Remove redundant run_tests.py wrapper

- POST /v1/messages endpoint with full quota enforcement and auth
- Accepts x-api-key and anthropic-auth-token headers (for Claude Code)
- Transforms Anthropic request/response format ↔ Ollama /api/chat
- Streaming support via Anthropic SSE format
- Tool use support (request and response transformation)
- ANTHROPIC_DEFAULT_MODEL env var for model selection without admin UI
- BACKEND_API_KEY env var for forwarding auth to upstream proxies
- Fix SQLite path always resolved relative to database.py location
- start.sh and start_claude.sh load .env relative to script location

.dockerignore

@@ -0,0 +1,52 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+venv/
+*.egg-info/
+.pytest_cache/
+
+# Tests
+backend/tests/
+
+# Environment & secrets
+.env
+*.env.local
+
+# Databases
+*.db
+*.sqlite3
+
+# Logs
+logs/
+*.log
+
+# IDE & tools
+.idea/
+.vscode/
+.claude/
+
+# Git
+.git/
+.gitignore
+
+# Frontend
+frontend/node_modules/
+frontend/dist/
+
+# Docker
+docker-compose.yml
+.dockerignore
+
+# Docs
+*.md
+*.tex
+*.pdf
+
+# Dev & build scripts
+run_dev.py
+build_push.sh
+start.sh
+test_api.sh

.env.example

@@ -0,0 +1,23 @@
+# Admin-Passwort für die Weboberfläche
+ADMIN_PASSWORD=change-me
+
+# Lokaler Endpunkt des Proxys (Admin-API bindet immer auf 127.0.0.1)
+PROXY_HOST=0.0.0.0
+PROXY_PORT=8000
+ADMIN_PORT=8001
+
+# Datenbankverbindung (Standard: SQLite für Entwicklung)
+DATABASE_URL=sqlite:///./test.db
+
+# Beispiel für PostgreSQL (Produktion):
+# DATABASE_URL=postgresql://user:password@localhost:5432/llm_quota
+
+# Ollama-Einstellungen (auch in der Admin-Oberfläche änderbar)
+OLLAMA_URL=http://localhost:11434
+DEFAULT_MODEL=llama3
+APP_TZ=Europe/Berlin
+
+# Standard-Modell für den Anthropic-kompatiblen Endpunkt (/v1/messages)
+# Wird verwendet, wenn der Client kein Modell angibt oder ein Anthropic-Modellname
+# (z.B. claude-opus-4-7) auf kein lokales Modell passt.
+ANTHROPIC_DEFAULT_MODEL=llama3

.gitignore

@@ -14,7 +14,11 @@ __pycache__/
 *.sqlite3
 
 # IDE
-.idea/
+.idea/*
+!.idea/runConfigurations/
+.idea/runConfigurations/*
+!.idea/runConfigurations/Dev.xml
+!.idea/runConfigurations/Docker_Push.xml
 .vscode/
 
 # Frontend build
@@ -22,4 +26,11 @@ frontend/node_modules/
 frontend/dist/
 
 # Misc
-config.json
+config.json
+
+# Generated documents
+KURZANLEITUNG.tex
+KURZANLEITUNG.pdf
+
+# Internal planning docs
+docs/

.idea/runConfigurations/Dev.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Dev" type="PythonConfigurationType" factoryName="Python">
+    <module name="llm_quota" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="SCRIPT_NAME" value="$PROJECT_DIR$/run_dev.py" />
+    <option name="PARAMETERS" value="" />
+    <method v="2" />
+  </configuration>
+</component>

.idea/runConfigurations/Docker_Push.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Docker Push" type="ShConfigurationType">
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/build_push.sh" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/bash" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <method v="2" />
+  </configuration>
+</component>

DOCKERHUB.en.md

@@ -0,0 +1,172 @@
+# mediaeng/llmproxy
+
+A lightweight reverse proxy for [Ollama](https://ollama.com) that manages API keys with configurable token and request quotas. Incoming requests in OpenAI-compatible or Anthropic-compatible format are authenticated, checked against the quota, and forwarded to the configured Ollama server.
+
+## Features
+
+- OpenAI-compatible endpoint (`/v1/chat/completions`, `/v1/models`)
+- Anthropic Messages API (`/v1/messages`) — compatible with Claude Code CLI and Anthropic SDK clients
+- API key management with daily and monthly token/request limits
+- Web-based admin interface (port 8001)
+- Model lock: enforces a specific model for all requests (useful for courses and lab sessions)
+- Streaming support (Server-Sent Events)
+- Tool use / function calling passthrough
+- Rotating usage logs
+- SQLite (default) or PostgreSQL
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| `8000` | Proxy endpoint (OpenAI and Anthropic API) |
+| `8001` | Admin API + web interface |
+
+All API endpoints require the `ADMIN_PASSWORD` — without a valid token, only the public frontend files (HTML/JS/CSS of the login page) are accessible. The password is therefore the primary protection.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ADMIN_PASSWORD` | – | **Required.** Password for the admin interface |
+| `OLLAMA_URL` | `http://localhost:11434` | URL of the Ollama server (without `/v1` suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Database connection string (SQLite or PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Proxy bind address |
+| `PROXY_PORT` | `8000` | Proxy port |
+| `ADMIN_HOST` | `0.0.0.0` | Admin API bind address (`127.0.0.1` to restrict to local access) |
+| `ADMIN_PORT` | `8001` | Admin API port |
+| `APP_TZ` | `Europe/Berlin` | Timezone for daily/monthly quota resets |
+| `LOG_FILE` | `logs/usage.log` | Path of the rotating usage log file |
+| `ANTHROPIC_DEFAULT_MODEL` | – | Default model for `/v1/messages` (Ollama model name, e.g. `llama3`) |
+
+## Docker Compose – Ollama on the Host (Linux, recommended)
+
+`network_mode: host` gives the container direct access to the host network stack. Ollama runs on the host and is reachable at `localhost:11434` — not visible from outside. The proxy and admin interface are available directly on host ports 8000 and 8001.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+ANTHROPIC_DEFAULT_MODEL=llama3
+```
+
+## Docker Compose – Ollama as Container, SQLite
+
+Ollama and llmproxy run together in Docker. Ollama is not exposed externally.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama as Container, PostgreSQL
+
+For production environments with an external database.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client Configuration
+
+**OpenAI-compatible client:**
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <API key created in the admin interface>
+```
+
+**Claude Code CLI:**
+```bash
+ANTHROPIC_BASE_URL=http://<host>:8000 \
+ANTHROPIC_AUTH_TOKEN=<API key created in the admin interface> \
+claude
+```
+
+## Acknowledgements
+
+The Anthropic Messages API endpoint (`/v1/messages`) was inspired by [free-claude-code](https://github.com/Alishahryar1/free-claude-code) by Ali Khokhar, which pursues a similar approach for routing Claude Code requests to alternative LLM backends.
+
+## License
+
+MIT — © 2026 Oliver Hofmann. See [LICENSE](https://git.efi.th-nuernberg.de/gitea/hofmannol/llmproxy/src/branch/main/LICENSE) for details.

DOCKERHUB.md

@@ -0,0 +1,168 @@
+# mediaeng/llmproxy
+
+Ein schlanker Reverse-Proxy für [Ollama](https://ollama.com), der API-Keys mit konfigurierbaren Token- und Request-Quoten verwaltet. Eingehende Anfragen im OpenAI-kompatiblen oder Anthropic-kompatiblen Format werden authentifiziert, auf Quota geprüft und an den konfigurierten Ollama-Server weitergeleitet.
+
+## Funktionen
+
+- OpenAI-kompatibler Endpunkt (`/v1/chat/completions`, `/v1/models`)
+- Anthropic Messages API (`/v1/messages`) — kompatibel mit Claude Code CLI und Anthropic-SDK-Clients
+- API-Key-Verwaltung mit tages- und monatlichen Token-/Request-Limits
+- Web-basierte Admin-Oberfläche (Port 8001)
+- Modell-Lock: erzwingt ein bestimmtes Modell für alle Requests (nützlich für Praktika/Kurse)
+- Streaming-Support (Server-Sent Events)
+- Tool-Use / Function Calling wird durchgereicht
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+
+## Ports
+
+| Port | Dienst |
+|------|--------|
+| `8000` | Proxy-Endpunkt (OpenAI- und Anthropic-API) |
+| `8001` | Admin-API + Web-Oberfläche |
+
+Alle API-Endpunkte erfordern das `ADMIN_PASSWORD` — ein Zugriff ohne gültiges Token liefert nur die öffentlichen Frontend-Dateien (HTML/JS/CSS der Login-Seite). Das Passwort ist damit die primäre Schutzmaßnahme.
+
+## Umgebungsvariablen
+
+| Variable | Standard | Beschreibung |
+|----------|----------|--------------|
+| `ADMIN_PASSWORD` | – | **Pflicht.** Passwort für die Admin-Oberfläche |
+| `OLLAMA_URL` | `http://localhost:11434` | URL des Ollama-Servers (ohne `/v1`-Suffix) |
+| `DATABASE_URL` | `sqlite:///./test.db` | Datenbank-Verbindungsstring (SQLite oder PostgreSQL) |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxy |
+| `PROXY_PORT` | `8000` | Port des Proxy |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (`127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für Tages-/Monats-Reset der Quoten |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ANTHROPIC_DEFAULT_MODEL` | – | Standard-Modell für `/v1/messages` (Ollama-Modellname, z. B. `llama3`) |
+
+## Docker Compose – Ollama auf dem Host (Linux, empfohlen)
+
+`network_mode: host` gibt dem Container direkten Zugriff auf das Host-Netzwerk. Ollama läuft auf dem Host und ist über `localhost:11434` erreichbar — nach außen nicht sichtbar. Proxy und Admin-Oberfläche sind direkt auf den Host-Ports 8000 und 8001 verfügbar.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    container_name: llmproxy
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    volumes:
+      - llmproxy-data:/app/backend
+
+volumes:
+  llmproxy-data:
+```
+
+`.env`:
+```env
+ADMIN_PASSWORD=changeme
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+ANTHROPIC_DEFAULT_MODEL=llama3
+```
+
+## Docker Compose – Ollama als Container, SQLite
+
+Ollama und llmproxy laufen gemeinsam in Docker. Ollama ist nicht nach außen exposed.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    volumes:
+      - llmproxy-data:/app/backend
+    depends_on:
+      - ollama
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  llmproxy-data:
+  ollama-data:
+```
+
+## Docker Compose – Ollama als Container, PostgreSQL
+
+Für Produktionsumgebungen mit externer Datenbank.
+
+```yaml
+services:
+  llmproxy:
+    image: mediaeng/llmproxy:latest
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+      - "8001:8001"
+    environment:
+      ADMIN_PASSWORD: changeme
+      OLLAMA_URL: http://ollama:11434
+      APP_TZ: Europe/Berlin
+      DATABASE_URL: postgresql://llmproxy:secret@db:5432/llmproxy
+      ANTHROPIC_DEFAULT_MODEL: llama3
+    depends_on:
+      db:
+        condition: service_healthy
+      ollama:
+        condition: service_started
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: llmproxy
+      POSTGRES_USER: llmproxy
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U llmproxy"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+
+volumes:
+  pg-data:
+  ollama-data:
+```
+
+## Client-Konfiguration
+
+**OpenAI-kompatibler Client:**
+```
+Base URL:  http://<host>:8000/v1
+API Key:   <angelegter API-Key aus der Admin-Oberfläche>
+```
+
+**Claude Code CLI:**
+```bash
+ANTHROPIC_BASE_URL=http://<host>:8000 \
+ANTHROPIC_AUTH_TOKEN=<API-Key> \
+claude
+```
+
+## Lizenz
+
+MIT — © 2026 Oliver Hofmann. Details siehe [LICENSE](https://git.efi.th-nuernberg.de/gitea/hofmannol/llmproxy/src/branch/main/LICENSE).

Dockerfile

@@ -0,0 +1,24 @@
+FROM node:20-alpine AS frontend-builder
+WORKDIR /app
+COPY frontend/package*.json frontend/
+RUN npm ci --prefix frontend
+COPY frontend/ frontend/
+RUN npm run build --prefix frontend
+
+FROM python:3.12-slim
+ARG APP_VERSION=dev
+ENV APP_VERSION=$APP_VERSION
+WORKDIR /app
+
+COPY backend/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt psycopg2-binary
+
+COPY backend/ backend/
+COPY --from=frontend-builder /app/frontend/dist frontend/dist
+
+COPY docker-entrypoint.sh .
+RUN chmod +x docker-entrypoint.sh
+
+EXPOSE 8000 8001
+
+CMD ["./docker-entrypoint.sh"]

