U d@sddlZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z m Z ddlmZddlmZgZe jZdddZddZGd d d eZGd d d eZGd ddeZedefiZddZddZddZddZddZ ddZ!ddZ"ddZ#dd Z$d!d"Z%d#d$Z&d%d&Z'd'd(Z(d)d*Z)d+d,Z*d-d.Z+d/d0Z,d1d2Z-Gd3d4d4eZ.Gd5d6d6eZ/Gd7d8d8eZ0Gd9d:d:eZ1Gd;d<dd>eZ3Gd?d@d@eZ4GdAdBdBeZ5GdCdDdDeZ6GdEdFdFeZ7GdGdHdHeZ8GdIdJdJeZ9GdKdLdLeZ:GdMdNdNeZ;GdOdPdPeZGdUdVdVeZ?GdWdXdXeZ@GdYdZdZeZAGd[d\d\eZBGd]d^d^eZCGd_d`d`eZDGdadbdbeZEGdcddddeZFGdedfdfeZGGdgdhdheZHGdidjdjeZIGdkdldleZJGdmdndneZKGdodpdpeZLGdqdrdreZMGdsdtdteZNGdudvdveZOGdwdxdxeZPGdydzdzeZQGd{d|d|eZRGd}d~d~eZSGdddeZTGdddeZUGdddeZVGdddeZWGdddeZXGdddeZYGdddeZZGdddeZ[GdddeZ\GdddeZ]GdddeZ^GdddeZ_GdddeZ`GdddeZaGdddeZbGdddeZcGdddeZdGdddeZeGdddeZfGdddeZgGdddeZhGdddeZiGdddeZjGdddeZkGdddeZlGdddeZmGdddeZnGdddeZoGdddeZpGdddeZqGdddeZrGdddeZsGdddeZtGdd„deZuGddĄdeZvGddƄdeZwGddȄdeZxGddʄdeZyGdd̄deZzGdd΄deZ{GddЄdeZ|Gdd҄deZ}GddԄdeZ~GddքdeZGdd؄deZGddڄdeZGdd܄deZdS)N) __version__util) ConfigError)reloader_enginescCs:i}|p d}tD]$}|}|j|kr&q|||j<q|S)N)KNOWN_SETTINGSnamecopy)ignoresettingssZsettingrr3/tmp/pip-unpacked-wheel-1tw_qy24/gunicorn/config.py make_settingss rcCs(td|tjr|ddd}t|dS)Nz0(\d)0Z0or)rematch IGNORECASEreplaceint)_xrrr auto_int'srcseZdZd*ddZddZddZfdd Zd d Zd d ZddZ e ddZ e ddZ e ddZ e ddZe ddZe ddZe ddZe ddZe d d!Ze d"d#Ze d$d%Ze d&d'Ze d(d)ZZS)+ConfigNcCs6t|_||_|p"tjtjd|_tj |_ dS)Nr) rr usageospathbasenamesysargvprogenvironr env_orig)selfrr rrr __init__0szConfig.__init__cCshg}tdd|jD}t|jD]:}|j|j}t|rFd|j}|dj|||dq"d|S)Ncss|]}t|VqdSN)len).0krrr 8sz!Config.__str__..z<{}()>z{k:{kmax}} = {v})r(vkmax ) maxr sortedvaluecallableformat __qualname__appendjoin)r#linesr+r(r*rrr __str__6s  zConfig.__str__cCs$||jkrtd||j|SNz No configuration setting for: %s)r AttributeErrorget)r#rrrr __getattr__@s  zConfig.__getattr__cs,|dkr||jkrtdt||dS)Nr zInvalid access!)r r8super __setattr__r#rr/ __class__rr r<EszConfig.__setattr__cCs*||jkrtd||j||dSr7)r r8setr=rrr r@Js  z Config.setcCsd|jkrt|jdSgS)NZGUNICORN_CMD_ARGS)r"shlexsplitr#rrr get_cmd_args_from_envOs zConfig.get_cmd_args_from_envcCs||j|jd}tjf|}|jdddtjdtddd|jd d tjd t|j|jj d }|D]}|j| |qb|S) N)rr z-vz --versionversionz%(prog)s (version z) z&show program's version number and exit)actiondefaultrEhelpargs*)nargsrH)key) rr argparseArgumentParser add_argumentSUPPRESSrr.r __getitem__ add_option)r#kwargsparserkeysr(rrr rTTs  z Config.parsercCs6|jd}|dp|dk}|r2|jdkr2dS|S)N worker_class SyncWorkersyncrZgthread)r r9endswiththreads)r#uriis_syncrrr worker_class_strfs zConfig.worker_class_strcCsR|jd}|dp|dk}|r2|jdkr2d}t|}t|drN||S)NrVrWrXrz%gunicorn.workers.gthread.ThreadWorkersetup)r r9rYrZr load_classhasattrr^)r#r[r\rVrrr rVps  zConfig.worker_classcCs|jd}dd|DS)NbindcSsg|]}tt|qSr)rZ parse_address bytes_to_str)r'rarrr sz"Config.address..r r9)r#r rrr address~szConfig.addresscCs|jdS)NuserrdrCrrr uidsz Config.uidcCs|jdS)NgrouprdrCrrr gidsz Config.gidcCs,|jd}|dk r|S|jdSdS)N proc_namedefault_proc_namerd)r#Zpnrrr rjszConfig.proc_namecCsj|jd}|dkrtj}|tjkrDd|jkrD|jdjdk rDd}tj|ddd}t|drf||S) N logger_classsimple statsd_hostz!gunicorn.instrument.statsd.Statsdgunicorn.glogging.Loggerzgunicorn.loggers)rGsectioninstall) r r9 LoggerClassrGr/rr_r`rq)r#r[rlrrr rls  zConfig.logger_classcCs |jp |jSr%)certfilekeyfilerCrrr is_sslsz Config.is_sslcCs2i}|jD]\}}|jdkr|||<q|S)NSSL)r itemsrpr9)r#optsrr/rrr ssl_optionss  zConfig.ssl_optionsc Csp|jd}i}|s|S|D]L}t|}z|dd\}}Wn tk r`td|YnX|||<q|S)Nraw_env=renvironment setting %r invalid)r r9rrbrB ValueError RuntimeError)r#rzenver r(r*rrr rs  z Config.envcCs:|jddk rdSdtjkr6tjd}|dkSdS)NsendfileFZSENDFILE)y1yestrueT)r r9rr!lower)r#rrrr rs  zConfig.sendfilecCs|jdS)N reuse_portrdrCrrr rszConfig.reuse_portc Cs|jd}|dkrdSi}|D]f}t|}ztd|d\}}Wn tk rftd|YnX|dd}|dd}|||<q"|S)Nraw_paste_global_confz(?r r.sB               rcs$eZdZfddZddZZS) SettingMetacsrtj}dd|D}|s(|||||Stt|d<t|d|d<|||||}||ddt||S)NcSsg|]}t|tr|qSr) isinstancer)r'brrr rcs z'SettingMeta.__new__..order validatordesc)r;__new__r&r staticmethodfmt_descr9r3)clsrbasesattrsZ super_newparents new_classr>rr rs  zSettingMeta.__new__cCs2t|}t|d|t|d|ddS)Nrshortr)textwrapdedentstripsetattr splitlines)rrrrr rs zSettingMeta.fmt_desc)rrr2rrrrrr>r rs rc@s|eZdZdZdZdZdZdZdZdZ dZ dZ dZ dZ dZdZddZddZddZdd Zd d Zd d ZeZddZdS)SettingNcCs|jdk r||jdSr%)rGr@rCrrr r$s zSetting.__init__cCs|js dSt|j}d|j|jf}|dd}|j|jp)r?rridr/rCrrr __repr__As zSetting.