Configuration
Self-hosted deployment, decision-service configuration and local policies.
Deployment model
SURADAR runs in the customer’s environment as a Go library and a decision service binary named suradar-pdp. Glyphzero does not run a hosted SURADAR service. An integrator wraps Hypertext Transfer Protocol (HTTP) handlers with the library’s middleware stack or puts suradar-pdp in front of tool calls. Agents sign requests with a software development kit (SDK).
suradar-pdp config
suradar-pdp reads one strict JavaScript Object Notation (JSON) config file, given by --config or SURADAR_PDP_CONFIG. It rejects unknown fields. The --check-config flag validates the config and exits.
suradar-pdp --config /etc/suradar-pdp/config.json --check-configSecrets, such as the admin key, are read from files rather than the config body.
License
The release build of the suradar command-line interface (CLI) requires a license file signed offline by Glyphzero using Ed25519, read from SURADAR_LICENSE_FILE. Pilot is one license tier.
Environment variables
| Variable | Purpose |
|---|---|
SURADAR_PDP_CONFIG | Config path for suradar-pdp |
SURADAR_LICENSE_FILE | License file for the suradar CLI release build |
VAULT_ADDR | Address for the optional HashiCorp Vault seed key store |
VAULT_TOKEN_FILE | Token file for the optional HashiCorp Vault seed key store |
Policies
The governance layer evaluates Cedar policies loaded from local files. A forbid rule always wins over a permit rule. Policy versions must be activated explicitly before they take effect.
Identity providers and SIEM export
Integrators configure identity connectors and security information and event management (SIEM) exporters in Go code using library configuration structs. See Integrations.
Admin console
A thin, single-file admin console uses static Hypertext Markup Language (HTML) to list, create and delete management application programming interface (API) objects. It connects with a base URL and a bearer token.