# Gordon example configuration
# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.

[server]
registry_port = 5000
gordon_domain = "gordon.example.com"
# legacy_registry_domains = ["registry.example.com:5000"]
# proxy_allowed_ips = ["173.245.48.0/20"]
# registry_allowed_ips = []
# registry_listen_address = ""
# tls_cert_file = ""
# tls_key_file = ""
# force_https_redirect = false
# data_dir = "~/.gordon"
# max_blob_chunk_size = "95MB"
# max_blob_size = "1GB"
# max_proxy_body_size = "512MB"
# max_proxy_response_size = "1GB"
# max_concurrent_connections = 10000

# "edge" is the conventional route-capable entrypoint name, but a single
# custom smart_tcp or tls_mux entrypoint can also serve normal Gordon routes.
[entrypoints.edge]
address = ":443"
protocol = "smart_tcp"
# trusted_cidrs = []
# raw_fallback = "ssh-fallback"
# raw_fallback_trusted_cidrs = ["100.64.0.0/10"]
# allow_public_raw_fallback = false

[dns]
resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
propagation_timeout = "5m"
polling_interval = "5s"

[tls.acme]
enabled = false
email = ""
challenge = "auto"
obtain_batch_size = 1

[auth]
enabled = true
# Use "pass" or "sops" in production. The unsafe backend reads a local file
# under server.data_dir/secrets and is intended for development only.
secrets_backend = "pass"
token_secret = "gordon/auth/token_secret"
token_expiry = "30d"
access_token_ttl = "15m"

[api.rate_limit]
enabled = true
global_rps = 500
per_ip_rps = 50
burst = 100
trusted_proxies = []

[deploy]
pull_policy = "if-tag-changed"
readiness_mode = "auto"
health_timeout = "90s"
readiness_delay = "5s"
drain_mode = "auto"
drain_timeout = "30s"
drain_delay = "2s"

[containers]
# "compat" preserves broad image compatibility. "strict" enables a read-only
# root filesystem and narrower Linux capabilities.
security_profile = "compat"

[network_isolation]
enabled = true
network_prefix = "gordon"
# Set true to create Docker internal networks without direct external egress.
internal = false

[volumes]
auto_create = true
prefix = "gordon"
preserve = true

[images]
# Explicit external registries must be listed here. Gordon's own registry is
# always allowed; localhost/private/link-local registries are always rejected.
allowed_registries = []
# Require @sha256:<digest> for allowlisted external registries.
require_digest = false

[images.prune]
enabled = false
schedule = "daily"
keep_last = 3

[auto_route]
enabled = false

[logging]
level = "info"
format = "console"

[logging.file]
enabled = false
# path = "~/.gordon/logs/gordon.log"
# max_size = 100
# max_backups = 3
# max_age = 28

[logging.container_logs]
enabled = true
# dir = "~/.gordon/logs/containers"
# max_size = 100
# max_backups = 3
# max_age = 28

[logging.access_log]
enabled = false
format = "json"
output = "stdout"
# file_path = "~/.gordon/logs/access.log"
max_size = 100
max_backups = 3
max_age = 28
exclude_health_checks = true
syslog_identifier = "gordon-access"

[telemetry]
enabled = false
# endpoint = "http://localhost:4318"
# auth_token = ""
traces = true
metrics = true
logs = true
trace_sample_rate = 1.0

[env]
# dir = "~/.gordon/env"

[backups.databases]
enabled = false
schedule = "daily"
storage_dir = ""

[backups.databases.retention]
hourly = 0
daily = 0
weekly = 0
monthly = 0

[backups.volumes]
enabled = false
interval = "24h"
compression = "gzip"
timeout = "2h"
max_concurrency = 2
# Helper image must include tar and the selected compressor.
helper_image = "alpine:3.20"

[backups.volumes.s3]
bucket = ""
region = ""
prefix = ""
# endpoint = "https://s3.example.com"
# path_style = false
# sse_algorithm = "AES256"
# sse_kms_key_id = ""

[backups.volumes.retention]
keep = 14

[routes]
# "app.example.com" = { image = "myapp:latest" }

[external_routes]
# "status.example.com" = "127.0.0.1:9000"

# Gordon-managed standalone L4 services. Use service:<name>:<port> from
# traffic routers to expose published loopback ports.
# [[services]]
# name = "rust"
# image = "registry.example.com:5000/rust:latest"
# enabled = true
# env_file = "/srv/gordon/services/rust.env"
#
# [[services.ports]]
# name = "game"
# container = 28015
# protocol = "udp"
# publish = "127.0.0.1:38015"
#
# [[services.ports]]
# name = "rcon"
# container = 28016
# protocol = "tcp"
# publish = "127.0.0.1:38016"
# trusted_cidrs = ["100.64.0.0/10"]
#
# [entrypoints.rust]
# address = "0.0.0.0:28015"
# protocol = "udp"
#
# [[traffic.udp.routers]]
# name = "rust-game"
# entrypoint = "rust"
# service = "service:rust:game"
#
# [entrypoints.rcon]
# address = "0.0.0.0:28016"
# protocol = "tcp"
# trusted_cidrs = ["100.64.0.0/10"]
#
# [[traffic.tcp.routers]]
# name = "rust-rcon"
# entrypoint = "rcon"
# service = "service:rust:rcon"

[network_groups]
# "backend" = ["app.example.com", "api.example.com"]

[attachments]
# "app.example.com" = ["postgres:18"]