault and OpenBao, provider = "vault" uses the transit engine.

Key	Type	Default	Purpose
name	string	required	What a wrapper names between kms. and +. See naming below.
provider	string	required	exec, vault, aws, or gcp. Which of the fields below this row reads.
command	array of strings	[]	Required for exec: the program and its arguments. The action word is appended when it runs. Arguments with spaces need no quoting.
key	string	""	Required for the native kinds. vault: the key name in the transit engine. aws: an ARN, alias, or key id. gcp: the key's full resource name.
address	string	""	Service base URL. Required for vault. Optional for aws: an interface or compliance endpoint to use in place of the region's public one. Not used by gcp.
mount	string	""	vault only: where the transit engine is mounted. Empty means transit.
region	string	""	aws only: which region the key lives in.

[[kms_keys]]
name     = "audit"
provider = "exec"
command  = ["/usr/local/bin/gdsgate-kms", "--key", "audit"]

[[kms_keys]]
name     = "audit"
provider = "vault"
address  = "https://vault.example.invalid:8200"
mount    = "kms-transit"
key      = "gdsgate-audit"

[[kms_keys]]
name     = "control"
provider = "aws"
region   = "eu-central-1"
key      = "arn:aws:kms:eu-central-1:123456789012:key/2f1c"

[[kms_keys]]
name     = "ca"
provider = "gcp"
key      = "projects/p/locations/europe-west1/keyRings/r/cryptoKeys/k"

Credentials for the native kinds come from the process environment. gdsgate stores none. Sources are read in this order; the first found is used:

Kind	Credentials
vault	VAULT_TOKEN, then ~/.vault-token. VAULT_NAMESPACE sets the namespace; VAULT_CACERT names a private CA.
aws	AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (with AWS_SESSION_TOKEN for temporary credentials), then container runtime credentials, then the instance role from the metadata service.
gcp	The service-account file in GOOGLE_APPLICATION_CREDENTIALS, then the instance identity from the metadata service.

Each native kind requires a build with its feature: kms-vault, kms-aws, or kms-gcp. exec is in every build. A key whose kind the binary lacks is refused at start-up; the error names the missing feature.

There is no pkcs11 kind. For a PKCS#11 hardware module, a KMIP device, or another key service, use provider = "exec" with a helper built against the vendor's library.

Naming a key

Declare separate keys for the control keyring and the audit keyring. Access to each can then be revoked separately at the key service. See [security.integrity]. Keys under different providers can be mixed.

A reference may leave the name out only while one key is declared; see Wrapping a source.

Supported service versions

vault works with Vault 1.18.5 and OpenBao 2.6.2.

The direct-encryption limit

AWS KMS encrypts at most 4096 bytes in one Encrypt or Decrypt call. A CA seed is 32 bytes. A wrapped keyring is sent as one document and fits up to 20 sealing keys or 14 signing keys. Retire old keys with keys rotate --retire to stay under the limit. A keyring over the limit is refused before anything is sent; the error names the limit and the size.

Top level

Used by: Authority, Proxy, Connector, and the foreground Resident client (profile); Authority (store_url, store_password_file, store_auto_migrate).

Key	Type	Default	Purpose
profile	string (optional)	unset, no deployment label	Deployment name. Labels service metrics, logs, and exported traces. The foreground Resident client labels its journal but exports no service metrics or traces.
store_url	string (optional)	unset, ~/.gdsgate/state/store.db (persistent file SQLite)	Authority state backend: audit chain, transport CA private key, SSH CAs, registration tokens, resource catalog. SQLite (file or :memory:) or PostgreSQL. :memory: is for tests only.
store_password_file	string (optional)	unset	PostgreSQL password, kept out of store_url. A path or a secret reference.
store_auto_migrate	bool	true	A starting service applies pending schema migrations. With false, a store with pending migrations stops the process; the error names how many are pending and the command that applies them.

profile security endpoints store_url store_password_file store_auto_migrate enroll authority transport client proxy policy mcp mfa oidc identity workload ca_rotation ha approvals discovery connector agent_host recording admin audit telemetry doctor agent_profiles delegation_profiles kms_keys

profile = "prod-eu"
store_url = "postgres://gdsgate@store-db.example.invalid:5432/gdsgate"
store_auto_migrate = false   # schema changes are a step of the rollout

With profile set, each service Prometheus series carries profile="<value>", each structured service log line carries a profile field, and each exported trace carries a profile resource attribute. See Metrics and health.

