Transport configuration

Paths in the tables are relative to [transport]. Check parsing and cross-field rules with gdsgate doctor --config <PATH> --json. See the registration and CA guide.

[transport]

Used by: Authority, Proxy, Connector.

Lifetime of node transport certificates, and the cluster name on a front shared by several clusters.

Key	Type	Default	Purpose
cert_ttl_secs	int	86400	Validity of an issued transport certificate, in seconds. Minimum 120. Read on Authority.
front_sni	string	unset	The name this cluster answers to on a front shared by several clusters. Unset: not used. See The name a shared front routes on.

[transport]
cert_ttl_secs = 86400
# front_sni = "acme-proxy.gate.example.com"

Authority applies cert_ttl_secs to every certificate it signs: registration, token-less renewal, and its own certificate. Set it on the Authority host. Node renewal timings scale with it:

	24 h (default)	3 min
Renewal starts with	1 h left	90 s left
Sleep between looks, at most	5 min	11 s
One attempt may take	30 s	11 s
Backoff after a failure	30 s to 10 min	11 s to 22 s
Calls to Authority per node	about 1 per day	about 1 per 90 s

Certificate TTL and renewal load

Each renewal is a mutual-TLS handshake, a CA signature and an audit write on the Authority write leader. At three minutes, 1000 nodes make about 11 renewals per second. Use short values only on test clusters.

The time left when renewal starts is how long Authority may be unreachable: one hour at the default, 90 seconds at three minutes.

Authority refuses to start with a value below 120; the error says why.

This key does not affect workload certificates ([workload].cert_ttl_secs), User SSH and Onward SSH certificates, or CA generations ([ca_rotation]).

The name a shared front routes on

A front shared by several clusters routes by the TLS server name. Client and registration connections carry the cluster's public name. A connector's reverse tunnel and token-less renewal use internal names (tunnel.gdsgate.internal, proxy.gdsgate.internal) that are the same in every cluster, so the front cannot route them.

front_sni is the server name the cluster uses on those connections. Set it to the cluster's gateway name, the name that resolves to the front.

Authority adds the name to the transport certificate of every role that terminates TLS, next to the role names. Nodes send it on tunnel and renewal connections; a connector sends it on both the gRPC and WebSocket legs of its tunnel.

Set it only on Authority. Authority advertises it when it issues a node's identity, and gdsgate join writes it into the node's [transport] section; see What Authority tells a joining node. Until the node certificates carry the name, a node that sends it fails the handshake.

Changing front_sni on a running cluster

A running node keeps the name it started with. Change it on Authority, then run gdsgate join --if-missing on each node. The command rewrites the file and reports that a restart is needed; restart the node.