Security and remote access

Loopback is the default and safest mode:

[server]
http_bind = "127.0.0.1:8080"
allow_remote = false
web_enabled = false
cors_origins = []

Require an API key

printf '%s' "$MIRMIR_HTTP_API_KEY" | mirmir config set server.api_key

Once configured, clients send:

Authorization: Bearer YOUR_KEY

Bind beyond loopback

A non-loopback bind requires both explicit remote access and an API key:

[server]
http_bind = "0.0.0.0:8080"
allow_remote = true
web_enabled = false

The embedded dashboard deliberately cannot be exposed on this bind. Put TLS, network policy, and any public rate limiting in a trusted reverse proxy or private network boundary.

Browser origins

CORS is disabled until exact origins are listed:

[server]
cors_origins = ["https://app.example.com"]

MiRMiR accepts GET and POST with Authorization and Content-Type headers from configured origins. Do not use * as a substitute for deciding which applications may reach a model server.