gordon.toml.example RawHistoryFolder

1# Gordon example configuration
2# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.
3
4[server]
5registry_port = 5000
6gordon_domain = "gordon.example.com"
7# legacy_registry_domains = ["registry.example.com:5000"]
8# proxy_allowed_ips = ["173.245.48.0/20"]
9# registry_allowed_ips = []
10# registry_listen_address = ""
11# tls_cert_file = ""
12# tls_key_file = ""
13# force_https_redirect = false
14# data_dir = "~/.gordon"
15# max_blob_chunk_size = "95MB"
16# max_blob_size = "1GB"
17# max_proxy_body_size = "512MB"
18# max_proxy_response_size = "1GB"
19# max_concurrent_connections = 10000
20
21# "edge" is the conventional route-capable entrypoint name, but a single
22# custom smart_tcp or tls_mux entrypoint can also serve normal Gordon routes.
23[entrypoints.edge]
24address = ":443"
25protocol = "smart_tcp"
26# trusted_cidrs = []
27# raw_fallback = "ssh-fallback"
28# raw_fallback_trusted_cidrs = ["100.64.0.0/10"]
29# allow_public_raw_fallback = false
30
31[dns]
32resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
33propagation_timeout = "5m"
34polling_interval = "5s"
35
36[tls.acme]
37enabled = false
38email = ""
39challenge = "auto"
40obtain_batch_size = 1
41
42[auth]
43enabled = true
44# Use "pass" or "sops" in production. The unsafe backend reads a local file
45# under server.data_dir/secrets and is intended for development only.
46secrets_backend = "pass"
47token_secret = "gordon/auth/token_secret"
48token_expiry = "30d"
49access_token_ttl = "15m"
50
51[api.rate_limit]
52enabled = true
53global_rps = 500
54per_ip_rps = 50
55burst = 100
56trusted_proxies = []
57
58[containers]
59# "compat" preserves broad image compatibility. "strict" enables a read-only
60# root filesystem and narrower Linux capabilities.
61security_profile = "compat"
62
63[network_isolation]
64# Installation network policy for Gordon-managed networks (prefix filter
65# for `gordon daemon networks`). Per-app isolation is removed: apps declare
66# `[[network.shared]]` membership in their app file instead.
67enabled = true
68network_prefix = "gordon"
69# Set true to create Docker internal networks without direct external egress.
70internal = false
71
72[volumes]
73auto_create = true
74prefix = "gordon"
75preserve = true
76
77[images]
78# Docker Hub, ghcr.io, quay.io, and Gordon's registry are always allowed.
79# Add other registries as exact hostname+port entries; this does not configure credentials.
80allowed_registries = []
81# Require @sha256:<64 hex chars> for images from every registry, including Gordon.
82require_digest = false
83
84[images.prune]
85enabled = false
86schedule = "daily"
87keep_last = 3
88
89[logging]
90level = "info"
91format = "console"
92
93[logging.file]
94enabled = false
95# path = "~/.gordon/logs/gordon.log"
96# max_size = 100
97# max_backups = 3
98# max_age = 28
99
100[logging.access_log]
101enabled = false
102format = "json"
103output = "stdout"
104# file_path = "~/.gordon/logs/access.log"
105max_size = 100
106max_backups = 3
107max_age = 28
108exclude_health_checks = true
109syslog_identifier = "gordon-access"
110
111# =============================================================================
112# ADMINISTRATIVE APP BIND MOUNTS
113# =============================================================================
114# A named policy is the only way an app manifest may reference a host path.
115# The manifest declares [[services.<name>.bind]] name = "<mount>"; direct host paths
116# are always rejected. allowed_apps/allowed_services are exact and non-empty,
117# and read_only/readonly force read-only: either side wins.
118# [app_mounts.app-logs]
119# source = "/srv/gordon/host-logs"   # Required; absolute, normalized
120# read_only = true                   # Either side forcing read-only wins
121# allowed_apps = ["metrics-agent"]   # Required; exact, non-empty
122# allowed_services = ["web"]         # Required; exact, non-empty
123# root = "/srv/gordon"               # Optional; defaults to the source's parent
124
125# =============================================================================
126# ADMINISTRATIVE APP DEVICES (CDI)
127# =============================================================================
128# A named device grant is the only way an app manifest may request host
129# devices. The manifest declares devices = ["<name>"]; raw /dev paths,
130# privileged containers, and runtime-specific GPU flags are never used.