KURZANLEITUNG.md

@@ -0,0 +1,204 @@
+# LLM-Dienst – Kurzanleitung
+
+## Worum geht es?
+
+Der Dienst stellt **große Sprachmodelle (LLMs)** über eine einfache HTTP-API bereit, die direkt aus Python-Skripten, Jupyter-Notebooks oder eigenen Anwendungen angesprochen werden kann. Die Modelle laufen lokal auf einem GPU-Server im Intranet – ohne Datenübertragung nach außen und ohne Cloud-Kosten.
+
+Typische Anwendungsfälle:
+
+- Texte zusammenfassen, übersetzen oder umformulieren
+- KI-gestütztes Coding (z.B. mit **[opencode](https://opencode.ai)**) 
+- Experimente mit Prompt-Engineering und LLM-Integration in eigene Projekte
+
+---
+
+## Zugang
+
+Der Dienst ist **nur im Intranet (VPN)** erreichbar.
+
+| | |
+|---|---|
+| **API-Endpunkt** | `http://141.75.33.244:8000` |
+| **Authentifizierung** | API-Key erforderlich (per E-Mail beim Admin anfragen) |
+
+---
+
+## Verfügbare Modelle
+
+| Modell | Größe | Hinweis |
+|---|---|---|
+| `gemma4:e4b` | 9,6 GB | sehr schnell, für einfache Aufgaben |
+| `gemma4:31b` | 19 GB | kompakt, schnell |
+| `gpt-oss:20b` | 13 GB | kompakt, schnell |
+| `gpt-oss:120b` | 65 GB | sehr leistungsfähig |
+| `qwen3.5:122b` | 81 GB | sehr leistungsfähig |
+| `qwen3-coder-next:q8_0` | 84 GB | speziell für Code |
+
+> **Wichtig:** Es kann immer nur **ein Modell gleichzeitig** im GPU-Speicher geladen sein.
+> Wechselt jemand das Modell, muss das vorherige entladen und das neue geladen werden –
+> das kann **mehrere Minuten** dauern. Der erste Prompt nach einem Modellwechsel ist
+> deshalb deutlich langsamer. Danach bleibt das Modell einige Zeit geladen.
+
+---
+
+## Python-Beispiel – Einfacher Prompt
+
+Das API folgt dem **OpenAI-Standard**, d.h. die `openai`-Bibliothek kann direkt verwendet werden.
+
+```bash
+pip install openai
+```
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."            # euren API-Key eintragen
+BASE_URL = "http://141.75.33.244:8000/v1"
+MODEL = "gemma4:31b"          # Modell nach Bedarf wählen
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+response = client.chat.completions.create(
+    model=MODEL,
+    messages=[
+        {"role": "user", "content": "Erkläre den Unterschied zwischen L1- und L2-Regularisierung."}
+    ]
+)
+
+print(response.choices[0].message.content)
+```
+
+---
+
+## Python-Beispiel – Verfügbare Modelle abfragen
+
+```python
+from openai import OpenAI
+
+API_KEY = "sk-..."
+BASE_URL = "http://141.75.33.244:8000/v1"
+
+client = OpenAI(api_key=API_KEY, base_url=BASE_URL)
+
+models = client.models.list()
+for m in models.data:
+    print(m.id)
+```
+
+---
+
+## Aktuell geladenes Modell abfragen
+
+Da immer nur ein Modell gleichzeitig im Speicher sein kann, lässt sich mit folgendem Aufruf prüfen, welches Modell gerade aktiv ist:
+
+```python
+import httpx
+
+r = httpx.get(
+    "http://141.75.33.244:8000/api/ps",
+    headers={"Authorization": "Bearer sk-..."}
+)
+print(r.json())
+```
+
+Die Antwort enthält Modellname, Größe und wie lange das Modell noch im Speicher bleibt.
+
+---
+
+## Empfehlungen zur Nutzung
+
+- **Kleines Modell zuerst** (`gemma4:31b` oder `gpt-oss:20b`) – viel schneller, für viele Aufgaben ausreichend.
+- **Großes Modell** nur bei komplexen Aufgaben (`qwen3.5:122b`, `gpt-oss:120b`).
+- **Code-Aufgaben**: `qwen3-coder-next:q8_0` ist speziell dafür optimiert.
+- Wenn möglich, **dasselbe Modell wie andere Nutzer** verwenden, um häufige Modellwechsel zu vermeiden.
+
+---
+
+## Quotas
+
+Je nach API-Key können folgende Limits konfiguriert sein:
+
+- Maximale **Anfragen pro Tag / Monat**
+- Maximale **Tokens pro Tag / Monat**
+
+Bei Überschreitung gibt die API den Statuscode `429 Too Many Requests` zurück.
+
+---
+
+## Coding-Assistent: opencode
+
+[opencode](https://opencode.ai) ist ein terminal-basierter KI-Coding-Agent (ähnlich Claude Code), der OpenAI-kompatible APIs unterstützt und damit direkt auf den Intranet-Dienst zeigen kann.
+
+### Installation
+
+```bash
+npm install -g opencode-ai
+# oder
+curl -fsSL https://opencode.ai/install | bash
+```
+
+### Konfiguration
+
+Konfigurationsdatei anlegen unter `~/.config/opencode/config.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "providers": {
+    "openai": {
+      "apiKey": "sk-...",
+      "baseURL": "http://141.75.33.244:8000/v1"
+    }
+  },
+  "model": "openai/qwen3-coder-next:q8_0"
+}
+```
+
+Für Code-Aufgaben empfiehlt sich `qwen3-coder-next:q8_0`, für allgemeine Aufgaben `gemma4:31b` oder `gpt-oss:20b`.
+
+### Starten
+
+```bash
+opencode
+```
+
+opencode öffnet eine interaktive Terminal-Oberfläche und kann dann im Projektverzeichnis eingesetzt werden – Dateien lesen, Code generieren, Refactoring vorschlagen usw.
+
+---
+
+## Coding-Assistent: Claude Code
+
+[Claude Code](https://claude.ai/code) ist Anthropics offizieller KI-Coding-Agent für das Terminal. Wer bereits einen Claude-Code-Zugang hat, kann ihn über den Intranet-Dienst mit lokalen Modellen betreiben — ohne Daten an Anthropic zu übertragen.
+
+### Voraussetzung
+
+Ein aktiver Claude-Code-Zugang (Claude Pro oder Team).
+
+### Starten
+
+```bash
+ANTHROPIC_BASE_URL=http://141.75.33.244:8000 \
+ANTHROPIC_AUTH_TOKEN=sk-... \
+claude
+```
+
+Das zu verwendende Modell wird vom Admin über `ANTHROPIC_DEFAULT_MODEL` vorkonfiguriert — eine manuelle Modellauswahl ist nicht nötig.
+
+---
+
+## Administration (nur für Admins)
+
+Das Web-Interface zur Verwaltung von API-Keys und Quotas ist erreichbar unter:
+
+**`http://141.75.33.244:8001`**
+
+Dort können API-Keys angelegt, deaktiviert und mit Quotas versehen werden.
+
+### Modell-Lock für Praktika
+
+Unter **Einstellungen → Aktives Modell (Lock)** kann ein Modell fest vorgegeben werden. Ist ein Lock gesetzt, wird das `model`-Feld in jedem Request durch dieses Modell ersetzt – unabhängig davon, was der Client schickt. Das verhindert unkoordinierte Modellwechsel während einer Veranstaltung, die alle Teilnehmenden durch lange Ladezeiten ausbremsen würden.
+
+Typischer Ablauf für ein Praktikum:
+1. Vor der Veranstaltung: passendes Modell in Ollama laden
+2. Lock in der Admin-Oberfläche aktivieren
+3. Nach der Veranstaltung: Lock wieder deaktivieren (Feld leeren)

LICENSE

@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) 2026 Oliver Hofmann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Portions of this software were inspired by free-claude-code
+(https://github.com/Alishahryar1/free-claude-code),
+copyright (c) 2026 Ali Khokhar, MIT License.

README.md

@@ -1,122 +1,235 @@
 # Ollama Proxy mit API-Keys und Quotas
 
-Ein Reverse-Proxy für Ollama mit API-Key-Authentifizierung und Quota-Management.
+Ollama bietet von sich aus keine Authentifizierung — wer die API erreicht, kann sie nutzen. Dieses Projekt löst das Problem: Ollama bleibt an `localhost` gebunden und ist von außen nicht erreichbar. Vorgeschaltet läuft ein Proxy (Port 8000), der jeden Request auf einen gültigen API-Key prüft und optional Token- sowie Request-Quoten pro Key durchsetzt. Eine Web-Admin-Oberfläche (Port 8001) erlaubt das Verwalten von Keys, Quoten und Ollama-Einstellungen.
 
 ## Features
 
-- API-Key-Authentifizierung (Bearer Token oder `sk-`-Prefix)
+- API-Key-Authentifizierung (Bearer Token, `sk-`-Prefix, `x-api-key`- und `anthropic-auth-token`-Header)
+- Optionales Ablaufdatum pro API-Key
 - Quota-Management mit getrennten Tages- und Monatslimits (Tokens & Requests)
-- Token-Zählung via tiktoken (cl100k_base)
+- Token-Zählung via tiktoken, Reset-Grenzen in der konfigurierten Zeitzone
-- Usage-Tracking mit automatischem täglichem/monatlichem Reset
+- Web-Admin-Oberfläche (API-Keys verwalten, Ollama-Einstellungen, Verbrauchsanzeige)
-- Web-Admin-Oberfläche für User- und Quota-Verwaltung
+- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt mit Streaming und Tool-Use
-- OpenAI-kompatibler `/v1/chat/completions`-Endpunkt
+- Anthropic Messages API `/v1/messages` — kompatibel mit Claude Code CLI und Anthropic-SDK-Clients
+- Rotierende Nutzungs-Logs
+- SQLite (Standard) oder PostgreSQL
+- Docker-Image auf DockerHub: `mediaeng/llmproxy`
 
 ## Sicherheit
 
-- Passwörter mit bcrypt gehasht
+- Admin-Oberfläche passwortgeschützt (`ADMIN_PASSWORD`) — alle API-Endpunkte erfordern den Token
-- API-Keys als SHA-256-Hash in der DB – Plaintext wird nur einmalig bei Erstellung zurückgegeben
+- API-Keys als SHA-256-Hash in der DB — Plaintext nur einmalig bei Erstellung
-- Admin-Zugriff über `is_admin`-Flag in der DB, nicht über Hardcoded-Namen
-- CORS-Origins konfigurierbar via `ALLOWED_ORIGINS`
 - Quota-Check atomar mit `SELECT FOR UPDATE` (kein TOCTOU-Race)
-
+- Admin-Port 8001 über `ADMIN_HOST=127.0.0.1` auf lokalen Zugriff beschränkbar
-## Installation & Start
-
-### Voraussetzungen
-
-- Python 3.12+
-- PostgreSQL 16+ (oder SQLite für Entwicklung)
-- Node.js 18+ (für Frontend)
-
-### Lokal mit SQLite (Entwicklung)
-
-```bash
-# Backend
-cd backend
-pip install -r requirements.txt
-python init_db.py
-python setup_admin.py
-uvicorn main:app --reload --port 8000
-
-# Admin-API (in neuem Terminal)
-uvicorn admin:app --reload --port 8001
-
-# Frontend (in neuem Terminal)
-cd frontend
-npm install
-npm run dev
-```
-
-### Mit PostgreSQL & Docker (Produktion)
-
-```bash
-docker compose up -d
-docker compose exec backend python init_db.py
-docker compose exec backend python setup_admin.py
-```
 
 ## Konfiguration
 
-`.env`-Datei im `backend/`-Verzeichnis anlegen:
+`.env`-Datei im Projektverzeichnis anlegen:
 
 ```env
-DATABASE_URL=postgresql://user:pass@host:5432/db
+ADMIN_PASSWORD=change-me
-OLLAMA_URL=http://ollama:11434
+PROXY_HOST=0.0.0.0
-ALLOWED_ORIGINS=https://admin.example.com
+PROXY_PORT=8000
+ADMIN_HOST=0.0.0.0
+ADMIN_PORT=8001
+DATABASE_URL=sqlite:///./test.db
+OLLAMA_URL=http://localhost:11434
+APP_TZ=Europe/Berlin
+LOG_FILE=logs/usage.log
+ANTHROPIC_DEFAULT_MODEL=llama3
 ```
 
 | Variable | Standard | Beschreibung |
 |----------|----------|--------------|
-| `DATABASE_URL` | PostgreSQL lokal | DB-Verbindungsstring; `sqlite:///` für SQLite |
+| `ADMIN_PASSWORD` | — | Passwort für die Admin-Oberfläche (**Pflicht**) |
-| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz |
+| `PROXY_HOST` | `0.0.0.0` | Bind-Adresse des Proxys |
-| `ALLOWED_ORIGINS` | `http://localhost:5173` | Kommagetrennte CORS-Origins für die Admin-UI |
+| `PROXY_PORT` | `8000` | Port des Proxys |
+| `ADMIN_HOST` | `0.0.0.0` | Bind-Adresse der Admin-API (z. B. `127.0.0.1` für lokalen Zugriff) |
+| `ADMIN_PORT` | `8001` | Port der Admin-API |
+| `DATABASE_URL` | `sqlite:///./test.db` | DB-Verbindungsstring (SQLite oder PostgreSQL) |
+| `OLLAMA_URL` | `http://localhost:11434` | Adresse der Ollama-Instanz (auch in der UI änderbar) |
+| `APP_TZ` | `Europe/Berlin` | Zeitzone für tägliche/monatliche Quota-Resets |
+| `LOG_FILE` | `logs/usage.log` | Pfad der rotierenden Nutzungs-Logdatei |
+| `ALLOWED_ORIGINS` | `http://localhost:5173` | CORS-Origins (nur für Entwicklung relevant) |
+| `ANTHROPIC_DEFAULT_MODEL` | — | Standard-Modell für `/v1/messages` (Ollama-Modellname) |
 
-## Proxy-Endpunkte
+## Entwicklung (lokal)
 
-Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header.
+### Voraussetzungen
+
+- Python 3.12+ mit virtualenv
+- Node.js 18+
 
 ```bash
-curl -X POST http://localhost:8000/api/generate \
+python -m venv .venv
-  -H "Authorization: Bearer sk-xxxxxx" \
+source .venv/bin/activate
-  -H "Content-Type: application/json" \
+pip install -r backend/requirements-dev.txt
-  -d '{"model":"llama3","prompt":"Say hello"}'
+cd frontend && npm install
 ```
 
-| Endpunkt | Beschreibung |
+### Starten
-|----------|--------------|
-| `POST /api/generate` | Ollama generate |
-| `POST /api/chat` | Ollama chat |
-| `GET /api/tags` | Verfügbare Modelle |
-| `GET /v1/models` | Modelle (OpenAI-Format) |
-| `POST /v1/chat/completions` | Chat (OpenAI-Format) |
 
-## Admin-API (Port 8001)
+**Per Script:**
+```bash
+cp .env.example .env   # ADMIN_PASSWORD setzen
+./start.sh
+```
 
