Explain network_mode: host motivation in README

Fix build_push.sh tag detection
Remove DOCKERHUB.md reference from README
2026-05-07 16:14:44 +02:00 · 2026-05-07 16:11:50 +02:00 · 2026-05-07 16:09:22 +02:00 · 2026-05-07 16:08:05 +02:00 · 2026-05-07 16:04:23 +02:00 · 2026-05-07 16:03:03 +02:00
22 changed files with 3507 additions and 278 deletions
@@ -1,11 +1,50 @@
-.git/
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
 .venv/
 venv/
+*.egg-info/
+.pytest_cache/
+
+# Tests
+backend/tests/
+
+# Environment & secrets
 .env
+*.env.local
+
+# Databases
+*.db
+*.sqlite3
+
+# Logs
+logs/
+*.log
+
+# IDE & tools
+.idea/
+.vscode/
+.claude/
+
+# Git
+.git/
+.gitignore
+
+# Frontend
 frontend/node_modules/
 frontend/dist/
-backend/__pycache__/
-backend/**/__pycache__/
-backend/*.pyc
-backend/test.db
-backend/tests/
+
+# Docker
+docker-compose.yml
+.dockerignore
+
+# Docs
+*.md
+
+# Dev & build scripts
+run_dev.py
+build_push.sh
+start.sh
+test_api.sh
@@ -14,7 +14,11 @@ __pycache__/
 *.sqlite3

 # IDE
-.idea/
+.idea/*
+!.idea/runConfigurations/
+.idea/runConfigurations/*
+!.idea/runConfigurations/Dev.xml
+!.idea/runConfigurations/Docker_Push.xml
 .vscode/

 # Frontend build
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Dev" type="PythonConfigurationType" factoryName="Python">
+    <module name="llm_quota" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="SCRIPT_NAME" value="$PROJECT_DIR$/run_dev.py" />
+    <option name="PARAMETERS" value="" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Docker Push" type="ShConfigurationType">
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/build_push.sh" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/bash" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,156 @@
+# mediaeng/llmproxy
+
+A lightweight reverse proxy for [Ollama](https://ollama.com) that manages API keys with configurable token and request quotas. Incoming requests in OpenAI-compatible format are authenticated, checked against the quota, and forwarded to the configured Ollama server.
+
+## Features
+
+- OpenAI-compatible endpoint (`/v1/chat/completions`, `/v1/models`)
+- API key management with daily and monthly token/request limits
+- Web-based admin interface (port 8001)
+- Streaming support (Server-Sent Events)
+- Tool use / function calling passthrough
+- Rotating usage logs
+- SQLite (default) or PostgreSQL
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| `8000` | Proxy endpoint (OpenAI API) |
+| `8001` | Admin API + web interface |
+
+All API endpoints require the `ADMIN_PASSWORD` — without a valid token, only the public frontend files (HTML/JS/CSS of the login page) are accessible. The password is therefore the primary protection.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ADMIN_PASSWORD` | – | **Required.** Password for the admin interface |
+| `OLLAMA_URL` | `http://localhost:11434` | URL of the Ollama server (without `/v1` suffix) |
+| `DEFAULT_MODEL` | `llama3` | Model used when the client does not specify one |
+| `DATABASE_URL` | `sqlite:///./test.db` | Database connection string (SQLite or PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Proxy bind address |
+| `PROXY_PORT` | `8000` | Proxy port |
+| `ADMIN_HOST` | `0.0.0.0` | Admin API bind address (`127.0.0.1` to restrict to local access) |
+| `ADMIN_PORT` | `8001` | Admin API port |
+| `APP_TZ` | `Europe/Berlin` | Timezone for daily/monthly quota resets |
+| `LOG_FILE` | `logs/usage.log` | Path of the rotating usage log file |
+
+## Docker Compose – Ollama on the Host (Linux, recommended)
+
+`network_mode: host` gives the container direct access to the host network stack. Ollama runs on the host and is reachable at `localhost:11434` — not visible from outside. The proxy and admin interface are available directly on host ports 8000 and 8001.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama as Container, SQLite
+
+Ollama and llmproxy run together in Docker. Ollama is not exposed externally.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama as Container, PostgreSQL
+
+For production environments with an external database.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client Configuration
+
+Configure the proxy as an OpenAI-compatible endpoint:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <API key created in the admin interface>
+```
@@ -0,0 +1,156 @@
+# mediaeng/llmproxy
+
+Ein schlanker Reverse-Proxy für [Ollama](https://ollama.com), der API-Keys mit konfigurierbaren Token- und Request-Quoten verwaltet. Eingehende Anfragen im OpenAI-kompatiblen Format werden authentifiziert, auf Quota geprüft und an den konfigurierten Ollama-Server weitergeleitet.
+
+## Funktionen
+
+- OpenAI-kompatibler Endpunkt (`/v1/chat/completions`, `/v1/models`)
+- API-Key-Verwaltung mit tages- und monatlichen Token-/Request-Limits
+- Web-basierte Admin-Oberfläche (Port 8001)
+- Streaming-Support (Server-Sent Events)
+- Tool-Use / Function Calling wird durchgereicht
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+
+## Ports
+
+| Port | Dienst |
+|------|--------|
+| `8000` | Proxy-Endpunkt (OpenAI-API) |
+| `8001` | Admin-API + Web-Oberfläche |
+
+Alle API-Endpunkte erfordern das `ADMIN_PASSWORD` — ein Zugriff ohne gültiges Token liefert nur die öffentlichen Frontend-Dateien (HTML/JS/CSS der Login-Seite). Das Passwort ist damit die primäre Schutzmaßnahme.
+
+## Umgebungsvariablen
+
+| Variable | Standard | Beschreibung |
+|----------|----------|--------------|
+| `ADMIN_PASSWORD` | – | **Pflicht.** Passwort für die Admin-Oberfläche |
+| `OLLAMA_URL` | `http://localhost:11434` | URL des Ollama-Servers (ohne `/v1`-Suffix) |
+| `DEFAULT_MODEL` | `llama3` | Modell, das verwendet wird wenn der Client keines angibt |
+| `DATABASE_URL` | `sqlite:///./test.db` | Datenbank-Verbindungsstring (SQLite oder PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxy |
+| `PROXY_PORT` | `8000` | Port des Proxy |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (`127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für Tages-/Monats-Reset der Quoten |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+
+## Docker Compose – Ollama auf dem Host (Linux, empfohlen)
+
+`network_mode: host` gibt dem Container direkten Zugriff auf das Host-Netzwerk. Ollama läuft auf dem Host und ist über `localhost:11434` erreichbar — nach außen nicht sichtbar. Proxy und Admin-Oberfläche sind direkt auf den Host-Ports 8000 und 8001 verfügbar.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama als Container, SQLite
+
+Ollama und llmproxy laufen gemeinsam in Docker. Ollama ist nicht nach außen exposed.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama als Container, PostgreSQL
+
+Für Produktionsumgebungen mit externer Datenbank.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client-Konfiguration
+
+Den Proxy als OpenAI-kompatibler Endpunkt konfigurieren:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <angelegter API-Key aus der Admin-Oberfläche>
+```
@@ -9,7 +9,7 @@ FROM python:3.12-slim
 WORKDIR /app

 COPY backend/requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir -r requirements.txt psycopg2-binary

 COPY backend/ backend/
 COPY --from=frontend-builder /app/frontend/dist frontend/dist
@@ -1,6 +1,6 @@
 # Ollama Proxy mit API-Keys und Quotas

-Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung, Quota-Management und Web-Admin-Oberfläche.
+Ollama bietet von sich aus keine Authentifizierung — wer die API erreicht, kann sie nutzen. Dieses Projekt löst das Problem: Ollama bleibt an `localhost` gebunden und ist von außen nicht erreichbar. Vorgeschaltet läuft ein Proxy (Port 8000), der jeden Request auf einen gültigen API-Key prüft und optional Token- sowie Request-Quoten pro Key durchsetzt. Eine Web-Admin-Oberfläche (Port 8001) erlaubt das Verwalten von Keys, Quoten und Ollama-Einstellungen.

