Configuration loading and global settings¶

This page covers how the configuration is loaded, secret references, external keys, the top-level keys, and environment overrides. The configuration hub links every section.

Paths in the tables are relative to the section heading. Each row gives the type and the default, or what an unset value means. Keep secrets in protected files or environment variables. Check parsing, unknown keys, and cross-field rules with gdsgate doctor --config <PATH> --json. Examples: configuration templates.

gdsgate config schema prints the configuration JSON Schema. Platform-specific values appear under x-gdsgate-platform-defaults, with separate linux and windows entries. The schema is identical on both platforms; each runtime continues to use its own default paths.

Layering¶

The effective config is built in three layers:

Defaults: the loopback development profile and each field's default. Fields without a default stay unset until configured.
TOML file from --config. A field present in the file overrides the default.
Environment. A GDSGATE_* variable that is set overrides the file. See Environment overrides.

Secret references¶

A secret value, or a path to one, can be written as a reference to where the secret is kept. A value whose whole string is ${scheme:argument} is a reference. Any other value is read literally: ${file:unclosed and $TOKEN are literal values.

Scheme	Value
(no prefix)	The value; for a parameter that names a path, the file at that path.
`file:PATH`	The file's contents, trailing newline stripped.
`env:NAME`	An environment variable of the process.
`exec:COMMAND ARG...`	Standard output of a command, trailing newline stripped.
`kms.<name>+<source>`	The ciphertext `<source>` yields (`file:`, `env:` or `exec:`), unwrapped by the key `<name>` of `[[kms_keys]]`. See Wrapping a source.

store_password_file = "${exec:/usr/local/bin/gdsgate-unwrap store}"  # a helper's standard output

[security.integrity]
control_keyring = "/var/lib/gdsgate/authority/control.keys"          # bare path, unchanged
audit_keyring   = "${file:/var/lib/gdsgate/authority/audit.keys}"    # the same thing, written out

[proxy]
public_key_file = "${env:PUBLIC_TLS_KEY}"                            # a variable of this process

A parameter that names a path reads a bare value as a file path: control_keyring = "/var/lib/gdsgate/authority/control.keys" and control_keyring = "${file:/var/lib/gdsgate/authority/control.keys}" are the same. A parameter that holds a value (a delegation profile's env entries, the enrollment token) reads a bare value as the value.

What accepts it¶

Parameter	Documented at
`[security.integrity].control_keyring`	Security
`[security.integrity].audit_keyring`	Security
`[audit].anchor_key_path` (deprecated)	Operations
`[audit].approval_key_path` (deprecated)	Operations
`[audit].revocation_key_path` (deprecated)	Operations
`[audit].delegation_key_path` (deprecated)	Operations
`[audit].inventory_key_path` (deprecated)	Operations
`[authority].enroll_key_file`	Authority
`[proxy].web_key_file`	Proxy
`[proxy].webapps_key_file`	Proxy
`[proxy].public_key_file`	Proxy
`store_password_file`	Top level
`[enroll].token`	Enrollment
`[[connector.backends]].service_account_password_file`	Connector
`[[connector.backends]].token_path`	Connector
`[[connector.backends]].credential_file`	Connector
`[connector.backends.discovery].password_file`	Connector

Running a command¶

exec: runs a helper and uses its standard output as the value. Use it for a hardware module or a secret store gdsgate has no driver for.

Rule	Behavior
No shell	The string is split on whitespace and the first word is executed. Pipelines, redirects and arguments with spaces are not possible; use a wrapper script.
Input and output	The value is read from standard output. Standard input is empty.
Exit code	A nonzero exit leaves the parameter unresolved; the process does not start.
Environment	Inherited unchanged. The helper's own credentials must already be in it.
Timeout	30 seconds, then the command is killed and the reference refused.

References are resolved when the configuration loads. Listener certificate keys (web_key_file, webapps_key_file, public_key_file, enroll_key_file) are resolved again each time the certificate file changes.

`env:` and where it shows up¶

env: reads a variable of the process environment. Use it for values passed on to a child process's environment, such as a delegation profile's env entries. For the parameters in the table above, use file: or exec:. The process environment is readable through /proc/<pid>/environ on Linux and appears in crash dumps.

gdsgate doctor reports which form each covered parameter is using, without reading the material behind it.