The value is 1 to 64 bytes from A-Z a-z 0-9 . _ -, read once at start-up. Requests, headers and tokens cannot set it. Environment: GDSGATE_PROFILE.

An invalid value stops authority, proxy, connector, all, and gdsgate up --foreground at start; the error names the character. Other commands run without the label and print a warning on stderr. gdsgate doctor reports it as a config.profile finding.

store_url unset means a persistent SQLite file at ~/.gdsgate/state/store.db. Set it for PostgreSQL or another path. sqlite::memory: loses everything on restart.

store_password_file keeps the PostgreSQL password out of store_url, which then carries only the user (postgres://gdsgate@store-db.example.invalid:5432/gdsgate). Setting both this field and a password inside store_url is refused at start-up. A password inside store_url still works and is redacted in output; gdsgate doctor warns about it. Environment: GDSGATE_STORE_PASSWORD_FILE.

Set store_auto_migrate = false to apply schema changes as a separate step: run gdsgate authority migrate once, then start the services. A store whose schema is newer than the binary is always refused. Environment: GDSGATE_STORE_AUTO_MIGRATE.

admin admin.endpoint admin.identity_dir admin.transport agent_host agent_host.id agent_host.scope agent_profiles agent_profiles[].checked agent_profiles[].config_args agent_profiles[].config_dir_env agent_profiles[].config_env agent_profiles[].config_format agent_profiles[].config_path agent_profiles[].model_config_key agent_profiles[].model_url_env agent_profiles[].model_url_path agent_profiles[].name agent_profiles[].note agent_profiles[].source agent_profiles[].tools_entry agent_profiles[].tools_key approvals approvals.min_approvers approvals.per_environment audit audit.anchor_key_path audit.approval_key_path audit.checkpoint_interval_secs audit.delegation_key_path audit.export_path audit.inventory_key_path audit.revocation_key_path audit.verify_interval_secs authority authority.agent_declaration_version authority.ca_kms_key authority.emergency_socket authority.enroll_cert_file authority.enroll_cert_from_cluster_ca authority.enroll_key_file ca_rotation ca_rotation.check_secs ca_rotation.enabled ca_rotation.interval_secs ca_rotation.proactive_secs ca_rotation.propagation_secs ca_rotation.retire_secs client client.access client.agent_auth_attempts_max client.agent_channel_ttl client.agent_frame_max client.agent_identities_max client.agent_key_source client.agent_resources client.agent_resources[].key client.agent_resources[].resource client.agent_signature_window client.agent_signatures_per_process client.agent_signatures_per_resource client.allow_insecure_http client.direct client.direct.basic_port_range client.direct.catalog_sync_secs client.direct.privileged_port_offset client.direct.v4_pool client.intercept_names client.local_user_only client.notify client.resolver client.step_up_on_denial client.transparent client.transparent.dns_zone client.transparent.reuse_grace_secs client.transparent.v4_pool client.transparent.v6_pool client.transport_ca client.transport_sni client.warm_access connector connector.authority_transport connector.backends connector.backends[].addr connector.backends[].admin connector.backends[].agent_auth_attempts_max connector.backends[].agent_identities_max connector.backends[].allow connector.backends[].allow_agent_forward connector.backends[].allow_elicitation_url connector.backends[].allow_encoded_separator connector.backends[].allow_fastpath_function connector.backends[].allow_local_forward connector.backends[].allow_port_forward connector.backends[].allow_remote_forward connector.backends[].allow_unpinned_upstream connector.backends[].allowed_backend_hosts connector.backends[].allowed_input_requests connector.backends[].allowed_models connector.backends[].allowed_query_params connector.backends[].allowed_request_headers connector.backends[].allowed_tools connector.backends[].api_url connector.backends[].audit connector.backends[].audit_command connector.backends[].auth_mode connector.backends[].ca_path connector.backends[].cage connector.backends[].cage.allow_degraded connector.backends[].cage.cpu_quota connector.backends[].cage.memory_max connector.backends[].cage.private_network connector.backends[].cage.private_tmp connector.backends[].cage.protect_home connector.backends[].cage.read_only_paths connector.backends[].cage.read_write_paths connector.backends[].cage.report_denied_paths