gordon.toml.example RawHistoryFolder

1# Gordon example configuration
2# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.
3
4[server]
5port = 8088
6registry_port = 5000
7gordon_domain = "gordon.example.com"
8# data_dir = "~/.gordon"
9
10[auth]
11enabled = true
12# Use "pass" or "sops" in production. The unsafe backend reads a local file
13# under server.data_dir/secrets and is intended for development only.
14secrets_backend = "pass"
15token_secret = "gordon/auth/token_secret"
16token_expiry = "30d"
17access_token_ttl = "15m"
18
19[api.rate_limit]
20enabled = true
21global_rps = 500
22per_ip_rps = 50
23burst = 100
24trusted_proxies = []
25
26[deploy]
27pull_policy = "if-tag-changed"
28readiness_mode = "auto"
29health_timeout = "90s"
30readiness_delay = "5s"
31drain_mode = "auto"
32drain_timeout = "30s"
33drain_delay = "2s"
34
35[containers]
36# "compat" preserves broad image compatibility. "strict" enables a read-only
37# root filesystem and narrower Linux capabilities.
38security_profile = "compat"
39
40[network_isolation]
41enabled = true
42network_prefix = "gordon"
43# Set true to create Docker internal networks without direct external egress.
44internal = false
45
46[volumes]
47auto_create = true
48prefix = "gordon"
49preserve = true
50
51[images]
52# Explicit external registries must be listed here. Gordon's own registry is
53# always allowed; localhost/private/link-local registries are always rejected.
54allowed_registries = []
55# Require @sha256:<digest> for allowlisted external registries.
56require_digest = false
57
58[images.prune]
59enabled = false
60schedule = "daily"
61keep_last = 3
62
63[auto_route]
64enabled = false
65
66[logging]
67level = "info"
68format = "console"
69
70[logging.container_logs]
71enabled = true
72
73[backups]
74enabled = false
75schedule = "daily"
76storage_dir = ""
77
78[backups.retention]
79hourly = 0
80daily = 0
81weekly = 0
82monthly = 0
83
84[routes]
85# "app.example.com" = { image = "myapp:latest" }
86
87[external_routes]
88# "status.example.com" = "127.0.0.1:9000"
89
90[network_groups]
91# "backend" = ["app.example.com", "api.example.com"]
92
93[attachments]
94# "app.example.com" = ["postgres:18"]