Show app version in admin UI and /version endpoint

Embed APP_VERSION build arg in Docker image (default: dev). build_push.sh passes the git tag as build arg. Proxy exposes GET /version, admin UI shows it as read-only field in settings.
Add /api/ps example to Kurzanleitung
2026-05-08 09:30:23 +02:00 · 2026-05-08 09:25:44 +02:00 · 2026-05-08 09:22:17 +02:00 · 2026-05-08 09:17:08 +02:00 · 2026-05-08 08:41:49 +02:00 · 2026-05-08 08:40:25 +02:00
31 changed files with 4600 additions and 662 deletions
@@ -0,0 +1,52 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+venv/
+*.egg-info/
+.pytest_cache/
+
+# Tests
+backend/tests/
+
+# Environment & secrets
+.env
+*.env.local
+
+# Databases
+*.db
+*.sqlite3
+
+# Logs
+logs/
+*.log
+
+# IDE & tools
+.idea/
+.vscode/
+.claude/
+
+# Git
+.git/
+.gitignore
+
+# Frontend
+frontend/node_modules/
+frontend/dist/
+
+# Docker
+docker-compose.yml
+.dockerignore
+
+# Docs
+*.md
+*.tex
+*.pdf
+
+# Dev & build scripts
+run_dev.py
+build_push.sh
+start.sh
+test_api.sh
@@ -0,0 +1,18 @@
+# Admin-Passwort für die Weboberfläche
+ADMIN_PASSWORD=change-me
+
+# Lokaler Endpunkt des Proxys (Admin-API bindet immer auf 127.0.0.1)
+PROXY_HOST=0.0.0.0
+PROXY_PORT=8000
+ADMIN_PORT=8001
+
+# Datenbankverbindung (Standard: SQLite für Entwicklung)
+DATABASE_URL=sqlite:///./test.db
+
+# Beispiel für PostgreSQL (Produktion):
+# DATABASE_URL=postgresql://user:password@localhost:5432/llm_quota
+
+# Ollama-Einstellungen (auch in der Admin-Oberfläche änderbar)
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
@@ -14,7 +14,11 @@ __pycache__/
 *.sqlite3

 # IDE
-.idea/
+.idea/*
+!.idea/runConfigurations/
+.idea/runConfigurations/*
+!.idea/runConfigurations/Dev.xml
+!.idea/runConfigurations/Docker_Push.xml
 .vscode/

 # Frontend build
@@ -22,4 +26,8 @@ frontend/node_modules/
 frontend/dist/

 # Misc
-config.json
+config.json
+
+# Generated documents
+KURZANLEITUNG.tex
+KURZANLEITUNG.pdf
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Dev" type="PythonConfigurationType" factoryName="Python">
+    <module name="llm_quota" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="SCRIPT_NAME" value="$PROJECT_DIR$/run_dev.py" />
+    <option name="PARAMETERS" value="" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Docker Push" type="ShConfigurationType">
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/build_push.sh" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/bash" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,155 @@
+# mediaeng/llmproxy
+
+A lightweight reverse proxy for [Ollama](https://ollama.com) that manages API keys with configurable token and request quotas. Incoming requests in OpenAI-compatible format are authenticated, checked against the quota, and forwarded to the configured Ollama server.
+
+## Features
+
+- OpenAI-compatible endpoint (`/v1/chat/completions`, `/v1/models`)
+- API key management with daily and monthly token/request limits
+- Web-based admin interface (port 8001)
+- Model lock: enforces a specific model for all requests (useful for courses and lab sessions)
+- Streaming support (Server-Sent Events)
+- Tool use / function calling passthrough
+- Rotating usage logs
+- SQLite (default) or PostgreSQL
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| `8000` | Proxy endpoint (OpenAI API) |
+| `8001` | Admin API + web interface |
+
+All API endpoints require the `ADMIN_PASSWORD` — without a valid token, only the public frontend files (HTML/JS/CSS of the login page) are accessible. The password is therefore the primary protection.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ADMIN_PASSWORD` | – | **Required.** Password for the admin interface |
+| `OLLAMA_URL` | `http://localhost:11434` | URL of the Ollama server (without `/v1` suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Database connection string (SQLite or PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Proxy bind address |
+| `PROXY_PORT` | `8000` | Proxy port |
+| `ADMIN_HOST` | `0.0.0.0` | Admin API bind address (`127.0.0.1` to restrict to local access) |
+| `ADMIN_PORT` | `8001` | Admin API port |
+| `APP_TZ` | `Europe/Berlin` | Timezone for daily/monthly quota resets |
+| `LOG_FILE` | `logs/usage.log` | Path of the rotating usage log file |
+
+## Docker Compose – Ollama on the Host (Linux, recommended)
+
+`network_mode: host` gives the container direct access to the host network stack. Ollama runs on the host and is reachable at `localhost:11434` — not visible from outside. The proxy and admin interface are available directly on host ports 8000 and 8001.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama as Container, SQLite
+
+Ollama and llmproxy run together in Docker. Ollama is not exposed externally.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama as Container, PostgreSQL
+
+For production environments with an external database.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client Configuration
+
+Configure the proxy as an OpenAI-compatible endpoint:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <API key created in the admin interface>
+```
@@ -0,0 +1,155 @@
+# mediaeng/llmproxy
+
+Ein schlanker Reverse-Proxy für [Ollama](https://ollama.com), der API-Keys mit konfigurierbaren Token- und Request-Quoten verwaltet. Eingehende Anfragen im OpenAI-kompatiblen Format werden authentifiziert, auf Quota geprüft und an den konfigurierten Ollama-Server weitergeleitet.
+
+## Funktionen
+
+- OpenAI-kompatibler Endpunkt (`/v1/chat/completions`, `/v1/models`)
+- API-Key-Verwaltung mit tages- und monatlichen Token-/Request-Limits
+- Web-basierte Admin-Oberfläche (Port 8001)
+- Modell-Lock: erzwingt ein bestimmtes Modell für alle Requests (nützlich für Praktika/Kurse)
+- Streaming-Support (Server-Sent Events)
+- Tool-Use / Function Calling wird durchgereicht
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+
+## Ports
+
+| Port | Dienst |
+|------|--------|
+| `8000` | Proxy-Endpunkt (OpenAI-API) |
+| `8001` | Admin-API + Web-Oberfläche |
+
+Alle API-Endpunkte erfordern das `ADMIN_PASSWORD` — ein Zugriff ohne gültiges Token liefert nur die öffentlichen Frontend-Dateien (HTML/JS/CSS der Login-Seite). Das Passwort ist damit die primäre Schutzmaßnahme.
+
+## Umgebungsvariablen
+
+| Variable | Standard | Beschreibung |
+|----------|----------|--------------|
+| `ADMIN_PASSWORD` | – | **Pflicht.** Passwort für die Admin-Oberfläche |
+| `OLLAMA_URL` | `http://localhost:11434` | URL des Ollama-Servers (ohne `/v1`-Suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Datenbank-Verbindungsstring (SQLite oder PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxy |
+| `PROXY_PORT` | `8000` | Port des Proxy |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (`127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für Tages-/Monats-Reset der Quoten |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+
+## Docker Compose – Ollama auf dem Host (Linux, empfohlen)
+
+`network_mode: host` gibt dem Container direkten Zugriff auf das Host-Netzwerk. Ollama läuft auf dem Host und ist über `localhost:11434` erreichbar — nach außen nicht sichtbar. Proxy und Admin-Oberfläche sind direkt auf den Host-Ports 8000 und 8001 verfügbar.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+```
+
+## Docker Compose – Ollama als Container, SQLite
+
+Ollama und llmproxy laufen gemeinsam in Docker. Ollama ist nicht nach außen exposed.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+
+      APP_TZ: Europe/Berlin
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama als Container, PostgreSQL
+
+Für Produktionsumgebungen mit externer Datenbank.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client-Konfiguration
+
+Den Proxy als OpenAI-kompatibler Endpunkt konfigurieren:
+
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <angelegter API-Key aus der Admin-Oberfläche>
+```
@@ -0,0 +1,24 @@
+FROM node:20-alpine AS frontend-builder
+WORKDIR /app
+COPY frontend/package*.json frontend/
+RUN npm ci --prefix frontend
+COPY frontend/ frontend/
+RUN npm run build --prefix frontend
+
+FROM python:3.12-slim
+ARG APP_VERSION=dev
+ENV APP_VERSION=$APP_VERSION
+WORKDIR /app
+
+COPY backend/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt psycopg2-binary
+
+COPY backend/ backend/
+COPY --from=frontend-builder /app/frontend/dist frontend/dist
+
+COPY docker-entrypoint.sh .
+RUN chmod +x docker-entrypoint.sh
+
+EXPOSE 8000 8001
+
+CMD ["./docker-entrypoint.sh"]
@@ -0,0 +1,183 @@
+# LLM-Dienst – Kurzanleitung
+
+## Worum geht es?
+
+Der Dienst stellt **große Sprachmodelle (LLMs)** über eine einfache HTTP-API bereit, die direkt aus Python-Skripten, Jupyter-Notebooks oder eigenen Anwendungen angesprochen werden kann. Die Modelle laufen lokal auf einem GPU-Server im Intranet – ohne Datenübertragung nach außen und ohne Cloud-Kosten.
+
+Typische Anwendungsfälle:
+
+- Texte zusammenfassen, übersetzen oder umformulieren
+- KI-gestütztes Coding (z.B. mit **[opencode](https://opencode.ai)**) 
+- Experimente mit Prompt-Engineering und LLM-Integration in eigene Projekte
+
+---
+
+## Zugang
+
+Der Dienst ist **nur im Intranet (VPN)** erreichbar.
+
+| | |
+|---|---|
+| **API-Endpunkt** | `http://141.75.33.244:8000` |
+| **Authentifizierung** | API-Key erforderlich (per E-Mail beim Admin anfragen) |
+
+---
+
+## Verfügbare Modelle
+
+| Modell | Größe | Hinweis |
+|---|---|---|
+| `gemma4:31b` | 19 GB | kompakt, schnell |
+| `gpt-oss:20b` | 13 GB | kompakt, schnell |
+| `gpt-oss:120b` | 65 GB | sehr leistungsfähig |
+| `qwen3.5:122b` | 81 GB | sehr leistungsfähig |
+| `qwen3-coder-next:q8_0` | 84 GB | speziell für Code |
+
+> **Wichtig:** Es kann immer nur **ein Modell gleichzeitig** im GPU-Speicher geladen sein.
+> Wechselt jemand das Modell, muss das vorherige entladen und das neue geladen werden –
+> das kann **mehrere Minuten** dauern. Der erste Prompt nach einem Modellwechsel ist
+> deshalb deutlich langsamer. Danach bleibt das Modell einige Zeit geladen.
+
+---
+
+## Python-Beispiel – Einfacher Prompt
+
+Das API folgt dem **OpenAI-Standard**, d.h. die `openai`-Bibliothek kann direkt verwendet werden.
+
+```bash
+pip install openai
+```
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."            # euren API-Key eintragen
+BASE_URL = "http://141.75.33.244:8000/v1"
+MODEL = "gemma4:31b"          # Modell nach Bedarf wählen
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+response = client.chat.completions.create(
+    model=MODEL,
+    messages=[
+        {"role": "user", "content": "Erkläre den Unterschied zwischen L1- und L2-Regularisierung."}
+    ]
+)
+
+print(response.choices[0].message.content)
+```
+
+---
+
+## Python-Beispiel – Verfügbare Modelle abfragen
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."
+BASE_URL = "http://141.75.33.244:8000/v1"
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+models = client.models.list()
+for m in models.data:
+    print(m.id)
+```
+
+---
+
+## Aktuell geladenes Modell abfragen
+
+Da immer nur ein Modell gleichzeitig im Speicher sein kann, lässt sich mit folgendem Aufruf prüfen, welches Modell gerade aktiv ist:
+
+```python
+import httpx
+
+r = httpx.get(
+    "http://141.75.33.244:8000/api/ps",
+    headers={"Authorization": "Bearer sk-..."}
+)
+print(r.json())
+```
+
+Die Antwort enthält Modellname, Größe und wie lange das Modell noch im Speicher bleibt.
+
+---
+
+## Empfehlungen zur Nutzung
+
+- **Kleines Modell zuerst** (`gemma4:31b` oder `gpt-oss:20b`) – viel schneller, für viele Aufgaben ausreichend.
+- **Großes Modell** nur bei komplexen Aufgaben (`qwen3.5:122b`, `gpt-oss:120b`).
+- **Code-Aufgaben**: `qwen3-coder-next:q8_0` ist speziell dafür optimiert.
+- Wenn möglich, **dasselbe Modell wie andere Nutzer** verwenden, um häufige Modellwechsel zu vermeiden.
+
+---
+
+## Quotas
+
+Je nach API-Key können folgende Limits konfiguriert sein:
+
+- Maximale **Anfragen pro Tag / Monat**
+- Maximale **Tokens pro Tag / Monat**
+
+Bei Überschreitung gibt die API den Statuscode `429 Too Many Requests` zurück.
+
+---
+
+## Coding-Assistent: opencode
+
+[opencode](https://opencode.ai) ist ein terminal-basierter KI-Coding-Agent (ähnlich Claude Code), der OpenAI-kompatible APIs unterstützt und damit direkt auf den Intranet-Dienst zeigen kann.
+
+### Installation
+
+```bash
+npm install -g opencode-ai
+# oder
+curl -fsSL https://opencode.ai/install | bash
+```
+
+### Konfiguration
+
+Konfigurationsdatei anlegen unter `~/.config/opencode/config.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "providers": {
+    "openai": {
+      "apiKey": "sk-...",
+      "baseURL": "http://141.75.33.244:8000/v1"
+    }
+  },
+  "model": "openai/qwen3-coder-next:q8_0"
+}
+```
+
+Für Code-Aufgaben empfiehlt sich `qwen3-coder-next:q8_0`, für allgemeine Aufgaben `gemma4:31b` oder `gpt-oss:20b`.
+
+### Starten
+
+```bash
+opencode
+```
+
+opencode öffnet eine interaktive Terminal-Oberfläche und kann dann im Projektverzeichnis eingesetzt werden – Dateien lesen, Code generieren, Refactoring vorschlagen usw.
+
+---
+
+## Administration (nur für Admins)
+
+Das Web-Interface zur Verwaltung von API-Keys und Quotas ist erreichbar unter:
+
+**`http://141.75.33.244:8001`**
+
+Dort können API-Keys angelegt, deaktiviert und mit Quotas versehen werden.
+
+### Modell-Lock für Praktika
+
+Unter **Einstellungen → Aktives Modell (Lock)** kann ein Modell fest vorgegeben werden. Ist ein Lock gesetzt, wird das `model`-Feld in jedem Request durch dieses Modell ersetzt – unabhängig davon, was der Client schickt. Das verhindert unkoordinierte Modellwechsel während einer Veranstaltung, die alle Teilnehmenden durch lange Ladezeiten ausbremsen würden.
+
+Typischer Ablauf für ein Praktikum:
+1. Vor der Veranstaltung: passendes Modell in Ollama laden
+2. Lock in der Admin-Oberfläche aktivieren
+3. Nach der Veranstaltung: Lock wieder deaktivieren (Feld leeren)
@@ -1,122 +1,206 @@
 # Ollama Proxy mit API-Keys und Quotas

-Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung und Quota-Management.
+Ollama bietet von sich aus keine Authentifizierung — wer die API erreicht, kann sie nutzen. Dieses Projekt löst das Problem: Ollama bleibt an `localhost` gebunden und ist von außen nicht erreichbar. Vorgeschaltet läuft ein Proxy (Port 8000), der jeden Request auf einen gültigen API-Key prüft und optional Token- sowie Request-Quoten pro Key durchsetzt. Eine Web-Admin-Oberfläche (Port 8001) erlaubt das Verwalten von Keys, Quoten und Ollama-Einstellungen.

 ## Features

 - API-Key-Authentifizierung (Bearer Token oder `sk-`-Prefix)
+- Optionales Ablaufdatum pro API-Key
 - Quota-Management mit getrennten Tages- und Monatslimits (Tokens & Requests)
- Token-Zählung via tiktoken (cl100k_base)
- Usage-Tracking mit automatischem täglichem/monatlichem Reset
- Web-Admin-Oberfläche für User- und Quota-Verwaltung
- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt
+- Token-Zählung via tiktoken, Reset-Grenzen in der Zeitzone Europe/Berlin
+- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Verbrauchsanzeige)
+- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt mit Streaming und Tool-Use
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+- Docker-Image auf DockerHub: `mediaeng/llmproxy`

 ## Sicherheit

- Passwörter mit bcrypt gehasht
- API-Keys als SHA-256-Hash in der DB – Plaintext wird nur einmalig bei Erstellung zurückgegeben
- Admin-Zugriff über `is_admin`-Flag in der DB, nicht über Hardcoded-Namen
- CORS-Origins konfigurierbar via `ALLOWED_ORIGINS`
+- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`) — alle API-Endpunkte erfordern den Token
+- API-Keys als SHA-256-Hash in der DB — Plaintext nur einmalig bei Erstellung
 - Quota-Check atomar mit `SELECT FOR UPDATE` (kein TOCTOU-Race)
-
-## Installation & Start
-
-### Voraussetzungen
-
- Python 3.12+
- PostgreSQL 16+ (oder SQLite für Entwicklung)
- Node.js 18+ (für Frontend)
-
-### Lokal mit SQLite (Entwicklung)
-
-```bash
-# Backend
-cd backend
-pip install -r requirements.txt
-python init_db.py
-python setup_admin.py
-uvicorn main:app --reload --port 8000
-
-# Admin-API (in neuem Terminal)
-uvicorn admin:app --reload --port 8001
-
-# Frontend (in neuem Terminal)
-cd frontend
-npm install
-npm run dev
-```
-
-### Mit PostgreSQL & Docker (Produktion)
-
-```bash
-docker compose up -d
-docker compose exec backend python init_db.py
-docker compose exec backend python setup_admin.py
-```
+- Admin-Port 8001 über `ADMIN_HOST=127.0.0.1` auf lokalen Zugriff beschränkbar

 ## Konfiguration

-`.env`-Datei im `backend/`-Verzeichnis anlegen:
+`.env`-Datei im Projektverzeichnis anlegen:

 ```env
-DATABASE_URL=postgresql://user:pass@host:5432/db
-OLLAMA_URL=http://ollama:11434
-ALLOWED_ORIGINS=https://admin.example.com
+ADMIN_PASSWORD=change-me
+PROXY_HOST=0.0.0.0
+PROXY_PORT=8000
+ADMIN_HOST=0.0.0.0
+ADMIN_PORT=8001
+DATABASE_URL=sqlite:///./test.db
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+LOG_FILE=logs/usage.log
 ```

 | Variable | Standard | Beschreibung |
 |----------|----------|--------------|
-| `DATABASE_URL` | PostgreSQL lokal | DB-Verbindungsstring; `sqlite:///` für SQLite |
-| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz |
-| `ALLOWED_ORIGINS` | `http://localhost:5173` | Kommagetrennte CORS-Origins für die Admin-UI |
+| `ADMIN_PASSWORD` | — | Passwort für die Admin-Oberfläche (**Pflicht**) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxys |
+| `PROXY_PORT` | `8000` | Port des Proxys |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (z. B. `127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring (SQLite oder PostgreSQL) |
+| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz (auch in der UI änderbar) |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für tägliche/monatliche Quota-Resets |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ALLOWED_ORIGINS` | `http://localhost:5173` | CORS-Origins (nur für Entwicklung relevant) |

-## Proxy-Endpunkte
+## Entwicklung (lokal)
+
+### Voraussetzungen
+
+- Python 3.12+ mit virtualenv
+- Node.js 18+
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -r backend/requirements-dev.txt
+cd frontend && npm install
+```
+
+### Starten
+
+**Per Script:**
+```bash
+cp .env.example .env   # ADMIN_PASSWORD setzen
+./start.sh
+```
+
+**Per PyCharm:** Run-Config „Dev" starten (startet Proxy, Admin-API und Vite-Dev-Server gemeinsam).
+
+Das Script prüft alle Ports auf Belegung, initialisiert die Datenbank und startet alle drei Dienste.
+
+Admin-Oberfläche: `http://localhost:5173`
+
+## Produktion (Docker)
+
+### Docker Compose (empfohlen)
+
+```bash
+docker compose up -d
+```
+
+Zieht das Image von DockerHub und lädt Variablen aus `.env`.
+
+Das Setup verwendet `network_mode: host`: Der Container teilt den Netzwerkstack des Hosts, statt ein eigenes virtuelles Netzwerk zu bekommen. Das ist hier aus zwei Gründen die richtige Wahl:
+
+1. **Ollama soll nicht von außen erreichbar sein.** Ollama läuft auf dem Host und ist an `127.0.0.1:11434` gebunden — nur lokal erreichbar. Mit einem eigenen Container-Netzwerk (Bridge-Mode) wäre `localhost` aus Sicht des Containers der Container selbst, nicht der Host. Die übliche Alternative (`host.docker.internal` + `extra_hosts`) ist auf Linux unzuverlässig.
+
+2. **Kein doppeltes Port-Mapping nötig.** Mit `network_mode: host` sind Port 8000 und 8001 direkt auf dem Host verfügbar, ohne `ports:`-Einträge in der Compose-Datei.
+
+### Image selbst bauen und pushen
+
+```bash
+./build_push.sh
+```
+
+Das Script zeigt den aktuellen Git-Tag, bietet an einen neuen zu setzen, baut das Image für `linux/arm64` und pusht zu `mediaeng/llmproxy`.
+
+### Port 8001 (Admin)
+
+Alle Admin-Endpunkte erfordern das `ADMIN_PASSWORD` — der Token ist der primäre Schutz. Für zusätzliche Härtung lässt sich die Admin-API auf lokalen Zugriff beschränken:
+
+```env
+ADMIN_HOST=127.0.0.1
+```
+
+Bei `network_mode: host` (Produktions-Standard) ist das die einzig wirksame Methode — Docker-Port-Mapping greift dort nicht.
+
+### HTTPS via Reverse-Proxy (ungetestet)
+
+Wer Proxy und Admin-Oberfläche per HTTPS bereitstellen will, kann einen weiteren Reverse-Proxy (z. B. Nginx oder Caddy) vorschalten. Bei `network_mode: host` lauschen beide Dienste direkt auf dem Host, Nginx/Caddy proxyen auf `localhost`.
+
+**Caddy** (empfohlen — automatisches TLS via Let's Encrypt):
+
+```
+llm.example.com {
+    reverse_proxy localhost:8000 {
+        flush_interval -1
+    }
+}
+
+llm-admin.example.com {
+    reverse_proxy localhost:8001
+}
+```
+
+**Nginx** (mit Certbot-Zertifikaten):
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name llm.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
+
+    location / {
+        proxy_pass         http://127.0.0.1:8000;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_buffering    off;   # nötig für Streaming
+        proxy_cache        off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name llm-admin.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm-admin.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm-admin.example.com/privkey.pem;
+
+    location / {
+        proxy_pass       http://127.0.0.1:8001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+Clients konfigurieren dann `https://llm.example.com/v1` als Base URL.
+
+## Proxy-Endpunkte (Port 8000)

 Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header.

 ```bash
-curl -X POST http://localhost:8000/api/generate \
+curl -X POST http://localhost:8000/v1/chat/completions \
  -H "Authorization: Bearer sk-xxxxxx" \
  -H "Content-Type: application/json" \
-  -d '{"model":"llama3","prompt":"Say hello"}'
+  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}]}'
 ```

-| Endpunkt | Beschreibung |
-|----------|--------------|
-| `POST /api/generate` | Ollama generate |
-| `POST /api/chat` | Ollama chat |
-| `GET /api/tags` | Verfügbare Modelle |
-| `GET /v1/models` | Modelle (OpenAI-Format) |
-| `POST /v1/chat/completions` | Chat (OpenAI-Format) |
-
-## Admin-API (Port 8001)
-
-Alle Endpunkte erfordern einen API-Key eines Nutzers mit `is_admin=true`.
-
 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/users` | GET | Alle User auflisten |
-| `/api/users` | POST | Neuen User anlegen |
-| `/api/api-keys` | GET | Alle API-Keys auflisten |
-| `/api/api-keys` | POST | Neuen API-Key erstellen (Plaintext einmalig in Response) |
+| `/v1/chat/completions` | POST | Chat (OpenAI-Format, Streaming + Tool-Use) |
+| `/v1/models` | GET | Modelle (OpenAI-Format) |
+| `/api/generate` | POST | Ollama generate (nativ) |
+| `/api/chat` | POST | Ollama chat (nativ) |
+| `/api/tags` | GET | Verfügbare Modelle |
+| `/api/versions` | GET | Ollama-Version |
+
+## Admin-API (Port 8001)
+
+Alle Endpunkte erfordern `Authorization: Bearer <ADMIN_PASSWORD>`.
+
+| Endpunkt | Methode | Beschreibung |
+|----------|---------|--------------|
+| `/api/api-keys` | GET | Alle API-Keys mit Verbrauchsdaten |
+| `/api/api-keys` | POST | Neuen API-Key erstellen |
+| `/api/api-keys/{id}/quota` | PATCH | Limits eines Keys aktualisieren |
+| `/api/api-keys/{id}/activate` | PUT | API-Key aktivieren |
 | `/api/api-keys/{id}/deactivate` | PUT | API-Key deaktivieren |
-| `/api/quotas/{user_id}` | PUT | Quota für User setzen |
-
-### Quota setzen
-
-```bash
-curl -X PUT http://localhost:8001/api/quotas/1 \
-  -H "Authorization: Bearer sk-admin-key" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "daily_tokens": 1000000,
-    "monthly_tokens": 10000000,
-    "daily_requests": 1000,
-    "monthly_requests": 10000
-  }'
-```
-
-`null` für ein Limit bedeutet unbegrenzt.
+| `/api/api-keys/{id}` | DELETE | API-Key löschen |
+| `/api/settings` | GET/PUT | Ollama-URL und Standard-Modell |
+| `/api/ollama-models` | GET | Verfügbare Modelle von Ollama |
+| `/api/proxy-info` | GET | Lokaler Proxy-Endpunkt |

