2Bh SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK r SSK J r Jr SSKJr SSKJr /r\ R(rSSjrSr"SS5r"S S \5r"S S 5r\"S \405rS rSrSrSrSr Sr!Sr"Sr#Sr$Sr%Sr&Sr'Sr(Sr)Sr*Sr+Sr,Sr-Sr."S S!\5r/"S"S#\5r0"S$S%\5r1"S&S'\5r2"S(S)\5r3"S*S+\5r4"S,S-\5r5"S.S/\5r6"S0S1\5r7"S2S3\5r8"S4S5\5r9"S6S7\5r:"S8S9\5r;"S:S;\5r<"S<S=\5r="S>S?\5r>"S@SA\5r?"SBSC\5r@"SDSE\5rA"SFSG\5rB"SHSI\5rC"SJSK\5rD"SLSM\5rE"SNSO\5rF"SPSQ\5rG"SRSS\5rH"STSU\5rI"SVSW\5rJ"SXSY\5rK"SZS[\5rL"S\S]\5rM"S^S_\5rN"S`Sa\5rO"SbSc\5rP"SdSe\5rQ"SfSg\5rR"ShSi\5rS"SjSk\5rT"SlSm\5rU"SnSo\5rV"SpSq\5rW"SrSs\5rX"StSu\5rY"SvSw\5rZ"SxSy\5r["SzS{\5r\"S|S}\5r]"S~S\5r^"SS\5r_"SS\5r`"SS\5ra"SS\5rb"SS\5rc"SS\5rd"SS\5re"SS\5rf"SS\5rg"SS\5rh"SS\5ri"SS\5rj"SS\5rk"SS\5rl"SS\5rm"SS\5rn"SS\5ro"SS\5rp"SS\5rq"SS\5rr"SS\5rs"SS\5rt"SS\5ru"SS\5rv"SS\5rw"SS\5rx"SS\5ry"SS\5rz"SS\5r{"SS\5r|"SS\5r}"SS\5r~"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5r"SS\5rSr"SS\5r"SS\5rg)N) __version__util) ConfigError)reloader_enginesc0nU=(d Sn[H8nU"5nURU;aMUR5XR'M: U$)N)KNOWN_SETTINGSnamecopy)ignoresettingsssettings A/var/www/html/env/lib/python3.13/site-packages/gunicorn/config.py make_settingsrsIH \rF # <<6 ! !(  Oc[R"SU[R5(aURSSS5n[ US5$)Nz0(\d)00or)rematch IGNORECASEreplaceint)_xs rauto_intr's7 xx!R]]++ IIc4 # q!9rc ^\rSrSrSSjrSrSrU4SjrSrSr Sr \ S 5r \ S 5r \ S 5r\ S 5r\ S 5r\ S5r\ S5r\ S5r\ S5r\ S5r\ S5r\ S5r\ S5rSrU=r$)Config.c[5UlXlU=(d0 [RR [ RS5Ul[RR5Ul g)Nr) rr usageospathbasenamesysargvprogenvironr env_orig)selfr#r)s r__init__Config.__init__0sE%  9BGG,,SXXa[9  ) rc ^/n[SUR55n[UR5HfnURURn[ U5(aSR UR 5nURSR X4US95 Mh SRU5$)Nc38# UHn[U5v M g7fN)len).0ks r !Config.__str__..8s1=a3q66=sz<{}()>z{k:{kmax}} = {v})r4vkmax ) maxr sortedvaluecallableformat __qualname__appendjoin)r,linesr8r4r7s r__str__Config.__str__6s14==11 &A a &&A{{OOANN3 LL+22Q$2G H ' yyrcvXR;a[SU-5eURUR5$Nz No configuration setting for: %s)r AttributeErrorget)r,r s r __getattr__Config.__getattr__@s5 }} $ !Cd!JK K}}T"&&((rcd>US:waXR;a [S5e[TU] X5 g)Nr zInvalid access!)r rGsuper __setattr__)r,r r< __class__s rrMConfig.__setattr__Es- : $--"7 !23 3 D(rczXR;a[SU-5eURURU5 grF)r rGset)r,r r<s rrQ Config.setJs4 }} $ !Cd!JK K d&rclSUR;a#[R"URS5$/$)NGUNICORN_CMD_ARGS)r+shlexsplitr,s rget_cmd_args_from_envConfig.get_cmd_args_from_envOs, $-- /;;t}}-@AB B rc URURS.n[R"S 0UD6nUR SSS[R S[ -S-SS9 UR S S [R S 9 [URURRS 9nUH!nURURU5 M# U$)N)r#r)z-vz --versionversionz%(prog)s (version z) z&show program's version number and exit)actiondefaultr[helpargs*)nargsr^)keyr) r#r)argparseArgumentParser add_argumentSUPPRESSrr;r __getitem__ add_option)r,kwargsparserkeysr4s rrj Config.parserTsZZII ((262D+#,h6G6G$8;$F$N!I  K F#H4E4EFdmm)B)BCA MM!  ' ' / rcURSR5n[U[5(a7UR S5=(d US:HnU(aUR S:agU$UR $)N worker_class SyncWorkersyncrgthread)r rH isinstancestrendswiththreads__name__)r,uriis_syncs rworker_class_strConfig.worker_class_strfs]mmN+//1 c3  ll<0AC6MG4<I==!4599; ;rcZURSR5nUS:Xa[RnU[R:Xa,SUR;aURSRbSn[ R "USSS9n[US5(aUR5 U$) N logger_classsimple statsd_hostz!gunicorn.instrument.statsd.Statsdgunicorn.glogging.Loggerzgunicorn.loggers)r]sectioninstall) r rH LoggerClassr]r<rr}r~r)r,rwrs rrConfig.logger_classsmmN+//1 (?%%C +%% % -$-- 2N2T2T2`9 .&( < + +  "rc@UR=(d UR$r1)certfilekeyfilerWs ris_ssl Config.is_ssls}}, ,rc0nURR5H)up#URS:XdMUR5X'M+ U$)NSSL)r itemsrrH)r,optsr r<s r ssl_optionsConfig.ssl_optionss@==..0KD}}%"YY[ 1 rcURSR5n0nU(dU$UH2n[R"U5nUR SS5upVXbU'M4 U$![ a [ SU-5ef=f)Nraw_env=renvironment setting %r invalid)r rHrrrV ValueError RuntimeError)r,renverr4r7s rr Config.envs-- *..0JA!!!$A IwwsAF  I"#Ca#GHH Is A##A<cURSR5bgS[R;a&[RSR 5nUS;$g)NsendfileFSENDFILE)y1yestrueT)r rHr$r*lower)r,rs rrConfig.sendfilesO == $ ( ( * 6  #zz*-335H88 8rc<URSR5$)N reuse_portrrWs rrConfig.reuse_ports}}\*..00rcHURSR5nUcg0nUH\n[R"U5n[R "SUS5upVURSS5nURSS5nXbU'M^ U$![ a [SU-5ef=f)Nraw_paste_global_confz(?[TU]nUVs/sHn[U[5(dMUPM nnU(d U"XX#5$[ [ 5US'[ US5US'U"XX#5nURURSS55 [ RU5 U$s snf)Norder validatordesc) rL__new__rrrr2r staticmethodfmt_descrHr@) clsr basesattrs super_newbparents new_classrNs rrSettingMeta.__new__sGO #Bez!['A1eBS5 5^,g)% *<=kc6 599VR01i(Cs B)B)c[R"U5R5n[USU5 [USUR 5S5 g)Nrshortr)textwrapdedentstripsetattr splitlines)rrs rrSettingMeta.fmt_descs=t$**,VT"Wdoo/23rr)rvrr?rrrrrrs@rrrs 44rrcv\rSrSrSrSrSrSrSrSr Sr Sr Sr Sr SrSrSrSrSrSrSrSrSr\rS rS rg) SettingiNcVURbURUR5 ggr1)r]rQrWs rr-Setting.__init__s! << # HHT\\ " $rc*UR(dg[UR5nUR<SUR<S3nUR SS5nUR UR =(d SUR=(d [SUS.nURbURUS'USS:waURS 5 URbURUS 'URbURUS 'UR"U0UD6 g) Nz []%z%%store)destr\typer]r^metavarr\rraconst)clituplerr]rr r\rrsmetapoprarre)r,rjr_help_txtris rrhSetting.add_optionsxx TXX $ DLL9##C.IIkk,WII$   99 $ F9  ( w & JJv  :: !"jjF7O :: !"jjF7OT,V,rc.[R"U5$r1)r rWs rr Setting.copy3syyrcUR$r1r<rWs rrH Setting.get6s zzrc[UR5(d[SUR-5eURU5Ulg)NzInvalid validator: %s)r=r TypeErrorr r<)r,vals rrQ Setting.set9s6''3dii?@ @^^C( rctURUR:H=(a URUR:$r1)rr)r,others r__lt__Setting.__lt__>s,  -) U[[( *rcSURRURR[U5UR4-$)Nz"<%s.%s object at %x with value %r>)rNrrvidr<rWs r__repr__Setting.__repr__Cs<3 NN % % NN # # tH JJ 7   rr)rvrr?rr r<rrrrrr\r]rrrarr-rhr rHrQr__cmp__rrrrrrrsm D EG CI D D FG E D E E#-<) *G rrc&Ucg[U[5(aU$[U[5(d[SU-5eUR 5R 5S:XagUR 5R 5S:Xag[ SU-5e)NInvalid type for casting: %srTfalseFzInvalid boolean: %s)rrboolrsrrrrrs r validate_boolr Os {#t c3  6<== yy{f$     '.455rcL[U[5(d[SU-5eU$)NzValue is not a dictionary: %s )rrdictrr s r validate_dictr_s% c4 83>?? Jrc[U[5(d [US5nO [U5nUS:a[SU-5eU$)NrzValue must be positive: %s)rrrrr s rvalidate_pos_intresB c3  #qk#h Qw5;<< JrclU[R:wa[RR S5 U$)NzXWarning: option `ssl_version` is deprecated and it is ignored. Use ssl_context instead. ) SSLVersionr]r'stderrwriter s rvalidate_ssl_versionrps( j    tu JrcpUcg[U[5(d[SU-5eUR5$)NzNot a string: %s)rrrsrrr s rvalidate_stringrvs4 { c3  *S011 99;rcrUcg[RRU5(d[SU-5eU$)NzFile %s does not exists.)r$r%existsrr s rvalidate_file_existsr~s3 { 77>>#  3c9:: JrcU(d/$[U[5(aU/nUVs/sHn[U5PM sn$s snfr1)rrrsrrr7s rvalidate_list_stringrs=  #se(+ ,1OA  ,, ,s>cV[U5Vs/sHn[U5PM sn$s snfr1)rrrs rvalidate_list_of_existing_filesr!s'-A#-F G-F  #-F GG Gs&cj[U5nUH!nUS:XaM [R"U5nM# U$)Nr`)validate_string_to_list ipaddress ip_address)raddr_vaid_ips rvalidate_string_to_addr_listr(s7 !