Configuration file reference

Every configuration file isg reads, and every key it accepts in one.

Keys are listed as dotted paths in Go struct-declaration order, not alphabetically: that is the order the shipped *.example.yaml files follow, so the two read side by side. A [] segment marks a list — rules[].pattern is the pattern key of each element of rules.

Files live under the config root — $ISG_HOME, or /var/lib/isg in the system-unit layout. Every one of them is optional; each loader defines what its file's absence means, and a config root with no files at all is a valid first-run state.

A top-level key not listed here REFUSES isg serve's start, with no escape switch (BACKLOG B192). Nested keys are NOT checked — see internal/configkeys' package doc for why that limit is where it is, and do not read a clean start as evidence that a nested key is spelled right.

Where a file has more than one consumer, the keys below are the UNION of what those structs declare, because that is what the gate enforces. Each file ships an example at the repository root; that one-to-one correspondence is not a convention but a tested invariant, in both directions (cmd/isg/config_keys_test.go's TestConfigKeyRegistryCoversEveryExampleFile), so the links below cannot go stale without a red test.

`agent.yaml`

Consumers: agent.Config
Example: agent.example.yaml

Key	Type
`ca_renew_url`	`string`
`ca_cert`	`string`
`host`	`string`
`renewable_cert`	`string`
`renewable_key`	`string`
`access_cert`	`string`
`access_key`	`string`
`renew_interval`	`agent.Duration`

`apps.yaml`

Consumers: appproxy.Config
Example: apps.example.yaml

Key	Type
`listen`	`string`
`tls_cert_file`	`string`
`tls_key_file`	`string`
`webui_url`	`string`
`assertion_key_file`	`string`
`assertion_issuer`	`string`
`assertion_ttl_seconds`	`int`
`idle_timeout_seconds`	`int`
`max_duration_seconds`	`int`
`reserved_usernames`	`[]string`
`credential_kv_prefix`	`string`
`apps[]`	`[]appproxy.App`
`apps[].id`	`string`
`apps[].name`	`string`
`apps[].display_name`	`string`
`apps[].host`	`string`
`apps[].upstream`	`string`
`apps[].upstream_ca_file`	`string`
`apps[].identity`	`string`
`apps[].audience`	`string`
`apps[].assertion_header`	`string`
`apps[].allow_groups`	`[]string`
`apps[].role_map[]`	`[]appproxy.RoleMap`
`apps[].role_map[].group`	`string`
`apps[].role_map[].role`	`string`
`apps[].default_role`	`string`
`apps[].reserved_usernames`	`[]string`
`apps[].logout_paths`	`[]string`
`apps[].record_query`	`bool`
`apps[].record_body`	`bool`
`apps[].record_body_max_bytes`	`int`
`apps[].record_body_mask_fields`	`[]string`
`apps[].credentials[]`	`[]appproxy.Credential`
`apps[].credentials[].name`	`string`
`apps[].credentials[].groups`	`[]string`
`apps[].credentials[].kind`	`string`
`apps[].credentials[].header`	`string`
`apps[].credentials[].form`	`*appproxy.FormLogin`
`apps[].credentials[].form.steps[]`	`[]appproxy.FormStep`
`apps[].credentials[].form.steps[].method`	`string`
`apps[].credentials[].form.steps[].path`	`string`
`apps[].credentials[].form.steps[].encoding`	`string`
`apps[].credentials[].form.steps[].fields`	`appproxy.FormFields`
`apps[].credentials[].form.steps[].extract[]`	`[]appproxy.FormExtract`
`apps[].credentials[].form.steps[].extract[].name`	`string`
`apps[].credentials[].form.steps[].extract[].from`	`string`
`apps[].credentials[].form.steps[].extract[].regex`	`string`
`apps[].credentials[].form.success`	`appproxy.FormSuccess`
`apps[].credentials[].form.success.status`	`[]int`
`apps[].credentials[].form.success.cookie`	`string`
`apps[].credentials[].form.success.redirect_prefix`	`string`
`apps[].credentials[].form.logged_out`	`appproxy.FormLoggedOut`
`apps[].credentials[].form.logged_out.status`	`[]int`
`apps[].credentials[].form.logged_out.redirect_prefix`	`string`
`apps[].credentials[].form.logged_out.unless_body_contains`	`[]string`
`apps[].credentials[].form.browser_cookies`	`[]string`
`apps[].require_approval`	`bool`
`apps[].approval_timeout_seconds`	`int`
`apps[].approval_max_grant_seconds`	`int`
`apps[].approval_single_use`	`bool`
`apps[].approval_mode`	`string`
`apps[].approval_reason_min_len`	`*int`
`apps[].approval_reason_pattern`	`string`
`apps[].level`	`int`
`apps[].mode`	`string`
`apps[].rdp_cert_fingerprints`	`[]string`
`apps[].rdp_ignore_cert`	`bool`
`apps[].viewer_grace_seconds`	`int`
`dynamic_apps_domain`	`string`