 ## Tests

@@ -130,28 +214,37 @@ python -m pytest tests/ -v
 ```
 llm_quota/
 ├── backend/
-│   ├── main.py           # Proxy-Server
-│   ├── admin.py          # Admin-API
-│   ├── database.py       # DB-Verbindung & Session
-│   ├── models.py         # SQLAlchemy-Modelle
-│   ├── schemas.py        # Pydantic-Schemas
-│   ├── crud.py           # DB-Operationen & Token-Zählung
-│   ├── init_db.py        # Tabellen anlegen
-│   ├── setup_admin.py    # Admin-User & API-Key erstellen
-│   ├── requirements.txt
-│   ├── Dockerfile
+│   ├── main.py              # Proxy-Server (Port 8000)
+│   ├── admin.py             # Admin-API + Static-File-Serving (Port 8001)
+│   ├── database.py          # DB-Verbindung & Session
+│   ├── models.py            # SQLAlchemy-Modelle (APIKey, Setting, Usage)
+│   ├── schemas.py           # Pydantic-Schemas
+│   ├── crud.py              # DB-Operationen, Token-Zählung, Quota-Logik
+│   ├── init_db.py           # Tabellen anlegen & Settings seeden
+│   ├── requirements.txt     # Produktiv-Dependencies
+│   ├── requirements-dev.txt # Test-Dependencies
 │   └── tests/
-│       ├── conftest.py   # Fixtures
-│       ├── test_auth.py  # Authentifizierungs-Tests
-│       └── test_quota.py # Quota- & Token-Tests
+│       ├── conftest.py
+│       ├── test_auth.py
+│       └── test_quota.py
 ├── frontend/
 │   └── src/
-│       ├── main.jsx
+│       ├── main.jsx         # React-Admin-UI
 │       └── styles.css
-├── .gitignore
-└── docker-compose.yml
+├── .idea/runConfigurations/
+│   └── Dev.xml              # PyCharm Run-Config
+├── Dockerfile
+├── docker-compose.yml       # Produktiv-Start mit DockerHub-Image
+├── docker-entrypoint.sh
+├── .dockerignore
+├── start.sh                 # Entwicklungs-Startscript
+├── run_dev.py               # Entwicklungs-Runner für PyCharm
+├── build_push.sh            # Docker-Build & Push zu DockerHub
+├── DOCKERHUB.md             # DockerHub-Beschreibung (deutsch)
+├── DOCKERHUB.en.md          # DockerHub-Beschreibung (englisch)
+└── .gitignore
 ```

 ## Lizenz

-MIT
+MIT
@@ -1,115 +1,175 @@
 import os
+import secrets
+import httpx
+from pathlib import Path
 from fastapi import FastAPI, Depends, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from database import get_db
 import crud, schemas
-from models import User, APIKey, Quota
+from models import APIKey as APIKeyModel, Usage as UsageModel

 app = FastAPI(title="Ollama Proxy Admin API")

 ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD")
+if not ADMIN_PASSWORD:
+    raise RuntimeError("ADMIN_PASSWORD environment variable must be set")

 app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS,
    allow_credentials=True,
-    allow_methods=["GET", "POST", "PUT", "DELETE"],
+    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
 )

-async def require_admin_auth(request: Request, db: Session = Depends(get_db)):
-    auth_header = request.headers.get("Authorization", "")
-    if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
-    elif auth_header.startswith("sk-"):
-        api_key = auth_header
-    else:
-        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+def require_admin_auth(request: Request):
+    auth = request.headers.get("Authorization", "")
+    token = auth.removeprefix("Bearer ").strip()
+    if not secrets.compare_digest(token, ADMIN_PASSWORD):
+        raise HTTPException(status_code=401, detail="Invalid admin password")

-    db_key = crud.verify_api_key(db, api_key)
-    if not db_key:
-        raise HTTPException(status_code=401, detail="Invalid API key")
-
-    db_user = db.query(User).filter(User.id == db_key.user_id).first()
-    if not db_user or not db_user.is_admin:
-        raise HTTPException(status_code=403, detail="Admin access required")
-
-    request.state.user = db_user
-
-@app.get("/api/users", response_model=list[schemas.User])
-async def read_users(
-    skip: int = 0,
-    limit: int = 100,
+@app.get("/api/api-keys", response_model=list[schemas.APIKeyWithUsage])
+async def read_api_keys(
+    skip: int = 0, limit: int = 100,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    users = db.query(User).offset(skip).limit(limit).all()
-    return users
-
-@app.post("/api/users", response_model=schemas.User)
-async def create_user(
-    user: schemas.UserCreate,
-    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
-):
-    db_user = crud.get_user_by_username(db, username=user.username)
-    if db_user:
-        raise HTTPException(status_code=400, detail="Username already registered")
-    db_user = crud.get_user_by_email(db, email=user.email)
-    if db_user:
-        raise HTTPException(status_code=400, detail="Email already registered")
-    return crud.create_user(db=db, username=user.username, email=user.email, password=user.password)
+    keys = db.query(APIKeyModel).offset(skip).limit(limit).all()
+    result = []
+    for key in keys:
+        item = schemas.APIKeyWithUsage.model_validate(key)
+        usage = db.query(UsageModel).filter(UsageModel.api_key_id == key.id).first()
+        if usage:
+            item.tokens_used_today = usage.tokens_used_today or 0
+            item.tokens_used_month = usage.tokens_used_month or 0
+            item.requests_today = usage.requests_today or 0
+            item.requests_month = usage.requests_month or 0
+            item.daily_reset_at = usage.daily_reset_at
+            item.monthly_reset_at = usage.monthly_reset_at
+        result.append(item)
+    return result

@app.post("/api/api-keys", response_model=schemas.APIKeyCreated)
 async def create_api_key(
    api_key: schemas.APIKeyCreate,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_user = db.query(User).filter(User.id == api_key.user_id).first()
-    if not db_user:
-        raise HTTPException(status_code=404, detail="User not found")
-    db_key, raw_key = crud.create_api_key(db=db, user_id=api_key.user_id, name=api_key.name)
+    db_key, raw_key = crud.create_api_key(
+        db,
+        name=api_key.name,
+        expires_at=api_key.expires_at,
+        daily_tokens=api_key.daily_tokens,
+        monthly_tokens=api_key.monthly_tokens,
+        daily_requests=api_key.daily_requests,
+        monthly_requests=api_key.monthly_requests,
+    )
    result = schemas.APIKeyCreated.model_validate(db_key)
    result.plaintext_key = raw_key
    return result

-@app.get("/api/api-keys", response_model=list[schemas.APIKey])
-async def read_api_keys(
-    skip: int = 0,
-    limit: int = 100,
+@app.patch("/api/api-keys/{api_key_id}/quota", response_model=schemas.APIKey)
+async def update_quota(
+    api_key_id: int,
+    quota: schemas.QuotaUpdate,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    api_keys = db.query(APIKey).offset(skip).limit(limit).all()
-    return api_keys
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    for field, value in quota.model_dump(exclude_unset=True).items():
+        setattr(db_key, field, value)
+    db.commit()
+    db.refresh(db_key)
+    return db_key

@app.put("/api/api-keys/{api_key_id}/deactivate")
 async def deactivate_api_key(
    api_key_id: int,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
    if not db_key:
        raise HTTPException(status_code=404, detail="API key not found")
    db_key.is_active = False
    db.commit()
    return {"message": "API key deactivated"}

-@app.put("/api/quotas/{user_id}", response_model=schemas.Quota)
-async def update_quota(
-    user_id: int,
-    quota: schemas.QuotaCreate,
+@app.put("/api/api-keys/{api_key_id}/activate")
+async def activate_api_key(
+    api_key_id: int,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_quota = db.query(Quota).filter(Quota.user_id == user_id).first()
-    if not db_quota:
-        raise HTTPException(status_code=404, detail="Quota not found")
-    for key, value in quota.model_dump(exclude_unset=True).items():
-        setattr(db_quota, key, value)
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db_key.is_active = True
    db.commit()
-    db.refresh(db_quota)
-    return db_quota
+    return {"message": "API key activated"}
+
+@app.delete("/api/api-keys/{api_key_id}")
+async def delete_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.delete(db_key)
+    db.commit()
+    return {"message": "API key deleted"}
+
+@app.get("/api/proxy-info")
+async def get_proxy_info(_ = Depends(require_admin_auth)):
+    host = os.getenv("PROXY_HOST", "0.0.0.0")
+    port = os.getenv("PROXY_PORT", "8000")
+    display_host = "localhost" if host in ("0.0.0.0", "::") else host
+    return {
+        "endpoint": f"http://{display_host}:{port}",
+        "version": os.getenv("APP_VERSION", "dev"),
+    }
+
+@app.get("/api/settings", response_model=schemas.Settings)
+async def read_settings(db: Session = Depends(get_db), _ = Depends(require_admin_auth)):
+    return schemas.Settings(
+        ollama_url=crud.get_setting(db, "ollama_url", "http://localhost:11434"),
+        force_model=crud.get_setting(db, "force_model") or None,
+    )
+
+@app.put("/api/settings", response_model=schemas.Settings)
+async def update_settings(
+    settings: schemas.Settings,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = settings.ollama_url.rstrip('/').removesuffix('/v1')
+    crud.set_setting(db, "ollama_url", ollama_url)
+    crud.set_setting(db, "force_model", settings.force_model or "")
+    return schemas.Settings(ollama_url=ollama_url, force_model=settings.force_model or None)
+
+@app.get("/api/ollama-models")
+async def get_ollama_models(
+    url: str = None,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = url or crud.get_setting(db, "ollama_url", "http://localhost:11434")
+    try:
+        async with httpx.AsyncClient(timeout=5.0) as client:
+            response = await client.get(f"{ollama_url}/api/tags")
+        models = [m["name"] for m in response.json().get("models", [])]
+        return {"models": models, "reachable": True}
+    except Exception:
+        return {"models": [], "reachable": False}
+
+# Statisches Frontend ausliefern (nur im Produktivbetrieb, wenn dist/ existiert)
+_dist = Path(__file__).parent.parent / "frontend" / "dist"
+if _dist.exists():
+    app.mount("/", StaticFiles(directory=_dist, html=True), name="frontend")
@@ -1,116 +1,116 @@
+import os
 import secrets
 import hashlib
-import bcrypt
 import tiktoken
 from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
 from sqlalchemy.orm import Session
-from models import APIKey, User, Quota, Usage
+from models import APIKey, Usage, Setting

 _encoder = tiktoken.get_encoding("cl100k_base")
+_tz = ZoneInfo(os.getenv("APP_TZ", "Europe/Berlin"))
+
+def _now_local() -> datetime:
+    return datetime.now(_tz)
+
+def _to_local(dt: datetime) -> datetime:
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(_tz)

 def count_tokens(text: str) -> int:
    return len(_encoder.encode(text))

-def hash_password(password: str) -> str:
-    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
-
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return bcrypt.checkpw(plain_password.encode(), hashed_password.encode())
-
 def _hash_api_key(key: str) -> str:
    return hashlib.sha256(key.encode()).hexdigest()

-def get_user_by_username(db: Session, username: str):
-    return db.query(User).filter(User.username == username).first()
-
-def get_user_by_email(db: Session, email: str):
-    return db.query(User).filter(User.email == email).first()
-
-def generate_api_key():
+def generate_api_key() -> str:
    return "sk-" + secrets.token_urlsafe(32)

-def create_user(db: Session, username: str, email: str, password: str, is_admin: bool = False):
-    db_user = User(
-        username=username,
-        email=email,
-        hashed_password=hash_password(password),
-        is_admin=is_admin,
-    )
-    db.add(db_user)
-    db.commit()
-    db.refresh(db_user)
-
-    default_quota = Quota(
-        user_id=db_user.id,
-        daily_tokens=1000000,
-        monthly_tokens=10000000,
-        daily_requests=1000,
-        monthly_requests=10000
-    )
-    db.add(default_quota)
-    db.commit()
-
-    return db_user
-
-def create_api_key(db: Session, user_id: int, name: str) -> tuple[APIKey, str]:
+def create_api_key(
+    db: Session,
+    name: str,
+    expires_at: datetime = None,
+    daily_tokens: int = None,
+    monthly_tokens: int = None,
+    daily_requests: int = None,
+    monthly_requests: int = None,
+) -> tuple[APIKey, str]:
    raw_key = generate_api_key()
    db_key = APIKey(
        name=name,
        key=_hash_api_key(raw_key),
-        user_id=user_id
+        key_prefix=raw_key[:12],
+        expires_at=expires_at,
+        daily_tokens=daily_tokens,
+        monthly_tokens=monthly_tokens,
+        daily_requests=daily_requests,
+        monthly_requests=monthly_requests,
    )
    db.add(db_key)
    db.commit()
    db.refresh(db_key)
    return db_key, raw_key

+def get_setting(db: Session, key: str, default: str = None) -> str:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    return row.value if row else default
+
+def set_setting(db: Session, key: str, value: str) -> None:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    if row:
+        row.value = value
+    else:
+        db.add(Setting(key=key, value=value))
+    db.commit()
+
 def verify_api_key(db: Session, api_key: str):
    key_hash = _hash_api_key(api_key)
-    return db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    db_key = db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    if db_key and db_key.expires_at:
+        expires = db_key.expires_at
+        if expires.tzinfo is None:
+            expires = expires.replace(tzinfo=timezone.utc)
+        if expires < datetime.now(timezone.utc):
+            return None
+    return db_key

-def get_quota(db: Session, user_id: int):
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_quota_by_user_id(db: Session, user_id: int):
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_usage(db: Session, user_id: int):
-    return db.query(Usage).filter(Usage.user_id == user_id).first()
-
-def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, requests: int = 1) -> bool:
+def check_and_increment_quota(db: Session, api_key_id: int, tokens: int = 0, requests: int = 1) -> bool:
    usage = (
        db.query(Usage)
-        .filter(Usage.user_id == user_id)
+        .filter(Usage.api_key_id == api_key_id)
        .with_for_update()
        .first()
    )
    if not usage:
-        usage = Usage(user_id=user_id)
+        usage = Usage(api_key_id=api_key_id)
        db.add(usage)
        db.flush()

-    now = datetime.now(timezone.utc)
+    now = _now_local()
+    daily_reset_local = _to_local(usage.daily_reset_at)
+    monthly_reset_local = _to_local(usage.monthly_reset_at)

-    if usage.daily_reset_at.date() < now.date():
+    if daily_reset_local.date() < now.date():
        usage.tokens_used_today = 0
        usage.requests_today = 0
        usage.daily_reset_at = now

