Run the open-source gateway

Reference for the open-source DVARA LLM Gateway, run from one gateway.yaml. The quickstart gets it running.

Audit log

To keep an audit record, set two variables:

DVARA_AUDIT_FILE_PATH=/var/lib/dvara/audit.log
DVARA_AUDIT_HMAC_SECRET=$(openssl rand -base64 32)

Without the path, events are dropped. With the path, the gateway refuses to start unless the secret is at least 32 characters and is not a placeholder: not the shipped default, and not a value from DVARA's own examples, such as dev-only-change-me. The chain is tamper-evident, not tamper-proof: it detects an edited, removed or reordered record, and anyone holding the secret can rewrite it.

Verify the chain, from the module jars or from the runnable jar

DVARA_AUDIT_HMAC_SECRET=... java \
  -cp dvara-gateway-autoconfigure/target/dvara-gateway-autoconfigure-<version>.jar:dvara-gateway-core/target/dvara-gateway-core-<version>.jar \
  com.dvarahq.autoconfigure.audit.FileAuditChainVerifier /var/lib/dvara/audit.log

The two jars and a JDK are the whole requirement, so the check can run on another machine. From the runnable jar instead:

DVARA_AUDIT_HMAC_SECRET=... java -cp dvara-gateway-server-<version>-app.jar \
  -Dloader.main=com.dvarahq.autoconfigure.audit.FileAuditChainVerifier \
  org.springframework.boot.loader.launch.PropertiesLauncher /var/lib/dvara/audit.log

The verifier exits 0 when the chain verified over at least one record, 1 when a record failed, naming the line, and 2 when nothing was checked. The secret is read from the environment, never from an argument.

To write the record somewhere else, implement AuditWriter from dvara-gateway-core and register it as a bean; the file writer stands down. HmacSigner in the same module gives you the bytes to sign and the previous-hash rule.

Deployment

The jar from a release and the jar from a build run the same way, as a plain Java process on port 8080. It reads gateway.yaml from the working directory; to keep the file elsewhere, name it:

DVARA_CONFIG_FILE=/etc/dvara/gateway.yaml \
OPENAI_API_KEY=sk-... \
java -jar dvara-gateway-server-<version>-app.jar

The image ghcr.io/dvarahq/dvara-gateway-oss is the same jar with a JRE. Its working directory is /app, so a file mounted at /app/gateway.yaml is found with no further setting, and every environment variable above is passed with -e. To keep the audit log, mount a volume at /var/lib/dvara and point DVARA_AUDIT_FILE_PATH into it. Pin a version tag in production.

Observability

Health probes at /actuator/health/liveness and /actuator/health/readiness are open. Metrics at /actuator/prometheus answer only to the key in DVARA_ACTUATOR_METRICS_API_KEY, and the other actuator endpoints to DVARA_ACTUATOR_API_KEY; with a key unset, that endpoint returns 401. Traces go to OpenTelemetry when OTEL_EXPORTER_OTLP_ENDPOINT names a collector and nowhere otherwise.