`audit.yaml`

Consumers: auditcfg.Config
Example: audit.example.yaml

Key	Type
`strict`	`auditcfg.StrictConfig`
`strict.cert_issued`	`bool`
`strict.break_glass_approval_bypassed`	`bool`
`syslog`	`auditcfg.SyslogConfig`
`syslog.enabled`	`bool`
`syslog.address`	`string`
`syslog.tls_ca_file`	`string`
`syslog.timeout_seconds`	`int`
`syslog.facility`	`string`
`syslog.app_name`	`string`
`syslog.queue_size`	`int`

`breakglass.yaml`

Consumers: main.breakglassFileConfig
Example: breakglass.example.yaml

Key	Type
`breakglass_log_target`	`string`
`breakglass_log_protocol`	`string`
`breakglass_ca_fingerprint`	`string`
`breakglass_drill_max_age_days`	`*int`

`broker.yaml`

Consumers: brokercfg.Config
Example: broker.example.yaml

Key	Type
`id`	`string`
`public_name`	`string`
`ssh_port`	`int`

`ca.yaml`

Consumers: ca.IssuancePolicy, ca.signerModeYAML
Example: ca.example.yaml

Key	Type
`service_accounts[]`	`[]ca.ServiceAccountSpec`
`service_accounts[].account`	`string`
`service_accounts[].principal`	`string`
`service_accounts[].hosts`	`[]string`
`service_accounts[].ttl_seconds`	`int`
`renewable_ttl_days`	`int`
`host_cert_ttl`	`string`
`human_access`	`*ca.HumanAccessConfig`
`human_access.enforce`	`bool`
`human_access.requested_by_enforce`	`bool`
`human_access.require_broker`	`bool`
`human_access.require_broker_host_labels`	`map[string]string`
`human_access.allow[]`	`[]ca.HumanAccessRule`
`human_access.allow[].principals`	`[]string`
`human_access.allow[].requested_by`	`[]string`
`human_access.allow[].require_group`	`string`
`human_access.allow[].host_labels`	`map[string]string`
`human_access.allow[].hosts`	`[]string`
`issue_requester_authz`	`*ca.IssueRequesterAuthzConfig`
`issue_requester_authz.enforce`	`bool`
`signer`	`string`

`cmdb.yaml`

Consumers: inventory.CMDBConfig
Example: cmdb.example.yaml

Key	Type
`resolver`	`string`
`mock_file`	`string`
`label_rules[]`	`[]inventory.LabelRule`
`label_rules[].label`	`string`
`label_rules[].value`	`string`
`label_rules[].level`	`int`
`default_level`	`int`
`cache_ttl`	`int`
`on_unavailable`	`string`
`miss_level`	`*int`

`connect.yaml`

Consumers: connectcfg.Config
Example: connect.example.yaml

Key	Type
`allow_password_auth`	`bool`
`host_key_check`	`string`
`human_auth`	`string`
`target_domain`	`string`

`diag.yaml`

Consumers: diagcfg.Config
Example: diag.example.yaml

Key	Type
`enabled`	`bool`
`listen`	`string`
`auth_token`	`string`
`per_host_labels`	`bool`
`scrape_staleness_warn`	`string`

`hostgroup.yaml`

Consumers: hostgroupcfg.Config
Example: hostgroup.example.yaml

Key	Type
`label_required_groups`	`map[string][]string`
`enforce`	`bool`

`jira.yaml`

Consumers: ticket.Config
Example: jira.example.yaml

Key	Type
`provider`	`string`
`endpoint`	`string`
`project_key`	`string`
`auth_email`	`string`
`auth_token`	`string`
`outbox_path`	`string`
`ticket_min_level`	`*int`
`timeout_seconds`	`int`
`webui_base_url`	`string`
`browse_base_url`	`string`
`disabled`	`bool`
`auth_token_expires_at`	`string`

