Profile matrix

What each [security].profile checks when a service starts, and what satisfies each check. Verify a file against it with gdsgate config check.

Cell	Meaning
required, refused at start	The service exits until the setting is in place.
refused if set	The service exits while the setting is present.
warning at start	The service logs a warning and starts.
doctor warning	Only gdsgate doctor reports it.
not checked	Nothing reports it.

The unset column is a file with no [security].profile. A refusal lists every failed check at once.

Compare

	dev	pilot	production
For	one machine, development, tests	a first real deployment, a pilot with real users	the deployment you run long term
Store	SQLite or PostgreSQL	PostgreSQL	PostgreSQL
Registration listener	cleartext allowed	TLS (enroll_cert_file)	TLS
Nodes register at	http:// or https://	https:// only	https:// only
Proxy client port	any	TLS	TLS
Connectors, Proxy, agent host	may run without an enrolled identity	enrolled identity required	enrolled identity required
gdsgate all (one process)	allowed	refused	refused
Identity provider ([oidc])	optional	optional	required; allow_insecure_http refused
Keyrings (control_keyring, audit_keyring)	optional	optional; one file for both: warning	required, two distinct files, readable by the service account only
Keys across replicas and sealed rows	not checked	not checked	every replica holds the same keys, and every key a sealed row names
Audit export ([audit].export_path)	not checked	warning at start	warning at start
Moving up	pilot: store, TLS, enrollment	production: IdP, keyrings

Each row names checks from the table below; the table has the exact rule and the fix.

Checks

Check	Role	dev	pilot	production
profile-declared	every role	warning at start	not checked	not checked
all-in-one	all-in-one	not checked	refused if set	refused if set
store-postgres	Authority	not checked	required, refused at start	required, refused at start
registration-tls	Authority	not checked	required, refused at start	required, refused at start
enroll-endpoint-tls	Proxy, connector, agent host	not checked	refused if set	refused if set
proxy-public-tls	Proxy	not checked	required, refused at start	required, refused at start
proxy-internal-mtls	Proxy	not checked	required, refused at start	required, refused at start
connector-enrolled	Connector	not checked	required, refused at start	required, refused at start
agent-host-enrolled	Agent host	not checked	required, refused at start	required, refused at start
audit-export	Authority	not checked	warning at start	warning at start
keyrings-named	Authority	not checked	not checked	required, refused at start
keyrings-distinct	Authority	not checked	warning at start	refused if set
key-file-access	Authority	not checked	not checked	refused if set
oidc-provider	Authority	not checked	not checked	required, refused at start
oidc-plain-http	Authority; Proxy with the clientless browser entry	doctor warning	doctor warning	refused if set
replica-keyrings	Authority	not checked	not checked	refused if set
sealed-row-keys	Authority	not checked	not checked	refused if set
open-secret-file	every service	warning at start	warning at start	warning at start
legacy-key-paths	Authority	warning at start	warning at start	warning at start

profile-declared

• Setting: [security].profile
• Satisfy: [security].profile = "production", "pilot" or "dev"; setup prepare --security-profile.
• Reference: Reference
• unset: doctor warning (dev is warning at start)

all-in-one

• Setting: gdsgate all (Authority, Proxy and connector in one process)
• Satisfy: Run gdsgate authority, gdsgate proxy and gdsgate connector as separate services.
• Reference: Reference

store-postgres

• Setting: store_url names PostgreSQL (unset or sqlite:// is SQLite)
• Satisfy: store_url = "postgres://gdsgate@db/gdsgate", password in store_password_file; setup prepare --store-url.
• Reference: Reference

registration-tls

• Setting: Registration listener TLS: [authority].enroll_cert_file and enroll_key_file
• Satisfy: [authority].enroll_cert_file and enroll_key_file; setup prepare --enroll-cert --enroll-key.
• Reference: Reference

enroll-endpoint-tls

• Setting: [enroll].endpoint scheme is http://
• Satisfy: [enroll].endpoint = "https://...", and [authority].enroll_cert_file on the Authority; setup prepare --enroll-cert.
• Reference: Reference

proxy-public-tls

• Setting: Client-facing TLS: a [proxy].public_cert_file pair, or an enrolled identity
• Satisfy: [proxy].public_cert_file and public_key_file, or [enroll]; setup prepare --tls-cert --tls-key.
• Reference: Reference

proxy-internal-mtls

• Setting: Connector-facing mutual TLS: an enrolled identity
• Satisfy: [enroll].endpoint and a one-time token ([enroll].token, or GDSGATE_ENROLL_TOKEN in the environment or in proxy.env beside the configuration), or an identity already in state_dir.
• Reference: Reference

connector-enrolled

• Setting: Connector enrolled identity
• Satisfy: [enroll].endpoint and a one-time token, or an identity already in state_dir.
• Reference: Reference

agent-host-enrolled

• Setting: Agent host enrolled identity
• Satisfy: [enroll].endpoint and a one-time token, or an identity already in state_dir.
• Reference: Reference