-    if (usage.monthly_reset_at.year, usage.monthly_reset_at.month) < (now.year, now.month):
+    if (monthly_reset_local.year, monthly_reset_local.month) < (now.year, now.month):
        usage.tokens_used_month = 0
        usage.requests_month = 0
        usage.monthly_reset_at = now

-    quota = get_quota(db, user_id)
+    api_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
    allowed = True
-    if quota:
-        if quota.daily_tokens and (usage.tokens_used_today + tokens) > quota.daily_tokens:
+    if api_key:
+        if api_key.daily_tokens and (usage.tokens_used_today + tokens) > api_key.daily_tokens:
            allowed = False
-        elif quota.monthly_tokens and (usage.tokens_used_month + tokens) > quota.monthly_tokens:
+        elif api_key.monthly_tokens and (usage.tokens_used_month + tokens) > api_key.monthly_tokens:
            allowed = False
-        elif quota.daily_requests and (usage.requests_today + requests) > quota.daily_requests:
+        elif api_key.daily_requests and (usage.requests_today + requests) > api_key.daily_requests:
            allowed = False
-        elif quota.monthly_requests and (usage.requests_month + requests) > quota.monthly_requests:
+        elif api_key.monthly_requests and (usage.requests_month + requests) > api_key.monthly_requests:
            allowed = False

    if allowed:
@@ -120,4 +120,4 @@ def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, reques
        usage.requests_month += requests

    db.commit()
-    return allowed
+    return allowed
@@ -1,19 +1,18 @@
+import os
+from dotenv import load_dotenv
 from sqlalchemy import create_engine
+
+load_dotenv(dotenv_path=os.path.join(os.path.dirname(__file__), '..', '.env'))
 from sqlalchemy.orm import sessionmaker, declarative_base

-try:
-    import os
-    DATABASE_URL = os.environ.get("DATABASE_URL", "postgresql://ollama:password@localhost:5432/ollama_proxy")
-    if "sqlite" in DATABASE_URL:
-        engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
-    else:
-        engine = create_engine(DATABASE_URL)
-except Exception:
-    DATABASE_URL = "sqlite:///./test.db"
+DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
+
+if "sqlite" in DATABASE_URL:
    engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
+else:
+    engine = create_engine(DATABASE_URL)

 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
-
 Base = declarative_base()

 def get_db():
@@ -1,24 +1,21 @@
-from sqlalchemy import create_engine
-from sqlalchemy.orm import sessionmaker
-from database import Base
-import models
 import os
+from dotenv import load_dotenv

-SQLALCHEMY_DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
+load_dotenv(dotenv_path=os.path.join(os.path.dirname(__file__), '..', '.env'))

-try:
-    if "sqlite" in SQLALCHEMY_DATABASE_URL:
-        engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
-    else:
-        engine = create_engine(SQLALCHEMY_DATABASE_URL)
-except:
-    SQLALCHEMY_DATABASE_URL = "sqlite:///./test.db"
-    engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
-SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+from database import Base, engine, SessionLocal
+import models
+from crud import get_setting, set_setting

 def init_db():
    Base.metadata.create_all(bind=engine)
-    print("Database tables created successfully!")
+
+    db = SessionLocal()
+    if not get_setting(db, "ollama_url"):
+        set_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    db.close()
+
+    print("Database initialized.")

 if __name__ == "__main__":
    init_db()
@@ -1,144 +1,225 @@
-import time
-import uuid
+import logging
+import os
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
 from fastapi import FastAPI, HTTPException, Depends, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from sqlalchemy.orm import Session
-from database import get_db, SessionLocal
+from database import get_db
 import crud
 import httpx
-import os

-app = FastAPI(title="Ollama Proxy")
-OLLAMA_URL = os.getenv("OLLAMA_URL", "http://localhost:11434")
+_log_dir = Path(os.getenv("LOG_FILE", "logs/usage.log")).parent
+_log_dir.mkdir(parents=True, exist_ok=True)
+_fmt = logging.Formatter("%(asctime)s | %(message)s", datefmt="%Y-%m-%d %H:%M:%S")

-async def proxy_request(url: str, method: str = "GET", json_data: dict = None, headers: dict = None):
-    async with httpx.AsyncClient() as client:
-        response = await client.request(method=method, url=url, json=json_data, headers=headers)
-        return response
+# Rotating usage log (8 KB per file, 3 backups)
+_usage_handler = RotatingFileHandler(str(_log_dir / "usage.log"), maxBytes=8192, backupCount=3, encoding="utf-8")
+_usage_handler.setFormatter(_fmt)
+usage_log = logging.getLogger("proxy.usage")
+usage_log.setLevel(logging.INFO)
+usage_log.addHandler(_usage_handler)
+usage_log.propagate = False

-@app.middleware("http")
-async def authenticate_and_quota(request: Request, call_next):
+# Rotating error log (64 KB per file, 5 backups)
+_error_handler = RotatingFileHandler(str(_log_dir / "error.log"), maxBytes=65536, backupCount=5, encoding="utf-8")
+_error_handler.setFormatter(_fmt)
+error_log = logging.getLogger("proxy.error")
+error_log.setLevel(logging.ERROR)
+error_log.addHandler(_error_handler)
+error_log.propagate = False
+
+def _content_to_str(content) -> str:
+    """Normalize OpenAI content: string or array of content parts → plain string."""
+    if isinstance(content, list):
+        return " ".join(
+            part.get("text", "") if isinstance(part, dict) else str(part)
+            for part in content
+        )
+    return content or ""
+
+
+def _last_user_msg(messages: list, max_len: int = 120) -> str:
+    for msg in reversed(messages):
+        if msg.get("role") == "user":
+            text = _content_to_str(msg.get("content")).replace("\n", " ").strip()
+            return text[:max_len] + ("…" if len(text) > max_len else "")
+    return ""
+
+async def require_api_key(request: Request, db: Session = Depends(get_db)):
    auth_header = request.headers.get("Authorization", "")
    if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
+        api_key = auth_header[7:]
    elif auth_header.startswith("sk-"):
        api_key = auth_header
    else:
-        return JSONResponse(status_code=401, content={"detail": "Invalid or missing API key"})
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+    db_key = crud.verify_api_key(db, api_key)
+    if not db_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    request.state.api_key_id = db_key.id
+    request.state.api_key_name = db_key.name

-    db = SessionLocal()
+app = FastAPI(title="Ollama Proxy", dependencies=[Depends(require_api_key)])
+
+@app.on_event("startup")
+def apply_env_settings():
+    """Write env-configured values into DB so they take effect until next restart."""
+    db = next(get_db())
    try:
-        db_key = crud.verify_api_key(db, api_key)
-        if not db_key:
-            return JSONResponse(status_code=401, content={"detail": "Invalid API key"})
-        if not db_key.is_active:
-            return JSONResponse(status_code=403, content={"detail": "API key deactivated"})
-        request.state.user_id = db_key.user_id
+        if url := os.getenv("OLLAMA_URL"):
+            crud.set_setting(db, "ollama_url", url)
+        db.commit()
    finally:
        db.close()

-    response = await call_next(request)
-    return response
+@app.exception_handler(Exception)
+async def unhandled_exception_handler(request: Request, exc: Exception):
+    error_log.error("Unhandled exception | %s %s | %s: %s",
+                    request.method, request.url.path, type(exc).__name__, exc, exc_info=exc)
+    return JSONResponse(status_code=500, content={"error": {"message": "Internal server error", "type": "server_error"}})
+
+async def proxy_request(url: str, method: str = "GET", json_data: dict = None):
+    async with httpx.AsyncClient(timeout=300.0) as client:
+        response = await client.request(method=method, url=url, json=json_data)
+        return response

@app.post("/api/generate")
 async def generate(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
-
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
    body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
    prompt_tokens = crud.count_tokens(body.get("prompt", ""))
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{OLLAMA_URL}/api/generate", method="POST", json_data=body, headers=dict(request.headers))
-
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    prompt_preview = (body.get("prompt", "").replace("\n", " ").strip())[:120]
+    usage_log.info('%s | /api/generate | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, prompt_preview)
+    try:
+        response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/generate | %s | actual ↑%d ↓%d tokens',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0))
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/generate | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.post("/api/chat")
 async def chat(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
-
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
    body = await request.json()
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
+    messages = body.get("messages", [])
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in body.get("messages", []))
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=body, headers=dict(request.headers))
-
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    usage_log.info('%s | /api/chat | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, _last_user_msg(messages))
+    try:
+        response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/chat | %s | actual ↑%d ↓%d tokens',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0))
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/chat | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.get("/api/tags")
-async def list_models(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+async def list_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/tags", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
+
+@app.get("/version")
+async def version():
+    return {"version": os.getenv("APP_VERSION", "dev")}
+
+@app.get("/api/ps")
+async def running_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/ps", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.get("/api/versions")
-async def versions(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/versions", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+async def versions(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/versions", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.get("/v1/models")
-async def list_openai_models(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
-    ollama_models = response.json()
-    openai_models = {
-        "object": "list",
-        "data": [
-            {
-                "id": model["name"],
-                "object": "model",
-                "created": int(model["modified_at"][:10].replace("-", "")) * 1000 if "modified_at" in model else 0,
-                "owned_by": "ollama"
-            }
-            for model in ollama_models.get("models", [])
-        ]
-    }
-    return JSONResponse(content=openai_models, status_code=200, headers=dict(response.headers))
+async def list_openai_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/v1/models", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.post("/v1/chat/completions")
 async def openai_chat_completions(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))

    body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
    messages = body.get("messages", [])
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in messages)
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    ollama_body = {
-        "model": body.get("model", "llama3"),
-        "messages": messages,
-        "stream": body.get("stream", False)
-    }
+    model_name = body["model"]

-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=ollama_body, headers=dict(request.headers))
+    usage_log.info('%s | /v1/chat/completions | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(messages))

-    response_content = response.json().get("message", {}).get("content", "")
-    completion_tokens = crud.count_tokens(response_content)
+    target = f"{ollama_url}/v1/chat/completions"

-    openai_response = {
-        "id": f"chatcmpl-{uuid.uuid4().hex}",
-        "object": "chat.completion",
-        "created": int(time.time()),
-        "model": body.get("model", "llama3"),
-        "choices": [
-            {
-                "index": 0,
-                "message": {
-                    "role": "assistant",
-                    "content": response_content
-                },
-                "finish_reason": "stop"
-            }
-        ],
-        "usage": {
-            "prompt_tokens": prompt_tokens,
-            "completion_tokens": completion_tokens,
-            "total_tokens": prompt_tokens + completion_tokens
-        }
-    }
+    if body.get("stream"):
+        async def generate():
+            try:
+                async with httpx.AsyncClient(timeout=300.0) as client:
+                    async with client.stream("POST", target, json=body) as resp:
+                        async for chunk in resp.aiter_bytes():
+                            yield chunk
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/chat/completions | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )

-    return JSONResponse(content=openai_response, status_code=200, headers={"Content-Type": "application/json"})
+    try:
+        response = await proxy_request(target, method="POST", json_data=body)
+        resp_json = response.json()
+        usage = resp_json.get("usage", {})
+        usage_log.info('%s | /v1/chat/completions | %s | actual ↑%d ↓%d tokens',
+                       request.state.api_key_name, model_name,
+                       usage.get("prompt_tokens", 0), usage.get("completion_tokens", 0))
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/chat/completions | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise
@@ -4,46 +4,35 @@ from database import Base

 _now = lambda: datetime.now(timezone.utc)

-class User(Base):
-    __tablename__ = "users"
-
-    id = Column(Integer, primary_key=True, index=True)
-    username = Column(String, unique=True, index=True)
-    email = Column(String, unique=True, index=True)
-    hashed_password = Column(String)
-    is_active = Column(Boolean, default=True)
-    is_admin = Column(Boolean, default=False)
-    created_at = Column(DateTime(timezone=True), default=_now)
-
 class APIKey(Base):
    __tablename__ = "api_keys"

    id = Column(Integer, primary_key=True, index=True)
    name = Column(String)
    key = Column(String, unique=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
+    key_prefix = Column(String)
    is_active = Column(Boolean, default=True)
    created_at = Column(DateTime(timezone=True), default=_now)
-
-class Quota(Base):
-    __tablename__ = "quotas"
-
-    id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
+    expires_at = Column(DateTime(timezone=True), nullable=True)
    daily_tokens = Column(BigInteger, nullable=True)
    monthly_tokens = Column(BigInteger, nullable=True)
    daily_requests = Column(Integer, nullable=True)
    monthly_requests = Column(Integer, nullable=True)
-    reset_at = Column(DateTime(timezone=True), default=_now)
+
+class Setting(Base):
+    __tablename__ = "settings"
+
+    key = Column(String, primary_key=True)
+    value = Column(String, nullable=False)

 class Usage(Base):
    __tablename__ = "usage"

    id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"), unique=True)
+    api_key_id = Column(Integer, ForeignKey("api_keys.id"), unique=True)
    tokens_used_today = Column(BigInteger, default=0)
    tokens_used_month = Column(BigInteger, default=0)
    requests_today = Column(Integer, default=0)
    requests_month = Column(Integer, default=0)
    daily_reset_at = Column(DateTime(timezone=True), default=_now)
-    monthly_reset_at = Column(DateTime(timezone=True), default=_now)
+    monthly_reset_at = Column(DateTime(timezone=True), default=_now)
@@ -0,0 +1,4 @@
+-r requirements.txt
+pytest==8.3.4
+pytest-asyncio==0.25.1
+pytest-cov==6.0.0
@@ -1,5 +1,6 @@
 fastapi==0.115.6
 uvicorn[standard]==0.34.0
+aiofiles==24.1.0
 httpx==0.28.1
 sqlalchemy==2.0.36
 alembic==1.14.0
@@ -9,6 +10,3 @@ python-jose[cryptography]==3.3.0
 bcrypt==5.0.0
 tiktoken==0.9.0
 python-dotenv==1.0.1
-pytest==8.3.4
-pytest-asyncio==0.25.1
-pytest-cov==6.0.0
@@ -2,61 +2,46 @@ from pydantic import BaseModel
 from datetime import datetime
 from typing import Optional

