1# Server Configuration
2
3Core server settings for Gordon.
4
5## Configuration
6
7```toml
8[server]
9port = 8080                              # HTTP proxy port
10registry_port = 5000                     # Container registry port
11tls_enabled = false                      # Enable native TLS listener
12tls_port = 443                           # HTTPS listener port
13tls_cert_file = ""                       # PEM certificate file (required when TLS enabled)
14tls_key_file = ""                        # PEM key file (required when TLS enabled)
15gordon_domain = "gordon.mydomain.com"    # Gordon domain (required)
16# data_dir = "~/.gordon"                 # Data storage directory (default)
17```
18
19## Options
20
21| Option | Type | Default | Description |
22|--------|------|---------|-------------|
23| `port` | int | `80` | HTTP proxy port for routing traffic to containers |
24| `registry_port` | int | `5000` | Docker registry port for image push/pull |
25| `tls_enabled` | bool | `false` | Enable native HTTPS listener for proxy traffic |
26| `tls_port` | int | `443` | HTTPS listener port when `tls_enabled` is true |
27| `tls_cert_file` | string | `""` | Path to PEM certificate file |
28| `tls_key_file` | string | `""` | Path to PEM private key file |
29| `gordon_domain` | string | **required** | Domain for Gordon (registry + admin API) |
30| `registry_domain` | string | - | Deprecated alias for `gordon_domain` |
31| `data_dir` | string | `~/.gordon` | Directory for registry data, logs, and env files |
32| `max_proxy_body_size` | string | `"512MB"` | Maximum request body size for proxied requests |
33| `max_blob_chunk_size` | string | `"95MB"` | Maximum request body size for a single registry blob upload chunk |
34| `registry_allowed_ips` | []string | `[]` | IPs or CIDR ranges allowed to access the registry (empty = allow all) |
35
36## Port Configuration
37
38### Proxy Port
39
40The `port` setting controls where Gordon listens for HTTP traffic:
41
42```toml
43[server]
44port = 8080  # Use 8080 for rootless containers with port forwarding
45```
46
47For rootless containers, you'll typically use a high port and configure firewall port forwarding:
48
49```bash
50# Forward port 80 to 8080
51sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
52```
53
54### Native TLS Listener
55
56Enable native HTTPS directly in Gordon:
57
58```toml
59[server]
60tls_enabled = true
61tls_port = 443
62tls_cert_file = "/etc/gordon/certs/fullchain.pem"
63tls_key_file = "/etc/gordon/certs/privkey.pem"
64```
65
66With TLS enabled:
67- Gordon terminates HTTPS on `tls_port`
68- Host-based routing still works (apps, `/v2/*`, `/auth/*`, `/admin/*`)
69- `port` remains available for plain HTTP unless you restrict it externally
70- If `tls_cert_file`/`tls_key_file` are empty, Gordon auto-generates a self-signed pair in `{data_dir}/tls/`
71
72### Registry Port
73
74The `registry_port` setting controls where Gordon accepts image pushes:
75
76```toml
77[server]
78registry_port = 5000
79```
80
81Docker/Podman clients push to this port:
82
83```bash
84docker push registry.mydomain.com:5000/myapp:latest
85```
86
87## Gordon Domain
88
89The `gordon_domain` is required and must match your DNS configuration:
90
91```toml
92[server]
93gordon_domain = "gordon.mydomain.com"
94```
95
96This domain is used for:
97- Docker login and image push/pull operations
98- Admin API access (`/admin/*` endpoints)
99- CLI remote targeting (`gordon routes --remote https://gordon.mydomain.com`)
100- Authentication endpoints (`/auth/*`)
101
102When requests arrive on the proxy port with this domain as the Host header, Gordon routes them to the backend services (registry and admin API).
103
104> **Note:** `registry_domain` is supported as a deprecated alias for backwards compatibility.
105
106## Data Directory
107
108The `data_dir` setting controls where Gordon stores data:
109
110```toml
111[server]
112data_dir = "~/.gordon"  # Default for user installations
113```
114
115### Directory Structure
116
117```
118~/.gordon/
119├── registry/           # Container images and manifests
120│   ├── blobs/
121│   └── manifests/
122├── env/                # Environment files per domain
123│   ├── app_mydomain_com.env
124│   └── api_mydomain_com.env
125├── logs/               # Application and container logs
126│   ├── gordon.log
127│   ├── proxy.log
128│   └── containers/
129└── secrets/            # Secrets (unsafe backend only)
130```
131
132### Permissions
133
134 Gordon creates directories with secure permissions:
135 - Directories: `0700` (owner only)
136 - Files: `0600` (owner only)
137
138 ## Maximum Proxy Body Size
139
140 The `max_proxy_body_size` setting limits the size of request bodies that Gordon will forward to backend containers:
141
142 ```toml
143 [server]
144 max_proxy_body_size = "512MB"  # Default
145 ```
146
147 **Purpose:** Prevents resource exhaustion attacks from extremely large uploads through the proxy.
