Explain network_mode: host motivation in README

- docker-entrypoint.sh: Admin-API bindet auf ADMIN_HOST (default 0.0.0.0)
  statt hardcoded 0.0.0.0 — ermöglicht Einschränkung auf 127.0.0.1
- README: Zweck-Beschreibung, HTTPS-Reverse-Proxy-Abschnitt (Caddy/Nginx),
  Port-8001-Abschnitt korrigiert (Docker-Port-Mapping greift bei
  network_mode: host nicht), ADMIN_HOST in Konfig-Tabelle ergänzt
- DOCKERHUB.md / DOCKERHUB.en.md: Auf drei Szenarien reduziert
  (network_mode: host, Ollama als Container + SQLite/PostgreSQL);
  host.docker.internal-Varianten entfernt
- review_priorities.md: gelöscht (alle Punkte behoben)

.dockerignore

@@ -1,11 +1,50 @@
-.git/
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
 .venv/
 venv/
+*.egg-info/
+.pytest_cache/
+
+# Tests
+backend/tests/
+
+# Environment & secrets
 .env
+*.env.local
+
+# Databases
+*.db
+*.sqlite3
+
+# Logs
+logs/
+*.log
+
+# IDE & tools
+.idea/
+.vscode/
+.claude/
+
+# Git
+.git/
+.gitignore
+
+# Frontend
 frontend/node_modules/
 frontend/dist/
-backend/__pycache__/
+
-backend/**/__pycache__/
+# Docker
-backend/*.pyc
+docker-compose.yml
-backend/test.db
+.dockerignore
-backend/tests/
+
+# Docs
+*.md
+
+# Dev & build scripts
+run_dev.py
+build_push.sh
+start.sh
+test_api.sh

.gitignore

@@ -14,7 +14,11 @@ __pycache__/
 *.sqlite3
 
 # IDE
-.idea/
+.idea/*
+!.idea/runConfigurations/
+.idea/runConfigurations/*
+!.idea/runConfigurations/Dev.xml
+!.idea/runConfigurations/Docker_Push.xml
 .vscode/
 
 # Frontend build

.idea/runConfigurations/Dev.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Dev" type="PythonConfigurationType" factoryName="Python">
+    <module name="llm_quota" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="SCRIPT_NAME" value="$PROJECT_DIR$/run_dev.py" />
+    <option name="PARAMETERS" value="" />
+    <method v="2" />
+  </configuration>
+</component>

.idea/runConfigurations/Docker_Push.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Docker Push" type="ShConfigurationType">
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/build_push.sh" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/bash" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <method v="2" />
+  </configuration>
+</component>

DOCKERHUB.en.md

@@ -0,0 +1,156 @@
+# mediaeng/llmproxy
+
+A lightweight reverse proxy for [Ollama](https://ollama.com) that manages API keys with configurable token and request quotas. Incoming requests in OpenAI-compatible format are authenticated, checked against the quota, and forwarded to the configured Ollama server.
+
+## Features
+
+- OpenAI-compatible endpoint (`/v1/chat/completions`, `/v1/models`)
+- API key management with daily and monthly token/request limits
+- Web-based admin interface (port 8001)
+- Streaming support (Server-Sent Events)
+- Tool use / function calling passthrough
+- Rotating usage logs
+- SQLite (default) or PostgreSQL
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| `8000` | Proxy endpoint (OpenAI API) |
+| `8001` | Admin API + web interface |
+
+All API endpoints require the `ADMIN_PASSWORD` — without a valid token, only the public frontend files (HTML/JS/CSS of the login page) are accessible. The password is therefore the primary protection.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ADMIN_PASSWORD` | – | **Required.** Password for the admin interface |
+| `OLLAMA_URL` | `http://localhost:11434` | URL of the Ollama server (without `/v1` suffix) |
+| `DEFAULT_MODEL` | `llama3` | Model used when the client does not specify one |
+| `DATABASE_URL` | `sqlite:///./test.db` | Database connection string (SQLite or PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Proxy bind address |
+| `PROXY_PORT` | `8000` | Proxy port |
+| `ADMIN_HOST` | `0.0.0.0` | Admin API bind address (`127.0.0.1` to restrict to local access) |
+| `ADMIN_PORT` | `8001` | Admin API port |
+| `APP_TZ` | `Europe/Berlin` | Timezone for daily/monthly quota resets |
+| `LOG_FILE` | `logs/usage.log` | Path of the rotating usage log file |
+
+## Docker Compose – Ollama on the Host (Linux, recommended)
+
+`network_mode: host` gives the container direct access to the host network stack. Ollama runs on the host and is reachable at `localhost:11434` — not visible from outside. The proxy and admin interface are available directly on host ports 8000 and 8001.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama as Container, SQLite
+
+Ollama and llmproxy run together in Docker. Ollama is not exposed externally.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama as Container, PostgreSQL
+
+For production environments with an external database.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client Configuration
+
+Configure the proxy as an OpenAI-compatible endpoint:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <API key created in the admin interface>
+```

DOCKERHUB.md

@@ -0,0 +1,156 @@
+# mediaeng/llmproxy
+
+Ein schlanker Reverse-Proxy für [Ollama](https://ollama.com), der API-Keys mit konfigurierbaren Token- und Request-Quoten verwaltet. Eingehende Anfragen im OpenAI-kompatiblen Format werden authentifiziert, auf Quota geprüft und an den konfigurierten Ollama-Server weitergeleitet.
+
+## Funktionen
+
+- OpenAI-kompatibler Endpunkt (`/v1/chat/completions`, `/v1/models`)
+- API-Key-Verwaltung mit tages- und monatlichen Token-/Request-Limits
+- Web-basierte Admin-Oberfläche (Port 8001)
+- Streaming-Support (Server-Sent Events)
+- Tool-Use / Function Calling wird durchgereicht
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+
+## Ports
+
+| Port | Dienst |
+|------|--------|
+| `8000` | Proxy-Endpunkt (OpenAI-API) |
+| `8001` | Admin-API + Web-Oberfläche |
+
+Alle API-Endpunkte erfordern das `ADMIN_PASSWORD` — ein Zugriff ohne gültiges Token liefert nur die öffentlichen Frontend-Dateien (HTML/JS/CSS der Login-Seite). Das Passwort ist damit die primäre Schutzmaßnahme.
+
+## Umgebungsvariablen
+
+| Variable | Standard | Beschreibung |
+|----------|----------|--------------|
+| `ADMIN_PASSWORD` | – | **Pflicht.** Passwort für die Admin-Oberfläche |
+| `OLLAMA_URL` | `http://localhost:11434` | URL des Ollama-Servers (ohne `/v1`-Suffix) |
+| `DEFAULT_MODEL` | `llama3` | Modell, das verwendet wird wenn der Client keines angibt |
+| `DATABASE_URL` | `sqlite:///./test.db` | Datenbank-Verbindungsstring (SQLite oder PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxy |
+| `PROXY_PORT` | `8000` | Port des Proxy |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (`127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für Tages-/Monats-Reset der Quoten |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+
+## Docker Compose – Ollama auf dem Host (Linux, empfohlen)
+
+`network_mode: host` gibt dem Container direkten Zugriff auf das Host-Netzwerk. Ollama läuft auf dem Host und ist über `localhost:11434` erreichbar — nach außen nicht sichtbar. Proxy und Admin-Oberfläche sind direkt auf den Host-Ports 8000 und 8001 verfügbar.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama als Container, SQLite
+
+Ollama und llmproxy laufen gemeinsam in Docker. Ollama ist nicht nach außen exposed.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama als Container, PostgreSQL
+
+Für Produktionsumgebungen mit externer Datenbank.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      DEFAULT_MODEL: llama3
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client-Konfiguration
+
+Den Proxy als OpenAI-kompatibler Endpunkt konfigurieren:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <angelegter API-Key aus der Admin-Oberfläche>
+```

