/usr/bin/gatekeeper

2026/11/08 02:48:02 maxprocs: Leaving GOMAXPROCS=64: CPU quota undefined
2026/11/08 02:48:02 INFO GOMEMLIMIT is updated package=github.com/KimMachineGun/automemlimit/memlimit GOMEMLIMIT=243218095718 previous=9223372036854775807
NAME:
   gatekeeper - is a proxy using the keycloak service for auth and authorization

USAGE:
   gatekeeper [options]

VERSION:
   4.9.0 (git+sha: d13a45f, built: 05-06-2026)

COMMANDS:
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --match-claims value [ --match-claims value ]                                  keypair values for matching access token claims e.g. aud=myapp, iss=http://example.*
   --tags value [ --tags value ]                                                  keypairs passed to the templates at render,e.g title=Page
   --default-allowed-query-params value [ --default-allowed-query-params value ]  default allowed query params, sent to IDP key=value
   --allowed-query-params value [ --allowed-query-params value ]                  allowed query params, sent to IDP key=optional value
   --response-headers value [ --response-headers value ]                          custom headers to added to the http response key=value
   --headers value [ --headers value ]                                            custom headers to the upstream request, key=value
   --openid-provider-headers value [ --openid-provider-headers value ]            http headers sent to idp provider
   --tls-forwarding-ca-private-key value                                          path to the CA private key, used for generating server cert for forwarding proxy [$PROXY_TLS_FORWARDING_CA_PRIVATE_KEY]
   --tls-store-ca-certificate value                                               path to the ca certificate used for verifying trusted server certificates [$PROXY_TLS_STORE_CA_CERTIFICATE]
   --post-login-redirect-path value                                               path to which client is redirected after successful login, in case user access / [$PROXY_POST_LOGIN_REDIRECT_PATH]
   --revocation-url value                                                         url for the revocation endpoint to revoke refresh token [$PROXY_REVOCATION_URL]
   --openid-provider-proxy value                                                  proxy for communication with the openid provider [$PROXY_OPENID_PROVIDER_PROXY]
   --upstream-proxy value                                                         proxy for communication with upstream [$PROXY_UPSTREAM_PROXY]
   --upstream-no-proxy value                                                      list of upstream destinations which should be not proxied [$PROXY_UPSTREAM_NO_PROXY]
   --base-uri value                                                               common prefix for all URIs [$PROXY_BASE_URI]
   --oauth-uri value                                                              the uri for proxy oauth endpoints (default: "/oauth") [$PROXY_OAUTH_URI]
   --upstream-url value                                                           url for the upstream endpoint you wish to proxy [$PROXY_UPSTREAM_URL]
   --upstream-ca value                                                            the path to a file container a CA certificate to validate the upstream tls endpoint [$PROXY_UPSTREAM_CA]
   --request-id-header value                                                      the http header name for request id (default: "X-Request-ID") [$PROXY_REQUEST_ID_HEADER]
   --content-security-policy value                                                specify the content security policy [$PROXY_CONTENT_SECURITY_POLICY]
   --opa-authz-uri value                                                          OPA endpoint address with path [$PROXY_OPA_AUTHZ_URI]
   --cookie-domain value                                                          domain the access cookie is available to, defaults host header [$PROXY_COOKIE_DOMAIN]
   --cookie-path value                                                            path for which cookie is valid [$PROXY_COOKIE_PATH]
   --cookie-access-name value                                                     name of the cookie used to hold the access token (default: "kc-access") [$PROXY_COOKIE_ACCESS_NAME]
   --cookie-id-token-name value                                                   name of the cookie used to hold id token (default: "id_token") [$PROXY_COOKIE_ID_TOKEN_NAME]
   --cookie-refresh-name value                                                    name of the cookie used to hold the encrypted refresh token (default: "kc-state") [$PROXY_COOKIE_REFRESH_NAME]
   --cookie-oauth-state-name value                                                name of the cookie used to hold the Oauth request state (default: "OAuth_Token_Request_State") [$PROXY_COOKIE_OAUTH_STATE_NAME]
   --cookie-request-uri-name value                                                name of the cookie used to hold the request uri (default: "request_uri") [$PROXY_COOKIE_REQUEST_URI_NAME]
   --cookie-pkce-name value                                                       name of the cookie used to hold PKCE code verifier (default: "pkce") [$PROXY_COOKIE_PKCE_NAME]
