> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Field Reference

Quick reference for every top-level key in the Orchestrator's YAML configuration file. Keys that have dedicated reference pages link out to avoid duplication -- keys documented only here include their full field tables.

For a conceptual overview of how configuration works, see the [Configuration overview](/reference/orchestrator/configuration).

## `version`

Required. Specifies the configuration format version.

| Key       | Type   | Required | Description                                      |
| --------- | ------ | -------- | ------------------------------------------------ |
| `version` | string | Yes      | Configuration version -- currently accepts `"1"` |

```yaml theme={null}
version: "1"
```

## `features`

Optional. Enables experimental or gated behavior via feature flags.

| Key        | Type               | Required | Description                                                                                                           |
| ---------- | ------------------ | -------- | --------------------------------------------------------------------------------------------------------------------- |
| `features` | map\[string]string | No       | Feature flag map -- values `"true"` or `"enabled"` (case-insensitive) turn a feature on; any other value turns it off |

```yaml theme={null}
features:
  experimental.clusters: "true"
```

**Parsing rules:** Only `"true"` and `"enabled"` (case-insensitive) are recognized as enabled. Any other value, or a missing flag, is treated as disabled.

**Known flags:**

| Flag                    | Purpose                                                                                                                 | Stability |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------- | --------- |
| `experimental.clusters` | Enable Orchestrator clustering for high availability with gossip-based membership, shared sessions, caches, and routing | Alpha     |

<Note>
  Feature flags with the `experimental.` prefix indicate alpha-level features that may change without notice. See the [Changelog](/changelog) for additions and removals.
</Note>

## `http`

Optional. Controls the HTTP server -- bind address, TLS, timeouts, and access logging.

| Key                             | Type    | Default          | Description                                                                                        |
| ------------------------------- | ------- | ---------------- | -------------------------------------------------------------------------------------------------- |
| `http.address`                  | string  | `"0.0.0.0:9443"` | Network address and port to bind to                                                                |
| `http.tls`                      | string  | --               | Name of a TLS profile defined under the top-level `tls` key (mutually exclusive with `http.hosts`) |
| `http.readTimeoutSeconds`       | integer | `20`             | Maximum seconds to read the full request                                                           |
| `http.readHeaderTimeoutSeconds` | integer | `5`              | Maximum seconds to read request headers                                                            |
| `http.writeTimeoutSeconds`      | integer | `20`             | Maximum seconds to write the response                                                              |
| `http.idleTimeoutSeconds`       | integer | `60`             | Maximum seconds to keep idle connections open                                                      |
| `http.endpointTimeoutSeconds`   | integer | `15`             | Maximum seconds for an endpoint handler to complete                                                |
| `http.accessLog.disabled`       | boolean | `false`          | Disable HTTP access logging                                                                        |
| `http.accessLog.level`          | string  | `"info"`         | Access log level -- `"debug"`, `"info"`, or `"error"`                                              |
| `http.hosts`                    | array   | --               | SNI-based virtual host configurations (mutually exclusive with `http.tls`)                         |
| `http.hosts[].serverName`       | string  | --               | Server name indicator (SNI) used for matching incoming TLS connections                             |
| `http.hosts[].default`          | boolean | `false`          | Use this host as the fallback when no SNI match is found; only one entry may set this to `true`    |
| `http.hosts[].tls`              | string  | --               | Name of the TLS profile to use for this host (required)                                            |

Single TLS profile:

```yaml maverics.yaml theme={null}
http:
  address: "0.0.0.0:9443"
  tls: "default"
  readTimeoutSeconds: 20
  writeTimeoutSeconds: 20
```

SNI-based virtual hosts (mutually exclusive with `http.tls`):

```yaml maverics.yaml theme={null}
http:
  address: "0.0.0.0:443"
  hosts:
    - serverName: "app.example.com"
      tls: "app-cert"
    - serverName: "api.example.com"
      tls: "api-cert"
    - default: true
      tls: "app-cert"

tls:
  "app-cert":
    certFile: /etc/maverics/certs/app.pem
    keyFile: /etc/maverics/certs/app-key.pem
  "api-cert":
    certFile: /etc/maverics/certs/api.pem
    keyFile: /etc/maverics/certs/api-key.pem
```

See the [TLS Security guide](/guides/security/tls) for full details on SNI-based certificate selection.

## `tls`

Optional. Named TLS profiles for server certificates, cipher suites, mTLS, and certificate revocation checking.

