Bootstrap configuration

Goal

Know which settings live in appsettings/env versus PostgreSQL snapshots.

Two layers

Layer	Examples	Source
Bootstrap	Connection strings, JWT signing key, Redis, internal API key, plugin directory	Env (priority 100) + JSON file (200) via ShieldGate.Configuration
Runtime WAF / topology	Hosts, routes, policies, rate limits, certs	PostgreSQL → versioned snapshots

Higher bootstrap priority wins on key merge. WAF decisions are never hardcoded—they come from DB snapshots evaluated on the Proxy.

Steps

1. Put secrets in environment variables or a secret store—not in git.
2. Optionally set ShieldGateConfiguration:JsonFilePath for file-based bootstrap.
3. Use the admin UI/API for day-to-day security policy.

Verify

• Host starts with expected Redis/JWT settings.
• Changing a policy in the UI changes Proxy behavior only after publish/swap—not via editing appsettings.