Rename settings save button to 'Änderungen übernehmen'

Harmonize typography: remove log uppercase, normalize label font sizes
Route /api/logs to admin API in Vite proxy config
2026-05-10 10:50:09 +02:00 · 2026-05-10 10:45:41 +02:00 · 2026-05-10 10:40:41 +02:00 · 2026-05-10 10:34:28 +02:00 · 2026-05-10 10:22:33 +02:00 · 2026-05-10 10:20:03 +02:00
37 changed files with 5874 additions and 661 deletions
@@ -0,0 +1,52 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+venv/
+*.egg-info/
+.pytest_cache/
+
+# Tests
+backend/tests/
+
+# Environment & secrets
+.env
+*.env.local
+
+# Databases
+*.db
+*.sqlite3
+
+# Logs
+logs/
+*.log
+
+# IDE & tools
+.idea/
+.vscode/
+.claude/
+
+# Git
+.git/
+.gitignore
+
+# Frontend
+frontend/node_modules/
+frontend/dist/
+
+# Docker
+docker-compose.yml
+.dockerignore
+
+# Docs
+*.md
+*.tex
+*.pdf
+
+# Dev & build scripts
+run_dev.py
+build_push.sh
+start.sh
+test_api.sh
@@ -0,0 +1,23 @@
+# Admin-Passwort für die Weboberfläche
+ADMIN_PASSWORD=change-me
+
+# Lokaler Endpunkt des Proxys (Admin-API bindet immer auf 127.0.0.1)
+PROXY_HOST=0.0.0.0
+PROXY_PORT=8000
+ADMIN_PORT=8001
+
+# Datenbankverbindung (Standard: SQLite für Entwicklung)
+DATABASE_URL=sqlite:///./test.db
+
+# Beispiel für PostgreSQL (Produktion):
+# DATABASE_URL=postgresql://user:password@localhost:5432/llm_quota
+
+# Ollama-Einstellungen (auch in der Admin-Oberfläche änderbar)
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+
+# Standard-Modell für den Anthropic-kompatiblen Endpunkt (/v1/messages)
+# Wird verwendet, wenn der Client kein Modell angibt oder ein Anthropic-Modellname
+# (z.B. claude-opus-4-7) auf kein lokales Modell passt.
+ANTHROPIC_DEFAULT_MODEL=llama3
@@ -14,7 +14,11 @@ __pycache__/
 *.sqlite3

 # IDE
-.idea/
+.idea/*
+!.idea/runConfigurations/
+.idea/runConfigurations/*
+!.idea/runConfigurations/Dev.xml
+!.idea/runConfigurations/Docker_Push.xml
 .vscode/

 # Frontend build
@@ -22,4 +26,8 @@ frontend/node_modules/
 frontend/dist/

 # Misc
-config.json
+config.json
+
+# Generated documents
+KURZANLEITUNG.tex
+KURZANLEITUNG.pdf
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Dev" type="PythonConfigurationType" factoryName="Python">
+    <module name="llm_quota" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="SCRIPT_NAME" value="$PROJECT_DIR$/run_dev.py" />
+    <option name="PARAMETERS" value="" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Docker Push" type="ShConfigurationType">
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/build_push.sh" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/bash" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <method v="2" />
+  </configuration>
+</component>
@@ -0,0 +1,168 @@
+# mediaeng/llmproxy
+
+A lightweight reverse proxy for [Ollama](https://ollama.com) that manages API keys with configurable token and request quotas. Incoming requests in OpenAI-compatible or Anthropic-compatible format are authenticated, checked against the quota, and forwarded to the configured Ollama server.
+
+## Features
+
+- OpenAI-compatible endpoint (`/v1/chat/completions`, `/v1/models`)
+- Anthropic Messages API (`/v1/messages`) — compatible with Claude Code CLI and Anthropic SDK clients
+- API key management with daily and monthly token/request limits
+- Web-based admin interface (port 8001)
+- Model lock: enforces a specific model for all requests (useful for courses and lab sessions)
+- Streaming support (Server-Sent Events)
+- Tool use / function calling passthrough
+- Rotating usage logs
+- SQLite (default) or PostgreSQL
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| `8000` | Proxy endpoint (OpenAI and Anthropic API) |
+| `8001` | Admin API + web interface |
+
+All API endpoints require the `ADMIN_PASSWORD` — without a valid token, only the public frontend files (HTML/JS/CSS of the login page) are accessible. The password is therefore the primary protection.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ADMIN_PASSWORD` | – | **Required.** Password for the admin interface |
+| `OLLAMA_URL` | `http://localhost:11434` | URL of the Ollama server (without `/v1` suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Database connection string (SQLite or PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Proxy bind address |
+| `PROXY_PORT` | `8000` | Proxy port |
+| `ADMIN_HOST` | `0.0.0.0` | Admin API bind address (`127.0.0.1` to restrict to local access) |
+| `ADMIN_PORT` | `8001` | Admin API port |
+| `APP_TZ` | `Europe/Berlin` | Timezone for daily/monthly quota resets |
+| `LOG_FILE` | `logs/usage.log` | Path of the rotating usage log file |
+| `ANTHROPIC_DEFAULT_MODEL` | – | Default model for `/v1/messages` (Ollama model name, e.g. `llama3`) |
+
+## Docker Compose – Ollama on the Host (Linux, recommended)
+
+`network_mode: host` gives the container direct access to the host network stack. Ollama runs on the host and is reachable at `localhost:11434` — not visible from outside. The proxy and admin interface are available directly on host ports 8000 and 8001.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+ANTHROPIC_DEFAULT_MODEL=llama3
+```
+
+## Docker Compose – Ollama as Container, SQLite
+
+Ollama and llmproxy run together in Docker. Ollama is not exposed externally.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama as Container, PostgreSQL
+
+For production environments with an external database.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client Configuration
+
+**OpenAI-compatible client:**
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <API key created in the admin interface>
+```
+
+**Claude Code CLI:**
+```bash
+ANTHROPIC_BASE_URL=http://<host>:8000 \
+ANTHROPIC_AUTH_TOKEN=<API key> \
+claude
+```
+
+## Acknowledgements
+
+The Anthropic Messages API endpoint (`/v1/messages`) was inspired by [free-claude-code](https://github.com/Alishahryar1/free-claude-code) by Ali Khokhar, which pursues a similar approach for routing Claude Code requests to alternative LLM backends.
@@ -0,0 +1,164 @@
+# mediaeng/llmproxy
+
+Ein schlanker Reverse-Proxy für [Ollama](https://ollama.com), der API-Keys mit konfigurierbaren Token- und Request-Quoten verwaltet. Eingehende Anfragen im OpenAI-kompatiblen oder Anthropic-kompatiblen Format werden authentifiziert, auf Quota geprüft und an den konfigurierten Ollama-Server weitergeleitet.
+
+## Funktionen
+
+- OpenAI-kompatibler Endpunkt (`/v1/chat/completions`, `/v1/models`)
+- Anthropic Messages API (`/v1/messages`) — kompatibel mit Claude Code CLI und Anthropic-SDK-Clients
+- API-Key-Verwaltung mit tages- und monatlichen Token-/Request-Limits
+- Web-basierte Admin-Oberfläche (Port 8001)
+- Modell-Lock: erzwingt ein bestimmtes Modell für alle Requests (nützlich für Praktika/Kurse)
+- Streaming-Support (Server-Sent Events)
+- Tool-Use / Function Calling wird durchgereicht
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+
+## Ports
+
+| Port | Dienst |
+|------|--------|
+| `8000` | Proxy-Endpunkt (OpenAI- und Anthropic-API) |
+| `8001` | Admin-API + Web-Oberfläche |
+
+Alle API-Endpunkte erfordern das `ADMIN_PASSWORD` — ein Zugriff ohne gültiges Token liefert nur die öffentlichen Frontend-Dateien (HTML/JS/CSS der Login-Seite). Das Passwort ist damit die primäre Schutzmaßnahme.
+
+## Umgebungsvariablen
+
+| Variable | Standard | Beschreibung |
+|----------|----------|--------------|
+| `ADMIN_PASSWORD` | – | **Pflicht.** Passwort für die Admin-Oberfläche |
+| `OLLAMA_URL` | `http://localhost:11434` | URL des Ollama-Servers (ohne `/v1`-Suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Datenbank-Verbindungsstring (SQLite oder PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxy |
+| `PROXY_PORT` | `8000` | Port des Proxy |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (`127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für Tages-/Monats-Reset der Quoten |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ANTHROPIC_DEFAULT_MODEL` | – | Standard-Modell für `/v1/messages` (Ollama-Modellname, z. B. `llama3`) |
+
+## Docker Compose – Ollama auf dem Host (Linux, empfohlen)
+
+`network_mode: host` gibt dem Container direkten Zugriff auf das Host-Netzwerk. Ollama läuft auf dem Host und ist über `localhost:11434` erreichbar — nach außen nicht sichtbar. Proxy und Admin-Oberfläche sind direkt auf den Host-Ports 8000 und 8001 verfügbar.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+ANTHROPIC_DEFAULT_MODEL=llama3
+```
+
+## Docker Compose – Ollama als Container, SQLite
+
+Ollama und llmproxy laufen gemeinsam in Docker. Ollama ist nicht nach außen exposed.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama als Container, PostgreSQL
+
+Für Produktionsumgebungen mit externer Datenbank.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client-Konfiguration
+
+**OpenAI-kompatibler Client:**
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <angelegter API-Key aus der Admin-Oberfläche>
+```
+
+**Claude Code CLI:**
+```bash
+ANTHROPIC_BASE_URL=http://<host>:8000 \
+ANTHROPIC_AUTH_TOKEN=<API-Key> \
+claude
+```
@@ -0,0 +1,24 @@
+FROM node:20-alpine AS frontend-builder
+WORKDIR /app
+COPY frontend/package*.json frontend/
+RUN npm ci --prefix frontend
+COPY frontend/ frontend/
+RUN npm run build --prefix frontend
+
+FROM python:3.12-slim
+ARG APP_VERSION=dev
+ENV APP_VERSION=$APP_VERSION
+WORKDIR /app
+
+COPY backend/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt psycopg2-binary
+
+COPY backend/ backend/
+COPY --from=frontend-builder /app/frontend/dist frontend/dist
+
+COPY docker-entrypoint.sh .
+RUN chmod +x docker-entrypoint.sh
+
+EXPOSE 8000 8001
+
+CMD ["./docker-entrypoint.sh"]
@@ -0,0 +1,204 @@
+# LLM-Dienst – Kurzanleitung
+
+## Worum geht es?
+
+Der Dienst stellt **große Sprachmodelle (LLMs)** über eine einfache HTTP-API bereit, die direkt aus Python-Skripten, Jupyter-Notebooks oder eigenen Anwendungen angesprochen werden kann. Die Modelle laufen lokal auf einem GPU-Server im Intranet – ohne Datenübertragung nach außen und ohne Cloud-Kosten.
+
+Typische Anwendungsfälle:
+
+- Texte zusammenfassen, übersetzen oder umformulieren
+- KI-gestütztes Coding (z.B. mit **[opencode](https://opencode.ai)**) 
+- Experimente mit Prompt-Engineering und LLM-Integration in eigene Projekte
+
+---
+
+## Zugang
+
+Der Dienst ist **nur im Intranet (VPN)** erreichbar.
+
+| | |
+|---|---|
+| **API-Endpunkt** | `http://141.75.33.244:8000` |
+| **Authentifizierung** | API-Key erforderlich (per E-Mail beim Admin anfragen) |
+
+---
+
+## Verfügbare Modelle
+
+| Modell | Größe | Hinweis |
+|---|---|---|
+| `gemma4:e4b` | 9,6 GB | sehr schnell, für einfache Aufgaben |
+| `gemma4:31b` | 19 GB | kompakt, schnell |
+| `gpt-oss:20b` | 13 GB | kompakt, schnell |
+| `gpt-oss:120b` | 65 GB | sehr leistungsfähig |
+| `qwen3.5:122b` | 81 GB | sehr leistungsfähig |
+| `qwen3-coder-next:q8_0` | 84 GB | speziell für Code |
+
+> **Wichtig:** Es kann immer nur **ein Modell gleichzeitig** im GPU-Speicher geladen sein.
+> Wechselt jemand das Modell, muss das vorherige entladen und das neue geladen werden –
+> das kann **mehrere Minuten** dauern. Der erste Prompt nach einem Modellwechsel ist
+> deshalb deutlich langsamer. Danach bleibt das Modell einige Zeit geladen.
+
+---
+
+## Python-Beispiel – Einfacher Prompt
+
+Das API folgt dem **OpenAI-Standard**, d.h. die `openai`-Bibliothek kann direkt verwendet werden.
+
+```bash
+pip install openai
+```
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."            # euren API-Key eintragen
+BASE_URL = "http://141.75.33.244:8000/v1"
+MODEL = "gemma4:31b"          # Modell nach Bedarf wählen
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+response = client.chat.completions.create(
+    model=MODEL,
+    messages=[
+        {"role": "user", "content": "Erkläre den Unterschied zwischen L1- und L2-Regularisierung."}
+    ]
+)
+
+print(response.choices[0].message.content)
+```
+
+---
+
+## Python-Beispiel – Verfügbare Modelle abfragen
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."
+BASE_URL = "http://141.75.33.244:8000/v1"
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+models = client.models.list()
+for m in models.data:
+    print(m.id)
+```
+
+---
+
+## Aktuell geladenes Modell abfragen
+
+Da immer nur ein Modell gleichzeitig im Speicher sein kann, lässt sich mit folgendem Aufruf prüfen, welches Modell gerade aktiv ist:
+
+```python
+import httpx
+
+r = httpx.get(
+    "http://141.75.33.244:8000/api/ps",
+    headers={"Authorization": "Bearer sk-..."}
+)
+print(r.json())
+```
+
+Die Antwort enthält Modellname, Größe und wie lange das Modell noch im Speicher bleibt.
+
+---
+
+## Empfehlungen zur Nutzung
+
+- **Kleines Modell zuerst** (`gemma4:31b` oder `gpt-oss:20b`) – viel schneller, für viele Aufgaben ausreichend.
+- **Großes Modell** nur bei komplexen Aufgaben (`qwen3.5:122b`, `gpt-oss:120b`).
+- **Code-Aufgaben**: `qwen3-coder-next:q8_0` ist speziell dafür optimiert.
+- Wenn möglich, **dasselbe Modell wie andere Nutzer** verwenden, um häufige Modellwechsel zu vermeiden.
+
+---
+
+## Quotas
+
+Je nach API-Key können folgende Limits konfiguriert sein:
+
+- Maximale **Anfragen pro Tag / Monat**
+- Maximale **Tokens pro Tag / Monat**
+
+Bei Überschreitung gibt die API den Statuscode `429 Too Many Requests` zurück.
+
+---
+
+## Coding-Assistent: opencode
+
+[opencode](https://opencode.ai) ist ein terminal-basierter KI-Coding-Agent (ähnlich Claude Code), der OpenAI-kompatible APIs unterstützt und damit direkt auf den Intranet-Dienst zeigen kann.
+
+### Installation
+
+```bash
+npm install -g opencode-ai
+# oder
+curl -fsSL https://opencode.ai/install | bash
+```
+
+### Konfiguration
+
+Konfigurationsdatei anlegen unter `~/.config/opencode/config.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "providers": {
+    "openai": {
+      "apiKey": "sk-...",
+      "baseURL": "http://141.75.33.244:8000/v1"
+    }
+  },
+  "model": "openai/qwen3-coder-next:q8_0"
+}
+```
+
+Für Code-Aufgaben empfiehlt sich `qwen3-coder-next:q8_0`, für allgemeine Aufgaben `gemma4:31b` oder `gpt-oss:20b`.
+
+### Starten
+
+```bash
+opencode
+```
+
+opencode öffnet eine interaktive Terminal-Oberfläche und kann dann im Projektverzeichnis eingesetzt werden – Dateien lesen, Code generieren, Refactoring vorschlagen usw.
+
+---
+
+## Coding-Assistent: Claude Code
+
+[Claude Code](https://claude.ai/code) ist Anthropics offizieller KI-Coding-Agent für das Terminal. Wer bereits einen Claude-Code-Zugang hat, kann ihn über den Intranet-Dienst mit lokalen Modellen betreiben — ohne Daten an Anthropic zu übertragen.
+
+### Voraussetzung
+
+Ein aktiver Claude-Code-Zugang (Claude Pro oder Team).
+
+### Starten
+
+```bash
+ANTHROPIC_BASE_URL=http://141.75.33.244:8000 \
+ANTHROPIC_AUTH_TOKEN=sk-... \
+claude
+```
+
+Das zu verwendende Modell wird vom Admin über `ANTHROPIC_DEFAULT_MODEL` vorkonfiguriert — eine manuelle Modellauswahl ist nicht nötig.
+
+---
+
+## Administration (nur für Admins)
+
+Das Web-Interface zur Verwaltung von API-Keys und Quotas ist erreichbar unter:
+
+**`http://141.75.33.244:8001`**
+
+Dort können API-Keys angelegt, deaktiviert und mit Quotas versehen werden.
+
+### Modell-Lock für Praktika
+
+Unter **Einstellungen → Aktives Modell (Lock)** kann ein Modell fest vorgegeben werden. Ist ein Lock gesetzt, wird das `model`-Feld in jedem Request durch dieses Modell ersetzt – unabhängig davon, was der Client schickt. Das verhindert unkoordinierte Modellwechsel während einer Veranstaltung, die alle Teilnehmenden durch lange Ladezeiten ausbremsen würden.
+
+Typischer Ablauf für ein Praktikum:
+1. Vor der Veranstaltung: passendes Modell in Ollama laden
+2. Lock in der Admin-Oberfläche aktivieren
+3. Nach der Veranstaltung: Lock wieder deaktivieren (Feld leeren)
@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) 2026 Oliver Hofmann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Portions of this software were inspired by free-claude-code
+(https://github.com/Alishahryar1/free-claude-code),
+copyright (c) 2026 Ali Khokhar, MIT License.
@@ -1,122 +1,235 @@
 # Ollama Proxy mit API-Keys und Quotas

-Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung und Quota-Management.
+Ollama bietet von sich aus keine Authentifizierung — wer die API erreicht, kann sie nutzen. Dieses Projekt löst das Problem: Ollama bleibt an `localhost` gebunden und ist von außen nicht erreichbar. Vorgeschaltet läuft ein Proxy (Port 8000), der jeden Request auf einen gültigen API-Key prüft und optional Token- sowie Request-Quoten pro Key durchsetzt. Eine Web-Admin-Oberfläche (Port 8001) erlaubt das Verwalten von Keys, Quoten und Ollama-Einstellungen.

