set_config
Writes a validated, audited daemon configuration section for admin-scoped changes, merging keys and rejecting unknown or protected values. Use dry_run to preview the plan before applying.
Instructions
Write a daemon config section (admin-scoped, validated, audited).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| values | Yes | Keys to merge into that section: an omitted key keeps its stored value, a null value deletes a NULLABLE key (reverting it to its default; a null on a non-nullable key is a 422 ``config.invalid``), and a nested table is merged one level deep. An unknown key is refused (422 ``config.invalid``) rather than silently dropped; ``auth_token`` is refused (403). | |
| dry_run | No | true = validate and return the plan (what would change) with zero writes; nothing is built, deployed or audited as a change. | |
| section | Yes | Config section to write, one per call (e.g. ``proxy``, ``services``, ``retention``). An unknown name is a 404 ``config.unknown_section``. | |
| if_match | No | ETag from a previous read of this section, sent as ``If-Match``: the write is refused with 409 ``config.stale`` if the config changed since. Omit to write unconditionally (no ETag is fetched for you); ``*`` always matches. | |
| idempotency_key | No | Caller-chosen key: a retry with the same key replays the first result instead of acting twice. Omit and a fresh key is minted per call, so each call acts. |