reference.md Raw History Folder

Configuration Reference

Complete configuration reference with all options and their default values.

Full Configuration Example

# =============================================================================
# SERVER
# =============================================================================
[server]
port = 8088                                  # HTTP proxy port
registry_port = 5000                         # Container registry port
tls_port = 8443                              # HTTPS proxy port (0 = disabled, no internal CA)
tls_cert_file = ""                           # PEM cert path (optional, for static TLS alongside internal CA)
tls_key_file = ""                            # PEM key path (optional, must be set with tls_cert_file)
force_https_redirect = false                 # Redirect all HTTP traffic to HTTPS (for direct-access setups)
gordon_domain = ""                           # Required: Gordon domain (registry + API)
data_dir = "~/.gordon"                       # Data directory (varies by install type)
max_blob_chunk_size = "512MB"                # Max size per registry blob upload chunk
registry_allowed_ips = []                    # IPs or CIDR ranges allowed to access the registry (empty = allow all)
proxy_allowed_ips = []                       # IPs or CIDR ranges allowed to reach the proxy (empty = allow all, e.g. Cloudflare IPs)
registry_listen_address = ""                 # Bind address for registry (empty = all interfaces, "127.0.0.1" = loopback only)

# =============================================================================
# AUTHENTICATION (required - Gordon won't start without credentials configured)
# =============================================================================
[auth]
enabled = true                               # Enable registry authentication (default: true)
secrets_backend = "unsafe"                   # "pass", "sops", or "unsafe"
token_secret = ""                            # Path in secrets backend to JWT signing key (REQUIRED)
token_expiry = "720h"                        # Token expiry duration (720h = 30 days)
access_token_ttl = "15m"                     # Ephemeral access token lifetime (default: 15m)

# =============================================================================
# API (applies to both Registry and Admin endpoints)
# =============================================================================
[api.rate_limit]
enabled = true                               # Enable rate limiting (default: true)
global_rps = 500                             # Max requests/second globally
per_ip_rps = 50                              # Max requests/second per client IP
burst = 100                                  # Burst size for rate limiters
trusted_proxies = []                         # IPs/CIDRs trusted to set X-Forwarded-For

# =============================================================================
# LOGGING
# =============================================================================
[logging]
level = "info"                               # "debug", "info", "warn", "error"
format = "console"                           # "console" or "json"

[logging.file]
enabled = false                              # Enable file logging
path = ""                                    # Log file path (default: {data_dir}/logs/gordon.log)
max_size = 100                               # Max size in MB before rotation
max_backups = 3                              # Number of old files to keep
max_age = 28                                 # Days to keep old files

[logging.container_logs]
enabled = true                               # Enable container log collection
dir = ""                                     # Log directory (default: {data_dir}/container-logs)
max_size = 100                               # Max size in MB before rotation
max_backups = 3                              # Number of old files to keep
max_age = 28                                 # Days to keep old files

# =============================================================================
# TELEMETRY (OpenTelemetry)
# =============================================================================
[telemetry]
enabled = false                              # Enable OTLP telemetry export
endpoint = ""                                # OTLP HTTP endpoint URL
auth_token = ""                              # Base64-encoded user:password for Basic auth
traces = true                                # Export distributed traces
metrics = true                               # Export metrics
logs = true                                  # Bridge zerolog output to OTLP logs
trace_sample_rate = 1.0                      # Fraction of traces to sample (0.0–1.0)

# =============================================================================
# ENVIRONMENT
# =============================================================================
[env]
dir = ""                                     # Env files directory (default: {data_dir}/env)

# =============================================================================
# DEPLOYMENT
# =============================================================================
[deploy]
pull_policy = "if-tag-changed"               # "always", "if-tag-changed", "never"
readiness_mode = "auto"                      # "auto", "docker-health", "delay"
health_timeout = "90s"                       # Max wait for health-based readiness
readiness_delay = "5s"                       # Wait after running before considered ready
drain_mode = "auto"                          # "auto", "inflight", "delay"
drain_timeout = "30s"                        # Max wait for in-flight request drain
drain_delay = "2s"                           # Wait after cache invalidation before old stop

# =============================================================================
# AUTO-ROUTE
# =============================================================================
[auto_route]
enabled = false                              # Create routes from image labels automatically

# =============================================================================
# NETWORK ISOLATION
# =============================================================================
[network_isolation]
enabled = true                               # Enable per-app Docker networks
network_prefix = "gordon"                    # Prefix for created networks