148
149 **Supported units:** B, KB, MB, GB, TB (case-insensitive, decimal/1024-based)
150
151 **Examples:**
152 ```toml
153 max_proxy_body_size = "100MB"   # Stricter limit
154 max_proxy_body_size = "1GB"     # Allow larger uploads
155 max_proxy_body_size = "0"       # No limit (not recommended)
156 ```
157
158 **Behavior:**
159 - When a request exceeds the limit, Gordon returns `413 Request Entity Too Large`
160 - The limit is applied before the request reaches the backend container
161 - Uploads in progress are terminated when the limit is exceeded
162
163 **Use cases:**
164 - File upload services: increase to `1GB` or higher
165 - CI/CD artifact uploads: adjust based on your largest artifacts
166 - Tight security: reduce to `100MB` or lower
167 - Default (512MB): suitable for most applications
168
169 > **Warning:** Setting this to `0` (no limit) allows unlimited upload sizes, which can lead to disk exhaustion and DoS vulnerabilities. Always set a reasonable limit for production deployments.
170
171## Maximum Registry Blob Chunk Size
172
173The `max_blob_chunk_size` setting limits the size of a single blob upload request to the registry (`PATCH`/`PUT` under `/v2/*/blobs/uploads/*`):
174
175```toml
176[server]
177max_blob_chunk_size = "95MB"  # Default
178```
179
180**Purpose:** Prevents excessive memory usage during blob uploads while allowing large real-world image layers.
181
182**Supported units:** B, KB, MB, GB, TB (case-insensitive, decimal/1024-based)
183
184**Examples:**
185
186```toml
187max_blob_chunk_size = "256MB"  # Stricter limit
188max_blob_chunk_size = "1GB"    # Allow larger layers
189```
190
191**Behavior:**
192- When a blob chunk exceeds the limit, Gordon returns `413 Request Entity Too Large`
193- Docker/Podman may send a full layer in one request, so set this high enough for your base images
194- Default (`95MB`) is compatible with Cloudflare and most CDN proxies; increase if pushing very large layers directly
195
196## Registry IP Allowlist
197
198The `registry_allowed_ips` setting restricts registry access to specific IPs or IP ranges. Accepts both CIDR notation (`100.64.0.0/10`) and individual IPs (`203.0.113.50`). When set, only requests from listed addresses (plus localhost) can reach registry and auth endpoints. An empty list allows all traffic (default).
199
200```toml
201[server]
202registry_allowed_ips = [
203  "100.64.0.0/10",   # Tailscale CGNAT range
204  "203.0.113.50",    # single IP (treated as /32)
205]
206```
207
208**Behavior:**
209- Single IPs are automatically converted to `/32` (IPv4) or `/128` (IPv6)
210- Denied requests receive `403 Forbidden`
211- Localhost (`127.0.0.0/8`, `::1`) is always allowed so Gordon can pull from its own registry
212- Respects `trusted_proxies` for accurate client IP extraction behind reverse proxies
213- Applied before rate limiting and authentication
214- Changes require a Gordon server restart; not picked up by config hot-reload
215
216**Use cases:**
217- Restrict registry to Tailscale network: `["100.64.0.0/10"]`
218- Restrict to private subnets: `["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]`
219- Allow a specific CI server: `["100.64.0.0/10", "203.0.113.50"]`
220
221Via environment variable:
222
223```bash
224GORDON_SERVER_REGISTRY_ALLOWED_IPS=100.64.0.0/10
225```
226
227## Examples
228
229### Development Configuration
230
231```toml
232[server]
233port = 8080
234registry_port = 5000
235gordon_domain = "gordon.local"
236data_dir = "./dev-data"
237```
238
239### Production Configuration
240
241```toml
242[server]
243port = 8080
244registry_port = 5000
245gordon_domain = "gordon.company.com"
246data_dir = "/var/lib/gordon"
247```
248
249### Rootless Container Setup
250
251```toml
252[server]
253port = 8080      # High port for rootless
254registry_port = 5000
255gordon_domain = "gordon.mydomain.com"
256```
257
258With firewall port forwarding:
259```bash
260sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
261sudo firewall-cmd --reload
262```
263
264## Related
265
266- [Configuration Overview](./index.md)
267- [Installation Guide](../installation.md)
268- [Routes Configuration](./routes.md)