`ldap.yaml`

Consumers: main.ldapFileConfig
Example: ldap.example.yaml

Key	Type
`url`	`string`
`start_tls`	`bool`
`tls_ca_file`	`string`
`allow_plaintext`	`bool`
`bind_dn`	`string`
`bind_password`	`string`
`base_dn`	`string`
`group_base_dn`	`string`
`user_attr`	`string`
`role_attr`	`string`
`display_name_attr`	`string`
`timeout_seconds`	`int`
`approver_group`	`string`
`approver_group_required`	`bool`
`mfa_reset_group`	`string`
`mfa_reset_group_required`	`bool`
`ca_admin_group`	`string`
`ca_admin_group_required`	`bool`
`session_admin_group`	`string`
`session_admin_group_required`	`bool`
`auditor_group`	`string`
`breakglass_group`	`string`
`breakglass_group_required`	`bool`
`service_account_marker_attr`	`string`
`service_account_marker_value`	`string`
`service_account_gate_group`	`string`

`license.yaml`

Consumers: license.File
Example: license.example.yaml

Key	Type
`key_id`	`string`
`payload`	`string`
`signature`	`string`

`mfa.yaml`

Consumers: mfacfg.Config
Example: mfa.example.yaml

Key	Type
`pre_auth_ttl_seconds`	`int`
`user_max_attempts`	`int`
`user_lockout_seconds`	`int`
`ip_max_attempts`	`int`
`ip_lockout_seconds`	`int`
`mfa_mode`	`string`
`gateway_session_step_up`	`bool`
`store`	`string`
`lockout_mode`	`string`

`notify.yaml`

Consumers: notify.Config
Example: notify.example.yaml

Key	Type
`webhook`	`*notify.WebhookConfig`
`webhook.url`	`string`
`outbox`	`*notify.OutboxConfig`
`outbox.path`	`string`
`lock_mail`	`notify.LockMailConfig`
`lock_mail.enabled`	`bool`
`lock_mail.mail_locked_user`	`bool`

`policy.yaml`

Consumers: policy.Config
Example: policy.example.yaml

Key	Type
`version`	`string`
`rules[]`	`[]policy.RuleSpec`
`rules[].name`	`string`
`rules[].pattern`	`string`
`rules[].category`	`string`
`rules[].action`	`string`
`rules[].reason`	`string`
`rules[].timeout_seconds`	`int`
`rules[].min_level`	`int`
`rules[].roles`	`[]string`
`require_recording`	`bool`
`idle_timeout_seconds`	`int`
`max_duration_seconds`	`int`
`sudo_allowed_commands`	`[]string`
`dynamic_construct_action`	`string`
`http_rules[]`	`[]policy.HTTPRuleSpec`
`http_rules[].name`	`string`
`http_rules[].action`	`string`
`http_rules[].apps`	`[]string`
`http_rules[].methods`	`[]string`
`http_rules[].path`	`string`
`http_rules[].roles`	`[]string`
`http_rules[].when`	`*policy.HTTPWhenSpec`
`http_rules[].when.days`	`[]string`
`http_rules[].when.time`	`string`
`http_rules[].when.dates`	`string`
`http_rules[].when.source`	`[]string`
`http_rules[].reason`	`string`
`http_rules[].valid_for`	`string`
`http_app_modes[]`	`[]policy.HTTPAppModeSpec`
`http_app_modes[].apps`	`[]string`
`http_app_modes[].mode`	`string`
`rdp_channels[]`	`[]policy.RDPChannelRuleSpec`
`rdp_channels[].name`	`string`
`rdp_channels[].apps`	`[]string`
`rdp_channels[].roles`	`[]string`
`rdp_channels[].allow`	`[]string`
`timezone`	`string`

`rbi-agent.yaml`

Consumers: rbiagent.Config
Example: rbi-agent.example.yaml

Key	Type
`brokers`	`[]string`
`server_name`	`string`
`ca_cert`	`string`
`identity_cert`	`string`
`identity_key`	`string`
`sessions_dir`	`string`
`recordings_dir`	`string`
`image`	`string`
`memory`	`string`
`pids_limit`	`int`
`max_sessions`	`int`
`podman`	`string`

