Control Plane Configuration

The control plane (AlienGiraffe Connector) is configured with a10e.toml (or the Docker Compose / Helm equivalents). This page covers the settings that matter for agent and MCP observability — the device-reporting and admin surfaces. The data-access platform’s settings are out of scope here.

a10e.toml

env  = "local"      # local | prod
port = 8080

[db]
dsn            = "postgres://a10e_user:a10e_password@localhost:5432/a10e_db?sslmode=disable"
max_open_conns = 25
max_idle_conns = 25
max_idle_time  = "15m"

[cors]
allowed_origins = ["http://localhost:3000"]

[auth]
provider       = "local"    # local | auth0
jwt_secret     = "change-me-32-bytes-minimum"
auth0_domain   = ""
auth0_audience = ""
auth0_bypass   = false

[health]
probe_interval = "30m"

[db]

The Postgres connection used for the device registry, inventory, observability events, and audit logs.

Key	Description
dsn	Postgres connection string
max_open_conns / max_idle_conns	Connection pool sizing
max_idle_time	How long idle connections are kept

[cors]

Key	Description
allowed_origins	Origins allowed to call the API — must include the dashboard’s URL

[auth]

Controls authentication and therefore access to the /admin/* observability endpoints (see Security & audit for the RBAC roles).

Key	Description
provider	local (username/password + JWT) or auth0 (OIDC/JWT)
jwt_secret	Signing secret for local auth (32+ bytes)
auth0_domain / auth0_audience	Auth0 tenant settings when provider = "auth0"
auth0_bypass	Skip Auth0 for local development only

[health]

Key	Description
probe_interval	How often background health probes run

Note

a10e.toml has additional sections ([deployment], [ai], [tunnels], [expiry], [fluentd]) used by the broader platform. They are not required for agent/MCP observability and are intentionally omitted here.

Environment variables

Common overrides (useful in containers and Helm):

Variable	Maps to
A10E_DB_DSN	[db].dsn
A10E_JWT_SECRET	[auth].jwt_secret
AUTH0_DOMAIN / AUTH0_AUDIENCE	[auth].auth0_domain / auth0_audience
A10E_DASHBOARD_URL	--dashboard-url — public base URL of the dashboard

A10E_DASHBOARD_URL (required for endpoint sign-in)

The control plane brokers Lander’s sign-in by redirecting the user’s browser to the dashboard login page, so it needs to know the dashboard’s public base URL. Set A10E_DASHBOARD_URL (or pass --dashboard-url); it must be an absolute URL with scheme and host, and it is validated at startup.

If it is unset, the API logs CLI sign-in disabled and the sign-in routes stay unmounted — Lander’s sign-in prompt has nothing to talk to, and because enrollment requires an authenticated user, no new device can register. Existing enrolled devices keep reporting normally.

Endpoints this configuration exposes

With the control plane configured and running, endpoints and admins use:

• Endpoint sign-in (browser-brokered, mounted only when A10E_DASHBOARD_URL is set): the /v1/auth/cli/* routes backing Lander’s authentication prompt.
• Device reporting (called by Lander, signed): POST /v1/devices/register — which additionally requires the authenticated user’s token — plus POST /v1/devices/inventory and POST /v1/devices/events, which remain certificate-authenticated only.
• Admin observability/fleet (require an admin role): /admin/devices, /admin/agents, /admin/mcps, /admin/fleet/*, /admin/observability/*, /admin/audit-logs.

The full request/response shapes are documented in the API Reference (generated from the OpenAPI spec) and the Observability Event Schema.

Health check

GET /v1/healthcheck returns service status and system information; use it for readiness checks and to confirm the control plane is up before pointing endpoints at it.