Field Reference

Quick reference for every top-level key in the Orchestrator’s YAML configuration file. Keys that have dedicated reference pages link out to avoid duplication — keys documented only here include their full field tables. For a conceptual overview of how configuration works, see the Configuration overview.

`version`

Required. Specifies the configuration format version.

Key	Type	Required	Description
`version`	string	Yes	Configuration version — currently accepts `"1"`

version: "1"

`features`

Optional. Enables experimental or gated behavior via feature flags.

Key	Type	Required	Description
`features`	map[string]string	No	Feature flag map — values `"true"` or `"enabled"` (case-insensitive) turn a feature on; any other value turns it off

features:
  experimental.clusters: "true"

Parsing rules: Only "true" and "enabled" (case-insensitive) are recognized as enabled. Any other value, or a missing flag, is treated as disabled. Known flags:

Flag	Purpose	Stability
`experimental.clusters`	Enable Orchestrator clustering for high availability with gossip-based membership, shared sessions, caches, and routing	Alpha

Feature flags with the experimental. prefix indicate alpha-level features that may change without notice. See the Changelog for additions and removals.

`http`

Optional. Controls the HTTP server — bind address, TLS, timeouts, and access logging.

Key	Type	Default	Description
`http.address`	string	`"0.0.0.0:9443"`	Network address and port to bind to
`http.tls`	string	—	Name of a TLS profile defined under the top-level `tls` key (mutually exclusive with `http.hosts`)
`http.readTimeoutSeconds`	integer	`20`	Maximum seconds to read the full request
`http.readHeaderTimeoutSeconds`	integer	`5`	Maximum seconds to read request headers
`http.writeTimeoutSeconds`	integer	`20`	Maximum seconds to write the response
`http.idleTimeoutSeconds`	integer	`60`	Maximum seconds to keep idle connections open
`http.endpointTimeoutSeconds`	integer	`15`	Maximum seconds for an endpoint handler to complete
`http.accessLog.disabled`	boolean	`false`	Disable HTTP access logging
`http.accessLog.level`	string	`"info"`	Access log level — `"debug"`, `"info"`, or `"error"`
`http.hosts`	array	—	SNI-based virtual host configurations (mutually exclusive with `http.tls`)
`http.hosts[].serverName`	string	—	Server name indicator (SNI) used for matching incoming TLS connections
`http.hosts[].default`	boolean	`false`	Use this host as the fallback when no SNI match is found; only one entry may set this to `true`
`http.hosts[].tls`	string	—	Name of the TLS profile to use for this host (required)

Single TLS profile:

maverics.yaml

http:
  address: "0.0.0.0:9443"
  tls: "default"
  readTimeoutSeconds: 20
  writeTimeoutSeconds: 20

SNI-based virtual hosts (mutually exclusive with http.tls):

maverics.yaml

http:
  address: "0.0.0.0:443"
  hosts:
    - serverName: "app.example.com"
      tls: "app-cert"
    - serverName: "api.example.com"
      tls: "api-cert"
    - default: true
      tls: "app-cert"

tls:
  "app-cert":
    certFile: /etc/maverics/certs/app.pem
    keyFile: /etc/maverics/certs/app-key.pem
  "api-cert":
    certFile: /etc/maverics/certs/api.pem
    keyFile: /etc/maverics/certs/api-key.pem

See the TLS Security guide for full details on SNI-based certificate selection.

`tls`

Optional. Named TLS profiles for server certificates, cipher suites, mTLS, and certificate revocation checking. See the TLS Security reference for the full field table, mTLS configuration, OCSP/CRL settings, and Windows Certificate Store support.

tls:
  "default":
    certFile: /etc/maverics/certs/server.pem
    keyFile: /etc/maverics/certs/server-key.pem
    minVersion: "1.2"
    maxVersion: "1.3"

`connectors`

Optional. Identity provider connections — OIDC, SAML, LDAP, and attribute providers. See the Identity Fabric reference for all supported connector types, protocol details, and per-provider configuration.

connectors:
  - name: azure
    type: azure
    oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
    oauthClientSecret: <vault.azure_client_secret>
    oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.TENANT_ID }}/v2.0/.well-known/openid-configuration"

`apps`

Optional. Application definitions with routes, authentication policies, and upstream targets. See the Applications reference for app types (Proxy, OIDC, SAML, MCP Bridge, MCP Proxy) and route configuration.

apps:
  - name: my-app
    type: proxy
    upstream: "https://internal-app.example.com"
    routePatterns:
      - "app.example.com/"

`oidcProvider`

Optional. OIDC Provider mode settings — token signing, claim mapping, and client registration. See the OIDC Provider reference for the full configuration.

`samlProvider`

Optional. SAML Provider mode settings — assertion signing, attribute mapping, and metadata. See the SAML Provider reference for the full configuration.

`ldapProvider`

Optional. LDAP Provider mode settings — virtual directory, attribute mapping, and backend routing. See the LDAP Provider reference for the full configuration.

`mcpProvider`

Optional. AI Identity Gateway mode settings — MCP Bridge and MCP Proxy configuration. See the AI Identity Gateway reference for the full configuration.

`session`

Optional. Session cookie, lifetime, and store configuration. See the Sessions reference for session types (local, cluster), cookie settings, and lifetime configuration.

session:
  cookie:
    name: "__Host-maverics"
    secure: true
  lifetime: "8h"

`caches`

Optional. Named cache stores for session data, tokens, and IdP metadata. See the Caches reference for Redis configuration, cluster caching, and connection settings.

caches:
  - name: shared-redis
    type: redis
    redis:
      addresses:
        - "redis.example.com:6379"

`logger`

Optional. Structured logging configuration. See the Logging reference for verbosity levels, JSON output, and filtering.

logger:
  level: "info"
  jsonOutput: true

`health`

Optional. Health check endpoint and heartbeat monitoring. See the Telemetry reference for health endpoint configuration.

health:
  location: "/status"
  heartbeat:
    interval: "60s"

`telemetry`

Optional. OpenTelemetry metrics and traces via OTLP. See the Telemetry reference for metrics, traces, and OTLP exporter configuration.

`singleLogout`

Optional. Single logout endpoint and post-logout redirect behavior. See the Single Logout guide for configuration and flow details.

`clusters`

Optional. Multi-node Orchestrator cluster configuration for high availability. See the Clusters reference for gossip protocol, shared state, and cluster routing. Requires experimental.clusters feature flag.

`apis`

Optional. Custom API endpoints powered by Service Extensions. See the Custom APIs reference for custom API configuration.

Configuration Overview

Conceptual overview, environment variables, and runtime behavior

Installation

CLI flags, environment variables, and deployment options

Console Administration

Orchestration

`version`

`features`

`http`

`tls`

`connectors`

`apps`

`oidcProvider`

`samlProvider`

`ldapProvider`

`mcpProvider`

`session`

`caches`

`logger`

`health`

`telemetry`

`singleLogout`

`clusters`

`apis`

Configuration Overview

Installation

​version

​features

​http

​tls

​connectors

​apps

​oidcProvider

​samlProvider

​ldapProvider

​mcpProvider

​session

​caches

​logger

​health

​telemetry

​singleLogout

​clusters

​apis

​Related Pages

Configuration Overview

Installation

`version`

`features`

`http`

`tls`

`connectors`

`apps`

`oidcProvider`

`samlProvider`

`ldapProvider`

`mcpProvider`

`session`

`caches`

`logger`

`health`

`telemetry`

`singleLogout`

`clusters`

`apis`

Related Pages