# =============================================================================
# VOLUMES
# =============================================================================
[volumes]
auto_create = true                           # Auto-create volumes from Dockerfile VOLUME
prefix = "gordon"                            # Volume name prefix
preserve = true                              # Keep volumes when containers are removed

# =============================================================================
# ROUTES
# =============================================================================
[routes]
# "domain.com" = "image:tag"
# "http://insecure.domain.com" = "image:tag"   # HTTP-only (no HTTPS redirect)

# =============================================================================
# EXTERNAL ROUTES
# =============================================================================
[external_routes]
# "domain.com" = "host:port"                 # Proxy to non-container services

# =============================================================================
# NETWORK GROUPS
# =============================================================================
[network_groups]
# "group-name" = ["domain1.com", "domain2.com"]

# =============================================================================
# ATTACHMENTS
# =============================================================================
[attachments]
# "domain-or-group" = ["image1:tag", "image2:tag"]

# =============================================================================
# BACKUPS
# =============================================================================
[backups]
enabled = false                              # Enable backup service
schedule = "daily"                          # "hourly", "daily", "weekly", "monthly"
storage_dir = ""                            # Backup root (default: {data_dir}/backups)

[backups.retention]
hourly = 0                                   # Keep N hourly backups per DB
daily = 0                                    # Keep N daily backups per DB
weekly = 0                                   # Keep N weekly backups per DB
monthly = 0                                  # Keep N monthly backups per DB

# =============================================================================
# IMAGES
# =============================================================================
[images.prune]
enabled = false                              # Enable scheduled image cleanup
schedule = "daily"                          # "hourly", "daily", "weekly", "monthly"
keep_last = 3                                # Keep N newest tags per repository

# Note: retention values set to 0 keep no backups for that tier.
# For practical defaults, consider setting daily = 7.

Default Values Summary

Setting	Default	Description
`server.port`	`8088`	HTTP proxy port
`server.registry_port`	`5000`	Container registry port
`server.tls_port`	`8443`	HTTPS listener port (0 = disabled)
`server.tls_cert_file`	`""`	PEM cert path for static TLS (optional)
`server.tls_key_file`	`""`	PEM key path for static TLS (optional)
`server.force_https_redirect`	`false`	Redirect all HTTP to HTTPS (for direct-access setups)
`server.gordon_domain`	`""`	Required - Gordon domain
`server.data_dir`	`~/.gordon`	Data directory
`server.max_blob_chunk_size`	`"512MB"`	Max size per registry blob upload chunk
`server.registry_allowed_ips`	`[]`	IPs or CIDR ranges allowed to access the registry (empty = allow all)
`server.proxy_allowed_ips`	`[]`	IPs or CIDR ranges allowed to reach the proxy (empty = allow all)
`server.registry_listen_address`	`""`	Bind address for registry (empty = all interfaces)
`auth.enabled`	`true`	Enable authentication; when `false`, run local-only mode (loopback-only `/v2/`, `/admin/` disabled)
`auth.secrets_backend`	`"unsafe"`	Secrets storage
`auth.token_expiry`	`"720h"`	30 days
`auth.access_token_ttl`	`"15m"`	Ephemeral access token lifetime
`api.rate_limit.enabled`	`true`	Enable rate limiting
`api.rate_limit.global_rps`	`500`	Global requests/second
`api.rate_limit.per_ip_rps`	`50`	Per-IP requests/second
`api.rate_limit.burst`	`100`	Burst size
`api.rate_limit.trusted_proxies`	`[]`	IPs/CIDRs trusted for X-Forwarded-For
`logging.level`	`"info"`	Log level
`logging.format`	`"console"`	Log format
`logging.file.enabled`	`false`	File logging disabled
`logging.file.max_size`	`100`	100 MB
`logging.file.max_backups`	`3`	Keep 3 old files
`logging.file.max_age`	`28`	28 days
`logging.container_logs.enabled`	`true`	Container logs enabled
`logging.container_logs.max_size`	`100`	100 MB
`logging.container_logs.max_backups`	`3`	Keep 3 old files
`logging.container_logs.max_age`	`28`	28 days
`telemetry.enabled`	`false`	Enable OTLP telemetry export
`telemetry.endpoint`	`""`	OTLP HTTP endpoint URL
`telemetry.auth_token`	`""`	Base64 `user:password` for Basic auth
`telemetry.traces`	`true`	Export distributed traces
`telemetry.metrics`	`true`	Export metrics
`telemetry.logs`	`true`	Bridge zerolog to OTLP logs
`telemetry.trace_sample_rate`	`1.0`	Fraction of traces to sample (0.0–1.0)
`deploy.pull_policy`	`"if-tag-changed"`	Pull on tag change
`deploy.readiness_mode`	`"auto"`	Readiness strategy (`auto`, `docker-health`, `delay`)
`deploy.health_timeout`	`"90s"`	Max wait for health-based readiness before deploy fails
`deploy.readiness_delay`	`"5s"`	Delay before container is considered ready
`deploy.drain_mode`	`"auto"`	Drain strategy (`auto`, `inflight`, `delay`)
`deploy.drain_timeout`	`"30s"`	Max wait for in-flight request drain before old stop
`deploy.drain_delay`	`"2s"`	Delay before stopping previous container after cache invalidation
`auto_route.enabled`	`false`	Auto-route disabled
`network_isolation.enabled`	`true`	Network isolation enabled
`network_isolation.network_prefix`	`"gordon"`	Network prefix
`volumes.auto_create`	`true`	Auto-create volumes
`volumes.prefix`	`"gordon"`	Volume prefix
`volumes.preserve`	`true`	Keep volumes
`backups.enabled`	`false`	Backup service disabled
`backups.schedule`	`"daily"`	Backup scheduler preset
`backups.storage_dir`	`""`	Uses `{server.data_dir}/backups` when empty
`backups.retention.hourly`	`0`	Keep no hourly backups by default
`backups.retention.daily`	`0`	Keep no daily backups by default (recommend `7`)
`backups.retention.weekly`	`0`	Keep no weekly backups by default
`backups.retention.monthly`	`0`	Keep no monthly backups by default
`images.prune.enabled`	`false`	Scheduled image cleanup disabled
`images.prune.schedule`	`"daily"`	Cleanup schedule preset
`images.prune.keep_last`	`3`	Number of recent tags kept per repository

