feat(config): export the effective configuration with gomodel config export

SA
2d ago
+3642-73

Description

Closes #1223.

Adds gomodel config export, which prints the configuration a gateway started now would run with as a config.yaml. It covers every setting (defaults, config.yaml, env vars) and the objects saved in the dashboard: providers, virtual models, users, MCP servers, tagging headers, budgets and rate limits. Load the output as config/config.yaml to run the same gateway from a file.

It is a CLI command only, with no admin endpoint and no dashboard UI, so a leaked dashboard session or API key cannot read the configuration.

No secret is printed:

  • A secret is written as the reference it was configured with (${env:…}, ${file:…}, ${vault:…}). Without one, it becomes ${env:SUGGESTED_NAME} with a comment naming the variable to set.
  • Credential-looking values outside known secret fields are also replaced by env references:
    • URLs with credentials;
    • token= / Bearer text;
    • MCP stdio args such as --api-key X and --header=Authorization: Bearer X;
    • secret-named keys in extensions:.
  • Text saved in the dashboard, such as a user description containing ${env:GOMODEL_MASTER_KEY}, is escaped, so it cannot become a live reference when the file is loaded back.

Not exported (listed in the file header): managed API keys, workflows, guardrails created in the dashboard, pricing overrides, runtime settings, and disabled provider credentials.

Docs: docs/advanced/cli.mdx, docs/advanced/config-yaml.mdx.

Summary by CodeRabbit

  • New Features
    • Added gomodel config export to print effective configuration as YAML, including defaults, configuration files, environment variables, and dashboard-managed settings and objects.
    • Export replaces detected secrets with references or environment-variable placeholders. The YAML can be loaded again, with dashboard-managed objects treated as read-only.
    • The command refuses to write output to the configuration file it reads when that file can be detected.
  • Documentation
    • Added guidance on exporting configuration, secret handling, redirection safety, and settings that cannot be exported. Bare tokens in free-form text may remain visible.