Wrapping a source: `${kms.<name>+<source>}`¶

A file:, env: or exec: source can hold ciphertext under a key held by an external service. The kms.<name>+ prefix names the [[kms_keys]] entry that unwraps it. <name> can be left out only while [[kms_keys]] declares one key. An undeclared name, or a missing name with more than one key declared, is refused when the configuration loads.

Written	Means
`${kms.<name>+file:PATH}`	The file holds ciphertext; the key `<name>` unwraps it.
`${kms.<name>+env:VAR}`	The variable holds ciphertext; the key `<name>` unwraps it.
`${kms.<name>+exec:CMD}`	The command's standard output is ciphertext; the key `<name>` unwraps it.
`${kms+file:PATH}` (name left out)	As above, meaning the single key `[[kms_keys]]` declares.

Nested wrappers (${kms.a+kms.b+file:PATH}) are refused. A wrapped source that holds a plain keyring document is refused before the key is called.

Only [security.integrity].control_keyring and .audit_keyring accept the prefix. The other parameters in What accepts it refuse a ${kms...} value; the error names the parameter.

A wrapping key supports three actions:

Action	Given	Gets back
`unwrap`	ciphertext	the material
`wrap`	the material	ciphertext
`generate`	nothing	fresh material and its ciphertext, together, in one answer

authority init and keys rotate --prepare call generate for a wrapped keyring. wrap writes a wrapped keyring back; a keyring is wrapped as one document, so adding a key or converting from the five legacy key files calls it. Material is never passed in an argument. A nonzero exit is a refusal; a start that cannot reach the key stops. The output of a refused call is not copied into the error message.

For the exec kind, command runs with the action word appended. The rules of running a command apply: no shell, a 30-second timeout.

Action	Argument appended	Standard input	Standard output
`unwrap`	`unwrap`	the ciphertext	the material
`wrap`	`wrap`	the material	the ciphertext
`generate`	`generate`	nothing	`{"ciphertext":"...","plaintext":"..."}`, both base64

The native kinds perform the same three actions through their service's API; see [[kms_keys]] for the build features.

`[[kms_keys]]`¶

Used by: Authority.

External wrapping keys: what a ${kms.<name>+...} reference names, and what [authority].ca_kms_key names. A key here wraps and unwraps; it never leaves its service. A key-value secret store is read through exec: as a source and is not declared here. For Vault and OpenBao, provider = "vault" uses the transit engine.

Key	Type	Default	Purpose
`name`	string	required	What a wrapper names between `kms.` and `+`. See naming below.
`provider`	string	required	`exec`, `vault`, `aws`, or `gcp`. Which of the fields below this row reads.
`command`	array of strings	`[]`	Required for `exec`: the program and its arguments. The action word is appended when it runs. Arguments with spaces need no quoting.
`key`	string	`""`	Required for the native kinds. `vault`: the key name in the transit engine. `aws`: an ARN, alias, or key id. `gcp`: the key's full resource name.
`address`	string	`""`	Service base URL. Required for `vault`. Optional for `aws`: an interface or compliance endpoint to use in place of the region's public one. Not used by `gcp`.
`mount`	string	`""`	`vault` only: where the transit engine is mounted. Empty means `transit`.
`region`	string	`""`	`aws` only: which region the key lives in.

[[kms_keys]]
name     = "audit"
provider = "exec"
command  = ["/usr/local/bin/gdsgate-kms", "--key", "audit"]

[[kms_keys]]
name     = "audit"
provider = "vault"
address  = "https://vault.example.invalid:8200"
mount    = "kms-transit"
key      = "gdsgate-audit"

[[kms_keys]]
name     = "control"
provider = "aws"
region   = "eu-central-1"
key      = "arn:aws:kms:eu-central-1:123456789012:key/2f1c"

[[kms_keys]]
name     = "ca"
provider = "gcp"
key      = "projects/p/locations/europe-west1/keyRings/r/cryptoKeys/k"

Credentials for the native kinds come from the process environment. gdsgate stores none. Sources are read in this order; the first found is used:

Kind	Credentials
`vault`	`VAULT_TOKEN`, then `~/.vault-token`. `VAULT_NAMESPACE` sets the namespace; `VAULT_CACERT` names a private CA.
`aws`	`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` (with `AWS_SESSION_TOKEN` for temporary credentials), then container runtime credentials, then the instance role from the metadata service.
`gcp`	The service-account file in `GOOGLE_APPLICATION_CREDENTIALS`, then the instance identity from the metadata service.