__repr__)rrr2rr/rprrrrrFrGrrrKrr$rRr r9r@rZ__cmp__rrrrr rs*rcCsh|dkr dSt|tr|St|ts0td||dkrDdS|dkrXdStd|dS)NzInvalid type for casting: %srTfalseFzInvalid boolean: %s)rboolrrrrr}rrrr validate_boolMs   rcCst|tstd||S)NzValue is not a dictionary: %s )rdictrrrrr validate_dict]s  rcCs6t|tst|d}nt|}|dkr2td||S)NrzValue must be positive: %s)rrr}rrrr validate_pos_intcs    rc Csi}ddttDD]}tt|||dd<q||krB||Szt|}||kr^|WSWnttfk rxYnXtd|d|fdS)NcSsg|]}|dr|qS) PROTOCOL_) startswith)r'prrr rcps z(validate_ssl_version.. z*Invalid ssl_version: %s. Valid options: %sz, )dirsslgetattrrvaluesr}rr4)rZ ssl_versionsprotocolZintvalrrr validate_ssl_versionns   rcCs*|dkr dSt|ts"td||S)NzNot a string: %s)rrrrrrrr validate_strings   rcCs(|dkr dStj|s$td||S)NzFile %s does not exists.)rrexistsr}rrrr validate_file_existss   rcCs&|sgSt|tr|g}dd|DS)NcSsg|] }t|qSr)rr'r*rrr rcsz(validate_list_string..)rrrrrr validate_list_strings  rcCsddt|DS)NcSsg|] }t|qSr)rrrrr rcsz3validate_list_of_existing_files..)rrrrr validate_list_of_existing_filessrcCs$t|}|sgSdd|dDS)NcSsg|]}|r|qSr)rrrrr rcsz+validate_string_to_list..,)rrBrrrr validate_string_to_listsrcCs0t|st|r|}t|r(|St|Sr%)inspect isfunctionismethodisclassrrrrr validate_classs  rcsfdd}|S)Nc st|trz|dd\}}Wn tk r>td|YnXzt||gd}t||}WnPtk r}ztt|W5d}~XYn$tk rtd||fYnXt |std|dkrt |krtd|S) N.rzFValue '%s' is not import string. Format: module[.submodules...].object)fromlistzCan not load '%s' from '%s'zValue is not callable: %szValue must have an arity of: %s) rrrsplitr}r __import__r ImportErrorr8r0r get_arity)rmod_nameZobj_namemodrarityrr _validate_callables*     z-validate_callable.._validate_callabler)rrrrr validate_callables rcCsb|dkrtSt|tr|S|r.t|Szt|jWStk r\t d|YnXdS)NzNo such user: '%s') rgeteuidrrisdigitpwdgetpwnampw_uidKeyErrorrrrrr validate_users rcCsb|dkrtSt|tr|S|r.t|Szt|jWStk r\t d|YnXdS)NzNo such group: '%s') rgetegidrrrgrpgetgrnamgr_gidrrrrrr validate_groups rcsVtdt}|dkr"S|dkr6fddS|dkrJfddStddS) Nrcs |||Sr%r)workerreqr_rrrr z'validate_post_request..cs ||Sr%r)rr_errrr rrzValue must have an arity of: 4)rrrr)rlargsrrr validate_post_requests    rcCsFt|}tjtjtjt|}tj|sBt d||S)Nzcan't chdir to %r) rrrabspathnormpathr4rgetcwdrr)rrrrr validate_chdirs "  rcCsJt|}|dkrdS|d}t|dkr>|dt|dfStddS)N:rrrz$Value must consist of: hostname:port)rrBr&rr)relementsrrr validate_hostports  rcCs|tkrtd||S)NzInvalid reload_engine: %r)rrrrrr validate_reload_engines rcCs.tjtjtd}tj|r*|SdS)Nzgunicorn.conf.py)rrr4rrr)Z config_pathrrr get_default_config_files  rc@s,eZdZdZdZddgZdZeZdZ dZ dS) ConfigFileconfig Config Filez-cz--configZCONFIGz./gunicorn.conf.pya The Gunicorn config file. A string of the form ``PATH``, ``file:PATH``, or ``python:MODULE_NAME``. Only has an effect when specified on the command line or as part of an application specific configuration. By default, a file named ``gunicorn.conf.py`` will be read from the same directory where gunicorn is being run. .. versionchanged:: 19.4 Loading the config from a Python module requires the ``python:`` prefix. N rrr2rrprrrrrGrrrrr rsrc@s$eZdZdZdZdZeZdZdZ dS)WSGIAppZwsgi_apprSTRINGNzz A WSGI application path in pattern ``$(MODULE_NAME):$(VARIABLE_NAME)``. .. versionadded:: 20.1.0 rrr2rrprrrrGrrrrr r6s rc@sReZdZdZdZdZddgZdZeZ de j krDd e j dgZnd gZd Zd S) Bindrar3 Server Socketz-bz--bindZADDRESSZPORTz 0.0.0.0:{0}z127.0.0.1:8000an The socket to bind. A string of the form: ``HOST``, ``HOST:PORT``, ``unix:PATH``, ``fd://FD``. An IP is a valid ``HOST``. .. versionchanged:: 20.0 Support for ``fd://FD`` got added. Multiple addresses can be bound. ex.:: $ gunicorn -b 127.0.0.1:8000 -b [::1]:8000 test:app will bind the `test:app` application on localhost both on ipv6 and ipv4 interfaces. If the ``PORT`` environment variable is defined, the default is ``['0.0.0.0:$PORT']``. If it is not defined, the default is ``['127.0.0.1:8000']``. N)rrr2rrFrprrrrrr!r1r9rGrrrrr rBs rc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)Backlogbacklogrz --backlogINTia{ The maximum number of pending connections. This refers to the number of clients that can be waiting to be served. Exceeding this number results in the client getting an error when attempting to connect. It should only affect servers under significant load. Must be a positive integer. Generally set in the 64-2048 range. N rrr2rrprrrrrrrGrrrrr r esr c@s>eZdZdZdZddgZdZeZe Z e e j ddZdZd S) WorkersworkersWorker Processesz-wz --workersr ZWEB_CONCURRENCYra The number of worker processes for handling requests. A positive integer generally in the ``2-4 x $(NUM_CORES)`` range. You'll want to vary this a bit to find the best for your particular application's work load. By default, the value of the ``WEB_CONCURRENCY`` environment variable, which is set by some Platform-as-a-Service providers such as Heroku. If it is not defined, the default is ``1``. N)rrr2rrprrrrrrrr!r9rGrrrrr r ysr c@s,eZdZdZdZddgZdZeZdZ dZ dS) WorkerClassrVrz-kz--worker-classrrXa The type of workers to use. The default class (``sync``) should handle most "normal" types of workloads. You'll want to read :doc:`design` for information on when you might want to choose one of the other worker classes. Required libraries may be installed using setuptools' ``extras_require`` feature. A string referring to one of the