 ## Features

@@ -8,30 +8,34 @@ Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung, Quota-Management un
 - Optionales Ablaufdatum pro API-Key
 - Quota-Management mit getrennten Tages- und Monatslimits (Tokens & Requests)
 - Token-Zählung via tiktoken, Reset-Grenzen in der Zeitzone Europe/Berlin
- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Proxy-Info)
- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt
+- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Verbrauchsanzeige)
+- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt mit Streaming und Tool-Use
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+- Docker-Image auf DockerHub: `mediaeng/llmproxy`

 ## Sicherheit

- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`)
- Admin-API bindet lokal auf `127.0.0.1` (nicht von außen erreichbar)
+- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`) — alle API-Endpunkte erfordern den Token
 - API-Keys als SHA-256-Hash in der DB — Plaintext nur einmalig bei Erstellung
 - Quota-Check atomar mit `SELECT FOR UPDATE` (kein TOCTOU-Race)
- CORS-Origins konfigurierbar via `ALLOWED_ORIGINS`
+- Admin-Port 8001 über `ADMIN_HOST=127.0.0.1` auf lokalen Zugriff beschränkbar

 ## Konfiguration

-`.env`-Datei im Projektverzeichnis anlegen (Vorlage: `.env.example`):
+`.env`-Datei im Projektverzeichnis anlegen:

 ```env
 ADMIN_PASSWORD=change-me
 PROXY_HOST=0.0.0.0
 PROXY_PORT=8000
+ADMIN_HOST=0.0.0.0
 ADMIN_PORT=8001
 DATABASE_URL=sqlite:///./test.db
 OLLAMA_URL=http://localhost:11434
 DEFAULT_MODEL=llama3
 APP_TZ=Europe/Berlin
+LOG_FILE=logs/usage.log
 ```

 | Variable | Standard | Beschreibung |
@@ -39,26 +43,17 @@ APP_TZ=Europe/Berlin
 | `ADMIN_PASSWORD` | — | Passwort für die Admin-Oberfläche (**Pflicht**) |
 | `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxys |
 | `PROXY_PORT` | `8000` | Port des Proxys |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (z. B. `127.0.0.1` für lokalen Zugriff) |
 | `ADMIN_PORT` | `8001` | Port der Admin-API |
-| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring |
+| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring (SQLite oder PostgreSQL) |
 | `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz (auch in der UI änderbar) |
 | `DEFAULT_MODEL` | `llama3` | Standard-Modell für `/v1/chat/completions` (auch in der UI änderbar) |
 | `APP_TZ` | `Europe/Berlin` | Zeitzone für tägliche/monatliche Quota-Resets |
-| `ALLOWED_ORIGINS` | `http://localhost:5173` | Kommagetrennte CORS-Origins |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ALLOWED_ORIGINS` | `http://localhost:5173` | CORS-Origins (nur für Entwicklung relevant) |

 ## Entwicklung (lokal)

-```bash
-cp .env.example .env
-# ADMIN_PASSWORD in .env setzen
-
-./start.sh
-```
-
-Das Script prüft alle Ports auf Belegung, aktiviert automatisch eine vorhandene `.venv`, initialisiert die Datenbank und startet Proxy, Admin-API und Vite-Dev-Server.
-
-Admin-Oberfläche: `http://localhost:5173`
-
 ### Voraussetzungen

 - Python 3.12+ mit virtualenv
@@ -68,59 +63,117 @@ Admin-Oberfläche: `http://localhost:5173`
 python -m venv .venv
 source .venv/bin/activate
 pip install -r backend/requirements-dev.txt
-
 cd frontend && npm install
 ```

+### Starten
+
+**Per Script:**
+```bash
+cp .env.example .env   # ADMIN_PASSWORD setzen
+./start.sh
+```
+
+**Per PyCharm:** Run-Config „Dev" starten (startet Proxy, Admin-API und Vite-Dev-Server gemeinsam).
+
+Das Script prüft alle Ports auf Belegung, initialisiert die Datenbank und startet alle drei Dienste.
+
+Admin-Oberfläche: `http://localhost:5173`
+
 ## Produktion (Docker)

-### Image bauen
+### Docker Compose (empfohlen)

 ```bash
-docker build -t llm-quota .
+docker compose up -d
 ```

-### Container starten
+Zieht das Image von DockerHub und lädt Variablen aus `.env`.
+
+Das Setup verwendet `network_mode: host`: Der Container teilt den Netzwerkstack des Hosts, statt ein eigenes virtuelles Netzwerk zu bekommen. Das ist hier aus zwei Gründen die richtige Wahl:
+
+1. **Ollama soll nicht von außen erreichbar sein.** Ollama läuft auf dem Host und ist an `127.0.0.1:11434` gebunden — nur lokal erreichbar. Mit einem eigenen Container-Netzwerk (Bridge-Mode) wäre `localhost` aus Sicht des Containers der Container selbst, nicht der Host. Die übliche Alternative (`host.docker.internal` + `extra_hosts`) ist auf Linux unzuverlässig.
+
+2. **Kein doppeltes Port-Mapping nötig.** Mit `network_mode: host` sind Port 8000 und 8001 direkt auf dem Host verfügbar, ohne `ports:`-Einträge in der Compose-Datei.
+
+### Image selbst bauen und pushen

 ```bash
-docker run -d \
-  -p 8000:8000 \
-  -p 8001:8001 \
-  -e ADMIN_PASSWORD=geheim \
-  -e OLLAMA_URL=http://host.docker.internal:11434 \
-  -e DATABASE_URL=sqlite:///./data/quota.db \
-  -v $(pwd)/data:/app/backend/data \
-  --name llm-quota \
-  llm-quota
+./build_push.sh
 ```

-| Port | Dienst |
-|------|--------|
-| `8000` | Proxy (für LLM-Clients) |
-| `8001` | Admin-API + Admin-Oberfläche |
+Das Script zeigt den aktuellen Git-Tag, bietet an einen neuen zu setzen, baut das Image für `linux/arm64` und pusht zu `mediaeng/llmproxy`.

-Admin-Oberfläche: `http://localhost:8001`
+### Port 8001 (Admin)

-### Mit PostgreSQL
+Alle Admin-Endpunkte erfordern das `ADMIN_PASSWORD` — der Token ist der primäre Schutz. Für zusätzliche Härtung lässt sich die Admin-API auf lokalen Zugriff beschränken:

-```bash
-docker run -d \
-  -p 8000:8000 \
-  -p 8001:8001 \
-  -e ADMIN_PASSWORD=geheim \
-  -e DATABASE_URL=postgresql://user:pass@db-host:5432/llm_quota \
-  -e OLLAMA_URL=http://ollama:11434 \
-  llm-quota
+```env
+ADMIN_HOST=127.0.0.1
 ```

-> **Hinweis:** Im Container bindet die Admin-API auf `0.0.0.0`. Port 8001 sollte nicht öffentlich exponiert werden — entweder per Firewall absichern oder hinter einem Reverse-Proxy (nginx, Caddy) betreiben.
+Bei `network_mode: host` (Produktions-Standard) ist das die einzig wirksame Methode — Docker-Port-Mapping greift dort nicht.
+
+### HTTPS via Reverse-Proxy (ungetestet)
+
+Wer Proxy und Admin-Oberfläche per HTTPS bereitstellen will, kann einen weiteren Reverse-Proxy (z. B. Nginx oder Caddy) vorschalten. Bei `network_mode: host` lauschen beide Dienste direkt auf dem Host, Nginx/Caddy proxyen auf `localhost`.
+
+**Caddy** (empfohlen — automatisches TLS via Let's Encrypt):
+
+```
+llm.example.com {
+    reverse_proxy localhost:8000 {
+        flush_interval -1
+    }
+}
+
+llm-admin.example.com {
+    reverse_proxy localhost:8001
+}
+```
+
+**Nginx** (mit Certbot-Zertifikaten):
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name llm.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
+
+    location / {
+        proxy_pass         http://127.0.0.1:8000;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_buffering    off;   # nötig für Streaming
+        proxy_cache        off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name llm-admin.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm-admin.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm-admin.example.com/privkey.pem;
+
+    location / {
+        proxy_pass       http://127.0.0.1:8001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+Clients konfigurieren dann `https://llm.example.com/v1` als Base URL.

