v3.2.0 4fc01fa

2026-10-16

4fc01faMerge pull request 'fix(proxy): send a trustworthy client IP to upstream containers' (#18) from fix/edge-trusted-real-ip into main merge SSH Unverifiedtag v3.2.0bnema
6e4d05dfix(proxy): send a trustworthy client IP to upstream containers GPG Verifiedbrice

2026-10-14

db3477eMerge pull request 'fix(docker): build on the published golang:1.27-alpine3.23 image' (#15) from chore/go-tooling-maintenance into main merge SSH Unverifiedbnema
944e1c7fix(docker): build on the published golang:1.27-alpine3.23 image GPG Verifiedbrice

2026-10-10

3a9dcaeMerge pull request 'feat(security): v3 secrets hardening' (#14) from feat/v3-secrets-hardening into main merge SSH Unverifiedbnema
beaf875ci(lint): bump golangci-lint to v2.14.0 for Go 1.27.2 GPG Verifiedbrice
2423197fix(security): keep dropped log paths protected and limit log-dir exception to data_dir/logs GPG Verifiedbrice
a320e99refactor(security): guard binds in resolveServiceBinds and add childenv.CommandContext GPG Verifiedbrice
01ec9bdfix(security): allow read-only binds of Gordon log directories GPG Verifiedbrice

2026-10-08

b4f4f5afix(security): strip GORDON_ env from journalctl and keep TLS cert dir bindable GPG Verifiedbrice
64d925bfix(security): guard restarts, widen protected paths, and strip GORDON_ env from secret tools GPG Verifiedbrice
1df31ddfix(deployment): never replace another container's secret files GPG Verifiedbrice
4e3a25ddocs(security): document secret files, runtime guard, and hardening GPG Verifiedbrice
49efad0feat(security): guard app container configs and disable process dumping GPG Verifiedbrice
e683751feat(deployment): deliver opt-in secrets as read-only files GPG Verifiedbrice
b7019c4feat(secrets): add host secret file store GPG Verifiedbrice
e55fb3bfeat(apps): parse and validate file-delivered secrets GPG Verifiedbrice
7ec1d0amerge(main): sync README wording from GitHub merge GPG Verifiedbrice
cfa771fdocs(auth): document the admin scope gordon images push needs (#13) brice
525f93dfix(cli): infer push registry from target Gordon instance (#12) brice

2026-10-03

3cf12bachore(docs): Simplify README by referencing installation guide GPG Unverifiedbnema
cf652cbchore(docs): README wording GPG Unverifiedbnema

2026-10-02

d676137fix(cli): explain restart_unsafe in apps status (#10) tag v3.1.0brice
48e0691feat(apps): support per-service env in app manifests (#9) brice
3a7fcc7fix(apps): explain that secrets require an applied service (#8) bnema
78f9cbcfix(deploy): report removed services as removed (#7) bnema
598d46dfix(ca): honor --remote for ca export and info (#6) brice
dcd34c9ci(forgejo): add a Forgejo workflow without paths-filter and CodeQL (#11) brice

2026-10-01

f19f453release: Gordon v3.0.0 - declarative apps (#299) GPG Unverifiedtag v3.0.0bnema

2026-09-03

da9b3d2build(deps): bump the all-dependencies group across 1 directory with 15 updates (#239) GPG Unverifieddependabot[bot]

2026-09-02

50221f8build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#240) GPG Unverifieddependabot[bot]

2026-08-31

f37fe67fix(remote): avoid replaying non-idempotent requests (#238) GPG Unverifiedtag v2.31.1bnema
30c748cfix(container): preserve legacy attachment volumes (#236) GPG Unverifiedbnema

2026-08-23

e02f654fix(release): prepare v2.31 release blockers (#235) GPG Unverifiedtag v2.31.0bnema

2026-08-21

fdf5cecbuild(deps): bump the all-dependencies group with 19 updates (#234) GPG Unverifieddependabot[bot]
c6dcd31build(deps): bump go.opentelemetry.io/otel from 1.44.0 to 1.45.0 (#232) GPG Unverifieddependabot[bot]
cf800cabuild(deps): bump github.com/aws/aws-sdk-go-v2/config (#229) GPG Unverifieddependabot[bot]
dd65661build(deps): bump github.com/mattn/go-runewidth from 0.0.23 to 0.0.27 (#230) GPG Unverifieddependabot[bot]
3611056chore(deps): group monthly Dependabot updates (#233) GPG Unverifiedbnema
40e8e08build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#228) GPG Unverifieddependabot[bot]

2026-08-11

15daeb5Merge pull request #227 from bnema/chore/refresh-readme merge GPG Unverifiedbnema
d100045Fix website and documentation links in README GPG Unverifiedbnema
65654e6Merge pull request #226 from bnema/security/scan-9bfec05a merge GPG Unverifiedbnema

2026-08-10

378d7cffix(security): address verified review findings GPG Verifiedbrice
6e78011fix(security): harden reviewed remediation paths GPG Verifiedbrice
271c36afix(security): remediate codex scan findings GPG Verifiedbrice
58a92f3Merge pull request #225 from bnema/dependabot/go_modules/go_modules-c93f3641e6 merge GPG Unverifiedtag v2.31.0-dev23bnema
a31d8b7build(deps): bump google.golang.org/grpc GPG Unverifieddependabot[bot]
621475dMerge pull request #214 from bnema/dependabot/go_modules/github.com/google/go-containerregistry-0.21.7 merge GPG Unverifiedbnema
e41a4daMerge branch 'main' into dependabot/go_modules/github.com/google/go-containerregistry-0.21.7 merge GPG Unverifiedbnema

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close