connector.backends[].cage.restrict_address_families connector.backends[].cage.tasks_max connector.backends[].command connector.backends[].command_env connector.backends[].credential connector.backends[].credential_file connector.backends[].credential_format connector.backends[].credential_header connector.backends[].db_roles connector.backends[].db_roles[].db_user connector.backends[].db_roles[].name connector.backends[].db_roles[].read_only connector.backends[].decider_ca_path connector.backends[].decider_command connector.backends[].decider_command_env connector.backends[].decider_fail_closed connector.backends[].decider_timeout_ms connector.backends[].decider_url connector.backends[].decision_cache_ttl_secs connector.backends[].discovery connector.backends[].discovery.allowlist connector.backends[].discovery.connection connector.backends[].discovery.denylist connector.backends[].discovery.freshness_secs connector.backends[].discovery.interval_secs connector.backends[].discovery.label_selector connector.backends[].discovery.mode connector.backends[].discovery.password_file connector.backends[].discovery.scope connector.backends[].discovery.sources connector.backends[].enforce_query_categories connector.backends[].enforce_tool_policy connector.backends[].forwarded_headers connector.backends[].host_key_fingerprints connector.backends[].host_key_fingerprints_file connector.backends[].identity connector.backends[].identity_headers_trust_the_network connector.backends[].inspect connector.backends[].kind connector.backends[].login_mode connector.backends[].login_user connector.backends[].login_users connector.backends[].max_request_bytes connector.backends[].onward_auth connector.backends[].pin_tool_descriptors connector.backends[].record_request connector.backends[].record_response connector.backends[].refuse_unfiltered_tool_listing connector.backends[].repository_root connector.backends[].audio connector.backends[].clipboard connector.backends[].clipboard_files connector.backends[].drives connector.backends[].graphics connector.backends[].host_cert_fingerprints connector.backends[].host_cert_fingerprints_file connector.backends[].ports connector.backends[].printers connector.backends[].record connector.backends[].record_max_bytes connector.backends[].smart_cards connector.backends[].resource connector.backends[].routed_ranges connector.backends[].routes connector.backends[].routes[].audit connector.backends[].routes[].match connector.backends[].routes[].name connector.backends[].service_account connector.backends[].service_account_password_file connector.backends[].service_account_tls_ca_file connector.backends[].session connector.backends[].session.cpu_quota connector.backends[].session.kill_on_close connector.backends[].session.memory_max connector.backends[].session.tasks_max connector.backends[].shell connector.backends[].settable_parameters connector.backends[].ssh_profile connector.backends[].statement_timeout_ms connector.backends[].token_path connector.backends[].url connector.backends[].websocket connector.backends[].windows_user connector.backends[].windows_users connector.backends[].windows_users[].account connector.backends[].windows_users[].credential_file connector.git connector.git.git_lfs_authenticate connector.git.git_receive_pack connector.git.git_upload_archive connector.git.git_upload_pack connector.git.lfs_batch_body_max connector.id connector.proxy_connection_count delegation_profiles delegation_profiles[].agent_profile delegation_profiles[].can delegation_profiles[].env delegation_profiles[].exec delegation_profiles[].exec_args delegation_profiles[].model delegation_profiles[].name delegation_profiles[].renewable delegation_profiles[].sandbox delegation_profiles[].sandbox_allow delegation_profiles[].sandbox_cpu delegation_profiles[].sandbox_listen delegation_profiles[].sandbox_memory delegation_profiles[].sandbox_processes delegation_profiles[].ttl_secs discovery discovery.auto_scopes discovery.auto_scopes[].accept_label_keys discovery.auto_scopes[].enabled discovery.auto_scopes[].environment discovery.auto_scopes[].fallback discovery.auto_scopes[].id_prefix discovery.auto_scopes[].kinds discovery.auto_scopes[].labels discovery.auto_scopes[].lease_secs discovery.auto_scopes[].max_live discovery.auto_scopes[].node discovery.auto_scopes[].onward_auth discovery.auto_scopes[].project discovery.auto_scopes[].ssh_host_key