 ## Proxy-Endpunkte (Port 8000)

 Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header.

 ```bash
-curl -X POST http://localhost:8000/api/chat \
+curl -X POST http://localhost:8000/v1/chat/completions \
  -H "Authorization: Bearer sk-xxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}]}'
@@ -128,12 +181,12 @@ curl -X POST http://localhost:8000/api/chat \

 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/generate` | POST | Ollama generate |
-| `/api/chat` | POST | Ollama chat |
+| `/v1/chat/completions` | POST | Chat (OpenAI-Format, Streaming + Tool-Use) |
+| `/v1/models` | GET | Modelle (OpenAI-Format) |
+| `/api/generate` | POST | Ollama generate (nativ) |
+| `/api/chat` | POST | Ollama chat (nativ) |
 | `/api/tags` | GET | Verfügbare Modelle |
 | `/api/versions` | GET | Ollama-Version |
-| `/v1/models` | GET | Modelle (OpenAI-Format) |
-| `/v1/chat/completions` | POST | Chat (OpenAI-Format) |

 ## Admin-API (Port 8001)

@@ -141,10 +194,12 @@ Alle Endpunkte erfordern `Authorization: Bearer <ADMIN_PASSWORD>`.

 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/api-keys` | GET | Alle API-Keys auflisten |
+| `/api/api-keys` | GET | Alle API-Keys mit Verbrauchsdaten |
 | `/api/api-keys` | POST | Neuen API-Key erstellen |
+| `/api/api-keys/{id}/quota` | PATCH | Limits eines Keys aktualisieren |
+| `/api/api-keys/{id}/activate` | PUT | API-Key aktivieren |
 | `/api/api-keys/{id}/deactivate` | PUT | API-Key deaktivieren |
-| `/api/api-keys/{id}/quota` | PATCH | Quota eines Keys aktualisieren |
+| `/api/api-keys/{id}` | DELETE | API-Key löschen |
 | `/api/settings` | GET/PUT | Ollama-URL und Standard-Modell |
 | `/api/ollama-models` | GET | Verfügbare Modelle von Ollama |
 | `/api/proxy-info` | GET | Lokaler Proxy-Endpunkt |
@@ -168,22 +223,27 @@ llm_quota/
 │   ├── schemas.py           # Pydantic-Schemas
 │   ├── crud.py              # DB-Operationen, Token-Zählung, Quota-Logik
 │   ├── init_db.py           # Tabellen anlegen & Settings seeden
-│   ├── setup_admin.py       # Standard-API-Key erstellen
 │   ├── requirements.txt     # Produktiv-Dependencies
 │   ├── requirements-dev.txt # Test-Dependencies
 │   └── tests/
-│       ├── conftest.py      # Fixtures
-│       ├── test_auth.py     # Authentifizierungs-Tests
-│       └── test_quota.py    # Quota-, Token- und Ablauf-Tests
+│       ├── conftest.py
+│       ├── test_auth.py
+│       └── test_quota.py
 ├── frontend/
 │   └── src/
 │       ├── main.jsx         # React-Admin-UI
 │       └── styles.css
+├── .idea/runConfigurations/
+│   └── Dev.xml              # PyCharm Run-Config
 ├── Dockerfile
+├── docker-compose.yml       # Produktiv-Start mit DockerHub-Image
 ├── docker-entrypoint.sh
 ├── .dockerignore
-├── .env.example
 ├── start.sh                 # Entwicklungs-Startscript
+├── run_dev.py               # Entwicklungs-Runner für PyCharm
+├── build_push.sh            # Docker-Build & Push zu DockerHub
+├── DOCKERHUB.md             # DockerHub-Beschreibung (deutsch)
+├── DOCKERHUB.en.md          # DockerHub-Beschreibung (englisch)
 └── .gitignore
 ```

@@ -8,7 +8,7 @@ from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from database import get_db
 import crud, schemas
-from models import APIKey as APIKeyModel
+from models import APIKey as APIKeyModel, Usage as UsageModel

 app = FastAPI(title="Ollama Proxy Admin API")

@@ -31,13 +31,26 @@ def require_admin_auth(request: Request):
    if not secrets.compare_digest(token, ADMIN_PASSWORD):
        raise HTTPException(status_code=401, detail="Invalid admin password")

-@app.get("/api/api-keys", response_model=list[schemas.APIKey])
+@app.get("/api/api-keys", response_model=list[schemas.APIKeyWithUsage])
 async def read_api_keys(
    skip: int = 0, limit: int = 100,
    db: Session = Depends(get_db),
    _ = Depends(require_admin_auth),
 ):
-    return db.query(APIKeyModel).offset(skip).limit(limit).all()
+    keys = db.query(APIKeyModel).offset(skip).limit(limit).all()
+    result = []
+    for key in keys:
+        item = schemas.APIKeyWithUsage.model_validate(key)
+        usage = db.query(UsageModel).filter(UsageModel.api_key_id == key.id).first()
+        if usage:
+            item.tokens_used_today = usage.tokens_used_today or 0
+            item.tokens_used_month = usage.tokens_used_month or 0
+            item.requests_today = usage.requests_today or 0
+            item.requests_month = usage.requests_month or 0
+            item.daily_reset_at = usage.daily_reset_at
+            item.monthly_reset_at = usage.monthly_reset_at
+        result.append(item)
+    return result

@app.post("/api/api-keys", response_model=schemas.APIKeyCreated)
 async def create_api_key(
@@ -87,6 +100,32 @@ async def deactivate_api_key(
    db.commit()
    return {"message": "API key deactivated"}

+@app.put("/api/api-keys/{api_key_id}/activate")
+async def activate_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db_key.is_active = True
+    db.commit()
+    return {"message": "API key activated"}
+
+@app.delete("/api/api-keys/{api_key_id}")
+async def delete_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.delete(db_key)
+    db.commit()
+    return {"message": "API key deleted"}
+
@app.get("/api/proxy-info")
 async def get_proxy_info(_ = Depends(require_admin_auth)):
    host = os.getenv("PROXY_HOST", "0.0.0.0")
@@ -107,20 +146,25 @@ async def update_settings(
    db: Session = Depends(get_db),
    _ = Depends(require_admin_auth),
 ):
-    crud.set_setting(db, "ollama_url", settings.ollama_url)
+    ollama_url = settings.ollama_url.rstrip('/').removesuffix('/v1')
+    crud.set_setting(db, "ollama_url", ollama_url)
    crud.set_setting(db, "default_model", settings.default_model)
-    return settings
+    return schemas.Settings(ollama_url=ollama_url, default_model=settings.default_model)

@app.get("/api/ollama-models")
-async def get_ollama_models(db: Session = Depends(get_db), _ = Depends(require_admin_auth)):
-    ollama_url = crud.get_setting(db, "ollama_url", "http://localhost:11434")
+async def get_ollama_models(
+    url: str = None,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = url or crud.get_setting(db, "ollama_url", "http://localhost:11434")
    try:
        async with httpx.AsyncClient(timeout=5.0) as client:
            response = await client.get(f"{ollama_url}/api/tags")
        models = [m["name"] for m in response.json().get("models", [])]
+        return {"models": models, "reachable": True}
    except Exception:
-        models = []
-    return {"models": models}
+        return {"models": [], "reachable": False}

 # Statisches Frontend ausliefern (nur im Produktivbetrieb, wenn dist/ existiert)
 _dist = Path(__file__).parent.parent / "frontend" / "dist"
@@ -40,6 +40,7 @@ def create_api_key(
    db_key = APIKey(
        name=name,
        key=_hash_api_key(raw_key),
+        key_prefix=raw_key[:12],
        expires_at=expires_at,
        daily_tokens=daily_tokens,
        monthly_tokens=monthly_tokens,
@@ -1,135 +1,192 @@
-import time
-import uuid
+import logging
+import os
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
 from fastapi import FastAPI, HTTPException, Depends, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from sqlalchemy.orm import Session
-from database import get_db, SessionLocal
+from database import get_db
 import crud
 import httpx
-import os

-app = FastAPI(title="Ollama Proxy")
+_log_dir = Path(os.getenv("LOG_FILE", "logs/usage.log")).parent
+_log_dir.mkdir(parents=True, exist_ok=True)
+_fmt = logging.Formatter("%(asctime)s | %(message)s", datefmt="%Y-%m-%d %H:%M:%S")

-async def proxy_request(url: str, method: str = "GET", json_data: dict = None, headers: dict = None):
-    async with httpx.AsyncClient() as client:
-        response = await client.request(method=method, url=url, json=json_data, headers=headers)
-        return response
+# Rotating usage log (8 KB per file, 3 backups)
+_usage_handler = RotatingFileHandler(str(_log_dir / "usage.log"), maxBytes=8192, backupCount=3, encoding="utf-8")
+_usage_handler.setFormatter(_fmt)
+usage_log = logging.getLogger("proxy.usage")
+usage_log.setLevel(logging.INFO)
+usage_log.addHandler(_usage_handler)
+usage_log.propagate = False