   --cookie-uma-name value                                                        name of the cookie used to hold the UMA RPT token [$PROXY_COOKIE_UMA_NAME]
   --same-site-cookie value                                                       enforces cookies to be send only to same site requests according to the policy (can be Strict|Lax|None) (default: "Lax") [$PROXY_SAME_SITE_COOKIE]
   --tls-cert value                                                               path to the TLS certificate [$PROXY_TLS_CERTIFICATE]
   --tls-private-key value                                                        path to the private key for TLS [$PROXY_TLS_PRIVATE_KEY]
   --tls-client-certificate value                                                 path to the client certificate used for authenticating to upstream [$PROXY_TLS_CLIENT_CERTIFICATE]
   --tls-client-private-key value                                                 path to the client private key, used for authentication to upstream [$PROXY_TLS_CLIENT_PRIVATE_KEY]
   --tls-client-ca-certificate value                                              path to the client CA certificate, used for verifying client certificates [$PROXY_TLS_CLIENT_CA_CERTIFICATE]
   --tls-forwarding-ca-certificate value                                          path to the CA certificate, used for generating server cert for forwarding-proxy [$PROXY_TLS_FORWARDING_CA_CERTIFICATE]
   --post-logout-redirect-uri value                                               url to which client is redirected after successful logout [$PROXY_POST_LOGOUT_REDIRECT_URI]
   --tls-min-version value                                                        specify server minimal TLS version one of tlsv1.2,tlsv1.3 (default: "tlsv1.3") [$PROXY_TLS_MIN_VERSION]
   --tls-admin-cert value                                                         path to the TLS certificate [$PROXY_TLS_ADMIN_CERTIFICATE]
   --tls-admin-private-key value                                                  path to the private key for TLS [$PROXY_TLS_ADMIN_PRIVATE_KEY]
   --tls-admin-client-certificate value                                           path to the client CA certificate user for verifying client certificates [$PROXY_TLS_ADMIN_CLIENT_CA_CERTIFICATE]
   --config value                                                                 path the a configuration file [$PROXY_CONFIG_FILE]
   --tls-store-client-certificate value                                           path to the client certificate, used for authenticating to store [$PROXY_TLS_STORE_CLIENT_CERTIFICATE]
   --tls-store-client-private-key value                                           path to the client private key, used for authenticating to store [$PROXY_TLS_STORE_CLIENT_PRIVATE_KEY]
   --store-url value                                                              url for the storage subsystem, e.g redis://user:secret@localhost:6379/0?protocol=3, only supported is redis usig redis uri spec [$PROXY_STORE_URL]
   --encryption-key value                                                         encryption key used to encryption the session state [$PROXY_ENCRYPTION_KEY]
   --letsencrypt-cache-dir value                                                  path where cached letsencrypt certificates are stored (default: "./cache") [$PROXY_LETS_ENCRYPT_CACHE_DIR]
   --sign-in-page value                                                           path to custom template displayed for signin [$PROXY_SIGN_IN_PAGE]
   --register-page value                                                          path to custom template displayed for registration [$PROXY_REGISTER_PAGE]
   --forbidden-page value                                                         path to custom template used for access forbidden [$PROXY_FORBIDDEN_PAGE]
   --error-page value                                                             path to custom template displayed for http.StatusBadRequest [$PROXY_ERROR_PAGE]
   --forwarding-grant-type value                                                  grant-type to use when logging into the openid provider, can be one of password, client_credentials (default: "password") [$PROXY_FORWARDING_GRANT_TYPE]
   --forwarding-username value                                                    username to use when logging into the openid provider [$PROXY_FORWARDING_USERNAME]
   --forwarding-password value                                                    password to use when logging into the openid provider [$PROXY_FORWARDING_PASSWORD]
   --tls-openid-provider-ca-certificate value                                     path to the ca certificate for IDP [$PROXY_TLS_OPENID_PROVIDER_CA_CERTIFICATE]
   --tls-openid-provider-client-private-key value                                 path to the client private key for IDP [$PROXY_TLS_OPENID_PROVIDER_CLIENT_PRIVATE_KEY]
   --tls-openid-provider-client-certificate value                                 path to the client certificate for IDP [$PROXY_TLS_OPENID_PROVIDER_CLIENT_CERTIFICATE]