discovery.import_rules discovery.import_rules[].environment discovery.import_rules[].labels discovery.import_rules[].match discovery.lease_sweep_secs discovery.resources discovery.resources[].aliases discovery.resources[].hostname discovery.resources[].id discovery.resources[].kind discovery.resources[].min_approvers discovery.resources[].native_name discovery.resources[].onward_auth discovery.resources[].pin_tool_descriptors discovery.resources[].port discovery.resources[].project discovery.resources[].ssh_profile discovery.resources[].web_profile doctor doctor.check_interval_secs endpoints endpoints.authority endpoints.authority_enroll endpoints.authority_enroll_failover endpoints.authority_failover endpoints.proxy_internal endpoints.proxy_join endpoints.proxy_public endpoints.proxy_ws enroll enroll.background_renewal enroll.endpoint enroll.node_name enroll.renew_endpoint enroll.state_dir enroll.token enroll.transport_ca enroll.transport_sni ha ha.authority_peers ha.enabled ha.keyring_sync ha.keyring_sync.bootstrap_endpoint ha.keyring_sync.bootstrap_fingerprint ha.keyring_sync.bootstrap_token ha.keyring_sync.enabled ha.keyring_sync.generation_kms_key ha.keyring_sync.initialize ha.keyring_sync.poll_secs ha.keyring_sync.state_dir ha.lease_ttl_secs ha.max_cluster_sessions ha.owner ha.renew_secs identity identity.allow_system_groups identity.max_groups identity.max_length kms_keys kms_keys[].address kms_keys[].command kms_keys[].key kms_keys[].mount kms_keys[].name kms_keys[].provider kms_keys[].region mcp mcp.destructive_patterns mfa mfa.webauthn mfa.webauthn.allow_any_port mfa.webauthn.allow_localhost mfa.webauthn.origins mfa.webauthn.rp_id mfa.webauthn.rp_origin oidc oidc.allow_insecure_http oidc.audience oidc.client_id oidc.display_name_claims oidc.id_token_signing_algs oidc.issuer oidc.jwks_refresh_secs oidc.request_timeout_secs policy policy.editor policy.editor.break_glass_policy_file policy.editor.min_approvers policy.path profile proxy proxy.abandoned_session_grace_secs proxy.internal_accept_burst proxy.internal_accept_rate_per_ip proxy.join_accept_burst proxy.join_accept_rate_per_ip proxy.join_idle_timeout_secs proxy.join_max_connections proxy.join_peek_timeout_secs proxy.max_bytes_per_second_per_session proxy.max_peer_connections proxy.max_peer_requests proxy.max_peer_sessions proxy.max_public_connections proxy.max_sessions proxy.max_streams_per_tunnel proxy.peer_addr proxy.peer_listen proxy.public_admin_max_connections proxy.public_anonymous_burst proxy.public_anonymous_rate_per_ip proxy.public_cert_file proxy.public_join proxy.public_join_burst proxy.public_join_rate_per_ip proxy.public_key_file proxy.public_origin proxy.public_proxy_protocol_from proxy.public_renewal_max_connections proxy.session_rate_burst_bytes proxy.single_port proxy.web_addr proxy.web_cert_file proxy.web_key_file proxy.webapps_addr proxy.webapps_cert_file proxy.webapps_key_file proxy.webapps_proxy_protocol_from proxy.webapps_session_ttl_secs proxy.webapps_zone recording recording.capture_stdin recording.mode recording.sweep_interval_secs security security.integrity security.integrity.audit_keyring security.integrity.control_keyring security.profile store_auto_migrate store_password_file store_url telemetry telemetry.metrics_listen telemetry.otel_endpoint transport transport.cert_ttl_secs transport.front_sni workload workload.cert_ttl_secs workload.issuers workload.issuers[].audience workload.issuers[].groups workload.issuers[].issuer workload.issuers[].owner_claim workload.issuers[].owner_service workload.issuers[].path_template workload.issuers[].single_use_jti workload.issuers[].slug workload.trust_domain connector.discovery_sources connector.discovery_sources[].api_url connector.discovery_sources[].ca_path connector.discovery_sources[].discovery connector.discovery_sources[].discovery.allowlist connector.discovery_sources[].discovery.connection connector.discovery_sources[].discovery.denylist connector.discovery_sources[].discovery.freshness_secs connector.discovery_sources[].discovery.interval_secs connector.discovery_sources[].discovery.label_selector connector.discovery_sources[].discovery.mode connector.discovery_sources[].discovery.password_file connector.discovery_sources[].discovery.scope connector.discovery_sources[].discovery.sources connector.discovery_sources[].id connector.discovery_sources[].kind connector.discovery_sources[].token_path ha.keyring_sync.root_kms_key