Dockerfile

@@ -9,7 +9,7 @@ FROM python:3.12-slim
 WORKDIR /app
 
 COPY backend/requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir -r requirements.txt psycopg2-binary
 
 COPY backend/ backend/
 COPY --from=frontend-builder /app/frontend/dist frontend/dist

README.md

@@ -1,6 +1,6 @@
 # Ollama Proxy mit API-Keys und Quotas
 
-Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung, Quota-Management und Web-Admin-Oberfläche.
+Ollama bietet von sich aus keine Authentifizierung — wer die API erreicht, kann sie nutzen. Dieses Projekt löst das Problem: Ollama bleibt an `localhost` gebunden und ist von außen nicht erreichbar. Vorgeschaltet läuft ein Proxy (Port 8000), der jeden Request auf einen gültigen API-Key prüft und optional Token- sowie Request-Quoten pro Key durchsetzt. Eine Web-Admin-Oberfläche (Port 8001) erlaubt das Verwalten von Keys, Quoten und Ollama-Einstellungen.
 
 ## Features
 
@@ -8,30 +8,34 @@ Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung, Quota-Management un
 - Optionales Ablaufdatum pro API-Key
 - Quota-Management mit getrennten Tages- und Monatslimits (Tokens & Requests)
 - Token-Zählung via tiktoken, Reset-Grenzen in der Zeitzone Europe/Berlin
-- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Proxy-Info)
+- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Verbrauchsanzeige)
-- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt
+- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt mit Streaming und Tool-Use
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+- Docker-Image auf DockerHub: `mediaeng/llmproxy`
 
 ## Sicherheit
 
-- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`)
+- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`) — alle API-Endpunkte erfordern den Token
-- Admin-API bindet lokal auf `127.0.0.1` (nicht von außen erreichbar)
 - API-Keys als SHA-256-Hash in der DB — Plaintext nur einmalig bei Erstellung
 - Quota-Check atomar mit `SELECT FOR UPDATE` (kein TOCTOU-Race)
-- CORS-Origins konfigurierbar via `ALLOWED_ORIGINS`
+- Admin-Port 8001 über `ADMIN_HOST=127.0.0.1` auf lokalen Zugriff beschränkbar
 
 ## Konfiguration
 
-`.env`-Datei im Projektverzeichnis anlegen (Vorlage: `.env.example`):
+`.env`-Datei im Projektverzeichnis anlegen:
 
 ```env
 ADMIN_PASSWORD=change-me
 PROXY_HOST=0.0.0.0
 PROXY_PORT=8000
+ADMIN_HOST=0.0.0.0
 ADMIN_PORT=8001
 DATABASE_URL=sqlite:///./test.db
 OLLAMA_URL=http://localhost:11434
 DEFAULT_MODEL=llama3
 APP_TZ=Europe/Berlin
+LOG_FILE=logs/usage.log
 ```
 
 | Variable | Standard | Beschreibung |
@@ -39,26 +43,17 @@ APP_TZ=Europe/Berlin
 | `ADMIN_PASSWORD` | — | Passwort für die Admin-Oberfläche (**Pflicht**) |
 | `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxys |
 | `PROXY_PORT` | `8000` | Port des Proxys |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (z. B. `127.0.0.1` für lokalen Zugriff) |
 | `ADMIN_PORT` | `8001` | Port der Admin-API |
-| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring |
+| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring (SQLite oder PostgreSQL) |
 | `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz (auch in der UI änderbar) |
 | `DEFAULT_MODEL` | `llama3` | Standard-Modell für `/v1/chat/completions` (auch in der UI änderbar) |
 | `APP_TZ` | `Europe/Berlin` | Zeitzone für tägliche/monatliche Quota-Resets |
-| `ALLOWED_ORIGINS` | `http://localhost:5173` | Kommagetrennte CORS-Origins |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ALLOWED_ORIGINS` | `http://localhost:5173` | CORS-Origins (nur für Entwicklung relevant) |
 
 ## Entwicklung (lokal)
 
-```bash
-cp .env.example .env
-# ADMIN_PASSWORD in .env setzen
-
-./start.sh
-```
-
-Das Script prüft alle Ports auf Belegung, aktiviert automatisch eine vorhandene `.venv`, initialisiert die Datenbank und startet Proxy, Admin-API und Vite-Dev-Server.
-
-Admin-Oberfläche: `http://localhost:5173`
-
 ### Voraussetzungen
 
 - Python 3.12+ mit virtualenv
@@ -68,71 +63,117 @@ Admin-Oberfläche: `http://localhost:5173`
 python -m venv .venv
 source .venv/bin/activate
 pip install -r backend/requirements-dev.txt
-
 cd frontend && npm install
 ```
 
+### Starten
+
+**Per Script:**
+```bash
+cp .env.example .env   # ADMIN_PASSWORD setzen
+./start.sh
+```
+
+**Per PyCharm:** Run-Config „Dev" starten (startet Proxy, Admin-API und Vite-Dev-Server gemeinsam).
+
+Das Script prüft alle Ports auf Belegung, initialisiert die Datenbank und startet alle drei Dienste.
+
+Admin-Oberfläche: `http://localhost:5173`
+
 ## Produktion (Docker)
 
-### Image bauen
+### Docker Compose (empfohlen)
 
 ```bash
-docker build -t llm-quota .
+docker compose up -d
 ```
 
-### Container starten
+Zieht das Image von DockerHub und lädt Variablen aus `.env`.
+
+Das Setup verwendet `network_mode: host`: Der Container teilt den Netzwerkstack des Hosts, statt ein eigenes virtuelles Netzwerk zu bekommen. Das ist hier aus zwei Gründen die richtige Wahl:
+
+1. **Ollama soll nicht von außen erreichbar sein.** Ollama läuft auf dem Host und ist an `127.0.0.1:11434` gebunden — nur lokal erreichbar. Mit einem eigenen Container-Netzwerk (Bridge-Mode) wäre `localhost` aus Sicht des Containers der Container selbst, nicht der Host. Die übliche Alternative (`host.docker.internal` + `extra_hosts`) ist auf Linux unzuverlässig.
+
+2. **Kein doppeltes Port-Mapping nötig.** Mit `network_mode: host` sind Port 8000 und 8001 direkt auf dem Host verfügbar, ohne `ports:`-Einträge in der Compose-Datei.
+
+### Image selbst bauen und pushen
 
 ```bash
-docker run -d \
+./build_push.sh
-  -p 8000:8000 \
-  -p 127.0.0.1:8001:8001 \
-  -e ADMIN_PASSWORD=geheim \
-  -e OLLAMA_URL=http://host.docker.internal:11434 \
-  -e DATABASE_URL=sqlite:///./data/quota.db \
-  -v $(pwd)/data:/app/backend/data \
-  --name llm-quota \
-  llm-quota
 ```
 
-| Port | Bindung | Dienst |
+Das Script zeigt den aktuellen Git-Tag, bietet an einen neuen zu setzen, baut das Image für `linux/arm64` und pusht zu `mediaeng/llmproxy`.
-|------|---------|--------|
-| `8000` | `0.0.0.0` — öffentlich | Proxy (für LLM-Clients) |
-| `8001` | `127.0.0.1` — nur lokal am Server | Admin-API + Admin-Oberfläche |
 
-Docker unterscheidet beim Port-Mapping zwischen `0.0.0.0` (alle Interfaces, öffentlich erreichbar) und `127.0.0.1` (nur der Server selbst kann zugreifen). Mit `-p 127.0.0.1:8001:8001` ist Port 8001 am Server verfügbar, aber von außen nicht direkt ansprechbar.
+### Port 8001 (Admin)
 
-### Admin-Oberfläche per SSH-Tunnel erreichbar machen
+Alle Admin-Endpunkte erfordern das `ADMIN_PASSWORD` — der Token ist der primäre Schutz. Für zusätzliche Härtung lässt sich die Admin-API auf lokalen Zugriff beschränken:
 
-Der SSH-Tunnel leitet einen lokalen Port auf den Server weiter und nutzt dabei, dass Port 8001 dort auf `127.0.0.1` erreichbar ist:
+```env
-
+ADMIN_HOST=127.0.0.1
-```
-Admin-Laptop:8001  ──SSH──►  Server:127.0.0.1:8001  ──►  Container:8001
 ```
 