   --listen value                                                                 Defines the binding interface for main listener, e.g. {address}:{port}. This is required and there is no default value [$PROXY_LISTEN]
   --listen-http value                                                            interface we should be listening to for HTTP traffic [$PROXY_LISTEN_HTTP]
   --listen-admin value                                                           defines the interface to bind admin-only endpoint (live-status, debug, prometheus...). If not defined, this defaults to the main listener defined by Listen [$PROXY_LISTEN_ADMIN]
   --listen-admin-scheme value                                                    scheme to serve admin-only endpoint (http or https). [$PROXY_LISTEN_ADMIN_SCHEME]
   --discovery-url value                                                          discovery url to retrieve the openid configuration [$PROXY_DISCOVERY_URL]
   --client-id value                                                              client id used to authenticate to the oauth service [$PROXY_CLIENT_ID]
   --client-secret value                                                          client secret used to authenticate to the oauth service [$PROXY_CLIENT_SECRET]
   --redirection-url value                                                        redirection url for the oauth callback url, defaults to host header if absent [$PROXY_REDIRECTION_URL]
   --compress-token-only-auth-scheme value                                        compress token only for chosen auth scheme: cookie, bearer, default is empty [$PROXY_COMPRESS_TOKEN_ONLY_AUTH_SCHEME]
   --hostnames value [ --hostnames value ]                                        list of hostnames the service will respond to
   --forwarding-domains value [ --forwarding-domains value ]                      list of domains which should be signed; everything else is relayed unsigned
   --cors-exposed-headers value [ --cors-exposed-headers value ]                  expose cors headers access control (Access-Control-Expose-Headers)
   --cors-headers value [ --cors-headers value ]                                  set of headers to add to the CORS access control (Access-Control-Allow-Headers)
   --cors-methods value [ --cors-methods value ]                                  methods permitted in the access control (Access-Control-Allow-Methods)
   --cors-origins value [ --cors-origins value ]                                  origins to add to the CORE origins control (Access-Control-Allow-Origin)
   --add-claims value [ --add-claims value ]                                      extra claims from the token and inject into headers, e.g given_name -> X-Auth-Given-Name
   --exclude-claims value [ --exclude-claims value ]                              do not add these claims as headers, can be one of: audience, email, expiresin, groups, roles, subject, userid, username
   --self-signed-tls-hostnames value [ --self-signed-tls-hostnames value ]        a list of hostnames to place on the self-signed certificate
   --custom-http-methods value [ --custom-http-methods value ]                    list of additional non-standard http methods
   --resources value [ --resources value ]                                        list of resources 'uri=/admin*|methods=GET,PUT|roles=role1,role2'
   --scopes value [ --scopes value ]                                              list of scopes requested when authenticating the user
   --opa-timeout value                                                            timeout for connection to OPA (default: 10s) [$PROXY_OPA_TIMEOUT]
   --pat-retry-interval value                                                     interval between retries to get PAT (default: 10s) [$PROXY_PAT_RETRY_INTERVAL]
   --pat-retry-count value                                                        number of retries to get PAT (default: 0) [$PROXY_PAT_RETRY_COUNT]
   --cors-max-age value                                                           max age applied to cors headers (Access-Control-Max-Age) (default: 0s) [$PROXY_CORS_MAX_AGE]
   --upstream-timeout value                                                       maximum amount of time a dial will wait for a connect to complete (default: 10s) [$PROXY_UPSTREAM_TIMEOUT]
   --upstream-keepalive-timeout value                                             specifies the keep-alive period for an active network connection (default: 10s) [$PROXY_UPSTREAM_KEEPALIVE_TIMEOUT]
   --upstream-tls-handshake-timeout value                                         the timeout placed on the tls handshake for upstream (default: 10s) [$PROXY_UPSTREAM_TLS_HANDSHAKE_TIMEOUT]
   --upstream-response-header-timeout value                                       the timeout placed on the response header for upstream (default: 10s) [$PROXY_UPSTREAM_RESPONSE_HEADER_TIMEOUT]
   --upstream-expect-continue-timeout value                                       the timeout placed on the expect continue for upstream (default: 10s) [$PROXY_UPSTREAM_EXPECT_CONTINUE_TIMEOUT]