 ## Features

- API-Key-Authentifizierung (Bearer Token oder `sk-`-Prefix)
+- API-Key-Authentifizierung (Bearer Token, `sk-`-Prefix, `x-api-key`- und `anthropic-auth-token`-Header)
+- Optionales Ablaufdatum pro API-Key
 - Quota-Management mit getrennten Tages- und Monatslimits (Tokens & Requests)
- Token-Zählung via tiktoken (cl100k_base)
- Usage-Tracking mit automatischem täglichem/monatlichem Reset
- Web-Admin-Oberfläche für User- und Quota-Verwaltung
- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt
+- Token-Zählung via tiktoken, Reset-Grenzen in der konfigurierten Zeitzone
+- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Verbrauchsanzeige)
+- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt mit Streaming und Tool-Use
+- Anthropic Messages API `/v1/messages` — kompatibel mit Claude Code CLI und Anthropic-SDK-Clients
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+- Docker-Image auf DockerHub: `mediaeng/llmproxy`

 ## Sicherheit

- Passwörter mit bcrypt gehasht
- API-Keys als SHA-256-Hash in der DB – Plaintext wird nur einmalig bei Erstellung zurückgegeben
- Admin-Zugriff über `is_admin`-Flag in der DB, nicht über Hardcoded-Namen
- CORS-Origins konfigurierbar via `ALLOWED_ORIGINS`
+- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`) — alle API-Endpunkte erfordern den Token
+- API-Keys als SHA-256-Hash in der DB — Plaintext nur einmalig bei Erstellung
 - Quota-Check atomar mit `SELECT FOR UPDATE` (kein TOCTOU-Race)
-
-## Installation & Start
-
-### Voraussetzungen
-
- Python 3.12+
- PostgreSQL 16+ (oder SQLite für Entwicklung)
- Node.js 18+ (für Frontend)
-
-### Lokal mit SQLite (Entwicklung)
-
-```bash
-# Backend
-cd backend
-pip install -r requirements.txt
-python init_db.py
-python setup_admin.py
-uvicorn main:app --reload --port 8000
-
-# Admin-API (in neuem Terminal)
-uvicorn admin:app --reload --port 8001
-
-# Frontend (in neuem Terminal)
-cd frontend
-npm install
-npm run dev
-```
-
-### Mit PostgreSQL & Docker (Produktion)
-
-```bash
-docker compose up -d
-docker compose exec backend python init_db.py
-docker compose exec backend python setup_admin.py
-```
+- Admin-Port 8001 über `ADMIN_HOST=127.0.0.1` auf lokalen Zugriff beschränkbar

 ## Konfiguration

-`.env`-Datei im `backend/`-Verzeichnis anlegen:
+`.env`-Datei im Projektverzeichnis anlegen:

 ```env
-DATABASE_URL=postgresql://user:pass@host:5432/db
-OLLAMA_URL=http://ollama:11434
-ALLOWED_ORIGINS=https://admin.example.com
+ADMIN_PASSWORD=change-me
+PROXY_HOST=0.0.0.0
+PROXY_PORT=8000
+ADMIN_HOST=0.0.0.0
+ADMIN_PORT=8001
+DATABASE_URL=sqlite:///./test.db
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+LOG_FILE=logs/usage.log
+ANTHROPIC_DEFAULT_MODEL=llama3
 ```

 | Variable | Standard | Beschreibung |
 |----------|----------|--------------|
-| `DATABASE_URL` | PostgreSQL lokal | DB-Verbindungsstring; `sqlite:///` für SQLite |
-| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz |
-| `ALLOWED_ORIGINS` | `http://localhost:5173` | Kommagetrennte CORS-Origins für die Admin-UI |
+| `ADMIN_PASSWORD` | — | Passwort für die Admin-Oberfläche (**Pflicht**) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxys |
+| `PROXY_PORT` | `8000` | Port des Proxys |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (z. B. `127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring (SQLite oder PostgreSQL) |
+| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz (auch in der UI änderbar) |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für tägliche/monatliche Quota-Resets |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ALLOWED_ORIGINS` | `http://localhost:5173` | CORS-Origins (nur für Entwicklung relevant) |
+| `ANTHROPIC_DEFAULT_MODEL` | — | Standard-Modell für `/v1/messages` (Ollama-Modellname) |

-## Proxy-Endpunkte
+## Entwicklung (lokal)

-Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header.
+### Voraussetzungen
+
+- Python 3.12+ mit virtualenv
+- Node.js 18+

 ```bash
-curl -X POST http://localhost:8000/api/generate \
-  -H "Authorization: Bearer sk-xxxxxx" \
-  -H "Content-Type: application/json" \
-  -d '{"model":"llama3","prompt":"Say hello"}'
+python -m venv .venv
+source .venv/bin/activate
+pip install -r backend/requirements-dev.txt
+cd frontend && npm install
 ```

-| Endpunkt | Beschreibung |
-|----------|--------------|
-| `POST /api/generate` | Ollama generate |
-| `POST /api/chat` | Ollama chat |
-| `GET /api/tags` | Verfügbare Modelle |
-| `GET /v1/models` | Modelle (OpenAI-Format) |
-| `POST /v1/chat/completions` | Chat (OpenAI-Format) |
+### Starten

-## Admin-API (Port 8001)
+**Per Script:**
+```bash
+cp .env.example .env   # ADMIN_PASSWORD setzen
+./start.sh
+```

-Alle Endpunkte erfordern einen API-Key eines Nutzers mit `is_admin=true`.
+**Per PyCharm:** Run-Config „Dev" starten (startet Proxy, Admin-API und Vite-Dev-Server gemeinsam).
+
+Das Script prüft alle Ports auf Belegung, initialisiert die Datenbank und startet alle drei Dienste.
+
+Admin-Oberfläche: `http://localhost:5173`
+
+## Claude Code CLI
+
+Der Proxy stellt einen Anthropic-kompatiblen Endpunkt bereit, über den Claude Code CLI mit lokalen Ollama-Modellen genutzt werden kann.
+
+```bash
+# ANTHROPIC_DEFAULT_MODEL in .env setzen, dann:
+./start_claude.sh
+
+# Oder mit Key als Argument:
+./start_claude.sh sk-dein-api-key
+
+# Oder als Umgebungsvariable:
+PROXY_API_KEY=sk-dein-api-key ./start_claude.sh
+```
+
+Das Script setzt `ANTHROPIC_BASE_URL` und `ANTHROPIC_AUTH_TOKEN` automatisch aus der `.env` und startet `claude`.
+
+## Produktion (Docker)
+
+### Docker Compose (empfohlen)
+
+```bash
+docker compose up -d
+```
+
+Zieht das Image von DockerHub und lädt Variablen aus `.env`.
+
+Das Setup verwendet `network_mode: host`: Der Container teilt den Netzwerkstack des Hosts, statt ein eigenes virtuelles Netzwerk zu bekommen. Das ist hier aus zwei Gründen die richtige Wahl:
+
+1. **Ollama soll nicht von außen erreichbar sein.** Ollama läuft auf dem Host und ist an `127.0.0.1:11434` gebunden — nur lokal erreichbar. Mit einem eigenen Container-Netzwerk (Bridge-Mode) wäre `localhost` aus Sicht des Containers der Container selbst, nicht der Host. Die übliche Alternative (`host.docker.internal` + `extra_hosts`) ist auf Linux unzuverlässig.
+
+2. **Kein doppeltes Port-Mapping nötig.** Mit `network_mode: host` sind Port 8000 und 8001 direkt auf dem Host verfügbar, ohne `ports:`-Einträge in der Compose-Datei.
+
+### Image selbst bauen und pushen
+
+```bash
+./build_push.sh
+```
+
+Das Script zeigt den aktuellen Git-Tag, bietet an einen neuen zu setzen, baut das Image für `linux/arm64` und pusht zu `mediaeng/llmproxy`.
+
+### Port 8001 (Admin)
+
+Alle Admin-Endpunkte erfordern das `ADMIN_PASSWORD` — der Token ist der primäre Schutz. Für zusätzliche Härtung lässt sich die Admin-API auf lokalen Zugriff beschränken:
+
+```env
+ADMIN_HOST=127.0.0.1
+```
+
+Bei `network_mode: host` (Produktions-Standard) ist das die einzig wirksame Methode — Docker-Port-Mapping greift dort nicht.
+
+### HTTPS via Reverse-Proxy (ungetestet)
+
+Wer Proxy und Admin-Oberfläche per HTTPS bereitstellen will, kann einen weiteren Reverse-Proxy (z. B. Nginx oder Caddy) vorschalten. Bei `network_mode: host` lauschen beide Dienste direkt auf dem Host, Nginx/Caddy proxyen auf `localhost`.
+
+**Caddy** (empfohlen — automatisches TLS via Let's Encrypt):
+
+```
+llm.example.com {
+    reverse_proxy localhost:8000 {
+        flush_interval -1
+    }
+}
+
+llm-admin.example.com {
+    reverse_proxy localhost:8001
+}
+```
+
+**Nginx** (mit Certbot-Zertifikaten):
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name llm.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
+
+    location / {
+        proxy_pass         http://127.0.0.1:8000;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_buffering    off;   # nötig für Streaming
+        proxy_cache        off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name llm-admin.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm-admin.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm-admin.example.com/privkey.pem;
+
+    location / {
+        proxy_pass       http://127.0.0.1:8001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+Clients konfigurieren dann `https://llm.example.com/v1` als Base URL.
+
+## Proxy-Endpunkte (Port 8000)
+
+Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header (`Bearer sk-...`), im `x-api-key`-Header oder im `anthropic-auth-token`-Header.
+
+```bash
+# OpenAI-kompatibler Endpunkt
+curl -X POST http://localhost:8000/v1/chat/completions \
+  -H "Authorization: Bearer sk-xxxxxx" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}]}'
+
+# Anthropic-kompatibler Endpunkt (z. B. für Claude Code)
+curl -X POST http://localhost:8000/v1/messages \
+  -H "x-api-key: sk-xxxxxx" \
+  -H "anthropic-version: 2023-06-01" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}],"max_tokens":1024}'
+```

 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/users` | GET | Alle User auflisten |
-| `/api/users` | POST | Neuen User anlegen |
-| `/api/api-keys` | GET | Alle API-Keys auflisten |
-| `/api/api-keys` | POST | Neuen API-Key erstellen (Plaintext einmalig in Response) |
+| `/v1/messages` | POST | Chat (Anthropic-Format, Streaming + Tool-Use) |
+| `/v1/chat/completions` | POST | Chat (OpenAI-Format, Streaming + Tool-Use) |
+| `/v1/models` | GET | Modelle (OpenAI-Format) |
+| `/api/generate` | POST | Ollama generate (nativ) |
+| `/api/chat` | POST | Ollama chat (nativ) |
+| `/api/tags` | GET | Verfügbare Modelle |
+| `/api/versions` | GET | Ollama-Version |
+
+## Admin-API (Port 8001)
+
+Alle Endpunkte erfordern `Authorization: Bearer <ADMIN_PASSWORD>`.
+
+| Endpunkt | Methode | Beschreibung |
+|----------|---------|--------------|
+| `/api/api-keys` | GET | Alle API-Keys mit Verbrauchsdaten |
+| `/api/api-keys` | POST | Neuen API-Key erstellen |
+| `/api/api-keys/{id}/quota` | PATCH | Limits eines Keys aktualisieren |
+| `/api/api-keys/{id}/activate` | PUT | API-Key aktivieren |
 | `/api/api-keys/{id}/deactivate` | PUT | API-Key deaktivieren |
-| `/api/quotas/{user_id}` | PUT | Quota für User setzen |
-
-### Quota setzen
-
-```bash
-curl -X PUT http://localhost:8001/api/quotas/1 \
-  -H "Authorization: Bearer sk-admin-key" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "daily_tokens": 1000000,
-    "monthly_tokens": 10000000,
-    "daily_requests": 1000,
-    "monthly_requests": 10000
-  }'
-```
-
-`null` für ein Limit bedeutet unbegrenzt.
+| `/api/api-keys/{id}` | DELETE | API-Key löschen |
+| `/api/settings` | GET/PUT | Ollama-URL und Standard-Modell |
+| `/api/ollama-models` | GET | Verfügbare Modelle von Ollama |
+| `/api/proxy-info` | GET | Lokaler Proxy-Endpunkt |

 ## Tests

@@ -130,28 +243,44 @@ python -m pytest tests/ -v
 ```
 llm_quota/
 ├── backend/
-│   ├── main.py           # Proxy-Server
-│   ├── admin.py          # Admin-API
-│   ├── database.py       # DB-Verbindung & Session
-│   ├── models.py         # SQLAlchemy-Modelle
-│   ├── schemas.py        # Pydantic-Schemas
-│   ├── crud.py           # DB-Operationen & Token-Zählung
-│   ├── init_db.py        # Tabellen anlegen
-│   ├── setup_admin.py    # Admin-User & API-Key erstellen
-│   ├── requirements.txt
-│   ├── Dockerfile
+│   ├── main.py              # Proxy-Server (Port 8000)
+│   ├── admin.py             # Admin-API + Static-File-Serving (Port 8001)
+│   ├── database.py          # DB-Verbindung & Session
+│   ├── models.py            # SQLAlchemy-Modelle (APIKey, Setting, Usage)
+│   ├── schemas.py           # Pydantic-Schemas
+│   ├── crud.py              # DB-Operationen, Token-Zählung, Quota-Logik
+│   ├── init_db.py           # Tabellen anlegen & Settings seeden
+│   ├── requirements.txt     # Produktiv-Dependencies
+│   ├── requirements-dev.txt # Test-Dependencies
 │   └── tests/
-│       ├── conftest.py   # Fixtures
-│       ├── test_auth.py  # Authentifizierungs-Tests
-│       └── test_quota.py # Quota- & Token-Tests
+│       ├── conftest.py
+│       ├── test_auth.py
+│       ├── test_quota.py
+│       └── test_anthropic_messages.py
 ├── frontend/
 │   └── src/
-│       ├── main.jsx
+│       ├── main.jsx         # React-Admin-UI
 │       └── styles.css
-├── .gitignore
-└── docker-compose.yml
+├── .idea/runConfigurations/
+│   └── Dev.xml              # PyCharm Run-Config
+├── Dockerfile
+├── docker-compose.yml       # Produktiv-Start mit DockerHub-Image
+├── docker-entrypoint.sh
+├── .dockerignore
+├── start.sh                 # Entwicklungs-Startscript
+├── start_claude.sh          # Claude Code CLI mit Proxy starten
+├── run_dev.py               # Entwicklungs-Runner für PyCharm
+├── build_push.sh            # Docker-Build & Push zu DockerHub
+├── LICENSE
+├── DOCKERHUB.md             # DockerHub-Beschreibung (deutsch)
+├── DOCKERHUB.en.md          # DockerHub-Beschreibung (englisch)
+└── .gitignore
 ```

+## Danksagung
+
+Der Anthropic-kompatible Endpunkt (`/v1/messages`) wurde durch das Projekt [free-claude-code](https://github.com/Alishahryar1/free-claude-code) von Ali Khokhar inspiriert, das einen ähnlichen Ansatz für das Weiterleiten von Claude-Code-Anfragen an alternative LLM-Backends verfolgt.
+
 ## Lizenz

-MIT
+MIT — siehe [LICENSE](LICENSE)
@@ -1,115 +1,187 @@
 import os
+import secrets
+import httpx
+from pathlib import Path
 from fastapi import FastAPI, Depends, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from database import get_db
 import crud, schemas
-from models import User, APIKey, Quota
+from models import APIKey as APIKeyModel, Usage as UsageModel

 app = FastAPI(title="Ollama Proxy Admin API")

 ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD")
+if not ADMIN_PASSWORD:
+    raise RuntimeError("ADMIN_PASSWORD environment variable must be set")

 app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS,
    allow_credentials=True,
-    allow_methods=["GET", "POST", "PUT", "DELETE"],
+    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
 )

-async def require_admin_auth(request: Request, db: Session = Depends(get_db)):
-    auth_header = request.headers.get("Authorization", "")
-    if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
-    elif auth_header.startswith("sk-"):
-        api_key = auth_header
-    else:
-        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+def require_admin_auth(request: Request):
+    auth = request.headers.get("Authorization", "")
+    token = auth.removeprefix("Bearer ").strip()
+    if not secrets.compare_digest(token, ADMIN_PASSWORD):
+        raise HTTPException(status_code=401, detail="Invalid admin password")

-    db_key = crud.verify_api_key(db, api_key)
-    if not db_key:
-        raise HTTPException(status_code=401, detail="Invalid API key")
-
-    db_user = db.query(User).filter(User.id == db_key.user_id).first()
-    if not db_user or not db_user.is_admin:
-        raise HTTPException(status_code=403, detail="Admin access required")
-
-    request.state.user = db_user
-
-@app.get("/api/users", response_model=list[schemas.User])
-async def read_users(
-    skip: int = 0,
-    limit: int = 100,
+@app.get("/api/api-keys", response_model=list[schemas.APIKeyWithUsage])
+async def read_api_keys(
+    skip: int = 0, limit: int = 100,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    users = db.query(User).offset(skip).limit(limit).all()
-    return users
-
-@app.post("/api/users", response_model=schemas.User)
-async def create_user(
-    user: schemas.UserCreate,
-    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
-):
-    db_user = crud.get_user_by_username(db, username=user.username)
-    if db_user:
-        raise HTTPException(status_code=400, detail="Username already registered")
-    db_user = crud.get_user_by_email(db, email=user.email)
-    if db_user:
-        raise HTTPException(status_code=400, detail="Email already registered")
-    return crud.create_user(db=db, username=user.username, email=user.email, password=user.password)
+    keys = db.query(APIKeyModel).offset(skip).limit(limit).all()
+    result = []
+    for key in keys:
+        item = schemas.APIKeyWithUsage.model_validate(key)
+        usage = db.query(UsageModel).filter(UsageModel.api_key_id == key.id).first()
+        if usage:
+            item.tokens_used_today = usage.tokens_used_today or 0
+            item.tokens_used_month = usage.tokens_used_month or 0
+            item.requests_today = usage.requests_today or 0
+            item.requests_month = usage.requests_month or 0
+            item.daily_reset_at = usage.daily_reset_at
+            item.monthly_reset_at = usage.monthly_reset_at
+        result.append(item)
+    return result

@app.post("/api/api-keys", response_model=schemas.APIKeyCreated)
 async def create_api_key(
    api_key: schemas.APIKeyCreate,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_user = db.query(User).filter(User.id == api_key.user_id).first()
-    if not db_user:
-        raise HTTPException(status_code=404, detail="User not found")
-    db_key, raw_key = crud.create_api_key(db=db, user_id=api_key.user_id, name=api_key.name)
+    db_key, raw_key = crud.create_api_key(
+        db,
+        name=api_key.name,
+        expires_at=api_key.expires_at,
+        daily_tokens=api_key.daily_tokens,
+        monthly_tokens=api_key.monthly_tokens,
+        daily_requests=api_key.daily_requests,
+        monthly_requests=api_key.monthly_requests,
+    )
    result = schemas.APIKeyCreated.model_validate(db_key)
    result.plaintext_key = raw_key
    return result

-@app.get("/api/api-keys", response_model=list[schemas.APIKey])
-async def read_api_keys(
-    skip: int = 0,
-    limit: int = 100,
+@app.patch("/api/api-keys/{api_key_id}/quota", response_model=schemas.APIKey)
+async def update_quota(
+    api_key_id: int,
+    quota: schemas.QuotaUpdate,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    api_keys = db.query(APIKey).offset(skip).limit(limit).all()
-    return api_keys
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    for field, value in quota.model_dump(exclude_unset=True).items():
+        setattr(db_key, field, value)
+    db.commit()
+    db.refresh(db_key)
+    return db_key

@app.put("/api/api-keys/{api_key_id}/deactivate")
 async def deactivate_api_key(
    api_key_id: int,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
    if not db_key:
        raise HTTPException(status_code=404, detail="API key not found")
    db_key.is_active = False
    db.commit()
    return {"message": "API key deactivated"}