-```bash
+Bei `network_mode: host` (Produktions-Standard) ist das die einzig wirksame Methode — Docker-Port-Mapping greift dort nicht.
-ssh -L 8001:localhost:8001 user@server
+
+### HTTPS via Reverse-Proxy (ungetestet)
+
+Wer Proxy und Admin-Oberfläche per HTTPS bereitstellen will, kann einen weiteren Reverse-Proxy (z. B. Nginx oder Caddy) vorschalten. Bei `network_mode: host` lauschen beide Dienste direkt auf dem Host, Nginx/Caddy proxyen auf `localhost`.
+
+**Caddy** (empfohlen — automatisches TLS via Let's Encrypt):
+
+```
+llm.example.com {
+    reverse_proxy localhost:8000 {
+        flush_interval -1
+    }
+}
+
+llm-admin.example.com {
+    reverse_proxy localhost:8001
+}
 ```
 
-Danach ist die Admin-Oberfläche auf dem Laptop unter `http://localhost:8001` erreichbar — ohne dass Port 8001 öffentlich exponiert wird.
+**Nginx** (mit Certbot-Zertifikaten):
 
-### Mit PostgreSQL
+```nginx
+server {
+    listen 443 ssl;
+    server_name llm.example.com;
 
-```bash
+    ssl_certificate     /etc/letsencrypt/live/llm.example.com/fullchain.pem;
-docker run -d \
+    ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
-  -p 8000:8000 \
+
-  -p 127.0.0.1:8001:8001 \
+    location / {
-  -e ADMIN_PASSWORD=geheim \
+        proxy_pass         http://127.0.0.1:8000;
-  -e DATABASE_URL=postgresql://user:pass@db-host:5432/llm_quota \
+        proxy_set_header   Host $host;
-  -e OLLAMA_URL=http://ollama:11434 \
+        proxy_set_header   X-Real-IP $remote_addr;
-  llm-quota
+        proxy_buffering    off;   # nötig für Streaming
+        proxy_cache        off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name llm-admin.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm-admin.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm-admin.example.com/privkey.pem;
+
+    location / {
+        proxy_pass       http://127.0.0.1:8001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
 ```
 
+Clients konfigurieren dann `https://llm.example.com/v1` als Base URL.
+
 ## Proxy-Endpunkte (Port 8000)
 
 Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header.
 
 ```bash
-curl -X POST http://localhost:8000/api/chat \
+curl -X POST http://localhost:8000/v1/chat/completions \
   -H "Authorization: Bearer sk-xxxxxx" \
   -H "Content-Type: application/json" \
   -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}]}'
@@ -140,12 +181,12 @@ curl -X POST http://localhost:8000/api/chat \
 
 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/generate` | POST | Ollama generate |
+| `/v1/chat/completions` | POST | Chat (OpenAI-Format, Streaming + Tool-Use) |
-| `/api/chat` | POST | Ollama chat |
+| `/v1/models` | GET | Modelle (OpenAI-Format) |
+| `/api/generate` | POST | Ollama generate (nativ) |
+| `/api/chat` | POST | Ollama chat (nativ) |
 | `/api/tags` | GET | Verfügbare Modelle |
 | `/api/versions` | GET | Ollama-Version |
-| `/v1/models` | GET | Modelle (OpenAI-Format) |
-| `/v1/chat/completions` | POST | Chat (OpenAI-Format) |
 
 ## Admin-API (Port 8001)
 
@@ -153,10 +194,12 @@ Alle Endpunkte erfordern `Authorization: Bearer <ADMIN_PASSWORD>`.
 
 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/api-keys` | GET | Alle API-Keys auflisten |
+| `/api/api-keys` | GET | Alle API-Keys mit Verbrauchsdaten |
 | `/api/api-keys` | POST | Neuen API-Key erstellen |
+| `/api/api-keys/{id}/quota` | PATCH | Limits eines Keys aktualisieren |
+| `/api/api-keys/{id}/activate` | PUT | API-Key aktivieren |
 | `/api/api-keys/{id}/deactivate` | PUT | API-Key deaktivieren |
-| `/api/api-keys/{id}/quota` | PATCH | Quota eines Keys aktualisieren |
+| `/api/api-keys/{id}` | DELETE | API-Key löschen |
 | `/api/settings` | GET/PUT | Ollama-URL und Standard-Modell |
 | `/api/ollama-models` | GET | Verfügbare Modelle von Ollama |
 | `/api/proxy-info` | GET | Lokaler Proxy-Endpunkt |
@@ -180,22 +223,27 @@ llm_quota/
 │   ├── schemas.py           # Pydantic-Schemas
 │   ├── crud.py              # DB-Operationen, Token-Zählung, Quota-Logik
 │   ├── init_db.py           # Tabellen anlegen & Settings seeden
-│   ├── setup_admin.py       # Standard-API-Key erstellen
 │   ├── requirements.txt     # Produktiv-Dependencies
 │   ├── requirements-dev.txt # Test-Dependencies
 │   └── tests/
-│       ├── conftest.py      # Fixtures
+│       ├── conftest.py
-│       ├── test_auth.py     # Authentifizierungs-Tests
+│       ├── test_auth.py
-│       └── test_quota.py    # Quota-, Token- und Ablauf-Tests
+│       └── test_quota.py
 ├── frontend/
 │   └── src/
 │       ├── main.jsx         # React-Admin-UI
 │       └── styles.css
+├── .idea/runConfigurations/
+│   └── Dev.xml              # PyCharm Run-Config
 ├── Dockerfile
+├── docker-compose.yml       # Produktiv-Start mit DockerHub-Image
 ├── docker-entrypoint.sh
 ├── .dockerignore
-├── .env.example
 ├── start.sh                 # Entwicklungs-Startscript
+├── run_dev.py               # Entwicklungs-Runner für PyCharm
+├── build_push.sh            # Docker-Build & Push zu DockerHub
+├── DOCKERHUB.md             # DockerHub-Beschreibung (deutsch)
+├── DOCKERHUB.en.md          # DockerHub-Beschreibung (englisch)
 └── .gitignore
 ```
 

backend/admin.py

@@ -8,7 +8,7 @@ from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from database import get_db
 import crud, schemas
-from models import APIKey as APIKeyModel
+from models import APIKey as APIKeyModel, Usage as UsageModel
 
 app = FastAPI(title="Ollama Proxy Admin API")
 
@@ -31,13 +31,26 @@ def require_admin_auth(request: Request):
     if not secrets.compare_digest(token, ADMIN_PASSWORD):
         raise HTTPException(status_code=401, detail="Invalid admin password")
 