# &C 3; ''- Jrc[U5nU(d/$URS5Vs/sHo(dM UR5PM sn$s snf)N,)rrVrrs rr#r#s> # C  "yy~ 3~!IAGGI~ 33 3s A A c[R"U5(d"U5(aU"5n[R"U5(aU$[ U5$r1)inspect isfunctionismethodisclassrr s rvalidate_classr0sI#'"2"23"7"7es 3 rc^U4SjnU$)Nc>[U[5(a+URSS5up[ X/S9n[ X25n[U5(d[ SU-5eTS :wa(T[R"U5:wa[ S T-5eU$![a [ SU-5ef=f![an[ [U55eSnAf[a [ SU<SU<S35ef=f) N.rzFValue '%s' is not import string. Format: module[.submodules...].object)fromlistzCan not load 'z' from ''zValue is not callable: %szValue must have an arity of: %s) rrrsrsplitrr __import__getattr ImportErrorrGr=r get_arity)rmod_nameobj_namemodraritys r_validate_callable-validate_callable.._validate_callables c3   O%(ZZQ%7" ; J?c, }}7#=> > B;5DNN3$77=EF F  O!HJM!NOO O  (A''! ;&.!:;; ;s"BB,B), C,6C  "C,r)r?r@s` rvalidate_callablerBs( rcUc[R"5$[U[5(aU$UR 5(a [U5$[ R "U5R$![a [SU-5ef=f)NzNo such user: '%s') r$geteuidrrrisdigitpwdgetpwnampw_uidKeyErrorrr s r validate_userrJss {zz|#s 3x :<<$++ + :2S89 9 : A11B cUc[R"5$[U[5(aU$UR 5(a [U5$[ R "U5R$![a [SU-5ef=f)NzNo such group: '%s') r$getegidrrrrEgrpgetgrnamgr_gidrIrr s rvalidate_grouprQss {zz|#s 3x ;<<$++ + ;3c9: : ;rKc^[S5"T5m[R"T5nUS:XaT$US:XaU4Sj$US:XaU4Sj$[S5e)Nr6c>T"XU5$r1r)workerreqr_rrs r'validate_post_request..s CS,Arc>T"X5$r1r)rVrW_erXrs rrYrZs 3v+;rzValue must have an arity of: 4)rBrr;r)rlargss` rvalidate_post_requestr_sR B  $C NN3 E z !AA !;;899rcZ[U5n[RR[RR [RR [ R"5U555n[RRU5(d[SU-5eU$)Nzcan't chdir to %r) rr$r%abspathnormpathrArgetcwdrr)rr%s rvalidate_chdirrdso # C 77??277++BGGLL,LM ND 77>>$  -344 Krc[U5nUcg[R"SU5nU(aS[UR S554$[ R "USS9nU$![a [S5ef=f)Nz ^unix:(\d+)$unixr8125) default_portz1Value must be one of ('host:port', 'unix://PATH')) rrrrrrrrr)runix_hostname_regressionrs rvalidate_statsd_addressrjs # C { "xx=4::1=>??M$$Sv> N MKLLMs A""A8c6U[;a[SU-5eU$)NzInvalid reload_engine: %r)rrr s rvalidate_reload_enginerls! ""5;<< Jrc[RR[RR[R"55S5n[RR U5(aU$g)Nzgunicorn.conf.py)r$r%rArarcr) config_paths rget_default_config_filerosH'',,rwwryy{;13K ww~~k"" rc4\rSrSrSrSrSS/rSr\r Sr Sr S r g ) ConfigFilei&config Config Filez-cz--configCONFIGz./gunicorn.conf.pya :ref:`The Gunicorn config file`. A string of the form ``PATH``, ``file:PATH``, or ``python:MODULE_NAME``. Only has an effect when specified on the command line or as part of an application specific configuration. By default, a file named ``gunicorn.conf.py`` will be read from the same directory where gunicorn is being run. .. versionchanged:: 19.4 Loading the config from a Python module requires the ``python:`` prefix. rN rvrr?rr rrrrrr]rrrrrrqrq&s, DG  C DI"G Drrqc,\rSrSrSrSrSr\rSr Sr Sr g)WSGIAppi>wsgi_apprsSTRINGNzz A WSGI application path in pattern ``$(MODULE_NAME):$(VARIABLE_NAME)``. .. versionadded:: 20.1.0 r rvrr?rr rrrrr]rrrrrrwrw>s" DG DIG Drrwc\rSrSrSrSrSrSS/rSr\ r S\ R;a,S R\ RRS55/rOS /rS rS rg )BindiKrr@ Server Socketz-bz--bindADDRESSPORTz 0.0.0.0:{0}z127.0.0.1:8000an The socket to bind. A string of the form: ``HOST``, ``HOST:PORT``, ``unix:PATH``, ``fd://FD``. An IP is a valid ``HOST``. .. versionchanged:: 20.0 Support for ``fd://FD`` got added. Multiple addresses can be bound. ex.:: $ gunicorn -b 127.0.0.1:8000 -b [::1]:8000 test:app will bind the `test:app` application on localhost both on ipv6 and ipv4 interfaces. If the ``PORT`` environment variable is defined, the default is ``['0.0.0.0:$PORT']``. If it is not defined, the default is ``['127.0.0.1:8000']``. rN)rvrr?rr r\rrrrrr$r*r>rHr]rrrrrr|r|Ks` D FG  C D$I  '' v(>?@#$ Drr|c6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) Backloginbacklogr}z --backlogINTia{ The maximum number of pending connections. This refers to the number of clients that can be waiting to be served. Exceeding this number results in the client getting an error when attempting to connect. It should only affect servers under significant load. Must be a positive integer. Generally set in the 64-2048 range. rNrvrr?rr rrrrrrrr]rrrrrrrns. DG -C D I DG Drrcx\rSrSrSrSrSS/rSr\r \ r \ "\ RRSS55rS rS rg ) WorkersiworkersWorker Processesz-wz --workersrWEB_CONCURRENCYra The number of worker processes for handling requests. A positive integer generally in the ``2-4 x $(NUM_CORES)`` range. You'll want to vary this a bit to find the best for your particular application's work load. By default, the value of the ``WEB_CONCURRENCY`` environment variable, which is set by some Platform-as-a-Service providers such as Heroku. If it is not defined, the default is ``1``. rN)rvrr?rr rrrrrrrr$r*rHr]rrrrrrrsF D G  C D I D"**..!2A67G Drrc4\rSrSrSrSrSS/rSr\r Sr Sr S r g ) WorkerClassirnrz-kz--worker-classryrpa The type of workers to use. The default class (``sync``) should handle most "normal" types of workloads. You'll want to read :doc:`design` for information on when you might want to choose one of the other worker classes. Required libraries may be installed using setuptools' ``extras_require`` feature. A string referring to one of the following bundled classes: * ``sync`` * ``eventlet`` - Requires eventlet >= 0.24.1 (or install it via ``pip install gunicorn[eventlet]``) * ``gevent`` - Requires gevent >= 1.4 (or install it via ``pip install gunicorn[gevent]``) * ``tornado`` - Requires tornado >= 0.2 (or install it via ``pip install gunicorn[tornado]``) * ``gthread`` - Python 2 requires the futures package to be installed (or install it via ``pip install gunicorn[gthread]``) Optionally, you can provide your own worker by giving Gunicorn a Python path to a subclass of ``gunicorn.workers.base.Worker``. This alternative syntax will load the gevent class: ``gunicorn.workers.ggevent.GeventWorker``. rN rvrr?rr rrrr0rr]rrrrrrrs- D G ! "C DIG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) WorkerThreadsirurz --threadsrram The number of worker threads for handling requests. Run each worker with the specified number of threads. A positive integer generally in the ``2-4 x $(NUM_CORES)`` range. You'll want to vary this a bit to find the best for your particular application's work load. If it is not defined, the default is ``1``. This setting only affects the Gthread worker type. .. note:: If you try to use the ``sync`` worker type and set the ``threads`` setting to more than 1, the ``gthread`` worker type will be used instead. rNrrrrrrs. D G -C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) WorkerConnectionsiworker_connectionsrz--worker-connectionsriz The maximum number of simultaneous clients. This setting only affects the ``gthread``, ``eventlet`` and ``gevent`` worker types. rNrrrrrrs/ D G ! "C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) MaxRequestsi max_requestsrz--max-requestsrra The maximum number of requests a worker will process before restarting. Any value greater than zero will limit the number of requests a worker will process before automatically restarting. This is a simple method to help limit the damage of memory leaks. If this is set to zero (the default) then the automatic worker restarts are disabled. rNrrrrrrs/ D G  C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) MaxRequestsJitterimax_requests_jitterrz--max-requests-jitterrraB The maximum jitter to add to the *max_requests* setting. The jitter causes the restart per worker to be randomized by ``randint(0, max_requests_jitter)``. This is intended to stagger worker restarts to avoid all workers restarting at the same time. .. versionadded:: 19.2 rNrrrrrrs/ D G " #C D I DG Drrc8\rSrSrSrSrSS/rSr\r \ r Sr Sr S rg ) Timeouti timeoutrz-tz --timeoutraH Workers silent for more than this many seconds are killed and restarted. Value is a positive number or 0. Setting it to 0 has the effect of infinite timeouts by disabling timeouts for all workers entirely. Generally, the default of thirty seconds should suffice. Only set this noticeably higher if you're sure of the repercussions for sync workers. For the non sync workers it just means that the worker process is still communicating and is not tied to the length of time required to handle a single request. rNrrrrrr s1 D G  C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) GracefulTimeouti!graceful_timeoutrz--graceful-timeoutrra Timeout for graceful workers restart. After receiving a restart signal, workers have this much time to finish serving requests. Workers still alive after the timeout (starting from the receipt of the restart signal) are force killed. rNrrrrrr!s/ D G  C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) Keepalivei2 keepaliverz --keep-aliverr[a The number of seconds to wait for requests on a Keep-Alive connection. Generally set in the 1-5 seconds range for servers with direct connection to the client (e.g. when you don't have separate load balancer). When Gunicorn is deployed behind a load balancer, it often makes sense to set this to a higher value. .. note:: ``sync`` worker does not support persistent connections and will ignore this option. rNrrrrrr2s/ D G  C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) LimitRequestLineiHlimit_request_lineSecurityz--limit-request-lineria The maximum size of HTTP request line in bytes. This parameter is used to limit the allowed size of a client's HTTP request-line. Since the request-line consists of the HTTP method, URI, and protocol version, this directive places a restriction on the length of a request-URI allowed for a request on the server. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the query part of a GET request. Value is a number from 0 (unlimited) to 8190. This parameter can be used to prevent any DDOS attack. rNrrrrrrHs/ DG ! "C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) LimitRequestFieldsi`limit_request_fieldsrz--limit-request-fieldsrda? Limit the number of HTTP headers fields in a request. This parameter is used to limit the number of headers in a request to prevent DDOS attack. Used with the *limit_request_field_size* it allows more safety. By default this value is 100 and can't be larger than 32768. rNrrrrrr`s/ !DG # $C D I DG Drrc6\rSrSrSrSrS/rSr\r \ r Sr Sr Srg ) LimitRequestFieldSizeirlimit_request_field_sizerz--limit-request-field_sizeria6 Limit the allowed size of an HTTP request header field. Value is a positive number or 0. Setting it to 0 will allow unlimited header field sizes. .. warning:: Setting this parameter to a very high or unlimited value can open up for DDOS attacks. rNrrrrrrrs/ %DG ' (C D I DG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) Reloadireload Debuggingz--reload store_trueFa Restart workers when code changes. This setting is intended for development. It will cause workers to be restarted whenever application code changes. The reloader is incompatible with application preloading. When using a paste configuration be sure that the server block does not import any application code or the reload will not work as designed. The default behavior is to attempt inotify with a fallback to file system polling. Generally, inotify should be preferred if available because it consumes less system resources. .. note:: In order to use the inotify reloader, you must have the ``inotify`` package installed. rN rvrr?rr rrr rr\r]rrrrrrrs) DG ,CI FG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g ) ReloadEnginei reload_enginerz--reload-engineryautoz The implementation that should be used to power :ref:`reload`. Valid engines are: * ``'auto'`` * ``'poll'`` * ``'inotify'`` (requires inotify) .. versionadded:: 19.7 rN) rvrr?rr rrrrlrr]rrrrrrrs* DG  C D&IG Drrc6\rSrSrSrSrSrS/rSr\ r /r Sr Sr g ) ReloadExtraFilesireload_extra_filesr@rz--reload-extra-fileFILESz Extends :ref:`reload` option to also watch and reload on additional files (e.g., templates, configurations, specifications, etc.). .. versionadded:: 19.8 rN)rvrr?rr r\rrrr!rr]rrrrrrrs/ D FG !C D/IG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) Spewispewrz--spewrFz| Install a trace function that spews every line executed by the server. This is the nuclear option. rNrrrrrrs) DG *CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) ConfigChecki check_configrz--check-configrFz Check the configuration and exit. The exit status is 0 if the configuration is correct, and 1 if the configuration is incorrect. rNrrrrrrs* DG  CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) PrintConfigi print_configrz--print-configrFza Print the configuration settings as fully resolved. Implies :ref:`check-config`. rNrrrrrrs* DG  CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) PreloadAppi preload_appServer Mechanicsz --preloadrFaY Load application code before the worker processes are forked. By preloading an application you can save some RAM resources as well as speed up server boot times. Although, if you defer application loading to each worker process, you can reload your application code easily by restarting workers. rNrrrrrrs) D G -CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) Sendfileirrz --no-sendfile store_constFa Disables the use of ``sendfile()``. If not set, the value of the ``SENDFILE`` environment variable is used to enable or disable its usage. .. versionadded:: 19.2 .. versionchanged:: 19.4 Swapped ``--sendfile`` with ``--no-sendfile`` to actually allow disabling. .. versionchanged:: 19.6 added support for the ``SENDFILE`` environment variable rN) rvrr?rr rrr rr\rrrrrrrrs* D G  CI F E Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) ReusePortirrz --reuse-portrFzg Set the ``SO_REUSEPORT`` flag on the listening socket. .. versionadded:: 19.8 rNrrrrrrs* D G  CI FG DrrcP\rSrSrSrSrS/r\r\ R"5r Sr Sr Srg) Chdiri$chdirrz--chdirz``'.'``zM Change directory to specified directory before loading apps. rN)rvrr?rr rrrdrrrcr] default_docrrrrrrr$s/ D G +CIkkmGK Drrc4\rSrSrSrSrSS/r\rSr Sr Sr S r g ) Daemoni0daemonrz-Dz--daemonrFz Daemonize the Gunicorn process. Detaches the server from the controlling terminal and enters the background. rNrrrrrr0s, D G  CI FG Drrc8\rSrSrSrSrSrSS/rSr\ r /r Sr S r g ) Envi?rr@rz-ez--envENVa| Set environment variables in the execution environment. Should be a list of strings in the ``key=value`` format. For example on the command line: .. code-block:: console $ gunicorn -b 127.0.0.1:8000 --env FOO=1 test:app Or in the configuration file: .. code-block:: python raw_env = ["FOO=1"] rNrvrr?rr r\rrrrrr]rrrrrrr?s0 D F G /C D$IG Drrc4\rSrSrSrSrSS/rSr\r Sr Sr S r g) Pidfilei[pidfilerz-pz--pidFILENzf A filename to use for the PID file. If not set, no PID file will be written. rrurrrrr[s+ D G /C DIG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) WorkerTmpDiriiworker_tmp_dirrz--worker-tmp-dirDIRNa A directory to use for the worker heartbeat temporary file. If not set, the default temporary directory will be used. .. note:: The current heartbeat system involves calling ``os.fchmod`` on temporary file handlers and may block a worker for arbitrary time if the directory is on a disk-backed filesystem. See :ref:`blocking-os-fchmod` for more detailed information and a solution for avoiding this problem. rrurrrrris* D G  C DIG DrrcV\rSrSrSrSrSS/rSr\r \ R"5r Sr SrS rg ) Userirrz-uz--userUSERz``os.geteuid()``z Switch worker processes to run as this user. A valid user id (as an integer) or the name of a user that can be retrieved with a call to ``pwd.getpwnam(value)`` or ``None`` to not change the worker process user. rN)rvrr?rr rrrrJrr$rDr]rrrrrrrrs7 D G  C DIjjlG$K DrrcV\rSrSrSrSrSS/rSr\r \ R"5r Sr SrS rg ) Groupirrz-gz--groupGROUPz``os.getegid()``z Switch worker process to run as this group. A valid group id (as an integer) or the name of a user that can be retrieved with a call to ``pwd.getgrnam(value)`` or ``None`` to not change the worker processes group. rN)rvrr?rr rrrrQrr$rMr]rrrrrrrrs7 D G  C DIjjlG$K Drrc8\rSrSrSrSrSS/rSr\r \ r Sr Sr S rg ) Umaskiumaskrz-mz--umaskrra A bit mask for the file mode on files written by Gunicorn. Note that this affects unix socket permissions. A valid value for the ``os.umask(mode)`` call or a string compatible with ``int(value, 0)`` (``0`` means Python guesses the base, so values like ``0``, ``0xFF``, ``0022`` are valid for decimal, hex, and octal representations) rN)rvrr?rr rrrrrrrr]rrrrrrrs1 D G  C D I DG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) Initgroupsi initgroupsrz --initgroupsrFz If true, set the worker process's group access list with all of the groups of which the specified username is a member, plus the specified group id. .. versionadded:: 19.7 rNrrrrrrs* D G  CI FG Drrc,\rSrSrSrSrSr\rSr Sr Sr g) TmpUploadDiritmp_upload_dirrrNa6 Directory to store temporary request data as they are read. This may disappear in the near future. This path should be writable by the process permissions set for Gunicorn workers. If not specified, Gunicorn will choose a system generated temporary directory. rrzrrrrrs" D G DIG Drrc0\rSrSrSrSr\rSSSS.rSr S r g ) SecureSchemeHeaderisecure_scheme_headersrsslhttpson)zX-FORWARDED-PROTOCOLzX-FORWARDED-PROTOzX-FORWARDED-SSLa~ A dictionary containing headers and values that the front-end proxy uses to indicate HTTPS requests. If the source IP is permitted by :ref:`forwarded-allow-ips` (below), *and* at least one request header matches a key-value pair listed in this dictionary, then Gunicorn will set ``wsgi.url_scheme`` to ``https``, so your application can tell that the request is secure. If the other headers listed in this dictionary are not present in the request, they will be ignored, but if the other headers are present and do not match the provided values, then the request will fail to parse. See the note below for more detailed examples of this behaviour. The dictionary should map upper-case header names to exact string values. The value comparisons are case-sensitive, unlike the header names, so make sure they're exactly what your front-end proxy sends when handling HTTPS requests. It is important that your front-end proxy configuration ensures that the headers defined here can not be passed directly from the client. rN rvrr?rr rrrr]rrrrrrrs( "D GI %$G  Drrcf\rSrSrSrSrS/rSr\r \ RRSS5r SrS rg ) ForwardedAllowIPSiforwarded_allow_ipsrz--forwarded-allow-ipsryFORWARDED_ALLOW_IPS 127.0.0.1,::1a Front-end's IPs from which allowed to handle set secure headers. (comma separated). Set to ``*`` to disable checking of front-end IPs. This is useful for setups where you don't know in advance the IP address of front-end, but instead have ensured via other means that only your authorized front-ends can access Gunicorn. By default, the value of the ``FORWARDED_ALLOW_IPS`` environment variable. If it is not defined, the default is ``"127.0.0.1,::1"``. .. note:: This option does not affect UNIX socket connections. Connections not associated with an IP address are treated as allowed, unconditionally. .. note:: The interplay between the request headers, the value of ``forwarded_allow_ips``, and the value of ``secure_scheme_headers`` is complex. Various scenarios are documented below to further elaborate. In each case, we have a request from the remote address 134.213.44.18, and the default value of ``secure_scheme_headers``: .. code:: secure_scheme_headers = { 'X-FORWARDED-PROTOCOL': 'ssl', 'X-FORWARDED-PROTO': 'https', 'X-FORWARDED-SSL': 'on' } .. list-table:: :header-rows: 1 :align: center :widths: auto * - ``forwarded-allow-ips`` - Secure Request Headers - Result - Explanation * - .. code:: ["127.0.0.1"] - .. code:: X-Forwarded-Proto: https - .. code:: wsgi.url_scheme = "http" - IP address was not allowed * - .. code:: "*" - - .. code:: wsgi.url_scheme = "http" - IP address allowed, but no secure headers provided * - .. code:: "*" - .. code:: X-Forwarded-Proto: https - .. code:: wsgi.url_scheme = "https" - IP address allowed, one request header matched * - .. code:: ["134.213.44.18"] - .. code:: X-Forwarded-Ssl: on X-Forwarded-Proto: http - ``InvalidSchemeHeaders()`` raised - IP address allowed, but the two secure headers disagreed on if HTTPS was used rN)rvrr?rr rrrr(rr$r*rHr]rrrrrrrs; D G " #C D,Ijjnn2ODGQ Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) AccessLogiR accesslogLoggingz--access-logfilerNzW The Access log file to write to. ``'-'`` means log to stdout. rrurrrrrRs* DG  C DIG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) DisableRedirectAccessToSyslogi`!disable_redirect_access_to_syslogrz#--disable-redirect-access-to-syslogrFzL Disable redirect access logs to syslog. .. versionadded:: 19.8 rNrrrrrr`s* .DG 0 1CI FG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g ) AccessLogFormatinaccess_log_formatrz--access-logformatryz;%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"a The access log format. =========== =========== Identifier Description =========== =========== h remote address l ``'-'`` u user name (if HTTP Basic auth used) t date of the request r status line (e.g. ``GET / HTTP/1.1``) m request method U URL path without query string q query string H protocol s status B response length b response length or ``'-'`` (CLF format) f referrer (note: header is ``referer``) a user agent T request time in seconds M request time in milliseconds D request time in microseconds L request time in decimal seconds p process ID {header}i request header {header}o response header {variable}e environment variable =========== =========== Use lowercase for header and environment variable names, and put ``{...}x`` names inside ``%(...)s``. For example:: %({x-forwarded-for}i)s rNrurrrrrns* DG  C DIKG" Drrc4\rSrSrSrSrSS/rSr\r Sr Sr S r g ) ErrorLogierrorlogrz--error-logfilez --log-filer-z The Error log file to write to. Using ``'-'`` for FILE makes gunicorn log to stderr. .. versionchanged:: 19.2 Log to stderr by default. rNrurrrrrs, DG l +C DIG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g ) Logleveliloglevelrz --log-levelLEVELinfoz The granularity of Error log outputs. Valid level names are: * ``'debug'`` * ``'info'`` * ``'warning'`` * ``'error'`` * ``'critical'`` rNrurrrr r s) DG /C DIG Drr c2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) CaptureOutputicapture_outputrz--capture-outputrFzm Redirect stdout/stderr to specified file in :ref:`errorlog`. .. versionadded:: 19.6 rNrrrrrrs* DG  CI FG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g ) rirrz--logger-classryraa The logger you want to use to log events in Gunicorn. The default class (``gunicorn.glogging.Logger``) handles most normal usages in logging. It provides error and access logging. You can provide your own logger by giving Gunicorn a Python path to a class that quacks like ``gunicorn.glogging.Logger``. rNrrrrrrs* DG  C DI(G Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) LogConfigi logconfigrz --log-configrNzz The log config file to use. Gunicorn uses the standard Python logging module's Configuration file format. rrurrrrrs* DG  C DIG Drrc(\rSrSrSrSr\r0rSr Sr g) LogConfigDictilogconfig_dictra8 The log config dictionary to use, using the standard Python logging module's dictionary configuration format. This option takes precedence over the :ref:`logconfig` and :ref:`logconfig-json` options, which uses the older file configuration format and JSON respectively. Format: https://docs.python.org/3/library/logging.config.html#logging.config.dictConfig For more context you can look at the default configuration dictionary for logging, which can be found at ``gunicorn.glogging.CONFIG_DEFAULTS``. .. versionadded:: 19.8 rNrrrrrrs DGIG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) LogConfigJsonilogconfig_jsonrz--log-config-jsonrNz The log config to read config from a JSON file Format: https://docs.python.org/3/library/logging.config.html#logging.config.jsonConfig .. versionadded:: 20.0 rrurrrrrs* DG  C DIG Drrch\rSrSrSrSrS/rSr\r \ S:XaSr O\ S;aS r O \ S :XaS r OS r S r Sr g)SyslogToi syslog_addrrz--log-syslog-to SYSLOG_ADDRdarwinzunix:///var/run/syslog)freebsd dragonflyzunix:///var/run/logopenbsdzunix:///dev/logzudp://localhost:514aY Address to send syslog messages. Address is a string of the form: * ``unix://PATH#TYPE`` : for unix domain socket. ``TYPE`` can be ``stream`` for the stream driver or ``dgram`` for the dgram driver. ``stream`` is the default. * ``udp://HOST:PORT`` : for UDP sockets * ``tcp://HOST:PORT`` : for TCP sockets rN)rvrr?rr rrrrrPLATFORMr]rrrrrrrsR DG  C DI8* / /' Y #' Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) Syslogi1syslogrz --log-syslogrFz Send *Gunicorn* logs to syslog. .. versionchanged:: 19.8 You can now disable sending access logs by using the :ref:`disable-redirect-access-to-syslog` setting. rNrrrrr%r%1s* DG  CI FG Drr%c2\rSrSrSrSrS/rSr\r Sr Sr Sr g) SyslogPrefixiA syslog_prefixrz--log-syslog-prefix SYSLOG_PREFIXNz Makes Gunicorn use the parameter as program-name in the syslog entries. All entries will be prefixed by ``gunicorn.