-@app.put("/api/quotas/{user_id}", response_model=schemas.Quota)
-async def update_quota(
-    user_id: int,
-    quota: schemas.QuotaCreate,
+@app.put("/api/api-keys/{api_key_id}/activate")
+async def activate_api_key(
+    api_key_id: int,
    db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_quota = db.query(Quota).filter(Quota.user_id == user_id).first()
-    if not db_quota:
-        raise HTTPException(status_code=404, detail="Quota not found")
-    for key, value in quota.model_dump(exclude_unset=True).items():
-        setattr(db_quota, key, value)
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db_key.is_active = True
    db.commit()
-    db.refresh(db_quota)
-    return db_quota
+    return {"message": "API key activated"}
+
+@app.delete("/api/api-keys/{api_key_id}")
+async def delete_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.delete(db_key)
+    db.commit()
+    return {"message": "API key deleted"}
+
+@app.get("/api/proxy-info")
+async def get_proxy_info(_ = Depends(require_admin_auth)):
+    host = os.getenv("PROXY_HOST", "0.0.0.0")
+    port = os.getenv("PROXY_PORT", "8000")
+    display_host = "localhost" if host in ("0.0.0.0", "::") else host
+    return {
+        "endpoint": f"http://{display_host}:{port}",
+        "version": os.getenv("APP_VERSION", "dev"),
+    }
+
+@app.get("/api/settings", response_model=schemas.Settings)
+async def read_settings(db: Session = Depends(get_db), _ = Depends(require_admin_auth)):
+    return schemas.Settings(
+        ollama_url=crud.get_setting(db, "ollama_url", "http://localhost:11434"),
+        force_model=crud.get_setting(db, "force_model") or None,
+    )
+
+@app.put("/api/settings", response_model=schemas.Settings)
+async def update_settings(
+    settings: schemas.Settings,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = settings.ollama_url.rstrip('/').removesuffix('/v1')
+    crud.set_setting(db, "ollama_url", ollama_url)
+    crud.set_setting(db, "force_model", settings.force_model or "")
+    return schemas.Settings(ollama_url=ollama_url, force_model=settings.force_model or None)
+
+@app.get("/api/ollama-models")
+async def get_ollama_models(
+    url: str = None,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = url or crud.get_setting(db, "ollama_url", "http://localhost:11434")
+    try:
+        async with httpx.AsyncClient(timeout=5.0) as client:
+            response = await client.get(f"{ollama_url}/api/tags")
+        models = [m["name"] for m in response.json().get("models", [])]
+        return {"models": models, "reachable": True}
+    except Exception:
+        return {"models": [], "reachable": False}
+
+@app.get("/api/logs/{name}")
+async def get_log_lines(name: str, _ = Depends(require_admin_auth)):
+    if name not in ("usage", "error"):
+        raise HTTPException(status_code=400, detail="name must be 'usage' or 'error'")
+    log_file = Path(os.getenv("LOG_FILE", "logs/usage.log"))
+    path = log_file if name == "usage" else log_file.parent / "error.log"
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+        return {"lines": lines[-10:]}
+    except FileNotFoundError:
+        return {"lines": []}
+
+# Statisches Frontend ausliefern (nur im Produktivbetrieb, wenn dist/ existiert)
+_dist = Path(__file__).parent.parent / "frontend" / "dist"
+if _dist.exists():
+    app.mount("/", StaticFiles(directory=_dist, html=True), name="frontend")
@@ -1,116 +1,116 @@
+import os
 import secrets
 import hashlib
-import bcrypt
 import tiktoken
 from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
 from sqlalchemy.orm import Session
-from models import APIKey, User, Quota, Usage
+from models import APIKey, Usage, Setting

 _encoder = tiktoken.get_encoding("cl100k_base")
+_tz = ZoneInfo(os.getenv("APP_TZ", "Europe/Berlin"))
+
+def _now_local() -> datetime:
+    return datetime.now(_tz)
+
+def _to_local(dt: datetime) -> datetime:
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(_tz)

 def count_tokens(text: str) -> int:
    return len(_encoder.encode(text))

-def hash_password(password: str) -> str:
-    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
-
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return bcrypt.checkpw(plain_password.encode(), hashed_password.encode())
-
 def _hash_api_key(key: str) -> str:
    return hashlib.sha256(key.encode()).hexdigest()

-def get_user_by_username(db: Session, username: str):
-    return db.query(User).filter(User.username == username).first()
-
-def get_user_by_email(db: Session, email: str):
-    return db.query(User).filter(User.email == email).first()
-
-def generate_api_key():
+def generate_api_key() -> str:
    return "sk-" + secrets.token_urlsafe(32)

-def create_user(db: Session, username: str, email: str, password: str, is_admin: bool = False):
-    db_user = User(
-        username=username,
-        email=email,
-        hashed_password=hash_password(password),
-        is_admin=is_admin,
-    )
-    db.add(db_user)
-    db.commit()
-    db.refresh(db_user)
-
-    default_quota = Quota(
-        user_id=db_user.id,
-        daily_tokens=1000000,
-        monthly_tokens=10000000,
-        daily_requests=1000,
-        monthly_requests=10000
-    )
-    db.add(default_quota)
-    db.commit()
-
-    return db_user
-
-def create_api_key(db: Session, user_id: int, name: str) -> tuple[APIKey, str]:
+def create_api_key(
+    db: Session,
+    name: str,
+    expires_at: datetime = None,
+    daily_tokens: int = None,
+    monthly_tokens: int = None,
+    daily_requests: int = None,
+    monthly_requests: int = None,
+) -> tuple[APIKey, str]:
    raw_key = generate_api_key()
    db_key = APIKey(
        name=name,
        key=_hash_api_key(raw_key),
-        user_id=user_id
+        key_prefix=raw_key[:12],
+        expires_at=expires_at,
+        daily_tokens=daily_tokens,
+        monthly_tokens=monthly_tokens,
+        daily_requests=daily_requests,
+        monthly_requests=monthly_requests,
    )
    db.add(db_key)
    db.commit()
    db.refresh(db_key)
    return db_key, raw_key

+def get_setting(db: Session, key: str, default: str = None) -> str:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    return row.value if row else default
+
+def set_setting(db: Session, key: str, value: str) -> None:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    if row:
+        row.value = value
+    else:
+        db.add(Setting(key=key, value=value))
+    db.commit()
+
 def verify_api_key(db: Session, api_key: str):
    key_hash = _hash_api_key(api_key)
-    return db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    db_key = db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    if db_key and db_key.expires_at:
+        expires = db_key.expires_at
+        if expires.tzinfo is None:
+            expires = expires.replace(tzinfo=timezone.utc)
+        if expires < datetime.now(timezone.utc):
+            return None
+    return db_key

-def get_quota(db: Session, user_id: int):
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_quota_by_user_id(db: Session, user_id: int):
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_usage(db: Session, user_id: int):
-    return db.query(Usage).filter(Usage.user_id == user_id).first()
-
-def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, requests: int = 1) -> bool:
+def check_and_increment_quota(db: Session, api_key_id: int, tokens: int = 0, requests: int = 1) -> bool:
    usage = (
        db.query(Usage)
-        .filter(Usage.user_id == user_id)
+        .filter(Usage.api_key_id == api_key_id)
        .with_for_update()
        .first()
    )
    if not usage:
-        usage = Usage(user_id=user_id)
+        usage = Usage(api_key_id=api_key_id)
        db.add(usage)
        db.flush()

-    now = datetime.now(timezone.utc)
+    now = _now_local()
+    daily_reset_local = _to_local(usage.daily_reset_at)
+    monthly_reset_local = _to_local(usage.monthly_reset_at)

-    if usage.daily_reset_at.date() < now.date():
+    if daily_reset_local.date() < now.date():
        usage.tokens_used_today = 0
        usage.requests_today = 0
        usage.daily_reset_at = now

-    if (usage.monthly_reset_at.year, usage.monthly_reset_at.month) < (now.year, now.month):
+    if (monthly_reset_local.year, monthly_reset_local.month) < (now.year, now.month):
        usage.tokens_used_month = 0
        usage.requests_month = 0
        usage.monthly_reset_at = now

-    quota = get_quota(db, user_id)
+    api_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
    allowed = True
-    if quota:
-        if quota.daily_tokens and (usage.tokens_used_today + tokens) > quota.daily_tokens:
+    if api_key:
+        if api_key.daily_tokens and (usage.tokens_used_today + tokens) > api_key.daily_tokens:
            allowed = False
-        elif quota.monthly_tokens and (usage.tokens_used_month + tokens) > quota.monthly_tokens:
+        elif api_key.monthly_tokens and (usage.tokens_used_month + tokens) > api_key.monthly_tokens:
            allowed = False
-        elif quota.daily_requests and (usage.requests_today + requests) > quota.daily_requests:
+        elif api_key.daily_requests and (usage.requests_today + requests) > api_key.daily_requests:
            allowed = False
-        elif quota.monthly_requests and (usage.requests_month + requests) > quota.monthly_requests:
+        elif api_key.monthly_requests and (usage.requests_month + requests) > api_key.monthly_requests:
            allowed = False

    if allowed:
@@ -120,4 +120,4 @@ def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, reques
        usage.requests_month += requests

    db.commit()
-    return allowed
+    return allowed
@@ -1,19 +1,26 @@
+import os
+from pathlib import Path
+from dotenv import load_dotenv
 from sqlalchemy import create_engine
+
+load_dotenv(dotenv_path=Path(__file__).resolve().parent.parent / ".env")
 from sqlalchemy.orm import sessionmaker, declarative_base

-try:
-    import os
-    DATABASE_URL = os.environ.get("DATABASE_URL", "postgresql://ollama:password@localhost:5432/ollama_proxy")
-    if "sqlite" in DATABASE_URL:
-        engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
-    else:
-        engine = create_engine(DATABASE_URL)
-except Exception:
-    DATABASE_URL = "sqlite:///./test.db"
+DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
+
+# Relative SQLite-Pfade immer relativ zu dieser Datei auflösen, nicht zum cwd
+if DATABASE_URL.startswith("sqlite:///") and not DATABASE_URL.startswith("sqlite:////"):
+    db_path = DATABASE_URL[len("sqlite:///"):]
+    if not os.path.isabs(db_path):
+        db_path = str(Path(__file__).resolve().parent / db_path)
+        DATABASE_URL = f"sqlite:///{db_path}"
+
+if "sqlite" in DATABASE_URL:
    engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
+else:
+    engine = create_engine(DATABASE_URL)

 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
-
 Base = declarative_base()

 def get_db():
@@ -1,24 +1,21 @@
-from sqlalchemy import create_engine
-from sqlalchemy.orm import sessionmaker
-from database import Base
-import models
 import os
+from dotenv import load_dotenv

-SQLALCHEMY_DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
+load_dotenv(dotenv_path=os.path.join(os.path.dirname(__file__), '..', '.env'))

-try:
-    if "sqlite" in SQLALCHEMY_DATABASE_URL:
-        engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
-    else:
-        engine = create_engine(SQLALCHEMY_DATABASE_URL)
-except:
-    SQLALCHEMY_DATABASE_URL = "sqlite:///./test.db"
-    engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
-SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+from database import Base, engine, SessionLocal
+import models
+from crud import get_setting, set_setting

 def init_db():
    Base.metadata.create_all(bind=engine)
-    print("Database tables created successfully!")
+
+    db = SessionLocal()
+    if not get_setting(db, "ollama_url"):
+        set_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    db.close()
+
+    print("Database initialized.")

 if __name__ == "__main__":
    init_db()
@@ -1,144 +1,469 @@
+import json
+import logging
+import os
+import secrets
 import time
-import uuid
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
 from fastapi import FastAPI, HTTPException, Depends, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from sqlalchemy.orm import Session
-from database import get_db, SessionLocal
+from database import get_db
 import crud
 import httpx
-import os

-app = FastAPI(title="Ollama Proxy")
-OLLAMA_URL = os.getenv("OLLAMA_URL", "http://localhost:11434")
+_log_dir = Path(os.getenv("LOG_FILE", "logs/usage.log")).parent
+_log_dir.mkdir(parents=True, exist_ok=True)
+_fmt = logging.Formatter("%(asctime)s | %(message)s", datefmt="%Y-%m-%d %H:%M:%S")

-async def proxy_request(url: str, method: str = "GET", json_data: dict = None, headers: dict = None):
-    async with httpx.AsyncClient() as client:
-        response = await client.request(method=method, url=url, json=json_data, headers=headers)
-        return response
+# Rotating usage log (8 KB per file, 3 backups)
+_usage_handler = RotatingFileHandler(str(_log_dir / "usage.log"), maxBytes=8192, backupCount=3, encoding="utf-8")
+_usage_handler.setFormatter(_fmt)
+usage_log = logging.getLogger("proxy.usage")
+usage_log.setLevel(logging.INFO)
+usage_log.addHandler(_usage_handler)
+usage_log.propagate = False

-@app.middleware("http")
-async def authenticate_and_quota(request: Request, call_next):
+# Rotating error log (64 KB per file, 5 backups)
+_error_handler = RotatingFileHandler(str(_log_dir / "error.log"), maxBytes=65536, backupCount=5, encoding="utf-8")
+_error_handler.setFormatter(_fmt)
+error_log = logging.getLogger("proxy.error")
+error_log.setLevel(logging.ERROR)
+error_log.addHandler(_error_handler)
+error_log.propagate = False
+
+def _content_to_str(content) -> str:
+    """Normalize OpenAI content: string or array of content parts → plain string."""
+    if isinstance(content, list):
+        return " ".join(
+            part.get("text", "") if isinstance(part, dict) else str(part)
+            for part in content
+        )
+    return content or ""
+
+
+def _last_user_msg(messages: list, max_len: int = 120) -> str:
+    for msg in reversed(messages):
+        if msg.get("role") == "user":
+            text = _content_to_str(msg.get("content")).replace("\n", " ").strip()
+            return text[:max_len] + ("…" if len(text) > max_len else "")
+    return ""
+
+async def require_api_key(request: Request, db: Session = Depends(get_db)):
    auth_header = request.headers.get("Authorization", "")
+    x_api_key = request.headers.get("x-api-key", "")
+    auth_token = request.headers.get("anthropic-auth-token", "")
    if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
+        api_key = auth_header[7:]
    elif auth_header.startswith("sk-"):
        api_key = auth_header
+    elif x_api_key:
+        api_key = x_api_key
+    elif auth_token:
+        api_key = auth_token
    else:
-        return JSONResponse(status_code=401, content={"detail": "Invalid or missing API key"})
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+    db_key = crud.verify_api_key(db, api_key)
+    if not db_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    request.state.api_key_id = db_key.id
+    request.state.api_key_name = db_key.name

-    db = SessionLocal()
+app = FastAPI(title="Ollama Proxy", dependencies=[Depends(require_api_key)])
+
+@app.on_event("startup")
+def apply_env_settings():
+    """Write env-configured values into DB so they take effect until next restart."""
+    db = next(get_db())
    try:
-        db_key = crud.verify_api_key(db, api_key)
-        if not db_key:
-            return JSONResponse(status_code=401, content={"detail": "Invalid API key"})
-        if not db_key.is_active:
-            return JSONResponse(status_code=403, content={"detail": "API key deactivated"})
-        request.state.user_id = db_key.user_id
+        if url := os.getenv("OLLAMA_URL"):
+            crud.set_setting(db, "ollama_url", url)
+        db.commit()
    finally:
        db.close()

-    response = await call_next(request)
-    return response
+@app.exception_handler(Exception)
+async def unhandled_exception_handler(request: Request, exc: Exception):
+    error_log.error("Unhandled exception | %s %s | %s: %s",
+                    request.method, request.url.path, type(exc).__name__, exc, exc_info=exc)
+    return JSONResponse(status_code=500, content={"error": {"message": "Internal server error", "type": "server_error"}})
+
+def _backend_headers() -> dict:
+    key = os.getenv("BACKEND_API_KEY")
+    return {"Authorization": f"Bearer {key}"} if key else {}
+
+
+async def proxy_request(url: str, method: str = "GET", json_data: dict = None):
+    async with httpx.AsyncClient(timeout=300.0) as client:
+        response = await client.request(method=method, url=url, json=json_data, headers=_backend_headers())
+        return response

@app.post("/api/generate")
 async def generate(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
-
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
    body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
    prompt_tokens = crud.count_tokens(body.get("prompt", ""))
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{OLLAMA_URL}/api/generate", method="POST", json_data=body, headers=dict(request.headers))
-
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    prompt_preview = (body.get("prompt", "").replace("\n", " ").strip())[:120]
+    usage_log.info('%s | /api/generate | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, prompt_preview)
+    start = time.monotonic()
+    try:
+        response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/generate | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/generate | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.post("/api/chat")
 async def chat(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
-
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
    body = await request.json()
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
+    messages = body.get("messages", [])
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in body.get("messages", []))
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=body, headers=dict(request.headers))
-
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    usage_log.info('%s | /api/chat | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, _last_user_msg(messages))
+    start = time.monotonic()
+    try:
+        response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/chat | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/chat | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise

@app.get("/api/tags")
-async def list_models(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+async def list_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/tags", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
+
+@app.get("/version")
+async def version():
+    return {"version": os.getenv("APP_VERSION", "dev")}
+
+@app.get("/api/ps")
+async def running_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/ps", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.get("/api/versions")
-async def versions(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/versions", method="GET", headers=dict(request.headers))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+async def versions(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/versions", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
+
+
+# --- Anthropic Messages API compatibility layer ---
+
+def _anthropic_content_to_str(content) -> str:
+    """Flatten Anthropic content (string or block array) to a plain string."""
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        for block in content:
+            if not isinstance(block, dict):
+                continue
+            if block.get("type") == "text":
+                parts.append(block.get("text", ""))
+            elif block.get("type") == "tool_result":
+                raw = block.get("content", "")
+                if isinstance(raw, list):
+                    raw = " ".join(r.get("text", "") for r in raw if isinstance(r, dict) and r.get("type") == "text")
+                parts.append(str(raw))
+        return " ".join(parts)
+    return str(content) if content else ""
+
+
+def _anthropic_messages_to_ollama(messages: list, system: str = None) -> list:
+    """Transform Anthropic messages array to Ollama /api/chat format."""
+    result = []
+    if system:
+        result.append({"role": "system", "content": system})
+    for msg in messages:
+        role = msg.get("role")
+        content = msg.get("content")
+        if role == "assistant" and isinstance(content, list):
+            text = " ".join(b.get("text", "") for b in content if isinstance(b, dict) and b.get("type") == "text")
+            tool_calls = [
+                {"function": {"name": b["name"], "arguments": b.get("input", {})}}
+                for b in content if isinstance(b, dict) and b.get("type") == "tool_use"
+            ]
+            entry = {"role": "assistant", "content": text}
+            if tool_calls:
+                entry["tool_calls"] = tool_calls
+            result.append(entry)
+        elif role == "user" and isinstance(content, list):
+            text_parts = []
+            for block in content:
+                if not isinstance(block, dict):
+                    continue
+                if block.get("type") == "tool_result":
+                    if text_parts:
+                        result.append({"role": "user", "content": " ".join(text_parts)})
+                        text_parts = []
+                    raw = block.get("content", "")
+                    if isinstance(raw, list):
+                        raw = " ".join(r.get("text", "") for r in raw if isinstance(r, dict) and r.get("type") == "text")
+                    result.append({"role": "tool", "content": str(raw)})
+                elif block.get("type") == "text":
+                    text_parts.append(block.get("text", ""))
+            if text_parts:
+                result.append({"role": "user", "content": " ".join(text_parts)})
+        else:
+            result.append({"role": role, "content": _anthropic_content_to_str(content)})
+    return result
+
+
+def _anthropic_tools_to_ollama(tools: list) -> list:
+    """Transform Anthropic tools to Ollama/OpenAI function format."""
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": t["name"],
+                "description": t.get("description", ""),
+                "parameters": t.get("input_schema", {}),
+            },
+        }
+        for t in tools
+    ]
+
+
+def _ollama_to_anthropic_response(ollama_resp: dict, model_name: str, msg_id: str) -> dict:
+    """Transform an Ollama /api/chat response to Anthropic Messages API format."""
+    msg = ollama_resp.get("message", {})
+    text = msg.get("content", "")
+    tool_calls = msg.get("tool_calls") or []
+
+    content_blocks = []
+    if text:
+        content_blocks.append({"type": "text", "text": text})
+
+    stop_reason = "end_turn"
+    for i, tc in enumerate(tool_calls):
+        stop_reason = "tool_use"
+        fn = tc.get("function", {})
+        args = fn.get("arguments", {})
+        if isinstance(args, str):
+            try:
+                args = json.loads(args)
+            except json.JSONDecodeError:
+                args = {}
+        content_blocks.append({
+            "type": "tool_use",
+            "id": f"toolu_{msg_id}_{i}",
+            "name": fn.get("name", ""),
+            "input": args,
+        })
+
+    return {
+        "id": f"msg_{msg_id}",
+        "type": "message",
+        "role": "assistant",
+        "content": content_blocks,
+        "model": model_name,
+        "stop_reason": stop_reason,
+        "stop_sequence": None,
+        "usage": {
+            "input_tokens": ollama_resp.get("prompt_eval_count", 0),
+            "output_tokens": ollama_resp.get("eval_count", 0),
+        },
+    }
+
+
+@app.post("/v1/messages")
+async def anthropic_messages(request: Request, db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    body = await request.json()
+
+    force_model = crud.get_setting(db, "force_model") or None
+    model_name = force_model or os.getenv("ANTHROPIC_DEFAULT_MODEL") or body.get("model")
+    if not model_name:
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
+
+    anthropic_msgs = body.get("messages", [])
+    system = body.get("system")
+
+    system_str = _anthropic_content_to_str(system) if system else ""
+    all_text = system_str + " ".join(_anthropic_content_to_str(m.get("content")) for m in anthropic_msgs)
+    prompt_tokens = crud.count_tokens(all_text)
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
+        raise HTTPException(status_code=429, detail="Quota exceeded")
+
+    ollama_messages = _anthropic_messages_to_ollama(anthropic_msgs, system=system_str)
+    ollama_body: dict = {"model": model_name, "messages": ollama_messages, "stream": body.get("stream", False)}
+    if tools := body.get("tools"):
+        ollama_body["tools"] = _anthropic_tools_to_ollama(tools)
+
+    msg_id = secrets.token_hex(12)
+    target = f"{ollama_url}/api/chat"
+
+    usage_log.info('%s | /v1/messages | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(ollama_messages))
+    start = time.monotonic()
+
+    if body.get("stream"):
+        # Backend wird immer non-streaming aufgerufen; der Dev-Proxy baut SSE selbst auf.
+        # Das ist nötig, weil vorgelagerte Proxys (z.B. Produktiv-Proxy) /api/chat
+        # nur non-streaming exponieren.
+        non_stream_body = {**ollama_body, "stream": False}
+
+        async def generate():
+            try:
+                response = await proxy_request(target, method="POST", json_data=non_stream_body)
+                ollama_resp = response.json()
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/messages | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+
+            msg = ollama_resp.get("message", {})
+            text = msg.get("content", "")
+            input_tokens = ollama_resp.get("prompt_eval_count", 0)
+            output_tokens = ollama_resp.get("eval_count", 0)
+
+            yield f"event: message_start\ndata: {json.dumps({'type': 'message_start', 'message': {'id': f'msg_{msg_id}', 'type': 'message', 'role': 'assistant', 'content': [], 'model': model_name, 'stop_reason': None, 'stop_sequence': None, 'usage': {'input_tokens': input_tokens, 'output_tokens': 0}}})}\n\n"
+            yield f"event: content_block_start\ndata: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+            yield f"event: ping\ndata: {json.dumps({'type': 'ping'})}\n\n"
+            if text:
+                yield f"event: content_block_delta\ndata: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'text_delta', 'text': text}})}\n\n"
+            yield f"event: content_block_stop\ndata: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+            yield f"event: message_delta\ndata: {json.dumps({'type': 'message_delta', 'delta': {'stop_reason': 'end_turn', 'stop_sequence': None}, 'usage': {'output_tokens': output_tokens}})}\n\n"
+            yield f"event: message_stop\ndata: {json.dumps({'type': 'message_stop'})}\n\n"
+            usage_log.info('%s | /v1/messages | %s | actual ↑%d ↓%d tokens | %.1fs',
+                           request.state.api_key_name, model_name,
+                           input_tokens, output_tokens,
+                           time.monotonic() - start)
+
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    try:
+        response = await proxy_request(target, method="POST", json_data=ollama_body)
+        result = _ollama_to_anthropic_response(response.json(), model_name, msg_id)
+        usage_log.info('%s | /v1/messages | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, model_name,
+                       result["usage"]["input_tokens"], result["usage"]["output_tokens"],
+                       time.monotonic() - start)
+        return JSONResponse(content=result, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/messages | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise

@app.get("/v1/models")
-async def list_openai_models(request: Request):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
-    ollama_models = response.json()
-    openai_models = {
-        "object": "list",
-        "data": [
-            {
-                "id": model["name"],
-                "object": "model",
-                "created": int(model["modified_at"][:10].replace("-", "")) * 1000 if "modified_at" in model else 0,
-                "owned_by": "ollama"
-            }
-            for model in ollama_models.get("models", [])
-        ]
-    }
-    return JSONResponse(content=openai_models, status_code=200, headers=dict(response.headers))
+async def list_openai_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/v1/models", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)

@app.post("/v1/chat/completions")
 async def openai_chat_completions(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))

    body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
    messages = body.get("messages", [])
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in messages)
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)

-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
        raise HTTPException(status_code=429, detail="Quota exceeded")

-    ollama_body = {
-        "model": body.get("model", "llama3"),
-        "messages": messages,
-        "stream": body.get("stream", False)
-    }
+    model_name = body["model"]

-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=ollama_body, headers=dict(request.headers))
+    usage_log.info('%s | /v1/chat/completions | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(messages))

-    response_content = response.json().get("message", {}).get("content", "")
-    completion_tokens = crud.count_tokens(response_content)
+    target = f"{ollama_url}/v1/chat/completions"

-    openai_response = {
-        "id": f"chatcmpl-{uuid.uuid4().hex}",
-        "object": "chat.completion",
-        "created": int(time.time()),
-        "model": body.get("model", "llama3"),
-        "choices": [
-            {
-                "index": 0,
-                "message": {
-                    "role": "assistant",
-                    "content": response_content
-                },
-                "finish_reason": "stop"
-            }
-        ],
-        "usage": {
-            "prompt_tokens": prompt_tokens,
-            "completion_tokens": completion_tokens,
-            "total_tokens": prompt_tokens + completion_tokens
-        }
-    }
+    if body.get("stream"):
+        existing_opts = body.get("stream_options") or {}
+        stream_body = {**body, "stream_options": {**existing_opts, "include_usage": True}}
+        start = time.monotonic()
+        usage_tokens = {"prompt": 0, "completion": 0}

-    return JSONResponse(content=openai_response, status_code=200, headers={"Content-Type": "application/json"})
+        async def generate():
+            try:
+                async with httpx.AsyncClient(timeout=300.0) as client:
+                    async with client.stream("POST", target, json=stream_body, headers=_backend_headers()) as resp:
+                        async for chunk in resp.aiter_bytes():
+                            try:
+                                for line in chunk.decode("utf-8", errors="ignore").splitlines():
+                                    if line.startswith("data: ") and "[DONE]" not in line:
+                                        data = json.loads(line[6:])
+                                        if u := data.get("usage"):
+                                            usage_tokens["prompt"] = u.get("prompt_tokens", 0)
+                                            usage_tokens["completion"] = u.get("completion_tokens", 0)
+                            except Exception:
+                                pass
+                            yield chunk
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/chat/completions | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+            finally:
+                usage_log.info('%s | /v1/chat/completions | %s | actual ↑%d ↓%d tokens | %.1fs',
+                               request.state.api_key_name, model_name,
+                               usage_tokens["prompt"], usage_tokens["completion"],
+                               time.monotonic() - start)
+
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    start = time.monotonic()
+    try:
+        response = await proxy_request(target, method="POST", json_data=body)
+        resp_json = response.json()
+        usage = resp_json.get("usage", {})
+        usage_log.info('%s | /v1/chat/completions | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, model_name,
+                       usage.get("prompt_tokens", 0), usage.get("completion_tokens", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/chat/completions | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise
@@ -4,46 +4,35 @@ from database import Base

 _now = lambda: datetime.now(timezone.utc)

-class User(Base):
-    __tablename__ = "users"
-
-    id = Column(Integer, primary_key=True, index=True)
-    username = Column(String, unique=True, index=True)
-    email = Column(String, unique=True, index=True)
-    hashed_password = Column(String)
-    is_active = Column(Boolean, default=True)
-    is_admin = Column(Boolean, default=False)
-    created_at = Column(DateTime(timezone=True), default=_now)
-
 class APIKey(Base):
    __tablename__ = "api_keys"

    id = Column(Integer, primary_key=True, index=True)
    name = Column(String)
    key = Column(String, unique=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
+    key_prefix = Column(String)
    is_active = Column(Boolean, default=True)
    created_at = Column(DateTime(timezone=True), default=_now)
-
-class Quota(Base):
-    __tablename__ = "quotas"
-
-    id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
+    expires_at = Column(DateTime(timezone=True), nullable=True)
    daily_tokens = Column(BigInteger, nullable=True)
    monthly_tokens = Column(BigInteger, nullable=True)
    daily_requests = Column(Integer, nullable=True)
    monthly_requests = Column(Integer, nullable=True)
-    reset_at = Column(DateTime(timezone=True), default=_now)
+
+class Setting(Base):
+    __tablename__ = "settings"
+
+    key = Column(String, primary_key=True)
+    value = Column(String, nullable=False)

 class Usage(Base):
    __tablename__ = "usage"

    id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"), unique=True)
+    api_key_id = Column(Integer, ForeignKey("api_keys.id"), unique=True)
    tokens_used_today = Column(BigInteger, default=0)
    tokens_used_month = Column(BigInteger, default=0)
    requests_today = Column(Integer, default=0)
    requests_month = Column(Integer, default=0)
    daily_reset_at = Column(DateTime(timezone=True), default=_now)
-    monthly_reset_at = Column(DateTime(timezone=True), default=_now)
+    monthly_reset_at = Column(DateTime(timezone=True), default=_now)
@@ -0,0 +1,4 @@
+-r requirements.txt
+pytest==8.3.4
+pytest-asyncio==0.25.1
+pytest-cov==6.0.0
@@ -1,5 +1,6 @@
 fastapi==0.115.6
 uvicorn[standard]==0.34.0
+aiofiles==24.1.0
 httpx==0.28.1
 sqlalchemy==2.0.36
 alembic==1.14.0
@@ -9,6 +10,3 @@ python-jose[cryptography]==3.3.0
 bcrypt==5.0.0
 tiktoken==0.9.0
 python-dotenv==1.0.1
-pytest==8.3.4
-pytest-asyncio==0.25.1
-pytest-cov==6.0.0
@@ -2,61 +2,46 @@ from pydantic import BaseModel
 from datetime import datetime
 from typing import Optional

-class UserBase(BaseModel):
-    username: str
-    email: str
-    is_admin: bool = False
-
-class UserCreate(UserBase):
-    password: str
-
-class User(UserBase):
-    id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyBase(BaseModel):
+class APIKeyCreate(BaseModel):
    name: str
-
-class APIKeyCreate(APIKeyBase):
-    user_id: int
-
-class APIKey(APIKeyBase):
-    id: int
-    key: str
-    user_id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyCreated(APIKey):
-    plaintext_key: str
-
-    class Config:
-        from_attributes = True
-
-class QuotaBase(BaseModel):
+    expires_at: Optional[datetime] = None
    daily_tokens: Optional[int] = None
    monthly_tokens: Optional[int] = None
    daily_requests: Optional[int] = None
    monthly_requests: Optional[int] = None

-class QuotaCreate(QuotaBase):
-    user_id: int
-
-class Quota(QuotaBase):
+class APIKey(BaseModel):
    id: int
-    user_id: int
-    reset_at: Optional[datetime] = None
+    name: str
+    key: str
+    key_prefix: Optional[str] = None
+    is_active: bool
+    created_at: datetime
+    expires_at: Optional[datetime] = None
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None

    class Config:
        from_attributes = True

+class APIKeyCreated(APIKey):
+    plaintext_key: Optional[str] = None
+
+    class Config:
+        from_attributes = True
+
+class QuotaUpdate(BaseModel):
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None
+
+class Settings(BaseModel):
+    ollama_url: str
+    force_model: Optional[str] = None
+
 class UsageStats(BaseModel):
    tokens_used_today: int = 0
    tokens_used_month: int = 0
@@ -67,3 +52,14 @@ class UsageStats(BaseModel):

    class Config:
        from_attributes = True
+
+class APIKeyWithUsage(APIKey):
+    tokens_used_today: int = 0
+    tokens_used_month: int = 0
+    requests_today: int = 0
+    requests_month: int = 0
+    daily_reset_at: Optional[datetime] = None
+    monthly_reset_at: Optional[datetime] = None
+
+    class Config:
+        from_attributes = True
@@ -1,42 +1,25 @@
 #!/usr/bin/env python3
 from database import Base, engine, SessionLocal
-from models import User, APIKey, Quota, Usage
-from crud import create_user, create_api_key, hash_password
+from models import APIKey
+from crud import create_api_key

 def setup_admin():
    Base.metadata.create_all(bind=engine)
    db = SessionLocal()
-    
-    admin_user = db.query(User).filter(User.username == "admin").first()
-    if not admin_user:
-        admin_user = User(
-            username="admin",
-            email="admin@ollama.local",
-            hashed_password=hash_password("admin123"),
-            is_active=True,
-            is_admin=True,
+    existing = db.query(APIKey).filter(APIKey.name == "default").first()
+    if not existing:
+        _, raw_key = create_api_key(
+            db,
+            name="default",
+            daily_tokens=1_000_000,
+            monthly_tokens=10_000_000,
+            daily_requests=1000,
+            monthly_requests=10000,
        )
-        db.add(admin_user)
-        db.commit()
-        db.refresh(admin_user)
-        print("✓ Admin user created")
-        
-        default_quota = Quota(
-            user_id=admin_user.id,
-            daily_tokens=10000000,
-            monthly_tokens=100000000,
-            daily_requests=10000,
-            monthly_requests=100000
-        )
-        db.add(default_quota)
-        db.commit()
-        print("✓ Admin quota created")
-        
-        _, raw_key = create_api_key(db, admin_user.id, "admin-api-key")
-        print(f"✓ Admin API Key: {raw_key}")
+        print(f"API Key created: {raw_key}")
    else:
-        print("✗ Admin user already exists")
+        print("Default API key already exists")
    db.close()

 if __name__ == "__main__":
-    setup_admin()
+    setup_admin()
@@ -6,68 +6,23 @@ os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")

 def _setup_db():
    from database import Base, engine, SessionLocal
-    from models import User, Quota
-    from crud import create_api_key, hash_password
+    from crud import create_api_key

    Base.metadata.drop_all(bind=engine)
    Base.metadata.create_all(bind=engine)

    db = SessionLocal()
-
-    test_user = User(
-        username="testuser",
-        email="test@example.com",
-        hashed_password=hash_password("test123"),
-        is_active=True,
-    )
-    db.add(test_user)
-    db.commit()
-    db.refresh(test_user)
-
-    db.add(Quota(
-        user_id=test_user.id,
-        daily_tokens=1_000_000,
-        monthly_tokens=10_000_000,
-        daily_requests=1000,
-        monthly_requests=10000,
-    ))
-    db.commit()
-
-    _, raw_key = create_api_key(db, test_user.id, "test-key")
+    _, raw_key = create_api_key(db, name="test-key", daily_tokens=1_000_000,
+                                monthly_tokens=10_000_000, daily_requests=1000,
+                                monthly_requests=10000)
    os.environ["TEST_API_KEY"] = raw_key
-
-    admin_user = User(
-        username="admin",
-        email="admin@example.com",
-        hashed_password=hash_password("admin123"),
-        is_active=True,
-        is_admin=True,
-    )
-    db.add(admin_user)
-    db.commit()
-    db.refresh(admin_user)
-
-    db.add(Quota(
-        user_id=admin_user.id,
-        daily_tokens=10_000_000,
-        monthly_tokens=100_000_000,
-        daily_requests=10000,
-        monthly_requests=100000,
-    ))
-    db.commit()
-
-    _, admin_raw_key = create_api_key(db, admin_user.id, "admin-key")
-    os.environ["ADMIN_API_KEY"] = admin_raw_key
-
    db.close()


 def _teardown_db():
-    from database import engine
-    from models import Base
+    from database import engine, Base
    Base.metadata.drop_all(bind=engine)
    os.environ.pop("TEST_API_KEY", None)
-    os.environ.pop("ADMIN_API_KEY", None)


