docs: Enhance README with firewall configuration and port redirection instructions

- Add UFW firewall setup steps for improved security.
- Clarify the creation and location of the gordon.toml configuration file.
- Update port redirection section to focus on iptables and make rules persistent across reboots.

commit: 04a35ad7fc5119de54ca33dc80e834695eafee66
author: bamen · 16mo ago · 2025-06-07 08:03 UTC
parent: 210f209
signature: unsigned

1 file · +18 -12

M README.md +18 -12


@@ -81,6 +81,14 @@ Containers deploy instantly when you push new images. No manual deployment steps
81	81		# Any VPS provider: DigitalOcean, Linode, Vultr, Hetzner
82	82		# Ubuntu/Debian recommended
83	83
	84	+	# Configure UFW firewall first
	85	+	sudo ufw --force enable
	86	+	sudo ufw default deny incoming
	87	+	sudo ufw default allow outgoing
	88	+	sudo ufw allow 22/tcp
	89	+	sudo ufw allow 80/tcp
	90	+	sudo ufw allow 443/tcp
	91	+
84	92		# Install Podman (more secure than Docker)
85	93		sudo apt update
86	94		sudo apt install -y podman

@@ -118,7 +126,9 @@ sudo mv gordon-linux-amd64 /usr/local/bin/gordon
118	126
119	127		### 3. Create Config
120	128		```toml
121		-	# gordon.toml
	129	+	# Create gordon.toml in current directory (or use --config flag)
	130	+	# Gordon searches for config in: ./ → ~/.config/gordon/ → ~/.gordon/ → ~/ → /etc/gordon/
	131	+
122	132		[server]
123	133		port = 8080
124	134		registry_domain = "registry.yourdomain.com"

@@ -134,6 +144,9 @@ password = "your-secure-password"
134	144		"app.yourdomain.com" = "myapp:latest"
135	145		"api.yourdomain.com" = "api:v1"
136	146		"blog.yourdomain.com" = "wordpress:latest"
	147	+
	148	+	# Custom config file location (optional):
	149	+	# gordon --config /path/to/custom.toml start
137	150		```
138	151
139	152		### 4. Point Cloudflare DNS

@@ -176,22 +189,15 @@ sudo loginctl enable-linger $USER
176	189		systemctl --user status gordon
177	190		```
178	191
179		-	### 6. Configure Firewall
	192	+	### 6. Redirect Ports 80/443 to 8080
180	193		```bash
181		-	# Set up port forwarding (choose one option)
182		-
183		-	# Option A: iptables (most common)
	194	+	# Simple iptables redirect
184	195		sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
185	196		sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
186	197
187		-	# Make iptables rules persistent
188		-	sudo apt-get install iptables-persistent
	198	+	# Make rules persistent across reboots
	199	+	sudo apt install -y iptables-persistent
189	200		sudo netfilter-persistent save
190		-
191		-	# Option B: UFW with NAT (Ubuntu)
192		-	sudo ufw allow 22,80,443,8080/tcp
193		-	echo 'net.ipv4.ip_forward=1' \| sudo tee -a /etc/sysctl.conf
194		-	sudo sysctl -p
195	201		```
196	202
197	203		### 7. Deploy Your First App

 # Any VPS provider: DigitalOcean, Linode, Vultr, Hetzner
 # Ubuntu/Debian recommended
+# Configure UFW firewall first
+sudo ufw --force enable
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+sudo ufw allow 22/tcp
+sudo ufw allow 80/tcp
+sudo ufw allow 443/tcp
 # Install Podman (more secure than Docker)
 sudo apt update
 sudo apt install -y podman
 ### 3. Create Config
 ```toml
-# gordon.toml
+# Create gordon.toml in current directory (or use --config flag)
+# Gordon searches for config in: ./ → ~/.config/gordon/ → ~/.gordon/ → ~/ → /etc/gordon/
 [server]
 port = 8080
 registry_domain = "registry.yourdomain.com"
 "app.yourdomain.com" = "myapp:latest"
 "api.yourdomain.com" = "api:v1"
 "blog.yourdomain.com" = "wordpress:latest"
+# Custom config file location (optional):
+# gordon --config /path/to/custom.toml start
 ```
 ### 4. Point Cloudflare DNS
 systemctl --user status gordon
 ```
-### 6. Configure Firewall
+### 6. Redirect Ports 80/443 to 8080
 ```bash
-# Set up port forwarding (choose one option)
+# Simple iptables redirect
-# Option A: iptables (most common)
 sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
 sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
-# Make iptables rules persistent
+# Make rules persistent across reboots
-sudo apt-get install iptables-persistent
+sudo apt install -y iptables-persistent
 sudo netfilter-persistent save
-# Option B: UFW with NAT (Ubuntu)
-sudo ufw allow 22,80,443,8080/tcp
-echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
-sudo sysctl -p
 ```
 ### 7. Deploy Your First App