-class UserBase(BaseModel):
-    username: str
-    email: str
-    is_admin: bool = False
-
-class UserCreate(UserBase):
-    password: str
-
-class User(UserBase):
-    id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyBase(BaseModel):
+class APIKeyCreate(BaseModel):
    name: str
-
-class APIKeyCreate(APIKeyBase):
-    user_id: int
-
-class APIKey(APIKeyBase):
-    id: int
-    key: str
-    user_id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyCreated(APIKey):
-    plaintext_key: str
-
-    class Config:
-        from_attributes = True
-
-class QuotaBase(BaseModel):
+    expires_at: Optional[datetime] = None
    daily_tokens: Optional[int] = None
    monthly_tokens: Optional[int] = None
    daily_requests: Optional[int] = None
    monthly_requests: Optional[int] = None

-class QuotaCreate(QuotaBase):
-    user_id: int
-
-class Quota(QuotaBase):
+class APIKey(BaseModel):
    id: int
-    user_id: int
-    reset_at: Optional[datetime] = None
+    name: str
+    key: str
+    key_prefix: Optional[str] = None
+    is_active: bool
+    created_at: datetime
+    expires_at: Optional[datetime] = None
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None

    class Config:
        from_attributes = True

+class APIKeyCreated(APIKey):
+    plaintext_key: Optional[str] = None
+
+    class Config:
+        from_attributes = True
+
+class QuotaUpdate(BaseModel):
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None
+
+class Settings(BaseModel):
+    ollama_url: str
+    force_model: Optional[str] = None
+
 class UsageStats(BaseModel):
    tokens_used_today: int = 0
    tokens_used_month: int = 0
@@ -67,3 +52,14 @@ class UsageStats(BaseModel):

    class Config:
        from_attributes = True
+
+class APIKeyWithUsage(APIKey):
+    tokens_used_today: int = 0
+    tokens_used_month: int = 0
+    requests_today: int = 0
+    requests_month: int = 0
+    daily_reset_at: Optional[datetime] = None
+    monthly_reset_at: Optional[datetime] = None
+
+    class Config:
+        from_attributes = True
@@ -1,42 +1,25 @@
 #!/usr/bin/env python3
 from database import Base, engine, SessionLocal
-from models import User, APIKey, Quota, Usage
-from crud import create_user, create_api_key, hash_password
+from models import APIKey
+from crud import create_api_key

 def setup_admin():
    Base.metadata.create_all(bind=engine)
    db = SessionLocal()
-    
-    admin_user = db.query(User).filter(User.username == "admin").first()
-    if not admin_user:
-        admin_user = User(
-            username="admin",
-            email="admin@ollama.local",
-            hashed_password=hash_password("admin123"),
-            is_active=True,
-            is_admin=True,
+    existing = db.query(APIKey).filter(APIKey.name == "default").first()
+    if not existing:
+        _, raw_key = create_api_key(
+            db,
+            name="default",
+            daily_tokens=1_000_000,
+            monthly_tokens=10_000_000,
+            daily_requests=1000,
+            monthly_requests=10000,
        )
-        db.add(admin_user)
-        db.commit()
-        db.refresh(admin_user)
-        print("✓ Admin user created")
-        
-        default_quota = Quota(
-            user_id=admin_user.id,
-            daily_tokens=10000000,
-            monthly_tokens=100000000,
-            daily_requests=10000,
-            monthly_requests=100000
-        )
-        db.add(default_quota)
-        db.commit()
-        print("✓ Admin quota created")
-        
-        _, raw_key = create_api_key(db, admin_user.id, "admin-api-key")
-        print(f"✓ Admin API Key: {raw_key}")
+        print(f"API Key created: {raw_key}")
    else:
-        print("✗ Admin user already exists")
+        print("Default API key already exists")
    db.close()

 if __name__ == "__main__":
-    setup_admin()
+    setup_admin()
@@ -6,68 +6,23 @@ os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")

 def _setup_db():
    from database import Base, engine, SessionLocal
-    from models import User, Quota
-    from crud import create_api_key, hash_password
+    from crud import create_api_key

    Base.metadata.drop_all(bind=engine)
    Base.metadata.create_all(bind=engine)

    db = SessionLocal()
-
-    test_user = User(
-        username="testuser",
-        email="test@example.com",
-        hashed_password=hash_password("test123"),
-        is_active=True,
-    )
-    db.add(test_user)
-    db.commit()
-    db.refresh(test_user)
-
-    db.add(Quota(
-        user_id=test_user.id,
-        daily_tokens=1_000_000,
-        monthly_tokens=10_000_000,
-        daily_requests=1000,
-        monthly_requests=10000,
-    ))
-    db.commit()
-
-    _, raw_key = create_api_key(db, test_user.id, "test-key")
+    _, raw_key = create_api_key(db, name="test-key", daily_tokens=1_000_000,
+                                monthly_tokens=10_000_000, daily_requests=1000,
+                                monthly_requests=10000)
    os.environ["TEST_API_KEY"] = raw_key
-
-    admin_user = User(
-        username="admin",
-        email="admin@example.com",
-        hashed_password=hash_password("admin123"),
-        is_active=True,
-        is_admin=True,
-    )
-    db.add(admin_user)
-    db.commit()
-    db.refresh(admin_user)
-
-    db.add(Quota(
-        user_id=admin_user.id,
-        daily_tokens=10_000_000,
-        monthly_tokens=100_000_000,
-        daily_requests=10000,
-        monthly_requests=100000,
-    ))
-    db.commit()
-
-    _, admin_raw_key = create_api_key(db, admin_user.id, "admin-key")
-    os.environ["ADMIN_API_KEY"] = admin_raw_key
-
    db.close()


 def _teardown_db():
-    from database import engine
-    from models import Base
+    from database import engine, Base
    Base.metadata.drop_all(bind=engine)
    os.environ.pop("TEST_API_KEY", None)
-    os.environ.pop("ADMIN_API_KEY", None)


@pytest.fixture(scope="function")
@@ -5,33 +5,21 @@ from datetime import datetime, timedelta, timezone
 os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")

 from database import Base, engine, SessionLocal
-from models import User, Quota, Usage
-from crud import check_and_increment_quota, count_tokens, hash_password
+from models import APIKey, Usage
+from crud import check_and_increment_quota, count_tokens, create_api_key, verify_api_key


-def make_user_and_quota(db, daily_tokens=None, monthly_tokens=None,
-                        daily_requests=None, monthly_requests=None):
-    user = User(
-        username="quotauser",
-        email="quota@example.com",
-        hashed_password=hash_password("pass"),
-        is_active=True,
-    )
-    db.add(user)
-    db.commit()
-    db.refresh(user)
-
-    quota = Quota(
-        user_id=user.id,
+def make_api_key(db, daily_tokens=None, monthly_tokens=None,
+                 daily_requests=None, monthly_requests=None):
+    db_key, _ = create_api_key(
+        db,
+        name="test-key",
        daily_tokens=daily_tokens,
        monthly_tokens=monthly_tokens,
        daily_requests=daily_requests,
        monthly_requests=monthly_requests,
    )
-    db.add(quota)
-    db.commit()
-
-    return user.id
+    return db_key.id


@pytest.fixture
@@ -64,119 +52,133 @@ def test_count_tokens_more_accurate_than_split():
 # --- check_and_increment_quota ---

 def test_allowed_within_daily_token_limit(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is True
+    api_key_id = make_api_key(db, daily_tokens=1000)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is True

 def test_denied_when_daily_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, daily_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    api_key_id = make_api_key(db, daily_tokens=50)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False

 def test_denied_when_monthly_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    api_key_id = make_api_key(db, monthly_tokens=50)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False

 def test_denied_when_daily_requests_exceeded(db):
-    user_id = make_user_and_quota(db, daily_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    api_key_id = make_api_key(db, daily_requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False

 def test_denied_when_monthly_requests_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    api_key_id = make_api_key(db, monthly_requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False

 def test_increments_both_daily_and_monthly_counters(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000,
-                                  daily_requests=100, monthly_requests=1000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000,
+                              daily_requests=100, monthly_requests=1000)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 50
    assert usage.tokens_used_month == 50
    assert usage.requests_today == 1
    assert usage.requests_month == 1

 def test_creates_usage_record_on_first_call(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is None
+    api_key_id = make_api_key(db, daily_tokens=1000)
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is None

-    check_and_increment_quota(db, user_id, tokens=10, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=10, requests=1)

-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is not None
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is not None

 def test_no_quota_allows_any_request(db):
-    user_id = make_user_and_quota(db)  # all limits None
-    assert check_and_increment_quota(db, user_id, tokens=999999, requests=9999) is True
+    api_key_id = make_api_key(db)  # all limits None
+    assert check_and_increment_quota(db, api_key_id, tokens=999999, requests=9999) is True

 def test_cumulative_usage_across_calls(db):
-    user_id = make_user_and_quota(db, daily_tokens=200)
-    check_and_increment_quota(db, user_id, tokens=100, requests=1)
-    check_and_increment_quota(db, user_id, tokens=99, requests=1)
-    # 199 used, 1 remaining – exactly 1 more token should pass
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is True
-    # Now 200 used – next request must fail
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is False
+    api_key_id = make_api_key(db, daily_tokens=200)
+    check_and_increment_quota(db, api_key_id, tokens=100, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=99, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is False


 # --- Reset logic ---

 def test_daily_reset_restores_access(db):
-    user_id = make_user_and_quota(db, daily_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=100)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)

-    # Backdate daily_reset_at to yesterday
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    db.commit()

-    # Should pass again after reset
-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 90

 def test_daily_reset_does_not_affect_monthly_counter(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    db.commit()

-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 50
-    assert usage.tokens_used_month == 100  # cumulative across days
+    assert usage.tokens_used_month == 100

 def test_monthly_reset_restores_access(db):
-    user_id = make_user_and_quota(db, monthly_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    api_key_id = make_api_key(db, monthly_tokens=100)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.monthly_reset_at = datetime.now(timezone.utc) - timedelta(days=32)
    db.commit()

-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_month == 90

 def test_failed_quota_check_still_commits_reset(db):
-    user_id = make_user_and_quota(db, daily_tokens=100, daily_requests=5)
-    check_and_increment_quota(db, user_id, tokens=80, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=100, daily_requests=5)
+    check_and_increment_quota(db, api_key_id, tokens=80, requests=1)

-    # Backdate so a reset fires, but the new request still exceeds the limit
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    usage.tokens_used_today = 80
    db.commit()

-    # After reset tokens_used_today = 0; 200 tokens exceeds 100 limit
-    result = check_and_increment_quota(db, user_id, tokens=200, requests=1)
+    result = check_and_increment_quota(db, api_key_id, tokens=200, requests=1)
    assert result is False

-    # Reset must still be persisted so the next request sees fresh counters
    db.expire_all()
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 0
+
+
+# --- verify_api_key expiry ---
+
+def _create_raw_key(db, expires_at=None):
+    _, raw_key = create_api_key(db, name="expiry-test", expires_at=expires_at)
+    return raw_key
+
+def test_key_without_expiry_is_valid(db):
+    raw_key = _create_raw_key(db)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_future_expiry_is_valid(db):
+    future = datetime.now(timezone.utc) + timedelta(days=30)
+    raw_key = _create_raw_key(db, expires_at=future)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_past_expiry_is_rejected(db):
+    past = datetime.now(timezone.utc) - timedelta(seconds=1)
+    raw_key = _create_raw_key(db, expires_at=past)
+    assert verify_api_key(db, raw_key) is None
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+IMAGE=mediaeng/llmproxy
+PLATFORM=linux/arm64
+
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+HEAD_TAG=$(git tag --points-at HEAD | head -1)
+
+if [ -n "$HEAD_TAG" ]; then
+    echo "HEAD bereits getaggt: $HEAD_TAG"
+    read -rp "Neuer Tag [${HEAD_TAG}]: " INPUT
+    VERSION="${INPUT:-$HEAD_TAG}"
+else
+    echo "Letzter Tag: ${LAST_TAG:-kein Tag}"
+    read -rp "Neuer Tag: " INPUT
+    if [ -z "$INPUT" ]; then
+        echo "Kein Tag angegeben, breche ab."
+        exit 1
+    fi
+    VERSION="$INPUT"
+fi
+
+if [ "$VERSION" != "$HEAD_TAG" ]; then
+    git tag "$VERSION"
+    git push origin "$VERSION"
+    echo "Tag '$VERSION' gesetzt und gepusht."
+fi
+
+echo ""
+echo "Image   : $IMAGE"
+echo "Platform: $PLATFORM"
+echo "Tags    : $IMAGE:$VERSION  $IMAGE:latest"
+echo ""
+
+docker buildx build \
+    --platform "$PLATFORM" \
+    --push \
+    --build-arg APP_VERSION="$VERSION" \
+    -t "$IMAGE:$VERSION" \
+    -t "$IMAGE:latest" \
+    .
+
+echo ""
+echo "Fertig. Gepusht:"
+echo "  docker pull $IMAGE:$VERSION"
+echo "  docker pull $IMAGE:latest"
@@ -1,24 +1,11 @@
-backend:
-  build:
-    context: ./backend
-    dockerfile: Dockerfile
-  ports:
-    - "8000:8000"
-  environment:
-    - DATABASE_URL=postgresql://ollama:password@db:5432/ollama_proxy
-    - OLLAMA_URL=http://ollama:11434
-    - SECRET_KEY=your-secret-key-change-me
-  depends_on:
-    - db
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - ./backend/test.db:/app/backend/test.db
+      - ./backend/logs:/app/backend/logs

