FAQ

Which file do I change?

To change	Edit	Owned by
Which repositories are synced, where data goes, credentials, self_heal, what may never change (force)	config.cue	the team running varTrack
A tenant's branches, root keys, prune and sync settings for the rules it uses	the tenant's bundle.json	the tenant
One repository's settings	its vartrack.json	the repository's owners

Configuration files has the full picture, and Rule options which file may set each option.

I changed config.cue — do I need to restart?

The orchestrator re-reads it when the file changes. The gateway reads it once at startup: restart it after changing platforms, rules or repositories. The watcher reads it only for leader election.

I changed bundle.json — when does it apply?

At the next refresh of the tenant's schema repository: every SCHEMA_TTL_SECONDS (300 s), or at once on a push when the repository is the one config.cue's schema_registry names.

Does vartrack.json on a feature branch apply?

Yes, to pushes of that branch: the file is read at the pushed commit, so each branch can carry its own.

What happens on a push to a branch I did not map?

Nothing is written: the push feeds no environment of the rule, so it is skipped and the task says so ("nothing to do: branch feature/x feeds no environment of …"). There is no default environment. Map every branch you push to — see Environment resolution.

Can a repository turn on self_heal, or change where data is written?

No. self_heal, repositories, secret_manager, force, tenants and the datasources' connection settings come from config.cue only. A repository can set the options listed under Overridable keys, and force still wins.

Will varTrack delete keys I added by hand?

No. Prune deletes only keys varTrack wrote before and Git no longer holds, and keeps a key whose value something else changed since (with a PruneSkipped event). Keys matching a protection pattern are never deleted. See What prune deletes.

Two datasources write the same Redis — will one prune the other's keys?

No. Each sync records the key space it wrote to; a prune keeps every key another target holds in the same key space, and warns once with a SharedKeySpace event.

How do I try a change without writing anything?

vt sync --dry-run … (or the Dry run button in the web UI, or the dry-run webhook) reads, validates and reports what would be written, and which keys a prune would delete. A dry run is something you start, not a setting of a rule (the dry_run rule option was removed: a rule that set it never wrote).

Where are secrets kept?

Not in Git. config.cue credentials can be {file: …} (a mounted secret) or {ref: …} (Vault); a config file's values can be @secret() fields its CUE schema marks, fetched from Vault when the file is synced. varTrack records only digests of secret values. See Secret value forms and Schema annotations.

Why does the web UI not show a rule?

The UI shows what your Git account can read. A rule whose repositories you cannot read, or whose platform you have not connected, is counted as hidden; Connect signs in to that platform. Without ui.auth, the UI shows every rule.

Can I run several gateways, workers and watchers?

Yes. Workers and gateways scale out; one watcher leads at a time. Set gateway_nonce_datasource (required in production) and watcher_leader_election_datasource — see High availability.