-@app.middleware("http")
-async def authenticate_and_quota(request: Request, call_next):
+# Rotating error log (64 KB per file, 5 backups)
+_error_handler = RotatingFileHandler(str(_log_dir / "error.log"), maxBytes=65536, backupCount=5, encoding="utf-8")
+_error_handler.setFormatter(_fmt)
+error_log = logging.getLogger("proxy.error")
+error_log.setLevel(logging.ERROR)
+error_log.addHandler(_error_handler)
+error_log.propagate = False
+
+def _content_to_str(content) -> str:
+    """Normalize OpenAI content: string or array of content parts → plain string."""
+    if isinstance(content, list):
+        return " ".join(
+            part.get("text", "") if isinstance(part, dict) else str(part)
+            for part in content
+        )
+    return content or ""
+
+
+def _last_user_msg(messages: list, max_len: int = 120) -> str:
+    for msg in reversed(messages):
+        if msg.get("role") == "user":
+            text = _content_to_str(msg.get("content")).replace("\n", " ").strip()
+            return text[:max_len] + ("…" if len(text) > max_len else "")
+    return ""
+
+async def require_api_key(request: Request, db: Session = Depends(get_db)):
    auth_header = request.headers.get("Authorization", "")
    if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
+        api_key = auth_header[7:]
    elif auth_header.startswith("sk-"):
        api_key = auth_header
    else:
-        return JSONResponse(status_code=401, content={"detail": "Invalid or missing API key"})
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+    db_key = crud.verify_api_key(db, api_key)
+    if not db_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    request.state.api_key_id = db_key.id
+    request.state.api_key_name = db_key.name

-    # Uses its own session since middleware cannot use Depends
-    db = SessionLocal()
+app = FastAPI(title="Ollama Proxy", dependencies=[Depends(require_api_key)])
+
+@app.on_event("startup")
+def apply_env_settings():
+    """Write env-configured values into DB so they take effect until next restart."""
+    db = next(get_db())
    try:
-        db_key = crud.verify_api_key(db, api_key)
-        if not db_key:
-            return JSONResponse(status_code=401, content={"detail": "Invalid API key"})
-        request.state.api_key_id = db_key.id
+        if url := os.getenv("OLLAMA_URL"):
+            crud.set_setting(db, "ollama_url", url)
+        if model := os.getenv("DEFAULT_MODEL"):
+            crud.set_setting(db, "default_model", model)
+        db.commit()
    finally:
        db.close()

-    response = await call_next(request)
-    return response
+@app.exception_handler(Exception)
+async def unhandled_exception_handler(request: Request, exc: Exception):
+    error_log.error("Unhandled exception | %s %s | %s: %s",
+                    request.method, request.url.path, type(exc).__name__, exc, exc_info=exc)
+    return JSONResponse(status_code=500, content={"error": {"message": "Internal server error", "type": "server_error"}})
+
+async def proxy_request(url: str, method: str = "GET", json_data: dict = None):
+    async with httpx.AsyncClient(timeout=300.0) as client:
+        response = await client.request(method=method, url=url, json=json_data)
+        return response

@app.post("/api/generate")
 async def generate(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
    body = await request.json()
-
    prompt_tokens = crud.count_tokens(body.get("prompt", ""))
-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body, headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    prompt_preview = (body.get("prompt", "").replace("\n", " ").strip())[:120]
+    usage_log.info('%s | /api/generate | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, prompt_preview)
+    try:
+        response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/generate | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.post("/api/chat")
 async def chat(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
    body = await request.json()
+    messages = body.get("messages", [])
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in body.get("messages", []))
-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body, headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    usage_log.info('%s | /api/chat | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, _last_user_msg(messages))
+    try:
+        response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/chat | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.get("/api/tags")
-async def list_models(request: Request, db: Session = Depends(get_db)):
+async def list_models(db: Session = Depends(get_db)):
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/tags", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    response = await proxy_request(f"{ollama_url}/api/tags", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.get("/api/versions")
-async def versions(request: Request, db: Session = Depends(get_db)):
+async def versions(db: Session = Depends(get_db)):
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/versions", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    response = await proxy_request(f"{ollama_url}/api/versions", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.get("/v1/models")
-async def list_openai_models(request: Request, db: Session = Depends(get_db)):
+async def list_openai_models(db: Session = Depends(get_db)):
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/tags", method="GET", headers=dict(request.headers))
-    ollama_models = response.json()
-    openai_models = {
-        "object": "list",
-        "data": [
-            {
-                "id": model["name"],
-                "object": "model",
-                "created": int(model["modified_at"][:10].replace("-", "")) * 1000 if "modified_at" in model else 0,
-                "owned_by": "ollama"
-            }
-            for model in ollama_models.get("models", [])
-        ]
-    }
-    return JSONResponse(content=openai_models, status_code=200, headers=dict(response.headers))
+    response = await proxy_request(f"{ollama_url}/v1/models", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.post("/v1/chat/completions")
 async def openai_chat_completions(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
    default_model = crud.get_setting(db, "default_model", os.getenv("DEFAULT_MODEL", "llama3"))

    body = await request.json()
    messages = body.get("messages", [])
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in messages)
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    ollama_body = {
-        "model": body.get("model", default_model),
-        "messages": messages,
-        "stream": body.get("stream", False)
-    }
+    if "model" not in body:
+        body = {**body, "model": default_model}

-    response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=ollama_body, headers=dict(request.headers))
-    response_content = response.json().get("message", {}).get("content", "")
-    completion_tokens = crud.count_tokens(response_content)
+    model_name = body["model"]
+    usage_log.info('%s | /v1/chat/completions | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(messages))

-    openai_response = {
-        "id": f"chatcmpl-{uuid.uuid4().hex}",
-        "object": "chat.completion",
-        "created": int(time.time()),
-        "model": body.get("model", default_model),
-        "choices": [{"index": 0, "message": {"role": "assistant", "content": response_content}, "finish_reason": "stop"}],
-        "usage": {
-            "prompt_tokens": prompt_tokens,
-            "completion_tokens": completion_tokens,
-            "total_tokens": prompt_tokens + completion_tokens,
-        },
-    }
-    return JSONResponse(content=openai_response, status_code=200, headers={"Content-Type": "application/json"})
+    target = f"{ollama_url}/v1/chat/completions"
+
+    if body.get("stream"):
+        async def generate():
+            try:
+                async with httpx.AsyncClient(timeout=300.0) as client:
+                    async with client.stream("POST", target, json=body) as resp:
+                        async for chunk in resp.aiter_bytes():
+                            yield chunk
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/chat/completions | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    try:
+        response = await proxy_request(target, method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/chat/completions | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise
@@ -10,6 +10,7 @@ class APIKey(Base):
    id = Column(Integer, primary_key=True, index=True)
    name = Column(String)
    key = Column(String, unique=True, index=True)
+    key_prefix = Column(String)
    is_active = Column(Boolean, default=True)
    created_at = Column(DateTime(timezone=True), default=_now)
    expires_at = Column(DateTime(timezone=True), nullable=True)
@@ -14,6 +14,7 @@ class APIKey(BaseModel):
    id: int
    name: str
    key: str
+    key_prefix: Optional[str] = None
    is_active: bool
    created_at: datetime
    expires_at: Optional[datetime] = None
@@ -49,5 +50,16 @@ class UsageStats(BaseModel):
    daily_reset_at: Optional[datetime] = None
    monthly_reset_at: Optional[datetime] = None