``. By default the program name is the name of the process. rrurrrr(r(As* DG !C DIG Drr(c2\rSrSrSrSrS/rSr\r Sr Sr Sr g ) SyslogFacilityiPsyslog_facilityrz--log-syslog-facilitySYSLOG_FACILITYrz Syslog facility name rNrurrrr,r,Ps* DG " #C DIG Drr,c4\rSrSrSrSrSS/r\rSr Sr Sr S r g ) EnableStdioInheritancei\enable_stdio_inheritancerz-Rz--enable-stdio-inheritanceFrz Enable stdio inheritance. Enable inheritance for stdio file descriptors in daemon mode. Note: To disable the Python stdout buffering, you can to set the user environment variable ``PYTHONUNBUFFERED`` . rN rvrr?rr rrr rr]r\rrrrrr0r0\s- %DG - .CIG F Drr0c2\rSrSrSrSrS/rSrSr\ r Sr Sr g) StatsdHostinrrz --statsd-host STATSD_ADDRNz The address of the StatsD server to log to. Address is a string of the form: * ``unix://PATH`` : for a unix domain socket. * ``HOST:PORT`` : for a network address .. versionadded:: 19.1 r) rvrr?rr rrrr]rjrrrrrrr4r4ns* DG  C DG'I Drr4c2\rSrSrSrSrS/rSrSr\ r Sr Sr g ) DogstatsdTagsidogstatsd_tagsrz--dogstatsd-tagsDOGSTATSD_TAGSrz} A comma-delimited list of datadog statsd (dogstatsd) tags to append to statsd metrics. .. versionadded:: 20 rN rvrr?rr rrrr]rrrrrrrr7r7s* DG  C DGI Drr7c2\rSrSrSrSrS/rSrSr\ r Sr Sr g ) StatsdPrefixi statsd_prefixrz--statsd-prefix STATSD_PREFIXrz Prefix to use when emitting statsd metrics (a trailing ``.`` is added, if not provided). .. versionadded:: 19.2 rNr:rrrr<r<s* DG  C DGI Drr<c4\rSrSrSrSrSS/rSr\r Sr Sr S r g) ProcnameirProcess Namingz-nz--nameryNa A base to use with setproctitle for process naming. This affects things like ``ps`` and ``top``. If you're going to be running more than one instance of Gunicorn you'll probably want to set a name to tell them apart. This requires that you install the setproctitle module. If not set, the *default_proc_name* setting will be used. rrurrrr@r@s, DG  C DIG Drr@c(\rSrSrSrSr\rSrSr Sr g)DefaultProcNameirrAgunicornzP Internal setting that is adjusted for each type of application. rN) rvrr?rr rrrr]rrrrrrCrCs DGIG DrrCc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) PythonPathi pythonpathrz --pythonpathryNz A comma-separated list of directories to add to the Python path. e.g. ``'/home/djangoprojects/myproject,/home/python/mylibrary'``. rrurrrrFrFs* D G  C DIG DrrFc4\rSrSrSrSrSS/rSr\r Sr Sr S r g) Pasteipasterz--pastez--pasterryNa[ Load a PasteDeploy config file. The argument may contain a ``#`` symbol followed by the name of an app section from the config file, e.g. ``production.ini#admin``. At this time, using alternate server blocks is not supported. Use the command line arguments to control server configuration instead. rrurrrrIrIs, D G j !C DIG DrrIcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) OnStartingi on_starting Server Hooksrcgr1rservers rrMOnStarting.on_starting rz Called just before the master process is initialized. The callable needs to accept a single instance variable for the Arbiter. rN)rvrr?rr rrBrr=rrMrr]rrrrrrLrLs1 DG!!$I D ;'G DrrLcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) OnReloadi on_reloadrNrcgr1rrPs rrVOnReload.on_reloadrSrz Called to recycle workers during a reload via SIGHUP. The callable needs to accept a single instance variable for the Arbiter. rN)rvrr?rr rrBrr=rrVrr]rrrrrrUrUs1 DG!!$I D 9%G DrrUcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) WhenReadyi when_readyrNrcgr1rrPs rr[WhenReady.when_readyrSrz Called just after the server is started. The callable needs to accept a single instance variable for the Arbiter. rN)rvrr?rr rrBrr=rr[rr]rrrrrrZrZs1 DG!!$I D :&G DrrZcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) Preforki pre_forkrNr[cgr1rrQrVs rr`Prefork.pre_forkrSrz Called just before a worker is forked. The callable needs to accept two instance variables for the Arbiter and new Worker. rN)rvrr?rr rrBrr=rr`rr]rrrrrr_r_ s1 DG!!$I D 8$G Drr_cJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) Postforki post_forkrNr[cgr1rrbs rrfPostfork.post_fork$rSrz Called just after a worker has been forked. The callable needs to accept two instance variables for the Arbiter and new Worker. rN)rvrr?rr rrBrr=rrfrr]rrrrrreres1 DG!!$I D 9%G DrrecJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) PostWorkerIniti/post_worker_initrNrcgr1rrVs rrkPostWorkerInit.post_worker_init5rSrz Called just after a worker has initialized the application. The callable needs to accept one instance variable for the initialized Worker. rN)rvrr?rr rrBrr=rrkrr]rrrrrrjrj/s4 DG!!$I D +,G DrrjcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) WorkerIntiA worker_intrNrcgr1rrms rrqWorkerInt.worker_intGrSrz Called just after a worker exited on SIGINT or SIGQUIT. The callable needs to accept one instance variable for the initialized Worker. rN)rvrr?rr rrBrr=rrqrr]rrrrrrprpAs3 DG!!$I D :&G DrrpcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) WorkerAbortiS worker_abortrNrcgr1rrms rrvWorkerAbort.worker_abortYrSrz Called when a worker received the SIGABRT signal. This call generally happens on timeout. The callable needs to accept one instance variable for the initialized Worker. rN)rvrr?rr rrBrr=rrvrr]rrrrrruruSs3 DG!!$I D <(G DrrucJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) PreExecigpre_execrNrcgr1rrPs rr{PreExec.pre_execmrSrz Called just before a new master process is forked. The callable needs to accept a single instance variable for the Arbiter. rN)rvrr?rr rrBrr=rr{rr]rrrrrrzrzgs1 DG!!$I D 8$G DrrzcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) PreRequestiw pre_requestrNr[cfURRSURUR5 g)Nz%s %s)logdebugmethodr%)rVrWs rrPreRequest.pre_request}s  #**chh7rz Called just before a worker processes the request. The callable needs to accept two instance variables for the Worker and the Request. rN)rvrr?rr rrBrr=rrrr]rrrrrrrws1 DG!!$I D8;'G Drrc>\rSrSrSrSr\r\r Sr \ "\ 5r Sr Srg) PostRequesti post_requestrNcgr1r)rVrWr*resps rrPostRequest.post_requestrSrz Called after a worker processes the request. The callable needs to accept two instance variables for the Worker and the Request. rN)rvrr?rr rr_rr=rrrr]rrrrrrrs, DG%I D <(G DrrcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) ChildExiti child_exitrNr[cgr1rrbs rrChildExit.child_exitrSrz Called just after a worker has been exited, in the master process. The callable needs to accept two instance variables for the Arbiter and the just-exited Worker. .. versionadded:: 19.7 rN)rvrr?rr rrBrr=rrrr]rrrrrrrs1 DG!!