`rbi.yaml`

Consumers: rbi.Config
Example: rbi.example.yaml

Key	Type
`agents[]`	`[]rbi.AgentConfig`
`agents[].name`	`string`
`agents[].guacd`	`string`
`guacd_ca_file`	`string`
`app_ca_file`	`string`
`session_start_timeout_seconds`	`int`
`poll_wait_seconds`	`int`
`agent_stale_seconds`	`int`
`viewer_grace_seconds`	`int`
`recording_max_mb`	`int`

`retention.yaml`

Consumers: retention.Config
Example: retention.example.yaml

Key	Type
`session_records`	`retention.Rule`
`session_records.minimum_retention`	`string`
`session_records.retention_period`	`string`
`approval_records`	`retention.Rule`
`approval_records.minimum_retention`	`string`
`approval_records.retention_period`	`string`
`recordings`	`retention.Rule`
`recordings.minimum_retention`	`string`
`recordings.retention_period`	`string`
`transcripts`	`retention.Rule`
`transcripts.minimum_retention`	`string`
`transcripts.retention_period`	`string`
`sweep`	`retention.SweepConfig`
`sweep.enabled`	`bool`
`sweep.interval`	`string`

`servers.yaml`

Consumers: inventory.Config
Example: servers.example.yaml

Key	Type
`default_level`	`int`
`servers`	`map[string]int`

`smtp.yaml`

Consumers: auth.SMTPConfig
Example: smtp.example.yaml

Key	Type
`host`	`string`
`port`	`int`
`from`	`string`
`username`	`string`
`password`	`string`
`tls`	`bool`
`timeout_seconds`	`int`

`sso.yaml`

Consumers: ssocfg.Config
Example: sso.example.yaml

Key	Type
`enabled`	`bool`
`issuer`	`string`
`client_id`	`string`
`client_secret_file`	`string`
`redirect_url`	`string`
`scopes`	`[]string`
`username_claim`	`string`
`mfa`	`string`
`idp_mfa_amr`	`[]string`
`idp_mfa_acr`	`string`
`web`	`string`
`cli`	`string`
`device_max_rounds`	`int`
`rp_logout`	`string`
`protocol`	`string`
`saml_idp_metadata_url`	`string`
`saml_idp_metadata_file`	`string`
`saml_sp_entity_id`	`string`
`saml_acs_url`	`string`
`saml_username_attribute`	`string`
`saml_use_name_id`	`bool`
`saml_idp_mfa_authn_context`	`[]string`
`saml_clock_skew_seconds`	`int`

`storage.yaml`

Consumers: streamstore.Config, recordstore.Config
Example: storage.example.yaml

Key	Type
`recordings`	`streamstore.RecordingsConfig`
`recordings.backend`	`string`
`recordings.dir`	`streamstore.DirConfig`
`recordings.dir.path`	`string`
`recordings.s3`	`streamstore.S3Config`
`recordings.s3.endpoint`	`string`
`recordings.s3.bucket`	`string`
`recordings.s3.prefix`	`string`
`recordings.s3.region`	`string`
`recordings.s3.path_style`	`bool`
`recordings.s3.credentials_file`	`string`
`records`	`recordstore.RecordsConfig`
`records.backend`	`string`
`records.postgres`	`recordstore.PostgresConfig`
`records.postgres.dsn_file`	`string`
`records.postgres.dsn_ro_file`	`string`

`tls.yaml`

Consumers: tlscfg.Config
Example: tls.example.yaml

Key	Type
`webui`	`tlscfg.WebUIConfig`
`webui.cert_file`	`string`
`webui.key_file`	`string`

`vault.yaml`

Consumers: vaultsigner.Config, vaultkv.Config
Example: vault.example.yaml

Key	Type
`address`	`string`
`token_file`	`string`
`ssh_mount`	`string`
`roles`	`vaultsigner.Roles`
`roles.access`	`string`
`roles.human`	`string`
`roles.host`	`string`
`timeout_seconds`	`int`
`tls_ca_file`	`string`
`kv_mount`	`string`
`kv_path_prefix`	`string`