-@app.get("/api/api-keys", response_model=list[schemas.APIKey])
+@app.get("/api/api-keys", response_model=list[schemas.APIKeyWithUsage])
 async def read_api_keys(
     skip: int = 0, limit: int = 100,
     db: Session = Depends(get_db),
     _ = Depends(require_admin_auth),
 ):
-    return db.query(APIKeyModel).offset(skip).limit(limit).all()
+    keys = db.query(APIKeyModel).offset(skip).limit(limit).all()
+    result = []
+    for key in keys:
+        item = schemas.APIKeyWithUsage.model_validate(key)
+        usage = db.query(UsageModel).filter(UsageModel.api_key_id == key.id).first()
+        if usage:
+            item.tokens_used_today = usage.tokens_used_today or 0
+            item.tokens_used_month = usage.tokens_used_month or 0
+            item.requests_today = usage.requests_today or 0
+            item.requests_month = usage.requests_month or 0
+            item.daily_reset_at = usage.daily_reset_at
+            item.monthly_reset_at = usage.monthly_reset_at
+        result.append(item)
+    return result
 
 @app.post("/api/api-keys", response_model=schemas.APIKeyCreated)
 async def create_api_key(
@@ -87,6 +100,32 @@ async def deactivate_api_key(
     db.commit()
     return {"message": "API key deactivated"}
 
+@app.put("/api/api-keys/{api_key_id}/activate")
+async def activate_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db_key.is_active = True
+    db.commit()
+    return {"message": "API key activated"}
+
+@app.delete("/api/api-keys/{api_key_id}")
+async def delete_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.delete(db_key)
+    db.commit()
+    return {"message": "API key deleted"}
+
 @app.get("/api/proxy-info")
 async def get_proxy_info(_ = Depends(require_admin_auth)):
     host = os.getenv("PROXY_HOST", "0.0.0.0")
@@ -107,9 +146,10 @@ async def update_settings(
     db: Session = Depends(get_db),
     _ = Depends(require_admin_auth),
 ):
-    crud.set_setting(db, "ollama_url", settings.ollama_url)
+    ollama_url = settings.ollama_url.rstrip('/').removesuffix('/v1')
+    crud.set_setting(db, "ollama_url", ollama_url)
     crud.set_setting(db, "default_model", settings.default_model)
-    return settings
+    return schemas.Settings(ollama_url=ollama_url, default_model=settings.default_model)
 
 @app.get("/api/ollama-models")
 async def get_ollama_models(
@@ -122,9 +162,9 @@ async def get_ollama_models(
         async with httpx.AsyncClient(timeout=5.0) as client:
             response = await client.get(f"{ollama_url}/api/tags")
         models = [m["name"] for m in response.json().get("models", [])]
+        return {"models": models, "reachable": True}
     except Exception:
-        models = []
+        return {"models": [], "reachable": False}
-    return {"models": models}
 
 # Statisches Frontend ausliefern (nur im Produktivbetrieb, wenn dist/ existiert)
 _dist = Path(__file__).parent.parent / "frontend" / "dist"

backend/crud.py

@@ -40,6 +40,7 @@ def create_api_key(
     db_key = APIKey(
         name=name,
         key=_hash_api_key(raw_key),
+        key_prefix=raw_key[:12],
         expires_at=expires_at,
         daily_tokens=daily_tokens,
         monthly_tokens=monthly_tokens,

backend/main.py

@@ -1,135 +1,192 @@
-import time
+import logging
-import uuid
+import os
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
 from fastapi import FastAPI, HTTPException, Depends, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from sqlalchemy.orm import Session
-from database import get_db, SessionLocal
+from database import get_db
 import crud
 import httpx
-import os
 
-app = FastAPI(title="Ollama Proxy")
+_log_dir = Path(os.getenv("LOG_FILE", "logs/usage.log")).parent
+_log_dir.mkdir(parents=True, exist_ok=True)
+_fmt = logging.Formatter("%(asctime)s | %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
 
-async def proxy_request(url: str, method: str = "GET", json_data: dict = None, headers: dict = None):
+# Rotating usage log (8 KB per file, 3 backups)
-    async with httpx.AsyncClient() as client:
+_usage_handler = RotatingFileHandler(str(_log_dir / "usage.log"), maxBytes=8192, backupCount=3, encoding="utf-8")
-        response = await client.request(method=method, url=url, json=json_data, headers=headers)
+_usage_handler.setFormatter(_fmt)
-        return response
+usage_log = logging.getLogger("proxy.usage")
+usage_log.setLevel(logging.INFO)
+usage_log.addHandler(_usage_handler)
+usage_log.propagate = False
 
-@app.middleware("http")
+# Rotating error log (64 KB per file, 5 backups)
-async def authenticate_and_quota(request: Request, call_next):
+_error_handler = RotatingFileHandler(str(_log_dir / "error.log"), maxBytes=65536, backupCount=5, encoding="utf-8")
+_error_handler.setFormatter(_fmt)
+error_log = logging.getLogger("proxy.error")
+error_log.setLevel(logging.ERROR)
+error_log.addHandler(_error_handler)
+error_log.propagate = False
+
+def _content_to_str(content) -> str:
+    """Normalize OpenAI content: string or array of content parts → plain string."""
+    if isinstance(content, list):
+        return " ".join(
+            part.get("text", "") if isinstance(part, dict) else str(part)
+            for part in content
+        )
+    return content or ""
+
+
+def _last_user_msg(messages: list, max_len: int = 120) -> str:
+    for msg in reversed(messages):
+        if msg.get("role") == "user":
+            text = _content_to_str(msg.get("content")).replace("\n", " ").strip()
+            return text[:max_len] + ("…" if len(text) > max_len else "")
+    return ""
+
+async def require_api_key(request: Request, db: Session = Depends(get_db)):
     auth_header = request.headers.get("Authorization", "")
     if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
+        api_key = auth_header[7:]
     elif auth_header.startswith("sk-"):
         api_key = auth_header
     else:
-        return JSONResponse(status_code=401, content={"detail": "Invalid or missing API key"})
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
-
-    # Uses its own session since middleware cannot use Depends
-    db = SessionLocal()
-    try:
     db_key = crud.verify_api_key(db, api_key)
     if not db_key:
-            return JSONResponse(status_code=401, content={"detail": "Invalid API key"})
+        raise HTTPException(status_code=401, detail="Invalid API key")
     request.state.api_key_id = db_key.id
+    request.state.api_key_name = db_key.name
+
+app = FastAPI(title="Ollama Proxy", dependencies=[Depends(require_api_key)])
+
+@app.on_event("startup")
+def apply_env_settings():
+    """Write env-configured values into DB so they take effect until next restart."""
+    db = next(get_db())
+    try:
+        if url := os.getenv("OLLAMA_URL"):
+            crud.set_setting(db, "ollama_url", url)
+        if model := os.getenv("DEFAULT_MODEL"):
+            crud.set_setting(db, "default_model", model)
+        db.commit()
     finally:
         db.close()
 
-    response = await call_next(request)
+@app.exception_handler(Exception)
+async def unhandled_exception_handler(request: Request, exc: Exception):
+    error_log.error("Unhandled exception | %s %s | %s: %s",
+                    request.method, request.url.path, type(exc).__name__, exc, exc_info=exc)
+    return JSONResponse(status_code=500, content={"error": {"message": "Internal server error", "type": "server_error"}})
+
+async def proxy_request(url: str, method: str = "GET", json_data: dict = None):
+    async with httpx.AsyncClient(timeout=300.0) as client:
+        response = await client.request(method=method, url=url, json=json_data)
         return response
 