See the [TLS Security reference](/reference/orchestrator/tls-security) for the full field table, mTLS configuration, OCSP/CRL settings, and Windows Certificate Store support.

```yaml theme={null}
tls:
  "default":
    certFile: /etc/maverics/certs/server.pem
    keyFile: /etc/maverics/certs/server-key.pem
    minVersion: "1.2"
    maxVersion: "1.3"
```

## `connectors`

Optional. Identity provider connections -- OIDC, SAML, LDAP, and attribute providers.

See the [Identity Fabric reference](/reference/orchestrator/identity-fabric) for all supported connector types, protocol details, and per-provider configuration.

```yaml theme={null}
connectors:
  - name: azure
    type: azure
    oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
    oauthClientSecret: <vault.azure_client_secret>
    oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.TENANT_ID }}/v2.0/.well-known/openid-configuration"
```

## `apps`

Optional. Application definitions with routes, authentication policies, and upstream targets.

See the [Applications reference](/reference/orchestrator/applications) for app types (Proxy, OIDC, SAML, MCP Bridge, MCP Proxy) and route configuration.

```yaml theme={null}
apps:
  - name: my-app
    type: proxy
    upstream: "https://internal-app.example.com"
    routePatterns:
      - "app.example.com/"
```

## `oidcProvider`

Optional. OIDC Provider mode settings -- token signing, claim mapping, and client registration.

See the [OIDC Provider reference](/reference/modes/oidc-provider) for the full configuration.

## `samlProvider`

Optional. SAML Provider mode settings -- assertion signing, attribute mapping, and metadata.

See the [SAML Provider reference](/reference/modes/saml-provider) for the full configuration.

## `ldapProvider`

Optional. LDAP Provider mode settings -- virtual directory, attribute mapping, and backend routing.

See the [LDAP Provider reference](/reference/modes/ldap-provider) for the full configuration.

## `mcpProvider`

Optional. AI Identity Gateway mode settings -- MCP Bridge and MCP Proxy configuration.

See the [AI Identity Gateway reference](/reference/modes/ai-identity-gateway) for the full configuration.

## `session`

Optional. Session cookie, lifetime, and store configuration.

See the [Sessions reference](/reference/orchestrator/sessions) for session types (local, cluster), cookie settings, and lifetime configuration.

```yaml theme={null}
session:
  cookie:
    name: "__Host-maverics"
    secure: true
  lifetime: "8h"
```

## `caches`

Optional. Named cache stores for session data, tokens, and IdP metadata.

See the [Caches reference](/reference/orchestrator/caches) for Redis configuration, cluster caching, and connection settings.

```yaml theme={null}
caches:
  - name: shared-redis
    type: redis
    redis:
      addresses:
        - "redis.example.com:6379"
```

## `logger`

Optional. Structured logging configuration.

See the [Logging reference](/reference/orchestrator/telemetry/logging) for verbosity levels, JSON output, and filtering.

```yaml theme={null}
logger:
  level: "info"
  jsonOutput: true
```

## `health`

Optional. Health check endpoint and heartbeat monitoring.

See the [Telemetry reference](/reference/orchestrator/telemetry) for health endpoint configuration.

```yaml theme={null}
health:
  location: "/status"
  heartbeat:
    interval: "60s"
```

## `telemetry`

Optional. OpenTelemetry metrics and traces via OTLP.

See the [Telemetry reference](/reference/orchestrator/telemetry) for metrics, traces, and OTLP exporter configuration.

## `singleLogout`

Optional. Single logout endpoint and post-logout redirect behavior.

See the [Single Logout guide](/guides/authentication/single-logout) for configuration and flow details.

## `clusters`

Optional. Multi-node Orchestrator cluster configuration for high availability.

See the [Clusters reference](/reference/orchestrator/experimental/clusters) for gossip protocol, shared state, and cluster routing. Requires `experimental.clusters` feature flag.

## `apis`

Optional. Custom API endpoints powered by Service Extensions.

See the [Custom APIs](/reference/orchestrator/service-extensions/custom-apis) reference for custom API configuration.

## Related Pages

<CardGroup cols={2}>
  <Card title="Configuration Overview" icon="gear" href="/reference/orchestrator/configuration">
    Conceptual overview, environment variables, and runtime behavior
  </Card>

  <Card title="Installation" icon="download" href="/reference/orchestrator/installation">
    CLI flags, environment variables, and deployment options
  </Card>
</CardGroup>