Configuration

Set CONFIG_PATH to an absolute configuration file path. Without it, the file loader searches for config.yaml or another supported config file format in the process's current directory and its parents. The application validates the loaded configuration at startup.

Environment variables override file settings. Use the uppercase TSG__ prefix, double underscores between path segments and snake case for camel-case keys. For example, TSG__SERVER__PUBLIC_ADDRESS overrides server.publicAddress.

Databases

By default, the development database is sqlite. We use postgres databases for production type instances of the http data planes.

Signaling identities

See Signaling authentication for the deployment-controlled signalingClients mapping and token claims.

Tenant authorization

See SSO multi-tenancy for manager identities, explicit client kinds and principal mappings. SSO always uses managed authorization. Browser services require stable SESSION_SECRET and TENANCY_SECRET values and durable shared session storage.

Configuration parameters

Key	Required	Type	Description	Default
ManagedSignalingTargetConfig
managedSignalingTargets		ManagedSignalingTargetConfig[]	Shared worker audiences and logical control-plane identities; workload authority still requires a current tenant grant	[]
managedSignalingTargets[].audience	Yes	String	Shared worker audience (its dataplaneId); tokens for it are only issued to managed tenant workloads
managedSignalingTargets[].identity	Yes	String	Logical control-plane identity carried in client_id; must match the worker's controlPlane.controlplaneId
oid4vpLoginMappings		Object	Explicit OID4VP credential issuer/subject to existing login user ID mappings; email and credential roles do not establish platform authority	[]
SsoTenancyConfig
tenancy		SsoTenancyConfig	SSO tenant authorization configuration
tenancy.serviceInstanceId		String	Operator-registered receiving SSO service instance	"sso"
tenancy.platformUserIds		String	Explicit local login user IDs with platform authority; never inferred from tenant roles or credentials	[]
tenancy.trustedBrowserClients		String	Operator-approved first-party shared browser client IDs allowed to complete authorization from an existing SSO session	[]
tenancy.provisioningIdentities		Object	Operator-registered provisioning principals, audiences, receiving service and allowed operations	[]
NodemailerConfiguration
email		NodemailerConfiguration	SMTP settings used for first-login account setup links
email.enabled		Boolean	Enable email sending	false
email.smtpFrom		String	Email address to send emails from
email.smtpPort		Number	SMTP port	465
email.smtpSecure		Boolean	SMTP secure connection	true
email.smtpServer		String	SMTP server
email.smtpUser		String	SMTP user
email.smtpPassword		String	SMTP password
email.title		String	Title
SignalingClientConfig
signalingClients		SignalingClientConfig[]	Deployment-controlled signaling identities; one OAuth client per tenant and role	[]
signalingClients[].clientId	Yes	String	Authenticated OAuth client ID authorized for signaling
signalingClients[].tenant	Yes	String	Fixed receiving tenant slug carried in the tenant claim
signalingClients[].identity		String	Plane identity carried in client_id; defaults to the OAuth client ID
signalingClients[].subject		String	Fixed subject; defaults to plane identity. For Siglet use its participant context ID
signalingClients[].role	Yes	"controlplane" | "dataplane"	Caller role determines the required transfer execute permission
signalingClients[].audiences	Yes	String	Allowed receiving plane identities for this client and tenant
DatabaseConfig
db	Yes	DatabaseConfig	Database configuration
db.retryAttempts		Number	Connection attempts during application startup, three seconds apart	10
db.type	Yes	"sqlite" | "postgres"	Type of database
db.database	Yes	String	Name of the database
db.synchronize		Boolean	Synchronize database schema	false
db{type=sqlite}	Yes	SQLiteConfig	Database configuration
db{type=sqlite}.retryAttempts		Number	Connection attempts during application startup, three seconds apart	10
db{type=sqlite}.type		"sqlite" | "postgres"	Type of database	"sqlite"
db{type=sqlite}.database	Yes	String	Name of the database
db{type=sqlite}.synchronize		Boolean	Synchronize database schema	false
db{type=postgres}	Yes	PostgresConfig	Database configuration
db{type=postgres}.host	Yes	String	Host of the database
db{type=postgres}.port	Yes	Number	Port of the database
db{type=postgres}.username	Yes	String	Username of the database
db{type=postgres}.password	Yes	String	Password of the database
db{type=postgres}.ssl		Object	SSL configuration of the database	false
db{type=postgres}.retryAttempts		Number	Connection attempts during application startup, three seconds apart	10
db{type=postgres}.type		"sqlite" | "postgres"	Type of database	"postgres"
db{type=postgres}.database	Yes	String	Name of the database
db{type=postgres}.synchronize		Boolean	Synchronize database schema	false
ServerConfig
server		ServerConfig	Server configuration
server.listen		String	IP address the server listens on	"0.0.0.0"
