Initial Configuration¶

After installation, you'll need to configure Pixee Enterprise Server. This page covers the first three sections of the admin console: how browsers reach the server, how users sign in, and which AI provider it uses.

Configuration¶

Embedded ClusterHelm Deployment

Configuration is done through the admin console configuration page available after installation at:

https://<domain name or ip address>:30000

When you load the admin console page you will be prompted to enter your admin password. The first time configuring after installation you will be directed through a workflow that will step you through configuring Pixee Enterprise Server.

Network¶

The settings under the Network Settings section all require your input. Together they describe how browsers reach your Pixee Enterprise Server, and the console reveals each option as your earlier answers make it relevant. Make sure you review all of them for completeness and accuracy. Authentication and AI model provider settings follow in their own sections.

The section asks its questions in the order they depend on one another:

Domain name — the address browsers use.
Behind a reverse proxy, load balancer, or CDN — whether anything sits between browsers and this server.
TLS Termination — shown only when you answer yes to the previous question.
Protocol, and the TLS Options that follow from it.
Use non-standard port? — and the port itself, when browsers do not reach the server on 80 or 443.

Domain¶

Enter the domain name browsers use to reach your Pixee Enterprise Server. Behind a reverse proxy, load balancer, or CDN this is the public hostname clients request — not the server's own address, and not the origin address the proxy was configured with.

Two things depend on it. Pixee builds every browser-facing URL from this value, including the OIDC authorization endpoint and the OAuth2 redirect_uri, so an internal address here sends the login flow to a host the browser cannot reach. It is also the only Host header the server's gateway accepts, so your proxy must forward requests carrying this hostname. See Reverse Proxy Settings.

If you have not assigned a domain name you can enter the public IP address of your Pixee Enterprise server instead but this will limit your TLS options.

Reverse proxy¶

Check Behind a reverse proxy, load balancer, or CDN when browsers reach this server through an ALB, Azure Front Door, Application Gateway, HAProxy, or similar, rather than connecting to the server directly. Answering yes reveals two further settings:

TLS Termination — at this server, at the reverse proxy, or nowhere. This decides the scheme in every browser-facing URL, so a proxy that terminates TLS still produces https:// login redirects even when the server itself serves HTTP.
Additional accepted hostnames — a fallback for proxies that rewrite the Host header and cannot be reconfigured.

Both are covered in depth under Reverse Proxy Settings.

Protocol¶

Select the protocol this server's own gateway serves. With nothing in front of it, this is also the protocol browsers use. Behind a reverse proxy it is what the proxy connects to, and it has to agree with TLS Termination:

TLS Termination	Protocol
TLS at this server	`HTTPS` — the proxy forwards encrypted traffic
TLS at reverse proxy	`HTTP`, or `HTTPS` if your proxy re-encrypts to the origin
No TLS (HTTP only)	`HTTP`

Choosing HTTP leaves traffic to this cluster un-encrypted, which is appropriate for quick testing and for the common arrangement where a proxy terminates TLS in front. Choosing HTTPS prompts you for TLS Options: upload your own certificate, have the cluster generate a self-signed one, or have Let's Encrypt issue and renew one for you.

HTTPS pins browsers to HTTPS for a year

An HTTPS gateway sends Strict-Transport-Security: max-age=31536000; includeSubDomains on every response. A browser that has loaded the site once then refuses plain HTTP to that hostname and its subdomains for a year, even if you later switch that hostname back to HTTP. That is HSTS working as intended rather than a fault, so plan any downgrade of a hostname with it in mind. The header is not sent when the cluster generates a self-signed certificate, since pinning HTTPS to a certificate the browser rejects would leave no way back into the console.

The header is also withheld when Use non-standard port? is set. A pin is recorded against the hostname alone, with no port attached, and a pinned browser rewrites the scheme while keeping whatever port it was given: http://host:30080 would become https://host:30080 and fail against the plaintext listener instead of following the redirect. The same pin would upgrade every other plain-HTTP service on that hostname and its subdomains, on any port, for a year, with no way to withdraw it.

Use non-standard port?¶

Leave this unchecked when browsers reach the server on the standard ports, 80 for HTTP and 443 for HTTPS. Check it when they do not — a load balancer listening on 5443, or a deployment reached on a NodePort such as 30080 — and enter the port in Non-standard port. The port is appended to every browser-facing URL, including the OIDC login redirects, so entering it here is what puts it into the authorization endpoint and the redirect_uri. It applies whether or not a reverse proxy is configured. See Non-Standard Port.

Authentication¶

Pixee Enterprise Server authenticates through Authentik, the embedded identity provider. Use Authentik on its own, or federate your existing IdP through it (Microsoft Entra ID, Okta, Google Workspace, Oracle, LDAP).

