Add, edit, list, show, and remove PostgreSQL listeners in cordon.toml.
Manage the PostgreSQL listeners that tell cordon which database connections to intercept and what credentials to inject.Prefer these commands over editing cordon.toml directly. They validate listener ports, upstreams, TLS mode, and secret references, and are intended to make listener configuration safer and less error-prone.All cordon listener subcommands accept --scope project|user to select which config file they target, matching cordon start and cordon setup. --config and --scope are mutually exclusive — passing both is an error. Resolution:
--config <path> — explicit path.
--scope <scope> — resolves to the scope’s default config path (project → $CWD/cordon.toml, user → ~/.config/cordon/cordon.toml).
Neither flag — defaults to project scope ($CWD/cordon.toml).
cordon listener add --config <path> can create a default config skeleton when that explicit path is missing. With default project scope or --scope, run cordon setup first. Other listener subcommands require the resolved config file to already exist.
Add a new PostgreSQL listener. With no flags, launches an interactive wizard that prompts for name, port, upstream address, client TLS mode, username, secret source, and source-specific fields.
1Password vault name (requires --source 1password)
--item
1Password item name (requires --source 1password)
--field
1Password field name (requires --source 1password)
--account
1Password account selector with --source 1password; keyring account name with --source keyring
--client-tls
Client-to-Cordon TLS mode: accept (default), require, or disable
--config
Path to cordon.toml (mutually exclusive with --scope)
--scope
project (default) or user — selects which config file to edit
--client-tls require requires valid tls.ca_cert_path and tls.ca_key_path in cordon.toml.When client_tls is omitted, Cordon treats it as accept.Cordon always requires TLS from Cordon to the upstream PostgreSQL server before it sends startup or authentication data. There is no command-line or configuration option to disable upstream PostgreSQL TLS.
After adding a keyring-backed listener, store the secret with cordon secret set ACCOUNT. Use cordon listener show NAME to find the keyring account. 1Password listeners don’t need this step — credentials are fetched from 1Password directly.
Edit an existing listener. With no flags (other than --scope or --config), launches an interactive editor that pre-fills current values — press Enter to keep a value, or type a new one.
Pass flags to change only specific fields without prompting:
cordon listener edit local-pg --port 15433
Argument / Flag
Description
NAME
Listener name to edit (positional, required)
--new-name
Rename the listener
--port
New local port
--upstream
New upstream address
--username
New database username
--source
1password or keyring
--vault
1Password vault name (requires --source 1password or existing 1password source)
--item
1Password item name (requires --source 1password or existing 1password source)
--field
1Password field name (requires --source 1password or existing 1password source)
--account
1Password account selector with --source 1password or an existing 1Password source; keyring account name with --source keyring or an existing keyring source
--client-tls
Client-to-Cordon TLS mode: accept, require, or disable
--config
Path to cordon.toml (mutually exclusive with --scope)
--scope
project (default) or user — selects which config file to edit
Non-interactive edit changes only the fields you specify. Unspecified fields keep their current values. Partial 1Password updates work the same as for routes:
# Change only the vault — item and field stay the samecordon listener edit staging-db --vault NewVault
