production.toml RawHistoryFolder

1# Gordon v2 - Production Configuration Example
2# Optimized for production environments with multiple services
3
4[server]
5port = 8080
6registry_port = 5000
7registry_domain = "registry.company.com"
8runtime = "auto"  # auto-detects Docker/Podman
9# socket_path = ""  # optional: override with custom socket path
10ssl_email = "devops@company.com"
11data_dir = "/var/lib/gordon"
12
13# Secrets backend for sensitive data
14[secrets]
15backend = "pass"  # "pass" (recommended), "sops", or "unsafe"
16
17[registry_auth]
18enabled = true
19type = "token"  # "token" (recommended for CI/CD) or "password"
20
21# Token auth: JWT-based, ideal for CI pipelines
22token_secret = "gordon/registry/token_secret"  # path in secrets backend
23
24# Generate tokens with:
25#   gordon auth token generate --subject deploy-bot --scopes push,pull --expiry 0
26# Each Gordon instance has unique tokens (different token_secret = incompatible tokens)
27
28# Alternative: Password auth (simpler but less flexible)
29# type = "password"
30# username = "deploy-bot"
31# password_hash = "gordon/registry/password_hash"  # bcrypt hash in secrets backend
32# Generate hash with: gordon auth password hash
33
34# Production logging configuration
35[logging]
36enabled = true                    # Enable comprehensive logging
37level = "info"                    # Standard production logging level
38dir = "/var/log/gordon"           # System log directory
39main_log_file = "gordon.log"      # Main application logs
40proxy_log_file = "proxy.log"      # HTTP proxy traffic logs
41container_log_dir = "containers"  # Container logs subdirectory
42
43# Production log rotation settings
44max_size = 100                    # Max 100MB per log file
45max_backups = 10                  # Keep 10 old files for history
46max_age = 90                      # Keep logs for 3 months
47compress = true                   # Compress old logs to save space
48
49# Environment variables configuration
50[env]
51# Directory where .env files are stored for each route
52dir = "/var/lib/gordon/env"
53# Note: Secret providers now use [secrets].backend configuration
54
55# Production service routes
56[routes]
57"app.company.com" = "company-app:v2.1.0"           # Main app with pinned version
58"api.company.com" = "company-api:v1.5.2"           # API service
59"admin.company.com" = "admin-panel:v1.0.1"         # Admin interface
60"docs.company.com" = "company-docs:latest"         # Documentation site
61"status.company.com" = "status-page:v0.3.0"        # Status page
62
63# Monitoring and internal tools  
64"grafana.company.com" = "grafana/grafana:latest"   # Metrics dashboard
65"prometheus.company.com" = "prom/prometheus:latest" # Metrics collection
66
67# Network isolation for production security
68[network_isolation]
69enabled = true                    # Enable per-app network isolation
70network_prefix = "prod"           # Production network prefix
71dns_suffix = ".internal"          # Internal DNS suffix
72
73# Network groups for microservices that need to communicate
74[network_groups]
75"backend" = ["app.company.com", "api.company.com"]        # App and API share services
76"monitoring" = ["grafana.company.com", "prometheus.company.com"]  # Monitoring stack
77
78# Service attachments with isolated networks
79[attachments]
80# Shared backend services
81"backend" = ["company-redis:latest", "company-rabbitmq:latest"]
82# Individual databases for isolation
83"app.company.com" = ["company-postgres:latest"]
84"api.company.com" = ["company-postgres:latest"] 
85"admin.company.com" = ["company-mysql:latest"]
86# Monitoring services get their own network
87"monitoring" = ["company-prometheus-data:latest"]
88
89# Environment Variables Usage:
90# 
91# For each route, create a .env file named after the domain:
92# /var/lib/gordon/env/app_company_com.env
93# /var/lib/gordon/env/api_company_com.env
94# 
95# Example env file content:
96# NODE_ENV=production
97# DATABASE_URL=postgresql://user:pass@db:5432/prod
98# API_KEY=${pass:company/api-key}              # From pass
99# SECRET_KEY=${sops:secrets.yaml:app.secret}   # From sops
100# 
101# Secret syntax:
102# ${pass:path/to/secret}        - Unix password manager
103# ${sops:file.yaml:key.path}    - SOPS encrypted file
104
105# Production deployment workflow:
106# 1. Build and tag: docker build -t company-app:v2.1.1 .
107# 2. Tag for registry: docker tag company-app:v2.1.1 registry.company.com/company-app:v2.1.1  
108# 3. Update this config: "app.company.com" = "company-app:v2.1.1"
109# 4. Create/update env file: /var/lib/gordon/env/app_company_com.env
110# 5. Restart Gordon to reload config
111# 6. Push to deploy: docker push registry.company.com/company-app:v2.1.1
112# 7. Gordon automatically deploys to app.company.com with environment variables!
113#
114# NETWORK ISOLATION IN PRODUCTION:
115# - Each app gets its own isolated network (prod-app-company-com, prod-admin-company-com)
116# - Network groups allow controlled sharing (prod-backend, prod-monitoring)
117# - Services communicate via simple DNS names (redis:6379, postgres:5432)
118# - Complete isolation between tenant/service boundaries
119#
120# Example service Dockerfiles for persistent storage:
121#
122# company-postgres/Dockerfile:
123#   FROM postgres:15
124#   VOLUME ["/var/lib/postgresql/data"]
125#   ENV POSTGRES_DB=production
126#   ENV POSTGRES_USER=app
127#   ENV POSTGRES_PASSWORD=supersecret
128#
129# company-redis/Dockerfile:
130#   FROM redis:7-alpine  
131#   VOLUME ["/data"]
132#   CMD ["redis-server", "--appendonly", "yes"]