 @app.post("/api/generate")
 async def generate(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
     body = await request.json()
-
     prompt_tokens = crud.count_tokens(body.get("prompt", ""))
-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body, headers=dict(request.headers))
+    prompt_preview = (body.get("prompt", "").replace("\n", " ").strip())[:120]
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    usage_log.info('%s | /api/generate | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, prompt_preview)
+    try:
+        response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/generate | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise
 
 @app.post("/api/chat")
 async def chat(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
     body = await request.json()
+    messages = body.get("messages", [])
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)
 
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in body.get("messages", []))
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body, headers=dict(request.headers))
+    usage_log.info('%s | /api/chat | %s | ~%d tokens | "%s"',
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, _last_user_msg(messages))
+    try:
+        response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/chat | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise
 
 @app.get("/api/tags")
-async def list_models(request: Request, db: Session = Depends(get_db)):
+async def list_models(db: Session = Depends(get_db)):
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/tags", method="GET", headers=dict(request.headers))
+    response = await proxy_request(f"{ollama_url}/api/tags", method="GET")
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    return JSONResponse(content=response.json(), status_code=response.status_code)
 
 @app.get("/api/versions")
-async def versions(request: Request, db: Session = Depends(get_db)):
+async def versions(db: Session = Depends(get_db)):
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/versions", method="GET", headers=dict(request.headers))
+    response = await proxy_request(f"{ollama_url}/api/versions", method="GET")
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    return JSONResponse(content=response.json(), status_code=response.status_code)
 
 @app.get("/v1/models")
-async def list_openai_models(request: Request, db: Session = Depends(get_db)):
+async def list_openai_models(db: Session = Depends(get_db)):
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    response = await proxy_request(f"{ollama_url}/api/tags", method="GET", headers=dict(request.headers))
+    response = await proxy_request(f"{ollama_url}/v1/models", method="GET")
-    ollama_models = response.json()
+    return JSONResponse(content=response.json(), status_code=response.status_code)
-    openai_models = {
-        "object": "list",
-        "data": [
-            {
-                "id": model["name"],
-                "object": "model",
-                "created": int(model["modified_at"][:10].replace("-", "")) * 1000 if "modified_at" in model else 0,
-                "owned_by": "ollama"
-            }
-            for model in ollama_models.get("models", [])
-        ]
-    }
-    return JSONResponse(content=openai_models, status_code=200, headers=dict(response.headers))
 
 @app.post("/v1/chat/completions")
 async def openai_chat_completions(request: Request, db: Session = Depends(get_db)):
-    api_key_id = request.state.api_key_id
     ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
     default_model = crud.get_setting(db, "default_model", os.getenv("DEFAULT_MODEL", "llama3"))
 
     body = await request.json()
     messages = body.get("messages", [])
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in messages)
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)
 
-    if not crud.check_and_increment_quota(db, api_key_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    ollama_body = {
+    if "model" not in body:
-        "model": body.get("model", default_model),
+        body = {**body, "model": default_model}
-        "messages": messages,
-        "stream": body.get("stream", False)
-    }
 
-    response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=ollama_body, headers=dict(request.headers))
+    model_name = body["model"]
-    response_content = response.json().get("message", {}).get("content", "")
+    usage_log.info('%s | /v1/chat/completions | %s | ~%d tokens | "%s"',
-    completion_tokens = crud.count_tokens(response_content)
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(messages))
 
-    openai_response = {
+    target = f"{ollama_url}/v1/chat/completions"
-        "id": f"chatcmpl-{uuid.uuid4().hex}",
+
-        "object": "chat.completion",
+    if body.get("stream"):
-        "created": int(time.time()),
+        async def generate():
-        "model": body.get("model", default_model),
+            try:
-        "choices": [{"index": 0, "message": {"role": "assistant", "content": response_content}, "finish_reason": "stop"}],
+                async with httpx.AsyncClient(timeout=300.0) as client:
-        "usage": {
+                    async with client.stream("POST", target, json=body) as resp:
-            "prompt_tokens": prompt_tokens,
+                        async for chunk in resp.aiter_bytes():
-            "completion_tokens": completion_tokens,
+                            yield chunk
-            "total_tokens": prompt_tokens + completion_tokens,
+            except Exception as exc:
-        },
+                error_log.error("Stream error | %s | /v1/chat/completions | %s | %s: %s",
-    }
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
-    return JSONResponse(content=openai_response, status_code=200, headers={"Content-Type": "application/json"})
+                raise
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    try:
+        response = await proxy_request(target, method="POST", json_data=body)
+        return JSONResponse(content=response.json(), status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/chat/completions | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise

backend/models.py

@@ -10,6 +10,7 @@ class APIKey(Base):
     id = Column(Integer, primary_key=True, index=True)
     name = Column(String)
     key = Column(String, unique=True, index=True)
+    key_prefix = Column(String)
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime(timezone=True), default=_now)
     expires_at = Column(DateTime(timezone=True), nullable=True)

backend/schemas.py

@@ -14,6 +14,7 @@ class APIKey(BaseModel):
     id: int
     name: str
     key: str
+    key_prefix: Optional[str] = None
     is_active: bool
     created_at: datetime
     expires_at: Optional[datetime] = None
@@ -51,3 +52,14 @@ class UsageStats(BaseModel):
 
     class Config:
         from_attributes = True
+
+class APIKeyWithUsage(APIKey):
+    tokens_used_today: int = 0
+    tokens_used_month: int = 0
+    requests_today: int = 0
+    requests_month: int = 0
+    daily_reset_at: Optional[datetime] = None
+    monthly_reset_at: Optional[datetime] = None
+
+    class Config:
+        from_attributes = True

build_push.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+IMAGE=mediaeng/llmproxy
+PLATFORM=linux/arm64
+
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+HEAD_TAG=$(git tag --points-at HEAD | head -1)
+
+if [ -n "$HEAD_TAG" ]; then
+    echo "HEAD bereits getaggt: $HEAD_TAG"
+    read -rp "Neuer Tag [${HEAD_TAG}]: " INPUT
+    VERSION="${INPUT:-$HEAD_TAG}"
+else
+    echo "Letzter Tag: ${LAST_TAG:-kein Tag}"
+    read -rp "Neuer Tag: " INPUT
+    if [ -z "$INPUT" ]; then
+        echo "Kein Tag angegeben, breche ab."
+        exit 1
+    fi
+    VERSION="$INPUT"
+fi
+
+if [ "$VERSION" != "$HEAD_TAG" ]; then
+    git tag "$VERSION"
+    git push origin "$VERSION"
+    echo "Tag '$VERSION' gesetzt und gepusht."
+fi
+
+echo ""
+echo "Image   : $IMAGE"
+echo "Platform: $PLATFORM"
+echo "Tags    : $IMAGE:$VERSION  $IMAGE:latest"
+echo ""
+
+docker buildx build \
+    --platform "$PLATFORM" \
+    --push \
+    -t "$IMAGE:$VERSION" \
+    -t "$IMAGE:latest" \
+    .
+
+echo ""
+echo "Fertig. Gepusht:"
+echo "  docker pull $IMAGE:$VERSION"
+echo "  docker pull $IMAGE:latest"

docker-compose.yml

@@ -1,24 +1,11 @@
-backend:
+services:
-  build:
+  llmproxy:
-    context: ./backend
+    image: mediaeng/llmproxy:latest
-    dockerfile: Dockerfile
+    container_name: llmproxy
-  ports:
+    restart: unless-stopped
-    - "8000:8000"
+    network_mode: host
-  environment:
+    env_file: .env
-    - DATABASE_URL=postgresql://ollama:password@db:5432/ollama_proxy
-    - OLLAMA_URL=http://ollama:11434
-    - SECRET_KEY=your-secret-key-change-me
-  depends_on:
-    - db
-
-db:
-  image: postgres:16
-  environment:
-    - POSTGRES_USER=ollama
-    - POSTGRES_PASSWORD=password
-    - POSTGRES_DB=ollama_proxy
     volumes:
-    - postgres_data:/var/lib/postgresql/data
+      - ./backend/test.db:/app/backend/test.db
+      - ./backend/logs:/app/backend/logs
 
