Production Configuration

A complete Gordon configuration for production environments.

When to Use

Production deployments
Multiple applications
Services requiring databases

Configuration

# ~/.config/gordon/gordon.toml

# Server settings
[server]
port = 8080                              # Cloudflare forwards 443 → 8080
registry_port = 5000
gordon_domain = "gordon.company.com"

# Authentication with pass backend (recommended)
[auth]
enabled = true
secrets_backend = "pass"
token_secret = "gordon/auth/token_secret"

# File-based logging with rotation
[logging]
level = "info"
format = "json"

[logging.file]
enabled = true
path = "~/.gordon/logs/gordon.log"
max_size = 100
max_backups = 10
max_age = 90

# Workload logs are read from the container runtime with
# `gordon apps logs APP --service SERVICE`.

# Volume settings (all enabled by default)
[volumes]
auto_create = true
prefix = "gordon"
preserve = true

# Network isolation for security
[network_isolation]
enabled = true
network_prefix = "prod"

# Applications, routes, services, and shared networks are declared in
# separate app manifest files and applied with `gordon apps apply`.

Setup Steps

1. Install Pass

sudo apt install pass gnupg
gpg --gen-key
pass init your-gpg-key-id

2. Store Token Secret

# Generate random secret
openssl rand -base64 32 | pass insert -m gordon/auth/token_secret

3. Generate CI Token

gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0

4. Set App Secrets

Declare public values under [env] and secret names under [services.<name>.secrets] in each app file, apply it, then set the values:

gordon apps apply --file ./app.toml
pass show company/db-password \
  | gordon apps secrets set app --service web --stdin --key DATABASE_PASSWORD

5. Configure Cloudflare

Type	Name	Content	Proxy
A	`app`	VPS IP	Yes
A	`api`	VPS IP	Yes
A	`admin`	VPS IP	Yes
A	`registry`	VPS IP	Yes

6. Start Gordon

systemctl --user enable --now gordon

Features Enabled

Feature	Status
Registry	Enabled
Token Auth	Enabled
File Logging	Enabled with rotation
Container Logs	Enabled with rotation
Network Isolation	Enabled
Attachments	Configured
Secrets (pass)	Enabled

Deployment Workflow

# Build locally
docker build -t company-app .

# Tag with version
docker tag company-app gordon.company.com/company-app:v2.2.0

# Push to deploy
docker push gordon.company.com/company-app:v2.2.0

# Update config with new version
vim ~/.config/gordon/gordon.toml
# Change: "app.company.com" = "company-app:v2.2.0"

# Reload to deploy
gordon daemon reload

source

1# Production Configuration
2
3A complete Gordon configuration for production environments.
4
5## When to Use
6
7- Production deployments
8- Multiple applications
9- Services requiring databases
10
11## Configuration
12
13```toml
14# ~/.config/gordon/gordon.toml
15
16# Server settings
17[server]
18port = 8080                              # Cloudflare forwards 443 → 8080
19registry_port = 5000
20gordon_domain = "gordon.company.com"
21
22# Authentication with pass backend (recommended)
23[auth]
24enabled = true
25secrets_backend = "pass"
26token_secret = "gordon/auth/token_secret"
27
28# File-based logging with rotation
29[logging]
30level = "info"
31format = "json"
32
33[logging.file]
34enabled = true
35path = "~/.gordon/logs/gordon.log"
36max_size = 100
37max_backups = 10
38max_age = 90
39
40# Workload logs are read from the container runtime with
41# `gordon apps logs APP --service SERVICE`.
42
43# Volume settings (all enabled by default)
44[volumes]
45auto_create = true
46prefix = "gordon"
47preserve = true
48
49# Network isolation for security
50[network_isolation]
51enabled = true
52network_prefix = "prod"
53
54# Applications, routes, services, and shared networks are declared in
55# separate app manifest files and applied with `gordon apps apply`.
56```
57
58## Setup Steps
59
60### 1. Install Pass
61
62```bash
63sudo apt install pass gnupg
64gpg --gen-key
65pass init your-gpg-key-id
66```
67
68### 2. Store Token Secret
69
70```bash
71# Generate random secret
72openssl rand -base64 32 | pass insert -m gordon/auth/token_secret
73```
74
75### 3. Generate CI Token
76
77```bash
78gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0
79```
80
81### 4. Set App Secrets
82
83Declare public values under `[env]` and secret names under `[services.<name>.secrets]` in each app file, apply it, then set the values:
84
85```bash
86gordon apps apply --file ./app.toml
87pass show company/db-password \
88  | gordon apps secrets set app --service web --stdin --key DATABASE_PASSWORD
89```
90
91### 5. Configure Cloudflare
92
93| Type | Name | Content | Proxy |
94|------|------|---------|-------|
95| A | `app` | VPS IP | Yes |
96| A | `api` | VPS IP | Yes |
97| A | `admin` | VPS IP | Yes |
98| A | `registry` | VPS IP | Yes |
99
100### 6. Start Gordon
101
102```bash
103systemctl --user enable --now gordon
104```
105
106## Features Enabled
107
108| Feature | Status |
109|---------|--------|
110| Registry | Enabled |
111| Token Auth | Enabled |
112| File Logging | Enabled with rotation |
113| Container Logs | Enabled with rotation |
114| Network Isolation | Enabled |
115| Attachments | Configured |
116| Secrets (pass) | Enabled |
117
118## Deployment Workflow
119
120```bash
121# Build locally
122docker build -t company-app .
123
124# Tag with version
125docker tag company-app gordon.company.com/company-app:v2.2.0
126
127# Push to deploy
128docker push gordon.company.com/company-app:v2.2.0
129
130# Update config with new version
131vim ~/.config/gordon/gordon.toml
132# Change: "app.company.com" = "company-app:v2.2.0"
133
134# Reload to deploy
135gordon daemon reload
136```
137
138## Related
139
140- [Minimal Configuration](./minimal.md)
141- [Secrets Configuration](/docs/config/secrets.md)
142- [Network Isolation](/docs/config/network-isolation.md)

production.md RawHistoryFolder