-Alle Endpunkte erfordern einen API-Key eines Nutzers mit `is_admin=true`.
+**Per PyCharm:** Run-Config „Dev" starten (startet Proxy, Admin-API und Vite-Dev-Server gemeinsam).
+
+Das Script prüft alle Ports auf Belegung, initialisiert die Datenbank und startet alle drei Dienste.
+
+Admin-Oberfläche: `http://localhost:5173`
+
+## Claude Code CLI
+
+Der Proxy stellt einen Anthropic-kompatiblen Endpunkt bereit, über den Claude Code CLI mit lokalen Ollama-Modellen genutzt werden kann.
+
+```bash
+# ANTHROPIC_DEFAULT_MODEL in .env setzen, dann:
+./start_claude.sh
+
+# Oder mit Key als Argument:
+./start_claude.sh sk-dein-api-key
+
+# Oder als Umgebungsvariable:
+PROXY_API_KEY=sk-dein-api-key ./start_claude.sh
+```
+
+Das Script setzt `ANTHROPIC_BASE_URL` und `ANTHROPIC_AUTH_TOKEN` automatisch aus der `.env` und startet `claude`.
+
+## Produktion (Docker)
+
+### Docker Compose (empfohlen)
+
+```bash
+docker compose up -d
+```
+
+Zieht das Image von DockerHub und lädt Variablen aus `.env`.
+
+Das Setup verwendet `network_mode: host`: Der Container teilt den Netzwerkstack des Hosts, statt ein eigenes virtuelles Netzwerk zu bekommen. Das ist hier aus zwei Gründen die richtige Wahl:
+
+1. **Ollama soll nicht von außen erreichbar sein.** Ollama läuft auf dem Host und ist an `127.0.0.1:11434` gebunden — nur lokal erreichbar. Mit einem eigenen Container-Netzwerk (Bridge-Mode) wäre `localhost` aus Sicht des Containers der Container selbst, nicht der Host. Die übliche Alternative (`host.docker.internal` + `extra_hosts`) ist auf Linux unzuverlässig.
+
+2. **Kein doppeltes Port-Mapping nötig.** Mit `network_mode: host` sind Port 8000 und 8001 direkt auf dem Host verfügbar, ohne `ports:`-Einträge in der Compose-Datei.
+
+### Image selbst bauen und pushen
+
+```bash
+./build_push.sh
+```
+
+Das Script zeigt den aktuellen Git-Tag, bietet an einen neuen zu setzen, baut das Image für `linux/arm64` und pusht zu `mediaeng/llmproxy`.
+
+### Port 8001 (Admin)
+
+Alle Admin-Endpunkte erfordern das `ADMIN_PASSWORD` — der Token ist der primäre Schutz. Für zusätzliche Härtung lässt sich die Admin-API auf lokalen Zugriff beschränken:
+
+```env
+ADMIN_HOST=127.0.0.1
+```
+
+Bei `network_mode: host` (Produktions-Standard) ist das die einzig wirksame Methode — Docker-Port-Mapping greift dort nicht.
+
+### HTTPS via Reverse-Proxy (ungetestet)
+
+Wer Proxy und Admin-Oberfläche per HTTPS bereitstellen will, kann einen weiteren Reverse-Proxy (z. B. Nginx oder Caddy) vorschalten. Bei `network_mode: host` lauschen beide Dienste direkt auf dem Host, Nginx/Caddy proxyen auf `localhost`.
+
+**Caddy** (empfohlen — automatisches TLS via Let's Encrypt):
+
+```
+llm.example.com {
+    reverse_proxy localhost:8000 {
+        flush_interval -1
+    }
+}
+
+llm-admin.example.com {
+    reverse_proxy localhost:8001
+}
+```
+
+**Nginx** (mit Certbot-Zertifikaten):
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name llm.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
+
+    location / {
+        proxy_pass         http://127.0.0.1:8000;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_buffering    off;   # nötig für Streaming
+        proxy_cache        off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name llm-admin.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/llm-admin.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/llm-admin.example.com/privkey.pem;
+
+    location / {
+        proxy_pass       http://127.0.0.1:8001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+Clients konfigurieren dann `https://llm.example.com/v1` als Base URL.
+
+## Proxy-Endpunkte (Port 8000)
+
+Alle Endpunkte erfordern einen gültigen API-Key im `Authorization`-Header (`Bearer sk-...`), im `x-api-key`-Header oder im `anthropic-auth-token`-Header.
+
+```bash
+# OpenAI-kompatibler Endpunkt
+curl -X POST http://localhost:8000/v1/chat/completions \
+  -H "Authorization: Bearer sk-xxxxxx" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}]}'
+
+# Anthropic-kompatibler Endpunkt (z. B. für Claude Code)
+curl -X POST http://localhost:8000/v1/messages \
+  -H "x-api-key: sk-xxxxxx" \
+  -H "anthropic-version: 2023-06-01" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"llama3","messages":[{"role":"user","content":"Hallo"}],"max_tokens":1024}'
+```
 
 | Endpunkt | Methode | Beschreibung |
 |----------|---------|--------------|
-| `/api/users` | GET | Alle User auflisten |
+| `/v1/messages` | POST | Chat (Anthropic-Format, Streaming + Tool-Use) |
-| `/api/users` | POST | Neuen User anlegen |
+| `/v1/chat/completions` | POST | Chat (OpenAI-Format, Streaming + Tool-Use) |
-| `/api/api-keys` | GET | Alle API-Keys auflisten |
+| `/v1/models` | GET | Modelle (OpenAI-Format) |
-| `/api/api-keys` | POST | Neuen API-Key erstellen (Plaintext einmalig in Response) |
+| `/api/generate` | POST | Ollama generate (nativ) |
+| `/api/chat` | POST | Ollama chat (nativ) |
+| `/api/tags` | GET | Verfügbare Modelle |
+| `/api/versions` | GET | Ollama-Version |
+
+## Admin-API (Port 8001)
+
+Alle Endpunkte erfordern `Authorization: Bearer <ADMIN_PASSWORD>`.
+
+| Endpunkt | Methode | Beschreibung |
+|----------|---------|--------------|
+| `/api/api-keys` | GET | Alle API-Keys mit Verbrauchsdaten |
+| `/api/api-keys` | POST | Neuen API-Key erstellen |
+| `/api/api-keys/{id}/quota` | PATCH | Limits eines Keys aktualisieren |
+| `/api/api-keys/{id}/activate` | PUT | API-Key aktivieren |
 | `/api/api-keys/{id}/deactivate` | PUT | API-Key deaktivieren |
-| `/api/quotas/{user_id}` | PUT | Quota für User setzen |
+| `/api/api-keys/{id}` | DELETE | API-Key löschen |
-
+| `/api/settings` | GET/PUT | Ollama-URL und Standard-Modell |
-### Quota setzen
+| `/api/ollama-models` | GET | Verfügbare Modelle von Ollama |
-
+| `/api/proxy-info` | GET | Lokaler Proxy-Endpunkt |
-```bash
-curl -X PUT http://localhost:8001/api/quotas/1 \
-  -H "Authorization: Bearer sk-admin-key" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "daily_tokens": 1000000,
-    "monthly_tokens": 10000000,
-    "daily_requests": 1000,
-    "monthly_requests": 10000
-  }'
-```
-
-`null` für ein Limit bedeutet unbegrenzt.
 
 ## Tests
 
@@ -130,28 +243,44 @@ python -m pytest tests/ -v
 ```
 llm_quota/
 ├── backend/
-│   ├── main.py           # Proxy-Server
+│   ├── main.py              # Proxy-Server (Port 8000)
-│   ├── admin.py          # Admin-API
+│   ├── admin.py             # Admin-API + Static-File-Serving (Port 8001)
-│   ├── database.py       # DB-Verbindung & Session
+│   ├── database.py          # DB-Verbindung & Session
-│   ├── models.py         # SQLAlchemy-Modelle
+│   ├── models.py            # SQLAlchemy-Modelle (APIKey, Setting, Usage)
-│   ├── schemas.py        # Pydantic-Schemas
+│   ├── schemas.py           # Pydantic-Schemas
-│   ├── crud.py           # DB-Operationen & Token-Zählung
+│   ├── crud.py              # DB-Operationen, Token-Zählung, Quota-Logik
-│   ├── init_db.py        # Tabellen anlegen
+│   ├── init_db.py           # Tabellen anlegen & Settings seeden
-│   ├── setup_admin.py    # Admin-User & API-Key erstellen
+│   ├── requirements.txt     # Produktiv-Dependencies
-│   ├── requirements.txt
+│   ├── requirements-dev.txt # Test-Dependencies
-│   ├── Dockerfile
 │   └── tests/
-│       ├── conftest.py   # Fixtures
+│       ├── conftest.py
-│       ├── test_auth.py  # Authentifizierungs-Tests
+│       ├── test_auth.py
-│       └── test_quota.py # Quota- & Token-Tests
+│       ├── test_quota.py
+│       └── test_anthropic_messages.py
 ├── frontend/
 │   └── src/
-│       ├── main.jsx
+│       ├── main.jsx         # React-Admin-UI
 │       └── styles.css
-├── .gitignore
+├── .idea/runConfigurations/
-└── docker-compose.yml
+│   └── Dev.xml              # PyCharm Run-Config
+├── Dockerfile
+├── docker-compose.yml       # Produktiv-Start mit DockerHub-Image
+├── docker-entrypoint.sh
+├── .dockerignore
+├── start.sh                 # Entwicklungs-Startscript
+├── start_claude.sh          # Claude Code CLI mit Proxy starten
+├── run_dev.py               # Entwicklungs-Runner für PyCharm
+├── build_push.sh            # Docker-Build & Push zu DockerHub
+├── LICENSE
+├── DOCKERHUB.md             # DockerHub-Beschreibung (deutsch)
+├── DOCKERHUB.en.md          # DockerHub-Beschreibung (englisch)
+└── .gitignore
 ```
 
+## Danksagung
+
+Der Anthropic-kompatible Endpunkt (`/v1/messages`) wurde durch das Projekt [free-claude-code](https://github.com/Alishahryar1/free-claude-code) von Ali Khokhar inspiriert, das einen ähnlichen Ansatz für das Weiterleiten von Claude-Code-Anfragen an alternative LLM-Backends verfolgt.
+
 ## Lizenz
 
-MIT
+MIT — siehe [LICENSE](LICENSE)

backend/admin.py

@@ -1,115 +1,187 @@
 import os
+import secrets
+import httpx
+from pathlib import Path
 from fastapi import FastAPI, Depends, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from database import get_db
 import crud, schemas
-from models import User, APIKey, Quota
+from models import APIKey as APIKeyModel, Usage as UsageModel
 
 app = FastAPI(title="Ollama Proxy Admin API")
 
 ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD")
+if not ADMIN_PASSWORD:
+    raise RuntimeError("ADMIN_PASSWORD environment variable must be set")
 
 app.add_middleware(
     CORSMiddleware,
     allow_origins=ALLOWED_ORIGINS,
     allow_credentials=True,
-    allow_methods=["GET", "POST", "PUT", "DELETE"],
+    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
     allow_headers=["Authorization", "Content-Type"],
 )
 
-async def require_admin_auth(request: Request, db: Session = Depends(get_db)):
+def require_admin_auth(request: Request):
-    auth_header = request.headers.get("Authorization", "")
+    auth = request.headers.get("Authorization", "")
-    if auth_header.startswith("Bearer "):
+    token = auth.removeprefix("Bearer ").strip()
-        api_key = auth_header.replace("Bearer ", "")
+    if not secrets.compare_digest(token, ADMIN_PASSWORD):
-    elif auth_header.startswith("sk-"):
+        raise HTTPException(status_code=401, detail="Invalid admin password")
-        api_key = auth_header
-    else:
-        raise HTTPException(status_code=401, detail="Invalid or missing API key")
 
-    db_key = crud.verify_api_key(db, api_key)
+@app.get("/api/api-keys", response_model=list[schemas.APIKeyWithUsage])
-    if not db_key:
+async def read_api_keys(
-        raise HTTPException(status_code=401, detail="Invalid API key")
+    skip: int = 0, limit: int = 100,
-
-    db_user = db.query(User).filter(User.id == db_key.user_id).first()
-    if not db_user or not db_user.is_admin:
-        raise HTTPException(status_code=403, detail="Admin access required")
-
-    request.state.user = db_user
-
-@app.get("/api/users", response_model=list[schemas.User])
-async def read_users(
-    skip: int = 0,
-    limit: int = 100,
     db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    users = db.query(User).offset(skip).limit(limit).all()
+    keys = db.query(APIKeyModel).offset(skip).limit(limit).all()
-    return users
+    result = []
-
+    for key in keys:
-@app.post("/api/users", response_model=schemas.User)
+        item = schemas.APIKeyWithUsage.model_validate(key)
-async def create_user(
+        usage = db.query(UsageModel).filter(UsageModel.api_key_id == key.id).first()
-    user: schemas.UserCreate,
+        if usage:
-    db: Session = Depends(get_db),
+            item.tokens_used_today = usage.tokens_used_today or 0
-    _ = Depends(require_admin_auth)
+            item.tokens_used_month = usage.tokens_used_month or 0
-):
+            item.requests_today = usage.requests_today or 0
-    db_user = crud.get_user_by_username(db, username=user.username)
+            item.requests_month = usage.requests_month or 0
-    if db_user:
+            item.daily_reset_at = usage.daily_reset_at
-        raise HTTPException(status_code=400, detail="Username already registered")
+            item.monthly_reset_at = usage.monthly_reset_at
-    db_user = crud.get_user_by_email(db, email=user.email)
+        result.append(item)
-    if db_user:
+    return result
-        raise HTTPException(status_code=400, detail="Email already registered")
-    return crud.create_user(db=db, username=user.username, email=user.email, password=user.password)
 
 @app.post("/api/api-keys", response_model=schemas.APIKeyCreated)
 async def create_api_key(
     api_key: schemas.APIKeyCreate,
     db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_user = db.query(User).filter(User.id == api_key.user_id).first()
+    db_key, raw_key = crud.create_api_key(
-    if not db_user:
+        db,
-        raise HTTPException(status_code=404, detail="User not found")
+        name=api_key.name,
-    db_key, raw_key = crud.create_api_key(db=db, user_id=api_key.user_id, name=api_key.name)
+        expires_at=api_key.expires_at,
+        daily_tokens=api_key.daily_tokens,
+        monthly_tokens=api_key.monthly_tokens,
+        daily_requests=api_key.daily_requests,
+        monthly_requests=api_key.monthly_requests,
+    )
     result = schemas.APIKeyCreated.model_validate(db_key)
     result.plaintext_key = raw_key
     return result
 
-@app.get("/api/api-keys", response_model=list[schemas.APIKey])
+@app.patch("/api/api-keys/{api_key_id}/quota", response_model=schemas.APIKey)
-async def read_api_keys(
+async def update_quota(
-    skip: int = 0,
+    api_key_id: int,
-    limit: int = 100,
+    quota: schemas.QuotaUpdate,
     db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    api_keys = db.query(APIKey).offset(skip).limit(limit).all()
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
-    return api_keys
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    for field, value in quota.model_dump(exclude_unset=True).items():
+        setattr(db_key, field, value)
+    db.commit()
+    db.refresh(db_key)
+    return db_key
 
 @app.put("/api/api-keys/{api_key_id}/deactivate")
 async def deactivate_api_key(
     api_key_id: int,
     db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
     if not db_key:
         raise HTTPException(status_code=404, detail="API key not found")
     db_key.is_active = False
     db.commit()
     return {"message": "API key deactivated"}
 