Each native kind requires a build with its feature: kms-vault, kms-aws, or kms-gcp. exec is in every build. A key whose kind the binary lacks is refused at start-up; the error names the missing feature.

There is no pkcs11 kind. For a PKCS#11 hardware module, a KMIP device, or another key service, use provider = "exec" with a helper built against the vendor's library.

Naming a key¶

Declare separate keys for the control keyring and the audit keyring. Access to each can then be revoked separately at the key service. See [security.integrity]. Keys under different providers can be mixed.

A reference may leave the name out only while one key is declared; see Wrapping a source.

Supported service versions¶

vault works with Vault 1.18.5 and OpenBao 2.6.2.

The direct-encryption limit¶

AWS KMS encrypts at most 4096 bytes in one Encrypt or Decrypt call. A CA seed is 32 bytes. A wrapped keyring is sent as one document and fits up to 20 sealing keys or 14 signing keys. Retire old keys with keys rotate --retire to stay under the limit. A keyring over the limit is refused before anything is sent; the error names the limit and the size.

Top level¶

Used by: Authority, Proxy, Connector, and the foreground Resident client (profile); Authority (store_url, store_password_file, store_auto_migrate).

Key	Type	Default	Purpose
`cluster_id`	string (optional)	unset for legacy configurations	Stable cluster binding saved by connect/join. Registration checks it before sending a join token; certificate renewal preserves it. Do not copy it between clusters.
`profile`	string (optional)	unset, no deployment label	Deployment name. Labels service metrics, logs, and exported traces. The foreground Resident client labels its journal but exports no service metrics or traces.
`store_url`	string (optional)	unset, `~/.gdsgate/state/store.db` (persistent file SQLite)	Authority state backend: audit chain, transport CA private key, SSH CAs, registration tokens, resource catalog. SQLite (file or `:memory:`) or PostgreSQL. `:memory:` is for tests only.
`store_password_file`	string (optional)	unset	PostgreSQL password, kept out of `store_url`. A path or a secret reference.
`store_auto_migrate`	bool	`true`	A starting service applies pending schema migrations. With `false`, a store with pending migrations stops the process; the error names how many are pending and the command that applies them.

profile security endpoints store_url store_password_file store_auto_migrate enroll authority transport client proxy policy mcp mfa oidc identity workload ca_rotation ha approvals discovery connector agent_host recording admin audit telemetry doctor agent_profiles delegation_profiles kms_keys

profile = "prod-eu"
store_url = "postgres://gdsgate@store-db.example.invalid:5432/gdsgate"
store_auto_migrate = false   # schema changes are a step of the rollout

With profile set, each service Prometheus series carries profile="<value>", each structured service log line carries a profile field, and each exported trace carries a profile resource attribute. See Metrics and health.

The value is 1 to 64 bytes from A-Z a-z 0-9 . _ -, read once at start-up. Requests, headers and tokens cannot set it. Environment: GDSGATE_PROFILE.

An invalid value stops authority, proxy, connector, all, and gdsgate up --foreground at start; the error names the character. Other commands run without the label and print a warning on stderr. gdsgate doctor reports it as a config.profile finding.

store_url unset means a persistent SQLite file at ~/.gdsgate/state/store.db. Set it for PostgreSQL or another path. sqlite::memory: loses everything on restart.

store_password_file keeps the PostgreSQL password out of store_url, which then carries only the user (postgres://gdsgate@store-db.example.invalid:5432/gdsgate). Setting both this field and a password inside store_url is refused at start-up. A password inside store_url still works and is redacted in output; gdsgate doctor warns about it. Environment: GDSGATE_STORE_PASSWORD_FILE.

