# `gcp-gateway.json` schema (`tare gateway install`)

> Reference for the gcp-gateway.json config file consumed by tare gateway install --type gcp through the --config flag.

# `gcp-gateway.json` schema (`tare gateway install`)

  The JSON config file accepted by <Link to="/reference/tare-cli/install-gateway"><code>tare gateway install --type gcp</code></Link>, consumed through the <code>--config</code> flag.

This document describes the JSON config file accepted by:

```bash
tare gateway install identity.json --type gcp --config gcp-gateway.json
```

The parser is implemented in
`svc/cli/internal/tare/gateway/config/types.go` (`Config`).

> **Tip:** Use [`tare gateway config init`](./gateway-config-init.mdx) to
> bootstrap a starter file from just a serve domain and a GCP project
> ID: the remaining fields documented below are pre-filled with
> sensible derivations and defaults that you can edit in place.

> **Azure:** for the `--type azure` flow, see
> [`azure-gateway.json` schema](./azure-gateway-config.mdx).

## Supported keys

All keys are optional in JSON, but some become required by the selected workflow.

| Key | Type | Used for | Required when |
|---|---|---|---|
| `projectId` | string | GCP project for prerequisite automation | `--dry-run-prereqs` or `--apply-prereqs` |
| `serveDomain` | string | DNS hostname/domain for DNS authorization + cert map entry | creating cert/dns prereqs from CLI |
| `customer` | string | Helm value `customer` | unless provided by identity / `--customer` |
| `environment` | string | Helm value `environment` | required when customer is `saas` |
| `serveUrl` | string | Helm value `serveUrl` | optional (falls back to identity fields) |
| `securityPolicy` | string | Helm value `securityPolicy` | optional |
| `certificateMap.name` | string | GCP cert map name + Helm `certificateMap.name` | prereq workflow and recommended for deploy |
| `gateway.staticIpName` | string | GCP global static IP name + Helm `gateway.staticIpName` | optional but recommended |
| `certificate.name` | string | Managed cert resource name (gcloud automation) | when automating cert creation |
| `dnsAuthorization.name` | string | DNS authorization resource name (gcloud automation) | optional (auto-derived if omitted) |
| `namespaces.gateway` | string | Gateway release namespace | optional (default `tars-gateway`) |
| `namespaces.system` | string | System namespace reference | optional (default `tars-system`) |
| `namespaces.dataplane` | string | Dataplane namespace reference | optional (default `tars-dataplane`) |
| `gcloud.skipExisting` | bool | Continue when gcloud create hits "already exists" | optional (`false` default) |

## Example

`examples/gcp-gateway.pocnt.json`:

```json
{
  "projectId": "withfraser",
  "serveDomain": "proxy.pocnt.tetrate.ai",
  "customer": "pocnt",
  "environment": "production",
  "serveUrl": "proxy.pocnt.tetrate.ai",
  "certificateMap": {
    "name": "pocnt-tetrate-ai"
  },
  "certificate": {
    "name": "pocnt-serve-cert"
  },
  "dnsAuthorization": {
    "name": "proxy-pocnt-tetrate-ai-dns-auth"
  },
  "namespaces": {
    "gateway": "tars-gateway",
    "system": "tars-system",
    "dataplane": "tars-dataplane"
  },
  "gcloud": {
    "skipExisting": false
  }
}
```

## Field precedence

For most values, precedence is:

1. explicit CLI flag
2. `gcp-gateway.json` (`--config`)
3. identity file defaults / built-in defaults

Notable defaults:

- `--serve-url`: falls back to `serveUrl` (config), then `serveDomain` (config), then identity `serveUrl`, then identity `proxy` (legacy).
- `--dns-authorization-name`: if omitted and cert automation is enabled, default becomes `<normalized-serve-domain>-dns-auth`.

## Minimal configs by use case

### A) Install only (prereqs handled outside CLI)

Usually enough:

```json
{
  "customer": "acme",
  "serveUrl": "proxy.acme.example.com",
  "certificateMap": { "name": "acme-cert-map" }
}
```

Then run:

```bash
tare gateway install identity.json \
  --type gcp \
  --config gcp-gateway.json \
  --ack-prereqs
```

### B) Use `--apply-prereqs` / `--dry-run-prereqs`

Provide at least:

- `projectId`
- `certificateMap.name`

And for certificate + DNS automation:

- `certificate.name`
- `serveDomain`

`gateway.staticIpName` is optional (CLI only creates static IP when set).

Where to go next

  <Link to="/reference/tare-cli/install-gateway" className="tare-nav-card">
    tare gateway install
    Consume this config to provision GCP prereqs and deploy the gateway.
  </Link>
  <Link to="/reference/tare-cli/azure-gateway-config" className="tare-nav-card">
    azure-gateway.json schema
    The equivalent config file for the Azure gateway flow.
  </Link>