-db:
-  image: postgres:16
-  environment:
-    - POSTGRES_USER=ollama
-    - POSTGRES_PASSWORD=password
-    - POSTGRES_DB=ollama_proxy
-  volumes:
-    - postgres_data:/var/lib/postgresql/data
-
-volumes:
-  postgres_data:
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+cd /app/backend
+python3 init_db.py
+
+uvicorn main:app \
+    --host "${PROXY_HOST:-0.0.0.0}" \
+    --port "${PROXY_PORT:-8000}" &
+PROXY_PID=$!
+
+uvicorn admin:app \
+    --host "${ADMIN_HOST:-0.0.0.0}" \
+    --port "${ADMIN_PORT:-8001}" &
+ADMIN_PID=$!
+
+# Beendet den Container wenn einer der Prozesse stirbt
+wait -n
+kill "$PROXY_PID" "$ADMIN_PID" 2>/dev/null
@@ -1,66 +1,403 @@
 import React, { useState, useEffect } from 'react';
+import ReactDOM from 'react-dom/client';
 import axios from 'axios';
 import './styles.css';

-const maskKey = (key) => `••••••••${key.slice(-4)}`;
+const displayKey = (prefix) => prefix ? `${prefix}••••••••` : '••••••••••••';

-function App() {
-  const [users, setUsers] = useState([]);
-  const [apiKeys, setApiKeys] = useState([]);
-  const [loading, setLoading] = useState(true);
+function authHeaders(token) {
+  return { Authorization: `Bearer ${token}` };
+}
+
+const fmtK = (n) => { const k = n / 1000; return k % 1 === 0 ? `${k}k` : `${k.toFixed(1)}k`; };
+
+function QuotaBar({ used, limit, isToken = false, since = null }) {
+  const fmt = isToken ? fmtK : (n) => n.toLocaleString('de-DE');
+  const sinceLabel = since
+    ? new Date(since).toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit' })
+    : null;
+
+  if (limit == null) return (
+    <div className="quota-cell">
+      <span className="quota-unlimited">∞</span>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+
+  const pct = Math.min(100, (used / limit) * 100);
+  const color = pct >= 90 ? '#e74c3c' : pct >= 70 ? '#e67e22' : '#27ae60';
+  return (
+    <div className="quota-cell">
+      <span className="quota-label">{fmt(used)} / {fmt(limit)}</span>
+      <div className="progress-bar">
+        <div className="progress-fill" style={{ width: `${pct}%`, backgroundColor: color }} />
+      </div>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+}
+
+function Login({ onLogin }) {
+  const [password, setPassword] = useState('');
  const [error, setError] = useState(null);

-  useEffect(() => {
-    Promise.all([fetchUsers(), fetchApiKeys()]).finally(() => setLoading(false));
-  }, []);
-
-  const fetchUsers = async () => {
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
    try {
-      const res = await axios.get('/api/users');
-      setUsers(res.data);
-    } catch (err) {
-      setError('Benutzer konnten nicht geladen werden.');
+      await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      sessionStorage.setItem('admin_password', password);
+      onLogin(password);
+    } catch {
+      setError('Ungültiges Passwort.');
    }
  };

-  const fetchApiKeys = async () => {
-    try {
-      const res = await axios.get('/api/api-keys');
-      setApiKeys(res.data);
-    } catch (err) {
-      setError('API-Keys konnten nicht geladen werden.');
-    }
-  };
-
-  if (loading) return <div>Loading...</div>;
-  if (error) return <div className="error">{error}</div>;
-
  return (
    <div className="container">
      <h1>Ollama Proxy Admin</h1>
+      <form onSubmit={handleSubmit} className="login-form">
+        <label>Passwort</label>
+        <input
+          type="password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          placeholder="Admin-Passwort eingeben"
+          autoFocus
+        />
+        {error && <div className="error">{error}</div>}
+        <button type="submit">Anmelden</button>
+      </form>
+    </div>
+  );
+}
+
+const EMPTY_KEY_FORM = {
+  name: '', expires_at: '', daily_tokens: '', monthly_tokens: '', daily_requests: '', monthly_requests: '',
+};
+
+function SettingsSection({ password }) {
+  const [settings, setSettings] = useState(null);
+  const [availableModels, setAvailableModels] = useState([]);
+  const [modelsLoading, setModelsLoading] = useState(false);
+  const [ollamaReachable, setOllamaReachable] = useState(true);
+  const [proxyEndpoint, setProxyEndpoint] = useState(null);
+  const [appVersion, setAppVersion] = useState(null);
+  const [saved, setSaved] = useState(false);
+  const [error, setError] = useState(null);
+
+  const fetchModels = async (url, currentModel) => {
+    setModelsLoading(true);
+    try {
+      const res = await axios.get('/api/ollama-models', {
+        headers: authHeaders(password),
+        params: url ? { url } : {},
+      });
+      const { models, reachable } = res.data;
+      setOllamaReachable(reachable);
+      setAvailableModels(models);
+      if (models.length > 0 && currentModel && !models.includes(currentModel)) {
+        setSettings(s => ({ ...s, force_model: models[0] }));
+      }
+    } catch {
+      setOllamaReachable(false);
+      setAvailableModels([]);
+    } finally {
+      setModelsLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    const headers = authHeaders(password);
+    Promise.all([
+      axios.get('/api/settings', { headers }),
+      axios.get('/api/proxy-info', { headers }),
+    ]).then(([settingsRes, proxyRes]) => {
+      const s = settingsRes.data;
+      setSettings(s);
+      setProxyEndpoint(proxyRes.data.endpoint);
+      setAppVersion(proxyRes.data.version);
+      fetchModels(s.ollama_url, s.force_model);
+    }).catch(() => setError('Einstellungen konnten nicht geladen werden.'));
+  }, []);
+
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setError(null);
+    setSaved(false);
+    try {
+      await axios.put('/api/settings', settings, { headers: authHeaders(password) });
+      setSaved(true);
+      setTimeout(() => setSaved(false), 3000);
+    } catch {
+      setError('Fehler beim Speichern.');
+    }
+  };
+
+  if (!settings) return <div>Laden...</div>;
+
+  return (
+    <section>
+      <h2>Einstellungen</h2>
+      <form onSubmit={handleSave} className="settings-form">
+        <div className="settings-row">
+          <label>Proxy-Endpunkt</label>
+          <span className="settings-value">
+            {proxyEndpoint ?? '…'}
+            <small> (Änderung erfordert Neustart)</small>
+          </span>
+        </div>
+        <div className="settings-row">
+          <label>Version</label>
+          <span className="settings-value">{appVersion ?? '…'}</span>
+        </div>
+        <div className="settings-row">
+          <label>Ollama-Endpunkt</label>
+          <div className="settings-input-wrap">
+            <input
+              type="url"
+              value={settings.ollama_url}
+              onChange={(e) => setSettings({ ...settings, ollama_url: e.target.value })}
+              onBlur={(e) => fetchModels(e.target.value, settings.force_model)}
+              placeholder="http://localhost:11434"
+              required
+            />
+            {!ollamaReachable && !modelsLoading && (
+              <div className="warning">⚠ Ollama nicht erreichbar unter {settings.ollama_url}</div>
+            )}
+          </div>
+        </div>
+        <div className="settings-row">
+          <label>Aktives Modell (Lock)</label>
+          {modelsLoading ? (
+            <span className="settings-value">Lade Modelle…</span>
+          ) : availableModels.length > 0 ? (
+            <select
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+            >
+              <option value="">— kein Lock —</option>
+              {availableModels.map(m => <option key={m} value={m}>{m}</option>)}
+            </select>
+          ) : (
+            <input
+              type="text"
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+              placeholder="leer = kein Lock"
+            />
+          )}
+        </div>
+        {error && <div className="error">{error}</div>}
+        {saved && <div className="success">Gespeichert.</div>}
+        <button type="submit">Speichern</button>
+      </form>
+    </section>
+  );
+}
+
+function App() {
+  const [password, setPassword] = useState(() => sessionStorage.getItem('admin_password'));
+  const [apiKeys, setApiKeys] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const [newKey, setNewKey] = useState(null);
+  const [form, setForm] = useState(EMPTY_KEY_FORM);
+  const [creating, setCreating] = useState(false);
+  const [editKey, setEditKey] = useState(null);
+  const [editForm, setEditForm] = useState({});
+
+  useEffect(() => {
+    if (!password) { setLoading(false); return; }
+    fetchApiKeys().finally(() => setLoading(false));
+  }, [password]);
+
+  const fetchApiKeys = async () => {
+    try {
+      const res = await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      setApiKeys(res.data);
+    } catch {
+      setError('API-Keys konnten nicht geladen werden.');
+    }
+  };
+
+  const handleCreate = async (e) => {
+    e.preventDefault();
+    setCreating(true);
+    try {
+      const payload = { name: form.name };
+      if (form.expires_at)       payload.expires_at       = new Date(form.expires_at).toISOString();
+      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens) * 1000;
+      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens) * 1000;
+      if (form.daily_requests)   payload.daily_requests   = Number(form.daily_requests);
+      if (form.monthly_requests) payload.monthly_requests = Number(form.monthly_requests);
+
+      const res = await axios.post('/api/api-keys', payload, { headers: authHeaders(password) });
+      setNewKey(res.data.plaintext_key);
+      setForm(EMPTY_KEY_FORM);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Erstellen des API-Keys.');
+    } finally {
+      setCreating(false);
+    }
+  };
+
+  const handleDeactivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/deactivate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Deaktivieren.');
+    }
+  };
+
+  const handleActivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/activate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Aktivieren.');
+    }
+  };
+
+  const handleDelete = async (id, name) => {
+    if (!window.confirm(`API-Key "${name}" wirklich löschen?`)) return;
+    try {
+      await axios.delete(`/api/api-keys/${id}`, { headers: authHeaders(password) });
+      if (editKey?.id === id) setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Löschen.');
+    }
+  };
+
+  const handleEdit = (key) => {
+    setEditKey(key);
+    setEditForm({
+      daily_tokens:     key.daily_tokens    != null ? key.daily_tokens / 1000    : '',
+      monthly_tokens:   key.monthly_tokens  != null ? key.monthly_tokens / 1000  : '',
+      daily_requests:   key.daily_requests  ?? '',
+      monthly_requests: key.monthly_requests ?? '',
+    });
+  };
+
+  const handleSaveEdit = async (e) => {
+    e.preventDefault();
+    try {
+      const payload = {
+        daily_tokens:     editForm.daily_tokens     !== '' ? Number(editForm.daily_tokens) * 1000     : null,
+        monthly_tokens:   editForm.monthly_tokens   !== '' ? Number(editForm.monthly_tokens) * 1000   : null,
+        daily_requests:   editForm.daily_requests   !== '' ? Number(editForm.daily_requests)   : null,
+        monthly_requests: editForm.monthly_requests !== '' ? Number(editForm.monthly_requests) : null,
+      };
+      await axios.patch(`/api/api-keys/${editKey.id}/quota`, payload, { headers: authHeaders(password) });
+      setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Speichern der Limits.');
+    }
+  };
+
+  const logout = () => {
+    sessionStorage.removeItem('admin_password');
+    setPassword(null);
+  };
+
+  if (!password) return <Login onLogin={setPassword} />;
+  if (loading) return <div>Laden...</div>;
+  if (error) return <div className="error">{error}</div>;
+
+  return (
+    <div className="container">
+      <div className="header">
+        <h1>Ollama Proxy Admin</h1>
+        <button onClick={logout}>Abmelden</button>
+      </div>
+
+      <SettingsSection password={password} />

      <section>
-        <h2>Users</h2>
-        <table>
-          <thead>
-            <tr>
-              <th>ID</th>
-              <th>Username</th>
-              <th>Email</th>
-              <th>Status</th>
-            </tr>
-          </thead>
-          <tbody>
-            {users.map(user => (
-              <tr key={user.id}>
-                <td>{user.id}</td>
-                <td>{user.username}</td>
-                <td>{user.email}</td>
-                <td>{user.is_active ? 'Active' : 'Inactive'}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
+        <h2>Neuer API-Key</h2>
+        <form onSubmit={handleCreate} className="create-form">
+          <div className="edit-form">
+            <label className="create-name">
+              Name
+              <small>&nbsp;</small>
+              <input
+                value={form.name}
+                onChange={(e) => setForm({ ...form, name: e.target.value })}
+                required
+                placeholder="z. B. alice"
+              />
+            </label>
+            <label className="create-date">
+              Ablaufdatum
+              <small>leer = unbegrenzt</small>
+              <input
+                type="date"
+                value={form.expires_at}
+                onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
+              />
+            </label>
+            <div className="create-btn-wrap">
+              <button type="submit" disabled={creating} className="btn-save">Erstellen</button>
+            </div>
+          </div>
+          <div className="edit-form">
+            <label>
+              Tokens/Tag (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_tokens}
+                onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Tokens/Monat (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_tokens}
+                onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Tag
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_requests}
+                onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Monat
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_requests}
+                onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
+              />
+            </label>
+          </div>
+        </form>
+        {newKey && (
+          <div className="new-key-box">
+            <strong>Neuer Key (nur einmal sichtbar):</strong>
+            <code>{newKey}</code>
+            <button onClick={() => setNewKey(null)}>✕</button>
+          </div>
+        )}
      </section>