-@app.put("/api/quotas/{user_id}", response_model=schemas.Quota)
+@app.put("/api/api-keys/{api_key_id}/activate")
-async def update_quota(
+async def activate_api_key(
-    user_id: int,
+    api_key_id: int,
-    quota: schemas.QuotaCreate,
     db: Session = Depends(get_db),
-    _ = Depends(require_admin_auth)
+    _ = Depends(require_admin_auth),
 ):
-    db_quota = db.query(Quota).filter(Quota.user_id == user_id).first()
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
-    if not db_quota:
+    if not db_key:
-        raise HTTPException(status_code=404, detail="Quota not found")
+        raise HTTPException(status_code=404, detail="API key not found")
-    for key, value in quota.model_dump(exclude_unset=True).items():
+    db_key.is_active = True
-        setattr(db_quota, key, value)
     db.commit()
-    db.refresh(db_quota)
+    return {"message": "API key activated"}
-    return db_quota
+
+@app.delete("/api/api-keys/{api_key_id}")
+async def delete_api_key(
+    api_key_id: int,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    db_key = db.query(APIKeyModel).filter(APIKeyModel.id == api_key_id).first()
+    if not db_key:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.delete(db_key)
+    db.commit()
+    return {"message": "API key deleted"}
+
+@app.get("/api/proxy-info")
+async def get_proxy_info(_ = Depends(require_admin_auth)):
+    host = os.getenv("PROXY_HOST", "0.0.0.0")
+    port = os.getenv("PROXY_PORT", "8000")
+    display_host = "localhost" if host in ("0.0.0.0", "::") else host
+    return {
+        "endpoint": f"http://{display_host}:{port}",
+        "version": os.getenv("APP_VERSION", "dev"),
+    }
+
+@app.get("/api/settings", response_model=schemas.Settings)
+async def read_settings(db: Session = Depends(get_db), _ = Depends(require_admin_auth)):
+    return schemas.Settings(
+        ollama_url=crud.get_setting(db, "ollama_url", "http://localhost:11434"),
+        force_model=crud.get_setting(db, "force_model") or None,
+    )
+
+@app.put("/api/settings", response_model=schemas.Settings)
+async def update_settings(
+    settings: schemas.Settings,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = settings.ollama_url.rstrip('/').removesuffix('/v1')
+    crud.set_setting(db, "ollama_url", ollama_url)
+    crud.set_setting(db, "force_model", settings.force_model or "")
+    return schemas.Settings(ollama_url=ollama_url, force_model=settings.force_model or None)
+
+@app.get("/api/ollama-models")
+async def get_ollama_models(
+    url: str = None,
+    db: Session = Depends(get_db),
+    _ = Depends(require_admin_auth),
+):
+    ollama_url = url or crud.get_setting(db, "ollama_url", "http://localhost:11434")
+    try:
+        async with httpx.AsyncClient(timeout=5.0) as client:
+            response = await client.get(f"{ollama_url}/api/tags")
+        models = [m["name"] for m in response.json().get("models", [])]
+        return {"models": models, "reachable": True}
+    except Exception:
+        return {"models": [], "reachable": False}
+
+@app.get("/api/logs/{name}")
+async def get_log_lines(name: str, _ = Depends(require_admin_auth)):
+    if name not in ("usage", "error"):
+        raise HTTPException(status_code=400, detail="name must be 'usage' or 'error'")
+    log_file = Path(os.getenv("LOG_FILE", "logs/usage.log"))
+    path = log_file if name == "usage" else log_file.parent / "error.log"
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+        return {"lines": lines[-10:]}
+    except FileNotFoundError:
+        return {"lines": []}
+
+# Statisches Frontend ausliefern (nur im Produktivbetrieb, wenn dist/ existiert)
+_dist = Path(__file__).parent.parent / "frontend" / "dist"
+if _dist.exists():
+    app.mount("/", StaticFiles(directory=_dist, html=True), name="frontend")

backend/crud.py

@@ -1,116 +1,116 @@
+import os
 import secrets
 import hashlib
-import bcrypt
 import tiktoken
 from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
 from sqlalchemy.orm import Session
-from models import APIKey, User, Quota, Usage
+from models import APIKey, Usage, Setting
 
 _encoder = tiktoken.get_encoding("cl100k_base")
+_tz = ZoneInfo(os.getenv("APP_TZ", "Europe/Berlin"))
+
+def _now_local() -> datetime:
+    return datetime.now(_tz)
+
+def _to_local(dt: datetime) -> datetime:
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(_tz)
 
 def count_tokens(text: str) -> int:
     return len(_encoder.encode(text))
 
-def hash_password(password: str) -> str:
-    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
-
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return bcrypt.checkpw(plain_password.encode(), hashed_password.encode())
-
 def _hash_api_key(key: str) -> str:
     return hashlib.sha256(key.encode()).hexdigest()
 
-def get_user_by_username(db: Session, username: str):
+def generate_api_key() -> str:
-    return db.query(User).filter(User.username == username).first()
-
-def get_user_by_email(db: Session, email: str):
-    return db.query(User).filter(User.email == email).first()
-
-def generate_api_key():
     return "sk-" + secrets.token_urlsafe(32)
 
-def create_user(db: Session, username: str, email: str, password: str, is_admin: bool = False):
+def create_api_key(
-    db_user = User(
+    db: Session,
-        username=username,
+    name: str,
-        email=email,
+    expires_at: datetime = None,
-        hashed_password=hash_password(password),
+    daily_tokens: int = None,
-        is_admin=is_admin,
+    monthly_tokens: int = None,
-    )
+    daily_requests: int = None,
-    db.add(db_user)
+    monthly_requests: int = None,
-    db.commit()
+) -> tuple[APIKey, str]:
-    db.refresh(db_user)
-
-    default_quota = Quota(
-        user_id=db_user.id,
-        daily_tokens=1000000,
-        monthly_tokens=10000000,
-        daily_requests=1000,
-        monthly_requests=10000
-    )
-    db.add(default_quota)
-    db.commit()
-
-    return db_user
-
-def create_api_key(db: Session, user_id: int, name: str) -> tuple[APIKey, str]:
     raw_key = generate_api_key()
     db_key = APIKey(
         name=name,
         key=_hash_api_key(raw_key),
-        user_id=user_id
+        key_prefix=raw_key[:12],
+        expires_at=expires_at,
+        daily_tokens=daily_tokens,
+        monthly_tokens=monthly_tokens,
+        daily_requests=daily_requests,
+        monthly_requests=monthly_requests,
     )
     db.add(db_key)
     db.commit()
     db.refresh(db_key)
     return db_key, raw_key
 
+def get_setting(db: Session, key: str, default: str = None) -> str:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    return row.value if row else default
+
+def set_setting(db: Session, key: str, value: str) -> None:
+    row = db.query(Setting).filter(Setting.key == key).first()
+    if row:
+        row.value = value
+    else:
+        db.add(Setting(key=key, value=value))
+    db.commit()
+
 def verify_api_key(db: Session, api_key: str):
     key_hash = _hash_api_key(api_key)
-    return db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    db_key = db.query(APIKey).filter(APIKey.key == key_hash, APIKey.is_active == True).first()
+    if db_key and db_key.expires_at:
+        expires = db_key.expires_at
+        if expires.tzinfo is None:
+            expires = expires.replace(tzinfo=timezone.utc)
+        if expires < datetime.now(timezone.utc):
+            return None
+    return db_key
 
-def get_quota(db: Session, user_id: int):
+def check_and_increment_quota(db: Session, api_key_id: int, tokens: int = 0, requests: int = 1) -> bool:
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_quota_by_user_id(db: Session, user_id: int):
-    return db.query(Quota).filter(Quota.user_id == user_id).first()
-
-def get_usage(db: Session, user_id: int):
-    return db.query(Usage).filter(Usage.user_id == user_id).first()
-
-def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, requests: int = 1) -> bool:
     usage = (
         db.query(Usage)
-        .filter(Usage.user_id == user_id)
+        .filter(Usage.api_key_id == api_key_id)
         .with_for_update()
         .first()
     )
     if not usage:
-        usage = Usage(user_id=user_id)
+        usage = Usage(api_key_id=api_key_id)
         db.add(usage)
         db.flush()
 
-    now = datetime.now(timezone.utc)
+    now = _now_local()
+    daily_reset_local = _to_local(usage.daily_reset_at)
+    monthly_reset_local = _to_local(usage.monthly_reset_at)
 
-    if usage.daily_reset_at.date() < now.date():
+    if daily_reset_local.date() < now.date():
         usage.tokens_used_today = 0
         usage.requests_today = 0
         usage.daily_reset_at = now
 
-    if (usage.monthly_reset_at.year, usage.monthly_reset_at.month) < (now.year, now.month):
+    if (monthly_reset_local.year, monthly_reset_local.month) < (now.year, now.month):
         usage.tokens_used_month = 0
         usage.requests_month = 0
         usage.monthly_reset_at = now
 
-    quota = get_quota(db, user_id)
+    api_key = db.query(APIKey).filter(APIKey.id == api_key_id).first()
     allowed = True
-    if quota:
+    if api_key:
-        if quota.daily_tokens and (usage.tokens_used_today + tokens) > quota.daily_tokens:
+        if api_key.daily_tokens and (usage.tokens_used_today + tokens) > api_key.daily_tokens:
             allowed = False
-        elif quota.monthly_tokens and (usage.tokens_used_month + tokens) > quota.monthly_tokens:
+        elif api_key.monthly_tokens and (usage.tokens_used_month + tokens) > api_key.monthly_tokens:
             allowed = False
-        elif quota.daily_requests and (usage.requests_today + requests) > quota.daily_requests:
+        elif api_key.daily_requests and (usage.requests_today + requests) > api_key.daily_requests:
             allowed = False
-        elif quota.monthly_requests and (usage.requests_month + requests) > quota.monthly_requests:
+        elif api_key.monthly_requests and (usage.requests_month + requests) > api_key.monthly_requests:
             allowed = False
 
     if allowed:
@@ -120,4 +120,4 @@ def check_and_increment_quota(db: Session, user_id: int, tokens: int = 0, reques
         usage.requests_month += requests
 
     db.commit()
-    return allowed
+    return allowed

backend/database.py

@@ -1,19 +1,26 @@
+import os
+from pathlib import Path
+from dotenv import load_dotenv
 from sqlalchemy import create_engine
+
+load_dotenv(dotenv_path=Path(__file__).resolve().parent.parent / ".env")
 from sqlalchemy.orm import sessionmaker, declarative_base
 
-try:
+DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
-    import os
+
-    DATABASE_URL = os.environ.get("DATABASE_URL", "postgresql://ollama:password@localhost:5432/ollama_proxy")
+# Relative SQLite-Pfade immer relativ zu dieser Datei auflösen, nicht zum cwd
-    if "sqlite" in DATABASE_URL:
+if DATABASE_URL.startswith("sqlite:///") and not DATABASE_URL.startswith("sqlite:////"):
-        engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
+    db_path = DATABASE_URL[len("sqlite:///"):]
-    else:
+    if not os.path.isabs(db_path):
-        engine = create_engine(DATABASE_URL)
+        db_path = str(Path(__file__).resolve().parent / db_path)
-except Exception:
+        DATABASE_URL = f"sqlite:///{db_path}"
-    DATABASE_URL = "sqlite:///./test.db"
+
+if "sqlite" in DATABASE_URL:
     engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
+else:
+    engine = create_engine(DATABASE_URL)
 
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
-
 Base = declarative_base()
 
 def get_db():

backend/init_db.py

@@ -1,24 +1,21 @@
-from sqlalchemy import create_engine
-from sqlalchemy.orm import sessionmaker
-from database import Base
-import models
 import os
+from dotenv import load_dotenv
 
-SQLALCHEMY_DATABASE_URL = os.environ.get("DATABASE_URL", "sqlite:///./test.db")
+load_dotenv(dotenv_path=os.path.join(os.path.dirname(__file__), '..', '.env'))
 
-try:
+from database import Base, engine, SessionLocal
-    if "sqlite" in SQLALCHEMY_DATABASE_URL:
+import models
-        engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
+from crud import get_setting, set_setting
-    else:
-        engine = create_engine(SQLALCHEMY_DATABASE_URL)
-except:
-    SQLALCHEMY_DATABASE_URL = "sqlite:///./test.db"
-    engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False})
-SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
 def init_db():
     Base.metadata.create_all(bind=engine)
-    print("Database tables created successfully!")
+
+    db = SessionLocal()
+    if not get_setting(db, "ollama_url"):
+        set_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    db.close()
+
+    print("Database initialized.")
 
 if __name__ == "__main__":
     init_db()

backend/main.py

@@ -1,144 +1,469 @@
+import json
+import logging
+import os
+import secrets
 import time
-import uuid
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
 from fastapi import FastAPI, HTTPException, Depends, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from sqlalchemy.orm import Session
-from database import get_db, SessionLocal
+from database import get_db
 import crud
 import httpx
-import os
 
-app = FastAPI(title="Ollama Proxy")
+_log_dir = Path(os.getenv("LOG_FILE", "logs/usage.log")).parent
-OLLAMA_URL = os.getenv("OLLAMA_URL", "http://localhost:11434")
+_log_dir.mkdir(parents=True, exist_ok=True)
+_fmt = logging.Formatter("%(asctime)s | %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
 
-async def proxy_request(url: str, method: str = "GET", json_data: dict = None, headers: dict = None):
+# Rotating usage log (8 KB per file, 3 backups)
-    async with httpx.AsyncClient() as client:
+_usage_handler = RotatingFileHandler(str(_log_dir / "usage.log"), maxBytes=8192, backupCount=3, encoding="utf-8")
-        response = await client.request(method=method, url=url, json=json_data, headers=headers)
+_usage_handler.setFormatter(_fmt)
-        return response
+usage_log = logging.getLogger("proxy.usage")
+usage_log.setLevel(logging.INFO)
+usage_log.addHandler(_usage_handler)
+usage_log.propagate = False
 
