node.toml.example

[node]
id = "local-node-1"
control_api = "http://127.0.0.1:7817"
node_token = "change-me"
region = "default"
work_root = "/data/node"

[node.capabilities]
build = true
serve = true

[build]
concurrency = 1
command_timeout_seconds = 600
retain_workspace_on_failure = true

[serve]
host = "0.0.0.0"
port = 8080
public_base_url = "http://127.0.0.1:8080"
metadata_cache_ttl_seconds = 30
artifact_cache_root = "/data/node/artifacts"

# Native HTTPS uses SNI-selected certificates synchronized from the Control API.
# Enable this on every public regional entry Node. Keep public_base_url on the
# private HTTP listener for Peer Hop traffic and internal health checks.
[serve.tls]
enabled = false
port = 8443

# SSR services start on the first request for their deployment and stop
# again after sitting idle; 0 disables the idle stop.
[serve.ssr]
idle_stop_seconds = 1800
startup_timeout_seconds = 90

[security]
# Repository targets must be publicly routable by default. Node administrators
# may add exact host + resolved IP + port exceptions; wildcards and CIDRs are
# intentionally unsupported.
# [[security.private_repository_targets]]
# host = "git.internal.example"
# ip = "10.0.0.8"
# port = 2222

[development]
verbose_build_log = true

[log]
level = "info"
format = "pretty"

[runtime]
backend = "podman-socket"
socket = "unix:///run/user/1000/podman/podman.sock"
default_build_image = "docker.io/library/node:22"
# Image that runs SSR service containers.
default_serve_image = "docker.io/library/node:22"
# SSR containers are reached by container IP, so a containerized node must
# share this network with them (override with GWNODE_RUNTIME_NETWORK).
network = "bridge"

[runtime.resources]
cpu_limit = 2
memory_mb = 2048