      <section>
@@ -68,28 +405,106 @@ function App() {
        <table>
          <thead>
            <tr>
-              <th>ID</th>
+              <th></th>
              <th>Name</th>
              <th>Key</th>
-              <th>User</th>
-              <th>Status</th>
+              <th>Läuft ab</th>
+              <th className="th-quota">Tokens/Tag</th>
+              <th className="th-quota">Tokens/Monat</th>
+              <th className="th-quota">Req/Tag</th>
+              <th className="th-quota">Req/Monat</th>
+              <th></th>
            </tr>
          </thead>
          <tbody>
            {apiKeys.map(key => (
-              <tr key={key.id}>
-                <td>{key.id}</td>
+              <tr key={key.id} className={editKey?.id === key.id ? 'row-editing' : ''}>
+                <td className="td-status">
+                  <span className={key.is_active ? 'status-active' : 'status-inactive'} title={key.is_active ? 'Aktiv' : 'Inaktiv'}>●</span>
+                </td>
                <td>{key.name}</td>
-                <td>{maskKey(key.key)}</td>
-                <td>{key.user_id}</td>
-                <td>{key.is_active ? 'Active' : 'Inactive'}</td>
+                <td>{displayKey(key.key_prefix)}</td>
+                <td>{key.expires_at ? new Date(key.expires_at).toLocaleDateString('de-DE', { timeZone: 'Europe/Berlin' }) : '∞'}</td>
+                <td><QuotaBar used={key.tokens_used_today} limit={key.daily_tokens} isToken since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.tokens_used_month} limit={key.monthly_tokens} isToken since={key.monthly_reset_at} /></td>
+                <td><QuotaBar used={key.requests_today} limit={key.daily_requests} since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.requests_month} limit={key.monthly_requests} since={key.monthly_reset_at} /></td>
+                <td className="action-cell">
+                  <button className="btn-icon btn-icon-edit" data-tooltip="Bearbeiten" onClick={() => handleEdit(key)}>✏</button>
+                  {key.is_active ? (
+                    <button className="btn-icon btn-icon-warn" data-tooltip="Deaktivieren" onClick={() => handleDeactivate(key.id)}>⏸</button>
+                  ) : (
+                    <button className="btn-icon btn-icon-ok" data-tooltip="Aktivieren" onClick={() => handleActivate(key.id)}>▶</button>
+                  )}
+                  <button className="btn-icon btn-icon-danger" data-tooltip="Löschen" onClick={() => handleDelete(key.id, key.name)}>✕</button>
+                </td>
              </tr>
            ))}
          </tbody>
        </table>
+
+        {editKey && (
+          <div className="edit-section">
+            <h3>Limits bearbeiten: <em>{editKey.name}</em></h3>
+            <form onSubmit={handleSaveEdit} className="edit-form">
+              <label>
+                Tokens/Tag (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, daily_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Tokens/Monat (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Tag
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_requests}
+                  onChange={(e) => setEditForm({ ...editForm, daily_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Monat
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_requests}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <div className="edit-actions">
+                <button type="submit" className="btn-save">Speichern</button>
+                <button type="button" className="btn-cancel" onClick={() => setEditKey(null)}>Abbrechen</button>
+              </div>
+            </form>
+          </div>
+        )}
      </section>
    </div>
  );
 }

-export default App;
+ReactDOM.createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>
+);
@@ -44,12 +44,411 @@ tr:hover {
  background: #f8f9fa;
 }

-.status-active {
+
+.header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 40px;
+}
+
+.header h1 {
+  margin-bottom: 0;
+}
+
+.login-form {
+  max-width: 360px;
+  margin: 80px auto;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.login-form input {
+  padding: 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.login-form button, .header button {
+  padding: 10px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.login-form button:hover, .header button:hover {
+  background: #34495e;
+}
+
+.error {
+  color: #e74c3c;
+  font-size: 14px;
+}
+
+.create-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.create-form .edit-form {
+  margin-bottom: 0;
+}
+
+.create-name {
+  flex: 0 0 auto !important;
+}
+
+.create-name input {
+  width: 200px;
+}
+
+.create-date {
+  flex: 0 0 auto !important;
+}
+
+.create-date input[type="date"] {
+  width: 150px;
+}
+
+.create-btn-wrap {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: flex-end;
+}
+
+.create-form .btn-save:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.new-key-box {
+  margin-top: 16px;
+  padding: 12px 16px;
+  background: #eafaf1;
+  border: 1px solid #27ae60;
+  border-radius: 4px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.new-key-box code {
+  flex: 1;
+  font-size: 13px;
+  word-break: break-all;
+}
+
+.new-key-box button {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  color: #555;
+}
+
+.btn-danger {
+  padding: 4px 10px;
+  background: #e74c3c;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 12px;
+}
+
+.btn-danger:hover {
+  background: #c0392b;
+}
+
+.settings-form {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  max-width: 500px;
+}
+
+.settings-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.settings-row label {
+  width: 160px;
+  flex-shrink: 0;
+  font-weight: 500;
+  color: #2c3e50;
+}
+
+.settings-row input, .settings-row select {
+  flex: 1;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.settings-input-wrap {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.settings-input-wrap input {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+  box-sizing: border-box;
+}
+
+.warning {
+  color: #b8520a;
+  background: #fff3e0;
+  border: 1px solid #e67e22;
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-size: 13px;
+}
+
+.settings-form button {
+  align-self: flex-start;
+  padding: 8px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.settings-form button:hover {
+  background: #34495e;
+}
+
+.success {
  color: #27ae60;
+  font-size: 14px;
+}
+
+.settings-value {
+  flex: 1;
+  font-size: 14px;
+  color: #2c3e50;
+}
+
+.settings-value small {
+  margin-left: 8px;
+  color: #999;
+  font-size: 12px;
+}
+
+/* Quota progress bars */
+.th-quota {
+  width: 90px;
+}
+
+.quota-cell {
+  width: 100%;
+}
+
+.quota-label {
+  font-size: 12px;
+  color: #555;
+  white-space: nowrap;
+}
+
+.quota-unlimited {
+  color: #aaa;
+  font-size: 14px;
+}
+
+.quota-since {
+  display: block;
+  font-size: 10px;
+  color: #aaa;
+  margin-top: 2px;
+}
+
+.progress-bar {
+  height: 4px;
+  background: #e2e8f0;
+  border-radius: 2px;
+  margin-top: 4px;
+}
+
+.progress-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.3s ease;
+}
+
+/* Edit form */
+.td-status {
+  width: 20px;
+  text-align: center;
+}
+
+.status-active  { color: #27ae60; font-size: 12px; }
+.status-inactive { color: #bdc3c7; font-size: 12px; }
+
+.btn-icon {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px 4px;
+  margin-right: 2px;
+  border-radius: 3px;
+  line-height: 1;
+  position: relative;
+}
+
+.btn-icon:hover {
+  background: rgba(0, 0, 0, 0.06);
+}
+
+.btn-icon-edit   { color: #2980b9; }
+.btn-icon-warn   { color: #e67e22; }
+.btn-icon-ok     { color: #27ae60; }
+.btn-icon-danger { color: #e74c3c; }
+
+.btn-icon::after {
+  content: attr(data-tooltip);
+  position: absolute;
+  bottom: calc(100% + 8px);
+  left: 50%;
+  transform: translateX(-50%);
+  background: #2c3e50;
+  color: white;
+  padding: 5px 10px;
+  border-radius: 5px;
+  font-size: 12px;
+  font-weight: 400;
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon::before {
+  content: '';
+  position: absolute;
+  bottom: calc(100% + 2px);
+  left: 50%;
+  transform: translateX(-50%);
+  border: 5px solid transparent;
+  border-top-color: #2c3e50;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon:hover::after,
+.btn-icon:hover::before {
+  opacity: 1;
+}
+
+.action-cell {
+  white-space: nowrap;
+  position: relative;
+  overflow: visible;
+}
+
+.row-editing {
+  background: #eaf4fb !important;
+}
+
+.edit-section {
+  margin-top: 20px;
+  padding: 16px 20px;
+  background: #f0f7ff;
+  border: 1px solid #3498db;
+  border-radius: 6px;
+}
+
+.edit-section h3 {
+  margin: 0 0 14px;
+  font-size: 15px;
+  color: #2c3e50;
  font-weight: 600;
 }

-.status-inactive {
-  color: #e74c3c;
-  font-weight: 600;
+.edit-section h3 em {
+  font-style: normal;
+  color: #2980b9;
+}
+
+.edit-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px;
+  align-items: flex-end;
+}
+
+.edit-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  font-size: 13px;
+  font-weight: 500;
+  color: #34495e;
+}
+
+.edit-form label small {
+  font-weight: 400;
+  color: #999;
+  font-size: 11px;
+}
+
+.edit-form input {
+  padding: 6px 8px;
+  border: 1px solid #bdc3c7;
+  border-radius: 4px;
+  font-size: 14px;
+  width: 130px;
+}
+
+.edit-actions {
+  display: flex;
+  gap: 8px;
+  padding-bottom: 2px;
+}
+
+.btn-save {
+  padding: 6px 18px;
+  background: #27ae60;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-save:hover {
+  background: #219a52;
+}
+
+.btn-cancel {
+  padding: 6px 18px;
+  background: #95a5a6;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-cancel:hover {
+  background: #7f8c8d;
 }
@@ -3,8 +3,14 @@ import react from '@vitejs/plugin-react'

