Defaults

Behavior

Loaded models

Storage

Storage

Storage

Two-factor authentication

Require a time-based one-time code (TOTP) from an authenticator app in addition to the admin password. The secret is stored on the server outside appsettings.json, so it is never included in a configuration export.

API keys

Tokens accepted as Authorization: Bearer …. Created keys persist in the per-user data directory and survive restarts. The full token is shown only at creation; revoke + mint a new one if you lose it.

TLS certificate

The certificate Kestrel is currently serving with. Self-signed certificates are auto-generated for development; for production, upload your own PFX/PEM below.

Upload certificate

Accepted formats: .pfx / .p12 (with optional password) and a single .pem file that contains both the certificate and its private key. A server restart is required to apply.

ACME / Let’s Encrypt restart required

Obtain a publicly-trusted certificate automatically and renew it in the background, with no reverse proxy. Requires a public DNS name that resolves to this server and an open inbound port: 80 for the HTTP-01 challenge or the HTTPS port for TLS-ALPN-01. An explicitly configured certificate path always takes precedence over ACME.

For a public HTTPS endpoint, set HTTPS to 443. Ports below 1024 require the server process to have permission to bind them (the Scaleway systemd unit grants this). Make sure the new port is open in the firewall before restarting, or you may lock yourself out.