131# Gordon resolves each name to explicit CDI IDs at activation time and
132# encodes them as one native CDI DeviceRequest. allowed_apps and
133# allowed_services are exact and non-empty: only that app+service pair
134# receives the grant. Aggregate "=all" selectors are rejected: name every
135# device explicitly. Changing a mapping never recreates a running
136# container; the next deploy serves the new resolution. Revoking a grant
137# fails subsequent deploys closed while the running service is untouched.
138# Supported engines: Podman 5.4+ or Docker 28.3+ with native CDI
139# configured (CDI specs, toolkit, device permissions on the host).
140# [app_devices.transcode-gpu]
141# cdi = ["example.com/gpu=GPU-device-uuid"]  # Required; explicit, non-empty
142# allowed_apps = ["video"]                   # Required; exact, non-empty
143# allowed_services = ["transcoder"]          # Required; exact, non-empty
144
145[telemetry]
146enabled = false
147# endpoint = "http://localhost:4318"
148# auth_token = ""
149traces = true
150metrics = true
151logs = true
152trace_sample_rate = 1.0
153
154[backups.databases]
155enabled = false
156schedule = "daily"
157storage_dir = ""
158
159[backups.databases.retention]
160hourly = 0
161daily = 0
162weekly = 0
163monthly = 0
164
165[backups.volumes]
166enabled = false
167interval = "24h"
168compression = "gzip"
169timeout = "2h"
170max_concurrency = 2
171# Helper image must include tar and the selected compressor.
172helper_image = "alpine:3.20"
173
174[backups.volumes.s3]
175bucket = ""
176region = ""
177prefix = ""
178# endpoint = "https://s3.example.com"
179# path_style = false
180# sse_algorithm = "AES256"
181# sse_kms_key_id = ""
182
183[backups.volumes.retention]
184keep = 14
185
186# [routes] is retired (see REMOVED list below): declaring it fails boot/reload closed.
187# "app.example.com" = { image = "myapp:latest" }
188
189[external_routes]
190# "status.example.com" = "127.0.0.1:9000"
191#
192# NOTE: the pre-v3 application keys below were removed by the
193# declarative-apps cutover. Gordon fails boot/reload closed when any of
194# them is present (see validateRetiredAppConfig in internal/app/run.go).
195# Declare application workloads in standalone <app>.toml files instead:
196# one file per app, applied with `gordon apps apply --file <app>.toml`
197# and activated with `gordon apps deploy <app>`.
198#
199# REMOVED: [routes]            -> [[services.<name>.http]] in an app file
200# REMOVED: [attachments]       -> [services.<name>] + volumes in an app file
201# REMOVED: [network_groups]    -> [[network.shared]] in an app file
202# REMOVED: app-like [[services]] -> one [services.<name>] table per app file
203#          (installation [[services]] below stays valid for L4 workloads)
204# REMOVED: [service_routes]    -> [[services.<name>.http]] in an app file
205# REMOVED: [auto]/[auto_route] -> explicit interfaces in an app file
206# REMOVED: [previews]          -> staging is an ordinary app file
207
208# Gordon-managed standalone L4 services. Use service:<name>:<port> from
209# traffic routers to expose published loopback ports. Standalone services
210# are installation-level: they live in gordon.toml, not in app files.
211# (App services are declared with [services.<name>] tables in <app>.toml files and
212# managed with `gordon apps`; see docs/cli/apps.md.)
213# [[services]]
214# name = "rust"
215# image = "registry.example.com:5000/rust:latest"
216# enabled = true
217# env_file = "/srv/gordon/services/rust.env"
218#
219# [[services.ports]]
220# name = "game"
221# container = 28015
222# protocol = "udp"
223# publish = "127.0.0.1:38015"
224#
225# [[services.ports]]
226# name = "rcon"
227# container = 28016
228# protocol = "tcp"
229# publish = "127.0.0.1:38016"
230# trusted_cidrs = ["100.64.0.0/10"]
231#
232# [entrypoints.rust]
233# address = "0.0.0.0:28015"
234# protocol = "udp"
235#
236# [[traffic.udp.routers]]
237# name = "rust-game"
238# entrypoint = "rust"
239# service = "service:rust:game"
240#
241# [entrypoints.rcon]
242# address = "0.0.0.0:28016"
243# protocol = "tcp"
244# trusted_cidrs = ["100.64.0.0/10"]
245#
246# [[traffic.tcp.routers]]
247# name = "rust-rcon"
248# entrypoint = "rcon"
249# service = "service:rust:rcon"
250#
251# REMOVED application sections (see note under [external_routes] above):
252# [routes], [network_groups], [attachments] were deleted with the cutover.