   --max-idle-connections value                                                   max idle upstream / keycloak connections to keep alive, ready for reuse (default: 0) [$PROXY_MAX_IDLE_CONNS]
   --max-idle-connections-per-host value                                          limits the number of idle connections maintained per host (default: 0) [$PROXY_MAX_IDLE_CONNS_PER_HOST]
   --server-grace-timeout value                                                   the server wait before closing the server (default: 10s) [$PROXY_SERVER_GRACE_TIMEOUT]
   --server-read-timeout value                                                    the server read timeout on the http server (default: 10s) [$PROXY_SERVER_READ_TIMEOUT]
   --server-write-timeout value                                                   the server write timeout on the http server (default: 10s) [$PROXY_SERVER_WRITE_TIMEOUT]
   --server-idle-timeout value                                                    the server idle timeout on the http server (default: 2m0s) [$PROXY_SERVER_IDLE_TIMEOUT]
   --self-signed-tls-expiration value                                             the expiration of the certificate before rotation (default: 3h0m0s) [$PROXY_SELF_SIGNED_TLS_EXPIRATION]
   --max-token-size value                                                         maximum size of token in bytes (default: 0) [$PROXY_MAX_TOKEN_SIZE]
   --max-body-size value                                                          maximum body size in bytes (default: 0) [$PROXY_MAX_BODY_SIZE]
   --openid-provider-retry-count value                                            number of retries for retrieving openid configuration (default: 0) [$PROXY_OPENID_PROVIDER_RETRY_COUNT]
   --openid-provider-timeout value                                                timeout for openid configuration on .well-known/openid-configuration (default: 30s) [$PROXY_OPENID_PROVIDER_TIMEOUT]
   --enable-profiling                                                             switching on the golang profiling via pprof on /debug/pprof, /debug/pprof/heap etc (default: false) (default: false) [$PROXY_ENABLE_PROFILING]
   --enable-idp-session-check                                                     during token validation it also checks if user session is still present, useful for multiapp logout (default: false) (default: false) [$PROXY_ENABLE_IDP_SESSION_CHECK]
   --enable-self-signed-tls                                                       create self signed certificates for the proxy (default: false) (default: false) [$PROXY_ENABLE_SELF_SIGNED_TLS]
   --enable-request-id                                                            indicates we should add a request id if none found (default: false) (default: false) [$PROXY_ENABLE_REQUEST_ID]
   --enable-logout-redirect                                                       indicates we should redirect to the identity provider for logging out (default: false) (default: false) [$PROXY_ENABLE_LOGOUT_REDIRECT]
   --enable-default-deny                                                          enables a default denial on all unauthenticated requests, you have to explicitly say what is permitted, although be aware that it allows any valid token (default: true) (default: false) [$PROXY_ENABLE_DEFAULT_DENY]
   --enable-default-deny-strict                                                   enables a default denial on all requests, even valid token is denied unless you create some resources (default: false) (default: false) [$PROXY_ENABLE_DEFAULT_DENY_STRICT]
   --enable-encrypted-token                                                       enable encryption for the access tokens (default: true) (default: false) [$PROXY_ENABLE_ENCRYPTED_TOKEN]
   --force-encrypted-cookie                                                       force encryption for the access tokens in cookies (default: false) (default: false) [$PROXY_FORCE_ENCRYPTED_COOKIE]
   --enable-logging                                                               enable http logging of the requests (default: false) (default: false) [$PROXY_ENABLE_LOGGING]
   --enable-json-logging                                                          switch on json logging rather than text (default: true) (default: false) [$PROXY_ENABLE_JSON_LOGGING]
   --enable-forwarding                                                            enables the forwarding proxy mode, signing outbound request (default: false) (default: false) [$PROXY_ENABLE_FORWARDING]
   --enable-security-filter                                                       enables the security filter handler (default: false) (default: false) [$PROXY_ENABLE_SECURITY_FILTER]
   --enable-refresh-tokens                                                        enables the handling of the refresh tokens (default: false) (default: false) [$PROXY_ENABLE_REFRESH_TOKEN]
   --enable-session-cookies                                                       access and refresh tokens are session only i.e. removed browser close (default: true) (default: false) [$PROXY_ENABLE_SESSION_COOKIES]