Set store_auto_migrate = false to apply schema changes as a separate step: run gdsgate authority store migrate once, then start the services. A store whose schema is newer than the binary is always refused. Environment: GDSGATE_STORE_AUTO_MIGRATE.

admin admin.endpoint admin.identity_dir admin.transport agent_host agent_host.id agent_host.scope agent_profiles agent_profiles[].checked agent_profiles[].config_args agent_profiles[].config_dir_env agent_profiles[].config_env agent_profiles[].config_format agent_profiles[].config_path agent_profiles[].model_config_key agent_profiles[].model_url_env agent_profiles[].model_url_path agent_profiles[].name agent_profiles[].note agent_profiles[].source agent_profiles[].tools_entry agent_profiles[].tools_key approvals approvals.min_approvers approvals.per_environment audit audit.anchor_key_path audit.approval_key_path audit.checkpoint_interval_secs audit.delegation_key_path audit.export_path audit.inventory_key_path audit.revocation_key_path audit.verify_interval_secs authority authority.agent_declaration_version authority.ca_kms_key authority.emergency_socket authority.enroll_cert_file authority.enroll_cert_from_cluster_ca authority.enroll_key_file ca_rotation ca_rotation.check_secs ca_rotation.enabled ca_rotation.interval_secs ca_rotation.proactive_secs ca_rotation.propagation_secs ca_rotation.retire_secs client client.access client.agent_auth_attempts_max client.agent_channel_ttl client.agent_frame_max client.agent_identities_max client.agent_key_source client.agent_resources client.agent_resources[].key client.agent_resources[].resource client.agent_signature_window client.agent_signatures_per_process client.agent_signatures_per_resource client.allow_insecure_http client.direct client.direct.basic_port_range client.direct.catalog_sync_secs client.direct.privileged_port_offset client.direct.v4_pool client.intercept_names client.local_user_only client.notify client.resolver client.step_up_on_denial client.transparent client.transparent.dns_zone client.transparent.reuse_grace_secs client.transparent.v4_pool client.transparent.v6_pool client.transport_ca client.transport_sni client.warm_access connector connector.authority_transport connector.backends connector.backends[].addr connector.backends[].admin connector.backends[].agent_auth_attempts_max connector.backends[].agent_identities_max connector.backends[].allow connector.backends[].allow_agent_forward connector.backends[].allow_elicitation_url connector.backends[].allow_encoded_separator connector.backends[].allow_fastpath_function connector.backends[].allow_local_forward connector.backends[].allow_port_forward connector.backends[].allow_remote_forward connector.backends[].allow_unpinned_upstream connector.backends[].allowed_backend_hosts connector.backends[].allowed_input_requests connector.backends[].allowed_models connector.backends[].allowed_query_params connector.backends[].allowed_request_headers connector.backends[].allowed_tools connector.backends[].api_url connector.backends[].audit connector.backends[].audit_command connector.backends[].auth_mode connector.backends[].ca_path connector.backends[].cage connector.backends[].cage.allow_degraded connector.backends[].cage.cpu_quota connector.backends[].cage.memory_max connector.backends[].cage.private_network connector.backends[].cage.private_tmp connector.backends[].cage.protect_home connector.backends[].cage.read_only_paths connector.backends[].cage.read_write_paths connector.backends[].cage.report_denied_paths connector.backends[].cage.restrict_address_families connector.backends[].cage.tasks_max connector.backends[].command connector.backends[].command_env connector.backends[].credential connector.backends[].credential_file connector.backends[].credential_format connector.backends[].credential_header connector.backends[].db_roles connector.backends[].db_roles[].db_user connector.backends[].db_roles[].name connector.backends[].db_roles[].read_only connector.backends[].decider_ca_path connector.backends[].decider_command connector.backends[].decider_command_env connector.backends[].decider_fail_closed connector.backends[].decider_timeout_ms connector.backends[].decider_url connector.backends[].decision_cache_ttl_secs connector.backends[].discovery