-volumes:
-  postgres_data:

docker-entrypoint.sh

@@ -10,7 +10,7 @@ uvicorn main:app \
 PROXY_PID=$!
 
 uvicorn admin:app \
-    --host "0.0.0.0" \
+    --host "${ADMIN_HOST:-0.0.0.0}" \
     --port "${ADMIN_PORT:-8001}" &
 ADMIN_PID=$!
 

frontend/src/main.jsx

@@ -3,12 +3,40 @@ import ReactDOM from 'react-dom/client';
 import axios from 'axios';
 import './styles.css';
 
-const maskKey = (key) => `••••••••${key.slice(-4)}`;
+const displayKey = (prefix) => prefix ? `${prefix}••••••••` : '••••••••••••';
 
 function authHeaders(token) {
   return { Authorization: `Bearer ${token}` };
 }
 
+const fmtK = (n) => { const k = n / 1000; return k % 1 === 0 ? `${k}k` : `${k.toFixed(1)}k`; };
+
+function QuotaBar({ used, limit, isToken = false, since = null }) {
+  const fmt = isToken ? fmtK : (n) => n.toLocaleString('de-DE');
+  const sinceLabel = since
+    ? new Date(since).toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit' })
+    : null;
+
+  if (limit == null) return (
+    <div className="quota-cell">
+      <span className="quota-unlimited">∞</span>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+
+  const pct = Math.min(100, (used / limit) * 100);
+  const color = pct >= 90 ? '#e74c3c' : pct >= 70 ? '#e67e22' : '#27ae60';
+  return (
+    <div className="quota-cell">
+      <span className="quota-label">{fmt(used)} / {fmt(limit)}</span>
+      <div className="progress-bar">
+        <div className="progress-fill" style={{ width: `${pct}%`, backgroundColor: color }} />
+      </div>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+}
+
 function Login({ onLogin }) {
   const [password, setPassword] = useState('');
   const [error, setError] = useState(null);
@@ -52,6 +80,7 @@ function SettingsSection({ password }) {
   const [settings, setSettings] = useState(null);
   const [availableModels, setAvailableModels] = useState([]);
   const [modelsLoading, setModelsLoading] = useState(false);
+  const [ollamaReachable, setOllamaReachable] = useState(true);
   const [proxyEndpoint, setProxyEndpoint] = useState(null);
   const [saved, setSaved] = useState(false);
   const [error, setError] = useState(null);
@@ -63,12 +92,14 @@ function SettingsSection({ password }) {
         headers: authHeaders(password),
         params: url ? { url } : {},
       });
-      const models = res.data.models;
+      const { models, reachable } = res.data;
+      setOllamaReachable(reachable);
       setAvailableModels(models);
       if (models.length > 0 && !models.includes(currentModel)) {
         setSettings(s => ({ ...s, default_model: models[0] }));
       }
     } catch {
+      setOllamaReachable(false);
       setAvailableModels([]);
     } finally {
       setModelsLoading(false);
@@ -116,6 +147,7 @@ function SettingsSection({ password }) {
         </div>
         <div className="settings-row">
           <label>Ollama-Endpunkt</label>
+          <div className="settings-input-wrap">
             <input
               type="url"
               value={settings.ollama_url}
@@ -124,6 +156,10 @@ function SettingsSection({ password }) {
               placeholder="http://localhost:11434"
               required
             />
+            {!ollamaReachable && !modelsLoading && (
+              <div className="warning">⚠ Ollama nicht erreichbar unter {settings.ollama_url}</div>
+            )}
+          </div>
         </div>
         <div className="settings-row">
           <label>Standard-Modell</label>
@@ -162,6 +198,8 @@ function App() {
   const [newKey, setNewKey] = useState(null);
   const [form, setForm] = useState(EMPTY_KEY_FORM);
   const [creating, setCreating] = useState(false);
+  const [editKey, setEditKey] = useState(null);
+  const [editForm, setEditForm] = useState({});
 
   useEffect(() => {
     if (!password) { setLoading(false); return; }
@@ -183,8 +221,8 @@ function App() {
     try {
       const payload = { name: form.name };
       if (form.expires_at)       payload.expires_at       = new Date(form.expires_at).toISOString();
-      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens);
+      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens) * 1000;
-      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens);
+      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens) * 1000;
       if (form.daily_requests)   payload.daily_requests   = Number(form.daily_requests);
       if (form.monthly_requests) payload.monthly_requests = Number(form.monthly_requests);
 
@@ -208,6 +246,53 @@ function App() {
     }
   };
 
