remote-cli.md Raw History Folder

Remote CLI

Gordon management commands use the authenticated daemon API. The default local transport is HTTP over the owner-only Unix socket; a configured remote uses authenticated HTTP/TLS.

Configure a remote

Store the server URL and credentials with Gordon's remote configuration commands. Avoid placing tokens directly in shell history, scripts, or repository files.

Verify connectivity:

gordon daemon status --remote https://gordon.example.com --token "$GORDON_TOKEN"

App management

The app name is the canonical workload identity. Domains are routing addresses declared by the manifest.

gordon apps apply --file app.toml --remote https://gordon.example.com --token "$GORDON_TOKEN"
gordon apps list --remote https://gordon.example.com --token "$GORDON_TOKEN"
gordon apps show APP --remote https://gordon.example.com --token "$GORDON_TOKEN"
gordon apps deploy APP --remote https://gordon.example.com --token "$GORDON_TOKEN"
gordon apps logs APP --service SERVICE --remote https://gordon.example.com --token "$GORDON_TOKEN"

Lifecycle commands use the same transport:

gordon apps stop APP
gordon apps start APP
gordon apps restart APP --service SERVICE
gordon apps remove APP

Backups

Backup targets come from the ACTIVE app manifest and use app, service, and resource identity:

gordon backups run APP --service SERVICE --database DATABASE
gordon backups volume run APP --service SERVICE --volume VOLUME
gordon backups status
gordon backups volume status

Logs

gordon daemon logs streams daemon process logs. Workload logs use the app command:

gordon daemon logs --remote https://gordon.example.com --token "$GORDON_TOKEN"
gordon apps logs APP --service SERVICE --remote https://gordon.example.com --token "$GORDON_TOKEN"

Security

Use HTTPS for remote access.
Scope and rotate tokens.
Keep the local admin socket owner-only.
Never expose the local socket through a public proxy.
Prefer environment variables or a protected credential store over literal tokens.

source

1# Remote CLI
2
3Gordon management commands use the authenticated daemon API. The default local transport is HTTP over the owner-only Unix socket; a configured remote uses authenticated HTTP/TLS.
4
5## Configure a remote
6
7Store the server URL and credentials with Gordon's remote configuration commands. Avoid placing tokens directly in shell history, scripts, or repository files.
8
9Verify connectivity:
10
11```bash
12gordon daemon status --remote https://gordon.example.com --token "$GORDON_TOKEN"
13```
14
15## App management
16
17The app name is the canonical workload identity. Domains are routing addresses declared by the manifest.
18
19```bash
20gordon apps apply --file app.toml --remote https://gordon.example.com --token "$GORDON_TOKEN"
21gordon apps list --remote https://gordon.example.com --token "$GORDON_TOKEN"
22gordon apps show APP --remote https://gordon.example.com --token "$GORDON_TOKEN"
23gordon apps deploy APP --remote https://gordon.example.com --token "$GORDON_TOKEN"
24gordon apps logs APP --service SERVICE --remote https://gordon.example.com --token "$GORDON_TOKEN"
25```
26
27Lifecycle commands use the same transport:
28
29```bash
30gordon apps stop APP
31gordon apps start APP
32gordon apps restart APP --service SERVICE
33gordon apps remove APP
34```
35
36## Backups
37
38Backup targets come from the ACTIVE app manifest and use app, service, and resource identity:
39
40```bash
41gordon backups run APP --service SERVICE --database DATABASE
42gordon backups volume run APP --service SERVICE --volume VOLUME
43gordon backups status
44gordon backups volume status
45```
46
47## Logs
48
49`gordon daemon logs` streams daemon process logs. Workload logs use the app command:
50
51```bash
52gordon daemon logs --remote https://gordon.example.com --token "$GORDON_TOKEN"
53gordon apps logs APP --service SERVICE --remote https://gordon.example.com --token "$GORDON_TOKEN"
54```
55
56## Security
57
58- Use HTTPS for remote access.
59- Scope and rotate tokens.
60- Keep the local admin socket owner-only.
61- Never expose the local socket through a public proxy.
62- Prefer environment variables or a protected credential store over literal tokens.

remote-cli.md RawHistoryFolder