Gateway Configuration (auvis.yaml)
Exhaustive configuration reference for the Auvis proxy gateway and streaming pipelines.
This document is the exhaustive configuration reference for the Auvis gateway proxy (auvis.yaml).
Configuration Loading Hierarchy
Auvis merges configuration settings from three layers in strict priority order (highest priority first):
- Environment Variables (e.g.
AUVIS_PORT,AUVIS_SALT) — overrides YAML settings. - YAML File (
auvis.yaml) — explicit file settings. - Built-in Defaults — fallback values when no setting or env var is present.
Gateway Settings (gateway)
All core gateway settings live under the top-level gateway block in auvis.yaml.
YAML
version: "1"
gateway:
port: 8082
upstream: "http://localhost:8000"
policies_dir: ./policies
audit_file: ./audit.jsonl
audit_max_size_mb: 100
audit_max_age_days: 30
audit_fsync_interval: "never"
idp_url: "http://idp.internal:8080/userinfo"
salt: "your-production-salt-phrase"
upstream_timeout_seconds: 10
circuit_breaker:
max_failures: 5
cooldown_seconds: 30Reference Table
| Field | Type | Default | Env Var Override | Description |
|---|---|---|---|---|
port | int / string | 8080 | AUVIS_PORT | HTTP port Auvis listens on for inbound traffic. |
upstream | string | "" | AUVIS_UPSTREAM / AUVIS_UPSTREAM_URL | Default single upstream server URL (e.g., http://backend:8000). |
upstreams | []object | [] | — | Static multi-upstream microservice routing list (name, prefix, target, policies_dir). |
policies_dir | string | "./policies" | — | Local directory containing policy YAML files. Watched for zero-downtime hot-reload. |
audit_file | string | "./audit.jsonl" | AUVIS_AUDIT_FILE | Append-only newline-delimited JSONL log file path. |
audit_max_size_mb | int | 10 | — | Maximum log file size in megabytes before rotation triggers. |
audit_max_age_days | int | 30 | — | Retention period in days for rotated log files before automatic cleanup. |
audit_fsync_interval | string | "never" | AUVIS_AUDIT_FSYNC_INTERVAL | Disk durability mode: "never" (max throughput), "always" (zero data loss), or duration ("100ms", "1s"). |
shutdown_timeout_seconds | int | 30 | — | Graceful shutdown timeout during SIGTERM before force-exit. |
idp_url | string | "" | AUVIS_IDP_URL | Optional Identity Provider endpoint to resolve bearer tokens or identity attributes. |
salt | string | "default-auvis-salt-value" | AUVIS_SALT | Secret salt string used for SHA-256 field anonymization (action: anonymize). Required in production. |
upstream_timeout_seconds | int | 10 | — | Maximum duration before an upstream HTTP request is cancelled. |
circuit_breaker | object | 5/30s | — | Global failure threshold (max_failures) and cooldown duration (cooldown_seconds). |
Multi-Upstream Microservice Routing (upstreams)
When running Auvis in front of multiple microservices, configure the upstreams list to route traffic based on path prefix or headers:
YAML
gateway:
upstreams:
- name: "patient-service"
prefix: "/api/v1/patients"
target: "http://patient-service.internal:8081"
policies_dir: "./policies/patients"
- name: "billing-service"
prefix: "/api/v1/billing"
target: "http://billing-service.internal:8083"
policies_dir: "./policies/billing"Streaming Pipeline Sources (sources)
In addition to proxying HTTP traffic, Auvis can continuously consume and govern real-time data streams (e.g. Kafka topics). Inbound stream sources are configured under the top-level sources array in auvis.yaml.
YAML
sources:
- type: kafka
settings:
brokers: "13.63.117.156:9092"
topic: "patient-records"
group_id: "auvis-hybrid-consumer-group"
auto_offset_reset: "latest" # "earliest" | "latest"
max_wait_ms: "500" # Max batch wait before return
session_timeout_ms: "60000" # WAN-safe consumer session timeout
heartbeat_interval_ms: "5000" # WAN-safe group heartbeat interval
rebalance_timeout_ms: "30000" # WAN group rebalance timeout
commit_interval: "1s" # At-least-once offset commit frequency
auth:
type: sasl_ssl
username: "my-kafka-user"
password: "my-kafka-password"
sasl_mechanism: "PLAIN"Data Destinations (destinations)
Auvis allows fan-out writing of governed records to one or more database or vector sinks before responding to the client.
YAML
gateway:
destinations:
- type: postgres
settings:
host: postgres.internal
port: "5432"
dbname: auvis_db
table: governed_records
sslmode: require
auto_create_table: "true"
auth:
username: auvis_app
password: "${POSTGRES_PASSWORD}"
- type: pgvector
settings:
host: postgres.internal
port: "5432"
dbname: auvis_db
table: governed_vectors
vector_field: "embedding"
vector_dim: "1536"
auto_create_table: "true"
auth:
username: auvis_app
password: "${POSTGRES_PASSWORD}"
- type: pinecone
settings:
index_host: "my-index-123.svc.pinecone.io"
vector_field: "embedding"
auth:
password: "${PINECONE_API_KEY}"Supported Drivers:
- PostgreSQL (
postgres): Relational database storage with auto-created JSONB payload tables. - pgvector (
pgvector): Stores vector embeddings with dimension validation and auto-extension setup (CREATE EXTENSION IF NOT EXISTS vector). - Pinecone (
pinecone): Cloud vector database using Pinecone REST APIs. - Weaviate (
weaviate): Self-hosted or cloud Weaviate clusters with class auto-creation.
Environment Variables Reference
| Environment Variable | Required | Description | Example |
|---|---|---|---|
AUVIS_UPSTREAM_URL | ✅ | Upstream target URL (also accepted as AUVIS_UPSTREAM) | http://api.internal:8000 |
AUVIS_ENV | ✅ | Execution environment: development or production. Governs fail-closed behavior. | production |
AUVIS_SALT | ✅ in prod | Secret salt for SHA-256 field pseudonymization (action: pseudonymize). | a7f3c9e84b... |
AUVIS_PORT | — | Gateway port override | 8082 |
AUVIS_AUDIT_FILE | — | Audit log path override | /var/log/auvis/audit.jsonl |
AUVIS_IDP_URL | — | IdP resolve endpoint override | https://idp.example.com/userinfo |
AUVIS_AUDIT_FSYNC_INTERVAL | — | Fsync durability interval override | 100ms |