> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Generated private TrustGate configuration and customer-managed Hybrid services.

## Generated setup

Start in [TrustGate's private gateway wizard](/neuraltrust/deployment/overview#create-a-private-trustgate-gateway). The runtime choices are **Docker**, **Kubernetes**, and **Manual**.

**Docker** displays a generated Compose command. It fetches the maintained TrustGate Compose manifest and injects:

* A generated `CONFIG_SYNC_LKG_KEY`
* The wizard-issued `CONFIG_SYNC_TOKEN`
* The wizard-issued `ENROLMENT_TOKEN`

Before running it, provide these additional values required by the Compose manifest:

* `SERVER_SECRET_KEY` — a random value of at least 32 bytes
* `CONFIG_SYNC_GRPC_ENDPOINT` — the SaaS config-sync endpoint as `host:port`
* `DATABRIDGE_ADDR` — the DataBridge endpoint as `host:port`

The generated Compose path starts the TrustGate LLM/proxy process and publishes port `8081`. It does **not** start or expose the MCP process on `8082`. Use Kubernetes for production MCP support, or run the full local TrustGate stack when you need both processes locally.

**Kubernetes** displays generated `values.yaml` and a Helm command. Kubernetes is recommended for production-grade deployments, but this output is setup and credential input rather than an install-ready chart contract. Use the maintained `neuraltrust-platform` chart or manifests as the deployment source, and map the generated credentials and settings into its current values and Secret interfaces before applying.

**Manual** displays exactly these generated environment values and does not display a deployment command:

* `CONTROL_PLANE_JWT`
* `DATA_AGENT_JWT`

Treat these values as secrets except for service URLs. Inject them into your maintained deployment manifests through an approved secret manager; do not commit them.

After deployment, expose separate LLM/proxy and MCP entry points. Enter the LLM/proxy URL as the wizard's bootstrap **Dataplane URL**, then select **Save and Finish**. The wizard initially seeds both URLs with that value. Open **Settings → Agent Gateway → General** and set the final **LLM URL** and **MCP URL** independently.

TrustGate listens on these ports by default:

| Entry point | Port   |
| ----------- | ------ |
| Admin       | `8080` |
| LLM/proxy   | `8081` |
| MCP         | `8082` |

When the full local TrustGate stack runs both processes, use the same hostname with different ports, such as `http://gateway.example:8081` and `http://gateway.example:8082`. Do not configure an MCP URL for the generated Compose path unless you separately run and expose the MCP process.

## Kubernetes

Choose **Kubernetes** in the wizard to obtain setup and credential input. Do not apply its generated values or local-chart Helm command unchanged. Platform operators must review and map that input into the current maintained `neuraltrust-platform` chart or manifests. Use **Manual** when you maintain a fully custom deployment.

For production, set `deploymentMode: hybrid` and point the maintained chart at managed PostgreSQL and Redis (`deploy: false`):

```yaml theme={null}
global:
  deploymentMode: hybrid
  platform: kubernetes
  domain: platform.example.com
  postgresql:
    deploy: false
    host: postgres.example.com
    port: 5432
    user: neuraltrust
    database: neuraltrust
    sslMode: require
    existingSecret:
      name: hybrid-postgresql
  redis:
    deploy: false
    host: redis.example.com
    port: 6379
    tls: "true"
    existingSecret:
      name: hybrid-redis
```

The wizard-generated Kubernetes file contains credentials directly. Do not commit or use it as a production values file. Move its credentials into pre-created Kubernetes Secrets or an approved secret manager, then use the maintained chart's documented Secret interfaces. For custom manifests, inject the two Manual JWT values through an approved secret manager. See [Credential contracts](/neuraltrust/deployment/secrets#credential-contracts).

## Cluster sizing

Chart defaults are a **sensible starting point**. For Hybrid, plan on about
**3–4** workers at **8 vCPU / 16–32 GiB**; for External, about **4–5** of the
same class. Right-size and fine-tune for your traffic — see
[Cluster sizing](/neuraltrust/deployment/sizing).

## Managed stores

Managed PostgreSQL and Redis are recommended for production. Pre-create the database, role, and Redis credentials; Helm does not create users in managed services. The maintained chart supports in-cluster PostgreSQL and Redis with `deploy: true` for evaluation and non-production environments.

For regional active/passive deployments, each region uses independent stores; runtime and historical data are not replicated between regions. See [High availability](/neuraltrust/deployment/high-availability#no-cross-region-data-replication).

| Store          | Minimum size                                  |
| -------------- | --------------------------------------------- |
| **PostgreSQL** | **2 vCPU**, **4 GiB RAM**, **20 GiB** storage |
| **Redis**      | **1 GiB** memory                              |

| Provider | PostgreSQL                                    | Redis                           |
| -------- | --------------------------------------------- | ------------------------------- |
| AWS      | RDS/Aurora `db.t4g.medium`, 20 GiB+           | ElastiCache `cache.t4g.small`   |
| GCP      | Cloud SQL `db-custom-2-4096`, 20 GiB+         | Memorystore **1 GiB**           |
| Azure    | Flexible Server **2 vCores / 4 GiB**, 20 GiB+ | Cache for Redis **C1** (1 GiB)+ |

Reach both over private networking from the cluster. Secret key contracts: [Secrets](/neuraltrust/deployment/secrets).

## Ingress

```yaml theme={null}
global:
  platform: aws
  domain: platform.example.com
  storageClass: gp3
  ingress:
    className: alb
    aws:
      certificateArn: arn:aws:acm:region:account:certificate/id
```

`global.domain` is used with the default host prefixes to render two public names:

* `gateway.<global.domain>` for the LLM/proxy Ingress
* `mcp.<global.domain>` for the MCP Ingress

The maintained chart creates separate `agentgateway-gateway` and `agentgateway-mcp` Ingress resources backed by separate Services. Each Service exposes port `80`: the proxy Service targets TrustGate container port `8081`, and the MCP Service targets container port `8082`. Set the corresponding full URLs, including `https://`, in **Settings → Agent Gateway → General**. `global.domain` does not update those console settings.

For regional active/passive deployments, put global LLM and MCP endpoints in front of the regional Ingress resources and configure those stable URLs in the console. See [High availability](/neuraltrust/deployment/high-availability#regional-topology).

Render and install with your maintained deployment manifests. See [Feature flags](/neuraltrust/deployment/feature-flags) and [Secrets](/neuraltrust/deployment/secrets).