Configuration recipes

Which sections each role reads, and where to start. Fields, types and defaults are on the linked pages.

Before starting any role, check the file with gdsgate doctor --config <PATH> --json.

Complete deployments with every command and file, per scenario: Deploy; certificate modes for any of them: Certificates.

Per-role recipes

Shape	Reads	Start with	Validate and continue
Authority-only	[endpoints], [authority], store_url, [policy], identity, catalog, HA, and audit sections	Authority, top-level keys	Multi-node control plane; also run the policy validator when a policy file is set.
Proxy-only	listener endpoints, [enroll], [proxy], [transport], published client addressing	Endpoints, enrollment, Proxy	Network zoning
Connector-only	dial endpoints, [enroll], [connector], backends, optional recording and telemetry	Connector, backends	Registration lifecycle
Connector-only, tunneled	Proxy and join addresses, [enroll], [connector].authority_transport = "tunneled"	Tunnelled connector, join relay	Registration lifecycle; check that join and renewal addresses are reachable.
Client	client-facing endpoint, [client], identity, command settings	Client, sign-in	Connect to the cluster
All-in-one	Authority, Proxy and Connector sections in one process	Deployment shapes, Authority, Proxy, Connector	Started only by the all subcommand. Does not read [admin] or CLI profile entries.

Authority-only (multi-node, control plane)

An Authority fleet sharing a persistent store. Set store_url, set store_auto_migrate for your rollout, and add the HA and audit sections. Other sections: Authority, policy, discovery. Validate with gdsgate doctor --config <PATH> --json and, with a policy file, gdsgate authority policy validate <POLICY_PATH>. Procedure: bringing up a multi-node cluster.

Proxy-only

Set the listeners in endpoints, enrollment in enroll, and admission and join limits in Proxy. Client addressing the Proxy publishes is described in client. Procedure: network zoning.

Connector-only

Set the endpoints and enrollment, then add [[connector.backends]] entries from the backend reference. Add recording or telemetry as needed. Keep upstream credentials in protected files. Procedure: registration lifecycle.

Connector-only, one address (tunneled)

Use authority_transport = "tunneled" when the connector can reach only the Proxy. The Proxy must serve a reachable proxy_join for registration and token-less renewal; other Authority calls go through the reverse tunnel. See tunneled connector behavior and registration lifecycle and PKI. gdsgate doctor shows the derived join and renewal addresses.

Client

Client commands use the Proxy endpoint and the client settings. Sign-in: identity. Procedure: connect to the cluster. gdsgate doctor checks the file; it does not check that the identity provider or the Proxy is reachable.

All-in-one (single-node deployment)

gdsgate all starts Authority, Proxy and Connector in one process and reads their sections. Set store_url to a persistent store to keep state across restarts. [admin], agent_profiles and delegation_profiles are not read. See deployment shapes, then follow the guide's bootstrap and enrollment steps.