docs(cli): clarify tailscale admin TLS with wildcard DNS routing

2 files · +28 -0

M docs/cli/index.md +2 -0


@@ -122,6 +122,8 @@ when you want to bypass your saved configuration.
122	122		Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate.
123	123		You can make this persistent with `insecure_tls = true` in `[client]` of `~/.config/gordon/gordon.toml`
124	124		or in a specific entry in `~/.config/gordon/remotes.toml`.
	125	+	This is useful when admin/API access goes through a private network (for example Tailscale),
	126	+	while your public app domains still use wildcard DNS and normal reverse-proxy routing.
125	127
126	128		```bash
127	129		# Using flags (use the gordon_domain from remote Gordon config)


@@ -122,6 +122,8 @@ when you want to bypass your saved configuration.
122	Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate.	122		Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate.
123	You can make this persistent with `insecure_tls = true` in `[client]` of `~/.config/gordon/gordon.toml`	123		You can make this persistent with `insecure_tls = true` in `[client]` of `~/.config/gordon/gordon.toml`
124	or in a specific entry in `~/.config/gordon/remotes.toml`.	124		or in a specific entry in `~/.config/gordon/remotes.toml`.
		125	+	This is useful when admin/API access goes through a private network (for example Tailscale),
		126	+	while your public app domains still use wildcard DNS and normal reverse-proxy routing.
125		127
126	```bash	128		```bash
127	# Using flags (use the gordon_domain from remote Gordon config)	129		# Using flags (use the gordon_domain from remote Gordon config)

M docs/cli/remotes.md +26 -0


@@ -304,6 +304,32 @@ gordon remotes use prod && gordon routes list
304	304		gordon remotes use staging && gordon routes list
305	305		```
306	306
	307	+	### Tailscale Admin + Wildcard App Domains
	308	+
	309	+	Use this pattern when Gordon admin/API is reachable only on a Tailscale path (self-signed or private cert),
	310	+	while app traffic still uses your public wildcard DNS and reverse-proxy routing.
	311	+
	312	+	```toml
	313	+	# ~/.config/gordon/remotes.toml
	314	+	active = "prod-ts"
	315	+
	316	+	[remotes.prod-ts]
	317	+	url = "https://gordon-backend.tailnet.ts.net"
	318	+	token_env = "GORDON_TOKEN"
	319	+	insecure_tls = true
	320	+	```
	321	+
	322	+	```bash
	323	+	# CLI calls Gordon admin API over Tailscale with insecure TLS allowed
	324	+	gordon status
	325	+	gordon routes list
	326	+	gordon deploy app.bnema.dev
	327	+	```
	328	+
	329	+	`insecure_tls` only affects CLI -> Gordon admin HTTPS verification. It does not change
	330	+	your runtime routing: the Gordon reverse proxy and container routes can still serve
	331	+	`*.bnema.dev` behind your normal wildcard DNS setup.
	332	+
307	333		## Related
308	334
309	335		- [CLI Overview](./index.md)


@@ -304,6 +304,32 @@ gordon remotes use prod && gordon routes list
304	gordon remotes use staging && gordon routes list	304		gordon remotes use staging && gordon routes list
305	```	305		```
306		306
		307	+	### Tailscale Admin + Wildcard App Domains
		308	+
		309	+	Use this pattern when Gordon admin/API is reachable only on a Tailscale path (self-signed or private cert),
		310	+	while app traffic still uses your public wildcard DNS and reverse-proxy routing.
		311	+
		312	+	```toml
		313	+	# ~/.config/gordon/remotes.toml
		314	+	active = "prod-ts"
		315	+
		316	+	[remotes.prod-ts]
		317	+	url = "https://gordon-backend.tailnet.ts.net"
		318	+	token_env = "GORDON_TOKEN"
		319	+	insecure_tls = true
		320	+	```
		321	+
		322	+	```bash
		323	+	# CLI calls Gordon admin API over Tailscale with insecure TLS allowed
		324	+	gordon status
		325	+	gordon routes list
		326	+	gordon deploy app.bnema.dev
		327	+	```
		328	+
		329	+	`insecure_tls` only affects CLI -> Gordon admin HTTPS verification. It does not change
		330	+	your runtime routing: the Gordon reverse proxy and container routes can still serve
		331	+	`*.bnema.dev` behind your normal wildcard DNS setup.
		332	+
307	## Related	333		## Related
308		334
309	- [CLI Overview](./index.md)	335		- [CLI Overview](./index.md)