connector.backends[].discovery.allowlist connector.backends[].discovery.connection connector.backends[].discovery.denylist connector.backends[].discovery.freshness_secs connector.backends[].discovery.interval_secs connector.backends[].discovery.label_selector connector.backends[].discovery.mode connector.backends[].discovery.password_file connector.backends[].discovery.scope connector.backends[].discovery.sources connector.backends[].enforce_query_categories connector.backends[].enforce_tool_policy connector.backends[].forwarded_headers connector.backends[].host_key_fingerprints connector.backends[].host_key_fingerprints_file connector.backends[].identity connector.backends[].identity_headers_trust_the_network connector.backends[].inspect connector.backends[].kind connector.backends[].login_mode connector.backends[].login_user connector.backends[].login_users connector.backends[].max_request_bytes connector.backends[].onward_auth connector.backends[].pin_tool_descriptors connector.backends[].record_request connector.backends[].record_response connector.backends[].refuse_unfiltered_tool_listing connector.backends[].repository_root connector.backends[].audio connector.backends[].clipboard connector.backends[].clipboard_files connector.backends[].drives connector.backends[].graphics connector.backends[].host_cert_fingerprints connector.backends[].host_cert_fingerprints_file connector.backends[].ports connector.backends[].printers connector.backends[].record connector.backends[].record_max_bytes connector.backends[].smart_cards connector.backends[].resource connector.backends[].routed_ranges connector.backends[].routes connector.backends[].routes[].audit connector.backends[].routes[].match connector.backends[].routes[].name connector.backends[].service_account connector.backends[].service_account_password_file connector.backends[].service_account_tls_ca_file connector.backends[].session connector.backends[].session.cpu_quota connector.backends[].session.kill_on_close connector.backends[].session.memory_max connector.backends[].session.tasks_max connector.backends[].shell connector.backends[].settable_parameters connector.backends[].ssh_profile connector.backends[].statement_timeout_ms connector.backends[].token_path connector.backends[].url connector.backends[].websocket connector.backends[].windows_user connector.backends[].windows_users connector.backends[].windows_users[].account connector.backends[].windows_users[].credential_file connector.git connector.git.git_lfs_authenticate connector.git.git_receive_pack connector.git.git_upload_archive connector.git.git_upload_pack connector.git.lfs_batch_body_max connector.id connector.proxy_connection_count delegation_profiles delegation_profiles[].agent_profile delegation_profiles[].can delegation_profiles[].env delegation_profiles[].exec delegation_profiles[].exec_args delegation_profiles[].model delegation_profiles[].name delegation_profiles[].renewable delegation_profiles[].sandbox delegation_profiles[].sandbox_allow delegation_profiles[].sandbox_cpu delegation_profiles[].sandbox_listen delegation_profiles[].sandbox_memory delegation_profiles[].sandbox_processes delegation_profiles[].ttl_secs discovery discovery.auto_scopes discovery.auto_scopes[].accept_label_keys discovery.auto_scopes[].enabled discovery.auto_scopes[].environment discovery.auto_scopes[].fallback discovery.auto_scopes[].id_prefix discovery.auto_scopes[].kinds discovery.auto_scopes[].labels discovery.auto_scopes[].lease_secs discovery.auto_scopes[].max_live discovery.auto_scopes[].node discovery.auto_scopes[].onward_auth discovery.auto_scopes[].project discovery.auto_scopes[].ssh_host_key discovery.import_rules discovery.import_rules[].environment discovery.import_rules[].labels discovery.import_rules[].match discovery.lease_sweep_secs discovery.resources discovery.resources[].aliases discovery.resources[].hostname discovery.resources[].id discovery.resources[].kind discovery.resources[].min_approvers discovery.resources[].native_name discovery.resources[].onward_auth discovery.resources[].pin_tool_descriptors discovery.resources[].port discovery.resources[].project discovery.resources[].ssh_profile discovery.resources[].web_profile doctor doctor.check_interval_secs endpoints endpoints.authority