   --enable-login-handler                                                         enables the handling of the refresh tokens (default: false) (default: false) [$PROXY_ENABLE_LOGIN_HANDLER]
   --enable-register-handler                                                      enables the register handler (default: false) (default: false) [$PROXY_ENABLE_REGISTER_HANDLER]
   --enable-token-header                                                          enables the token authentication header X-Auth-Token to upstream (default: true) (default: false) [$PROXY_ENABLE_TOKEN_HEADER]
   --enable-authorization-header                                                  adds the authorization header to the proxy request (default: true) (default: false) [$PROXY_ENABLE_AUTHORIZATION_HEADER]
   --enable-header-encoding                                                       encodes header values according RFC 2047, in MIME B format (default: false) (default: false) [$PROXY_ENABLE_HEADER_ENCODING]
   --enable-authorization-cookies                                                 adds the authorization cookies to the uptream proxy request (default: true) (default: false) [$PROXY_ENABLE_AUTHORIZATION_COOKIES]
   --enable-https-redirection                                                     enable the http to https redirection on the http service (default: false) (default: false) [$PROXY_ENABLE_HTTPS_REDIRECT]
   --skip-openid-provider-tls-verify                                              skip the verification of any TLS communication with the openid provider (default: false) (default: false) [$PROXY_SKIP_OPENID_PROVIDER_TLSVERIFY]
   --enable-metrics                                                               enable the prometheus metrics collector on /oauth/metrics (default: false) (default: false) [$PROXY_ENABLE_METRICS]
   --filter-browser-xss                                                           enable the adds the X-XSS-Protection header with mode=block (default: false) (default: false) [$PROXY_ENABLE_BROWSER_XSS_FILTER]
   --filter-content-nosniff                                                       adds the X-Content-Type-Options header with the value nosniff (default: false) (default: false) [$PROXY_ENABLE_CONTENT_NO_SNIFF]
   --filter-frame-deny                                                            enable to the frame deny header (default: false) (default: false) [$PROXY_ENABLE_FRAME_DENY]
   --localhost-metrics                                                            enforces the metrics page can only been requested from 127.0.0.1 (default: false) (default: false) [$PROXY_LOCALHOST_METRICS]
   --enable-compression                                                           enable gzip compression for response (default: false) (default: false) [$PROXY_ENABLE_COMPRESSION]
   --enable-compress-token                                                        enable token gzip compression (default: false) (default: false) [$PROXY_ENABLE_COMPRESS_TOKEN]
   --enable-pkce                                                                  enable pkce for auth code flow, only S256 code challenge supported (default: true) (default: false) [$PROXY_ENABLE_PKCE]
   --preserve-host                                                                preserve the host header of the proxied request in the upstream request (default: false) (default: false) [$PROXY_PRESERVE_HOST]
   --enable-uma                                                                   enable uma authorization, please don't use it in production, we would like to receive feedback (default: false) (default: false) [$PROXY_ENABLE_UMA]
   --enable-opa                                                                   enable authorization with external Open policy agent (default: false) (default: false) [$PROXY_ENABLE_OPA]
   --secure-cookie                                                                enforces the cookie to be secure (default: true) (default: false) [$PROXY_SECURE_COOKIE]
   --http-only-cookie                                                             enforces the cookie is in http only mode (default: true) (default: false) [$PROXY_HTTP_ONLY_COOKIE]
   --enable-id-token-cookie                                                       enable id token cookie (default: false) (default: false) [$PROXY_ENABLE_IDTOKEN_COOKIE]
   --enable-uma-method-scope                                                      enables passing request method as 'method:GET' scope to keycloak for authorization (default: false) (default: false) [$PROXY_ENABLE_UMA_METHOD_SCOPE]
   --skip-upstream-tls-verify                                                     skip the verification of any upstream TLS (default: false) (default: false) [$PROXY_SKIP_UPSTREAM_TLS_VERIFY]
   --cors-credentials                                                             credentials access control header (Access-Control-Allow-Credentials) (default: false) (default: false) [$PROXY_CORS_CREDENTIALS]
   --enable-hmac                                                                  enable creating hmac for forwarded requests and verification on incoming requests (default: false) (default: false) [$PROXY_ENABLE_HMAC]