@pytest.fixture(scope="function")
@@ -0,0 +1,59 @@
+import os
+import pytest
+from fastapi.testclient import TestClient
+
+os.environ.setdefault("ADMIN_PASSWORD", "test-admin-pw")
+os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")
+
+
+@pytest.fixture
+def client(tmp_path):
+    log_file = tmp_path / "usage.log"
+    log_file.write_text("\n".join(f"Zeile {i}" for i in range(1, 16)) + "\n")
+    (tmp_path / "error.log").write_text("Fehler A\nFehler B\n")
+    os.environ["LOG_FILE"] = str(log_file)
+
+    from database import Base, engine
+    Base.metadata.drop_all(bind=engine)
+    Base.metadata.create_all(bind=engine)
+
+    from admin import app
+    yield TestClient(app, raise_server_exceptions=False)
+
+    Base.metadata.drop_all(bind=engine)
+    os.environ.pop("LOG_FILE", None)
+
+
+AUTH = {"Authorization": "Bearer test-admin-pw"}
+
+
+def test_logs_usage_returns_last_10_lines(client):
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    lines = resp.json()["lines"]
+    assert len(lines) == 10
+    assert lines[-1] == "Zeile 15"
+    assert lines[0] == "Zeile 6"
+
+
+def test_logs_error_returns_content(client):
+    resp = client.get("/api/logs/error", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == ["Fehler A", "Fehler B"]
+
+
+def test_logs_missing_file_returns_empty(client, tmp_path):
+    os.environ["LOG_FILE"] = str(tmp_path / "nonexistent.log")
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == []
+
+
+def test_logs_invalid_name_returns_400(client):
+    resp = client.get("/api/logs/secret", headers=AUTH)
+    assert resp.status_code == 400
+
+
+def test_logs_requires_auth(client):
+    resp = client.get("/api/logs/usage")
+    assert resp.status_code == 401
@@ -0,0 +1,272 @@
+import json
+import os
+from unittest.mock import AsyncMock, MagicMock, patch, call
+
+
+def _make_body(model="llama3", messages=None, stream=False, **kwargs):
+    body = {
+        "model": model,
+        "messages": messages or [{"role": "user", "content": "Hello"}],
+        "max_tokens": 100,
+    }
+    if stream:
+        body["stream"] = True
+    body.update(kwargs)
+    return body
+
+
+def _ollama_chat_response(content="Hi!", input_tokens=5, output_tokens=3):
+    return {
+        "model": "llama3",
+        "message": {"role": "assistant", "content": content},
+        "prompt_eval_count": input_tokens,
+        "eval_count": output_tokens,
+        "done": True,
+    }
+
+
+# --- Auth ---
+
+def test_messages_missing_auth_returns_401(test_client):
+    response = test_client.post("/v1/messages", json=_make_body())
+    assert response.status_code == 401
+
+
+def test_messages_invalid_key_returns_401(test_client):
+    response = test_client.post(
+        "/v1/messages",
+        headers={"x-api-key": "sk-invalid"},
+        json=_make_body(),
+    )
+    assert response.status_code == 401
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_accepts_anthropic_auth_token_header(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    response = test_client.post(
+        "/v1/messages",
+        headers={"anthropic-auth-token": os.environ.get("TEST_API_KEY", "")},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_accepts_x_api_key_header(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    response = test_client.post(
+        "/v1/messages",
+        headers={"x-api-key": os.environ.get("TEST_API_KEY", "")},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+
+
+# --- Validation ---
+
+def test_messages_missing_model_returns_422(test_client):
+    env = {k: v for k, v in os.environ.items() if k != "ANTHROPIC_DEFAULT_MODEL"}
+    with patch.dict(os.environ, env, clear=True):
+        response = test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json={"messages": [{"role": "user", "content": "Hi"}], "max_tokens": 100},
+        )
+    assert response.status_code == 422
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_anthropic_default_model_used_when_no_model_in_request(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    with patch.dict(os.environ, {"ANTHROPIC_DEFAULT_MODEL": "qwen3-coder:q8_0"}):
+        test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json={"messages": [{"role": "user", "content": "Hi"}], "max_tokens": 100},
+        )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["model"] == "qwen3-coder:q8_0"
+
+
+# --- Quota ---
+
+def test_messages_quota_exceeded_returns_429(test_client):
+    with patch("main.crud.check_and_increment_quota", return_value=False):
+        response = test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json=_make_body(),
+        )
+        assert response.status_code == 429
+
+
+# --- Response format ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_returns_anthropic_format(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response("Hello!")
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["type"] == "message"
+    assert data["role"] == "assistant"
+    assert isinstance(data["content"], list)
+    assert data["content"][0]["type"] == "text"
+    assert data["content"][0]["text"] == "Hello!"
+    assert data["usage"]["input_tokens"] == 5
+    assert data["usage"]["output_tokens"] == 3
+
+
+# --- Request transformation ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_system_prompt_becomes_first_system_message(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(system="You are helpful"),
+    )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["messages"][0]["role"] == "system"
+    assert sent_body["messages"][0]["content"] == "You are helpful"
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_tools_transformed_to_ollama_function_format(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(tools=[{
+            "name": "bash",
+            "description": "Run bash",
+            "input_schema": {"type": "object", "properties": {"command": {"type": "string"}}},
+        }]),
+    )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["tools"][0]["type"] == "function"
+    assert sent_body["tools"][0]["function"]["name"] == "bash"
+    assert "parameters" in sent_body["tools"][0]["function"]
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_tool_call_response_transformed_to_anthropic(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: {
+        "model": "llama3",
+        "message": {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [{"function": {"name": "bash", "arguments": {"command": "ls"}}}],
+        },
+        "prompt_eval_count": 10,
+        "eval_count": 5,
+        "done": True,
+    }
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(),
+    )
+    data = response.json()
+    assert data["stop_reason"] == "tool_use"
+    tool_block = next(b for b in data["content"] if b["type"] == "tool_use")
+    assert tool_block["name"] == "bash"
+    assert tool_block["input"] == {"command": "ls"}
+
+
+# --- Streaming ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_streaming_returns_anthropic_sse_events(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: {
+        "model": "llama3",
+        "message": {"role": "assistant", "content": "Hi!"},
+        "prompt_eval_count": 5,
+        "eval_count": 3,
+        "done": True,
+    }
+
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(stream=True),
+    )
+
+    assert response.status_code == 200
+    events = [
+        json.loads(line[6:])
+        for line in response.text.splitlines()
+        if line.startswith("data: ")
+    ]
+    event_types = [e["type"] for e in events]
+    assert "message_start" in event_types
+    assert "content_block_start" in event_types
+    assert "content_block_delta" in event_types
+    assert "message_stop" in event_types
+
+    deltas = [e for e in events if e["type"] == "content_block_delta"]
+    text = "".join(d["delta"]["text"] for d in deltas)
+    assert text == "Hi!"
+
+
+# --- Backend-Auth (BACKEND_API_KEY) ---
+
+def test_proxy_request_forwards_backend_api_key(test_client):
+    with patch("main.httpx.AsyncClient") as mock_cls:
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"result": "ok"}
+
+        mock_instance = AsyncMock()
+        mock_instance.__aenter__ = AsyncMock(return_value=mock_instance)
+        mock_instance.__aexit__ = AsyncMock(return_value=False)
+        mock_instance.request = AsyncMock(return_value=mock_response)
+        mock_cls.return_value = mock_instance
+
+        with patch.dict(os.environ, {"BACKEND_API_KEY": "sk-backend-secret"}):
+            test_client.post(
+                "/api/generate",
+                headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+                json={"model": "llama3", "prompt": "hi"},
+            )
+
+        _, kwargs = mock_instance.request.call_args
+        assert kwargs.get("headers", {}).get("Authorization") == "Bearer sk-backend-secret"
+
+
+def test_proxy_request_omits_auth_header_when_no_backend_key(test_client):
+    with patch("main.httpx.AsyncClient") as mock_cls:
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"result": "ok"}
+
+        mock_instance = AsyncMock()
+        mock_instance.__aenter__ = AsyncMock(return_value=mock_instance)
+        mock_instance.__aexit__ = AsyncMock(return_value=False)
+        mock_instance.request = AsyncMock(return_value=mock_response)
+        mock_cls.return_value = mock_instance
+
+        env_without_key = {k: v for k, v in os.environ.items() if k != "BACKEND_API_KEY"}
+        with patch.dict(os.environ, env_without_key, clear=True):
+            test_client.post(
+                "/api/generate",
+                headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+                json={"model": "llama3", "prompt": "hi"},
+            )
+
+        _, kwargs = mock_instance.request.call_args
+        assert "Authorization" not in kwargs.get("headers", {})
@@ -5,33 +5,21 @@ from datetime import datetime, timedelta, timezone
 os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")

 from database import Base, engine, SessionLocal
-from models import User, Quota, Usage
-from crud import check_and_increment_quota, count_tokens, hash_password
+from models import APIKey, Usage
+from crud import check_and_increment_quota, count_tokens, create_api_key, verify_api_key


-def make_user_and_quota(db, daily_tokens=None, monthly_tokens=None,
-                        daily_requests=None, monthly_requests=None):
-    user = User(
-        username="quotauser",
-        email="quota@example.com",
-        hashed_password=hash_password("pass"),
-        is_active=True,
-    )
-    db.add(user)
-    db.commit()
-    db.refresh(user)
-
-    quota = Quota(
-        user_id=user.id,
+def make_api_key(db, daily_tokens=None, monthly_tokens=None,
+                 daily_requests=None, monthly_requests=None):
+    db_key, _ = create_api_key(
+        db,
+        name="test-key",
        daily_tokens=daily_tokens,
        monthly_tokens=monthly_tokens,
        daily_requests=daily_requests,
        monthly_requests=monthly_requests,
    )
-    db.add(quota)
-    db.commit()
-
-    return user.id
+    return db_key.id


@pytest.fixture
@@ -64,119 +52,133 @@ def test_count_tokens_more_accurate_than_split():
 # --- check_and_increment_quota ---

 def test_allowed_within_daily_token_limit(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is True
+    api_key_id = make_api_key(db, daily_tokens=1000)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is True

 def test_denied_when_daily_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, daily_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    api_key_id = make_api_key(db, daily_tokens=50)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False

 def test_denied_when_monthly_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    api_key_id = make_api_key(db, monthly_tokens=50)
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False

 def test_denied_when_daily_requests_exceeded(db):
-    user_id = make_user_and_quota(db, daily_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    api_key_id = make_api_key(db, daily_requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False

 def test_denied_when_monthly_requests_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    api_key_id = make_api_key(db, monthly_requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False

 def test_increments_both_daily_and_monthly_counters(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000,
-                                  daily_requests=100, monthly_requests=1000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000,
+                              daily_requests=100, monthly_requests=1000)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 50
    assert usage.tokens_used_month == 50
    assert usage.requests_today == 1
    assert usage.requests_month == 1

 def test_creates_usage_record_on_first_call(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is None
+    api_key_id = make_api_key(db, daily_tokens=1000)
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is None

-    check_and_increment_quota(db, user_id, tokens=10, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=10, requests=1)

-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is not None
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is not None

 def test_no_quota_allows_any_request(db):
-    user_id = make_user_and_quota(db)  # all limits None
-    assert check_and_increment_quota(db, user_id, tokens=999999, requests=9999) is True
+    api_key_id = make_api_key(db)  # all limits None
+    assert check_and_increment_quota(db, api_key_id, tokens=999999, requests=9999) is True

 def test_cumulative_usage_across_calls(db):
-    user_id = make_user_and_quota(db, daily_tokens=200)
-    check_and_increment_quota(db, user_id, tokens=100, requests=1)
-    check_and_increment_quota(db, user_id, tokens=99, requests=1)
-    # 199 used, 1 remaining – exactly 1 more token should pass
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is True
-    # Now 200 used – next request must fail
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is False
+    api_key_id = make_api_key(db, daily_tokens=200)
+    check_and_increment_quota(db, api_key_id, tokens=100, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=99, requests=1)
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is False


 # --- Reset logic ---

 def test_daily_reset_restores_access(db):
-    user_id = make_user_and_quota(db, daily_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=100)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)

-    # Backdate daily_reset_at to yesterday
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    db.commit()

-    # Should pass again after reset
-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 90

 def test_daily_reset_does_not_affect_monthly_counter(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    db.commit()

-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 50
-    assert usage.tokens_used_month == 100  # cumulative across days
+    assert usage.tokens_used_month == 100

 def test_monthly_reset_restores_access(db):
-    user_id = make_user_and_quota(db, monthly_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    api_key_id = make_api_key(db, monthly_tokens=100)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.monthly_reset_at = datetime.now(timezone.utc) - timedelta(days=32)
    db.commit()

-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True

-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_month == 90

 def test_failed_quota_check_still_commits_reset(db):
-    user_id = make_user_and_quota(db, daily_tokens=100, daily_requests=5)
-    check_and_increment_quota(db, user_id, tokens=80, requests=1)
+    api_key_id = make_api_key(db, daily_tokens=100, daily_requests=5)
+    check_and_increment_quota(db, api_key_id, tokens=80, requests=1)

-    # Backdate so a reset fires, but the new request still exceeds the limit
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
    usage.tokens_used_today = 80
    db.commit()

-    # After reset tokens_used_today = 0; 200 tokens exceeds 100 limit
-    result = check_and_increment_quota(db, user_id, tokens=200, requests=1)
+    result = check_and_increment_quota(db, api_key_id, tokens=200, requests=1)
    assert result is False

-    # Reset must still be persisted so the next request sees fresh counters
    db.expire_all()
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
    assert usage.tokens_used_today == 0
+
+
+# --- verify_api_key expiry ---
+
+def _create_raw_key(db, expires_at=None):
+    _, raw_key = create_api_key(db, name="expiry-test", expires_at=expires_at)
+    return raw_key
+
+def test_key_without_expiry_is_valid(db):
+    raw_key = _create_raw_key(db)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_future_expiry_is_valid(db):
+    future = datetime.now(timezone.utc) + timedelta(days=30)
+    raw_key = _create_raw_key(db, expires_at=future)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_past_expiry_is_rejected(db):
+    past = datetime.now(timezone.utc) - timedelta(seconds=1)
+    raw_key = _create_raw_key(db, expires_at=past)
+    assert verify_api_key(db, raw_key) is None
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+IMAGE=mediaeng/llmproxy
+PLATFORM=linux/arm64
+
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+HEAD_TAG=$(git tag --points-at HEAD | head -1)
+
+if [ -n "$HEAD_TAG" ]; then
+    echo "HEAD bereits getaggt: $HEAD_TAG"
+    read -rp "Neuer Tag [${HEAD_TAG}]: " INPUT
+    VERSION="${INPUT:-$HEAD_TAG}"
+else
+    echo "Letzter Tag: ${LAST_TAG:-kein Tag}"
+    read -rp "Neuer Tag: " INPUT
+    if [ -z "$INPUT" ]; then
+        echo "Kein Tag angegeben, breche ab."
+        exit 1
+    fi
+    VERSION="$INPUT"
+fi
+
+if [ "$VERSION" != "$HEAD_TAG" ]; then
+    git tag "$VERSION"
+    git push origin "$VERSION"
+    echo "Tag '$VERSION' gesetzt und gepusht."
+fi
+
+echo ""
+echo "Image   : $IMAGE"
+echo "Platform: $PLATFORM"
+echo "Tags    : $IMAGE:$VERSION  $IMAGE:latest"
+echo ""
+
+docker buildx build \
+    --platform "$PLATFORM" \
+    --push \
+    --build-arg APP_VERSION="$VERSION" \
+    -t "$IMAGE:$VERSION" \
+    -t "$IMAGE:latest" \
+    .
+
+echo ""
+echo "Fertig. Gepusht:"
+echo "  docker pull $IMAGE:$VERSION"
+echo "  docker pull $IMAGE:latest"
@@ -1,24 +1,11 @@
-backend:
-  build:
-    context: ./backend
-    dockerfile: Dockerfile
-  ports:
-    - "8000:8000"
-  environment:
-    - DATABASE_URL=postgresql://ollama:password@db:5432/ollama_proxy
-    - OLLAMA_URL=http://ollama:11434
-    - SECRET_KEY=your-secret-key-change-me
-  depends_on:
-    - db
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - ./backend/test.db:/app/backend/test.db
+      - ./backend/logs:/app/backend/logs