endpoints.authority_enroll endpoints.authority_enroll_failover endpoints.authority_failover endpoints.proxy_internal endpoints.proxy_join endpoints.proxy_public endpoints.proxy_ws enroll enroll.background_renewal enroll.endpoint enroll.node_name enroll.renew_endpoint enroll.state_dir enroll.token enroll.transport_ca enroll.transport_sni ha ha.authority_peers ha.enabled ha.keyring_sync ha.keyring_sync.bootstrap_endpoint ha.keyring_sync.bootstrap_fingerprint ha.keyring_sync.bootstrap_token ha.keyring_sync.enabled ha.keyring_sync.generation_kms_key ha.keyring_sync.initialize ha.keyring_sync.poll_secs ha.keyring_sync.state_dir ha.lease_ttl_secs ha.max_cluster_sessions ha.owner ha.renew_secs identity identity.allow_system_groups identity.max_groups identity.max_length kms_keys kms_keys[].address kms_keys[].command kms_keys[].key kms_keys[].mount kms_keys[].name kms_keys[].provider kms_keys[].region mcp mcp.destructive_patterns mfa mfa.webauthn mfa.webauthn.allow_any_port mfa.webauthn.allow_localhost mfa.webauthn.origins mfa.webauthn.rp_id mfa.webauthn.rp_origin oidc oidc.allow_insecure_http oidc.audience oidc.client_id oidc.display_name_claims oidc.browser oidc.browser.callback_port oidc.claims oidc.claims.email oidc.claims.preferred_username oidc.claims.groups oidc.claims.groups.path oidc.claims.groups.format oidc.claims.groups.delimiter oidc.claims.groups.required oidc.device oidc.device.interval oidc.device.expires_in oidc.device.pending_errors oidc.parameters oidc.parameters.authorization oidc.parameters.device_authorization oidc.parameters.token oidc.parameters.refresh oidc.resource oidc.scopes oidc.id_token_signing_algs oidc.issuer oidc.jwks_refresh_secs oidc.request_timeout_secs policy policy.editor policy.editor.break_glass_policy_file policy.editor.min_approvers policy.path profile proxy proxy.abandoned_session_grace_secs proxy.internal_accept_burst proxy.internal_accept_rate_per_ip proxy.join_accept_burst proxy.join_accept_rate_per_ip proxy.join_idle_timeout_secs proxy.join_max_connections proxy.join_peek_timeout_secs proxy.max_bytes_per_second_per_session proxy.max_peer_connections proxy.max_peer_requests proxy.max_peer_sessions proxy.max_public_connections proxy.max_sessions proxy.max_streams_per_tunnel proxy.peer_addr proxy.peer_listen proxy.public_admin_max_connections proxy.public_anonymous_burst proxy.public_anonymous_rate_per_ip proxy.public_cert_file proxy.public_join proxy.public_join_burst proxy.public_join_rate_per_ip proxy.public_key_file proxy.public_origin proxy.public_proxy_protocol_from proxy.public_renewal_max_connections proxy.session_rate_burst_bytes proxy.single_port proxy.web_addr proxy.web_cert_file proxy.web_key_file proxy.webapps_addr proxy.webapps_cert_file proxy.webapps_key_file proxy.webapps_proxy_protocol_from proxy.webapps_session_ttl_secs proxy.webapps_zone recording recording.capture_stdin recording.mode recording.sweep_interval_secs security security.integrity security.integrity.audit_keyring security.integrity.control_keyring security.profile store_auto_migrate store_password_file store_url telemetry telemetry.metrics_listen telemetry.otel_endpoint transport transport.cert_ttl_secs transport.front_sni workload workload.cert_ttl_secs workload.issuers workload.issuers[].audience workload.issuers[].groups workload.issuers[].issuer workload.issuers[].owner_claim workload.issuers[].owner_service workload.issuers[].path_template workload.issuers[].single_use_jti workload.issuers[].slug workload.trust_domain connector.discovery_sources connector.discovery_sources[].api_url connector.discovery_sources[].ca_path connector.discovery_sources[].discovery connector.discovery_sources[].discovery.allowlist connector.discovery_sources[].discovery.connection connector.discovery_sources[].discovery.denylist connector.discovery_sources[].discovery.freshness_secs connector.discovery_sources[].discovery.interval_secs connector.discovery_sources[].discovery.label_selector connector.discovery_sources[].discovery.mode connector.discovery_sources[].discovery.password_file connector.discovery_sources[].discovery.scope connector.discovery_sources[].discovery.sources connector.discovery_sources[].id connector.discovery_sources[].kind connector.discovery_sources[].token_path ha.keyring_sync.root_kms_key