following bundled classes: * ``sync`` * ``eventlet`` - Requires eventlet >= 0.24.1 (or install it via ``pip install gunicorn[eventlet]``) * ``gevent`` - Requires gevent >= 1.4 (or install it via ``pip install gunicorn[gevent]``) * ``tornado`` - Requires tornado >= 0.2 (or install it via ``pip install gunicorn[tornado]``) * ``gthread`` - Python 2 requires the futures package to be installed (or install it via ``pip install gunicorn[gthread]``) Optionally, you can provide your own worker by giving Gunicorn a Python path to a subclass of ``gunicorn.workers.base.Worker``. This alternative syntax will load the gevent class: ``gunicorn.workers.ggevent.GeventWorker``. N rrr2rrprrrrrGrrrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS) WorkerThreadsrZrz --threadsr ram The number of worker threads for handling requests. Run each worker with the specified number of threads. A positive integer generally in the ``2-4 x $(NUM_CORES)`` range. You'll want to vary this a bit to find the best for your particular application's work load. If it is not defined, the default is ``1``. This setting only affects the Gthread worker type. .. note:: If you try to use the ``sync`` worker type and set the ``threads`` setting to more than 1, the ``gthread`` worker type will be used instead. Nr rrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)WorkerConnectionsZworker_connectionsrz--worker-connectionsr iz The maximum number of simultaneous clients. This setting only affects the Eventlet and Gevent worker types. Nr rrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS) MaxRequestsZ max_requestsrz--max-requestsr ra The maximum number of requests a worker will process before restarting. Any value greater than zero will limit the number of requests a worker will process before automatically restarting. This is a simple method to help limit the damage of memory leaks. If this is set to zero (the default) then the automatic worker restarts are disabled. Nr rrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)MaxRequestsJitterZmax_requests_jitterrz--max-requests-jitterr raB The maximum jitter to add to the *max_requests* setting. The jitter causes the restart per worker to be randomized by ``randint(0, max_requests_jitter)``. This is intended to stagger worker restarts to avoid all workers restarting at the same time. .. versionadded:: 19.2 Nr rrrr rsrc@s0eZdZdZdZddgZdZeZe Z dZ dZ dS) Timeouttimeoutrz-tz --timeoutr aH Workers silent for more than this many seconds are killed and restarted. Value is a positive number or 0. Setting it to 0 has the effect of infinite timeouts by disabling timeouts for all workers entirely. Generally, the default of thirty seconds should suffice. Only set this noticeably higher if you're sure of the repercussions for sync workers. For the non sync workers it just means that the worker process is still communicating and is not tied to the length of time required to handle a single request. Nr rrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)GracefulTimeoutZgraceful_timeoutrz--graceful-timeoutr ra Timeout for graceful workers restart. After receiving a restart signal, workers have this much time to finish serving requests. Workers still alive after the timeout (starting from the receipt of the restart signal) are force killed. Nr rrrr rsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS) Keepalive keepaliverz --keep-aliver ra The number of seconds to wait for requests on a Keep-Alive connection. Generally set in the 1-5 seconds range for servers with direct connection to the client (e.g. when you don't have separate load balancer). When Gunicorn is deployed behind a load balancer, it often makes sense to set this to a higher value. .. note:: ``sync`` worker does not support persistent connections and will ignore this option. Nr rrrr r)src@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)LimitRequestLineZlimit_request_lineSecurityz--limit-request-liner ia The maximum size of HTTP request line in bytes. This parameter is used to limit the allowed size of a client's HTTP request-line. Since the request-line consists of the HTTP method, URI, and protocol version, this directive places a restriction on the length of a request-URI allowed for a request on the server. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the query part of a GET request. Value is a number from 0 (unlimited) to 8190. This parameter can be used to prevent any DDOS attack. Nr rrrr r?src@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)LimitRequestFieldsZlimit_request_fieldsrz--limit-request-fieldsr da? Limit the number of HTTP headers fields in a request. This parameter is used to limit the number of headers in a request to prevent DDOS attack. Used with the *limit_request_field_size* it allows more safety. By default this value is 100 and can't be larger than 32768. Nr rrrr rWsrc@s.eZdZdZdZdgZdZeZe Z dZ dZ dS)LimitRequestFieldSizeZlimit_request_field_sizerz--limit-request-field_sizer ia6 Limit the allowed size of an HTTP request header field. Value is a positive number or 0. Setting it to 0 will allow unlimited header field sizes. .. warning:: Setting this parameter to a very high or unlimited value can open up for DDOS attacks. Nr rrrr r isr c@s*eZdZdZdZdgZeZdZdZ dZ dS)Reloadreload Debuggingz--reload store_trueFa Restart workers when code changes. This setting is intended for development. It will cause workers to be restarted whenever application code changes. The reloader is incompatible with application preloading. When using a paste configuration be sure that the server block does not import any application code or the reload will not work as designed. The default behavior is to attempt inotify with a fallback to file system polling. Generally, inotify should be preferred if available because it consumes less system resources. .. note:: In order to use the inotify reloader, you must have the ``inotify`` package installed. N rrr2rrprrrrFrGrrrrr r!}sr!c@s*eZdZdZdZdgZdZeZdZ dZ dS) ReloadEngineZ reload_enginer#z--reload-enginerautoz The implementation that should be used to power :ref:`reload`. Valid engines are: * ``'auto'`` * ``'poll'`` * ``'inotify'`` (requires inotify) .. versionadded:: 19.7 N) rrr2rrprrrrrGrrrrr r&sr&c@s.eZdZdZdZdZdgZdZeZ gZ dZ dS)ReloadExtraFilesZreload_extra_filesr3r#z--reload-extra-fileZFILESz Extends :ref:`reload` option to also watch and reload on additional files (e.g., templates, configurations, specifications, etc.). .. versionadded:: 19.8 N) rrr2rrFrprrrrrGrrrrr r(sr(c@s*eZdZdZdZdgZeZdZdZ dZ dS)SpewZspewr#z--spewr$Fz| Install a trace function that spews every line executed by the server. This is the nuclear option. Nr%rrrr r)sr)c@s*eZdZdZdZdgZeZdZdZ dZ dS) ConfigCheckZ check_configr#z--check-configr$Fz Check the configuration and exit. The exit status is 0 if the configuration is correct, and 1 if the configuration is incorrect. Nr%rrrr r*sr*c@s*eZdZdZdZdgZeZdZdZ dZ dS) PrintConfigZ print_configr#z--print-configr$Fza Print the configuration settings as fully resolved. Implies :ref:`check-config`. Nr%rrrr r+sr+c@s*eZdZdZdZdgZeZdZdZ dZ dS) PreloadAppZ preload_appServer Mechanicsz --preloadr$FaY Load application code before the worker processes are forked. By preloading an application you can save some RAM resources as well as speed up server boot times. Although, if you defer application loading to each worker process, you can reload your application code easily by restarting workers. Nr%rrrr r,sr,c@s*eZdZdZdZdgZeZdZdZ dZ dS)Sendfilerr-z --no-sendfile store_constFa Disables the use of ``sendfile()``. If not set, the value of the ``SENDFILE`` environment variable is used to enable or disable its usage. .. versionadded:: 19.2 .. versionchanged:: 19.4 Swapped ``--sendfile`` with ``--no-sendfile`` to actually allow disabling. .. versionchanged:: 19.6 added support for the ``SENDFILE`` environment variable N) rrr2rrprrrrFrrrrrr r.sr.c@s*eZdZdZdZdgZeZdZdZ dZ dS) ReusePortrr-z --reuse-portr$Fzg Set the ``SO_REUSEPORT`` flag on the listening socket. .. versionadded:: 19.8 Nr%rrrr r0 sr0c@s*eZdZdZdZdgZeZe Z dZ dS)Chdirchdirr-z--chdirzM Change directory to specified directory before loading apps. N) rrr2rrprrrrrrGrrrrr r1s r1c@s,eZdZdZdZddgZeZdZdZ dZ dS) Daemondaemonr-z-Dz--daemonr$Fz Daemonize the Gunicorn process. Detaches the server from the controlling terminal and enters the background. Nr%rrrr r3&sr3c@s0eZdZdZdZdZddgZdZeZ gZ dZ dS) Envrzr3r-z-ez--envENVa| Set environment variables in the execution environment. Should be a list of strings in the ``key=value`` format. For example on the command line: .. code-block:: console $ gunicorn -b 127.0.0.1:8000 --env FOO=1 test:app Or in the configuration file: .. code-block:: python raw_env = ["FOO=1"] N rrr2rrFrprrrrrGrrrrr r55sr5c@s,eZdZdZdZddgZdZeZdZ dZ dS)PidfileZpidfiler-z-pz--pidFILENzf A filename to use for the PID file. If not set, no PID file will be written. rrrrr r8Qsr8c@s*eZdZdZdZdgZdZeZdZ dZ dS) WorkerTmpDirZworker_tmp_dirr-z--worker-tmp-dirDIRNa A directory to use for the worker heartbeat temporary file. If not set, the default temporary directory will be used. .. note:: The current heartbeat system involves calling ``os.fchmod`` on temporary file handlers and may block a worker for arbitrary time if the directory is on a disk-backed filesystem. See :ref:`blocking-os-fchmod` for more detailed information and a solution for avoiding this problem. rrrrr r:_sr:c@s0eZdZdZdZddgZdZeZe Z dZ dS)Userrfr-z-uz--userUSERz Switch worker processes to run as this user. A valid