audit-export

• Setting: [audit].export_path
• Satisfy: [audit].export_path = "/var/lib/gdsgate/authority/audit.jsonl" (Windows: %ProgramData%\gdsgate\state\authority\audit.jsonl), shipped by a log collector.
• Reference: Reference

keyrings-named

• Setting: [security.integrity].control_keyring and audit_keyring both set
• Satisfy: gdsgate authority init --profile production, or setup prepare; existing key files: gdsgate authority keys migrate-legacy.
• Reference: Reference

keyrings-distinct

• Setting: The two keyrings name one file
• Satisfy: [security.integrity] control_keyring = "/etc/gdsgate/control.keys", audit_keyring = "/etc/gdsgate/audit.keys".
• Reference: Reference

key-file-access

• Setting: A keyring or an existing [audit].*_key_path file owned by another account or readable beyond the service
• Satisfy: Owner root or the service account; mode 0640 with group gdsgate, or 0600.
• Reference: Reference

oidc-provider

• Setting: [oidc].issuer and [oidc].client_id
• Satisfy: [oidc].issuer = "https://idp.example/realms/gdsgate", client_id = "gdsgate"; setup prepare --oidc-issuer --oidc-client-id.
• Reference: Reference

oidc-plain-http

• Setting: [oidc].allow_insecure_http = true (a lab or dev provider)
• Satisfy: [oidc].allow_insecure_http = false and an https:// issuer.
• Reference: Reference

replica-keyrings

• Setting: Authority replicas hold different keys, and rows are sealed under the difference (checked against the store)
• Satisfy: The same keyrings on every replica; gdsgate authority keys status.
• Reference: Reference

sealed-row-keys

• Setting: The newest sealed row of a table names a key no keyring here holds (checked against the store)
• Satisfy: The keyring that holds the key; for a lost key gdsgate authority keys accept-loss.
• Reference: Reference

open-secret-file

• Setting: A secret file the configuration names is readable beyond its owner and the service group
• Satisfy: chmod 640 with group gdsgate, or chmod 600.
• Reference: Reference

legacy-key-paths

• Setting: Any of the five [audit].*_key_path parameters set
• Satisfy: gdsgate authority keys migrate-legacy, then name the keyrings.
• Reference: Reference

gdsgate config check runs every check above except the two checked against the store (replica-keyrings, sealed-row-keys), which run after Authority opens the store.

Not checked by any profile

Setting	pilot	production	How to satisfy
Step-up MFA ([mfa.webauthn])	optional	recommended	[mfa]; policies that require webauthn_satisfied.
High availability ([ha])	optional	recommended: two or more Authority instances	[ha]; needs a PostgreSQL store_url.
Session recording off the connector host ([recording])	optional	recommended	[recording].
Client-facing certificate from a public CA ([proxy].public_cert_file)	optional	recommended	Without it clients trust the cluster CA through gdsgate connect. [proxy].
Metrics and health ([telemetry].metrics_listen)	optional	recommended	[telemetry].

Example

A pilot Authority that passes every check:

store_url           = "postgres://gdsgate@db.example.com/gdsgate"
store_password_file = "/etc/gdsgate/store.password"

[security]
profile = "pilot"

[authority]
enroll_cert_file = "/etc/gdsgate/enroll.pem"
enroll_key_file  = "/etc/gdsgate/enroll.key"

[audit]
export_path = "/var/lib/gdsgate/authority/audit.jsonl"

For production add:

[security.integrity]
control_keyring = "/etc/gdsgate/control.keys"
audit_keyring   = "/etc/gdsgate/audit.keys"

[oidc]
issuer    = "https://idp.example.com/realms/gdsgate"
client_id = "gdsgate"

gdsgate config check /etc/gdsgate/authority.toml --role authority
gdsgate config check /etc/gdsgate/authority.toml --role authority --profile production

Symptoms

Symptom	Cause	What to do
refusing to start: followed by a list, each item with a fix: line	One or more required or refused if set cells above	Apply every fix: line; gdsgate config check <FILE> --role <ROLE> prints the same list with the key path of each.
`store_url` is unset: state is kept in a local SQLite file	store-postgres	Set store_url to a postgres:// URL.
`[authority].enroll_cert_file` is unset	registration-tls	Set enroll_cert_file and enroll_key_file.
`[enroll].endpoint` is `http://...`: the provision token crosses it in cleartext	enroll-endpoint-tls	Write the endpoint as https://; the Authority needs enroll_cert_file.
the client-facing listener has no TLS	proxy-public-tls	Set [proxy].public_cert_file and public_key_file, or enrol the Proxy.
`[security.integrity].control_keyring` names no keyring	keyrings-named	gdsgate authority init --profile production, or gdsgate authority keys migrate-legacy for existing key files.
`[oidc].issuer` and `[oidc].client_id` are unset	oidc-provider	Set both.
`[audit].export_path` is unset in the log, service running	audit-export	Set export_path; the warning does not stop the service.
`gdsgate all`: Authority, Proxy and connector in one process	all-in-one	Run the three roles as separate services, or set profile = "dev".