$I D :&G DrrcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) WorkerExiti worker_exitrNr[cgr1rrbs rrWorkerExit.worker_exitrSrz Called just after a worker has been exited, in the worker process. The callable needs to accept two instance variables for the Arbiter and the just-exited Worker. rN)rvrr?rr rrBrr=rrrr]rrrrrrrs1 DG!!$I D ;'G DrrcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) NumWorkersChangedinworkers_changedrNrTcgr1r)rQ new_value old_values rr"NumWorkersChanged.nworkers_changedrSra7 Called just after *num_workers* has been changed. The callable needs to accept an instance variable of the Arbiter and two integers of number of workers after and before change. If the number of workers is set for the first time, *old_value* would be ``None``. rN)rvrr?rr rrBrr=rrrr]rrrrrrrs2 DG!!$I D +,G DrrcF\rSrSrSrSr\"S5rSr\ "\5r Sr Sr g) OnExition_exitrNrcgr1rrPs rrOnExit.on_exitrSrz Called just before exiting Gunicorn. The callable needs to accept a single instance variable for the Arbiter. rN) rvrr?rr rrBrrrr]rrrrrrrs. DG!!$I 7#G DrrcJ\rSrSrSrSr\"S5r\r Sr \ "\ 5r Sr Srg) NewSSLContexti ssl_contextrNr[cU"5$r1r)rrdefault_ssl_context_factorys rrNewSSLContext.ssl_contexts *,,raO Called when SSLContext is needed. Allows customizing SSL context. The callable needs to accept an instance variable for the Config and a factory function that returns default SSLContext which is initialized with certificates, private key, cert_reqs, and ciphers according to config and can be further customized by the callable. The callable needs to return SSLContext object. Following example shows a configuration file that sets the minimum TLS version to 1.3: .. code-block:: python def ssl_context(conf, default_ssl_context_factory): import ssl context = default_ssl_context_factory() context.minimum_version = ssl.TLSVersion.TLSv1_3 return context .. versionadded:: 21.0 rN)rvrr?rr rrBrr=rrrr]rrrrrrrs3 DG!!$I D-;'G Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) ProxyProtocoliproxy_protocolrz--proxy-protocolFra Enable detect PROXY protocol (PROXY mode). Allow using HTTP and Proxy together. It may be useful for work with stunnel as HTTPS frontend and Gunicorn as HTTP server. PROXY protocol: http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt Example for stunnel config:: [https] protocol = proxy accept = 443 connect = 80 cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.key rNr2rrrrrs* D G  CIG F Drrc.\rSrSrSrSrS/r\rSr Sr Sr g) ProxyAllowFromiproxy_allow_ipsrz--proxy-allow-fromra" Front-end's IPs from which allowed accept proxy requests (comma separated). Set to ``*`` to disable checking of front-end IPs. This is useful for setups where you don't know in advance the IP address of front-end, but instead have ensured via other means that only your authorized front-ends can access Gunicorn. .. note:: This option does not affect UNIX socket connections. Connections not associated with an IP address are treated as allowed, unconditionally. rN) rvrr?rr rrr(rr]rrrrrrrs% D G  C,IG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) KeyFilei3rrz --keyfilerNz SSL key file rrurrrrr3s) DG -C DIG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) CertFilei?rrz --certfilerNz SSL certificate file rrurrrrr?) DG .C DIG Drrc\rSrSrSrSrS/r\r\ "\ S5(a \ Rr O \ Rr \ Rr SrSrg) riK ssl_versionrz --ssl-version PROTOCOL_TLSa SSL version to use (see stdlib ssl module's). .. deprecated:: 21.0 The option is deprecated and it is currently ignored. Use :ref:`ssl-context` instead. ============= ============ --ssl-version Description ============= ============ SSLv3 SSLv3 is not-secure and is strongly discouraged. SSLv23 Alias for TLS. Deprecated in Python 3.6, use TLS. TLS Negotiate highest possible version between client/server. Can yield SSL. (Python 3.6+) TLSv1 TLS 1.0 TLSv1_1 TLS 1.1 (Python 3.4+) TLSv1_2 TLS 1.2 (Python 3.4+) TLS_SERVER Auto-negotiate the highest protocol version like TLS, but only support server-side SSLSocket connections. (Python 3.6+) ============= ============ .. versionchanged:: 19.7 The default value has been changed from ``ssl.PROTOCOL_TLSv1`` to ``ssl.PROTOCOL_SSLv23``. .. versionchanged:: 20.0 This setting now accepts string names based on ``ssl.PROTOCOL_`` constants. .. versionchanged:: 20.0.1 The default value has been changed from ``ssl.PROTOCOL_SSLv23`` to ``ssl.PROTOCOL_TLS`` when Python >= 3.6 . rN)rvrr?rr rrrrr~rrr]PROTOCOL_SSLv23rrrrrrrKsN DG  C$IsN##""%%!!G DrrcB\rSrSrSrSrS/r\r\ Rr Sr Sr g)CertReqsix cert_reqsrz --cert-reqsa` Whether client certificate is required (see stdlib ssl module's) =========== =========================== --cert-reqs Description =========== =========================== `0` no client verification `1` ssl.CERT_OPTIONAL `2` ssl.CERT_REQUIRED =========== =========================== rN)rvrr?rr rrrrr CERT_NONEr]rrrrrrrxs( DG /C ImmG Drrc2\rSrSrSrSrS/rSr\r Sr Sr Sr g) CACertsica_certsrz --ca-certsrNz CA certificates file rrurrrrrrrrc2\rSrSrSrSrS/rSrSr\ r Sr Sr g ) SuppressRaggedEOFsisuppress_ragged_eofsrz--suppress-ragged-eofsrTz7 Suppress ragged EOFs (see stdlib ssl module's) rN) rvrr?rr rrr\r]r rrrrrrrrs* !DG # $C FGI Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) DoHandshakeOnConnectido_handshake_on_connectrz--do-handshake-on-connectrFzU Whether to perform SSL handshake on socket connect (see stdlib ssl module's) rNrrrrrrs* $DG & 'CI FG Drrc.