Gateway Environment Configuration

Configuration procedures for custom gateway environments

Overview

The gateway agent runs with default set of settings, which can be customized to add or remove internal features. This guide goes through the procedures for changing these settings, depending on the gateway installation medium.

There are two ways to apply settings / add features to the gateway:

• With environment variables (Docker, Windows, Linux)
• With CLI arguments (Windows, Linux)

Some features can only be set with environment variables, see Gateway Environment Variables for a table of what is available with either approaches.

Environment Variables

Environment Variables can be set to define gateway settings and features. For Docker installations, they are the only way to configure the gateway.

Docker Installations

1. Update your docker-compose.yml file:

vi docker-compose.yml

1. Add / remove environment variables from the environment block of the gateway service:

services:
  keeper-gateway:
    platform: linux/amd64
    image: keeper/gateway:latest
    shm_size: 2g
    restart: unless-stopped
    security_opt:
      - seccomp:docker-seccomp.json
      - apparmor:gateway-apparmor-profile
    environment:
      ACCEPT_EULA: Y
      GATEWAY_CONFIG: ey...
      KEEPER_GATEWAY_...: true    # ← New variable

1. Restart your Docker container:

docker compose up -d

Linux Installations

The Linux-native gateway runs as a systemd service.

1. Update the service file:

vi /etc/systemd/system/keeper-gateway.service

1. Add / remove environment variables from the service configuration:

[Unit]
...

[Service]
...
ExecStart=/bin/bash -c "/usr/local/bin/gateway start --service --config-file /etc/keeper-gateway/gateway-config.json --log-to-stdout"
User=keeper-gw
Group=keeper-gw
Environment=RECORDING_PATH=/opt/keeper/gateway/recordings
Environment=TYPE_SCRIPT_RECORDING_PATH=/opt/keeper/gateway/recordings
Environment=GUACD_RECORDING_PATH=/opt/keeper/gateway/recordings
Environment=GUACD_TYPE_SCRIPT_RECORDING_PATH=/opt/keeper/gateway/recordings
Environment=KEEPER_RBI_PROFILE_STORAGE_PATH=/opt/keeper/gateway/rbi-profiles
Environment=KEEPER_RDP_DRIVE_STORAGE_PATH=/opt/keeper/gateway/rdp-drives
Environment=KEEPER_GATEWAY_...=true    # ← New variable
...

[Install]
...

1. Reload the systemd daemon:

systemctl daemon-reload

1. Restart the Keeper gateway:

systemctl restart keeper-gateway.service

Windows Installations

The Windows-native gateway runs as a Windows Service by default. Variables can be set at machine-scope to apply to services and persist across user sessions:

1. In PowerShell, define new Keeper gateway environment variables:

[Environment]::SetEnvironmentVariable("KEEPER_GATEWAY_...", "true", "Machine")

1. Restart the Keeper gateway service:

CLI Arguments

The gateway is a program that launches when the service / container starts, and it starts with some CLI arguments by default. Additional arguments can be set to change gateway settings or add features.

Docker Installations

Since Docker containers are ephemeral, the CLI shouldn't be used to update the gateway configuration, as changes won't persist if the container is restarted. The CLI can be used to run ephemeral commands, however, such as checking the gateway version:

docker exec -it <gateway-process-id> /opt/keeper/gateway/keeper-gateway version

Linux Installations

The Linux-native gateway runs as a systemd service, which executes the gateway start CLI when the service starts. You can add CLI arguments to the start command in the following way.

1. Update the service file:

vi /etc/systemd/system/keeper-gateway.service

1. Add / remove environment variables from the service configuration:

[Unit]
...

[Service]
...
ExecStart=/bin/bash -c "/usr/local/bin/gateway start --service --config-file /etc/keeper-gateway/gateway-config.json --log-to-stdout <CLI_ARGUMENT_HERE>"
...

[Install]
...

1. Reload the systemd daemon:

systemctl daemon-reload

1. Restart the Keeper gateway:

systemctl restart keeper-gateway.service

Windows Installations

The Windows-native gateway runs as a Windows Service by default, which executes the gateway start CLI when the service starts. You can add CLI arguments to the start command in the following way.

1. Open the Keeper gateway service's Properties menu, and add arguments in the input field (the service must be stopped first):

1. Make sure to start the service from that menu (do not press OK), or else the new arguments will not be accounted for.