gordon.toml.example RawHistoryFolder

1# Gordon example configuration
2# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.
3
4[server]
5port = 8088
6tls_port = 8443
7registry_port = 5000
8gordon_domain = "gordon.example.com"
9# legacy_registry_domains = ["registry.example.com:5000"]
10# proxy_allowed_ips = ["173.245.48.0/20"]
11# registry_allowed_ips = []
12# registry_listen_address = ""
13# tls_cert_file = ""
14# tls_key_file = ""
15# force_https_redirect = false
16# data_dir = "~/.gordon"
17# max_blob_chunk_size = "95MB"
18# max_blob_size = "1GB"
19# max_proxy_body_size = "512MB"
20# max_proxy_response_size = "1GB"
21# max_concurrent_connections = 10000
22
23[dns]
24resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
25propagation_timeout = "5m"
26polling_interval = "5s"
27
28[tls.acme]
29enabled = false
30email = ""
31challenge = "auto"
32obtain_batch_size = 1
33
34[auth]
35enabled = true
36# Use "pass" or "sops" in production. The unsafe backend reads a local file
37# under server.data_dir/secrets and is intended for development only.
38secrets_backend = "pass"
39token_secret = "gordon/auth/token_secret"
40token_expiry = "30d"
41access_token_ttl = "15m"
42
43[api.rate_limit]
44enabled = true
45global_rps = 500
46per_ip_rps = 50
47burst = 100
48trusted_proxies = []
49
50[deploy]
51pull_policy = "if-tag-changed"
52readiness_mode = "auto"
53health_timeout = "90s"
54readiness_delay = "5s"
55drain_mode = "auto"
56drain_timeout = "30s"
57drain_delay = "2s"
58
59[containers]
60# "compat" preserves broad image compatibility. "strict" enables a read-only
61# root filesystem and narrower Linux capabilities.
62security_profile = "compat"
63
64[network_isolation]
65enabled = true
66network_prefix = "gordon"
67# Set true to create Docker internal networks without direct external egress.
68internal = false
69
70[volumes]
71auto_create = true
72prefix = "gordon"
73preserve = true
74
75[images]
76# Explicit external registries must be listed here. Gordon's own registry is
77# always allowed; localhost/private/link-local registries are always rejected.
78allowed_registries = []
79# Require @sha256:<digest> for allowlisted external registries.
80require_digest = false
81
82[images.prune]
83enabled = false
84schedule = "daily"
85keep_last = 3
86
87[auto_route]
88enabled = false
89
90[logging]
91level = "info"
92format = "console"
93
94[logging.file]
95enabled = false
96# path = "~/.gordon/logs/gordon.log"
97# max_size = 100
98# max_backups = 3
99# max_age = 28
100
101[logging.container_logs]
102enabled = true
103# dir = "~/.gordon/logs/containers"
104# max_size = 100
105# max_backups = 3
106# max_age = 28
107
108[logging.access_log]
109enabled = false
110format = "json"
111output = "stdout"
112# file_path = "~/.gordon/logs/access.log"
113max_size = 100
114max_backups = 3
115max_age = 28
116exclude_health_checks = true
117syslog_identifier = "gordon-access"
118
119[telemetry]
120enabled = false
121# endpoint = "http://localhost:4318"
122# auth_token = ""
123traces = true
124metrics = true
125logs = true
126trace_sample_rate = 1.0
127
128[env]
129# dir = "~/.gordon/env"
130
131[backups]
132enabled = false
133schedule = "daily"
134storage_dir = ""
135
136[backups.retention]
137hourly = 0
138daily = 0
139weekly = 0
140monthly = 0
141
142[routes]
143# "app.example.com" = { image = "myapp:latest" }
144
145[external_routes]
146# "status.example.com" = "127.0.0.1:9000"
147
148[network_groups]
149# "backend" = ["app.example.com", "api.example.com"]
150
151[attachments]
152# "app.example.com" = ["postgres:18"]