\rSrSrSrSrS/r\rSr Sr Sr g)Ciphersiciphersrz --ciphersNa SSL Cipher suite to use, in the format of an OpenSSL cipher list. By default we use the default cipher list from Python's ``ssl`` module, which contains ciphers considered strong at the time of each Python release. As a recommended alternative, the Open Web App Security Project (OWASP) offers `a vetted set of strong cipher strings rated A+ to C- `_. OWASP provides details on user-agent compatibility at each security level. See the `OpenSSL Cipher List Format Documentation `_ for details on the format of an OpenSSL cipher list. r) rvrr?rr rrrrr]rrrrrrrs$ DG -CIG Drrc6\rSrSrSrSrSrS/rSr\ r /r Sr Sr g ) PasteGlobalConfirr@rz--paste-globalCONFa\ Set a PasteDeploy global config variable in ``key=value`` form. The option can be specified multiple times. The variables are passed to the PasteDeploy entrypoint. Example:: $ gunicorn -b 127.0.0.1:8000 --paste development.ini --paste-global FOO=1 --paste-global BAR=2 .. versionadded:: 19.7 rNrrrrrrs/ "D F G  C D$IG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) PermitObsoleteFoldingipermit_obsolete_foldingrz--permit-obsolete-foldingrFa  Permit requests employing obsolete HTTP line folding mechanism The folding mechanism was deprecated by rfc7230 Section 3.2.4 and will not be employed in HTTP request headers from standards-compliant HTTP clients. This option is provided to diagnose backwards-incompatible changes. Use with care and only if necessary. Temporary; the precise effect of this option may change in a future version, or it may be removed altogether. .. versionadded:: 23.0.0 rNrrrrrrs* $D G & 'CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) StripHeaderSpacesistrip_header_spacesrz--strip-header-spacesrFa Strip spaces present between the header name and the the ``:``. This is known to induce vulnerabilities and is not compliant with the HTTP/1.1 standard. See https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn. Use with care and only if necessary. Deprecated; scheduled for removal in 25.0.0 .. versionadded:: 20.0.1 rNrrrrrrs* D G " #CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) PermitUnconventionalHTTPMethodi !permit_unconventional_http_methodrz#--permit-unconventional-http-methodrFa Permit HTTP methods not matching conventions, such as IANA registration guidelines This permits request methods of length less than 3 or more than 20, methods with lowercase characters or methods containing the # character. HTTP methods are case sensitive by definition, and merely uppercase by convention. If unset, Gunicorn will apply nonstandard restrictions and cause 400 response status in cases where otherwise 501 status is expected. While this option does modify that behaviour, it should not be depended upon to guarantee standards-compliant behaviour. Rather, it is provided temporarily, to assist in diagnosing backwards-incompatible changes around the incomplete application of those restrictions. Use with care and only if necessary. Temporary; scheduled for removal in 24.0.0 .. versionadded:: 22.0.0 rNrrrrrr s* .D G 0 1CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) PermitUnconventionalHTTPVersioni "permit_unconventional_http_versionrz$--permit-unconventional-http-versionrFa Permit HTTP version not matching conventions of 2023 This disables the refusal of likely malformed request lines. It is unusual to specify HTTP 1 versions other than 1.0 and 1.1. This option is provided to diagnose backwards-incompatible changes. Use with care and only if necessary. Temporary; the precise effect of this option may change in a future version, or it may be removed altogether. .. versionadded:: 22.0.0 rNrrrrrr s* /D G 1 2CI FG Drrc2\rSrSrSrSrS/r\rSr Sr Sr Sr g ) CasefoldHTTPMethodi4 casefold_http_methodrz--casefold-http-methodrFa Transform received HTTP methods to uppercase HTTP methods are case sensitive by definition, and merely uppercase by convention. This option is provided because previous versions of gunicorn defaulted to this behaviour. Use with care and only if necessary. Deprecated; scheduled for removal in 24.0.0 .. versionadded:: 22.0.0 rNrrrrrr4 s* !D G # $CI FG Drrc>Ucg[U[5(d[SU-5eUR5R 5S:XagUR5R 5S:XagUR5R 5S:Xag[ SU-5e)Nr droprefuse dangerousz Invalid header map behaviour: %s)rrrsrrrrr s rvalidate_header_map_behaviourrH s { c3  6<== yy{f$     (     +;cABBrc.\rSrSrSrSrS/r\rSr Sr Sr g) ForwarderHeadersiZ forwarder_headersrz--forwarder-headerszSCRIPT_NAME,PATH_INFOa A list containing upper-case header field names that the front-end proxy (see :ref:`forwarded-allow-ips`) sets, to be used in WSGI environment. This option has no effect for headers not present in the request. This option can be used to transfer ``SCRIPT_NAME``, ``PATH_INFO`` and ``REMOTE_USER``. It is important that your front-end proxy configuration ensures that the headers defined here can not be passed directly from the client. rN) rvrr?rr rrr#rr]rrrrrrrZ s% D G !C'I%G Drrc.\rSrSrSrSrS/r\rSr Sr Sr g) HeaderMapio header_maprz --header-maprao Configure how header field names are mapped into environ Headers containing underscores are permitted by RFC9110, but gunicorn joining headers of different names into the same environment variable will dangerously confuse applications as to which is which. The safe default ``drop`` is to silently drop headers that cannot be unambiguously mapped. The value ``refuse`` will return an error if a request contains *any* such header. The value ``dangerous`` matches the previous, not advisable, behaviour of mapping different header field names into the same environ name. If the source is permitted as explained in :ref:`forwarded-allow-ips`, *and* the header name is present in :ref:`forwarder-headers`, the header is mapped into environment regardless of the state of this setting. Use with care and only if necessary and after considering if your problem could instead be solved by specifically renaming or rewriting only the intended headers on a proxy in front of Gunicorn. .. versionadded:: 22.0.0 rN) rvrr?rr rrrrr]rrrrrrro s% D G  C-IG Drrr1)rcr rNr,r$r$rFrrUrr'rrDrrgunicorn.errorsrgunicorn.reloaderrr platformr#rrr rrrr rrrrrrr!r(r#r0rBrJrQr_rdrjrlrorqrwr|rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrrr%r(r,r0r4r7r<r@rCrFrIrLrUrZr_rerjrprurzrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrsO  &'. <<||~4$4*G G T i'R 0 6   -H4 0 : ; : *  0  g    7  F g ( g * ' D G 8     ' (  & g , g "  , w 0  $ G ( W 8 7 (  w   7    '    '    " w .      G    W   ' 8  g   7 , 7 " G " G (  " 7 "  @X X v     G ) g) X w $ w (  G   ' $  G* G  w< W  7  W W$( G  7  w & g      G "     w      g " w " W $  $ ' (  g    " ' "  &  "  (  W   G  F G 4 W * g  w **Zw& g    7 g0 g , G *  & W 4 g *  (C$ w *  r