profile|None security|Security::default() endpoints|Endpoints::default() store_url|None store_password_file|None store_auto_migrate|true enroll|Enroll::default() authority|Authority::default() transport|Transport::default() client|Client::default() proxy|Proxy::default() policy|Policy::default() mcp|Mcp::default() mfa|Mfa::default() oidc|Oidc::default() identity|Identity::default() workload|Workload::default() ca_rotation|CaRotation::default() ha|Ha::default() approvals|Approvals::default() discovery|Discovery::default() connector|Connector::default() agent_host|AgentHost::default() recording|Recording::default() admin|Admin::default() telemetry|Telemetry::default() doctor|Doctor::default() agent_profiles|Vec::new() delegation_profiles|Vec::new() kms_keys|Vec::new()

Environment overrides

Each variable below overrides the file when it is set.

Variable	Overrides
GDSGATE_PROFILE	profile
GDSGATE_STORE_URL	store_url
GDSGATE_STORE_PASSWORD_FILE	store_password_file
GDSGATE_STORE_AUTO_MIGRATE	store_auto_migrate
GDSGATE_AUTH_ADDR	endpoints.authority
GDSGATE_AUTH_ENROLL_ADDR	endpoints.authority_enroll
GDSGATE_PROXY_PUBLIC_ADDR	endpoints.proxy_public
GDSGATE_PROXY_INTERNAL_ADDR	endpoints.proxy_internal
GDSGATE_PROXY_WS_ADDR	endpoints.proxy_ws
GDSGATE_PROXY_JOIN_ADDR	endpoints.proxy_join
GDSGATE_ENROLL_ENDPOINT	enroll.endpoint
GDSGATE_ENROLL_TOKEN	enroll.token
GDSGATE_ENROLL_STATE_DIR	enroll.state_dir
GDSGATE_ENROLL_RENEW_ENDPOINT	enroll.renew_endpoint
GDSGATE_ENROLL_NODE_NAME	enroll.node_name
GDSGATE_CLIENT_TRANSPORT_CA	client.transport_ca
GDSGATE_CLIENT_TRANSPORT_SNI	client.transport_sni
GDSGATE_CLIENT_ALLOW_INSECURE_HTTP	client.allow_insecure_http
GDSGATE_PROXY_SINGLE_PORT	proxy.single_port
GDSGATE_PROXY_PEER_ADDR	proxy.peer_addr
GDSGATE_PROXY_PEER_LISTEN	proxy.peer_listen
GDSGATE_POLICY_PATH	policy.path
GDSGATE_OIDC_ISSUER	oidc.issuer
GDSGATE_OIDC_CLIENT_ID	oidc.client_id
GDSGATE_OIDC_AUDIENCE	oidc.audience
GDSGATE_OIDC_ALLOW_INSECURE_HTTP	oidc.allow_insecure_http
GDSGATE_OIDC_JWKS_REFRESH_SECS	oidc.jwks_refresh_secs
GDSGATE_OIDC_REQUEST_TIMEOUT_SECS	oidc.request_timeout_secs
GDSGATE_IDENTITY_ALLOW_SYSTEM_GROUPS	identity.allow_system_groups
GDSGATE_IDENTITY_MAX_LENGTH	identity.max_length
GDSGATE_IDENTITY_MAX_GROUPS	identity.max_groups
GDSGATE_CONNECTOR_ID	connector.id
GDSGATE_CONNECTOR_AUTH_TRANSPORT	connector.authority_transport
GDSGATE_CA_ROTATION_ENABLED	ca_rotation.enabled
GDSGATE_CA_ROTATION_INTERVAL_SECS	ca_rotation.interval_secs
GDSGATE_CA_ROTATION_PROACTIVE_SECS	ca_rotation.proactive_secs
GDSGATE_CA_ROTATION_PROPAGATION_SECS	ca_rotation.propagation_secs
GDSGATE_CA_ROTATION_RETIRE_SECS	ca_rotation.retire_secs
GDSGATE_CA_ROTATION_CHECK_SECS	ca_rotation.check_secs
GDSGATE_HA_ENABLED	ha.enabled
GDSGATE_HA_OWNER	ha.owner
GDSGATE_HA_LEASE_TTL_SECS	ha.lease_ttl_secs
GDSGATE_HA_RENEW_SECS	ha.renew_secs
GDSGATE_AUDIT_ANCHOR_KEY_PATH	audit.anchor_key_path (deprecated)
GDSGATE_AUDIT_APPROVAL_KEY_PATH	audit.approval_key_path (deprecated)
GDSGATE_AUDIT_REVOCATION_KEY_PATH	audit.revocation_key_path (deprecated)
GDSGATE_AUDIT_DELEGATION_KEY_PATH	audit.delegation_key_path (deprecated)
GDSGATE_AUDIT_INVENTORY_KEY_PATH	audit.inventory_key_path (deprecated)
GDSGATE_AUDIT_EXPORT_PATH	audit.export_path
GDSGATE_TELEMETRY_METRICS_LISTEN	telemetry.metrics_listen
GDSGATE_TELEMETRY_OTEL_ENDPOINT	telemetry.otel_endpoint
GDSGATE_ADMIN_ENDPOINT	admin.endpoint
GDSGATE_ADMIN_IDENTITY_DIR	admin.identity_dir
GDSGATE_ADMIN_TRANSPORT	admin.transport

