Configuration Guide

Example: HTTP health check with TLS and Prometheus metrics:

health:
  type: http
  port: 443
  checkinterval: "10s"
  timeout: "2s"
  http:
    path: "/healthz"
    expectedstatus: 200
    tls: true
    insecureSkipVerify: false

metrics:
  enablePrometheus: true
  listenAddr: "0.0.0.0"
  port: 9090

Example: enable GitOps with signed commits type: http port: 443 checkinterval: "10s" timeout: "2s" http: path: "/healthz" expectedstatus: 200 tls: true insecureSkipVerify: false

metrics: enablePrometheus: true listenAddr: "0.0.0.0" port: 9090

Example: enable GitOps with signed commits

cluster: id: "prod-emea"

gitops: repoURL: "ssh://gitea@git.example.com/infra/gslb-config.git" branch: "main" pathPrefix: "clusters/prod-emea" pollInterval: "30s" requireSignature: true allowedSigners: ["ABCD1234...FPR"] auth: sshKeyPath: "/etc/gslb/gitops_deploy_key"

Example: NATS state sync with quorum policy

cluster: id: "prod-global"

state: healthPolicy: "global-quorum" quorumMinPercent: 67 heartbeatInterval: "10s" heartbeatTTL: "30s" nats: servers: ["nats://n1.example.com:4222","nats://n2.example.com:4222","nats://n3.example.com:4222"] tls: caFile: "/etc/gslb/pki/ca.crt" certFile: "/etc/gslb/pki/client.crt" keyFile: "/etc/gslb/pki/client.key" jetStream: domain: "gslb"

Troubleshooting tips
- If no A/AAAA answers are returned:
  - Ensure endpoints are valid IPs and reachable; check health checks (metrics `gslbd_health_*`).
  - If using `prefer-local`, local health must pass; otherwise global may be ignored.
- If GitOps changes are ignored:
  - Check logs for signature verification failures.
  - Verify `allowedSigners` includes the signer fingerprint.
- If NATS state sync seems inactive:
  - Check `gslbd_state_nats_connected` metric; verify servers list and TLS credentials.

Example: weighted round-robin with per-endpoint weights

cluster: id: "prod-emea" node: id: "edge-fra-02"

dns: listenAddr: "0.0.0.0" port: 5353 domain: "example.gslb"

loadbalancer: algorithm: "weighted-round-robin" # aliases: wrr, weighted_rr endpoints: - 203.0.113.10 - 203.0.113.11 - 2001:db8::10 weights: "203.0.113.10": 5 # higher share "203.0.113.11": 1 # lower share "2001:db8::10": 3 # IPv6 endpoint weighted too

health: type: http port: 443 checkinterval: "10s" timeout: "2s" http: path: "/healthz" expectedstatus: 200 tls: true insecureSkipVerify: false

Notes on weights
- Weights apply only when `algorithm` is a weighted variant.
- Omitted endpoints default to weight `1`.
- A weight of `0` disables selection of that endpoint (useful for draining) while keeping it listed.

Declarative configuration (GitOps)
NATS JetStream config sync has been removed. The full daemon config is now
distributed via **GitOps self-restart**: each node independently polls a Git repo,
validates the config, writes it to its own config file, and gracefully restarts onto
it. There is no central coordinator.

Data-plane objects (pools, members, services, …) are replicated across nodes by the
[rqlite](../reference/Datastore.md) datastore (Raft), and are edited live via the API
/ WebUI / Terraform / `gslbctl` — not through the config file.

See the [GitOps User Guide](GitOpsUserGuide.md) for setup, signing, and the
reconcile/restart flow.

Tips
- Git is the source of truth for the daemon config file; the API/datastore is the source of truth for pools/members/services.
- Use `weighted-round-robin` and `weights` to control per-endpoint traffic share.