+    class Config:
+        from_attributes = True
+
+class APIKeyWithUsage(APIKey):
+    tokens_used_today: int = 0
+    tokens_used_month: int = 0
+    requests_today: int = 0
+    requests_month: int = 0
+    daily_reset_at: Optional[datetime] = None
+    monthly_reset_at: Optional[datetime] = None
+
    class Config:
        from_attributes = True
@@ -0,0 +1,47 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+IMAGE=mediaeng/llmproxy
+PLATFORM=linux/arm64
+
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+HEAD_TAG=$(git tag --points-at HEAD | head -1)
+
+if [ -n "$HEAD_TAG" ]; then
+    echo "HEAD bereits getaggt: $HEAD_TAG"
+    read -rp "Neuer Tag [${HEAD_TAG}]: " INPUT
+    VERSION="${INPUT:-$HEAD_TAG}"
+else
+    echo "Letzter Tag: ${LAST_TAG:-kein Tag}"
+    read -rp "Neuer Tag: " INPUT
+    if [ -z "$INPUT" ]; then
+        echo "Kein Tag angegeben, breche ab."
+        exit 1
+    fi
+    VERSION="$INPUT"
+fi
+
+if [ "$VERSION" != "$HEAD_TAG" ]; then
+    git tag "$VERSION"
+    git push origin "$VERSION"
+    echo "Tag '$VERSION' gesetzt und gepusht."
+fi
+
+echo ""
+echo "Image   : $IMAGE"
+echo "Platform: $PLATFORM"
+echo "Tags    : $IMAGE:$VERSION  $IMAGE:latest"
+echo ""
+
+docker buildx build \
+    --platform "$PLATFORM" \
+    --push \
+    -t "$IMAGE:$VERSION" \
+    -t "$IMAGE:latest" \
+    .
+
+echo ""
+echo "Fertig. Gepusht:"
+echo "  docker pull $IMAGE:$VERSION"
+echo "  docker pull $IMAGE:latest"
@@ -1,24 +1,11 @@
-backend:
-  build:
-    context: ./backend
-    dockerfile: Dockerfile
-  ports:
-    - "8000:8000"
-  environment:
-    - DATABASE_URL=postgresql://ollama:password@db:5432/ollama_proxy
-    - OLLAMA_URL=http://ollama:11434
-    - SECRET_KEY=your-secret-key-change-me
-  depends_on:
-    - db
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - ./backend/test.db:/app/backend/test.db
+      - ./backend/logs:/app/backend/logs

-db:
-  image: postgres:16
-  environment:
-    - POSTGRES_USER=ollama
-    - POSTGRES_PASSWORD=password
-    - POSTGRES_DB=ollama_proxy
-  volumes:
-    - postgres_data:/var/lib/postgresql/data
-
-volumes:
-  postgres_data:
@@ -10,7 +10,7 @@ uvicorn main:app \
 PROXY_PID=$!

 uvicorn admin:app \
-    --host "0.0.0.0" \
+    --host "${ADMIN_HOST:-0.0.0.0}" \
    --port "${ADMIN_PORT:-8001}" &
 ADMIN_PID=$!

@@ -3,12 +3,40 @@ import ReactDOM from 'react-dom/client';
 import axios from 'axios';
 import './styles.css';

-const maskKey = (key) => `••••••••${key.slice(-4)}`;
+const displayKey = (prefix) => prefix ? `${prefix}••••••••` : '••••••••••••';

 function authHeaders(token) {
  return { Authorization: `Bearer ${token}` };
 }

+const fmtK = (n) => { const k = n / 1000; return k % 1 === 0 ? `${k}k` : `${k.toFixed(1)}k`; };
+
+function QuotaBar({ used, limit, isToken = false, since = null }) {
+  const fmt = isToken ? fmtK : (n) => n.toLocaleString('de-DE');
+  const sinceLabel = since
+    ? new Date(since).toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit' })
+    : null;
+
+  if (limit == null) return (
+    <div className="quota-cell">
+      <span className="quota-unlimited">∞</span>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+
+  const pct = Math.min(100, (used / limit) * 100);
+  const color = pct >= 90 ? '#e74c3c' : pct >= 70 ? '#e67e22' : '#27ae60';
+  return (
+    <div className="quota-cell">
+      <span className="quota-label">{fmt(used)} / {fmt(limit)}</span>
+      <div className="progress-bar">
+        <div className="progress-fill" style={{ width: `${pct}%`, backgroundColor: color }} />
+      </div>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+}
+
 function Login({ onLogin }) {
  const [password, setPassword] = useState('');
  const [error, setError] = useState(null);
@@ -51,20 +79,43 @@ const EMPTY_KEY_FORM = {
 function SettingsSection({ password }) {
  const [settings, setSettings] = useState(null);
  const [availableModels, setAvailableModels] = useState([]);
+  const [modelsLoading, setModelsLoading] = useState(false);
+  const [ollamaReachable, setOllamaReachable] = useState(true);
  const [proxyEndpoint, setProxyEndpoint] = useState(null);
  const [saved, setSaved] = useState(false);
  const [error, setError] = useState(null);

+  const fetchModels = async (url, currentModel) => {
+    setModelsLoading(true);
+    try {
+      const res = await axios.get('/api/ollama-models', {
+        headers: authHeaders(password),
+        params: url ? { url } : {},
+      });
+      const { models, reachable } = res.data;
+      setOllamaReachable(reachable);
+      setAvailableModels(models);
+      if (models.length > 0 && !models.includes(currentModel)) {
+        setSettings(s => ({ ...s, default_model: models[0] }));
+      }
+    } catch {
+      setOllamaReachable(false);
+      setAvailableModels([]);
+    } finally {
+      setModelsLoading(false);
+    }
+  };
+
  useEffect(() => {
    const headers = authHeaders(password);
    Promise.all([
      axios.get('/api/settings', { headers }),
-      axios.get('/api/ollama-models', { headers }),
      axios.get('/api/proxy-info', { headers }),
-    ]).then(([settingsRes, modelsRes, proxyRes]) => {
-      setSettings(settingsRes.data);
-      setAvailableModels(modelsRes.data.models);
+    ]).then(([settingsRes, proxyRes]) => {
+      const s = settingsRes.data;
+      setSettings(s);
      setProxyEndpoint(proxyRes.data.endpoint);
+      fetchModels(s.ollama_url, s.default_model);
    }).catch(() => setError('Einstellungen konnten nicht geladen werden.'));
  }, []);

@@ -96,17 +147,25 @@ function SettingsSection({ password }) {
        </div>
        <div className="settings-row">
          <label>Ollama-Endpunkt</label>
-          <input
-            type="url"
-            value={settings.ollama_url}
-            onChange={(e) => setSettings({ ...settings, ollama_url: e.target.value })}
-            placeholder="http://localhost:11434"
-            required
-          />
+          <div className="settings-input-wrap">
+            <input
+              type="url"
+              value={settings.ollama_url}
+              onChange={(e) => setSettings({ ...settings, ollama_url: e.target.value })}
+              onBlur={(e) => fetchModels(e.target.value, settings.default_model)}
+              placeholder="http://localhost:11434"
+              required
+            />
+            {!ollamaReachable && !modelsLoading && (
+              <div className="warning">⚠ Ollama nicht erreichbar unter {settings.ollama_url}</div>
+            )}
+          </div>
        </div>
        <div className="settings-row">
          <label>Standard-Modell</label>
-          {availableModels.length > 0 ? (
+          {modelsLoading ? (
+            <span className="settings-value">Lade Modelle…</span>
+          ) : availableModels.length > 0 ? (
            <select
              value={settings.default_model}
              onChange={(e) => setSettings({ ...settings, default_model: e.target.value })}
@@ -139,6 +198,8 @@ function App() {
  const [newKey, setNewKey] = useState(null);
  const [form, setForm] = useState(EMPTY_KEY_FORM);
  const [creating, setCreating] = useState(false);
+  const [editKey, setEditKey] = useState(null);
+  const [editForm, setEditForm] = useState({});

  useEffect(() => {
    if (!password) { setLoading(false); return; }
@@ -160,8 +221,8 @@ function App() {
    try {
      const payload = { name: form.name };
      if (form.expires_at)       payload.expires_at       = new Date(form.expires_at).toISOString();
-      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens);
-      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens);
+      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens) * 1000;
+      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens) * 1000;
      if (form.daily_requests)   payload.daily_requests   = Number(form.daily_requests);
      if (form.monthly_requests) payload.monthly_requests = Number(form.monthly_requests);

@@ -185,6 +246,53 @@ function App() {
    }
  };

