Secure AngeVoice

The default installation targets a local or trusted environment. Complete this checklist before other devices can reach it.

Required before network exposure

1. Use the initial credentials once, then set a strong administrator name and password.
2. Generate or configure a strong API key and require Bearer authentication from clients.
3. Expose the service through an HTTPS reverse proxy instead of publishing the admin port directly.
4. Restrict who can upload reference audio and PyTorch voice files.
5. Persist credentials, configuration, models and prompts with appropriate file permissions.

Administrator credentials

After a change, AngeVoice stores only a PBKDF2 hash. To set credentials before the first start, use a local environment override that is not committed to the repository.

API key

KOKORO_API_KEY=auto
ANGEVOICE_API_KEY_FILE=/app/credentials/.angevoice-api-key

Never include the full key in logs, screenshots, issues, chat messages or diagnostic archives. Rotate it after suspected exposure.

Protected persistent directories

/app/credentials  Administrator hashes and API key
/app/config       Runtime configuration
/app/models       Model files and cache
/app/prompts      Voice Profiles and reference WAV files
/app/outputs      Generated audio
/app/logs         Logs and diagnostics

Uploads and model files

• Reference audio can contain personal voice data. Limit access and delete it when no longer required.
• Untrusted .pt or .pth files may execute code. Accept weights only from trusted sources.
• Public deployments should limit upload size, request rate, queue length and WebSocket connections.

Sanitize diagnostics

python3 scripts/evidence_secret_scan.py <diagnostic-directory-or-archive>

Remove administrator passwords, full API keys, Authorization headers, local environment files and signed URLs.

Public access

• Use TLS and configure trusted proxy headers carefully.
• Restrict the admin console to trusted networks when possible.
• Keep application rate limits and WebSocket connection limits unless equivalent upstream protection exists.
• Back up persistent data and test versioned images before upgrading.