-@app.middleware("http")
+# Rotating error log (64 KB per file, 5 backups)
-async def authenticate_and_quota(request: Request, call_next):
+_error_handler = RotatingFileHandler(str(_log_dir / "error.log"), maxBytes=65536, backupCount=5, encoding="utf-8")
+_error_handler.setFormatter(_fmt)
+error_log = logging.getLogger("proxy.error")
+error_log.setLevel(logging.ERROR)
+error_log.addHandler(_error_handler)
+error_log.propagate = False
+
+def _content_to_str(content) -> str:
+    """Normalize OpenAI content: string or array of content parts → plain string."""
+    if isinstance(content, list):
+        return " ".join(
+            part.get("text", "") if isinstance(part, dict) else str(part)
+            for part in content
+        )
+    return content or ""
+
+
+def _last_user_msg(messages: list, max_len: int = 120) -> str:
+    for msg in reversed(messages):
+        if msg.get("role") == "user":
+            text = _content_to_str(msg.get("content")).replace("\n", " ").strip()
+            return text[:max_len] + ("…" if len(text) > max_len else "")
+    return ""
+
+async def require_api_key(request: Request, db: Session = Depends(get_db)):
     auth_header = request.headers.get("Authorization", "")
+    x_api_key = request.headers.get("x-api-key", "")
+    auth_token = request.headers.get("anthropic-auth-token", "")
     if auth_header.startswith("Bearer "):
-        api_key = auth_header.replace("Bearer ", "")
+        api_key = auth_header[7:]
     elif auth_header.startswith("sk-"):
         api_key = auth_header
+    elif x_api_key:
+        api_key = x_api_key
+    elif auth_token:
+        api_key = auth_token
     else:
-        return JSONResponse(status_code=401, content={"detail": "Invalid or missing API key"})
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+    db_key = crud.verify_api_key(db, api_key)
+    if not db_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    request.state.api_key_id = db_key.id
+    request.state.api_key_name = db_key.name
 
-    db = SessionLocal()
+app = FastAPI(title="Ollama Proxy", dependencies=[Depends(require_api_key)])
+
+@app.on_event("startup")
+def apply_env_settings():
+    """Write env-configured values into DB so they take effect until next restart."""
+    db = next(get_db())
     try:
-        db_key = crud.verify_api_key(db, api_key)
+        if url := os.getenv("OLLAMA_URL"):
-        if not db_key:
+            crud.set_setting(db, "ollama_url", url)
-            return JSONResponse(status_code=401, content={"detail": "Invalid API key"})
+        db.commit()
-        if not db_key.is_active:
-            return JSONResponse(status_code=403, content={"detail": "API key deactivated"})
-        request.state.user_id = db_key.user_id
     finally:
         db.close()
 
-    response = await call_next(request)
+@app.exception_handler(Exception)
-    return response
+async def unhandled_exception_handler(request: Request, exc: Exception):
+    error_log.error("Unhandled exception | %s %s | %s: %s",
+                    request.method, request.url.path, type(exc).__name__, exc, exc_info=exc)
+    return JSONResponse(status_code=500, content={"error": {"message": "Internal server error", "type": "server_error"}})
+
+def _backend_headers() -> dict:
+    key = os.getenv("BACKEND_API_KEY")
+    return {"Authorization": f"Bearer {key}"} if key else {}
+
+
+async def proxy_request(url: str, method: str = "GET", json_data: dict = None):
+    async with httpx.AsyncClient(timeout=300.0) as client:
+        response = await client.request(method=method, url=url, json=json_data, headers=_backend_headers())
+        return response
 
 @app.post("/api/generate")
 async def generate(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
     body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
     prompt_tokens = crud.count_tokens(body.get("prompt", ""))
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    response = await proxy_request(f"{OLLAMA_URL}/api/generate", method="POST", json_data=body, headers=dict(request.headers))
+    prompt_preview = (body.get("prompt", "").replace("\n", " ").strip())[:120]
-
+    usage_log.info('%s | /api/generate | %s | ~%d tokens | "%s"',
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, prompt_preview)
+    start = time.monotonic()
+    try:
+        response = await proxy_request(f"{ollama_url}/api/generate", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/generate | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/generate | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise
 
 @app.post("/api/chat")
 async def chat(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-
     body = await request.json()
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
+    messages = body.get("messages", [])
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)
 
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in body.get("messages", []))
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=body, headers=dict(request.headers))
+    usage_log.info('%s | /api/chat | %s | ~%d tokens | "%s"',
-
+                   request.state.api_key_name, body.get("model", "?"), prompt_tokens, _last_user_msg(messages))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    start = time.monotonic()
+    try:
+        response = await proxy_request(f"{ollama_url}/api/chat", method="POST", json_data=body)
+        resp_json = response.json()
+        usage_log.info('%s | /api/chat | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, body.get("model", "?"),
+                       resp_json.get("prompt_eval_count", 0), resp_json.get("eval_count", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /api/chat | %s | %s: %s",
+                        request.state.api_key_name, body.get("model", "?"), type(exc).__name__, exc, exc_info=exc)
+        raise
 
 @app.get("/api/tags")
-async def list_models(request: Request):
+async def list_models(db: Session = Depends(get_db)):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    response = await proxy_request(f"{ollama_url}/api/tags", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
+
+@app.get("/version")
+async def version():
+    return {"version": os.getenv("APP_VERSION", "dev")}
+
+@app.get("/api/ps")
+async def running_models(db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    response = await proxy_request(f"{ollama_url}/api/ps", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
 
 @app.get("/api/versions")
-async def versions(request: Request):
+async def versions(db: Session = Depends(get_db)):
-    response = await proxy_request(f"{OLLAMA_URL}/api/versions", method="GET", headers=dict(request.headers))
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    return JSONResponse(content=response.json(), status_code=response.status_code, headers=dict(response.headers))
+    response = await proxy_request(f"{ollama_url}/api/versions", method="GET")
+    return JSONResponse(content=response.json(), status_code=response.status_code)
+
+
+# --- Anthropic Messages API compatibility layer ---
+
+def _anthropic_content_to_str(content) -> str:
+    """Flatten Anthropic content (string or block array) to a plain string."""
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        for block in content:
+            if not isinstance(block, dict):
+                continue
+            if block.get("type") == "text":
+                parts.append(block.get("text", ""))
+            elif block.get("type") == "tool_result":
+                raw = block.get("content", "")
+                if isinstance(raw, list):
+                    raw = " ".join(r.get("text", "") for r in raw if isinstance(r, dict) and r.get("type") == "text")
+                parts.append(str(raw))
+        return " ".join(parts)
+    return str(content) if content else ""
+
+
+def _anthropic_messages_to_ollama(messages: list, system: str = None) -> list:
+    """Transform Anthropic messages array to Ollama /api/chat format."""
+    result = []
+    if system:
+        result.append({"role": "system", "content": system})
+    for msg in messages:
+        role = msg.get("role")
+        content = msg.get("content")
+        if role == "assistant" and isinstance(content, list):
+            text = " ".join(b.get("text", "") for b in content if isinstance(b, dict) and b.get("type") == "text")
+            tool_calls = [
+                {"function": {"name": b["name"], "arguments": b.get("input", {})}}
+                for b in content if isinstance(b, dict) and b.get("type") == "tool_use"
+            ]
+            entry = {"role": "assistant", "content": text}
+            if tool_calls:
+                entry["tool_calls"] = tool_calls
+            result.append(entry)
+        elif role == "user" and isinstance(content, list):
+            text_parts = []
+            for block in content:
+                if not isinstance(block, dict):
+                    continue
+                if block.get("type") == "tool_result":
+                    if text_parts:
+                        result.append({"role": "user", "content": " ".join(text_parts)})
+                        text_parts = []
+                    raw = block.get("content", "")
+                    if isinstance(raw, list):
+                        raw = " ".join(r.get("text", "") for r in raw if isinstance(r, dict) and r.get("type") == "text")
+                    result.append({"role": "tool", "content": str(raw)})
+                elif block.get("type") == "text":
+                    text_parts.append(block.get("text", ""))
+            if text_parts:
+                result.append({"role": "user", "content": " ".join(text_parts)})
+        else:
+            result.append({"role": role, "content": _anthropic_content_to_str(content)})
+    return result
+
+
+def _anthropic_tools_to_ollama(tools: list) -> list:
+    """Transform Anthropic tools to Ollama/OpenAI function format."""
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": t["name"],
+                "description": t.get("description", ""),
+                "parameters": t.get("input_schema", {}),
+            },
+        }
+        for t in tools
+    ]
+
+
+def _ollama_to_anthropic_response(ollama_resp: dict, model_name: str, msg_id: str) -> dict:
+    """Transform an Ollama /api/chat response to Anthropic Messages API format."""
+    msg = ollama_resp.get("message", {})
+    text = msg.get("content", "")
+    tool_calls = msg.get("tool_calls") or []
+
+    content_blocks = []
+    if text:
+        content_blocks.append({"type": "text", "text": text})
+
+    stop_reason = "end_turn"
+    for i, tc in enumerate(tool_calls):
+        stop_reason = "tool_use"
+        fn = tc.get("function", {})
+        args = fn.get("arguments", {})
+        if isinstance(args, str):
+            try:
+                args = json.loads(args)
+            except json.JSONDecodeError:
+                args = {}
+        content_blocks.append({
+            "type": "tool_use",
+            "id": f"toolu_{msg_id}_{i}",
+            "name": fn.get("name", ""),
+            "input": args,
+        })
+
+    return {
+        "id": f"msg_{msg_id}",
+        "type": "message",
+        "role": "assistant",
+        "content": content_blocks,
+        "model": model_name,
+        "stop_reason": stop_reason,
+        "stop_sequence": None,
+        "usage": {
+            "input_tokens": ollama_resp.get("prompt_eval_count", 0),
+            "output_tokens": ollama_resp.get("eval_count", 0),
+        },
+    }
+
+
+@app.post("/v1/messages")
+async def anthropic_messages(request: Request, db: Session = Depends(get_db)):
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
+    body = await request.json()
+
+    force_model = crud.get_setting(db, "force_model") or None
+    model_name = force_model or os.getenv("ANTHROPIC_DEFAULT_MODEL") or body.get("model")
+    if not model_name:
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
+
+    anthropic_msgs = body.get("messages", [])
+    system = body.get("system")
+
+    system_str = _anthropic_content_to_str(system) if system else ""
+    all_text = system_str + " ".join(_anthropic_content_to_str(m.get("content")) for m in anthropic_msgs)
+    prompt_tokens = crud.count_tokens(all_text)
+
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
+        raise HTTPException(status_code=429, detail="Quota exceeded")
+
+    ollama_messages = _anthropic_messages_to_ollama(anthropic_msgs, system=system_str)
+    ollama_body: dict = {"model": model_name, "messages": ollama_messages, "stream": body.get("stream", False)}
+    if tools := body.get("tools"):
+        ollama_body["tools"] = _anthropic_tools_to_ollama(tools)
+
+    msg_id = secrets.token_hex(12)
+    target = f"{ollama_url}/api/chat"
+
+    usage_log.info('%s | /v1/messages | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(ollama_messages))
+    start = time.monotonic()
+
+    if body.get("stream"):
+        # Backend wird immer non-streaming aufgerufen; der Dev-Proxy baut SSE selbst auf.
+        # Das ist nötig, weil vorgelagerte Proxys (z.B. Produktiv-Proxy) /api/chat
+        # nur non-streaming exponieren.
+        non_stream_body = {**ollama_body, "stream": False}
+
+        async def generate():
+            try:
+                response = await proxy_request(target, method="POST", json_data=non_stream_body)
+                ollama_resp = response.json()
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/messages | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+
+            msg = ollama_resp.get("message", {})
+            text = msg.get("content", "")
+            input_tokens = ollama_resp.get("prompt_eval_count", 0)
+            output_tokens = ollama_resp.get("eval_count", 0)
+
+            yield f"event: message_start\ndata: {json.dumps({'type': 'message_start', 'message': {'id': f'msg_{msg_id}', 'type': 'message', 'role': 'assistant', 'content': [], 'model': model_name, 'stop_reason': None, 'stop_sequence': None, 'usage': {'input_tokens': input_tokens, 'output_tokens': 0}}})}\n\n"
+            yield f"event: content_block_start\ndata: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+            yield f"event: ping\ndata: {json.dumps({'type': 'ping'})}\n\n"
+            if text:
+                yield f"event: content_block_delta\ndata: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'text_delta', 'text': text}})}\n\n"
+            yield f"event: content_block_stop\ndata: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+            yield f"event: message_delta\ndata: {json.dumps({'type': 'message_delta', 'delta': {'stop_reason': 'end_turn', 'stop_sequence': None}, 'usage': {'output_tokens': output_tokens}})}\n\n"
+            yield f"event: message_stop\ndata: {json.dumps({'type': 'message_stop'})}\n\n"
+            usage_log.info('%s | /v1/messages | %s | actual ↑%d ↓%d tokens | %.1fs',
+                           request.state.api_key_name, model_name,
+                           input_tokens, output_tokens,
+                           time.monotonic() - start)
+
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    try:
+        response = await proxy_request(target, method="POST", json_data=ollama_body)
+        result = _ollama_to_anthropic_response(response.json(), model_name, msg_id)
+        usage_log.info('%s | /v1/messages | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, model_name,
+                       result["usage"]["input_tokens"], result["usage"]["output_tokens"],
+                       time.monotonic() - start)
+        return JSONResponse(content=result, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/messages | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise
 
 @app.get("/v1/models")
-async def list_openai_models(request: Request):
+async def list_openai_models(db: Session = Depends(get_db)):
-    response = await proxy_request(f"{OLLAMA_URL}/api/tags", method="GET", headers=dict(request.headers))
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
-    ollama_models = response.json()
+    response = await proxy_request(f"{ollama_url}/v1/models", method="GET")
-    openai_models = {
+    return JSONResponse(content=response.json(), status_code=response.status_code)
-        "object": "list",
-        "data": [
-            {
-                "id": model["name"],
-                "object": "model",
-                "created": int(model["modified_at"][:10].replace("-", "")) * 1000 if "modified_at" in model else 0,
-                "owned_by": "ollama"
-            }
-            for model in ollama_models.get("models", [])
-        ]
-    }
-    return JSONResponse(content=openai_models, status_code=200, headers=dict(response.headers))
 
 @app.post("/v1/chat/completions")
 async def openai_chat_completions(request: Request, db: Session = Depends(get_db)):
-    user_id = request.state.user_id
+    ollama_url = crud.get_setting(db, "ollama_url", os.getenv("OLLAMA_URL", "http://localhost:11434"))
 
     body = await request.json()
-
+    force_model = crud.get_setting(db, "force_model") or None
+    if force_model:
+        body = {**body, "model": force_model}
+    if not body.get("model"):
+        raise HTTPException(status_code=422, detail="Field 'model' is required")
     messages = body.get("messages", [])
-    prompt_tokens = sum(crud.count_tokens(msg.get("content", "")) for msg in messages)
+    prompt_tokens = sum(crud.count_tokens(_content_to_str(msg.get("content"))) for msg in messages)
 