Note: for all backups.retention.* keys, 0 means keep no backups for that retention tier.

Environment Variables

All configuration options can be set via environment variables using the pattern:

GORDON_<SECTION>_<KEY>=value

Examples:

GORDON_SERVER_PORT=8080
GORDON_SERVER_GORDON_DOMAIN=gordon.example.com
GORDON_AUTH_ENABLED=true
GORDON_LOGGING_LEVEL=debug
GORDON_NETWORK_ISOLATION_ENABLED=true

Nested keys use underscores:

GORDON_LOGGING_FILE_ENABLED=true
GORDON_LOGGING_FILE_MAX_SIZE=200
GORDON_LOGGING_CONTAINER_LOGS_ENABLED=false

Security Environment Variables

These special environment variables take priority over config file values:

Variable	Description
`GORDON_AUTH_TOKEN_SECRET`	JWT signing secret (avoids storing secret on disk)

Example:

export GORDON_AUTH_TOKEN_SECRET="your-secure-32-char-secret-here"
gordon serve

Pull Policy Options

Value	Behavior
`"always"`	Always pull image before deploying
`"if-tag-changed"`	Pull only if image tag differs from running container
`"never"`	Never pull, use local image only

Secrets Backend Options

Value	Description
`"pass"`	Unix password manager (recommended for production)
`"sops"`	Mozilla SOPS encrypted files
`"unsafe"`	Plain text files (development only)

Log Level Options

Value	Description
`"debug"`	Verbose debugging information
`"info"`	General operational information
`"warn"`	Warning conditions
`"error"`	Error conditions only

