Fix CORS config: use str type to avoid pydantic-settings JSON parsing; fallback gracefully for env var format issues

.env

@@ -8,7 +8,7 @@ NEUTTS_DEFAULT_VOICE=jo
 NEUTTS_SAMPLE_RATE=24000
 NEUTTS_DEFAULT_RESPONSE_FORMAT=mp3
 NEUTTS_CORS_ENABLED=true
-NEUTTS_CORS_ORIGINS=["*"]
+NEUTTS_CORS_ORIGINS=*
 NEUTTS_LOG_LEVEL=-info
 NEUTTS_MAX_INFERENCE_WORKERS=4
 NEUTTS_ALLOW_VOICE_UPLOAD=true

Dockerfile

@@ -22,7 +22,7 @@ ENV NEUTTS_DEFAULT_CODEC_DEVICE=cpu
 ENV NEUTTS_DEFAULT_VOICE=jo
 ENV NEUTTS_LOG_LEVEL=INFO
 ENV NEUTTS_CORS_ENABLED=true
-ENV NEUTTS_CORS_ORIGINS=["*"]
+ENV NEUTTS_CORS_ORIGINS=*
 
 RUN pip install --no-cache-dir uv
 

api/src/core/config.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 import json
 from typing import Literal
 
-from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings
 
 
@@ -29,7 +28,7 @@ class Settings(BaseSettings):
 
     # CORS
     cors_enabled: bool = True
-    cors_origins: list[str] = ["*"]
+    cors_origins: str = "*"
 
     # Logging
     log_level: str = "INFO"
@@ -40,12 +39,15 @@ class Settings(BaseSettings):
     # Voice Upload
     allow_voice_upload: bool = True
 
-    @field_validator("cors_origins", mode="before")
-    @classmethod
-    def parse_cors_origins(cls, v: str | list) -> list[str]:
-        if isinstance(v, str):
-            return json.loads(v)
-        return v
+    @property
+    def cors_origins_list(self) -> list[str]:
+        try:
+            parsed = json.loads(self.cors_origins)
+            if isinstance(parsed, list):
+                return parsed
+        except json.JSONDecodeError:
+            pass
+        return [o.strip() for o in self.cors_origins.split(",") if o.strip()]
 
     @property
     def default_models_list(self) -> list[str]:

api/src/main.py

@@ -89,7 +89,7 @@ app = FastAPI(
 if settings.cors_enabled:
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=settings.cors_origins,
+        allow_origins=settings.cors_origins_list,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],