 export default defineConfig({
  plugins: [react()],
+  clearScreen: false,
  server: {
+    open: true,
    proxy: {
+      '/api/api-keys': 'http://localhost:8001',
+      '/api/settings': 'http://localhost:8001',
+      '/api/ollama-models': 'http://localhost:8001',
+      '/api/proxy-info': 'http://localhost:8001',
      '/api': 'http://localhost:8000',
    },
  },
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Dev runner: startet Proxy, Admin-API und Frontend gemeinsam."""
+import os
+import sys
+import signal
+import subprocess
+import threading
+from pathlib import Path
+
+
+def load_env(path: Path):
+    if not path.exists():
+        return
+    for line in path.read_text(encoding='utf-8').splitlines():
+        line = line.strip()
+        if line and not line.startswith('#') and '=' in line:
+            key, _, val = line.partition('=')
+            os.environ.setdefault(key.strip(), val.strip().strip('"\''))
+
+
+def pipe_output(proc: subprocess.Popen, label: str, color: str):
+    reset = '\033[0m'
+    prefix = f'\033[{color}m[{label}]{reset} '
+    for raw in iter(proc.stdout.readline, b''):
+        sys.stdout.write(prefix + raw.decode(errors='replace'))
+        sys.stdout.flush()
+
+
+def main():
+    root = Path(__file__).parent
+    load_env(root / '.env')
+
+    if not os.environ.get('ADMIN_PASSWORD'):
+        print('Fehler: ADMIN_PASSWORD nicht gesetzt (siehe .env)')
+        sys.exit(1)
+
+    python  = root / '.venv' / 'bin' / 'python'
+    backend = root / 'backend'
+    frontend = root / 'frontend'
+
+    proxy_host = os.environ.get('PROXY_HOST', '0.0.0.0')
+    proxy_port = os.environ.get('PROXY_PORT', '8000')
+    admin_host = os.environ.get('ADMIN_HOST', '127.0.0.1')
+    admin_port = os.environ.get('ADMIN_PORT', '8001')
+
+    print('Initialisiere Datenbank...')
+    subprocess.run([str(python), 'init_db.py'], cwd=backend, check=True)
+
+    print(f'Starte Proxy      → http://{proxy_host}:{proxy_port}')
+    print(f'Starte Admin-API  → http://{admin_host}:{admin_port}')
+    print('Starte Frontend   → http://localhost:5173')
+
+    env = {**os.environ, 'PYTHONUNBUFFERED': '1'}
+
+    procs = [
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'main:app', '--reload',
+             '--host', proxy_host, '--port', proxy_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Proxy   ', '34'),  # blau
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'admin:app', '--reload',
+             '--host', admin_host, '--port', admin_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Admin   ', '33'),  # gelb
+        (subprocess.Popen(
+            ['npm', 'run', 'dev'],
+            cwd=frontend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        ), 'Frontend', '32'),  # grün
+    ]
+
+    for proc, label, color in procs:
+        threading.Thread(target=pipe_output, args=(proc, label, color), daemon=True).start()
+
+    def stop(*_):
+        for p, _, _ in procs:
+            p.terminate()
+
+    signal.signal(signal.SIGINT, stop)
+    signal.signal(signal.SIGTERM, stop)
+
+    for p, _, _ in procs:
+        p.wait()
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# .env laden
+if [ -f .env ]; then
+    set -a
+    source .env
+    set +a
+fi
+
+# Virtuelle Umgebung aktivieren falls vorhanden
+if [ -f .venv/bin/activate ]; then
+    source .venv/bin/activate
+elif [ -f venv/bin/activate ]; then
+    source venv/bin/activate
+fi
+
+if [ -z "$ADMIN_PASSWORD" ]; then
+    echo "Fehler: ADMIN_PASSWORD ist nicht gesetzt. Bitte .env befüllen."
+    exit 1
+fi
+
+PROXY_HOST=${PROXY_HOST:-0.0.0.0}
+PROXY_PORT=${PROXY_PORT:-8000}
+ADMIN_HOST=${ADMIN_HOST:-127.0.0.1}
+ADMIN_PORT=${ADMIN_PORT:-8001}
+FRONTEND_PORT=5173
+
+PIDS=()
+
+cleanup() {
+    echo "Beende alle Prozesse..."
+    for pid in "${PIDS[@]}"; do
+        kill "$pid" 2>/dev/null
+    done
+    wait 2>/dev/null
+}
+
+port_in_use() {
+    lsof -iTCP:"$1" -sTCP:LISTEN -t &>/dev/null
+}
+
+# Ports prüfen bevor irgendetwas gestartet wird
+for port in "$PROXY_PORT" "$ADMIN_PORT" "$FRONTEND_PORT"; do
+    if port_in_use "$port"; then
+        echo "Fehler: Port $port ist bereits belegt."
+        exit 1
+    fi
+done
+
+trap cleanup EXIT INT TERM
+
+# Datenbank initialisieren
+echo "Initialisiere Datenbank..."
+cd backend
+python3 init_db.py
+cd ..
+
+# Backend starten
+echo "Starte Backend (Proxy) auf ${PROXY_HOST}:${PROXY_PORT}..."
+cd backend
+python3 -m uvicorn main:app --reload --host "$PROXY_HOST" --port "$PROXY_PORT" &
+PIDS+=($!)
+
+echo "Starte Admin-API auf ${ADMIN_HOST}:${ADMIN_PORT}..."
+python3 -m uvicorn admin:app --reload --host "$ADMIN_HOST" --port "$ADMIN_PORT" &
+PIDS+=($!)
+cd ..
+
+# Frontend starten
+echo "Starte Frontend..."
+cd frontend
+npm install --silent
+npm run dev &
+PIDS+=($!)
+cd ..
+
+echo "Backend läuft (Port $PROXY_PORT)"
+echo "Admin-API läuft (${ADMIN_HOST}:${ADMIN_PORT})"
+echo "Admin-Oberfläche: http://localhost:$FRONTEND_PORT"
+
+wait
Author	SHA1	Message	Date
Oliver Hofmann	07f6fec4bf	Show app version in admin UI and /version endpoint Embed APP_VERSION build arg in Docker image (default: dev). build_push.sh passes the git tag as build arg. Proxy exposes GET /version, admin UI shows it as read-only field in settings.	2026-05-08 09:30:23 +02:00
Oliver Hofmann	6761a73364	Add /api/ps example to Kurzanleitung	2026-05-08 09:25:44 +02:00
Oliver Hofmann	0d1ce96c99	Expose /api/ps to show currently loaded model	2026-05-08 09:22:17 +02:00
Oliver Hofmann	b16b3af44d	Mention VPN as alias for Intranet in Kurzanleitung	2026-05-08 09:17:08 +02:00
Oliver Hofmann	fdbe0a74e8	Exclude .tex and .pdf from Docker build context	2026-05-08 08:41:49 +02:00
Oliver Hofmann	0154c89c6b	Improve Python examples and opencode description in Kurzanleitung Split second example into focused model listing only, remove repeated prompt code. Replace TUI with 'interaktive Terminal-Oberfläche'.	2026-05-08 08:40:25 +02:00
Oliver Hofmann	e3dbed9f5e	Ignore generated KURZANLEITUNG.tex and .pdf	2026-05-08 08:15:07 +02:00
Oliver Hofmann	5b37718120	Fix list indentation in KURZANLEITUNG.md	2026-05-08 08:07:02 +02:00
Oliver Hofmann	f823e7d314	Return 422 when model field is missing and no force_model is set Prevents an opaque Ollama error from reaching the client by failing fast with a clear message before the request is forwarded.	2026-05-08 08:04:52 +02:00
Oliver Hofmann	34b108f4df	Replace default_model with force_model (model lock) Removes DEFAULT_MODEL in favour of a force_model setting configurable via the admin UI. When set, every proxy request's model field is overridden, preventing uncoordinated model switches during lab sessions. Updates schemas, admin API, all three proxy endpoints, frontend, init_db, and docs (README, DOCKERHUB, KURZANLEITUNG).	2026-05-08 08:02:16 +02:00
Oliver Hofmann	cced65693c	Log actual Ollama token counts and add user guide Add a second usage log line after each proxy response with actual ↑prompt ↓completion token counts from Ollama (prompt_eval_count/eval_count for native endpoints, usage object for OpenAI endpoint). Also adds KURZANLEITUNG.md for students and colleagues covering API access, model selection, Python examples, opencode setup, and quota/admin information.	2026-05-08 07:21:36 +02:00
Oliver Hofmann	256bafe30d	Explain network_mode: host motivation in README	2026-05-07 16:14:44 +02:00
Oliver Hofmann	555d9899fe	Fix build_push.sh tag detection	2026-05-07 16:11:50 +02:00
Oliver Hofmann	31504d1a5b	Remove DOCKERHUB.md reference from README	2026-05-07 16:09:22 +02:00
Oliver Hofmann	2e7b13227d	Make ADMIN_HOST consistent across dev and prod	2026-05-07 16:08:05 +02:00
Oliver Hofmann	5469981eb5	Add ADMIN_HOST to env tables and .env example	2026-05-07 16:04:23 +02:00
Oliver Hofmann	a1e293b1d7	Add ADMIN_HOST env var, restructure docs - docker-entrypoint.sh: Admin-API bindet auf ADMIN_HOST (default 0.0.0.0) statt hardcoded 0.0.0.0 — ermöglicht Einschränkung auf 127.0.0.1 - README: Zweck-Beschreibung, HTTPS-Reverse-Proxy-Abschnitt (Caddy/Nginx), Port-8001-Abschnitt korrigiert (Docker-Port-Mapping greift bei network_mode: host nicht), ADMIN_HOST in Konfig-Tabelle ergänzt - DOCKERHUB.md / DOCKERHUB.en.md: Auf drei Szenarien reduziert (network_mode: host, Ollama als Container + SQLite/PostgreSQL); host.docker.internal-Varianten entfernt - review_priorities.md: gelöscht (alle Punkte behoben)	2026-05-07 16:03:03 +02:00
hofmannol	9f92c09586	Add container_name, remove ineffective extra_hosts with network_mode host	2026-05-07 15:09:04 +02:00
hofmannol	3974010156	Use network_mode: host so container can reach Ollama on 127.0.0.1	2026-05-07 13:58:26 +02:00
hofmannol	8d3f9a7661	Fix OpenAI array content, add error logging, Ollama reachability warning - Normalize OpenAI array-format content to string to fix connection reset - Add error.log with rotating handler for proxy and stream errors - Add global unhandled exception handler returning JSON 500 - Write OLLAMA_URL/DEFAULT_MODEL env vars to DB on startup (reset on restart) - Add extra_hosts to docker-compose.yml for host.docker.internal on Linux - Show warning in admin UI when Ollama URL is unreachable - Return reachable: true/false from /api/ollama-models endpoint	2026-05-07 11:43:17 +02:00
Oliver Hofmann	280b3b0762	Add open: true to Vite dev server config	2026-04-29 17:13:14 +02:00
Oliver Hofmann	89661dafcc	Update README: new endpoints, Docker Hub, streaming, PyCharm config, port 8001 security	2026-04-29 10:19:31 +02:00
Oliver Hofmann	3ccc7f325d	Explain port 8001 security model in docs	2026-04-29 10:17:59 +02:00
Oliver Hofmann	25f19b6ada	Show reset date below quota progress bars in admin UI	2026-04-29 09:55:25 +02:00
Oliver Hofmann	5b97ed0ef7	Expose port 8001 on 127.0.0.1 only, explain why in docs	2026-04-29 09:52:13 +02:00
Oliver Hofmann	222b204d4b	build_push.sh: show current tag, offer to set new one before build	2026-04-29 09:36:50 +02:00
Oliver Hofmann	9910e6e062	Exclude .claude from Docker build context	2026-04-29 09:35:17 +02:00
Oliver Hofmann	6e704da86b	Expand .dockerignore with standard entries	2026-04-29 09:34:19 +02:00
Oliver Hofmann	bd0dc0478f	Add local docker-compose pulling from DockerHub with SQLite and .env	2026-04-29 09:33:04 +02:00
Oliver Hofmann	92fd66381f	Add English version of DockerHub README	2026-04-29 09:19:28 +02:00
Oliver Hofmann	c46c1c2b12	Clarify that Ollama can run remotely, not just on Docker host	2026-04-29 08:51:23 +02:00
Oliver Hofmann	d243523906	Split host-Ollama compose into SQLite and PostgreSQL variants	2026-04-29 08:47:40 +02:00
Oliver Hofmann	2319434b0f	Add host-Ollama compose variant, fix leftover port 8001 exposure	2026-04-29 08:43:54 +02:00
Oliver Hofmann	7912431ffb	Remove ALLOWED_ORIGINS from DockerHub docs (dev-only setting)	2026-04-29 08:38:38 +02:00
Oliver Hofmann	114c45dc7e	Remove port 8001 exposure from all Docker examples	2026-04-29 08:36:59 +02:00
Oliver Hofmann	6f67f29f68	Fix depends_on syntax in PostgreSQL compose example	2026-04-29 08:31:25 +02:00
Oliver Hofmann	3b7c88bf2c	Install psycopg2-binary in Dockerfile only, not in dev requirements	2026-04-29 08:30:16 +02:00
Oliver Hofmann	03712fe401	Add DockerHub README with usage, env vars and compose examples	2026-04-29 08:26:47 +02:00
Oliver Hofmann	a0512b3b2b	Replace build_push.py with build_push.sh, use shell script run config	2026-04-29 08:23:07 +02:00
Oliver Hofmann	511e85ea79	Add Docker build/push run config for arm64	2026-04-29 08:20:15 +02:00
Oliver Hofmann	cdaec894d8	Add PyCharm Dev run config and dev runner script - run_dev.py: starts proxy, admin and frontend together with colored output per process; handles SIGTERM from PyCharm Stop button - .idea/runConfigurations/Dev.xml: PyCharm Python run config - .gitignore: allow Dev.xml via layered negation pattern - vite.config.js: open browser automatically on dev server start	2026-04-29 08:14:33 +02:00
Oliver HofmannandClaude Sonnet 4.6	dd8f69ecb6	Proxy fixes, streaming support, Admin-UI overhaul Backend: - Fix Content-Length mismatch by not forwarding client headers to Ollama - Proxy /v1/chat/completions directly to Ollama's OpenAI-compatible endpoint (eliminates manual Ollama↔OpenAI format conversion, fixes tool use) - Add streaming support via SSE passthrough - Fix ollama_url /v1 suffix stripped on save - Replace BaseHTTPMiddleware with FastAPI global dependency (fixes double logging) - Add rotating usage log (8 KB, logs key name + model + token estimate + prompt preview) - Add httpx timeout 300s - Add activate and delete endpoints for API keys - Return usage data (tokens/requests) in GET /api/api-keys Frontend: - Admin table: remove ID column, status as icon, icon-only action buttons with CSS tooltips - Add activate + delete buttons; edit available for inactive keys too - Quota columns: fixed equal width, progress bars with k-unit formatting - Create form: structured layout matching edit form style - Edit form: token inputs in k units (÷1000 display, ×1000 on save) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-29 07:48:10 +02:00
Oliver Hofmann	c62cafc202	Store key_prefix for readable key display instead of masked hash The last-4 of the SHA-256 hash was meaningless for identification. Now storing the first 12 chars of the plaintext key as key_prefix, displayed as 'sk-aBcDeFgH••••••••' — consistent with what the user sees at creation time and how GitHub/OpenAI handle it.	2026-04-28 10:23:37 +02:00
Oliver Hofmann	94368670b7	Reload Ollama models on URL change, pre-select current model - /api/ollama-models accepts optional url query param to query a different endpoint - Frontend fetches models on load and on Ollama URL blur - Keeps current model selected if available, otherwise selects first in list - Shows loading indicator while fetching	2026-04-28 09:07:53 +02:00
Oliver Hofmann	f22bad6496	Clarify Docker port binding and SSH tunnel for admin access Use 127.0.0.1:8001:8001 to bind admin port locally only. Explain Docker's 0.0.0.0 vs 127.0.0.1 distinction and add SSH tunnel diagram showing how admin UI is accessed remotely.	2026-04-28 08:52:26 +02:00
Oliver HofmannandClaude Sonnet 4.6	ff5c88ecfd	Remove admin port binding from docker run example Port 8001 should not be exposed to the host directly. Add nginx reverse proxy and SSH tunnel examples instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:41:18 +02:00
Oliver HofmannandClaude Sonnet 4.6	317c7f0340	Add Docker production build and update README - Multi-stage Dockerfile: builds frontend, packages with Python backend - admin.py serves frontend/dist as StaticFiles in production - docker-entrypoint.sh runs proxy + admin-api, exits cleanly if either dies - .dockerignore excludes .env, venv, tests, node_modules - Split requirements.txt (prod) / requirements-dev.txt (dev+test) - aiofiles added for StaticFiles support - start.sh: port checks before startup, venv auto-activation, trap cleanup - vite.config.js: clearScreen disabled - README rewritten to reflect current architecture Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:34:45 +02:00
Oliver HofmannandClaude Sonnet 4.6	c8235ec274	Refactor to flat APIKey model with quota, admin UI, .env config, and Berlin timezone - Remove User/Quota models; quota fields now live directly on APIKey - Admin UI: login, API key management, settings (Ollama URL/model), proxy info display - .env/.env.example: ADMIN_PASSWORD, PROXY_HOST/PORT, DATABASE_URL, APP_TZ - Admin API runs on 127.0.0.1 only; proxy host/port configurable - API keys support optional expires_at; verified against Europe/Berlin timezone - Daily/monthly quota resets use Europe/Berlin midnight boundary - Fix all tests to use new flat model; add expiry tests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:21:42 +02:00