source

1# Configuration Reference
2
3Complete configuration reference with all options and their default values.
4
5## Full Configuration Example
6
7```toml
8# =============================================================================
9# SERVER
10# =============================================================================
11[server]
12port = 8088                                  # HTTP proxy port
13registry_port = 5000                         # Container registry port
14tls_port = 8443                              # HTTPS proxy port (0 = disabled, no internal CA)
15tls_cert_file = ""                           # PEM cert path (optional, for static TLS alongside internal CA)
16tls_key_file = ""                            # PEM key path (optional, must be set with tls_cert_file)
17force_https_redirect = false                 # Redirect all HTTP traffic to HTTPS (for direct-access setups)
18gordon_domain = ""                           # Required: Gordon domain (registry + API)
19data_dir = "~/.gordon"                       # Data directory (varies by install type)
20max_blob_chunk_size = "512MB"                # Max size per registry blob upload chunk
21registry_allowed_ips = []                    # IPs or CIDR ranges allowed to access the registry (empty = allow all)
22proxy_allowed_ips = []                       # IPs or CIDR ranges allowed to reach the proxy (empty = allow all, e.g. Cloudflare IPs)
23registry_listen_address = ""                 # Bind address for registry (empty = all interfaces, "127.0.0.1" = loopback only)
24
25# =============================================================================
26# AUTHENTICATION (required - Gordon won't start without credentials configured)
27# =============================================================================
28[auth]
29enabled = true                               # Enable registry authentication (default: true)
30secrets_backend = "unsafe"                   # "pass", "sops", or "unsafe"
31token_secret = ""                            # Path in secrets backend to JWT signing key (REQUIRED)
32token_expiry = "720h"                        # Token expiry duration (720h = 30 days)
33access_token_ttl = "15m"                     # Ephemeral access token lifetime (default: 15m)
34
35# =============================================================================
36# API (applies to both Registry and Admin endpoints)
37# =============================================================================
38[api.rate_limit]
39enabled = true                               # Enable rate limiting (default: true)
40global_rps = 500                             # Max requests/second globally
41per_ip_rps = 50                              # Max requests/second per client IP
42burst = 100                                  # Burst size for rate limiters
43trusted_proxies = []                         # IPs/CIDRs trusted to set X-Forwarded-For
44
45# =============================================================================
46# LOGGING
47# =============================================================================
48[logging]
49level = "info"                               # "debug", "info", "warn", "error"
50format = "console"                           # "console" or "json"
51
52[logging.file]
53enabled = false                              # Enable file logging
54path = ""                                    # Log file path (default: {data_dir}/logs/gordon.log)
55max_size = 100                               # Max size in MB before rotation
56max_backups = 3                              # Number of old files to keep
57max_age = 28                                 # Days to keep old files
58
59[logging.container_logs]
60enabled = true                               # Enable container log collection
61dir = ""                                     # Log directory (default: {data_dir}/container-logs)
62max_size = 100                               # Max size in MB before rotation
63max_backups = 3                              # Number of old files to keep
64max_age = 28                                 # Days to keep old files
65
66# =============================================================================
67# TELEMETRY (OpenTelemetry)
68# =============================================================================
69[telemetry]
70enabled = false                              # Enable OTLP telemetry export
71endpoint = ""                                # OTLP HTTP endpoint URL
72auth_token = ""                              # Base64-encoded user:password for Basic auth
73traces = true                                # Export distributed traces
74metrics = true                               # Export metrics
75logs = true                                  # Bridge zerolog output to OTLP logs
76trace_sample_rate = 1.0                      # Fraction of traces to sample (0.0–1.0)
77
78# =============================================================================
79# ENVIRONMENT
80# =============================================================================
81[env]
82dir = ""                                     # Env files directory (default: {data_dir}/env)
83
84# =============================================================================
85# DEPLOYMENT
86# =============================================================================
87[deploy]
88pull_policy = "if-tag-changed"               # "always", "if-tag-changed", "never"
