gori keeps global preferences in a JSON settings file and stores each project as its own SQLite database. This page covers the essentials you need on day one: where things live, how the proxy binds, and how clients trust gori's CA. For the full, key-by-key breakdown, see the Configuration Reference.
The gori Home Directory
Everything gori writes lives under a single tree, GORI_HOME: $GORI_HOME when that variable is set and non-empty, otherwise ~/.gori. It holds settings.json (global preferences), your project databases under projects/, the root CA in ca/, plus themes/ and wordlists/. See Storage Layout for the full tree.
Point gori at an isolated home for a session:
GORI_HOME=/tmp/gori-scratch gori
Global Settings
Global preferences are stored in settings.json. Print its path, or open it in $EDITOR:
gori settings # print the settings.json path
gori settings --edit # open it in your editor
You rarely need to edit the file by hand. Everything in it is editable in the Preferences modal, grouped into five sub-tabs (General, Appearance, Editor & Keys, Network & Tabs, AI):
| Open it with | Lands on |
|---|---|
Ctrl-, from anywhere |
The group strip, so you pick a group first |
The β chip in the top bar |
Same as Ctrl-, |
Ctrl-P β any Settings: β¦ entry |
That section's fields directly |
Ctrl-, also works in the project picker, before any project is open, so you can set your theme on first launch. Saved changes apply live, no restart. See the Settings guide for every section and field, and the Configuration Reference for the underlying keys.
Network
With no upstream setting or process proxy environment, the proxy listens on 127.0.0.1:8070 and connects directly to targets. You can change the gori-side route in three places, highest priority first:
- Per-project: pin a bind address, port, and upstream for one project from the Project tab, or headless with
gori run project network; these win for that project only. - CLI flags:
--listen/--portoverride the global default for the current process, without writing to disk. settings.jsonnetwork: the shared default, edited by the first-run wizard and Preferences β Network.
When nothing is set, the factory default is 127.0.0.1:8070, direct. If network.upstream_proxy is blank, gori also honors the conventional HTTPS_PROXY, HTTP_PROXY, and ALL_PROXY variables (including lowercase spellings), with NO_PROXY / no_proxy exceptions; localhost and loopback destinations always stay direct. A project upstream, an upstream rule, or a non-empty network.upstream_proxy wins over those variables. See network for every key and Per-Project Overrides for the exact precedence.
The Root CA
To intercept HTTPS, clients must trust gori's root certificate, kept in $GORI_HOME/ca (~/.gori/ca by default) as root.crt.pem and root.key.pem.
gori ca # print the certificate path
gori ca --pem # print the PEM to stdout
gori ca --ca-dir /path # use a custom CA directory
gori ca regenerate --yes # replace the root CA (scripts/CI; voids prior trust)
You can also rotate the CA from the TUI command palette (Regenerate CA certificate), or interactively with gori ca regenerate (type regenerate to confirm). Both paths are confirm-gated because rotation invalidates all previously issued trust; any already-running gori keeps the old CA until restarted.
Bring your own CA
To reuse one CA across a team or machines, generate a root externally and import it (cert and key: gori signs leaf certificates with the key; clients trust only the cert):
openssl ecparam -genkey -name prime256v1 -out root.key.pem
openssl req -x509 -new -key root.key.pem -days 3650 -subj "/CN=my ca" -out root.crt.pem
gori ca import --cert root.crt.pem --key root.key.pem --yes
The same action is available from the palette (Import CA certificate). gori checks the key matches the cert, that it is a CA, and that it can actually sign a leaf with the key before adopting it. An Ed25519 or Ed448 root is rejected, because leaves are signed with SHA-256. Distribute only root.crt.pem to trust; keep root.key.pem secret. See gori ca import.
The palette's Open browser action launches an installed browser with an isolated profile that already trusts the CA and routes through the proxy (see the Quick Start).
For command-line tools, the palette's Open shell action does the same for a terminal: Open shell here hands this terminal to your $SHELL with the proxy and a CA bundle already set (gori keeps capturing and comes back when the shell exits; it needs capture on and intercept off, since held requests could not be forwarded while the shell has the screen), and Copy env copies a one-line command (eval "$(gori run shell --print ...)") to the clipboard, ready to paste into another pane. From any terminal, gori run shell does the same (see gori run shell).
Full Reference
See the Configuration Reference for every settings key and the CLI Reference for all command-line flags.