user id (as an integer) or the name of a user that can be retrieved with a call to ``pwd.getpwnam(value)`` or ``None`` to not change the worker process user. N) rrr2rrprrrrrrrGrrrrr r<usr<c@s0eZdZdZdZddgZdZeZe Z dZ dS)Grouprhr-z-gz--groupZGROUPz Switch worker process to run as this group. A valid group id (as an integer) or the name of a user that can be retrieved with a call to ``pwd.getgrnam(value)`` or ``None`` to not change the worker processes group. N) rrr2rrprrrrrrrGrrrrr r>sr>c@s0eZdZdZdZddgZdZeZe Z dZ dZ dS) Umaskumaskr-z-mz--umaskr ra A bit mask for the file mode on files written by Gunicorn. Note that this affects unix socket permissions. A valid value for the ``os.umask(mode)`` call or a string compatible with ``int(value, 0)`` (``0`` means Python guesses the base, so values like ``0``, ``0xFF``, ``0022`` are valid for decimal, hex, and octal representations) N) rrr2rrprrrrrrrGrrrrr r?sr?c@s*eZdZdZdZdgZeZdZdZ dZ dS) Initgroups initgroupsr-z --initgroupsr$Fz If true, set the worker process's group access list with all of the groups of which the specified username is a member, plus the specified group id. .. versionadded:: 19.7 Nr%rrrr rAsrAc@s$eZdZdZdZdZeZdZdZ dS) TmpUploadDirZtmp_upload_dirr-r;Na6 Directory to store temporary request data as they are read. This may disappear in the near future. This path should be writable by the process permissions set for Gunicorn workers. If not specified, Gunicorn will choose a system generated temporary directory. rrrrr rCs rCc@s(eZdZdZdZeZddddZdZdS) SecureSchemeHeaderZsecure_scheme_headersr-rhttpson)zX-FORWARDED-PROTOCOLzX-FORWARDED-PROTOzX-FORWARDED-SSLa{ A dictionary containing headers and values that the front-end proxy uses to indicate HTTPS requests. If the source IP is permitted by ``forwarded-allow-ips`` (below), *and* at least one request header matches a key-value pair listed in this dictionary, then Gunicorn will set ``wsgi.url_scheme`` to ``https``, so your application can tell that the request is secure. If the other headers listed in this dictionary are not present in the request, they will be ignored, but if the other headers are present and do not match the provided values, then the request will fail to parse. See the note below for more detailed examples of this behaviour. The dictionary should map upper-case header names to exact string values. The value comparisons are case-sensitive, unlike the header names, so make sure they're exactly what your front-end proxy sends when handling HTTPS requests. It is important that your front-end proxy configuration ensures that the headers defined here can not be passed directly from the client. N rrr2rrprrrGrrrrr rDsrDc@s4eZdZdZdZdgZdZeZe j ddZ dZ dS) ForwardedAllowIPSZforwarded_allow_ipsr-z--forwarded-allow-ipsrZFORWARDED_ALLOW_IPS 127.0.0.1a Front-end's IPs from which allowed to handle set secure headers. (comma separate). Set to ``*`` to disable checking of Front-end IPs (useful for setups where you don't know in advance the IP address of Front-end, but you still trust the environment). By default, the value of the ``FORWARDED_ALLOW_IPS`` environment variable. If it is not defined, the default is ``"127.0.0.1"``. .. note:: The interplay between the request headers, the value of ``forwarded_allow_ips``, and the value of ``secure_scheme_headers`` is complex. Various scenarios are documented below to further elaborate. In each case, we have a request from the remote address 134.213.44.18, and the default value of ``secure_scheme_headers``: .. code:: secure_scheme_headers = { 'X-FORWARDED-PROTOCOL': 'ssl', 'X-FORWARDED-PROTO': 'https', 'X-FORWARDED-SSL': 'on' } .. list-table:: :header-rows: 1 :align: center :widths: auto * - ``forwarded-allow-ips`` - Secure Request Headers - Result - Explanation * - .. code:: ["127.0.0.1"] - .. code:: X-Forwarded-Proto: https - .. code:: wsgi.url_scheme = "http" - IP address was not allowed * - .. code:: "*" - - .. code:: wsgi.url_scheme = "http" - IP address allowed, but no secure headers provided * - .. code:: "*" - .. code:: X-Forwarded-Proto: https - .. code:: wsgi.url_scheme = "https" - IP address allowed, one request header matched * - .. code:: ["134.213.44.18"] - .. code:: X-Forwarded-Ssl: on X-Forwarded-Proto: http - ``InvalidSchemeHeaders()`` raised - IP address allowed, but the two secure headers disagreed on if HTTPS was used N)rrr2rrprrrrrr!r9rGrrrrr rHsrHc@s*eZdZdZdZdgZdZeZdZ dZ dS) AccessLogZ accesslogLoggingz--access-logfiler9NzW The Access log file to write to. ``'-'`` means log to stdout. rrrrr rJ?srJc@s*eZdZdZdZdgZeZdZdZ dZ dS)DisableRedirectAccessToSyslogZ!disable_redirect_access_to_syslogrKz#--disable-redirect-access-to-syslogr$FzL Disable redirect access logs to syslog. .. versionadded:: 19.8 Nr%rrrr