pixano_inference.server_settings

Server-side runtime settings (security, media policy, logging).

These are read from environment variables prefixed PIXANO_INFERENCE_ (or a .env file) and drive the request-facing behaviour of the server: API-key authentication, the media-ingestion security policy, CORS, and request-body limits.

ServerSettings is what the ingress and model replicas consult at request time; because it derives entirely from the environment, a Ray worker process reconstructs the same policy its driver used (see :mod:pixano_inference.utils.media).

ServerSettings

Bases: BaseSettings

Request-facing server configuration, sourced from the environment.

Attributes:

Name	Type	Description
api_keys	Annotated[list[str], NoDecode]	Accepted API keys. When empty, authentication is disabled (a warning is emitted at startup; see :mod:pixano_inference.security).
media_allow_url	bool	Whether URL media (http/https) may be fetched at all.
media_url_host_allowlist	Annotated[list[str], NoDecode]	Hostnames whose private/loopback IPs are permitted despite the SSRF guard (e.g. pixano on a Docker network).
media_allow_private_ips	bool	Disable the private/loopback/link-local IP block entirely (unsafe; for trusted single-host setups only).
media_roots	Annotated[list[Path], NoDecode]	Filesystem roots under which local-path media is allowed. Empty means local-path media is denied outright.
media_connect_timeout_s	float	Connect timeout for URL fetches.
media_read_timeout_s	float	Read timeout for URL fetches.
media_max_redirects	int	Maximum number of HTTP redirects followed (each re-validated).
media_max_image_bytes	int	Maximum decoded size for a fetched image.
media_max_video_bytes	int	Maximum size for a fetched video.
cors_allow_origins	Annotated[list[str], NoDecode]	Allowed CORS origins. Empty disables CORS.
max_request_body_bytes	int	Maximum accepted request body size.
log_level	str	Root log level applied at startup.
log_json	bool	Emit structured JSON logs when true.

auth_enabled property

Whether API-key authentication is active.