   --no-proxy                                                                     do not proxy requests to upstream, useful for forward-auth usage (with nginx, traefik) (default: false) (default: false) [$PROXY_NO_PROXY]
   --no-redirects                                                                 do not have back redirects when no authentication is present, 401 them (default: false) (default: false) [$PROXY_NO_REDIRECTS]
   --skip-access-token-issuer-check                                               according RFC issuer should not be checked on access token, this will be default true in future (default: true) (default: false) [$PROXY_SKIP_ACCESS_TOKEN_ISSUER_CHECK]
   --skip-access-token-clientid-check                                             according RFC client id should not be checked on access token, this will be default true in future (default: true) (default: false) [$PROXY_SKIP_ACCESS_TOKEN_CLIENT_ID_CHECK]
   --skip-authorization-header-identity                                           skip authorization header identity, means that we won't be extracting token from authorization header (e.g. if authorization header is used only by application behind gatekeeper) (default: false) (default: false) [$PROXY_SKIP_AUTHORIZATION_HEADER_IDENTITY]
   --upstream-keepalives                                                          enables or disables the keepalive connections for upstream endpoint (default: true) (default: false) [$PROXY_UPSTREAM_KEEPALIVES]
   --verbose                                                                      switch on debug / verbose logging (default: false) (default: false) [$PROXY_VERBOSE]
   --enabled-proxy-protocol                                                       enable proxy protocol (default: false) (default: false) [$PROXY_ENABLE_PROXY_PROTOCOL]
   --use-letsencrypt                                                              use letsencrypt for certificates (default: false) (default: false) [$PROXY_USE_LETS_ENCRYPT]
   --disable-all-logging                                                          disables all logging to stdout and stderr (default: false) (default: false) [$PROXY_DISABLE_ALL_LOGGING]
   --enable-loa                                                                   enables level of authentication (default: false) (default: false) [$PROXY_ENABLE_LOA]
   --enable-store-ha                                                              enable store high availability client, currently only redis-cluster supported (default: false) (default: false) [$PROXY_ENABLE_STORE_HA]
   --enable-signing                                                               enable signing of requests to upstream, when in reverse proxy mode (default: false) (default: false) [$PROXY_ENABLE_SIGNING]
   --enable-signing-hmac                                                          enable signing of requests to upstream, when in reverse proxy mode with HMAC (default: false) (default: false) [$PROXY_ENABLE_SIGNING_HMAC]
   --enable-x-forwarded-headers                                                   enable using X-Forwarded headers (host and proto) for callback and authorization url (default: false) (default: false) [$PROXY_ENABLE_X_FORWARDED_HEADERS]
   --enable-optional-encryption                                                   enable optional decryption for access tokens, id tokens, refresh tokens (default: false) (default: false) [$PROXY_ENABLE_OPTIONAL_ENCRYPTION]
   --enable-logout-auth                                                           enable authentication on logout handler (default: true) (default: false) [$PROXY_ENABLE_LOGOUT_AUTH]
   --enable-request-upstream-compression                                          enables asking upstream for compression, by adding Accept-Encoding: gzip header and decompressing response from upstream (default: true) (default: false) [$PROXY_ENABLE_REQUEST_UPSTREAM_COMPRESSION]
   --enable-accept-encoding-header                                                pass Accept-Encoding header from client to upstream (default: false) (default: false) [$PROXY_ENABLE_ACCEPT_ENCODING_HEADER]
   --enable-id-token-claims                                                       extract claims also from id token, you can then use --add-claims option to specify claims from id token (default: false) (default: false) [$PROXY_ENABLE_ID_TOKEN_CLAIMS]
   --enable-user-info-claims                                                      extract information from userinfo endpoint, you can then use --add-claims to specify claims (default: false) (default: false) [$PROXY_ENABLE_USER_INFO_CLAIMS]
   --override-destination-headers                                                 enables overriding headers set by gatekeeper by your upstream, flag present only for backward compatibility (default: false) (default: false) [$PROXY_OVERRIDE_DESTINATION_HEADERS]
   --help, -h                                                                     show help
   --version, -v                                                                  print the version