+  const handleActivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/activate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Aktivieren.');
+    }
+  };
+
+  const handleDelete = async (id, name) => {
+    if (!window.confirm(`API-Key "${name}" wirklich löschen?`)) return;
+    try {
+      await axios.delete(`/api/api-keys/${id}`, { headers: authHeaders(password) });
+      if (editKey?.id === id) setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Löschen.');
+    }
+  };
+
+  const handleEdit = (key) => {
+    setEditKey(key);
+    setEditForm({
+      daily_tokens:     key.daily_tokens    != null ? key.daily_tokens / 1000    : '',
+      monthly_tokens:   key.monthly_tokens  != null ? key.monthly_tokens / 1000  : '',
+      daily_requests:   key.daily_requests  ?? '',
+      monthly_requests: key.monthly_requests ?? '',
+    });
+  };
+
+  const handleSaveEdit = async (e) => {
+    e.preventDefault();
+    try {
+      const payload = {
+        daily_tokens:     editForm.daily_tokens     !== '' ? Number(editForm.daily_tokens) * 1000     : null,
+        monthly_tokens:   editForm.monthly_tokens   !== '' ? Number(editForm.monthly_tokens) * 1000   : null,
+        daily_requests:   editForm.daily_requests   !== '' ? Number(editForm.daily_requests)   : null,
+        monthly_requests: editForm.monthly_requests !== '' ? Number(editForm.monthly_requests) : null,
+      };
+      await axios.patch(`/api/api-keys/${editKey.id}/quota`, payload, { headers: authHeaders(password) });
+      setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Speichern der Limits.');
+    }
+  };
+
   const logout = () => {
     sessionStorage.removeItem('admin_password');
     setPassword(null);
@@ -229,43 +314,76 @@ function App() {
       <section>
         <h2>Neuer API-Key</h2>
         <form onSubmit={handleCreate} className="create-form">
+          <div className="edit-form">
+            <label className="create-name">
+              Name
+              <small>&nbsp;</small>
               <input
-            placeholder="Name"
                 value={form.name}
                 onChange={(e) => setForm({ ...form, name: e.target.value })}
                 required
+                placeholder="z. B. alice"
               />
+            </label>
+            <label className="create-date">
+              Ablaufdatum
+              <small>leer = unbegrenzt</small>
               <input
                 type="date"
-            placeholder="Ablaufdatum (leer = unbegrenzt)"
                 value={form.expires_at}
                 onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
               />
+            </label>
+            <div className="create-btn-wrap">
+              <button type="submit" disabled={creating} className="btn-save">Erstellen</button>
+            </div>
+          </div>
+          <div className="edit-form">
+            <label>
+              Tokens/Tag (k)
+              <small>leer = unbegrenzt</small>
               <input
                 type="number"
-            placeholder="Tokens/Tag (leer = unbegrenzt)"
+                min="0"
+                placeholder="∞"
                 value={form.daily_tokens}
                 onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
               />
+            </label>
+            <label>
+              Tokens/Monat (k)
+              <small>leer = unbegrenzt</small>
               <input
                 type="number"
-            placeholder="Tokens/Monat"
+                min="0"
+                placeholder="∞"
                 value={form.monthly_tokens}
                 onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
               />
+            </label>
+            <label>
+              Requests/Tag
+              <small>leer = unbegrenzt</small>
               <input
                 type="number"
-            placeholder="Requests/Tag"
+                min="0"
+                placeholder="∞"
                 value={form.daily_requests}
                 onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
               />
+            </label>
+            <label>
+              Requests/Monat
+              <small>leer = unbegrenzt</small>
               <input
                 type="number"
-            placeholder="Requests/Monat"
+                min="0"
+                placeholder="∞"
                 value={form.monthly_requests}
                 onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
               />
-          <button type="submit" disabled={creating}>Erstellen</button>
+            </label>
+          </div>
         </form>
         {newKey && (
           <div className="new-key-box">
@@ -281,41 +399,99 @@ function App() {
         <table>
           <thead>
             <tr>
-              <th>ID</th>
+              <th></th>
               <th>Name</th>
               <th>Key</th>
-              <th>Status</th>
               <th>Läuft ab</th>
-              <th>Tokens/Tag</th>
+              <th className="th-quota">Tokens/Tag</th>
-              <th>Tokens/Monat</th>
+              <th className="th-quota">Tokens/Monat</th>
-              <th>Req/Tag</th>
+              <th className="th-quota">Req/Tag</th>
-              <th>Req/Monat</th>
+              <th className="th-quota">Req/Monat</th>
               <th></th>
             </tr>
           </thead>
           <tbody>
             {apiKeys.map(key => (
-              <tr key={key.id}>
+              <tr key={key.id} className={editKey?.id === key.id ? 'row-editing' : ''}>
-                <td>{key.id}</td>
+                <td className="td-status">
+                  <span className={key.is_active ? 'status-active' : 'status-inactive'} title={key.is_active ? 'Aktiv' : 'Inaktiv'}>●</span>
+                </td>
                 <td>{key.name}</td>
-                <td>{maskKey(key.key)}</td>
+                <td>{displayKey(key.key_prefix)}</td>
-                <td>{key.is_active ? 'Aktiv' : 'Inaktiv'}</td>
                 <td>{key.expires_at ? new Date(key.expires_at).toLocaleDateString('de-DE', { timeZone: 'Europe/Berlin' }) : '∞'}</td>
-                <td>{key.daily_tokens ?? '∞'}</td>
+                <td><QuotaBar used={key.tokens_used_today} limit={key.daily_tokens} isToken since={key.daily_reset_at} /></td>
-                <td>{key.monthly_tokens ?? '∞'}</td>
+                <td><QuotaBar used={key.tokens_used_month} limit={key.monthly_tokens} isToken since={key.monthly_reset_at} /></td>
-                <td>{key.daily_requests ?? '∞'}</td>
+                <td><QuotaBar used={key.requests_today} limit={key.daily_requests} since={key.daily_reset_at} /></td>
-                <td>{key.monthly_requests ?? '∞'}</td>
+                <td><QuotaBar used={key.requests_month} limit={key.monthly_requests} since={key.monthly_reset_at} /></td>
-                <td>
+                <td className="action-cell">
-                  {key.is_active && (
+                  <button className="btn-icon btn-icon-edit" data-tooltip="Bearbeiten" onClick={() => handleEdit(key)}>✏</button>
-                    <button className="btn-danger" onClick={() => handleDeactivate(key.id)}>
+                  {key.is_active ? (
-                      Deaktivieren
+                    <button className="btn-icon btn-icon-warn" data-tooltip="Deaktivieren" onClick={() => handleDeactivate(key.id)}>⏸</button>
-                    </button>
+                  ) : (
+                    <button className="btn-icon btn-icon-ok" data-tooltip="Aktivieren" onClick={() => handleActivate(key.id)}>▶</button>
                   )}
+                  <button className="btn-icon btn-icon-danger" data-tooltip="Löschen" onClick={() => handleDelete(key.id, key.name)}>✕</button>
                 </td>
               </tr>
             ))}
           </tbody>
         </table>
+
+        {editKey && (
+          <div className="edit-section">
+            <h3>Limits bearbeiten: <em>{editKey.name}</em></h3>
+            <form onSubmit={handleSaveEdit} className="edit-form">
+              <label>
+                Tokens/Tag (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, daily_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Tokens/Monat (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Tag
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_requests}
+                  onChange={(e) => setEditForm({ ...editForm, daily_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Monat
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_requests}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <div className="edit-actions">
+                <button type="submit" className="btn-save">Speichern</button>
+                <button type="button" className="btn-cancel" onClick={() => setEditKey(null)}>Abbrechen</button>
+              </div>
+            </form>
+          </div>
+        )}
       </section>
     </div>
   );

frontend/src/styles.css

@@ -92,30 +92,37 @@ tr:hover {
 
 .create-form {
   display: flex;
-  flex-wrap: wrap;
+  flex-direction: column;
-  gap: 10px;
+  gap: 12px;
+}
+
+.create-form .edit-form {
+  margin-bottom: 0;
+}
+
+.create-name {
+  flex: 0 0 auto !important;
+}
+
+.create-name input {
+  width: 200px;
+}
+
+.create-date {
+  flex: 0 0 auto !important;
+}
+
+.create-date input[type="date"] {
+  width: 150px;
+}
+
+.create-btn-wrap {
+  flex: 0 0 auto;
+  display: flex;
   align-items: flex-end;
 }
 
-.create-form input {
+.create-form .btn-save:disabled {
-  padding: 8px 10px;
-  border: 1px solid #ccc;
-  border-radius: 4px;
-  font-size: 14px;
-  flex: 1 1 160px;
-}
-
-.create-form button {
-  padding: 8px 20px;
-  background: #27ae60;
-  color: white;
-  border: none;
-  border-radius: 4px;
-  cursor: pointer;
-  font-size: 14px;
-}
-
-.create-form button:disabled {
   opacity: 0.6;
   cursor: not-allowed;
 }
@@ -187,6 +194,31 @@ tr:hover {
   font-size: 14px;
 }
 