89readiness_mode = "auto"                      # "auto", "docker-health", "delay"
90health_timeout = "90s"                       # Max wait for health-based readiness
91readiness_delay = "5s"                       # Wait after running before considered ready
92drain_mode = "auto"                          # "auto", "inflight", "delay"
93drain_timeout = "30s"                        # Max wait for in-flight request drain
94drain_delay = "2s"                           # Wait after cache invalidation before old stop
95
96# =============================================================================
97# AUTO-ROUTE
98# =============================================================================
99[auto_route]
100enabled = false                              # Create routes from image labels automatically
101
102# =============================================================================
103# NETWORK ISOLATION
104# =============================================================================
105[network_isolation]
106enabled = true                               # Enable per-app Docker networks
107network_prefix = "gordon"                    # Prefix for created networks
108
109# =============================================================================
110# VOLUMES
111# =============================================================================
112[volumes]
113auto_create = true                           # Auto-create volumes from Dockerfile VOLUME
114prefix = "gordon"                            # Volume name prefix
115preserve = true                              # Keep volumes when containers are removed
116
117# =============================================================================
118# ROUTES
119# =============================================================================
120[routes]
121# "domain.com" = "image:tag"
122# "http://insecure.domain.com" = "image:tag"   # HTTP-only (no HTTPS redirect)
123
124# =============================================================================
125# EXTERNAL ROUTES
126# =============================================================================
127[external_routes]
128# "domain.com" = "host:port"                 # Proxy to non-container services
129
130# =============================================================================
131# NETWORK GROUPS
132# =============================================================================
133[network_groups]
134# "group-name" = ["domain1.com", "domain2.com"]
135
136# =============================================================================
137# ATTACHMENTS
138# =============================================================================
139[attachments]
140# "domain-or-group" = ["image1:tag", "image2:tag"]
141
142# =============================================================================
143# BACKUPS
144# =============================================================================
145[backups]
146enabled = false                              # Enable backup service
147schedule = "daily"                          # "hourly", "daily", "weekly", "monthly"
148storage_dir = ""                            # Backup root (default: {data_dir}/backups)
149
150[backups.retention]
151hourly = 0                                   # Keep N hourly backups per DB
152daily = 0                                    # Keep N daily backups per DB
153weekly = 0                                   # Keep N weekly backups per DB
154monthly = 0                                  # Keep N monthly backups per DB
155
156# =============================================================================
157# IMAGES
158# =============================================================================
159[images.prune]
160enabled = false                              # Enable scheduled image cleanup
161schedule = "daily"                          # "hourly", "daily", "weekly", "monthly"
162keep_last = 3                                # Keep N newest tags per repository
163
164# Note: retention values set to 0 keep no backups for that tier.
165# For practical defaults, consider setting daily = 7.
166```
167
168## Default Values Summary
169
170| Setting | Default | Description |
171|---------|---------|-------------|
172| `server.port` | `8088` | HTTP proxy port |
173| `server.registry_port` | `5000` | Container registry port |
174| `server.tls_port` | `8443` | HTTPS listener port (0 = disabled) |
175| `server.tls_cert_file` | `""` | PEM cert path for static TLS (optional) |
176| `server.tls_key_file` | `""` | PEM key path for static TLS (optional) |
177| `server.force_https_redirect` | `false` | Redirect all HTTP to HTTPS (for direct-access setups) |
178| `server.gordon_domain` | `""` | **Required** - Gordon domain |
179| `server.data_dir` | `~/.gordon` | Data directory |
180| `server.max_blob_chunk_size` | `"512MB"` | Max size per registry blob upload chunk |
181| `server.registry_allowed_ips` | `[]` | IPs or CIDR ranges allowed to access the registry (empty = allow all) |
182| `server.proxy_allowed_ips` | `[]` | IPs or CIDR ranges allowed to reach the proxy (empty = allow all) |
183| `server.registry_listen_address` | `""` | Bind address for registry (empty = all interfaces) |
184| `auth.enabled` | `true` | Enable authentication; when `false`, run local-only mode (loopback-only `/v2/*`, `/admin/*` disabled) |