+  const handleActivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/activate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Aktivieren.');
+    }
+  };
+
+  const handleDelete = async (id, name) => {
+    if (!window.confirm(`API-Key "${name}" wirklich löschen?`)) return;
+    try {
+      await axios.delete(`/api/api-keys/${id}`, { headers: authHeaders(password) });
+      if (editKey?.id === id) setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Löschen.');
+    }
+  };
+
+  const handleEdit = (key) => {
+    setEditKey(key);
+    setEditForm({
+      daily_tokens:     key.daily_tokens    != null ? key.daily_tokens / 1000    : '',
+      monthly_tokens:   key.monthly_tokens  != null ? key.monthly_tokens / 1000  : '',
+      daily_requests:   key.daily_requests  ?? '',
+      monthly_requests: key.monthly_requests ?? '',
+    });
+  };
+
+  const handleSaveEdit = async (e) => {
+    e.preventDefault();
+    try {
+      const payload = {
+        daily_tokens:     editForm.daily_tokens     !== '' ? Number(editForm.daily_tokens) * 1000     : null,
+        monthly_tokens:   editForm.monthly_tokens   !== '' ? Number(editForm.monthly_tokens) * 1000   : null,
+        daily_requests:   editForm.daily_requests   !== '' ? Number(editForm.daily_requests)   : null,
+        monthly_requests: editForm.monthly_requests !== '' ? Number(editForm.monthly_requests) : null,
+      };
+      await axios.patch(`/api/api-keys/${editKey.id}/quota`, payload, { headers: authHeaders(password) });
+      setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Speichern der Limits.');
+    }
+  };
+
  const logout = () => {
    sessionStorage.removeItem('admin_password');
    setPassword(null);
@@ -206,43 +314,76 @@ function App() {
      <section>
        <h2>Neuer API-Key</h2>
        <form onSubmit={handleCreate} className="create-form">
-          <input
-            placeholder="Name"
-            value={form.name}
-            onChange={(e) => setForm({ ...form, name: e.target.value })}
-            required
-          />
-          <input
-            type="date"
-            placeholder="Ablaufdatum (leer = unbegrenzt)"
-            value={form.expires_at}
-            onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
-          />
-          <input
-            type="number"
-            placeholder="Tokens/Tag (leer = unbegrenzt)"
-            value={form.daily_tokens}
-            onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
-          />
-          <input
-            type="number"
-            placeholder="Tokens/Monat"
-            value={form.monthly_tokens}
-            onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
-          />
-          <input
-            type="number"
-            placeholder="Requests/Tag"
-            value={form.daily_requests}
-            onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
-          />
-          <input
-            type="number"
-            placeholder="Requests/Monat"
-            value={form.monthly_requests}
-            onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
-          />
-          <button type="submit" disabled={creating}>Erstellen</button>
+          <div className="edit-form">
+            <label className="create-name">
+              Name
+              <small>&nbsp;</small>
+              <input
+                value={form.name}
+                onChange={(e) => setForm({ ...form, name: e.target.value })}
+                required
+                placeholder="z. B. alice"
+              />
+            </label>
+            <label className="create-date">
+              Ablaufdatum
+              <small>leer = unbegrenzt</small>
+              <input
+                type="date"
+                value={form.expires_at}
+                onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
+              />
+            </label>
+            <div className="create-btn-wrap">
+              <button type="submit" disabled={creating} className="btn-save">Erstellen</button>
+            </div>
+          </div>
+          <div className="edit-form">
+            <label>
+              Tokens/Tag (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_tokens}
+                onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Tokens/Monat (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_tokens}
+                onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Tag
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_requests}
+                onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Monat
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_requests}
+                onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
+              />
+            </label>
+          </div>
        </form>
        {newKey && (
          <div className="new-key-box">
@@ -258,41 +399,99 @@ function App() {
        <table>
          <thead>
            <tr>
-              <th>ID</th>
+              <th></th>
              <th>Name</th>
              <th>Key</th>
-              <th>Status</th>
              <th>Läuft ab</th>
-              <th>Tokens/Tag</th>
-              <th>Tokens/Monat</th>
-              <th>Req/Tag</th>
-              <th>Req/Monat</th>
+              <th className="th-quota">Tokens/Tag</th>
+              <th className="th-quota">Tokens/Monat</th>
+              <th className="th-quota">Req/Tag</th>
+              <th className="th-quota">Req/Monat</th>
              <th></th>
            </tr>
          </thead>
          <tbody>
            {apiKeys.map(key => (
-              <tr key={key.id}>
-                <td>{key.id}</td>
+              <tr key={key.id} className={editKey?.id === key.id ? 'row-editing' : ''}>
+                <td className="td-status">
+                  <span className={key.is_active ? 'status-active' : 'status-inactive'} title={key.is_active ? 'Aktiv' : 'Inaktiv'}>●</span>
+                </td>
                <td>{key.name}</td>
-                <td>{maskKey(key.key)}</td>
-                <td>{key.is_active ? 'Aktiv' : 'Inaktiv'}</td>
+                <td>{displayKey(key.key_prefix)}</td>
                <td>{key.expires_at ? new Date(key.expires_at).toLocaleDateString('de-DE', { timeZone: 'Europe/Berlin' }) : '∞'}</td>
-                <td>{key.daily_tokens ?? '∞'}</td>
-                <td>{key.monthly_tokens ?? '∞'}</td>
-                <td>{key.daily_requests ?? '∞'}</td>
-                <td>{key.monthly_requests ?? '∞'}</td>
-                <td>
-                  {key.is_active && (
-                    <button className="btn-danger" onClick={() => handleDeactivate(key.id)}>
-                      Deaktivieren
-                    </button>
+                <td><QuotaBar used={key.tokens_used_today} limit={key.daily_tokens} isToken since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.tokens_used_month} limit={key.monthly_tokens} isToken since={key.monthly_reset_at} /></td>
+                <td><QuotaBar used={key.requests_today} limit={key.daily_requests} since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.requests_month} limit={key.monthly_requests} since={key.monthly_reset_at} /></td>
+                <td className="action-cell">
+                  <button className="btn-icon btn-icon-edit" data-tooltip="Bearbeiten" onClick={() => handleEdit(key)}>✏</button>
+                  {key.is_active ? (
+                    <button className="btn-icon btn-icon-warn" data-tooltip="Deaktivieren" onClick={() => handleDeactivate(key.id)}>⏸</button>
+                  ) : (
+                    <button className="btn-icon btn-icon-ok" data-tooltip="Aktivieren" onClick={() => handleActivate(key.id)}>▶</button>
                  )}
+                  <button className="btn-icon btn-icon-danger" data-tooltip="Löschen" onClick={() => handleDelete(key.id, key.name)}>✕</button>
                </td>
              </tr>
            ))}
          </tbody>
        </table>
+
+        {editKey && (
+          <div className="edit-section">
+            <h3>Limits bearbeiten: <em>{editKey.name}</em></h3>
+            <form onSubmit={handleSaveEdit} className="edit-form">
+              <label>
+                Tokens/Tag (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, daily_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Tokens/Monat (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Tag
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_requests}
+                  onChange={(e) => setEditForm({ ...editForm, daily_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Monat
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_requests}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <div className="edit-actions">
+                <button type="submit" className="btn-save">Speichern</button>
+                <button type="button" className="btn-cancel" onClick={() => setEditKey(null)}>Abbrechen</button>
+              </div>
+            </form>
+          </div>
+        )}
      </section>
    </div>
  );
@@ -302,4 +501,4 @@ ReactDOM.createRoot(document.getElementById('root')).render(
  <React.StrictMode>
    <App />
  </React.StrictMode>
-);
+);
@@ -92,30 +92,37 @@ tr:hover {

 .create-form {
  display: flex;
-  flex-wrap: wrap;
-  gap: 10px;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.create-form .edit-form {
+  margin-bottom: 0;
+}
+
+.create-name {
+  flex: 0 0 auto !important;
+}
+
+.create-name input {
+  width: 200px;
+}
+
+.create-date {
+  flex: 0 0 auto !important;
+}
+
+.create-date input[type="date"] {
+  width: 150px;
+}
+
+.create-btn-wrap {
+  flex: 0 0 auto;
+  display: flex;
  align-items: flex-end;
 }

-.create-form input {
-  padding: 8px 10px;
-  border: 1px solid #ccc;
-  border-radius: 4px;
-  font-size: 14px;
-  flex: 1 1 160px;
-}
-
-.create-form button {
-  padding: 8px 20px;
-  background: #27ae60;
-  color: white;
-  border: none;
-  border-radius: 4px;
-  cursor: pointer;
-  font-size: 14px;
-}
-
-.create-form button:disabled {
+.create-form .btn-save:disabled {
  opacity: 0.6;
  cursor: not-allowed;
 }
@@ -187,6 +194,31 @@ tr:hover {
  font-size: 14px;
 }