+.settings-input-wrap {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.settings-input-wrap input {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+  box-sizing: border-box;
+}
+
+.warning {
+  color: #b8520a;
+  background: #fff3e0;
+  border: 1px solid #e67e22;
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-size: 13px;
+}
+
 .settings-form button {
   align-self: flex-start;
   padding: 8px 20px;
@@ -218,3 +250,205 @@ tr:hover {
   color: #999;
   font-size: 12px;
 }
+
+/* Quota progress bars */
+.th-quota {
+  width: 90px;
+}
+
+.quota-cell {
+  width: 100%;
+}
+
+.quota-label {
+  font-size: 12px;
+  color: #555;
+  white-space: nowrap;
+}
+
+.quota-unlimited {
+  color: #aaa;
+  font-size: 14px;
+}
+
+.quota-since {
+  display: block;
+  font-size: 10px;
+  color: #aaa;
+  margin-top: 2px;
+}
+
+.progress-bar {
+  height: 4px;
+  background: #e2e8f0;
+  border-radius: 2px;
+  margin-top: 4px;
+}
+
+.progress-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.3s ease;
+}
+
+/* Edit form */
+.td-status {
+  width: 20px;
+  text-align: center;
+}
+
+.status-active  { color: #27ae60; font-size: 12px; }
+.status-inactive { color: #bdc3c7; font-size: 12px; }
+
+.btn-icon {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px 4px;
+  margin-right: 2px;
+  border-radius: 3px;
+  line-height: 1;
+  position: relative;
+}
+
+.btn-icon:hover {
+  background: rgba(0, 0, 0, 0.06);
+}
+
+.btn-icon-edit   { color: #2980b9; }
+.btn-icon-warn   { color: #e67e22; }
+.btn-icon-ok     { color: #27ae60; }
+.btn-icon-danger { color: #e74c3c; }
+
+.btn-icon::after {
+  content: attr(data-tooltip);
+  position: absolute;
+  bottom: calc(100% + 8px);
+  left: 50%;
+  transform: translateX(-50%);
+  background: #2c3e50;
+  color: white;
+  padding: 5px 10px;
+  border-radius: 5px;
+  font-size: 12px;
+  font-weight: 400;
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon::before {
+  content: '';
+  position: absolute;
+  bottom: calc(100% + 2px);
+  left: 50%;
+  transform: translateX(-50%);
+  border: 5px solid transparent;
+  border-top-color: #2c3e50;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon:hover::after,
+.btn-icon:hover::before {
+  opacity: 1;
+}
+
+.action-cell {
+  white-space: nowrap;
+  position: relative;
+  overflow: visible;
+}
+
+.row-editing {
+  background: #eaf4fb !important;
+}
+
+.edit-section {
+  margin-top: 20px;
+  padding: 16px 20px;
+  background: #f0f7ff;
+  border: 1px solid #3498db;
+  border-radius: 6px;
+}
+
+.edit-section h3 {
+  margin: 0 0 14px;
+  font-size: 15px;
+  color: #2c3e50;
+  font-weight: 600;
+}
+
+.edit-section h3 em {
+  font-style: normal;
+  color: #2980b9;
+}
+
+.edit-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px;
+  align-items: flex-end;
+}
+
+.edit-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  font-size: 13px;
+  font-weight: 500;
+  color: #34495e;
+}
+
+.edit-form label small {
+  font-weight: 400;
+  color: #999;
+  font-size: 11px;
+}
+
+.edit-form input {
+  padding: 6px 8px;
+  border: 1px solid #bdc3c7;
+  border-radius: 4px;
+  font-size: 14px;
+  width: 130px;
+}
+
+.edit-actions {
+  display: flex;
+  gap: 8px;
+  padding-bottom: 2px;
+}
+
+.btn-save {
+  padding: 6px 18px;
+  background: #27ae60;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-save:hover {
+  background: #219a52;
+}
+
+.btn-cancel {
+  padding: 6px 18px;
+  background: #95a5a6;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-cancel:hover {
+  background: #7f8c8d;
+}

frontend/vite.config.js

@@ -5,6 +5,7 @@ export default defineConfig({
   plugins: [react()],
   clearScreen: false,
   server: {
+    open: true,
     proxy: {
       '/api/api-keys': 'http://localhost:8001',
       '/api/settings': 'http://localhost:8001',

run_dev.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Dev runner: startet Proxy, Admin-API und Frontend gemeinsam."""
+import os
+import sys
+import signal
+import subprocess
+import threading
+from pathlib import Path
+
+
+def load_env(path: Path):
+    if not path.exists():
+        return
+    for line in path.read_text(encoding='utf-8').splitlines():
+        line = line.strip()
+        if line and not line.startswith('#') and '=' in line:
+            key, _, val = line.partition('=')
+            os.environ.setdefault(key.strip(), val.strip().strip('"\''))
+
+
+def pipe_output(proc: subprocess.Popen, label: str, color: str):
+    reset = '\033[0m'
+    prefix = f'\033[{color}m[{label}]{reset} '
+    for raw in iter(proc.stdout.readline, b''):
+        sys.stdout.write(prefix + raw.decode(errors='replace'))
+        sys.stdout.flush()
+
+
+def main():
+    root = Path(__file__).parent
+    load_env(root / '.env')
+
+    if not os.environ.get('ADMIN_PASSWORD'):
+        print('Fehler: ADMIN_PASSWORD nicht gesetzt (siehe .env)')
+        sys.exit(1)
+
+    python  = root / '.venv' / 'bin' / 'python'
+    backend = root / 'backend'
+    frontend = root / 'frontend'
+
+    proxy_host = os.environ.get('PROXY_HOST', '0.0.0.0')
+    proxy_port = os.environ.get('PROXY_PORT', '8000')
+    admin_host = os.environ.get('ADMIN_HOST', '127.0.0.1')
+    admin_port = os.environ.get('ADMIN_PORT', '8001')
+
+    print('Initialisiere Datenbank...')
+    subprocess.run([str(python), 'init_db.py'], cwd=backend, check=True)
+
+    print(f'Starte Proxy      → http://{proxy_host}:{proxy_port}')
+    print(f'Starte Admin-API  → http://{admin_host}:{admin_port}')
+    print('Starte Frontend   → http://localhost:5173')
+
+    env = {**os.environ, 'PYTHONUNBUFFERED': '1'}
+
+    procs = [
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'main:app', '--reload',
+             '--host', proxy_host, '--port', proxy_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Proxy   ', '34'),  # blau
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'admin:app', '--reload',
+             '--host', admin_host, '--port', admin_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Admin   ', '33'),  # gelb
+        (subprocess.Popen(
+            ['npm', 'run', 'dev'],
+            cwd=frontend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        ), 'Frontend', '32'),  # grün
+    ]
+
+    for proc, label, color in procs:
+        threading.Thread(target=pipe_output, args=(proc, label, color), daemon=True).start()
+
+    def stop(*_):
+        for p, _, _ in procs:
+            p.terminate()
+
+    signal.signal(signal.SIGINT, stop)
+    signal.signal(signal.SIGTERM, stop)
+
+    for p, _, _ in procs:
+        p.wait()
+
+
+if __name__ == '__main__':
+    main()

start.sh

@@ -21,6 +21,7 @@ fi
 
 PROXY_HOST=${PROXY_HOST:-0.0.0.0}
 PROXY_PORT=${PROXY_PORT:-8000}
+ADMIN_HOST=${ADMIN_HOST:-127.0.0.1}
 ADMIN_PORT=${ADMIN_PORT:-8001}
 FRONTEND_PORT=5173
 
@@ -60,9 +61,8 @@ cd backend
 python3 -m uvicorn main:app --reload --host "$PROXY_HOST" --port "$PROXY_PORT" &
 PIDS+=($!)
 
-# Admin-API immer nur lokal erreichbar (Host nicht konfigurierbar)
+echo "Starte Admin-API auf ${ADMIN_HOST}:${ADMIN_PORT}..."
-echo "Starte Admin-API auf 127.0.0.1:${ADMIN_PORT}..."
+python3 -m uvicorn admin:app --reload --host "$ADMIN_HOST" --port "$ADMIN_PORT" &
-python3 -m uvicorn admin:app --reload --host 127.0.0.1 --port "$ADMIN_PORT" &
 PIDS+=($!)
 cd ..
 
@@ -75,7 +75,7 @@ PIDS+=($!)
 cd ..
 
 echo "Backend läuft (Port $PROXY_PORT)"
-echo "Admin-API läuft (Port $ADMIN_PORT, nur lokal)"
+echo "Admin-API läuft (${ADMIN_HOST}:${ADMIN_PORT})"
 echo "Admin-Oberfläche: http://localhost:$FRONTEND_PORT"
 
 wait