-    if not crud.check_and_increment_quota(db, user_id, tokens=prompt_tokens, requests=1):
+    if not crud.check_and_increment_quota(db, request.state.api_key_id, tokens=prompt_tokens, requests=1):
         raise HTTPException(status_code=429, detail="Quota exceeded")
 
-    ollama_body = {
+    model_name = body["model"]
-        "model": body.get("model", "llama3"),
-        "messages": messages,
-        "stream": body.get("stream", False)
-    }
 
-    response = await proxy_request(f"{OLLAMA_URL}/api/chat", method="POST", json_data=ollama_body, headers=dict(request.headers))
+    usage_log.info('%s | /v1/chat/completions | %s | ~%d tokens | "%s"',
+                   request.state.api_key_name, model_name, prompt_tokens, _last_user_msg(messages))
 
-    response_content = response.json().get("message", {}).get("content", "")
+    target = f"{ollama_url}/v1/chat/completions"
-    completion_tokens = crud.count_tokens(response_content)
 
-    openai_response = {
+    if body.get("stream"):
-        "id": f"chatcmpl-{uuid.uuid4().hex}",
+        existing_opts = body.get("stream_options") or {}
-        "object": "chat.completion",
+        stream_body = {**body, "stream_options": {**existing_opts, "include_usage": True}}
-        "created": int(time.time()),
+        start = time.monotonic()
-        "model": body.get("model", "llama3"),
+        usage_tokens = {"prompt": 0, "completion": 0}
-        "choices": [
-            {
-                "index": 0,
-                "message": {
-                    "role": "assistant",
-                    "content": response_content
-                },
-                "finish_reason": "stop"
-            }
-        ],
-        "usage": {
-            "prompt_tokens": prompt_tokens,
-            "completion_tokens": completion_tokens,
-            "total_tokens": prompt_tokens + completion_tokens
-        }
-    }
 
-    return JSONResponse(content=openai_response, status_code=200, headers={"Content-Type": "application/json"})
+        async def generate():
+            try:
+                async with httpx.AsyncClient(timeout=300.0) as client:
+                    async with client.stream("POST", target, json=stream_body, headers=_backend_headers()) as resp:
+                        async for chunk in resp.aiter_bytes():
+                            try:
+                                for line in chunk.decode("utf-8", errors="ignore").splitlines():
+                                    if line.startswith("data: ") and "[DONE]" not in line:
+                                        data = json.loads(line[6:])
+                                        if u := data.get("usage"):
+                                            usage_tokens["prompt"] = u.get("prompt_tokens", 0)
+                                            usage_tokens["completion"] = u.get("completion_tokens", 0)
+                            except Exception:
+                                pass
+                            yield chunk
+            except Exception as exc:
+                error_log.error("Stream error | %s | /v1/chat/completions | %s | %s: %s",
+                                request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+                raise
+            finally:
+                usage_log.info('%s | /v1/chat/completions | %s | actual ↑%d ↓%d tokens | %.1fs',
+                               request.state.api_key_name, model_name,
+                               usage_tokens["prompt"], usage_tokens["completion"],
+                               time.monotonic() - start)
+
+        return StreamingResponse(
+            generate(),
+            media_type="text/event-stream",
+            headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+        )
+
+    start = time.monotonic()
+    try:
+        response = await proxy_request(target, method="POST", json_data=body)
+        resp_json = response.json()
+        usage = resp_json.get("usage", {})
+        usage_log.info('%s | /v1/chat/completions | %s | actual ↑%d ↓%d tokens | %.1fs',
+                       request.state.api_key_name, model_name,
+                       usage.get("prompt_tokens", 0), usage.get("completion_tokens", 0),
+                       time.monotonic() - start)
+        return JSONResponse(content=resp_json, status_code=response.status_code)
+    except Exception as exc:
+        error_log.error("Proxy error | %s | /v1/chat/completions | %s | %s: %s",
+                        request.state.api_key_name, model_name, type(exc).__name__, exc, exc_info=exc)
+        raise

backend/models.py

@@ -4,46 +4,35 @@ from database import Base
 
 _now = lambda: datetime.now(timezone.utc)
 
-class User(Base):
-    __tablename__ = "users"
-
-    id = Column(Integer, primary_key=True, index=True)
-    username = Column(String, unique=True, index=True)
-    email = Column(String, unique=True, index=True)
-    hashed_password = Column(String)
-    is_active = Column(Boolean, default=True)
-    is_admin = Column(Boolean, default=False)
-    created_at = Column(DateTime(timezone=True), default=_now)
-
 class APIKey(Base):
     __tablename__ = "api_keys"
 
     id = Column(Integer, primary_key=True, index=True)
     name = Column(String)
     key = Column(String, unique=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
+    key_prefix = Column(String)
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime(timezone=True), default=_now)
-
+    expires_at = Column(DateTime(timezone=True), nullable=True)
-class Quota(Base):
-    __tablename__ = "quotas"
-
-    id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"))
     daily_tokens = Column(BigInteger, nullable=True)
     monthly_tokens = Column(BigInteger, nullable=True)
     daily_requests = Column(Integer, nullable=True)
     monthly_requests = Column(Integer, nullable=True)
-    reset_at = Column(DateTime(timezone=True), default=_now)
+
+class Setting(Base):
+    __tablename__ = "settings"
+
+    key = Column(String, primary_key=True)
+    value = Column(String, nullable=False)
 
 class Usage(Base):
     __tablename__ = "usage"
 
     id = Column(Integer, primary_key=True, index=True)
-    user_id = Column(Integer, ForeignKey("users.id"), unique=True)
+    api_key_id = Column(Integer, ForeignKey("api_keys.id"), unique=True)
     tokens_used_today = Column(BigInteger, default=0)
     tokens_used_month = Column(BigInteger, default=0)
     requests_today = Column(Integer, default=0)
     requests_month = Column(Integer, default=0)
     daily_reset_at = Column(DateTime(timezone=True), default=_now)
-    monthly_reset_at = Column(DateTime(timezone=True), default=_now)
+    monthly_reset_at = Column(DateTime(timezone=True), default=_now)

backend/requirements-dev.txt

@@ -0,0 +1,4 @@
+-r requirements.txt
+pytest==8.3.4
+pytest-asyncio==0.25.1
+pytest-cov==6.0.0

backend/requirements.txt

@@ -1,5 +1,6 @@
 fastapi==0.115.6
 uvicorn[standard]==0.34.0
+aiofiles==24.1.0
 httpx==0.28.1
 sqlalchemy==2.0.36
 alembic==1.14.0
@@ -9,6 +10,3 @@ python-jose[cryptography]==3.3.0
 bcrypt==5.0.0
 tiktoken==0.9.0
 python-dotenv==1.0.1
-pytest==8.3.4
-pytest-asyncio==0.25.1
-pytest-cov==6.0.0

backend/schemas.py

@@ -2,61 +2,46 @@ from pydantic import BaseModel
 from datetime import datetime
 from typing import Optional
 
-class UserBase(BaseModel):
+class APIKeyCreate(BaseModel):
-    username: str
-    email: str
-    is_admin: bool = False
-
-class UserCreate(UserBase):
-    password: str
-
-class User(UserBase):
-    id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyBase(BaseModel):
     name: str
-
+    expires_at: Optional[datetime] = None
-class APIKeyCreate(APIKeyBase):
-    user_id: int
-
-class APIKey(APIKeyBase):
-    id: int
-    key: str
-    user_id: int
-    is_active: bool
-    created_at: datetime
-
-    class Config:
-        from_attributes = True
-
-class APIKeyCreated(APIKey):
-    plaintext_key: str
-
-    class Config:
-        from_attributes = True
-
-class QuotaBase(BaseModel):
     daily_tokens: Optional[int] = None
     monthly_tokens: Optional[int] = None
     daily_requests: Optional[int] = None
     monthly_requests: Optional[int] = None
 
-class QuotaCreate(QuotaBase):
+class APIKey(BaseModel):
-    user_id: int
-
-class Quota(QuotaBase):
     id: int
-    user_id: int
+    name: str
-    reset_at: Optional[datetime] = None
+    key: str
+    key_prefix: Optional[str] = None
+    is_active: bool
+    created_at: datetime
+    expires_at: Optional[datetime] = None
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None
 
     class Config:
         from_attributes = True
 
+class APIKeyCreated(APIKey):
+    plaintext_key: Optional[str] = None
+
+    class Config:
+        from_attributes = True
+
+class QuotaUpdate(BaseModel):
+    daily_tokens: Optional[int] = None
+    monthly_tokens: Optional[int] = None
+    daily_requests: Optional[int] = None
+    monthly_requests: Optional[int] = None
+
+class Settings(BaseModel):
+    ollama_url: str
+    force_model: Optional[str] = None
+
 class UsageStats(BaseModel):
     tokens_used_today: int = 0
     tokens_used_month: int = 0
@@ -67,3 +52,14 @@ class UsageStats(BaseModel):
 
     class Config:
         from_attributes = True
+
+class APIKeyWithUsage(APIKey):
+    tokens_used_today: int = 0
+    tokens_used_month: int = 0
+    requests_today: int = 0
+    requests_month: int = 0
+    daily_reset_at: Optional[datetime] = None
+    monthly_reset_at: Optional[datetime] = None
+
+    class Config:
+        from_attributes = True

backend/setup_admin.py

@@ -1,42 +1,25 @@
 #!/usr/bin/env python3
 from database import Base, engine, SessionLocal
-from models import User, APIKey, Quota, Usage
+from models import APIKey
-from crud import create_user, create_api_key, hash_password
+from crud import create_api_key
 
 def setup_admin():
     Base.metadata.create_all(bind=engine)
     db = SessionLocal()
-    
+    existing = db.query(APIKey).filter(APIKey.name == "default").first()
-    admin_user = db.query(User).filter(User.username == "admin").first()
+    if not existing:
-    if not admin_user:
+        _, raw_key = create_api_key(
-        admin_user = User(
+            db,
-            username="admin",
+            name="default",
-            email="admin@ollama.local",
+            daily_tokens=1_000_000,
-            hashed_password=hash_password("admin123"),
+            monthly_tokens=10_000_000,
-            is_active=True,
+            daily_requests=1000,
-            is_admin=True,
+            monthly_requests=10000,
         )
-        db.add(admin_user)
+        print(f"API Key created: {raw_key}")
-        db.commit()
-        db.refresh(admin_user)
-        print("✓ Admin user created")
-        
-        default_quota = Quota(
-            user_id=admin_user.id,
-            daily_tokens=10000000,
-            monthly_tokens=100000000,
-            daily_requests=10000,
-            monthly_requests=100000
-        )
-        db.add(default_quota)
-        db.commit()
-        print("✓ Admin quota created")
-        
-        _, raw_key = create_api_key(db, admin_user.id, "admin-api-key")
-        print(f"✓ Admin API Key: {raw_key}")
     else:
-        print("✗ Admin user already exists")
+        print("Default API key already exists")
     db.close()
 
 if __name__ == "__main__":
-    setup_admin()
+    setup_admin()

backend/tests/conftest.py

@@ -6,68 +6,23 @@ os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")
 
 def _setup_db():
     from database import Base, engine, SessionLocal
-    from models import User, Quota
+    from crud import create_api_key
-    from crud import create_api_key, hash_password
 
     Base.metadata.drop_all(bind=engine)
     Base.metadata.create_all(bind=engine)
 
     db = SessionLocal()
-
+    _, raw_key = create_api_key(db, name="test-key", daily_tokens=1_000_000,
-    test_user = User(
+                                monthly_tokens=10_000_000, daily_requests=1000,
-        username="testuser",
+                                monthly_requests=10000)
-        email="test@example.com",
-        hashed_password=hash_password("test123"),
-        is_active=True,
-    )
-    db.add(test_user)
-    db.commit()
-    db.refresh(test_user)
-
-    db.add(Quota(
-        user_id=test_user.id,
-        daily_tokens=1_000_000,
-        monthly_tokens=10_000_000,
-        daily_requests=1000,
-        monthly_requests=10000,
-    ))
-    db.commit()
-
-    _, raw_key = create_api_key(db, test_user.id, "test-key")
     os.environ["TEST_API_KEY"] = raw_key
-
-    admin_user = User(
-        username="admin",
-        email="admin@example.com",
-        hashed_password=hash_password("admin123"),
-        is_active=True,
-        is_admin=True,
-    )
-    db.add(admin_user)
-    db.commit()
-    db.refresh(admin_user)
-
-    db.add(Quota(
-        user_id=admin_user.id,
-        daily_tokens=10_000_000,
-        monthly_tokens=100_000_000,
-        daily_requests=10000,
-        monthly_requests=100000,
-    ))
-    db.commit()
-
-    _, admin_raw_key = create_api_key(db, admin_user.id, "admin-key")
-    os.environ["ADMIN_API_KEY"] = admin_raw_key
-
     db.close()
 
 
 def _teardown_db():
-    from database import engine
+    from database import engine, Base
-    from models import Base
     Base.metadata.drop_all(bind=engine)
     os.environ.pop("TEST_API_KEY", None)
-    os.environ.pop("ADMIN_API_KEY", None)
 