rLMsrLc@s*eZdZdZdZdgZdZeZdZ dZ dS)AccessLogFormatZaccess_log_formatrKz--access-logformatrz;%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"a The access log format. =========== =========== Identifier Description =========== =========== h remote address l ``'-'`` u user name t date of the request r status line (e.g. ``GET / HTTP/1.1``) m request method U URL path without query string q query string H protocol s status B response length b response length or ``'-'`` (CLF format) f referer a user agent T request time in seconds M request time in milliseconds D request time in microseconds L request time in decimal seconds p process ID {header}i request header {header}o response header {variable}e environment variable =========== =========== Use lowercase for header and environment variable names, and put ``{...}x`` names inside ``%(...)s``. For example:: %({x-forwarded-for}i)s Nrrrrr rM[srMc@s,eZdZdZdZddgZdZeZdZ dZ dS) ErrorLogZerrorlogrKz--error-logfilez --log-filer9-z The Error log file to write to. Using ``'-'`` for FILE makes gunicorn log to stderr. .. versionchanged:: 19.2 Log to stderr by default. Nrrrrr rNsrNc@s*eZdZdZdZdgZdZeZdZ dZ dS)LoglevelZloglevelrKz --log-levelZLEVELinfoz The granularity of Error log outputs. Valid level names are: * ``'debug'`` * ``'info'`` * ``'warning'`` * ``'error'`` * ``'critical'`` Nrrrrr rPsrPc@s*eZdZdZdZdgZeZdZdZ dZ dS) CaptureOutputcapture_outputrKz--capture-outputr$Fzm Redirect stdout/stderr to specified file in :ref:`errorlog`. .. versionadded:: 19.6 Nr%rrrr rRsrRc@s*eZdZdZdZdgZdZeZdZ dZ dS)rrrlrKz--logger-classrroaa The logger you want to use to log events in Gunicorn. The default class (``gunicorn.glogging.Logger``) handles most normal usages in logging. It provides error and access logging. You can provide your own logger by giving Gunicorn a Python path to a class that quacks like ``gunicorn.glogging.Logger``. Nrrrrr rrsrrc@s*eZdZdZdZdgZdZeZdZ dZ dS) LogConfigZ logconfigrKz --log-configr9Nzz The log config file to use. Gunicorn uses the standard Python logging module's Configuration file format. rrrrr rTsrTc@s eZdZdZdZeZiZdZdS) LogConfigDictZlogconfig_dictrKaj The log config dictionary to use, using the standard Python logging module's dictionary configuration format. This option takes precedence over the :ref:`logconfig` option, which uses the older file configuration format. Format: https://docs.python.org/3/library/logging.config.html#logging.config.dictConfig .. versionadded:: 19.8 NrGrrrr rUs rUc@sTeZdZdZdZdgZdZeZe dkr,dZ n e dkr:dZ ne d krHd Z nd Z d Z d S)SyslogToZ syslog_addrrKz--log-syslog-toZ SYSLOG_ADDRdarwinzunix:///var/run/syslog)ZfreebsdZ dragonflyzunix:///var/run/logZopenbsdzunix:///dev/logzudp://localhost:514aY Address to send syslog messages. Address is a string of the form: * ``unix://PATH#TYPE`` : for unix domain socket. ``TYPE`` can be ``stream`` for the stream driver or ``dgram`` for the dgram driver. ``stream`` is the default. * ``udp://HOST:PORT`` : for UDP sockets * ``tcp://HOST:PORT`` : for TCP sockets N) rrr2rrprrrrPLATFORMrGrrrrr rVsrVc@s*eZdZdZdZdgZeZdZdZ dZ dS)SyslogsyslogrKz --log-syslogr$Fz Send *Gunicorn* logs to syslog. .. versionchanged:: 19.8 You can now disable sending access logs by using the :ref:`disable-redirect-access-to-syslog` setting. Nr%rrrr rY srYc@s*eZdZdZdZdgZdZeZdZ dZ dS) SyslogPrefixZ syslog_prefixrKz--log-syslog-prefixZ SYSLOG_PREFIXNz Makes Gunicorn use the parameter as program-name in the syslog entries. All entries will be prefixed by ``gunicorn.``. By default the program name is the name of the process. rrrrr r[sr[c@s*eZdZdZdZdgZdZeZdZ dZ dS)SyslogFacilityZsyslog_facilityrKz--log-syslog-facilityZSYSLOG_FACILITYrfz Syslog facility name Nrrrrr r\)sr\c@s,eZdZdZdZddgZeZdZdZ dZ dS) EnableStdioInheritanceZenable_stdio_inheritancerKz-Rz--enable-stdio-inheritanceFr$z Enable stdio inheritance. Enable inheritance for stdio file descriptors in daemon mode. Note: To disable the Python stdout buffering, you can to set the user environment variable ``PYTHONUNBUFFERED`` . N rrr2rrprrrrGrFrrrrr r]5sr]c@s*eZdZdZdZdgZdZdZeZ dZ dS) StatsdHostrnrKz --statsd-hostZ STATSD_ADDRNzR ``host:port`` of the statsd server to log to. .. versionadded:: 19.1 ) rrr2rrprrrGrrrrrrr r_Gsr_c@s*eZdZdZdZdgZdZdZeZ dZ dS) DogstatsdTagsZdogstatsd_tagsrKz--dogstatsd-tagsZDOGSTATSD_TAGSrz} A comma-delimited list of datadog statsd (dogstatsd) tags to append to statsd metrics. .. versionadded:: 20 N rrr2rrprrrGrrrrrrr r`Usr`c@s*eZdZdZdZdgZdZdZeZ dZ dS) StatsdPrefixZ statsd_prefixrKz--statsd-prefixZ STATSD_PREFIXrz Prefix to use when emitting statsd metrics (a trailing ``.