+.settings-input-wrap {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.settings-input-wrap input {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+  box-sizing: border-box;
+}
+
+.warning {
+  color: #b8520a;
+  background: #fff3e0;
+  border: 1px solid #e67e22;
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-size: 13px;
+}
+
 .settings-form button {
  align-self: flex-start;
  padding: 8px 20px;
@@ -218,3 +250,205 @@ tr:hover {
  color: #999;
  font-size: 12px;
 }
+
+/* Quota progress bars */
+.th-quota {
+  width: 90px;
+}
+
+.quota-cell {
+  width: 100%;
+}
+
+.quota-label {
+  font-size: 12px;
+  color: #555;
+  white-space: nowrap;
+}
+
+.quota-unlimited {
+  color: #aaa;
+  font-size: 14px;
+}
+
+.quota-since {
+  display: block;
+  font-size: 10px;
+  color: #aaa;
+  margin-top: 2px;
+}
+
+.progress-bar {
+  height: 4px;
+  background: #e2e8f0;
+  border-radius: 2px;
+  margin-top: 4px;
+}
+
+.progress-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.3s ease;
+}
+
+/* Edit form */
+.td-status {
+  width: 20px;
+  text-align: center;
+}
+
+.status-active  { color: #27ae60; font-size: 12px; }
+.status-inactive { color: #bdc3c7; font-size: 12px; }
+
+.btn-icon {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px 4px;
+  margin-right: 2px;
+  border-radius: 3px;
+  line-height: 1;
+  position: relative;
+}
+
+.btn-icon:hover {
+  background: rgba(0, 0, 0, 0.06);
+}
+
+.btn-icon-edit   { color: #2980b9; }
+.btn-icon-warn   { color: #e67e22; }
+.btn-icon-ok     { color: #27ae60; }
+.btn-icon-danger { color: #e74c3c; }
+
+.btn-icon::after {
+  content: attr(data-tooltip);
+  position: absolute;
+  bottom: calc(100% + 8px);
+  left: 50%;
+  transform: translateX(-50%);
+  background: #2c3e50;
+  color: white;
+  padding: 5px 10px;
+  border-radius: 5px;
+  font-size: 12px;
+  font-weight: 400;
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon::before {
+  content: '';
+  position: absolute;
+  bottom: calc(100% + 2px);
+  left: 50%;
+  transform: translateX(-50%);
+  border: 5px solid transparent;
+  border-top-color: #2c3e50;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon:hover::after,
+.btn-icon:hover::before {
+  opacity: 1;
+}
+
+.action-cell {
+  white-space: nowrap;
+  position: relative;
+  overflow: visible;
+}
+
+.row-editing {
+  background: #eaf4fb !important;
+}
+
+.edit-section {
+  margin-top: 20px;
+  padding: 16px 20px;
+  background: #f0f7ff;
+  border: 1px solid #3498db;
+  border-radius: 6px;
+}
+
+.edit-section h3 {
+  margin: 0 0 14px;
+  font-size: 15px;
+  color: #2c3e50;
+  font-weight: 600;
+}
+
+.edit-section h3 em {
+  font-style: normal;
+  color: #2980b9;
+}
+
+.edit-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px;
+  align-items: flex-end;
+}
+
+.edit-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  font-size: 13px;
+  font-weight: 500;
+  color: #34495e;
+}
+
+.edit-form label small {
+  font-weight: 400;
+  color: #999;
+  font-size: 11px;
+}
+
+.edit-form input {
+  padding: 6px 8px;
+  border: 1px solid #bdc3c7;
+  border-radius: 4px;
+  font-size: 14px;
+  width: 130px;
+}
+
+.edit-actions {
+  display: flex;
+  gap: 8px;
+  padding-bottom: 2px;
+}
+
+.btn-save {
+  padding: 6px 18px;
+  background: #27ae60;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-save:hover {
+  background: #219a52;
+}
+
+.btn-cancel {
+  padding: 6px 18px;
+  background: #95a5a6;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-cancel:hover {
+  background: #7f8c8d;
+}
@@ -5,6 +5,7 @@ export default defineConfig({
  plugins: [react()],
  clearScreen: false,
  server: {
+    open: true,
    proxy: {
      '/api/api-keys': 'http://localhost:8001',
      '/api/settings': 'http://localhost:8001',
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Dev runner: startet Proxy, Admin-API und Frontend gemeinsam."""
+import os
+import sys
+import signal
+import subprocess
+import threading
+from pathlib import Path
+
+
+def load_env(path: Path):
+    if not path.exists():
+        return
+    for line in path.read_text(encoding='utf-8').splitlines():
+        line = line.strip()
+        if line and not line.startswith('#') and '=' in line:
+            key, _, val = line.partition('=')
+            os.environ.setdefault(key.strip(), val.strip().strip('"\''))
+
+
+def pipe_output(proc: subprocess.Popen, label: str, color: str):
+    reset = '\033[0m'
+    prefix = f'\033[{color}m[{label}]{reset} '
+    for raw in iter(proc.stdout.readline, b''):
+        sys.stdout.write(prefix + raw.decode(errors='replace'))
+        sys.stdout.flush()
+
+
+def main():
+    root = Path(__file__).parent
+    load_env(root / '.env')
+
+    if not os.environ.get('ADMIN_PASSWORD'):
+        print('Fehler: ADMIN_PASSWORD nicht gesetzt (siehe .env)')
+        sys.exit(1)
+
+    python  = root / '.venv' / 'bin' / 'python'
+    backend = root / 'backend'
+    frontend = root / 'frontend'
+
+    proxy_host = os.environ.get('PROXY_HOST', '0.0.0.0')
+    proxy_port = os.environ.get('PROXY_PORT', '8000')
+    admin_host = os.environ.get('ADMIN_HOST', '127.0.0.1')
+    admin_port = os.environ.get('ADMIN_PORT', '8001')
+
+    print('Initialisiere Datenbank...')
+    subprocess.run([str(python), 'init_db.py'], cwd=backend, check=True)
+
+    print(f'Starte Proxy      → http://{proxy_host}:{proxy_port}')
+    print(f'Starte Admin-API  → http://{admin_host}:{admin_port}')
+    print('Starte Frontend   → http://localhost:5173')
+
+    env = {**os.environ, 'PYTHONUNBUFFERED': '1'}
+
+    procs = [
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'main:app', '--reload',
+             '--host', proxy_host, '--port', proxy_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Proxy   ', '34'),  # blau
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'admin:app', '--reload',
+             '--host', admin_host, '--port', admin_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Admin   ', '33'),  # gelb
+        (subprocess.Popen(
+            ['npm', 'run', 'dev'],
+            cwd=frontend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        ), 'Frontend', '32'),  # grün
+    ]
+
+    for proc, label, color in procs:
+        threading.Thread(target=pipe_output, args=(proc, label, color), daemon=True).start()
+
+    def stop(*_):
+        for p, _, _ in procs:
+            p.terminate()
+
+    signal.signal(signal.SIGINT, stop)
+    signal.signal(signal.SIGTERM, stop)
+
+    for p, _, _ in procs:
+        p.wait()
+
+
+if __name__ == '__main__':
+    main()
@@ -21,6 +21,7 @@ fi

 PROXY_HOST=${PROXY_HOST:-0.0.0.0}
 PROXY_PORT=${PROXY_PORT:-8000}
+ADMIN_HOST=${ADMIN_HOST:-127.0.0.1}
 ADMIN_PORT=${ADMIN_PORT:-8001}
 FRONTEND_PORT=5173

@@ -60,9 +61,8 @@ cd backend
 python3 -m uvicorn main:app --reload --host "$PROXY_HOST" --port "$PROXY_PORT" &
 PIDS+=($!)

-# Admin-API immer nur lokal erreichbar (Host nicht konfigurierbar)
-echo "Starte Admin-API auf 127.0.0.1:${ADMIN_PORT}..."
-python3 -m uvicorn admin:app --reload --host 127.0.0.1 --port "$ADMIN_PORT" &
+echo "Starte Admin-API auf ${ADMIN_HOST}:${ADMIN_PORT}..."
+python3 -m uvicorn admin:app --reload --host "$ADMIN_HOST" --port "$ADMIN_PORT" &
 PIDS+=($!)
 cd ..