-db:
-  image: postgres:16
-  environment:
-    - POSTGRES_USER=ollama
-    - POSTGRES_PASSWORD=password
-    - POSTGRES_DB=ollama_proxy
-  volumes:
-    - postgres_data:/var/lib/postgresql/data
-
-volumes:
-  postgres_data:
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+cd /app/backend
+python3 init_db.py
+
+uvicorn main:app \
+    --host "${PROXY_HOST:-0.0.0.0}" \
+    --port "${PROXY_PORT:-8000}" &
+PROXY_PID=$!
+
+uvicorn admin:app \
+    --host "${ADMIN_HOST:-0.0.0.0}" \
+    --port "${ADMIN_PORT:-8001}" &
+ADMIN_PID=$!
+
+# Beendet den Container wenn einer der Prozesse stirbt
+wait -n
+kill "$PROXY_PID" "$ADMIN_PID" 2>/dev/null
@@ -0,0 +1,384 @@
+# Log-Viewer und Auto-Reload Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Letzten 10 Zeilen von usage.log/error.log in der Settings-Sektion anzeigen; alle Daten alle 5 Minuten automatisch neu laden; Zeitstempel der letzten Aktualisierung im Header.
+
+**Architecture:** Neuer Backend-Endpunkt `GET /api/logs/{name}` in `admin.py` liest die letzten 10 Zeilen aus den Logdateien. `SettingsSection` bekommt einen `refreshKey`-Prop, den `App` alle 5 Minuten inkrementiert — das triggert einen neuen `useEffect`-Lauf. `App` hält den `lastUpdated`-Timestamp und zeigt ihn im Header.
+
+**Tech Stack:** FastAPI (Python), React 18, axios, CSS
+
+---
+
+### Task 1: Backend-Endpunkt `GET /api/logs/{name}`
+
+**Files:**
+- Modify: `backend/admin.py`
+- Create: `backend/tests/test_admin_logs.py`
+
+- [ ] **Schritt 1: Test schreiben**
+
+Datei `backend/tests/test_admin_logs.py` anlegen:
+
+```python
+import os
+import pytest
+from fastapi.testclient import TestClient
+
+os.environ.setdefault("ADMIN_PASSWORD", "test-admin-pw")
+os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")
+
+
+@pytest.fixture
+def client(tmp_path):
+    log_file = tmp_path / "usage.log"
+    log_file.write_text("\n".join(f"Zeile {i}" for i in range(1, 16)) + "\n")
+    (tmp_path / "error.log").write_text("Fehler A\nFehler B\n")
+    os.environ["LOG_FILE"] = str(log_file)
+
+    from database import Base, engine
+    Base.metadata.drop_all(bind=engine)
+    Base.metadata.create_all(bind=engine)
+
+    from admin import app
+    yield TestClient(app, raise_server_exceptions=False)
+
+    Base.metadata.drop_all(bind=engine)
+    os.environ.pop("LOG_FILE", None)
+
+
+AUTH = {"Authorization": "Bearer test-admin-pw"}
+
+
+def test_logs_usage_returns_last_10_lines(client):
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    lines = resp.json()["lines"]
+    assert len(lines) == 10
+    assert lines[-1] == "Zeile 15"
+    assert lines[0] == "Zeile 6"
+
+
+def test_logs_error_returns_content(client):
+    resp = client.get("/api/logs/error", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == ["Fehler A", "Fehler B"]
+
+
+def test_logs_missing_file_returns_empty(client, tmp_path):
+    os.environ["LOG_FILE"] = str(tmp_path / "nonexistent.log")
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == []
+
+
+def test_logs_invalid_name_returns_400(client):
+    resp = client.get("/api/logs/secret", headers=AUTH)
+    assert resp.status_code == 400
+
+
+def test_logs_requires_auth(client):
+    resp = client.get("/api/logs/usage")
+    assert resp.status_code == 401
+```
+
+- [ ] **Schritt 2: Test zum Scheitern bringen**
+
+```bash
+cd backend
+/Users/oliver/Development/Technologien/llm_quota/.venv/bin/python3 -m pytest tests/test_admin_logs.py -v
+```
+
+Erwartung: alle Tests FAIL mit 404 oder AttributeError (Endpunkt existiert nicht).
+
+- [ ] **Schritt 3: Endpunkt in `admin.py` implementieren**
+
+Direkt vor der Static-File-Mount-Zeile (`_dist = ...`) einfügen:
+
+```python
+@app.get("/api/logs/{name}")
+async def get_log_lines(name: str, _ = Depends(require_admin_auth)):
+    if name not in ("usage", "error"):
+        raise HTTPException(status_code=400, detail="name must be 'usage' or 'error'")
+    log_file = Path(os.getenv("LOG_FILE", "logs/usage.log"))
+    path = log_file if name == "usage" else log_file.parent / "error.log"
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+        return {"lines": lines[-10:]}
+    except FileNotFoundError:
+        return {"lines": []}
+```
+
+- [ ] **Schritt 4: Tests laufen lassen**
+
+```bash
+cd backend
+/Users/oliver/Development/Technologien/llm_quota/.venv/bin/python3 -m pytest tests/test_admin_logs.py -v
+```
+
+Erwartung: alle 5 Tests PASS.
+
+- [ ] **Schritt 5: Gesamte Test-Suite prüfen**
+
+```bash
+cd backend
+/Users/oliver/Development/Technologien/llm_quota/.venv/bin/python3 -m pytest tests/ -q
+```
+
+Erwartung: alle Tests PASS, keine Regressionen.
+
+- [ ] **Schritt 6: Commit**
+
+```bash
+git add backend/admin.py backend/tests/test_admin_logs.py
+git commit -m "Add GET /api/logs/{name} endpoint to admin API"
+```
+
+---
+
+### Task 2: Log-Anzeige in `SettingsSection`
+
+**Files:**
+- Modify: `frontend/src/main.jsx`
+- Modify: `frontend/src/styles.css`
+
+- [ ] **Schritt 1: `refreshKey`-Prop und Log-State in `SettingsSection` ergänzen**
+
+In `main.jsx`, `SettingsSection`-Signatur und State ändern:
+
+```jsx
+function SettingsSection({ password, refreshKey }) {
+  // bestehende States beibehalten, neu hinzufügen:
+  const [usageLog, setUsageLog] = useState([]);
+  const [errorLog, setErrorLog] = useState([]);
+```
+
+- [ ] **Schritt 2: Log-Fetch in den bestehenden `useEffect` integrieren**
+
+Den bestehenden `useEffect` in `SettingsSection` (Zeilen 110–122) ersetzen:
+
+```jsx
+  useEffect(() => {
+    const headers = authHeaders(password);
+    Promise.all([
+      axios.get('/api/settings', { headers }),
+      axios.get('/api/proxy-info', { headers }),
+      axios.get('/api/logs/usage', { headers }),
+      axios.get('/api/logs/error', { headers }),
+    ]).then(([settingsRes, proxyRes, usageRes, errorRes]) => {
+      const s = settingsRes.data;
+      setSettings(s);
+      setProxyEndpoint(proxyRes.data.endpoint);
+      setAppVersion(proxyRes.data.version);
+      setUsageLog(usageRes.data.lines);
+      setErrorLog(errorRes.data.lines);
+      fetchModels(s.ollama_url, s.force_model);
+    }).catch(() => setError('Einstellungen konnten nicht geladen werden.'));
+  }, [refreshKey]);
+```
+
+Wichtig: `[refreshKey]` statt `[]` als Dependency-Array, damit ein neuer `refreshKey` einen Re-Fetch auslöst.
+
+- [ ] **Schritt 3: Log-Anzeige am Ende von `SettingsSection` einfügen**
+
+Den `return`-Block von `SettingsSection` — direkt vor dem schließenden `</section>` — erweitern:
+
+```jsx
+        <div className="log-section">
+          <h3>Nutzungslog (letzte 10 Einträge)</h3>
+          <pre className="log-pre">
+            {usageLog.length > 0 ? usageLog.join('\n') : '— keine Einträge —'}
+          </pre>
+          {errorLog.length > 0 && (
+            <>
+              <h3>Fehlerlog</h3>
+              <pre className="log-pre log-pre-error">{errorLog.join('\n')}</pre>
+            </>
+          )}
+        </div>
+```
+
+Der vollständige `return` von `SettingsSection` sieht dann so aus:
+
+```jsx
+  return (
+    <section>
+      <h2>Einstellungen</h2>
+      <form onSubmit={handleSave} className="settings-form">
+        {/* ... bestehende settings-rows ... */}
+        {error && <div className="error">{error}</div>}
+        {saved && <div className="success">Gespeichert.</div>}
+        <button type="submit">Speichern</button>
+      </form>
+      <div className="log-section">
+        <h3>Nutzungslog (letzte 10 Einträge)</h3>
+        <pre className="log-pre">
+          {usageLog.length > 0 ? usageLog.join('\n') : '— keine Einträge —'}
+        </pre>
+        {errorLog.length > 0 && (
+          <>
+            <h3>Fehlerlog</h3>
+            <pre className="log-pre log-pre-error">{errorLog.join('\n')}</pre>
+          </>
+        )}
+      </div>
+    </section>
+  );
+```
+
+- [ ] **Schritt 4: CSS ergänzen**
+
+Am Ende von `frontend/src/styles.css` anhängen:
+
+```css
+.log-section {
+  margin-top: 24px;
+  border-top: 1px solid #eee;
+  padding-top: 16px;
+}
+
+.log-section h3 {
+  font-size: 13px;
+  font-weight: 600;
+  color: #555;
+  margin: 0 0 6px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.log-pre {
+  background: #1e2a35;
+  color: #c8d6df;
+  font-family: 'Menlo', 'Consolas', monospace;
+  font-size: 11px;
+  line-height: 1.6;
+  padding: 10px 14px;
+  border-radius: 4px;
+  margin: 0 0 14px;
+  overflow-x: auto;
+  white-space: pre;
+}
+
+.log-pre-error {
+  background: #2d1b1b;
+  color: #f5a0a0;
+}
+```
+
+- [ ] **Schritt 5: Manueller Browser-Test**
+
+Dev-Server starten (`./start.sh`), Admin-UI öffnen (`http://localhost:5173`), anmelden. Unter den Einstellungen müssen die letzten 10 Zeilen von `usage.log` erscheinen. Wenn `error.log` leer ist, kein Fehlerlog-Block sichtbar.
+
+- [ ] **Schritt 6: Commit**
+
+```bash
+git add frontend/src/main.jsx frontend/src/styles.css
+git commit -m "Show last 10 log lines in settings section"
+```
+
+---
+
+### Task 3: Auto-Reload alle 5 Minuten + Zeitstempel
+
+**Files:**
+- Modify: `frontend/src/main.jsx`
+- Modify: `frontend/src/styles.css`
+
+- [ ] **Schritt 1: `refreshKey` und `lastUpdated` State in `App` ergänzen**
+
+Im `App`-Component direkt nach den bestehenden `useState`-Deklarationen:
+
+```jsx
+  const [refreshKey, setRefreshKey] = useState(0);
+  const [lastUpdated, setLastUpdated] = useState(null);
+```
+
+- [ ] **Schritt 2: `fetchApiKeys` so anpassen, dass `lastUpdated` gesetzt wird**
+
+Die bestehende `fetchApiKeys`-Funktion in `App` (Zeilen 215–221) ersetzen:
+
+```jsx
+  const fetchApiKeys = async () => {
+    try {
+      const res = await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      setApiKeys(res.data);
+      setLastUpdated(new Date());
+    } catch {
+      setError('API-Keys konnten nicht geladen werden.');
+    }
+  };
+```
+
+- [ ] **Schritt 3: `setInterval` in `App` einbauen**
+
+Den bestehenden `useEffect` in `App` (Zeilen 210–213) ersetzen:
+
+```jsx
+  useEffect(() => {
+    if (!password) { setLoading(false); return; }
+    fetchApiKeys().finally(() => setLoading(false));
+
+    const timer = setInterval(() => {
+      fetchApiKeys();
+      setRefreshKey(k => k + 1);
+    }, 5 * 60 * 1000);
+
+    return () => clearInterval(timer);
+  }, [password]);
+```
+
+- [ ] **Schritt 4: `refreshKey` an `SettingsSection` übergeben**
+
+In der `return`-Anweisung von `App` den `SettingsSection`-Aufruf anpassen:
+
+```jsx
+      <SettingsSection password={password} refreshKey={refreshKey} />
+```
+
+- [ ] **Schritt 5: Zeitstempel im Header anzeigen**
+
+Den `header`-Block in `App` ersetzen:
+
+```jsx
+      <div className="header">
+        <h1>Ollama Proxy Admin</h1>
+        <div className="header-right">
+          {lastUpdated && (
+            <span className="last-updated">
+              Aktualisiert: {lastUpdated.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })}
+            </span>
+          )}
+          <button onClick={logout}>Abmelden</button>
+        </div>
+      </div>
+```
+
+- [ ] **Schritt 6: CSS für Header-Right und Zeitstempel**
+
+Am Ende von `frontend/src/styles.css` anhängen:
+
+```css
+.header-right {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+}
+
+.last-updated {
+  font-size: 12px;
+  color: #95a5a6;
+}
+```
+
+- [ ] **Schritt 7: Manueller Browser-Test**
+
+Admin-UI öffnen. Nach dem Login: Zeitstempel erscheint oben rechts (HH:MM). Nach 5 Minuten müssen Keys und Logs automatisch aktualisiert werden — Timestamp springt auf neue Uhrzeit.
+
+Zum Schnelltest: Intervall testweise auf `5000` (5 Sekunden) setzen, prüfen, dann wieder auf `5 * 60 * 1000` zurücksetzen.
+
+- [ ] **Schritt 8: Commit**
+
+```bash
+git add frontend/src/main.jsx frontend/src/styles.css
+git commit -m "Add 5-minute auto-reload and last-updated timestamp to admin UI"
+```
@@ -0,0 +1,67 @@
+# Design: Log-Viewer und Auto-Reload in der Admin-Oberfläche
+
+## Kontext
+
+Die Admin-Oberfläche zeigt aktuell nur API-Keys und Einstellungen. Es gibt kein automatisches Aktualisieren und keinen Zugriff auf die Logdateien. Hauptbedürfnis: Das aktuell geladene Ollama-Modell schnell im Blick haben, ohne manuell neu laden zu müssen.
+
+## Scope
+
+- Letzten 10 Zeilen von `usage.log` und `error.log` in der Settings-Sektion anzeigen
+- Alle Daten (Keys, Settings, Logs) alle 5 Minuten automatisch neu laden
+- Zeitstempel der letzten Aktualisierung anzeigen
+
+---
+
+## Backend
+
+### Neuer Endpunkt: `GET /api/logs/{name}`
+
+**Datei:** `backend/admin.py`
+
+**Parameter:** `name` — `usage` oder `error` (andere Werte → 400)
+
+**Verhalten:**
+- Leitet den Pfad aus `LOG_FILE` (Env-Var, Default: `logs/usage.log`) ab
+- `error` → selbes Verzeichnis, Dateiname `error.log`
+- Liest die letzten 10 Zeilen der Datei
+- Gibt `{"lines": ["...", ...]}` zurück
+- Datei nicht vorhanden → leeres Array `{"lines": []}`
+- Geschützt durch `require_admin_auth`
+
+---
+
+## Frontend
+
+### Log-Anzeige in `SettingsSection`
+
+**Datei:** `frontend/src/main.jsx`
+
+- Neuer Unterabschnitt am Ende der Settings-Karte
+- Zwei `<pre>`-Blöcke: `usage.log` (immer) und `error.log` (nur wenn nicht leer)
+- Stil konsistent mit bestehenden Settings-Elementen (dunkler Hintergrund, Monospace-Font)
+- Daten werden beim Mount von `SettingsSection` zusammen mit den übrigen Settings geladen
+
+### Auto-Reload
+
+- `setInterval` im `App`-Component, Intervall: **5 Minuten (300 000 ms)**
+- Ruft dieselben Fetch-Funktionen auf wie beim Login: Keys + Settings + Logs
+- Timer wird beim Unmount (Logout) via `clearInterval` bereinigt
+- Oben rechts in der eingeloggten UI: kleiner Hinweis „Zuletzt aktualisiert: HH:MM"
+
+---
+
+## Nicht im Scope
+
+- Live-Streaming / WebSocket
+- Filterung oder Suche in Logs
+- Konfigurierbare Zeilenzahl (fest: 10)
+- Automatisches Scrollen
+
+---
+
+## Tests
+
+- `GET /api/logs/usage` gibt die letzten 10 Zeilen zurück
+- `GET /api/logs/error` gibt leeres Array zurück wenn Datei nicht existiert
+- `GET /api/logs/invalid` gibt 400 zurück
+- Manueller Test: Admin-UI öffnen, 5 Minuten warten, Timestamp prüfen
@@ -1,66 +1,441 @@
 import React, { useState, useEffect } from 'react';
+import ReactDOM from 'react-dom/client';
 import axios from 'axios';
 import './styles.css';

-const maskKey = (key) => `••••••••${key.slice(-4)}`;
+const displayKey = (prefix) => prefix ? `${prefix}••••••••` : '••••••••••••';

-function App() {
-  const [users, setUsers] = useState([]);
-  const [apiKeys, setApiKeys] = useState([]);
-  const [loading, setLoading] = useState(true);
+function authHeaders(token) {
+  return { Authorization: `Bearer ${token}` };
+}
+
+const fmtK = (n) => { const k = n / 1000; return k % 1 === 0 ? `${k}k` : `${k.toFixed(1)}k`; };
+
+function QuotaBar({ used, limit, isToken = false, since = null }) {
+  const fmt = isToken ? fmtK : (n) => n.toLocaleString('de-DE');
+  const sinceLabel = since
+    ? new Date(since).toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit' })
+    : null;
+
+  if (limit == null) return (
+    <div className="quota-cell">
+      <span className="quota-unlimited">∞</span>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+
+  const pct = Math.min(100, (used / limit) * 100);
+  const color = pct >= 90 ? '#e74c3c' : pct >= 70 ? '#e67e22' : '#27ae60';
+  return (
+    <div className="quota-cell">
+      <span className="quota-label">{fmt(used)} / {fmt(limit)}</span>
+      <div className="progress-bar">
+        <div className="progress-fill" style={{ width: `${pct}%`, backgroundColor: color }} />
+      </div>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+}
+
+function Login({ onLogin }) {
+  const [password, setPassword] = useState('');
  const [error, setError] = useState(null);

-  useEffect(() => {
-    Promise.all([fetchUsers(), fetchApiKeys()]).finally(() => setLoading(false));
-  }, []);
-
-  const fetchUsers = async () => {
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
    try {
-      const res = await axios.get('/api/users');
-      setUsers(res.data);
-    } catch (err) {
-      setError('Benutzer konnten nicht geladen werden.');
+      await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      sessionStorage.setItem('admin_password', password);
+      onLogin(password);
+    } catch {
+      setError('Ungültiges Passwort.');
    }
  };

-  const fetchApiKeys = async () => {
-    try {
-      const res = await axios.get('/api/api-keys');
-      setApiKeys(res.data);
-    } catch (err) {
-      setError('API-Keys konnten nicht geladen werden.');
-    }
-  };
-
-  if (loading) return <div>Loading...</div>;
-  if (error) return <div className="error">{error}</div>;
-
  return (
    <div className="container">
      <h1>Ollama Proxy Admin</h1>
+      <form onSubmit={handleSubmit} className="login-form">
+        <label>Passwort</label>
+        <input
+          type="password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          placeholder="Admin-Passwort eingeben"
+          autoFocus
+        />
+        {error && <div className="error">{error}</div>}
+        <button type="submit">Anmelden</button>
+      </form>
+    </div>
+  );
+}
+
+const EMPTY_KEY_FORM = {
+  name: '', expires_at: '', daily_tokens: '', monthly_tokens: '', daily_requests: '', monthly_requests: '',
+};
+
+function SettingsSection({ password, refreshKey }) {
+  const [settings, setSettings] = useState(null);
+  const [availableModels, setAvailableModels] = useState([]);
+  const [modelsLoading, setModelsLoading] = useState(false);
+  const [ollamaReachable, setOllamaReachable] = useState(true);
+  const [proxyEndpoint, setProxyEndpoint] = useState(null);
+  const [appVersion, setAppVersion] = useState(null);
+  const [saved, setSaved] = useState(false);
+  const [error, setError] = useState(null);
+  const [usageLog, setUsageLog] = useState([]);
+  const [errorLog, setErrorLog] = useState([]);
+
+  const fetchModels = async (url, currentModel) => {
+    setModelsLoading(true);
+    try {
+      const res = await axios.get('/api/ollama-models', {
+        headers: authHeaders(password),
+        params: url ? { url } : {},
+      });
+      const { models, reachable } = res.data;
+      setOllamaReachable(reachable);
+      setAvailableModels(models);
+      if (models.length > 0 && currentModel && !models.includes(currentModel)) {
+        setSettings(s => ({ ...s, force_model: models[0] }));
+      }
+    } catch {
+      setOllamaReachable(false);
+      setAvailableModels([]);
+    } finally {
+      setModelsLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    const headers = authHeaders(password);
+    Promise.allSettled([
+      axios.get('/api/settings', { headers }),
+      axios.get('/api/proxy-info', { headers }),
+      axios.get('/api/logs/usage', { headers }),
+      axios.get('/api/logs/error', { headers }),
+    ]).then(([settingsRes, proxyRes, usageRes, errorRes]) => {
+      if (settingsRes.status === 'rejected' || proxyRes.status === 'rejected') {
+        setError('Einstellungen konnten nicht geladen werden.');
+        return;
+      }
+      const s = settingsRes.value.data;
+      setSettings(s);
+      setProxyEndpoint(proxyRes.value.data.endpoint);
+      setAppVersion(proxyRes.value.data.version);
+      if (usageRes.status === 'fulfilled') setUsageLog(usageRes.value.data.lines);
+      if (errorRes.status === 'fulfilled') setErrorLog(errorRes.value.data.lines);
+      fetchModels(s.ollama_url, s.force_model);
+    });
+  }, [refreshKey]);
+
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setError(null);
+    setSaved(false);
+    try {
+      await axios.put('/api/settings', settings, { headers: authHeaders(password) });
+      setSaved(true);
+      setTimeout(() => setSaved(false), 3000);
+    } catch {
+      setError('Fehler beim Speichern.');
+    }
+  };
+
+  if (!settings) return <div>Laden...</div>;
+
+  return (
+    <section>
+      <h2>Einstellungen</h2>
+      <form onSubmit={handleSave} className="settings-form">
+        <div className="settings-row">
+          <label>Proxy-Endpunkt</label>
+          <span className="settings-value">
+            {proxyEndpoint ?? '…'}
+            <small> (Änderung erfordert Neustart)</small>
+          </span>
+        </div>
+        <div className="settings-row">
+          <label>Version</label>
+          <span className="settings-value">{appVersion ?? '…'}</span>
+        </div>
+        <div className="settings-row">
+          <label>Ollama-Endpunkt</label>
+          <div className="settings-input-wrap">
+            <input
+              type="url"
+              value={settings.ollama_url}
+              onChange={(e) => setSettings({ ...settings, ollama_url: e.target.value })}
+              onBlur={(e) => fetchModels(e.target.value, settings.force_model)}
+              placeholder="http://localhost:11434"
+              required
+            />
+            {!ollamaReachable && !modelsLoading && (
+              <div className="warning">⚠ Ollama nicht erreichbar unter {settings.ollama_url}</div>
+            )}
+          </div>
+        </div>
+        <div className="settings-row">
+          <label>Aktives Modell (Lock)</label>
+          {modelsLoading ? (
+            <span className="settings-value">Lade Modelle…</span>
+          ) : availableModels.length > 0 ? (
+            <select
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+            >
+              <option value="">— kein Lock —</option>
+              {availableModels.map(m => <option key={m} value={m}>{m}</option>)}
+            </select>
+          ) : (
+            <input
+              type="text"
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+              placeholder="leer = kein Lock"
+            />
+          )}
+        </div>
+        {error && <div className="error">{error}</div>}
+        {saved && <div className="success">Gespeichert.</div>}
+        <button type="submit">Änderungen übernehmen</button>
+      </form>
+      <div className="log-section">
+        <h3>Nutzungslog (letzte 10 Einträge)</h3>
+        <pre className="log-pre">{usageLog.length > 0 ? usageLog.join('\n') : '— keine Einträge —'}</pre>
+        {errorLog.length > 0 && (
+          <>
+            <h3>Fehlerlog (letzte 10 Einträge)</h3>
+            <pre className="log-pre log-pre-error">{errorLog.join('\n')}</pre>
+          </>
+        )}
+      </div>
+    </section>
+  );
+}
+
+function App() {
+  const [password, setPassword] = useState(() => sessionStorage.getItem('admin_password'));
+  const [apiKeys, setApiKeys] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const [newKey, setNewKey] = useState(null);
+  const [form, setForm] = useState(EMPTY_KEY_FORM);
+  const [creating, setCreating] = useState(false);
+  const [editKey, setEditKey] = useState(null);
+  const [editForm, setEditForm] = useState({});
+  const [refreshKey, setRefreshKey] = useState(0);
+  const [lastUpdated, setLastUpdated] = useState(null);
+
+  const fetchApiKeys = async () => {
+    try {
+      const res = await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      setApiKeys(res.data);
+      setLastUpdated(new Date());
+    } catch {
+      setError('API-Keys konnten nicht geladen werden.');
+    }
+  };
+
+  useEffect(() => {
+    if (!password) { setLoading(false); return; }
+    fetchApiKeys().finally(() => setLoading(false));
+
+    const timer = setInterval(() => {
+      fetchApiKeys();
+      setRefreshKey(k => k + 1);
+    }, 5 * 60 * 1000);
+
+    return () => clearInterval(timer);
+  }, [password]);
+
+  const handleCreate = async (e) => {
+    e.preventDefault();
+    setCreating(true);
+    try {
+      const payload = { name: form.name };
+      if (form.expires_at)       payload.expires_at       = new Date(form.expires_at).toISOString();
+      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens) * 1000;
+      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens) * 1000;
+      if (form.daily_requests)   payload.daily_requests   = Number(form.daily_requests);
+      if (form.monthly_requests) payload.monthly_requests = Number(form.monthly_requests);
+
+      const res = await axios.post('/api/api-keys', payload, { headers: authHeaders(password) });
+      setNewKey(res.data.plaintext_key);
+      setForm(EMPTY_KEY_FORM);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Erstellen des API-Keys.');
+    } finally {
+      setCreating(false);
+    }
+  };
+
+  const handleDeactivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/deactivate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Deaktivieren.');
+    }
+  };
+
+  const handleActivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/activate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Aktivieren.');
+    }
+  };
+
+  const handleDelete = async (id, name) => {
+    if (!window.confirm(`API-Key "${name}" wirklich löschen?`)) return;
+    try {
+      await axios.delete(`/api/api-keys/${id}`, { headers: authHeaders(password) });
+      if (editKey?.id === id) setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Löschen.');
+    }
+  };
+
+  const handleEdit = (key) => {
+    setEditKey(key);
+    setEditForm({
+      daily_tokens:     key.daily_tokens    != null ? key.daily_tokens / 1000    : '',
+      monthly_tokens:   key.monthly_tokens  != null ? key.monthly_tokens / 1000  : '',
+      daily_requests:   key.daily_requests  ?? '',
+      monthly_requests: key.monthly_requests ?? '',
+    });
+  };
+
+  const handleSaveEdit = async (e) => {
+    e.preventDefault();
+    try {
+      const payload = {
+        daily_tokens:     editForm.daily_tokens     !== '' ? Number(editForm.daily_tokens) * 1000     : null,
+        monthly_tokens:   editForm.monthly_tokens   !== '' ? Number(editForm.monthly_tokens) * 1000   : null,
+        daily_requests:   editForm.daily_requests   !== '' ? Number(editForm.daily_requests)   : null,
+        monthly_requests: editForm.monthly_requests !== '' ? Number(editForm.monthly_requests) : null,
+      };
+      await axios.patch(`/api/api-keys/${editKey.id}/quota`, payload, { headers: authHeaders(password) });
+      setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Speichern der Limits.');
+    }
+  };
+
+  const logout = () => {
+    sessionStorage.removeItem('admin_password');
+    setLastUpdated(null);
+    setPassword(null);
+  };
+
+  if (!password) return <Login onLogin={setPassword} />;
+  if (loading) return <div>Laden...</div>;
+  if (error) return <div className="error">{error}</div>;
+
+  return (
+    <div className="container">
+      <div className="header">
+        <h1>Ollama Proxy Admin</h1>
+        <div className="header-right">
+          {lastUpdated && (
+            <span className="last-updated">
+              Aktualisiert: {lastUpdated.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })}
+            </span>
+          )}
+          <button onClick={logout}>Abmelden</button>
+        </div>
+      </div>
+
+      <SettingsSection password={password} refreshKey={refreshKey} />

