VisoRAG is a GPU-backed Python API. Treat it as a long-running service, not a static site or serverless function.
- GPU VM, workstation, or notebook runtime for real model inference.
- FastAPI/Uvicorn behind a reverse proxy or platform gateway.
- TLS terminated at the gateway.
- Strong
VISORAG_API_TOKEN. - Restricted CORS origins.
- Private temporary upload storage.
- Public internet exposure of the raw Uvicorn server.
- Serverless hosting that cannot provide persistent GPU runtime or large model downloads.
- Multi-user production workloads without a real auth layer, quotas, audit logs, and request isolation.
- Using the fallback demo token or placeholder
.env.examplevalues. - Processing sensitive documents while request logs include filenames or query snippets.
export VISORAG_API_TOKEN="change-me"
python -m visorag serve --host 0.0.0.0 --port 8000Use 127.0.0.1 for local-only testing.
- Replace the example token with a high-entropy secret.
- Restrict CORS in
api/app.pyor at the gateway. - Disable or restrict sensitive request/response logging. The current runtime may log filenames and query snippets.
- Keep uploaded files and rendered page images out of source control and CI artifacts.
- Patch dependencies and model runtime packages regularly.
- Review upstream model and package licenses before redistribution.
- Add monitoring for GPU memory, request latency, failed renderings, and failed model loads.