`` is added, if not provided). .. versionadded:: 19.2 Nrarrrr rbcsrbc@s,eZdZdZdZddgZdZeZdZ dZ dS)ProcnamerjProcess Namingz-nz--namerNa A base to use with setproctitle for process naming. This affects things like ``ps`` and ``top``. If you're going to be running more than one instance of Gunicorn you'll probably want to set a name to tell them apart. This requires that you install the setproctitle module. If not set, the *default_proc_name* setting will be used. rrrrr rcrsrcc@s eZdZdZdZeZdZdZdS)DefaultProcNamerkrdgunicornzP Internal setting that is adjusted for each type of application. N) rrr2rrprrrGrrrrr res rec@s*eZdZdZdZdgZdZeZdZ dZ dS) PythonPath pythonpathr-z --pythonpathrNz A comma-separated list of directories to add to the Python path. e.g. ``'/home/djangoprojects/myproject,/home/python/mylibrary'``. rrrrr rgsrgc@s,eZdZdZdZddgZdZeZdZ dZ dS)PasteZpaster-z--pastez--pasterrNa[ Load a PasteDeploy config file. The argument may contain a ``#`` symbol followed by the name of an app section from the config file, e.g. ``production.ini#admin``. At this time, using alternate server blocks is not supported. Use the command line arguments to control server configuration instead. rrrrr risric@s4eZdZdZdZedZeZddZ e e Z dZ dS) OnStarting on_starting Server HooksrcCsdSr%rserverrrr rkszOnStarting.on_startingz Called just before the master process is initialized. The callable needs to accept a single instance variable for the Arbiter. N) rrr2rrprrr0rrkrrGrrrrr rjsrjc@s4eZdZdZdZedZeZddZ e e Z dZ dS)OnReload on_reloadrlrcCsdSr%rrmrrr rpszOnReload.on_reloadz Called to recycle workers during a reload via SIGHUP. The callable needs to accept a single instance variable for the Arbiter. N) rrr2rrprrr0rrprrGrrrrr rosroc@s4eZdZdZdZedZeZddZ e e Z dZ dS) WhenReady when_readyrlrcCsdSr%rrmrrr rrszWhenReady.when_readyz Called just after the server is started. The callable needs to accept a single instance variable for the Arbiter. N) rrr2rrprrr0rrrrrGrrrrr rqsrqc@s4eZdZdZdZedZeZddZ e e Z dZ dS)Preforkpre_forkrlrcCsdSr%rrnrrrr rtszPrefork.pre_forkz Called just before a worker is forked. The callable needs to accept two instance variables for the Arbiter and new Worker. N) rrr2rrprrr0rrtrrGrrrrr rssrsc@s4eZdZdZdZedZeZddZ e e Z dZ dS)Postfork post_forkrlrcCsdSr%rrurrr rwszPostfork.post_forkz Called just after a worker has been forked. The callable needs to accept two instance variables for the Arbiter and new Worker. N) rrr2rrprrr0rrwrrGrrrrr rvsrvc@s4eZdZdZdZedZeZddZ e e Z dZ dS)PostWorkerInitpost_worker_initrlrcCsdSr%rrrrr ryszPostWorkerInit.post_worker_initz Called just after a worker has initialized the application. The callable needs to accept one instance variable for the initialized Worker. N) rrr2rrprrr0rryrrGrrrrr rxsrxc@s4eZdZdZdZedZeZddZ e e Z dZ dS) WorkerInt worker_intrlrcCsdSr%rrzrrr r|szWorkerInt.worker_intz Called just after a worker exited on SIGINT or SIGQUIT. The callable needs to accept one instance variable for the initialized Worker. N) rrr2rrprrr0rr|rrGrrrrr r{sr{c@s4eZdZdZdZedZeZddZ e e Z dZ dS) WorkerAbort worker_abortrlrcCsdSr%rrzrrr r~+szWorkerAbort.worker_abortz Called when a worker received the SIGABRT signal. This call generally happens on timeout. The callable needs to accept one instance variable for the initialized Worker. N) rrr2rrprrr0rr~rrGrrrrr r}%sr}c@s4eZdZdZdZedZeZddZ e e Z dZ dS)PreExecpre_execrlrcCsdSr%rrmrrr r?szPreExec.pre_execz Called just before a new master process is forked. The callable needs to accept a single instance variable for the Arbiter. N) rrr2rrprrr0rrrrGrrrrr r9src@s4eZdZdZdZedZeZddZ e e Z dZ dS) PreRequest pre_requestrlrcCs|jd|j|jfdS)Nz%s %s)logdebugmethodr)rrrrr rOszPreRequest.pre_requestz Called just before a worker processes the request. The callable needs to accept two instance variables for the Worker and the Request. N) rrr2rrprrr0rrrrGrrrrr rIsrc@s0eZdZdZdZeZeZddZ e e Z dZ dS) PostRequest post_requestrlcCsdSr%r)rrr!resprrr r`szPostRequest.post_requestz Called after a worker processes the request. The callable needs to accept two instance variables for the Worker and the Request. N) rrr2rrprrr0rrrrGrrrrr rZsrc@s4eZdZdZdZedZeZddZ e e Z dZ dS) ChildExit child_exitrlrcCsdSr%rrurrr rqszChildExit.child_exitz Called just after a worker has been exited, in the master process. The callable needs to accept two instance variables for the Arbiter and the just-exited Worker. .. versionadded:: 19.7 N) rrr2rrprrr0rrrrGrrrrr rksrc@s4eZdZdZdZedZeZddZ e e Z dZ dS) WorkerExit worker_exitrlrcCsdSr%rrurrr rszWorkerExit.worker_exitz Called just after a worker has been exited, in the worker process. The callable needs to accept two instance variables for the Arbiter and the just-exited Worker. N) rrr2rrprrr0rrrrGrrrrr r~src@s4eZdZdZdZedZeZddZ e e Z dZ dS)NumWorkersChangednworkers_changedrlrcCsdSr%r)rn new_value old_valuerrr rsz"NumWorkersChanged.nworkers_changeda7 Called just after *num_workers* has been changed. The