gordon.toml.example Raw History Folder

1# Gordon example configuration
2# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.
3
4[server]
5registry_port = 5000
6gordon_domain = "gordon.example.com"
7# legacy_registry_domains = ["registry.example.com:5000"]
8# proxy_allowed_ips = ["173.245.48.0/20"]
9# registry_allowed_ips = []
10# registry_listen_address = ""
11# tls_cert_file = ""
12# tls_key_file = ""
13# force_https_redirect = false
14# data_dir = "~/.gordon"
15# max_blob_chunk_size = "95MB"
16# max_blob_size = "1GB"
17# max_proxy_body_size = "512MB"
18# max_proxy_response_size = "1GB"
19# max_concurrent_connections = 10000
20
21# "edge" is the conventional route-capable entrypoint name, but a single
22# custom smart_tcp or tls_mux entrypoint can also serve normal Gordon routes.
23[entrypoints.edge]
24address = ":443"
25protocol = "smart_tcp"
26# trusted_cidrs = []
27# raw_fallback = "ssh-fallback"
28# raw_fallback_trusted_cidrs = ["100.64.0.0/10"]
29# allow_public_raw_fallback = false
30
31[dns]
32resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
33propagation_timeout = "5m"
34polling_interval = "5s"
35
36[tls.acme]
37enabled = false
38email = ""
39challenge = "auto"
40obtain_batch_size = 1
41
42[auth]
43enabled = true
44# Use "pass" or "sops" in production. The unsafe backend reads a local file
45# under server.data_dir/secrets and is intended for development only.
46secrets_backend = "pass"
47token_secret = "gordon/auth/token_secret"
48token_expiry = "30d"
49access_token_ttl = "15m"
50
51[api.rate_limit]
52enabled = true
53global_rps = 500
54per_ip_rps = 50
55burst = 100
56trusted_proxies = []
57
58[deploy]
59pull_policy = "if-tag-changed"
60readiness_mode = "auto"
61health_timeout = "90s"
62readiness_delay = "5s"
63drain_mode = "auto"
64drain_timeout = "30s"
65drain_delay = "2s"
66
67[containers]
68# "compat" preserves broad image compatibility. "strict" enables a read-only
69# root filesystem and narrower Linux capabilities.
70security_profile = "compat"
71
72[network_isolation]
73enabled = true
74network_prefix = "gordon"
75# Set true to create Docker internal networks without direct external egress.
76internal = false
77
78[volumes]
79auto_create = true
80prefix = "gordon"
81preserve = true
82
83[images]
84# Explicit external registries must be listed here. Gordon's own registry is
85# always allowed; localhost/private/link-local registries are always rejected.
86allowed_registries = []
87# Require @sha256:<digest> for allowlisted external registries.
88require_digest = false
89
90[images.prune]
91enabled = false
92schedule = "daily"
93keep_last = 3
94
95[auto_route]
96enabled = false
97
98[logging]
99level = "info"
100format = "console"
101
102[logging.file]
103enabled = false
104# path = "~/.gordon/logs/gordon.log"
105# max_size = 100
106# max_backups = 3
107# max_age = 28
108
109[logging.container_logs]
110enabled = true
111# dir = "~/.gordon/logs/containers"
112# max_size = 100
113# max_backups = 3
114# max_age = 28
115
116[logging.access_log]
117enabled = false
118format = "json"
119output = "stdout"
120# file_path = "~/.gordon/logs/access.log"
121max_size = 100
122max_backups = 3
123max_age = 28
124exclude_health_checks = true
125syslog_identifier = "gordon-access"
126
127[telemetry]
128enabled = false
129# endpoint = "http://localhost:4318"
130# auth_token = ""
131traces = true
132metrics = true
133logs = true
134trace_sample_rate = 1.0
135
136[env]
137# dir = "~/.gordon/env"
138
139[backups.databases]
140enabled = false
141schedule = "daily"
142storage_dir = ""
143
144[backups.databases.retention]
145hourly = 0
146daily = 0
147weekly = 0
148monthly = 0
149
150[backups.volumes]
151enabled = false
152interval = "24h"
153compression = "gzip"
154timeout = "2h"
155max_concurrency = 2
156# Helper image must include tar and the selected compressor.
157helper_image = "alpine:3.20"
158
159[backups.volumes.s3]
160bucket = ""
161region = ""
162prefix = ""
163# endpoint = "https://s3.example.com"
164# path_style = false
165# sse_algorithm = "AES256"
166# sse_kms_key_id = ""
167
168[backups.volumes.retention]
169keep = 14
170
171[routes]
172# "app.example.com" = { image = "myapp:latest" }
173
174[external_routes]
175# "status.example.com" = "127.0.0.1:9000"
176
177# Gordon-managed standalone L4 services. Use service:<name>:<port> from
178# traffic routers to expose published loopback ports.
179# [[services]]
180# name = "rust"
181# image = "registry.example.com:5000/rust:latest"
182# enabled = true
183# env_file = "/srv/gordon/services/rust.env"
184#
185# [[services.ports]]
186# name = "game"
187# container = 28015
188# protocol = "udp"
189# publish = "127.0.0.1:38015"
190#
191# [[services.ports]]
192# name = "rcon"
193# container = 28016
194# protocol = "tcp"
195# publish = "127.0.0.1:38016"
196# trusted_cidrs = ["100.64.0.0/10"]
197#
198# [entrypoints.rust]
199# address = "0.0.0.0:28015"
200# protocol = "udp"
201#
202# [[traffic.udp.routers]]
203# name = "rust-game"
204# entrypoint = "rust"
205# service = "service:rust:game"
206#
207# [entrypoints.rcon]
208# address = "0.0.0.0:28016"
209# protocol = "tcp"
210# trusted_cidrs = ["100.64.0.0/10"]
211#
212# [[traffic.tcp.routers]]
213# name = "rust-rcon"
214# entrypoint = "rcon"
215# service = "service:rust:rcon"
216
217[network_groups]
218# "backend" = ["app.example.com", "api.example.com"]
219
220[attachments]
221# "app.example.com" = ["postgres:18"]
gordon.toml.example RawHistoryFolder

gordon.toml.example Raw History Folder
