controller-config.md

Controller Configuration Schema

Field	Type	Description
adminAccess	object	Management authentication, separate from device enrollment. Defaults to local-only access.
adminAccess.mode	enum	Unauthenticated access restricted to an IPv4 or IPv6 loopback listener. Possible values: local.
adminAccess.mode	enum	Possible values: authenticated.
adminAccess.provider	object	Settings owned and validated by the compiled-in authentication extension. Relative paths inside it are resolved from the controller configuration directory.
adminAccess.publicUrl	string	Exact external HTTPS origin, without a path other than /.
adminAccess.transport	object	How HTTPS reaches the management listener.
adminAccess.transport.mode	enum	HTTPS terminates at a trusted proxy; the plaintext listener must not be public. Possible values: proxy.
adminAccess.transport.certificate	string	PEM certificate chain. Relative paths are resolved from the configuration directory.
adminAccess.transport.key	string	PEM private key. Relative paths are resolved from the configuration directory.
adminAccess.transport.mode	enum	Possible values: tls.
adminListen	string	Address on which the controller management UI listens. Local mode requires loopback.
allowInsecureDev	boolean	Permit a non-HTTPS OIDC issuer for isolated local development. This escape hatch is only appropriate for isolated local development.
daemonConfig	object	Daemon configuration distributed to enrolled devices.
daemonConfig.path	string	Path to the watched YAML configuration distributed to enrolled devices. Relative paths are resolved from the controller configuration directory. Valid file changes are published to connected devices automatically.
daemonConfig.revision	integer	Monotonically increasing revision assigned to the daemon configuration.
databaseUrl	string	SQLite or PostgreSQL URL used for controller state.
fleetListen	string	Address on which the device-facing gRPC fleet API listens.
gatewayJwt	object	LLM gateway JWT signing settings.
gatewayJwt.issuer	string	Issuer claim placed in generated JWTs.
gatewayJwt.keyId	string	Key identifier placed in generated JWT headers.
gatewayJwt.lifetime	string	Lifetime of generated JWTs. Defaults to 5m.
gatewayJwt.privateKey	string	Path to the PEM-encoded RSA private signing key. Relative paths are resolved from the controller configuration directory.
oidc	object	OpenID Connect settings used for device enrollment and authorization.
oidc.clientId	string	Public OpenID Connect client identifier.
oidc.issuer	string	Exact OpenID Connect issuer URL.
oidc.redirectUri	string	Redirect URI registered for the native enrollment client.
tls	string	TLS identities used by the device-facing fleet API. A string selects a directory containing controller.pem, controller-key.pem, device-ca.pem, and device-ca-key.pem.
tls.certificate	string	Path to the PEM-encoded TLS certificate chain. Relative paths are resolved from the controller configuration directory.
tls.clientCaCertificate	string	PEM CA roots used to verify issued device client certificates.
tls.clientCaKey	string	PEM private key used to issue device certificates from clientCaCertificate. Enrolled daemons generate their own private key and send a CSR.
tls.key	string	Path to the PEM-encoded TLS private key. Relative paths are resolved from the controller configuration directory.
usage	object	Token and cost collection from agentgateway access logs.
usage.tokenFile	string	Path to a file containing the bearer token agentgateway sends with each export. The token must be at least 32 characters. Relative paths are resolved from the controller configuration directory.