# Gordon example configuration
# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.

[server]
port = 8088
tls_port = 8443
registry_port = 5000
gordon_domain = "gordon.example.com"
# legacy_registry_domains = ["registry.example.com:5000"]
# proxy_allowed_ips = ["173.245.48.0/20"]
# registry_allowed_ips = []
# registry_listen_address = ""
# tls_cert_file = ""
# tls_key_file = ""
# force_https_redirect = false
# data_dir = "~/.gordon"
# max_blob_chunk_size = "95MB"
# max_blob_size = "1GB"
# max_proxy_body_size = "512MB"
# max_proxy_response_size = "1GB"
# max_concurrent_connections = 10000

[dns]
resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
propagation_timeout = "5m"
polling_interval = "5s"

[tls.acme]
enabled = false
email = ""
challenge = "auto"
obtain_batch_size = 1

[auth]
enabled = true
# Use "pass" or "sops" in production. The unsafe backend reads a local file
# under server.data_dir/secrets and is intended for development only.
secrets_backend = "pass"
token_secret = "gordon/auth/token_secret"
token_expiry = "30d"
access_token_ttl = "15m"

[api.rate_limit]
enabled = true
global_rps = 500
per_ip_rps = 50
burst = 100
trusted_proxies = []

[deploy]
pull_policy = "if-tag-changed"
readiness_mode = "auto"
health_timeout = "90s"
readiness_delay = "5s"
drain_mode = "auto"
drain_timeout = "30s"
drain_delay = "2s"

[containers]
# "compat" preserves broad image compatibility. "strict" enables a read-only
# root filesystem and narrower Linux capabilities.
security_profile = "compat"

[network_isolation]
enabled = true
network_prefix = "gordon"
# Set true to create Docker internal networks without direct external egress.
internal = false

[volumes]
auto_create = true
prefix = "gordon"
preserve = true

[images]
# Explicit external registries must be listed here. Gordon's own registry is
# always allowed; localhost/private/link-local registries are always rejected.
allowed_registries = []
# Require @sha256:<digest> for allowlisted external registries.
require_digest = false

[images.prune]
enabled = false
schedule = "daily"
keep_last = 3

[auto_route]
enabled = false

[logging]
level = "info"
format = "console"

[logging.file]
enabled = false
# path = "~/.gordon/logs/gordon.log"
# max_size = 100
# max_backups = 3
# max_age = 28

[logging.container_logs]
enabled = true
# dir = "~/.gordon/logs/containers"
# max_size = 100
# max_backups = 3
# max_age = 28

[logging.access_log]
enabled = false
format = "json"
output = "stdout"
# file_path = "~/.gordon/logs/access.log"
max_size = 100
max_backups = 3
max_age = 28
exclude_health_checks = true
syslog_identifier = "gordon-access"

[telemetry]
enabled = false
# endpoint = "http://localhost:4318"
# auth_token = ""
traces = true
metrics = true
logs = true
trace_sample_rate = 1.0

[env]
# dir = "~/.gordon/env"

[backups]
enabled = false
schedule = "daily"
storage_dir = ""

[backups.retention]
hourly = 0
daily = 0
weekly = 0
monthly = 0

[routes]
# "app.example.com" = { image = "myapp:latest" }

[external_routes]
# "status.example.com" = "127.0.0.1:9000"

[network_groups]
# "backend" = ["app.example.com", "api.example.com"]

[attachments]
# "app.example.com" = ["postgres:18"]