General

Core server behavior and performance limits.

Import config

Log capture level ?

Sync Timeout ?

Max Jobs Per Owner ?

API Docs Layout restart

CORS Origins restart ?

Request History Capacity restart ?

Models

Defaults used when no model is specified in a request, plus the on-disk catalog and currently-loaded models.

Defaults ?

Default Model ?

Vision OCR ?

Audio ?

Text Embeddings ?

Image Embeddings ?

Reranking ?

Behavior

Allow Custom ModelsWhen enabled (default), inference requests can specify any model identifier. When disabled, the model field on every request is ignored and the server's preconfigured defaults above are used instead. Takes effect immediately, no restart required.

Loaded models ?

Loading…

Catalog ?

Local only

Loading…

Storage

Model Directory restart ?

Disk used Scanning… Files -

OCR

OCR engine used for document text extraction. Default language, auto deskew, and max concurrent processes apply immediately; provider and AWS credential changes still require a restart.

Provider ?

LM-Kit OCR Settings

Default Language ?

Max Concurrent Processes ?

Orientation DetectionDetect and correct page rotation (0°/90°/180°/270°) before OCR when the request does not specify.

Auto DeskewAutomatically correct skewed document scans before OCR.

Smart BinarizationUse adaptive thresholding to handle uneven lighting, shadows, and gradients. Disable for already clean, high-contrast scans.

DespeckleRemove small isolated speckle noise (scanner debris, photocopy specks) from the binarized image before recognition.

AWS Textract Settings

AWS Access Key ID ?

AWS Secret Access Key ? Leave masked to keep current value.

AWS Region ?

Timeout (seconds) ?

PaddleVlm Settings

No additional configuration available for this provider.

Hardware

GPU acceleration and device assignment. restart required

CUDA AccelerationUse NVIDIA GPU via CUDA.

Distributed InferenceUse all GPUs for tensor distribution.

GPU Selection

Loading devices…

Inference

Concurrency, context budgets, and conversation context lifecycle.

Max Concurrent Completions ?

Max Concurrent Embeddings ?

Inference Memory Budget (%) ?

Slots ?

Slot Context (tokens) ?

When All Slots Busy ?

Pool Allocation ?

Embedding Context (tokens) ?

Embedding Batch Inputs ?

Default Image Detail ?

Hibernation Mode ?

Per-model overrides ?

KV Cache Quantization ?Store the conversation KV cache at 8-bit precision, roughly halving its memory footprint at a small quality cost.

Speculative Decoding Drafts ?Use the draft assets packaged with a model (multi-token prediction or a draft model) for draft-and-verify decoding, speeding up generation at a small VRAM cost.

Storage

Context Hibernation Directory restart ?

Disk used Scanning… Files -

File Management

Upload storage, retention, and size limits.

Max File Retention ?

days

hrs

min

Scan Interval ?

days

hrs

min

Max Upload Size (MB) ?

Retain all uploaded filesWhen enabled, the server keeps every uploaded file for analysis: automatic retention cleanup is paused and every deletion request (the per-file delete API, the Delete all button below, and the background cleanup job) is refused. Takes effect immediately, no restart required.

Storage

Disk used Scanning… Files - Directory -

Security

API authentication.

Checking… Evaluating security posture…

Allow anonymous calls When enabled, the API surface accepts unauthenticated requests. Disable to require a bearer token matching one of the API keys below. Admin endpoints are always protected by the admin password and are unaffected by this toggle. Applies immediately, no restart.

Require HTTPS for admin Refuse to serve the admin panel over plaintext HTTP, redirecting browser requests to HTTPS. Loopback is always exempt. Applies immediately, no restart.

HSTS Send a Strict-Transport-Security header so browsers refuse plaintext to this host after the first HTTPS visit. Recommended for public hosting on a stable domain; avoid on a bare IP or shared hostname. Applies immediately, no restart.

Sign-in brute-force lockout Throttle repeated failed admin sign-ins from one IP with an exponentially growing cooldown. Keep enabled for any internet-facing host. Applies immediately, no restart.

HTTPS restart required Serve the API and admin panel over TLS. Disabling this sends admin sign-in and session tokens in plaintext, and combined with "Require HTTPS for admin" can lock out remote access (loopback stays reachable). Configure the certificate under TLS below.

Admin IP allowlist

Optionally restrict who can reach this admin panel to specific source IPs or CIDR ranges. Leave it empty (the default) to allow any source. Localhost is always permitted, so you can never lock yourself out locally. This does not affect the API. Applies immediately, no restart.

Allowed IPs / CIDR ranges (optional)

Format examples: 203.0.113.0/24, 198.51.100.7, 2001:db8::/32. One entry per line, or separate them with commas.

Admin password

The password required to sign in to this admin panel. Stored as Admin:Password and never included in a configuration export. Minimum 8 characters; applied immediately.

New password

Confirm password

Two-factor authentication

Require a time-based one-time code (TOTP) from an authenticator app in addition to the admin password. The secret is stored on the server outside appsettings.json, so it is never included in a configuration export.

Checking…

API keys

Tokens accepted as Authorization: Bearer …. Created keys persist in the per-user data directory and survive restarts. The full token is shown only at creation; revoke + mint a new one if you lose it.

0active 0revoked

No API keys yet. Click Create key to mint one.

TLS certificate

The certificate Kestrel is currently serving with. Self-signed certificates are auto-generated for development; for production, upload your own PFX/PEM below.

Loading…

Upload certificate

Accepted formats: .pfx / .p12 (with optional password) and a single .pem file that contains both the certificate and its private key. A server restart is required to apply.

Certificate file

Password (PFX only - leave empty for PEM)

ACME / Let’s Encrypt restart required

Obtain a publicly-trusted certificate automatically and renew it in the background, with no reverse proxy. Requires a public DNS name that resolves to this server and an open inbound port: 80 for the HTTP-01 challenge or the HTTPS port for TLS-ALPN-01. An explicitly configured certificate path always takes precedence over ACME.

Loading…

Enable automatic TLS via ACME

Domain names (one per line, or comma-separated)

Contact email (recommended)

Use staging server (for testing) I accept the certificate authority’s terms of service

Test with the staging server first to avoid the production issuance rate limits, then switch it off for a browser-trusted certificate. Apply changes by restarting the server.

Telemetry

OpenTelemetry and Prometheus. restart required

OpenTelemetryExport traces and metrics via OTLP.

PrometheusExpose /metrics endpoint for scraping.

OTLP Endpoint

Ports

The TCP ports Kestrel listens on. restart required

HTTP restart required

HTTPS restart required

For a public HTTPS endpoint, set HTTPS to 443. Ports below 1024 require the server process to have permission to bind them (the Scaleway systemd unit grants this). Make sure the new port is open in the firewall before restarting, or you may lock yourself out.

Admin access

Confirm

Enter a value

Unexpected restart report

Server memory diagnostics

Collection settings

Tenant settings

Dashboard

System resources

GPU activity

Downloads in progress

Loaded models ?

File storage

TLS status

Server controls

Telemetry

Alerts

Scheduler

Requests

Audit log

Logs

General

Models

Defaults ?

Behavior

Loaded models ?

Catalog ?

Storage

OCR

LM-Kit OCR Settings

AWS Textract Settings

PaddleVlm Settings

Hardware

Inference

Per-model overrides ?

Storage

File Management

Storage

Security

Admin IP allowlist

Admin password

Two-factor authentication

API keys

TLS certificate

Upload certificate

ACME / Let’s Encrypt restart required

Telemetry

Ports

Vector Stores

Full-Text Stores

Search (Managed)