Advanced ghc-api configuration: shared instances and security

1. When advanced configuration is needed

If ghc-api listens only on 127.0.0.1 for one local user, the defaults are usually enough. Add these controls only when sharing Copilot access, connecting from other devices, retaining requests, or synchronizing machines.

2. User tokens for a shared instance

Start with ghc-api --enable-auth, or enable enable_auth in the configuration generated by your installed version.

1. A user opens /signup and receives a one-time gha_... token.
2. An administrator approves the user in the dashboard.
3. The client sends the approved token as a Bearer token or compatible API-key header.
4. An administrator can revoke or remove the user.

3. Protect administration with a reverse proxy

User-token middleware primarily protects LLM endpoints. Protect dashboards, request details, user management, and configuration APIs separately with nginx, Caddy, or another reverse proxy.

• Allow Bearer-token LLM requests to reach ghc-api without Basic Auth intercepting them.
• Require separate administrator authentication for dashboard and management paths.
• Disable proxy buffering and use a long read timeout for streaming.
• Expose only required ports and use HTTPS.

4. Request logs, OneDrive, and persistence

Feature	Before enabling
Request files	Useful for historical statistics but may retain sensitive content.
OneDrive	Can synchronize config, sessions, and usage; enable only when the cloud boundary is acceptable.
User registry	Contains user state and tokens; restrict file access and backups.
Memory cache	Size it for concurrency and the sensitivity of retained requests.

5. Deployment checklist

1. Confirm account and organization model access.
2. Enable user authentication and approve a test user.
3. Separate LLM and administrator authentication rules.
4. Verify SSE streaming is not buffered.
5. Review permissions for logs, sync, and backups.
6. Complete an end-to-end request with a non-admin client token.