Once Authentik is running, this section lists the default admin credentials, the Authentik admin console URL, and the direct login link for administrators, the URL local accounts such as akadmin use to reach a password form when a federated IdP is configured with auto-redirect.

See Authentication for more information on specific provider configuration.

AI Providers¶

Choose LLM provider and fill in the credentials. Pixee uses two models — a Reasoning Model for complex analysis and a Fast Model for quick tasks (they can be the same). Sensible defaults are pre-filled.

Supported providers: OpenAI, Azure AI Foundry, Anthropic, Azure Anthropic, and AWS Bedrock. OpenAI and Anthropic only require an API Key; the Azure variants also require an Endpoint, and Bedrock an AWS Region.

Selecting AWS Bedrock reveals a second choice, Bedrock API: Mantle (the default) for OpenAI's frontier models, or Converse for the models AWS hosts natively. The two APIs are incompatible and take different model IDs, so the console asks for the credentials and model names of whichever one you pick.

For OpenAI-compatible providers such as Databricks, select OpenAI and set the Endpoint to your workspace serving URL. See Databricks AI.

See AI Providers for per-provider walkthroughs and web search model configuration.

Create a values.yaml file and configure the following basic settings:

Domain¶

Set the URL where your Pixee Enterprise Server will be accessible (if no domain name is available, use an external IP address):

global:
  pixee:
    domain: "<your pixee enterprise server domain name>"

Protocol¶

Set the HTTP protocol (http or https) used to access your Pixee Enterprise Server:

global:
  pixee:
    protocol: "https"

Info

protocol is what this cluster serves. When TLS is terminated outside the cluster, leave it at http and set externalProtocol: "https" alongside it — that is the scheme browsers use, and it is what the browser-facing URLs are built from. See Reverse Proxy Settings.

Ingress¶

If you are using an ingress controller, you can enable and configure the Pixee Enterprise Server ingress resource as follows:

platform:
  proxy:
    # enable proxy configuration with ingress to allow headers from the ingress controller
    enabled: true
  ingress:
    enabled: true
    className: "<your ingress controller class name (i.e. nginx, gce, etc)"
    hosts:
      - host: "<your pixee enterprise server domain name>"
        paths:
          - path: "/"
            pathType: "Prefix"
    # If you are securing your Pixee Enterprise Server with TLS via ingress, set the following
    tls:
      - hosts:
        - "<your pixee enterprise server domain name>"
        secretName: "<your tls certificate secret name>"

AI Model Provider¶

Select the AI provider you want to use and set the API key, endpoint (if required), and model names. Pixee uses two models: reasoning for complex analysis and fast for quick tasks — these can be the same model.

OpenAIAzure AI FoundryAnthropicAzure AnthropicAWS Bedrock (Mantle)

global:
  pixee:
    ai:
      enabled: true
      default:
        provider: "openai"
        apiKey: "<your OpenAI API key>"
      reasoning:
        model: "gpt-5.4-mini"
      fast:
        model: "gpt-5.4-mini"

Info

For OpenAI-compatible providers such as Databricks, set default.endpoint to your workspace serving URL. See Databricks AI.

global:
  pixee:
    ai:
      enabled: true
      default:
        provider: "azure"
        apiKey: "<your Azure AI Foundry API key>"
        endpoint: "<your Azure AI Foundry endpoint>"
      reasoning:
        model: "gpt-5.4-mini"
      fast:
        model: "gpt-5.4-mini"

global:
  pixee:
    ai:
      enabled: true
      default:
        provider: "anthropic"
        apiKey: "<your Anthropic API key>"
      reasoning:
        model: "claude-sonnet-4-20250514"
      fast:
        model: "claude-sonnet-4-20250514"

global:
  pixee:
    ai:
      enabled: true
      default:
        provider: "azure-anthropic"
        apiKey: "<your Azure Anthropic API key>"
        endpoint: "<your Azure Anthropic endpoint>"
      reasoning:
        model: "claude-sonnet-4-20250514"
      fast:
        model: "claude-sonnet-4-20250514"

global:
  pixee:
    ai:
      enabled: true
      default:
        provider: "bedrock-mantle"
        apiKey: "<your AWS Bedrock API key>"
        endpoint: "https://bedrock-mantle.us-east-1.api.aws/openai/v1"
      reasoning:
        model: "openai.gpt-5.6-luna"
      fast:
        model: "openai.gpt-5.6-luna"

Info

The Responses API is enabled automatically for this provider. See AWS Bedrock (Mantle).

For advanced settings (web search model, custom headers, Responses API, using an existing secret), see AI Providers.