GDSGATE_ADMIN_ENDPOINT GDSGATE_ADMIN_IDENTITY_DIR GDSGATE_ADMIN_TRANSPORT GDSGATE_AUDIT_ANCHOR_KEY_PATH GDSGATE_AUDIT_APPROVAL_KEY_PATH GDSGATE_AUDIT_DELEGATION_KEY_PATH GDSGATE_AUDIT_EXPORT_PATH GDSGATE_AUDIT_INVENTORY_KEY_PATH GDSGATE_AUDIT_REVOCATION_KEY_PATH GDSGATE_AUTH_ADDR GDSGATE_AUTH_ENROLL_ADDR GDSGATE_CA_ROTATION_CHECK_SECS GDSGATE_CA_ROTATION_ENABLED GDSGATE_CA_ROTATION_INTERVAL_SECS GDSGATE_CA_ROTATION_PROACTIVE_SECS GDSGATE_CA_ROTATION_PROPAGATION_SECS GDSGATE_CA_ROTATION_RETIRE_SECS GDSGATE_CLIENT_ALLOW_INSECURE_HTTP GDSGATE_CLIENT_TRANSPORT_CA GDSGATE_CLIENT_TRANSPORT_SNI GDSGATE_CONNECTOR_AUTH_TRANSPORT GDSGATE_CONNECTOR_ID GDSGATE_ENROLL_ENDPOINT GDSGATE_ENROLL_NODE_NAME GDSGATE_ENROLL_RENEW_ENDPOINT GDSGATE_ENROLL_STATE_DIR GDSGATE_ENROLL_TOKEN GDSGATE_HA_ENABLED GDSGATE_HA_LEASE_TTL_SECS GDSGATE_HA_OWNER GDSGATE_HA_RENEW_SECS GDSGATE_IDENTITY_ALLOW_SYSTEM_GROUPS GDSGATE_IDENTITY_MAX_GROUPS GDSGATE_IDENTITY_MAX_LENGTH GDSGATE_OIDC_ALLOW_INSECURE_HTTP GDSGATE_OIDC_AUDIENCE GDSGATE_OIDC_CLIENT_ID GDSGATE_OIDC_ISSUER GDSGATE_OIDC_JWKS_REFRESH_SECS GDSGATE_OIDC_REQUEST_TIMEOUT_SECS GDSGATE_POLICY_PATH GDSGATE_PROFILE GDSGATE_PROXY_INTERNAL_ADDR GDSGATE_PROXY_JOIN_ADDR GDSGATE_PROXY_PEER_ADDR GDSGATE_PROXY_PEER_LISTEN GDSGATE_PROXY_PUBLIC_ADDR GDSGATE_PROXY_SINGLE_PORT GDSGATE_PROXY_WS_ADDR GDSGATE_STORE_AUTO_MIGRATE GDSGATE_STORE_PASSWORD_FILE GDSGATE_STORE_URL GDSGATE_TELEMETRY_METRICS_LISTEN GDSGATE_TELEMETRY_OTEL_ENDPOINT

Client-only variables:

Variable	Purpose
GDSGATE_ID_TOKEN	Identity token a client command should present (headless / CI).
GDSGATE_USER	Local-dev principal name when no [oidc] is configured.
RUST_LOG	Log filter. Default warn,gdsgate=info: gdsgate* at INFO, everything else at WARN. A set value replaces the default.

[[connector.backends]] has no environment override.