server.port		Number	Port the server listens on	3000
server.publicDomain		String	Public domain of the server	"localhost"
server.publicAddress		String	Public address of the server	"http://localhost:3000"
server.subPath		String	Sub path of the server
InitClient
initClients		InitClient[]	Initial client configurations	[]
initClients[].kind	Yes	"shared" | "workload" | "platform"	Explicit operator-controlled client authority
initClients[].tenantId		String	Canonical tenant UUID for a workload client
initClients[].audiences		String	Registered resource audiences	[]
initClients[].scopes		String	Allowed OAuth scopes	["openid","profile","email","offline_access"]
initClients[].clientId	Yes	String	Client ID
initClients[].clientSecret		String	Client secret (required for client_secret_post authentication)
initClients[].tokenEndpointAuthMethod		"client_secret_post" | "private_key_jwt" | "none"	Token endpoint authentication method: client_secret_post, private_key_jwt, or none	"client_secret_post"
initClients[].jwk		Object	Public key in JWK format (required for private_key_jwt authentication)
initClients[].secretName		String	Kubernetes secret name
initClients[].permissions	Yes	String	Client permissions (can be permission strings or permission set names)
initClients[].grants		String	Allowed grant types; defaults depend on client kind and authentication method. Explicit lists override defaults.
initClients[].name	Yes	String	Client name
initClients[].description	Yes	String	Client description
initClients[].redirectUris	Yes	String	Exact allowed client redirect URIs
InitUser
initUsers		InitUser[]	Initial user configurations	[]
initUsers[].id		String	Optional stable login principal UUID for operator bootstrap/migration mappings
initUsers[].username	Yes	String	Username
initUsers[].password	Yes	String	Password
initUsers[].email	Yes	String	Email
initUsers[].permissions	Yes	String	User permissions (can be permission strings or permission set names)
initUsers[].grants		String	Grant types supported	["authorization_code","refresh_token"]
initUsers[].require2FA		Boolean	Require two-factor authentication for this user. User will be prompted to set up 2FA on first login.	false
kubernetesNamespace		String	Kubernetes namespace	"default"
twoFactorIssuerName		String	Issuer name for Two-Factor Authentication (shown in authenticator apps)	"SSO Bridge"
dcqlQueryMap		Object	DCQL Query map for OID4VP	{"Administrator":{"credentials":[{"id":"identity_credential","format":"jwt_vc_json","meta":{"type_values":[["VerifiableCredential","HandsonCredential"]]},"claims":[{"id":"email","path":["credentialSubject","email"]},{"id":"role","path":["credentialSubject","role"],"values":["Administrator"]}]}]},"User":{"credentials":[{"id":"identity_credential","format":"jwt_vc_json","meta":{"type_values":[["VerifiableCredential","HandsonCredential"]]},"claims":[{"id":"email","path":["credentialSubject","email"]}]}]}}
AuditModuleConfig
audit		AuditModuleConfig	Audit logging configuration
audit.enabled		Boolean	Enable audit logging	true
audit.minSeverity		"debug" | "info" | "warning" | "error" | "critical"	Minimum severity level to log	"info"
audit.logDenied		Boolean	Always log denied access attempts regardless of action type	true
audit.logDelegated		Boolean	Log delegated access attempts when enabled, while still respecting action-specific success filters	true
audit.logMutations		Boolean	Log successful mutation actions (create, update, delete, manage)	true
audit.logExecute		Boolean	Log successful execute actions	false
audit.logReads		Boolean	Log successful read actions — disabled by default as reads are frequent and rarely relevant for auditing	false
audit.sensitiveResources		Array	Resources logged regardless of minimum severity, while still respecting action-specific success filters	["w.key","w.credential","sso.user"]
AuditHandlersConfig
audit.handlers		AuditHandlersConfig	Handler configuration
audit.handlers.console		Boolean	Enable console audit log handler	false
audit.handlers.database		Boolean	Enable database audit log handler	true
audit.handlers.otlp		Boolean	Enable OTLP audit log handler	false
OtlpAuditHandlerConfig
audit.otlp		OtlpAuditHandlerConfig	OTLP audit log handler configuration
audit.otlp.url		String	OTLP HTTP logs endpoint URL	"http://localhost:4318/v1/logs"
audit.otlp.headers		Object	Additional HTTP headers to include in OTLP requests
audit.otlp.timeoutMillis		Number	OTLP export timeout in milliseconds	5000
audit.otlp.concurrencyLimit		Number	Maximum number of concurrent OTLP export requests	1
audit.otlp.serviceName		String	Service name included on OTLP log attributes	"tsg-dsp-api"
audit.otlp.serviceVersion		String	Optional service version included on OTLP log attributes
IngressAuthConfig
ingressAuth		IngressAuthConfig	Ingress authentication configuration
ingressAuth.clients		Object	Operator-controlled ingress targets; each route binds a client, canonical tenant and resource audience	[]
ingressAuth.allowedRedirectDomains		String	Additional hostnames that protected applications may be redirected back to after login. The public domain of the SSO Bridge and its subdomains are always allowed.	[]