@@ -75,7 +75,7 @@ PIDS+=($!)
 cd ..

 echo "Backend läuft (Port $PROXY_PORT)"
-echo "Admin-API läuft (Port $ADMIN_PORT, nur lokal)"
+echo "Admin-API läuft (${ADMIN_HOST}:${ADMIN_PORT})"
 echo "Admin-Oberfläche: http://localhost:$FRONTEND_PORT"

 wait
Author	SHA1	Message	Date
Oliver Hofmann	256bafe30d	Explain network_mode: host motivation in README	2026-05-07 16:14:44 +02:00
Oliver Hofmann	555d9899fe	Fix build_push.sh tag detection	2026-05-07 16:11:50 +02:00
Oliver Hofmann	31504d1a5b	Remove DOCKERHUB.md reference from README	2026-05-07 16:09:22 +02:00
Oliver Hofmann	2e7b13227d	Make ADMIN_HOST consistent across dev and prod	2026-05-07 16:08:05 +02:00
Oliver Hofmann	5469981eb5	Add ADMIN_HOST to env tables and .env example	2026-05-07 16:04:23 +02:00
Oliver Hofmann	a1e293b1d7	Add ADMIN_HOST env var, restructure docs - docker-entrypoint.sh: Admin-API bindet auf ADMIN_HOST (default 0.0.0.0) statt hardcoded 0.0.0.0 — ermöglicht Einschränkung auf 127.0.0.1 - README: Zweck-Beschreibung, HTTPS-Reverse-Proxy-Abschnitt (Caddy/Nginx), Port-8001-Abschnitt korrigiert (Docker-Port-Mapping greift bei network_mode: host nicht), ADMIN_HOST in Konfig-Tabelle ergänzt - DOCKERHUB.md / DOCKERHUB.en.md: Auf drei Szenarien reduziert (network_mode: host, Ollama als Container + SQLite/PostgreSQL); host.docker.internal-Varianten entfernt - review_priorities.md: gelöscht (alle Punkte behoben)	2026-05-07 16:03:03 +02:00
hofmannol	9f92c09586	Add container_name, remove ineffective extra_hosts with network_mode host	2026-05-07 15:09:04 +02:00
hofmannol	3974010156	Use network_mode: host so container can reach Ollama on 127.0.0.1	2026-05-07 13:58:26 +02:00
hofmannol	8d3f9a7661	Fix OpenAI array content, add error logging, Ollama reachability warning - Normalize OpenAI array-format content to string to fix connection reset - Add error.log with rotating handler for proxy and stream errors - Add global unhandled exception handler returning JSON 500 - Write OLLAMA_URL/DEFAULT_MODEL env vars to DB on startup (reset on restart) - Add extra_hosts to docker-compose.yml for host.docker.internal on Linux - Show warning in admin UI when Ollama URL is unreachable - Return reachable: true/false from /api/ollama-models endpoint	2026-05-07 11:43:17 +02:00
Oliver Hofmann	280b3b0762	Add open: true to Vite dev server config	2026-04-29 17:13:14 +02:00
Oliver Hofmann	89661dafcc	Update README: new endpoints, Docker Hub, streaming, PyCharm config, port 8001 security	2026-04-29 10:19:31 +02:00
Oliver Hofmann	3ccc7f325d	Explain port 8001 security model in docs	2026-04-29 10:17:59 +02:00
Oliver Hofmann	25f19b6ada	Show reset date below quota progress bars in admin UI	2026-04-29 09:55:25 +02:00
Oliver Hofmann	5b97ed0ef7	Expose port 8001 on 127.0.0.1 only, explain why in docs	2026-04-29 09:52:13 +02:00
Oliver Hofmann	222b204d4b	build_push.sh: show current tag, offer to set new one before build	2026-04-29 09:36:50 +02:00
Oliver Hofmann	9910e6e062	Exclude .claude from Docker build context	2026-04-29 09:35:17 +02:00
Oliver Hofmann	6e704da86b	Expand .dockerignore with standard entries	2026-04-29 09:34:19 +02:00
Oliver Hofmann	bd0dc0478f	Add local docker-compose pulling from DockerHub with SQLite and .env	2026-04-29 09:33:04 +02:00
Oliver Hofmann	92fd66381f	Add English version of DockerHub README	2026-04-29 09:19:28 +02:00
Oliver Hofmann	c46c1c2b12	Clarify that Ollama can run remotely, not just on Docker host	2026-04-29 08:51:23 +02:00
Oliver Hofmann	d243523906	Split host-Ollama compose into SQLite and PostgreSQL variants	2026-04-29 08:47:40 +02:00
Oliver Hofmann	2319434b0f	Add host-Ollama compose variant, fix leftover port 8001 exposure	2026-04-29 08:43:54 +02:00
Oliver Hofmann	7912431ffb	Remove ALLOWED_ORIGINS from DockerHub docs (dev-only setting)	2026-04-29 08:38:38 +02:00
Oliver Hofmann	114c45dc7e	Remove port 8001 exposure from all Docker examples	2026-04-29 08:36:59 +02:00
Oliver Hofmann	6f67f29f68	Fix depends_on syntax in PostgreSQL compose example	2026-04-29 08:31:25 +02:00
Oliver Hofmann	3b7c88bf2c	Install psycopg2-binary in Dockerfile only, not in dev requirements	2026-04-29 08:30:16 +02:00
Oliver Hofmann	03712fe401	Add DockerHub README with usage, env vars and compose examples	2026-04-29 08:26:47 +02:00
Oliver Hofmann	a0512b3b2b	Replace build_push.py with build_push.sh, use shell script run config	2026-04-29 08:23:07 +02:00
Oliver Hofmann	511e85ea79	Add Docker build/push run config for arm64	2026-04-29 08:20:15 +02:00
Oliver Hofmann	cdaec894d8	Add PyCharm Dev run config and dev runner script - run_dev.py: starts proxy, admin and frontend together with colored output per process; handles SIGTERM from PyCharm Stop button - .idea/runConfigurations/Dev.xml: PyCharm Python run config - .gitignore: allow Dev.xml via layered negation pattern - vite.config.js: open browser automatically on dev server start	2026-04-29 08:14:33 +02:00
Oliver HofmannandClaude Sonnet 4.6	dd8f69ecb6	Proxy fixes, streaming support, Admin-UI overhaul Backend: - Fix Content-Length mismatch by not forwarding client headers to Ollama - Proxy /v1/chat/completions directly to Ollama's OpenAI-compatible endpoint (eliminates manual Ollama↔OpenAI format conversion, fixes tool use) - Add streaming support via SSE passthrough - Fix ollama_url /v1 suffix stripped on save - Replace BaseHTTPMiddleware with FastAPI global dependency (fixes double logging) - Add rotating usage log (8 KB, logs key name + model + token estimate + prompt preview) - Add httpx timeout 300s - Add activate and delete endpoints for API keys - Return usage data (tokens/requests) in GET /api/api-keys Frontend: - Admin table: remove ID column, status as icon, icon-only action buttons with CSS tooltips - Add activate + delete buttons; edit available for inactive keys too - Quota columns: fixed equal width, progress bars with k-unit formatting - Create form: structured layout matching edit form style - Edit form: token inputs in k units (÷1000 display, ×1000 on save) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-29 07:48:10 +02:00
Oliver Hofmann	c62cafc202	Store key_prefix for readable key display instead of masked hash The last-4 of the SHA-256 hash was meaningless for identification. Now storing the first 12 chars of the plaintext key as key_prefix, displayed as 'sk-aBcDeFgH••••••••' — consistent with what the user sees at creation time and how GitHub/OpenAI handle it.	2026-04-28 10:23:37 +02:00
Oliver Hofmann	94368670b7	Reload Ollama models on URL change, pre-select current model - /api/ollama-models accepts optional url query param to query a different endpoint - Frontend fetches models on load and on Ollama URL blur - Keeps current model selected if available, otherwise selects first in list - Shows loading indicator while fetching	2026-04-28 09:07:53 +02:00
Oliver Hofmann	f22bad6496	Clarify Docker port binding and SSH tunnel for admin access Use 127.0.0.1:8001:8001 to bind admin port locally only. Explain Docker's 0.0.0.0 vs 127.0.0.1 distinction and add SSH tunnel diagram showing how admin UI is accessed remotely.	2026-04-28 08:52:26 +02:00
Oliver HofmannandClaude Sonnet 4.6	ff5c88ecfd	Remove admin port binding from docker run example Port 8001 should not be exposed to the host directly. Add nginx reverse proxy and SSH tunnel examples instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:41:18 +02:00