      <section>
-        <h2>Users</h2>
-        <table>
-          <thead>
-            <tr>
-              <th>ID</th>
-              <th>Username</th>
-              <th>Email</th>
-              <th>Status</th>
-            </tr>
-          </thead>
-          <tbody>
-            {users.map(user => (
-              <tr key={user.id}>
-                <td>{user.id}</td>
-                <td>{user.username}</td>
-                <td>{user.email}</td>
-                <td>{user.is_active ? 'Active' : 'Inactive'}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
+        <h2>Neuer API-Key</h2>
+        <form onSubmit={handleCreate} className="create-form">
+          <div className="edit-form">
+            <label className="create-name">
+              Name
+              <small>&nbsp;</small>
+              <input
+                value={form.name}
+                onChange={(e) => setForm({ ...form, name: e.target.value })}
+                required
+                placeholder="z. B. alice"
+              />
+            </label>
+            <label className="create-date">
+              Ablaufdatum
+              <small>leer = unbegrenzt</small>
+              <input
+                type="date"
+                value={form.expires_at}
+                onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
+              />
+            </label>
+            <div className="create-btn-wrap">
+              <button type="submit" disabled={creating} className="btn-save">Erstellen</button>
+            </div>
+          </div>
+          <div className="edit-form">
+            <label>
+              Tokens/Tag (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_tokens}
+                onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Tokens/Monat (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_tokens}
+                onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Tag
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_requests}
+                onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Monat
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_requests}
+                onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
+              />
+            </label>
+          </div>
+        </form>
+        {newKey && (
+          <div className="new-key-box">
+            <strong>Neuer Key (nur einmal sichtbar):</strong>
+            <code>{newKey}</code>
+            <button onClick={() => setNewKey(null)}>✕</button>
+          </div>
+        )}
      </section>

      <section>
@@ -68,28 +443,106 @@ function App() {
        <table>
          <thead>
            <tr>
-              <th>ID</th>
+              <th></th>
              <th>Name</th>
              <th>Key</th>
-              <th>User</th>
-              <th>Status</th>
+              <th>Läuft ab</th>
+              <th className="th-quota">Tokens/Tag</th>
+              <th className="th-quota">Tokens/Monat</th>
+              <th className="th-quota">Req/Tag</th>
+              <th className="th-quota">Req/Monat</th>
+              <th></th>
            </tr>
          </thead>
          <tbody>
            {apiKeys.map(key => (
-              <tr key={key.id}>
-                <td>{key.id}</td>
+              <tr key={key.id} className={editKey?.id === key.id ? 'row-editing' : ''}>
+                <td className="td-status">
+                  <span className={key.is_active ? 'status-active' : 'status-inactive'} title={key.is_active ? 'Aktiv' : 'Inaktiv'}>●</span>
+                </td>
                <td>{key.name}</td>
-                <td>{maskKey(key.key)}</td>
-                <td>{key.user_id}</td>
-                <td>{key.is_active ? 'Active' : 'Inactive'}</td>
+                <td>{displayKey(key.key_prefix)}</td>
+                <td>{key.expires_at ? new Date(key.expires_at).toLocaleDateString('de-DE', { timeZone: 'Europe/Berlin' }) : '∞'}</td>
+                <td><QuotaBar used={key.tokens_used_today} limit={key.daily_tokens} isToken since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.tokens_used_month} limit={key.monthly_tokens} isToken since={key.monthly_reset_at} /></td>
+                <td><QuotaBar used={key.requests_today} limit={key.daily_requests} since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.requests_month} limit={key.monthly_requests} since={key.monthly_reset_at} /></td>
+                <td className="action-cell">
+                  <button className="btn-icon btn-icon-edit" data-tooltip="Bearbeiten" onClick={() => handleEdit(key)}>✏</button>
+                  {key.is_active ? (
+                    <button className="btn-icon btn-icon-warn" data-tooltip="Deaktivieren" onClick={() => handleDeactivate(key.id)}>⏸</button>
+                  ) : (
+                    <button className="btn-icon btn-icon-ok" data-tooltip="Aktivieren" onClick={() => handleActivate(key.id)}>▶</button>
+                  )}
+                  <button className="btn-icon btn-icon-danger" data-tooltip="Löschen" onClick={() => handleDelete(key.id, key.name)}>✕</button>
+                </td>
              </tr>
            ))}
          </tbody>
        </table>
+
+        {editKey && (
+          <div className="edit-section">
+            <h3>Limits bearbeiten: <em>{editKey.name}</em></h3>
+            <form onSubmit={handleSaveEdit} className="edit-form">
+              <label>
+                Tokens/Tag (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, daily_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Tokens/Monat (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Tag
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_requests}
+                  onChange={(e) => setEditForm({ ...editForm, daily_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Monat
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_requests}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <div className="edit-actions">
+                <button type="submit" className="btn-save">Speichern</button>
+                <button type="button" className="btn-cancel" onClick={() => setEditKey(null)}>Abbrechen</button>
+              </div>
+            </form>
+          </div>
+        )}
      </section>
    </div>
  );
 }

-export default App;
+ReactDOM.createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>
+);
@@ -44,12 +44,455 @@ tr:hover {
  background: #f8f9fa;
 }

-.status-active {
+
+.header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 40px;
+}
+
+.header h1 {
+  margin-bottom: 0;
+}
+
+.login-form {
+  max-width: 360px;
+  margin: 80px auto;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.login-form input {
+  padding: 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.login-form button, .header button {
+  padding: 10px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.login-form button:hover, .header button:hover {
+  background: #34495e;
+}
+
+.error {
+  color: #e74c3c;
+  font-size: 14px;
+}
+
+.create-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.create-form .edit-form {
+  margin-bottom: 0;
+}
+
+.create-name {
+  flex: 0 0 auto !important;
+}
+
+.create-name input {
+  width: 200px;
+}
+
+.create-date {
+  flex: 0 0 auto !important;
+}
+
+.create-date input[type="date"] {
+  width: 150px;
+}
+
+.create-btn-wrap {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: flex-end;
+}
+
+.create-form .btn-save:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.new-key-box {
+  margin-top: 16px;
+  padding: 12px 16px;
+  background: #eafaf1;
+  border: 1px solid #27ae60;
+  border-radius: 4px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.new-key-box code {
+  flex: 1;
+  font-size: 13px;
+  word-break: break-all;
+}
+
+.new-key-box button {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  color: #555;
+}
+
+.btn-danger {
+  padding: 4px 10px;
+  background: #e74c3c;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 12px;
+}
+
+.btn-danger:hover {
+  background: #c0392b;
+}
+
+.settings-form {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  max-width: 500px;
+}
+
+.settings-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.settings-row label {
+  width: 160px;
+  flex-shrink: 0;
+  font-size: 14px;
+  font-weight: 500;
+  color: #2c3e50;
+}
+
+.settings-row input, .settings-row select {
+  flex: 1;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.settings-input-wrap {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.settings-input-wrap input {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+  box-sizing: border-box;
+}
+
+.warning {
+  color: #b8520a;
+  background: #fff3e0;
+  border: 1px solid #e67e22;
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-size: 13px;
+}
+
+.settings-form button {
+  align-self: flex-start;
+  padding: 8px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.settings-form button:hover {
+  background: #34495e;
+}
+
+.success {
  color: #27ae60;
+  font-size: 14px;
+}
+
+.settings-value {
+  flex: 1;
+  font-size: 14px;
+  color: #2c3e50;
+}
+
+.settings-value small {
+  margin-left: 8px;
+  color: #999;
+  font-size: 12px;
+}
+
+/* Quota progress bars */
+.th-quota {
+  width: 90px;
+}
+
+.quota-cell {
+  width: 100%;
+}
+
+.quota-label {
+  font-size: 12px;
+  color: #555;
+  white-space: nowrap;
+}
+
+.quota-unlimited {
+  color: #aaa;
+  font-size: 14px;
+}
+
+.quota-since {
+  display: block;
+  font-size: 10px;
+  color: #aaa;
+  margin-top: 2px;
+}
+
+.progress-bar {
+  height: 4px;
+  background: #e2e8f0;
+  border-radius: 2px;
+  margin-top: 4px;
+}
+
+.progress-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.3s ease;
+}
+
+/* Edit form */
+.td-status {
+  width: 20px;
+  text-align: center;
+}
+
+.status-active  { color: #27ae60; font-size: 12px; }
+.status-inactive { color: #bdc3c7; font-size: 12px; }
+
+.btn-icon {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px 4px;
+  margin-right: 2px;
+  border-radius: 3px;
+  line-height: 1;
+  position: relative;
+}
+
+.btn-icon:hover {
+  background: rgba(0, 0, 0, 0.06);
+}
+
+.btn-icon-edit   { color: #2980b9; }
+.btn-icon-warn   { color: #e67e22; }
+.btn-icon-ok     { color: #27ae60; }
+.btn-icon-danger { color: #e74c3c; }
+
+.btn-icon::after {
+  content: attr(data-tooltip);
+  position: absolute;
+  bottom: calc(100% + 8px);
+  left: 50%;
+  transform: translateX(-50%);
+  background: #2c3e50;
+  color: white;
+  padding: 5px 10px;
+  border-radius: 5px;
+  font-size: 12px;
+  font-weight: 400;
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon::before {
+  content: '';
+  position: absolute;
+  bottom: calc(100% + 2px);
+  left: 50%;
+  transform: translateX(-50%);
+  border: 5px solid transparent;
+  border-top-color: #2c3e50;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon:hover::after,
+.btn-icon:hover::before {
+  opacity: 1;
+}
+
+.action-cell {
+  white-space: nowrap;
+  position: relative;
+  overflow: visible;
+}
+
+.row-editing {
+  background: #eaf4fb !important;
+}
+
+.edit-section {
+  margin-top: 20px;
+  padding: 16px 20px;
+  background: #f0f7ff;
+  border: 1px solid #3498db;
+  border-radius: 6px;
+}
+
+.edit-section h3 {
+  margin: 0 0 14px;
+  font-size: 15px;
+  color: #2c3e50;
  font-weight: 600;
 }

-.status-inactive {
-  color: #e74c3c;
+.edit-section h3 em {
+  font-style: normal;
+  color: #2980b9;
+}
+
+.edit-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px;
+  align-items: flex-end;
+}
+
+.edit-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  font-size: 13px;
+  font-weight: 500;
+  color: #34495e;
+}
+
+.edit-form label small {
+  font-weight: 400;
+  color: #999;
+  font-size: 12px;
+}
+
+.edit-form input {
+  padding: 6px 8px;
+  border: 1px solid #bdc3c7;
+  border-radius: 4px;
+  font-size: 14px;
+  width: 130px;
+}
+
+.edit-actions {
+  display: flex;
+  gap: 8px;
+  padding-bottom: 2px;
+}
+
+.btn-save {
+  padding: 6px 18px;
+  background: #27ae60;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-save:hover {
+  background: #219a52;
+}
+
+.btn-cancel {
+  padding: 6px 18px;
+  background: #95a5a6;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-cancel:hover {
+  background: #7f8c8d;
+}
+
+.log-section {
+  margin-top: 24px;
+  border-top: 1px solid #eee;
+  padding-top: 16px;
+}
+
+.log-section h3 {
+  font-size: 14px;
  font-weight: 600;
+  color: #34495e;
+  margin: 0 0 6px;
+}
+
+.log-pre {
+  background: #1e2a35;
+  color: #c8d6df;
+  font-family: 'Menlo', 'Consolas', monospace;
+  font-size: 11px;
+  line-height: 1.6;
+  padding: 10px 14px;
+  border-radius: 4px;
+  margin: 0 0 14px;
+  overflow-x: auto;
+  white-space: pre;
+}
+
+.log-pre-error {
+  background: #2d1b1b;
+  color: #f5a0a0;
+  margin-bottom: 0;
+}
+
+.header-right {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+}
+
+.last-updated {
+  font-size: 12px;
+  color: #95a5a6;
 }
@@ -3,8 +3,15 @@ import react from '@vitejs/plugin-react'