Environment overrides¶

Each variable below overrides the file when it is set.

Variable	Overrides
`GDSGATE_PROFILE`	`profile`
`GDSGATE_STORE_URL`	`store_url`
`GDSGATE_STORE_PASSWORD_FILE`	`store_password_file`
`GDSGATE_STORE_AUTO_MIGRATE`	`store_auto_migrate`
`GDSGATE_AUTH_ADDR`	`endpoints.authority`
`GDSGATE_AUTH_ENROLL_ADDR`	`endpoints.authority_enroll`
`GDSGATE_PROXY_PUBLIC_ADDR`	`endpoints.proxy_public`
`GDSGATE_PROXY_INTERNAL_ADDR`	`endpoints.proxy_internal`
`GDSGATE_PROXY_WS_ADDR`	`endpoints.proxy_ws`
`GDSGATE_PROXY_JOIN_ADDR`	`endpoints.proxy_join`
`GDSGATE_ENROLL_ENDPOINT`	`enroll.endpoint`
`GDSGATE_ENROLL_TOKEN`	`enroll.token`
`GDSGATE_ENROLL_STATE_DIR`	`enroll.state_dir`
`GDSGATE_ENROLL_RENEW_ENDPOINT`	`enroll.renew_endpoint`
`GDSGATE_ENROLL_NODE_NAME`	`enroll.node_name`
`GDSGATE_CLIENT_TRANSPORT_CA`	`client.transport_ca`
`GDSGATE_CLIENT_TRANSPORT_SNI`	`client.transport_sni`
`GDSGATE_CLIENT_ALLOW_INSECURE_HTTP`	`client.allow_insecure_http`
`GDSGATE_PROXY_SINGLE_PORT`	`proxy.single_port`
`GDSGATE_PROXY_PEER_ADDR`	`proxy.peer_addr`
`GDSGATE_PROXY_PEER_LISTEN`	`proxy.peer_listen`
`GDSGATE_POLICY_PATH`	`policy.path`
`GDSGATE_OIDC_ISSUER`	`oidc.issuer`
`GDSGATE_OIDC_CLIENT_ID`	`oidc.client_id`
`GDSGATE_OIDC_AUDIENCE`	`oidc.audience`
`GDSGATE_OIDC_ALLOW_INSECURE_HTTP`	`oidc.allow_insecure_http`
`GDSGATE_OIDC_JWKS_REFRESH_SECS`	`oidc.jwks_refresh_secs`
`GDSGATE_OIDC_REQUEST_TIMEOUT_SECS`	`oidc.request_timeout_secs`
`GDSGATE_IDENTITY_ALLOW_SYSTEM_GROUPS`	`identity.allow_system_groups`
`GDSGATE_IDENTITY_MAX_LENGTH`	`identity.max_length`
`GDSGATE_IDENTITY_MAX_GROUPS`	`identity.max_groups`
`GDSGATE_CONNECTOR_ID`	`connector.id`
`GDSGATE_CONNECTOR_AUTH_TRANSPORT`	`connector.authority_transport`
`GDSGATE_CA_ROTATION_ENABLED`	`ca_rotation.enabled`
`GDSGATE_CA_ROTATION_INTERVAL_SECS`	`ca_rotation.interval_secs`
`GDSGATE_CA_ROTATION_PROACTIVE_SECS`	`ca_rotation.proactive_secs`
`GDSGATE_CA_ROTATION_PROPAGATION_SECS`	`ca_rotation.propagation_secs`
`GDSGATE_CA_ROTATION_RETIRE_SECS`	`ca_rotation.retire_secs`
`GDSGATE_CA_ROTATION_CHECK_SECS`	`ca_rotation.check_secs`
`GDSGATE_HA_ENABLED`	`ha.enabled`
`GDSGATE_HA_OWNER`	`ha.owner`
`GDSGATE_HA_LEASE_TTL_SECS`	`ha.lease_ttl_secs`
`GDSGATE_HA_RENEW_SECS`	`ha.renew_secs`
`GDSGATE_AUDIT_ANCHOR_KEY_PATH`	`audit.anchor_key_path` (deprecated)
`GDSGATE_AUDIT_APPROVAL_KEY_PATH`	`audit.approval_key_path` (deprecated)
`GDSGATE_AUDIT_REVOCATION_KEY_PATH`	`audit.revocation_key_path` (deprecated)
`GDSGATE_AUDIT_DELEGATION_KEY_PATH`	`audit.delegation_key_path` (deprecated)
`GDSGATE_AUDIT_INVENTORY_KEY_PATH`	`audit.inventory_key_path` (deprecated)
`GDSGATE_AUDIT_EXPORT_PATH`	`audit.export_path`
`GDSGATE_TELEMETRY_METRICS_LISTEN`	`telemetry.metrics_listen`
`GDSGATE_TELEMETRY_OTEL_ENDPOINT`	`telemetry.otel_endpoint`
`GDSGATE_ADMIN_ENDPOINT`	`admin.endpoint`
`GDSGATE_ADMIN_IDENTITY_DIR`	`admin.identity_dir`
`GDSGATE_ADMIN_TRANSPORT`	`admin.transport`

