Operations¶
As an operator, you handle these parts of Sluice:
| Part | Server config key | Default | What it is |
|---|---|---|---|
| REST listener | rest.listen | :8080 | Queries, health endpoints and approval links. See Deployment. |
| Admin listener | admin.listen | :9091, off | The Admin API and /metrics. Turn it on with admin.enabled: true and set a token. |
| Policy directory | policies.directory | ./policies.d | Policies, subject bindings and data sources. Sluice reloads it. |
| Audit directory | audit.file.path | None | The audit log. Sluice creates it with mode 0750. |
| State directory | budget.stateDir, approval.stateDir | ./state | Budget counters with budget.enabled: true, approvals with approval.persist: true. Sluice creates it with mode 0700. |
- Without
audit.file.path, Sluice writes the audit log to the temp directory of the system and logs a warning. - Every
.yamland.ymlfile in the policy directory must be a policy object. Sluice skips hidden directories and the directoriestestsandtestdata.
Pages¶
- Deployment: image, ports, health endpoints, TLS, signals.
- Server config & secrets: how Sluice loads the config and reads secrets.
- Data sources: the
DataSourcetypes. - Synthetic data: generated rows in place of real ones.
- Configuration reload: change policies without a restart.
- Observability: logs, metrics and tracing.
For a production checklist, see Hardening.