 export default defineConfig({
  plugins: [react()],
+  clearScreen: false,
  server: {
+    open: true,
    proxy: {
+      '/api/api-keys': 'http://localhost:8001',
+      '/api/settings': 'http://localhost:8001',
+      '/api/ollama-models': 'http://localhost:8001',
+      '/api/proxy-info': 'http://localhost:8001',
+      '/api/logs': 'http://localhost:8001',
      '/api': 'http://localhost:8000',
    },
  },
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Dev runner: startet Proxy, Admin-API und Frontend gemeinsam."""
+import os
+import sys
+import signal
+import subprocess
+import threading
+from pathlib import Path
+
+
+def load_env(path: Path):
+    if not path.exists():
+        return
+    for line in path.read_text(encoding='utf-8').splitlines():
+        line = line.strip()
+        if line and not line.startswith('#') and '=' in line:
+            key, _, val = line.partition('=')
+            os.environ.setdefault(key.strip(), val.strip().strip('"\''))
+
+
+def pipe_output(proc: subprocess.Popen, label: str, color: str):
+    reset = '\033[0m'
+    prefix = f'\033[{color}m[{label}]{reset} '
+    for raw in iter(proc.stdout.readline, b''):
+        sys.stdout.write(prefix + raw.decode(errors='replace'))
+        sys.stdout.flush()
+
+
+def main():
+    root = Path(__file__).parent
+    load_env(root / '.env')
+
+    if not os.environ.get('ADMIN_PASSWORD'):
+        print('Fehler: ADMIN_PASSWORD nicht gesetzt (siehe .env)')
+        sys.exit(1)
+
+    python  = root / '.venv' / 'bin' / 'python'
+    backend = root / 'backend'
+    frontend = root / 'frontend'
+
+    proxy_host = os.environ.get('PROXY_HOST', '0.0.0.0')
+    proxy_port = os.environ.get('PROXY_PORT', '8000')
+    admin_host = os.environ.get('ADMIN_HOST', '127.0.0.1')
+    admin_port = os.environ.get('ADMIN_PORT', '8001')
+
+    print('Initialisiere Datenbank...')
+    subprocess.run([str(python), 'init_db.py'], cwd=backend, check=True)
+
+    print(f'Starte Proxy      → http://{proxy_host}:{proxy_port}')
+    print(f'Starte Admin-API  → http://{admin_host}:{admin_port}')
+    print('Starte Frontend   → http://localhost:5173')
+
+    env = {**os.environ, 'PYTHONUNBUFFERED': '1'}
+
+    procs = [
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'main:app', '--reload',
+             '--host', proxy_host, '--port', proxy_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Proxy   ', '34'),  # blau
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'admin:app', '--reload',
+             '--host', admin_host, '--port', admin_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Admin   ', '33'),  # gelb
+        (subprocess.Popen(
+            ['npm', 'run', 'dev'],
+            cwd=frontend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        ), 'Frontend', '32'),  # grün
+    ]
+
+    for proc, label, color in procs:
+        threading.Thread(target=pipe_output, args=(proc, label, color), daemon=True).start()
+
+    def stop(*_):
+        for p, _, _ in procs:
+            p.terminate()
+
+    signal.signal(signal.SIGINT, stop)
+    signal.signal(signal.SIGTERM, stop)
+
+    for p, _, _ in procs:
+        p.wait()
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,83 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# .env laden
+if [ -f "$SCRIPT_DIR/.env" ]; then
+    set -a
+    source "$SCRIPT_DIR/.env"
+    set +a
+fi
+
+# Virtuelle Umgebung aktivieren falls vorhanden
+if [ -f "$SCRIPT_DIR/.venv/bin/activate" ]; then
+    source "$SCRIPT_DIR/.venv/bin/activate"
+elif [ -f "$SCRIPT_DIR/venv/bin/activate" ]; then
+    source "$SCRIPT_DIR/venv/bin/activate"
+fi
+
+if [ -z "$ADMIN_PASSWORD" ]; then
+    echo "Fehler: ADMIN_PASSWORD ist nicht gesetzt. Bitte .env befüllen."
+    exit 1
+fi
+
+PROXY_HOST=${PROXY_HOST:-0.0.0.0}
+PROXY_PORT=${PROXY_PORT:-8000}
+ADMIN_HOST=${ADMIN_HOST:-127.0.0.1}
+ADMIN_PORT=${ADMIN_PORT:-8001}
+FRONTEND_PORT=5173
+
+PIDS=()
+
+cleanup() {
+    echo "Beende alle Prozesse..."
+    for pid in "${PIDS[@]}"; do
+        kill "$pid" 2>/dev/null
+    done
+    wait 2>/dev/null
+}
+
+port_in_use() {
+    lsof -iTCP:"$1" -sTCP:LISTEN -t &>/dev/null
+}
+
+# Ports prüfen bevor irgendetwas gestartet wird
+for port in "$PROXY_PORT" "$ADMIN_PORT" "$FRONTEND_PORT"; do
+    if port_in_use "$port"; then
+        echo "Fehler: Port $port ist bereits belegt."
+        exit 1
+    fi
+done
+
+trap cleanup EXIT INT TERM
+
+# Datenbank initialisieren
+echo "Initialisiere Datenbank..."
+cd backend
+python3 init_db.py
+cd ..
+
+# Backend starten
+echo "Starte Backend (Proxy) auf ${PROXY_HOST}:${PROXY_PORT}..."
+cd backend
+python3 -m uvicorn main:app --reload --host "$PROXY_HOST" --port "$PROXY_PORT" &
+PIDS+=($!)
+
+echo "Starte Admin-API auf ${ADMIN_HOST}:${ADMIN_PORT}..."
+python3 -m uvicorn admin:app --reload --host "$ADMIN_HOST" --port "$ADMIN_PORT" &
+PIDS+=($!)
+cd ..
+
+# Frontend starten
+echo "Starte Frontend..."
+cd frontend
+npm install --silent
+npm run dev &
+PIDS+=($!)
+cd ..
+
+echo "Backend läuft (Port $PROXY_PORT)"
+echo "Admin-API läuft (${ADMIN_HOST}:${ADMIN_PORT})"
+echo "Admin-Oberfläche: http://localhost:$FRONTEND_PORT"
+
+wait
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# .env laden
+if [ -f "$SCRIPT_DIR/.env" ]; then
+    set -a
+    source "$SCRIPT_DIR/.env"
+    set +a
+fi
+
+# API-Key: erstes Argument hat Vorrang, sonst Umgebungsvariable PROXY_API_KEY
+API_KEY="${1:-$PROXY_API_KEY}"
+
+if [ -z "$API_KEY" ]; then
+    echo "Fehler: Kein API-Key angegeben."
+    echo "Verwendung: ./start_claude.sh sk-dein-key"
+    echo "       oder: PROXY_API_KEY=sk-dein-key ./start_claude.sh"
+    exit 1
+fi
+
+# 0.0.0.0 ist eine Bind-Adresse, kein gültiger Client-Host
+PROXY_HOST="${PROXY_HOST:-0.0.0.0}"
+PROXY_PORT="${PROXY_PORT:-8000}"
+if [ "$PROXY_HOST" = "0.0.0.0" ]; then
+    PROXY_HOST="localhost"
+fi
+
+export ANTHROPIC_BASE_URL="http://${PROXY_HOST}:${PROXY_PORT}"
+export ANTHROPIC_AUTH_TOKEN="$API_KEY"
+
+echo "Verbinde mit Proxy: $ANTHROPIC_BASE_URL"
+exec claude
Author	SHA1	Message	Date
Oliver Hofmann	eb83c52b7f	Rename settings save button to 'Änderungen übernehmen'	2026-05-10 10:50:09 +02:00
Oliver Hofmann	f551b2a421	Harmonize typography: remove log uppercase, normalize label font sizes	2026-05-10 10:45:41 +02:00
Oliver Hofmann	79a30dd179	Route /api/logs to admin API in Vite proxy config	2026-05-10 10:40:41 +02:00
Oliver Hofmann	0353e0299f	Use Promise.allSettled so log fetch failures don't break settings display	2026-05-10 10:34:28 +02:00
Oliver Hofmann	5a94fc6d90	Reset lastUpdated on logout	2026-05-10 10:22:33 +02:00
Oliver Hofmann	cf1b3f7786	Add 5-minute auto-reload and last-updated timestamp to admin UI	2026-05-10 10:20:03 +02:00
Oliver Hofmann	02b4ad06ca	Fix pre whitespace, log-pre-error margin, error log heading	2026-05-10 10:18:27 +02:00
Oliver Hofmann	ca55783b90	Show last 10 log lines in settings section	2026-05-10 10:15:48 +02:00
Oliver Hofmann	a9b0168c71	Add GET /api/logs/{name} endpoint to admin API	2026-05-10 10:11:55 +02:00
Oliver Hofmann	7ce4d3a895	Add implementation plan: log viewer and auto-reload	2026-05-10 10:09:34 +02:00
Oliver Hofmann	fff9d1048d	Add design spec: log viewer and auto-reload for admin UI	2026-05-10 10:07:44 +02:00
Oliver Hofmann	cdd55880d6	Remove unnecessary bold formatting from Anthropic API feature entries	2026-05-10 10:00:34 +02:00
Oliver Hofmann	6b2ae4b072	Remove BACKEND_API_KEY from public documentation	2026-05-10 09:58:50 +02:00
Oliver Hofmann	4c8a8d4afb	Update Kurzanleitung: add gemma4:e4b, Claude Code section	2026-05-10 09:56:35 +02:00
Oliver Hofmann	9872175fb0	Add LICENSE, update docs with Anthropic endpoint and free-claude-code attribution	2026-05-10 09:53:12 +02:00
Oliver Hofmann	cc3ee5a03c	Add Anthropic Messages API compatibility layer (/v1/messages) - POST /v1/messages endpoint with full quota enforcement and auth - Accepts x-api-key and anthropic-auth-token headers (for Claude Code) - Transforms Anthropic request/response format ↔ Ollama /api/chat - Streaming support via Anthropic SSE format - Tool use support (request and response transformation) - ANTHROPIC_DEFAULT_MODEL env var for model selection without admin UI - BACKEND_API_KEY env var for forwarding auth to upstream proxies - Fix SQLite path always resolved relative to database.py location - start.sh and start_claude.sh load .env relative to script location	2026-05-10 09:45:38 +02:00
Oliver Hofmann	70fd61608b	Log actual tokens and elapsed time for all endpoints incl. streaming For streaming /v1/chat/completions: inject stream_options.include_usage, parse usage from SSE chunks, log actual ↑↓ tokens and wall time in the generator's finally block. Add elapsed time to all second log entries.	2026-05-08 09:47:32 +02:00
Oliver Hofmann	07f6fec4bf	Show app version in admin UI and /version endpoint Embed APP_VERSION build arg in Docker image (default: dev). build_push.sh passes the git tag as build arg. Proxy exposes GET /version, admin UI shows it as read-only field in settings.	2026-05-08 09:30:23 +02:00
Oliver Hofmann	6761a73364	Add /api/ps example to Kurzanleitung	2026-05-08 09:25:44 +02:00
Oliver Hofmann	0d1ce96c99	Expose /api/ps to show currently loaded model	2026-05-08 09:22:17 +02:00
Oliver Hofmann	b16b3af44d	Mention VPN as alias for Intranet in Kurzanleitung	2026-05-08 09:17:08 +02:00
Oliver Hofmann	fdbe0a74e8	Exclude .tex and .pdf from Docker build context	2026-05-08 08:41:49 +02:00
Oliver Hofmann	0154c89c6b	Improve Python examples and opencode description in Kurzanleitung Split second example into focused model listing only, remove repeated prompt code. Replace TUI with 'interaktive Terminal-Oberfläche'.	2026-05-08 08:40:25 +02:00
Oliver Hofmann	e3dbed9f5e	Ignore generated KURZANLEITUNG.tex and .pdf	2026-05-08 08:15:07 +02:00
Oliver Hofmann	5b37718120	Fix list indentation in KURZANLEITUNG.md	2026-05-08 08:07:02 +02:00
Oliver Hofmann	f823e7d314	Return 422 when model field is missing and no force_model is set Prevents an opaque Ollama error from reaching the client by failing fast with a clear message before the request is forwarded.	2026-05-08 08:04:52 +02:00
Oliver Hofmann	34b108f4df	Replace default_model with force_model (model lock) Removes DEFAULT_MODEL in favour of a force_model setting configurable via the admin UI. When set, every proxy request's model field is overridden, preventing uncoordinated model switches during lab sessions. Updates schemas, admin API, all three proxy endpoints, frontend, init_db, and docs (README, DOCKERHUB, KURZANLEITUNG).	2026-05-08 08:02:16 +02:00
Oliver Hofmann	cced65693c	Log actual Ollama token counts and add user guide Add a second usage log line after each proxy response with actual ↑prompt ↓completion token counts from Ollama (prompt_eval_count/eval_count for native endpoints, usage object for OpenAI endpoint). Also adds KURZANLEITUNG.md for students and colleagues covering API access, model selection, Python examples, opencode setup, and quota/admin information.	2026-05-08 07:21:36 +02:00
Oliver Hofmann	256bafe30d	Explain network_mode: host motivation in README	2026-05-07 16:14:44 +02:00
Oliver Hofmann	555d9899fe	Fix build_push.sh tag detection	2026-05-07 16:11:50 +02:00
Oliver Hofmann	31504d1a5b	Remove DOCKERHUB.md reference from README	2026-05-07 16:09:22 +02:00
Oliver Hofmann	2e7b13227d	Make ADMIN_HOST consistent across dev and prod	2026-05-07 16:08:05 +02:00
Oliver Hofmann	5469981eb5	Add ADMIN_HOST to env tables and .env example	2026-05-07 16:04:23 +02:00
Oliver Hofmann	a1e293b1d7	Add ADMIN_HOST env var, restructure docs - docker-entrypoint.sh: Admin-API bindet auf ADMIN_HOST (default 0.0.0.0) statt hardcoded 0.0.0.0 — ermöglicht Einschränkung auf 127.0.0.1 - README: Zweck-Beschreibung, HTTPS-Reverse-Proxy-Abschnitt (Caddy/Nginx), Port-8001-Abschnitt korrigiert (Docker-Port-Mapping greift bei network_mode: host nicht), ADMIN_HOST in Konfig-Tabelle ergänzt - DOCKERHUB.md / DOCKERHUB.en.md: Auf drei Szenarien reduziert (network_mode: host, Ollama als Container + SQLite/PostgreSQL); host.docker.internal-Varianten entfernt - review_priorities.md: gelöscht (alle Punkte behoben)	2026-05-07 16:03:03 +02:00
hofmannol	9f92c09586	Add container_name, remove ineffective extra_hosts with network_mode host	2026-05-07 15:09:04 +02:00
hofmannol	3974010156	Use network_mode: host so container can reach Ollama on 127.0.0.1	2026-05-07 13:58:26 +02:00
hofmannol	8d3f9a7661	Fix OpenAI array content, add error logging, Ollama reachability warning - Normalize OpenAI array-format content to string to fix connection reset - Add error.log with rotating handler for proxy and stream errors - Add global unhandled exception handler returning JSON 500 - Write OLLAMA_URL/DEFAULT_MODEL env vars to DB on startup (reset on restart) - Add extra_hosts to docker-compose.yml for host.docker.internal on Linux - Show warning in admin UI when Ollama URL is unreachable - Return reachable: true/false from /api/ollama-models endpoint	2026-05-07 11:43:17 +02:00
Oliver Hofmann	280b3b0762	Add open: true to Vite dev server config	2026-04-29 17:13:14 +02:00
Oliver Hofmann	89661dafcc	Update README: new endpoints, Docker Hub, streaming, PyCharm config, port 8001 security	2026-04-29 10:19:31 +02:00
Oliver Hofmann	3ccc7f325d	Explain port 8001 security model in docs	2026-04-29 10:17:59 +02:00
Oliver Hofmann	25f19b6ada	Show reset date below quota progress bars in admin UI	2026-04-29 09:55:25 +02:00
Oliver Hofmann	5b97ed0ef7	Expose port 8001 on 127.0.0.1 only, explain why in docs	2026-04-29 09:52:13 +02:00
Oliver Hofmann	222b204d4b	build_push.sh: show current tag, offer to set new one before build	2026-04-29 09:36:50 +02:00
Oliver Hofmann	9910e6e062	Exclude .claude from Docker build context	2026-04-29 09:35:17 +02:00
Oliver Hofmann	6e704da86b	Expand .dockerignore with standard entries	2026-04-29 09:34:19 +02:00
Oliver Hofmann	bd0dc0478f	Add local docker-compose pulling from DockerHub with SQLite and .env	2026-04-29 09:33:04 +02:00
Oliver Hofmann	92fd66381f	Add English version of DockerHub README	2026-04-29 09:19:28 +02:00
Oliver Hofmann	c46c1c2b12	Clarify that Ollama can run remotely, not just on Docker host	2026-04-29 08:51:23 +02:00
Oliver Hofmann	d243523906	Split host-Ollama compose into SQLite and PostgreSQL variants	2026-04-29 08:47:40 +02:00
Oliver Hofmann	2319434b0f	Add host-Ollama compose variant, fix leftover port 8001 exposure	2026-04-29 08:43:54 +02:00
Oliver Hofmann	7912431ffb	Remove ALLOWED_ORIGINS from DockerHub docs (dev-only setting)	2026-04-29 08:38:38 +02:00
Oliver Hofmann	114c45dc7e	Remove port 8001 exposure from all Docker examples	2026-04-29 08:36:59 +02:00
Oliver Hofmann	6f67f29f68	Fix depends_on syntax in PostgreSQL compose example	2026-04-29 08:31:25 +02:00
Oliver Hofmann	3b7c88bf2c	Install psycopg2-binary in Dockerfile only, not in dev requirements	2026-04-29 08:30:16 +02:00
Oliver Hofmann	03712fe401	Add DockerHub README with usage, env vars and compose examples	2026-04-29 08:26:47 +02:00
Oliver Hofmann	a0512b3b2b	Replace build_push.py with build_push.sh, use shell script run config	2026-04-29 08:23:07 +02:00
Oliver Hofmann	511e85ea79	Add Docker build/push run config for arm64	2026-04-29 08:20:15 +02:00
Oliver Hofmann	cdaec894d8	Add PyCharm Dev run config and dev runner script - run_dev.py: starts proxy, admin and frontend together with colored output per process; handles SIGTERM from PyCharm Stop button - .idea/runConfigurations/Dev.xml: PyCharm Python run config - .gitignore: allow Dev.xml via layered negation pattern - vite.config.js: open browser automatically on dev server start	2026-04-29 08:14:33 +02:00
Oliver HofmannandClaude Sonnet 4.6	dd8f69ecb6	Proxy fixes, streaming support, Admin-UI overhaul Backend: - Fix Content-Length mismatch by not forwarding client headers to Ollama - Proxy /v1/chat/completions directly to Ollama's OpenAI-compatible endpoint (eliminates manual Ollama↔OpenAI format conversion, fixes tool use) - Add streaming support via SSE passthrough - Fix ollama_url /v1 suffix stripped on save - Replace BaseHTTPMiddleware with FastAPI global dependency (fixes double logging) - Add rotating usage log (8 KB, logs key name + model + token estimate + prompt preview) - Add httpx timeout 300s - Add activate and delete endpoints for API keys - Return usage data (tokens/requests) in GET /api/api-keys Frontend: - Admin table: remove ID column, status as icon, icon-only action buttons with CSS tooltips - Add activate + delete buttons; edit available for inactive keys too - Quota columns: fixed equal width, progress bars with k-unit formatting - Create form: structured layout matching edit form style - Edit form: token inputs in k units (÷1000 display, ×1000 on save) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-29 07:48:10 +02:00
Oliver Hofmann	c62cafc202	Store key_prefix for readable key display instead of masked hash The last-4 of the SHA-256 hash was meaningless for identification. Now storing the first 12 chars of the plaintext key as key_prefix, displayed as 'sk-aBcDeFgH••••••••' — consistent with what the user sees at creation time and how GitHub/OpenAI handle it.	2026-04-28 10:23:37 +02:00
Oliver Hofmann	94368670b7	Reload Ollama models on URL change, pre-select current model - /api/ollama-models accepts optional url query param to query a different endpoint - Frontend fetches models on load and on Ollama URL blur - Keeps current model selected if available, otherwise selects first in list - Shows loading indicator while fetching	2026-04-28 09:07:53 +02:00
Oliver Hofmann	f22bad6496	Clarify Docker port binding and SSH tunnel for admin access Use 127.0.0.1:8001:8001 to bind admin port locally only. Explain Docker's 0.0.0.0 vs 127.0.0.1 distinction and add SSH tunnel diagram showing how admin UI is accessed remotely.	2026-04-28 08:52:26 +02:00
Oliver HofmannandClaude Sonnet 4.6	ff5c88ecfd	Remove admin port binding from docker run example Port 8001 should not be exposed to the host directly. Add nginx reverse proxy and SSH tunnel examples instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:41:18 +02:00
Oliver HofmannandClaude Sonnet 4.6	317c7f0340	Add Docker production build and update README - Multi-stage Dockerfile: builds frontend, packages with Python backend - admin.py serves frontend/dist as StaticFiles in production - docker-entrypoint.sh runs proxy + admin-api, exits cleanly if either dies - .dockerignore excludes .env, venv, tests, node_modules - Split requirements.txt (prod) / requirements-dev.txt (dev+test) - aiofiles added for StaticFiles support - start.sh: port checks before startup, venv auto-activation, trap cleanup - vite.config.js: clearScreen disabled - README rewritten to reflect current architecture Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:34:45 +02:00
Oliver HofmannandClaude Sonnet 4.6	c8235ec274	Refactor to flat APIKey model with quota, admin UI, .env config, and Berlin timezone - Remove User/Quota models; quota fields now live directly on APIKey - Admin UI: login, API key management, settings (Ollama URL/model), proxy info display - .env/.env.example: ADMIN_PASSWORD, PROXY_HOST/PORT, DATABASE_URL, APP_TZ - Admin API runs on 127.0.0.1 only; proxy host/port configurable - API keys support optional expires_at; verified against Europe/Berlin timezone - Daily/monthly quota resets use Europe/Berlin midnight boundary - Fix all tests to use new flat model; add expiry tests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 08:21:42 +02:00