185| `auth.secrets_backend` | `"unsafe"` | Secrets storage |
186| `auth.token_expiry` | `"720h"` | 30 days |
187| `auth.access_token_ttl` | `"15m"` | Ephemeral access token lifetime |
188| `api.rate_limit.enabled` | `true` | Enable rate limiting |
189| `api.rate_limit.global_rps` | `500` | Global requests/second |
190| `api.rate_limit.per_ip_rps` | `50` | Per-IP requests/second |
191| `api.rate_limit.burst` | `100` | Burst size |
192| `api.rate_limit.trusted_proxies` | `[]` | IPs/CIDRs trusted for X-Forwarded-For |
193| `logging.level` | `"info"` | Log level |
194| `logging.format` | `"console"` | Log format |
195| `logging.file.enabled` | `false` | File logging disabled |
196| `logging.file.max_size` | `100` | 100 MB |
197| `logging.file.max_backups` | `3` | Keep 3 old files |
198| `logging.file.max_age` | `28` | 28 days |
199| `logging.container_logs.enabled` | `true` | Container logs enabled |
200| `logging.container_logs.max_size` | `100` | 100 MB |
201| `logging.container_logs.max_backups` | `3` | Keep 3 old files |
202| `logging.container_logs.max_age` | `28` | 28 days |
203| `telemetry.enabled` | `false` | Enable OTLP telemetry export |
204| `telemetry.endpoint` | `""` | OTLP HTTP endpoint URL |
205| `telemetry.auth_token` | `""` | Base64 `user:password` for Basic auth |
206| `telemetry.traces` | `true` | Export distributed traces |
207| `telemetry.metrics` | `true` | Export metrics |
208| `telemetry.logs` | `true` | Bridge zerolog to OTLP logs |
209| `telemetry.trace_sample_rate` | `1.0` | Fraction of traces to sample (0.0–1.0) |
210| `deploy.pull_policy` | `"if-tag-changed"` | Pull on tag change |
211| `deploy.readiness_mode` | `"auto"` | Readiness strategy (`auto`, `docker-health`, `delay`) |
212| `deploy.health_timeout` | `"90s"` | Max wait for health-based readiness before deploy fails |
213| `deploy.readiness_delay` | `"5s"` | Delay before container is considered ready |
214| `deploy.drain_mode` | `"auto"` | Drain strategy (`auto`, `inflight`, `delay`) |
215| `deploy.drain_timeout` | `"30s"` | Max wait for in-flight request drain before old stop |
216| `deploy.drain_delay` | `"2s"` | Delay before stopping previous container after cache invalidation |
217| `auto_route.enabled` | `false` | Auto-route disabled |
218| `network_isolation.enabled` | `true` | Network isolation enabled |
219| `network_isolation.network_prefix` | `"gordon"` | Network prefix |
220| `volumes.auto_create` | `true` | Auto-create volumes |
221| `volumes.prefix` | `"gordon"` | Volume prefix |
222| `volumes.preserve` | `true` | Keep volumes |
223| `backups.enabled` | `false` | Backup service disabled |
224| `backups.schedule` | `"daily"` | Backup scheduler preset |
225| `backups.storage_dir` | `""` | Uses `{server.data_dir}/backups` when empty |
226| `backups.retention.hourly` | `0` | Keep no hourly backups by default |
227| `backups.retention.daily` | `0` | Keep no daily backups by default (recommend `7`) |
228| `backups.retention.weekly` | `0` | Keep no weekly backups by default |
229| `backups.retention.monthly` | `0` | Keep no monthly backups by default |
230| `images.prune.enabled` | `false` | Scheduled image cleanup disabled |
231| `images.prune.schedule` | `"daily"` | Cleanup schedule preset |
232| `images.prune.keep_last` | `3` | Number of recent tags kept per repository |
233
234Note: for all `backups.retention.*` keys, `0` means keep no backups for that retention tier.
235
236## Environment Variables
237
238All configuration options can be set via environment variables using the pattern:
239
240```
241GORDON_<SECTION>_<KEY>=value
242```
243
244Examples:
245```bash
246GORDON_SERVER_PORT=8080
247GORDON_SERVER_GORDON_DOMAIN=gordon.example.com
248GORDON_AUTH_ENABLED=true
249GORDON_LOGGING_LEVEL=debug
250GORDON_NETWORK_ISOLATION_ENABLED=true
251```
252
253Nested keys use underscores:
254```bash
255GORDON_LOGGING_FILE_ENABLED=true
256GORDON_LOGGING_FILE_MAX_SIZE=200
257GORDON_LOGGING_CONTAINER_LOGS_ENABLED=false
258```
259
260### Security Environment Variables
261
262These special environment variables take priority over config file values:
263
264| Variable | Description |
265|----------|-------------|
266| `GORDON_AUTH_TOKEN_SECRET` | JWT signing secret (avoids storing secret on disk) |
267
268Example:
269```bash
270export GORDON_AUTH_TOKEN_SECRET="your-secure-32-char-secret-here"
271gordon serve
272```
273
274## Pull Policy Options
275
276| Value | Behavior |
277|-------|----------|
278| `"always"` | Always pull image before deploying |
279| `"if-tag-changed"` | Pull only if image tag differs from running container |
280| `"never"` | Never pull, use local image only |
281
282## Secrets Backend Options
283
284| Value | Description |
285|-------|-------------|
286| `"pass"` | Unix password manager (recommended for production) |
287| `"sops"` | Mozilla SOPS encrypted files |
288| `"unsafe"` | Plain text files (development only) |
289
290## Log Level Options
291
292| Value | Description |
293|-------|-------------|
294| `"debug"` | Verbose debugging information |
295| `"info"` | General operational information |
296| `"warn"` | Warning conditions |
297| `"error"` | Error conditions only |
298
299## Related
300
301- [Configuration Overview](./index.md)
302- [Authentication](./auth.md)
303- [Telemetry](./telemetry.md)
304- [Network Isolation](./network-isolation.md)
305- [Volumes](./volumes.md)
306- [Images](./images.md)

reference.md RawHistoryFolder