 
 @pytest.fixture(scope="function")

backend/tests/test_admin_logs.py

@@ -0,0 +1,59 @@
+import os
+import pytest
+from fastapi.testclient import TestClient
+
+os.environ.setdefault("ADMIN_PASSWORD", "test-admin-pw")
+os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")
+
+
+@pytest.fixture
+def client(tmp_path):
+    log_file = tmp_path / "usage.log"
+    log_file.write_text("\n".join(f"Zeile {i}" for i in range(1, 16)) + "\n")
+    (tmp_path / "error.log").write_text("Fehler A\nFehler B\n")
+    os.environ["LOG_FILE"] = str(log_file)
+
+    from database import Base, engine
+    Base.metadata.drop_all(bind=engine)
+    Base.metadata.create_all(bind=engine)
+
+    from admin import app
+    yield TestClient(app, raise_server_exceptions=False)
+
+    Base.metadata.drop_all(bind=engine)
+    os.environ.pop("LOG_FILE", None)
+
+
+AUTH = {"Authorization": "Bearer test-admin-pw"}
+
+
+def test_logs_usage_returns_last_10_lines(client):
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    lines = resp.json()["lines"]
+    assert len(lines) == 10
+    assert lines[-1] == "Zeile 15"
+    assert lines[0] == "Zeile 6"
+
+
+def test_logs_error_returns_content(client):
+    resp = client.get("/api/logs/error", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == ["Fehler A", "Fehler B"]
+
+
+def test_logs_missing_file_returns_empty(client, tmp_path):
+    os.environ["LOG_FILE"] = str(tmp_path / "nonexistent.log")
+    resp = client.get("/api/logs/usage", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["lines"] == []
+
+
+def test_logs_invalid_name_returns_400(client):
+    resp = client.get("/api/logs/secret", headers=AUTH)
+    assert resp.status_code == 400
+
+
+def test_logs_requires_auth(client):
+    resp = client.get("/api/logs/usage")
+    assert resp.status_code == 401

backend/tests/test_anthropic_messages.py

@@ -0,0 +1,272 @@
+import json
+import os
+from unittest.mock import AsyncMock, MagicMock, patch, call
+
+
+def _make_body(model="llama3", messages=None, stream=False, **kwargs):
+    body = {
+        "model": model,
+        "messages": messages or [{"role": "user", "content": "Hello"}],
+        "max_tokens": 100,
+    }
+    if stream:
+        body["stream"] = True
+    body.update(kwargs)
+    return body
+
+
+def _ollama_chat_response(content="Hi!", input_tokens=5, output_tokens=3):
+    return {
+        "model": "llama3",
+        "message": {"role": "assistant", "content": content},
+        "prompt_eval_count": input_tokens,
+        "eval_count": output_tokens,
+        "done": True,
+    }
+
+
+# --- Auth ---
+
+def test_messages_missing_auth_returns_401(test_client):
+    response = test_client.post("/v1/messages", json=_make_body())
+    assert response.status_code == 401
+
+
+def test_messages_invalid_key_returns_401(test_client):
+    response = test_client.post(
+        "/v1/messages",
+        headers={"x-api-key": "sk-invalid"},
+        json=_make_body(),
+    )
+    assert response.status_code == 401
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_accepts_anthropic_auth_token_header(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    response = test_client.post(
+        "/v1/messages",
+        headers={"anthropic-auth-token": os.environ.get("TEST_API_KEY", "")},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_accepts_x_api_key_header(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    response = test_client.post(
+        "/v1/messages",
+        headers={"x-api-key": os.environ.get("TEST_API_KEY", "")},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+
+
+# --- Validation ---
+
+def test_messages_missing_model_returns_422(test_client):
+    env = {k: v for k, v in os.environ.items() if k != "ANTHROPIC_DEFAULT_MODEL"}
+    with patch.dict(os.environ, env, clear=True):
+        response = test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json={"messages": [{"role": "user", "content": "Hi"}], "max_tokens": 100},
+        )
+    assert response.status_code == 422
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_anthropic_default_model_used_when_no_model_in_request(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    with patch.dict(os.environ, {"ANTHROPIC_DEFAULT_MODEL": "qwen3-coder:q8_0"}):
+        test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json={"messages": [{"role": "user", "content": "Hi"}], "max_tokens": 100},
+        )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["model"] == "qwen3-coder:q8_0"
+
+
+# --- Quota ---
+
+def test_messages_quota_exceeded_returns_429(test_client):
+    with patch("main.crud.check_and_increment_quota", return_value=False):
+        response = test_client.post(
+            "/v1/messages",
+            headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+            json=_make_body(),
+        )
+        assert response.status_code == 429
+
+
+# --- Response format ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_returns_anthropic_format(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response("Hello!")
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(),
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["type"] == "message"
+    assert data["role"] == "assistant"
+    assert isinstance(data["content"], list)
+    assert data["content"][0]["type"] == "text"
+    assert data["content"][0]["text"] == "Hello!"
+    assert data["usage"]["input_tokens"] == 5
+    assert data["usage"]["output_tokens"] == 3
+
+
+# --- Request transformation ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_system_prompt_becomes_first_system_message(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(system="You are helpful"),
+    )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["messages"][0]["role"] == "system"
+    assert sent_body["messages"][0]["content"] == "You are helpful"
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_tools_transformed_to_ollama_function_format(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: _ollama_chat_response()
+    test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(tools=[{
+            "name": "bash",
+            "description": "Run bash",
+            "input_schema": {"type": "object", "properties": {"command": {"type": "string"}}},
+        }]),
+    )
+    sent_body = mock_proxy.call_args[1]["json_data"]
+    assert sent_body["tools"][0]["type"] == "function"
+    assert sent_body["tools"][0]["function"]["name"] == "bash"
+    assert "parameters" in sent_body["tools"][0]["function"]
+
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_tool_call_response_transformed_to_anthropic(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: {
+        "model": "llama3",
+        "message": {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [{"function": {"name": "bash", "arguments": {"command": "ls"}}}],
+        },
+        "prompt_eval_count": 10,
+        "eval_count": 5,
+        "done": True,
+    }
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(),
+    )
+    data = response.json()
+    assert data["stop_reason"] == "tool_use"
+    tool_block = next(b for b in data["content"] if b["type"] == "tool_use")
+    assert tool_block["name"] == "bash"
+    assert tool_block["input"] == {"command": "ls"}
+
+
+# --- Streaming ---
+
+@patch("main.proxy_request", new_callable=AsyncMock)
+def test_messages_streaming_returns_anthropic_sse_events(mock_proxy, test_client):
+    mock_proxy.return_value.status_code = 200
+    mock_proxy.return_value.json = lambda: {
+        "model": "llama3",
+        "message": {"role": "assistant", "content": "Hi!"},
+        "prompt_eval_count": 5,
+        "eval_count": 3,
+        "done": True,
+    }
+
+    response = test_client.post(
+        "/v1/messages",
+        headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+        json=_make_body(stream=True),
+    )
+
+    assert response.status_code == 200
+    events = [
+        json.loads(line[6:])
+        for line in response.text.splitlines()
+        if line.startswith("data: ")
+    ]
+    event_types = [e["type"] for e in events]
+    assert "message_start" in event_types
+    assert "content_block_start" in event_types
+    assert "content_block_delta" in event_types
+    assert "message_stop" in event_types
+
+    deltas = [e for e in events if e["type"] == "content_block_delta"]
+    text = "".join(d["delta"]["text"] for d in deltas)
+    assert text == "Hi!"
+
+
+# --- Backend-Auth (BACKEND_API_KEY) ---
+
+def test_proxy_request_forwards_backend_api_key(test_client):
+    with patch("main.httpx.AsyncClient") as mock_cls:
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"result": "ok"}
+
+        mock_instance = AsyncMock()
+        mock_instance.__aenter__ = AsyncMock(return_value=mock_instance)
+        mock_instance.__aexit__ = AsyncMock(return_value=False)
+        mock_instance.request = AsyncMock(return_value=mock_response)
+        mock_cls.return_value = mock_instance
+
+        with patch.dict(os.environ, {"BACKEND_API_KEY": "sk-backend-secret"}):
+            test_client.post(
+                "/api/generate",
+                headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+                json={"model": "llama3", "prompt": "hi"},
+            )
+
+        _, kwargs = mock_instance.request.call_args
+        assert kwargs.get("headers", {}).get("Authorization") == "Bearer sk-backend-secret"
+
+
+def test_proxy_request_omits_auth_header_when_no_backend_key(test_client):
+    with patch("main.httpx.AsyncClient") as mock_cls:
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"result": "ok"}
+
+        mock_instance = AsyncMock()
+        mock_instance.__aenter__ = AsyncMock(return_value=mock_instance)
+        mock_instance.__aexit__ = AsyncMock(return_value=False)
+        mock_instance.request = AsyncMock(return_value=mock_response)
+        mock_cls.return_value = mock_instance
+
+        env_without_key = {k: v for k, v in os.environ.items() if k != "BACKEND_API_KEY"}
+        with patch.dict(os.environ, env_without_key, clear=True):
+            test_client.post(
+                "/api/generate",
+                headers={"Authorization": f"Bearer {os.environ.get('TEST_API_KEY', '')}"},
+                json={"model": "llama3", "prompt": "hi"},
+            )
+
+        _, kwargs = mock_instance.request.call_args
+        assert "Authorization" not in kwargs.get("headers", {})

backend/tests/test_quota.py

@@ -5,33 +5,21 @@ from datetime import datetime, timedelta, timezone
 os.environ.setdefault("OLLAMA_URL", "http://127.0.0.1:9999")
 
 from database import Base, engine, SessionLocal
-from models import User, Quota, Usage
+from models import APIKey, Usage
-from crud import check_and_increment_quota, count_tokens, hash_password
+from crud import check_and_increment_quota, count_tokens, create_api_key, verify_api_key
 
 
-def make_user_and_quota(db, daily_tokens=None, monthly_tokens=None,
+def make_api_key(db, daily_tokens=None, monthly_tokens=None,
-                        daily_requests=None, monthly_requests=None):
+                 daily_requests=None, monthly_requests=None):
-    user = User(
+    db_key, _ = create_api_key(
-        username="quotauser",
+        db,
-        email="quota@example.com",
+        name="test-key",
-        hashed_password=hash_password("pass"),
-        is_active=True,
-    )
-    db.add(user)
-    db.commit()
-    db.refresh(user)
-
-    quota = Quota(
-        user_id=user.id,
         daily_tokens=daily_tokens,
         monthly_tokens=monthly_tokens,
         daily_requests=daily_requests,
         monthly_requests=monthly_requests,
     )
-    db.add(quota)
+    return db_key.id
-    db.commit()
-
-    return user.id
 
 
 @pytest.fixture
@@ -64,119 +52,133 @@ def test_count_tokens_more_accurate_than_split():
 # --- check_and_increment_quota ---
 
 def test_allowed_within_daily_token_limit(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
+    api_key_id = make_api_key(db, daily_tokens=1000)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is True
 
 def test_denied_when_daily_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, daily_tokens=50)
+    api_key_id = make_api_key(db, daily_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False
 
 def test_denied_when_monthly_tokens_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_tokens=50)
+    api_key_id = make_api_key(db, monthly_tokens=50)
-    assert check_and_increment_quota(db, user_id, tokens=100, requests=1) is False
+    assert check_and_increment_quota(db, api_key_id, tokens=100, requests=1) is False
 
 def test_denied_when_daily_requests_exceeded(db):
-    user_id = make_user_and_quota(db, daily_requests=1)
+    api_key_id = make_api_key(db, daily_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False
 
 def test_denied_when_monthly_requests_exceeded(db):
-    user_id = make_user_and_quota(db, monthly_requests=1)
+    api_key_id = make_api_key(db, monthly_requests=1)
-    check_and_increment_quota(db, user_id, tokens=0, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=0, requests=1)
-    assert check_and_increment_quota(db, user_id, tokens=0, requests=1) is False
+    assert check_and_increment_quota(db, api_key_id, tokens=0, requests=1) is False
 
 def test_increments_both_daily_and_monthly_counters(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000,
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000,
-                                  daily_requests=100, monthly_requests=1000)
+                              daily_requests=100, monthly_requests=1000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     assert usage.tokens_used_today == 50
     assert usage.tokens_used_month == 50
     assert usage.requests_today == 1
     assert usage.requests_month == 1
 
 def test_creates_usage_record_on_first_call(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000)
+    api_key_id = make_api_key(db, daily_tokens=1000)
-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is None
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is None
 
-    check_and_increment_quota(db, user_id, tokens=10, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=10, requests=1)
 
-    assert db.query(Usage).filter(Usage.user_id == user_id).first() is not None
+    assert db.query(Usage).filter(Usage.api_key_id == api_key_id).first() is not None
 
 def test_no_quota_allows_any_request(db):
-    user_id = make_user_and_quota(db)  # all limits None
+    api_key_id = make_api_key(db)  # all limits None
-    assert check_and_increment_quota(db, user_id, tokens=999999, requests=9999) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=999999, requests=9999) is True
 
 def test_cumulative_usage_across_calls(db):
-    user_id = make_user_and_quota(db, daily_tokens=200)
+    api_key_id = make_api_key(db, daily_tokens=200)
-    check_and_increment_quota(db, user_id, tokens=100, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=100, requests=1)
-    check_and_increment_quota(db, user_id, tokens=99, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=99, requests=1)
-    # 199 used, 1 remaining – exactly 1 more token should pass
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is True
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=1, requests=1) is False
-    # Now 200 used – next request must fail
-    assert check_and_increment_quota(db, user_id, tokens=1, requests=1) is False
 
 
 # --- Reset logic ---
 
 def test_daily_reset_restores_access(db):
-    user_id = make_user_and_quota(db, daily_tokens=100)
+    api_key_id = make_api_key(db, daily_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)
 
-    # Backdate daily_reset_at to yesterday
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
     usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
     db.commit()
 
-    # Should pass again after reset
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True
-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     assert usage.tokens_used_today == 90
 
 def test_daily_reset_does_not_affect_monthly_counter(db):
-    user_id = make_user_and_quota(db, daily_tokens=1000, monthly_tokens=10000)
+    api_key_id = make_api_key(db, daily_tokens=1000, monthly_tokens=10000)
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
     db.commit()
 
-    check_and_increment_quota(db, user_id, tokens=50, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=50, requests=1)
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     assert usage.tokens_used_today == 50
-    assert usage.tokens_used_month == 100  # cumulative across days
+    assert usage.tokens_used_month == 100
 
 def test_monthly_reset_restores_access(db):
-    user_id = make_user_and_quota(db, monthly_tokens=100)
+    api_key_id = make_api_key(db, monthly_tokens=100)
-    check_and_increment_quota(db, user_id, tokens=90, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=90, requests=1)
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     usage.monthly_reset_at = datetime.now(timezone.utc) - timedelta(days=32)
     db.commit()
 
-    assert check_and_increment_quota(db, user_id, tokens=90, requests=1) is True
+    assert check_and_increment_quota(db, api_key_id, tokens=90, requests=1) is True
 
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     assert usage.tokens_used_month == 90
 
 def test_failed_quota_check_still_commits_reset(db):
-    user_id = make_user_and_quota(db, daily_tokens=100, daily_requests=5)
+    api_key_id = make_api_key(db, daily_tokens=100, daily_requests=5)
-    check_and_increment_quota(db, user_id, tokens=80, requests=1)
+    check_and_increment_quota(db, api_key_id, tokens=80, requests=1)
 