callable needs to accept an instance variable of the Arbiter and two integers of number of workers after and before change. If the number of workers is set for the first time, *old_value* would be ``None``. N) rrr2rrprrr0rrrrGrrrrr rsrc@s0eZdZdZdZedZddZeeZ dZ dS)OnExiton_exitrlrcCsdSr%rrmrrr rszOnExit.on_exitz Called just before exiting Gunicorn. The callable needs to accept a single instance variable for the Arbiter. N) rrr2rrprrrrrGrrrrr rs rc@s*eZdZdZdZdgZeZdZdZ dZ dS) ProxyProtocolZproxy_protocolr-z--proxy-protocolFr$a Enable detect PROXY protocol (PROXY mode). Allow using HTTP and Proxy together. It may be useful for work with stunnel as HTTPS frontend and Gunicorn as HTTP server. PROXY protocol: http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt Example for stunnel config:: [https] protocol = proxy accept = 443 connect = 80 cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.key Nr^rrrr rsrc@s&eZdZdZdZdgZeZdZdZ dS)ProxyAllowFromZproxy_allow_ipsr-z--proxy-allow-fromrIa Front-end's IPs from which allowed accept proxy requests (comma separate). Set to ``*`` to disable checking of Front-end IPs (useful for setups where you don't know in advance the IP address of Front-end, but you still trust the environment) N) rrr2rrprrrrGrrrrr rs rc@s*eZdZdZdZdgZdZeZdZ dZ dS)KeyFilertrvz --keyfiler9Nz SSL key file rrrrr rsrc@s*eZdZdZdZdgZdZeZdZ dZ dS)CertFilersrvz --certfiler9Nz SSL certificate file rrrrr rsrc@sDeZdZdZdZdgZeZee dr,e j Z ne j Z dZ e j Z dZ dS) SSLVersion ssl_versionrvz --ssl-version PROTOCOL_TLSz SSL version to use (see stdlib ssl module's) .. versionchanged:: 20.0.1 The default value has been changed from ``ssl.PROTOCOL_SSLv23`` to ``ssl.PROTOCOL_TLS`` when Python >= 3.6 . a SSL version to use. ============= ============ --ssl-version Description ============= ============ SSLv3 SSLv3 is not-secure and is strongly discouraged. SSLv23 Alias for TLS. Deprecated in Python 3.6, use TLS. TLS Negotiate highest possible version between client/server. Can yield SSL. (Python 3.6+) TLSv1 TLS 1.0 TLSv1_1 TLS 1.1 (Python 3.4+) TLSv1_2 TLS 1.2 (Python 3.4+) TLS_SERVER Auto-negotiate the highest protocol version like TLS, but only support server-side SSLSocket connections. (Python 3.6+) ============= ============ .. versionchanged:: 19.7 The default value has been changed from ``ssl.PROTOCOL_TLSv1`` to ``ssl.PROTOCOL_SSLv23``. .. versionchanged:: 20.0 This setting now accepts string names based on ``ssl.PROTOCOL_`` constants. N)rrr2rrprrrr`rrrGPROTOCOL_SSLv23rrrrr rs rc@s(eZdZdZdZdgZeZej Z dZ dS)CertReqs cert_reqsrvz --cert-reqszI Whether client certificate is required (see stdlib ssl module's) N) rrr2rrprrrr CERT_NONErGrrrrr r#s rc@s*eZdZdZdZdgZdZeZdZ dZ dS)CACertsca_certsrvz --ca-certsr9Nz CA certificates file rrrrr r.src@s*eZdZdZdZdgZdZdZeZ dZ dS)SuppressRaggedEOFssuppress_ragged_eofsrvz--suppress-ragged-eofsr$Tz7 Suppress ragged EOFs (see stdlib ssl module's) N) rrr2rrprrFrGrrrrrrr r:src@s*eZdZdZdZdgZeZdZdZ dZ dS)DoHandshakeOnConnectdo_handshake_on_connectrvz--do-handshake-on-connectr$FzU Whether to perform SSL handshake on socket connect (see stdlib ssl module's) Nr%rrrr rFsrc@s&eZdZdZdZdgZeZdZdZ dS)Ciphersciphersrvz --ciphersNa SSL Cipher suite to use, in the format of an OpenSSL cipher list. By default we use the default cipher list from Python's ``ssl`` module, which contains ciphers considered strong at the time of each Python release. As a recommended alternative, the Open Web App Security Project (OWASP) offers `a vetted set of strong cipher strings rated A+ to C- `_. OWASP provides details on user-agent compatibility at each security level. See the `OpenSSL Cipher List Format Documentation `_ for details on the format of an OpenSSL cipher list. ) rrr2rrprrrrGrrrrr rRs rc@s.eZdZdZdZdZdgZdZeZ gZ dZ dS)PasteGlobalConfrr3r-z--paste-globalZCONFa` Set a PasteDeploy global config variable in ``key=value`` form. The option can be specified multiple times. The variables are passed to the the PasteDeploy entrypoint. Example:: $ gunicorn -b 127.0.0.1:8000 --paste development.ini --paste-global FOO=1 --paste-global BAR=2 .. versionadded:: 19.7 Nr7rrrr rjsrc@s*eZdZdZdZdgZeZdZdZ dZ dS)StripHeaderSpacesZstrip_header_spacesr-z--strip-header-spacesr$Fa; Strip spaces present between the header name and the the ``:``. This is known to induce vulnerabilities and is not compliant with the HTTP/1.1 standard. See https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn. Use with care and only if necessary. Nr%rrrr rsr)N)rMr rrrrrrArrrrfrrZgunicorn.errorsrZgunicorn.reloaderrrplatformrXrrobjectrrrrrrrrrrrrrrrrrrrrrrrrrr r rrrrrrrrrrr r!r&r(r)r*r+r,r.r0r1r3r5r8r:r<r>r?rArCrDrHrJrLrMrNrPrRrrrTrUrVrYr[r\r]r_r`rbrcrergrirjrorqrsrvrxr{r}rrrrrrrrrrrrrrrrrrrrrrr s   >J     #"    T,    /