GDSGATE_ADMIN_ENDPOINT GDSGATE_ADMIN_IDENTITY_DIR GDSGATE_ADMIN_TRANSPORT GDSGATE_AUDIT_ANCHOR_KEY_PATH GDSGATE_AUDIT_APPROVAL_KEY_PATH GDSGATE_AUDIT_DELEGATION_KEY_PATH GDSGATE_AUDIT_EXPORT_PATH GDSGATE_AUDIT_INVENTORY_KEY_PATH GDSGATE_AUDIT_REVOCATION_KEY_PATH GDSGATE_AUTH_ADDR GDSGATE_AUTH_ENROLL_ADDR GDSGATE_CA_ROTATION_CHECK_SECS GDSGATE_CA_ROTATION_ENABLED GDSGATE_CA_ROTATION_INTERVAL_SECS GDSGATE_CA_ROTATION_PROACTIVE_SECS GDSGATE_CA_ROTATION_PROPAGATION_SECS GDSGATE_CA_ROTATION_RETIRE_SECS GDSGATE_CLIENT_ALLOW_INSECURE_HTTP GDSGATE_CLIENT_TRANSPORT_CA GDSGATE_CLIENT_TRANSPORT_SNI GDSGATE_CONNECTOR_AUTH_TRANSPORT GDSGATE_CONNECTOR_ID GDSGATE_ENROLL_ENDPOINT GDSGATE_ENROLL_NODE_NAME GDSGATE_ENROLL_RENEW_ENDPOINT GDSGATE_ENROLL_STATE_DIR GDSGATE_ENROLL_TOKEN GDSGATE_HA_ENABLED GDSGATE_HA_LEASE_TTL_SECS GDSGATE_HA_OWNER GDSGATE_HA_RENEW_SECS GDSGATE_IDENTITY_ALLOW_SYSTEM_GROUPS GDSGATE_IDENTITY_MAX_GROUPS GDSGATE_IDENTITY_MAX_LENGTH GDSGATE_OIDC_ALLOW_INSECURE_HTTP GDSGATE_OIDC_AUDIENCE GDSGATE_OIDC_CLIENT_ID GDSGATE_OIDC_ISSUER GDSGATE_OIDC_JWKS_REFRESH_SECS GDSGATE_OIDC_REQUEST_TIMEOUT_SECS GDSGATE_POLICY_PATH GDSGATE_PROFILE GDSGATE_PROXY_INTERNAL_ADDR GDSGATE_PROXY_JOIN_ADDR GDSGATE_PROXY_PEER_ADDR GDSGATE_PROXY_PEER_LISTEN GDSGATE_PROXY_PUBLIC_ADDR GDSGATE_PROXY_SINGLE_PORT GDSGATE_PROXY_WS_ADDR GDSGATE_STORE_AUTO_MIGRATE GDSGATE_STORE_PASSWORD_FILE GDSGATE_STORE_URL GDSGATE_TELEMETRY_METRICS_LISTEN GDSGATE_TELEMETRY_OTEL_ENDPOINT

Client-only variables:

Variable	Purpose
`GDSGATE_ID_TOKEN`	Identity token a client command should present (headless / CI).
`GDSGATE_USER`	Local-dev principal name when no `[oidc]` is configured.
`RUST_LOG`	Log filter. Default `warn,gdsgate=info`: `gdsgate*` at INFO, everything else at WARN. A set value replaces the default.

[[connector.backends]] has no environment override.