-    # Backdate so a reset fires, but the new request still exceeds the limit
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
     usage.daily_reset_at = datetime.now(timezone.utc) - timedelta(days=1)
     usage.tokens_used_today = 80
     db.commit()
 
-    # After reset tokens_used_today = 0; 200 tokens exceeds 100 limit
+    result = check_and_increment_quota(db, api_key_id, tokens=200, requests=1)
-    result = check_and_increment_quota(db, user_id, tokens=200, requests=1)
     assert result is False
 
-    # Reset must still be persisted so the next request sees fresh counters
     db.expire_all()
-    usage = db.query(Usage).filter(Usage.user_id == user_id).first()
+    usage = db.query(Usage).filter(Usage.api_key_id == api_key_id).first()
     assert usage.tokens_used_today == 0
+
+
+# --- verify_api_key expiry ---
+
+def _create_raw_key(db, expires_at=None):
+    _, raw_key = create_api_key(db, name="expiry-test", expires_at=expires_at)
+    return raw_key
+
+def test_key_without_expiry_is_valid(db):
+    raw_key = _create_raw_key(db)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_future_expiry_is_valid(db):
+    future = datetime.now(timezone.utc) + timedelta(days=30)
+    raw_key = _create_raw_key(db, expires_at=future)
+    assert verify_api_key(db, raw_key) is not None
+
+def test_key_with_past_expiry_is_rejected(db):
+    past = datetime.now(timezone.utc) - timedelta(seconds=1)
+    raw_key = _create_raw_key(db, expires_at=past)
+    assert verify_api_key(db, raw_key) is None

build_push.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+IMAGE=mediaeng/llmproxy
+PLATFORM=linux/arm64
+
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+HEAD_TAG=$(git tag --points-at HEAD | head -1)
+
+if [ -n "$HEAD_TAG" ]; then
+    echo "HEAD bereits getaggt: $HEAD_TAG"
+    read -rp "Neuer Tag [${HEAD_TAG}]: " INPUT
+    VERSION="${INPUT:-$HEAD_TAG}"
+else
+    echo "Letzter Tag: ${LAST_TAG:-kein Tag}"
+    read -rp "Neuer Tag: " INPUT
+    if [ -z "$INPUT" ]; then
+        echo "Kein Tag angegeben, breche ab."
+        exit 1
+    fi
+    VERSION="$INPUT"
+fi
+
+if [ "$VERSION" != "$HEAD_TAG" ]; then
+    git tag "$VERSION"
+    git push origin "$VERSION"
+    echo "Tag '$VERSION' gesetzt und gepusht."
+fi
+
+echo ""
+echo "Image   : $IMAGE"
+echo "Platform: $PLATFORM"
+echo "Tags    : $IMAGE:$VERSION  $IMAGE:latest"
+echo ""
+
+docker buildx build \
+    --platform "$PLATFORM" \
+    --push \
+    --build-arg APP_VERSION="$VERSION" \
+    -t "$IMAGE:$VERSION" \
+    -t "$IMAGE:latest" \
+    .
+
+echo ""
+echo "Fertig. Gepusht:"
+echo "  docker pull $IMAGE:$VERSION"
+echo "  docker pull $IMAGE:latest"

docker-compose.yml

@@ -1,24 +1,11 @@
-backend:
+services:
-  build:
+  llmproxy:
-    context: ./backend
+    image: mediaeng/llmproxy:latest
-    dockerfile: Dockerfile
+    container_name: llmproxy
-  ports:
+    restart: unless-stopped
-    - "8000:8000"
+    network_mode: host
-  environment:
+    env_file: .env
-    - DATABASE_URL=postgresql://ollama:password@db:5432/ollama_proxy
+    volumes:
-    - OLLAMA_URL=http://ollama:11434
+      - ./backend/test.db:/app/backend/test.db
-    - SECRET_KEY=your-secret-key-change-me
+      - ./backend/logs:/app/backend/logs
-  depends_on:
-    - db
 
-db:
-  image: postgres:16
-  environment:
-    - POSTGRES_USER=ollama
-    - POSTGRES_PASSWORD=password
-    - POSTGRES_DB=ollama_proxy
-  volumes:
-    - postgres_data:/var/lib/postgresql/data
-
-volumes:
-  postgres_data:

docker-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+cd /app/backend
+python3 init_db.py
+
+uvicorn main:app \
+    --host "${PROXY_HOST:-0.0.0.0}" \
+    --port "${PROXY_PORT:-8000}" &
+PROXY_PID=$!
+
+uvicorn admin:app \
+    --host "${ADMIN_HOST:-0.0.0.0}" \
+    --port "${ADMIN_PORT:-8001}" &
+ADMIN_PID=$!
+
+# Beendet den Container wenn einer der Prozesse stirbt
+wait -n
+kill "$PROXY_PID" "$ADMIN_PID" 2>/dev/null

frontend/src/main.jsx

@@ -1,66 +1,441 @@
 import React, { useState, useEffect } from 'react';
+import ReactDOM from 'react-dom/client';
 import axios from 'axios';
 import './styles.css';
 
-const maskKey = (key) => `••••••••${key.slice(-4)}`;
+const displayKey = (prefix) => prefix ? `${prefix}••••••••` : '••••••••••••';
 
-function App() {
+function authHeaders(token) {
-  const [users, setUsers] = useState([]);
+  return { Authorization: `Bearer ${token}` };
-  const [apiKeys, setApiKeys] = useState([]);
+}
-  const [loading, setLoading] = useState(true);
+
+const fmtK = (n) => { const k = n / 1000; return k % 1 === 0 ? `${k}k` : `${k.toFixed(1)}k`; };
+
+function QuotaBar({ used, limit, isToken = false, since = null }) {
+  const fmt = isToken ? fmtK : (n) => n.toLocaleString('de-DE');
+  const sinceLabel = since
+    ? new Date(since).toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit' })
+    : null;
+
+  if (limit == null) return (
+    <div className="quota-cell">
+      <span className="quota-unlimited">∞</span>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+
+  const pct = Math.min(100, (used / limit) * 100);
+  const color = pct >= 90 ? '#e74c3c' : pct >= 70 ? '#e67e22' : '#27ae60';
+  return (
+    <div className="quota-cell">
+      <span className="quota-label">{fmt(used)} / {fmt(limit)}</span>
+      <div className="progress-bar">
+        <div className="progress-fill" style={{ width: `${pct}%`, backgroundColor: color }} />
+      </div>
+      {sinceLabel && <span className="quota-since">seit {sinceLabel}</span>}
+    </div>
+  );
+}
+
+function Login({ onLogin }) {
+  const [password, setPassword] = useState('');
   const [error, setError] = useState(null);
 
-  useEffect(() => {
+  const handleSubmit = async (e) => {
-    Promise.all([fetchUsers(), fetchApiKeys()]).finally(() => setLoading(false));
+    e.preventDefault();
-  }, []);
+    setError(null);
-
-  const fetchUsers = async () => {
     try {
-      const res = await axios.get('/api/users');
+      await axios.get('/api/api-keys', { headers: authHeaders(password) });
-      setUsers(res.data);
+      sessionStorage.setItem('admin_password', password);
-    } catch (err) {
+      onLogin(password);
-      setError('Benutzer konnten nicht geladen werden.');
+    } catch {
+      setError('Ungültiges Passwort.');
     }
   };
 
-  const fetchApiKeys = async () => {
-    try {
-      const res = await axios.get('/api/api-keys');
-      setApiKeys(res.data);
-    } catch (err) {
-      setError('API-Keys konnten nicht geladen werden.');
-    }
-  };
-
-  if (loading) return <div>Loading...</div>;
-  if (error) return <div className="error">{error}</div>;
-
   return (
     <div className="container">
       <h1>Ollama Proxy Admin</h1>
+      <form onSubmit={handleSubmit} className="login-form">
+        <label>Passwort</label>
+        <input
+          type="password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          placeholder="Admin-Passwort eingeben"
+          autoFocus
+        />
+        {error && <div className="error">{error}</div>}
+        <button type="submit">Anmelden</button>
+      </form>
+    </div>
+  );
+}
+
+const EMPTY_KEY_FORM = {
+  name: '', expires_at: '', daily_tokens: '', monthly_tokens: '', daily_requests: '', monthly_requests: '',
+};
+
+function SettingsSection({ password, refreshKey }) {
+  const [settings, setSettings] = useState(null);
+  const [availableModels, setAvailableModels] = useState([]);
+  const [modelsLoading, setModelsLoading] = useState(false);
+  const [ollamaReachable, setOllamaReachable] = useState(true);
+  const [proxyEndpoint, setProxyEndpoint] = useState(null);
+  const [appVersion, setAppVersion] = useState(null);
+  const [saved, setSaved] = useState(false);
+  const [error, setError] = useState(null);
+  const [usageLog, setUsageLog] = useState([]);
+  const [errorLog, setErrorLog] = useState([]);
+
+  const fetchModels = async (url, currentModel) => {
+    setModelsLoading(true);
+    try {
+      const res = await axios.get('/api/ollama-models', {
+        headers: authHeaders(password),
+        params: url ? { url } : {},
+      });
+      const { models, reachable } = res.data;
+      setOllamaReachable(reachable);
+      setAvailableModels(models);
+      if (models.length > 0 && currentModel && !models.includes(currentModel)) {
+        setSettings(s => ({ ...s, force_model: models[0] }));
+      }
+    } catch {
+      setOllamaReachable(false);
+      setAvailableModels([]);
+    } finally {
+      setModelsLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    const headers = authHeaders(password);
+    Promise.allSettled([
+      axios.get('/api/settings', { headers }),
+      axios.get('/api/proxy-info', { headers }),
+      axios.get('/api/logs/usage', { headers }),
+      axios.get('/api/logs/error', { headers }),
+    ]).then(([settingsRes, proxyRes, usageRes, errorRes]) => {
+      if (settingsRes.status === 'rejected' || proxyRes.status === 'rejected') {
+        setError('Einstellungen konnten nicht geladen werden.');
+        return;
+      }
+      const s = settingsRes.value.data;
+      setSettings(s);
+      setProxyEndpoint(proxyRes.value.data.endpoint);
+      setAppVersion(proxyRes.value.data.version);
+      if (usageRes.status === 'fulfilled') setUsageLog(usageRes.value.data.lines);
+      if (errorRes.status === 'fulfilled') setErrorLog(errorRes.value.data.lines);
+      fetchModels(s.ollama_url, s.force_model);
+    });
+  }, [refreshKey]);
+
+  const handleSave = async (e) => {
+    e.preventDefault();
+    setError(null);
+    setSaved(false);
+    try {
+      await axios.put('/api/settings', settings, { headers: authHeaders(password) });
+      setSaved(true);
+      setTimeout(() => setSaved(false), 3000);
+    } catch {
+      setError('Fehler beim Speichern.');
+    }
+  };
+
+  if (!settings) return <div>Laden...</div>;
+
+  return (
+    <section>
+      <h2>Einstellungen</h2>
+      <form onSubmit={handleSave} className="settings-form">
+        <div className="settings-row">
+          <label>Proxy-Endpunkt</label>
+          <span className="settings-value">
+            {proxyEndpoint ?? '…'}
+            <small> (Änderung erfordert Neustart)</small>
+          </span>
+        </div>
+        <div className="settings-row">
+          <label>Version</label>
+          <span className="settings-value">{appVersion ?? '…'}</span>
+        </div>
+        <div className="settings-row">
+          <label>Ollama-Endpunkt</label>
+          <div className="settings-input-wrap">
+            <input
+              type="url"
+              value={settings.ollama_url}
+              onChange={(e) => setSettings({ ...settings, ollama_url: e.target.value })}
+              onBlur={(e) => fetchModels(e.target.value, settings.force_model)}
+              placeholder="http://localhost:11434"
+              required
+            />
+            {!ollamaReachable && !modelsLoading && (
+              <div className="warning">⚠ Ollama nicht erreichbar unter {settings.ollama_url}</div>
+            )}
+          </div>
+        </div>
+        <div className="settings-row">
+          <label>Aktives Modell (Lock)</label>
+          {modelsLoading ? (
+            <span className="settings-value">Lade Modelle…</span>
+          ) : availableModels.length > 0 ? (
+            <select
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+            >
+              <option value="">— kein Lock —</option>
+              {availableModels.map(m => <option key={m} value={m}>{m}</option>)}
+            </select>
+          ) : (
+            <input
+              type="text"
+              value={settings.force_model || ""}
+              onChange={(e) => setSettings({ ...settings, force_model: e.target.value || null })}
+              placeholder="leer = kein Lock"
+            />
+          )}
+        </div>
+        {error && <div className="error">{error}</div>}
+        {saved && <div className="success">Gespeichert.</div>}
+        <button type="submit">Änderungen übernehmen</button>
+      </form>
+      <div className="log-section">
+        <h3>Nutzungslog (letzte 10 Einträge)</h3>
+        <pre className="log-pre">{usageLog.length > 0 ? usageLog.join('\n') : '— keine Einträge —'}</pre>
+        {errorLog.length > 0 && (
+          <>
+            <h3>Fehlerlog (letzte 10 Einträge)</h3>
+            <pre className="log-pre log-pre-error">{errorLog.join('\n')}</pre>
+          </>
+        )}
+      </div>
+    </section>
+  );
+}
+
+function App() {
+  const [password, setPassword] = useState(() => sessionStorage.getItem('admin_password'));
+  const [apiKeys, setApiKeys] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const [newKey, setNewKey] = useState(null);
+  const [form, setForm] = useState(EMPTY_KEY_FORM);
+  const [creating, setCreating] = useState(false);
+  const [editKey, setEditKey] = useState(null);
+  const [editForm, setEditForm] = useState({});
+  const [refreshKey, setRefreshKey] = useState(0);
+  const [lastUpdated, setLastUpdated] = useState(null);
+
+  const fetchApiKeys = async () => {
+    try {
+      const res = await axios.get('/api/api-keys', { headers: authHeaders(password) });
+      setApiKeys(res.data);
+      setLastUpdated(new Date());
+    } catch {
+      setError('API-Keys konnten nicht geladen werden.');
+    }
+  };
+
+  useEffect(() => {
+    if (!password) { setLoading(false); return; }
+    fetchApiKeys().finally(() => setLoading(false));
+
+    const timer = setInterval(() => {
+      fetchApiKeys();
+      setRefreshKey(k => k + 1);
+    }, 5 * 60 * 1000);
+
+    return () => clearInterval(timer);
+  }, [password]);
+
+  const handleCreate = async (e) => {
+    e.preventDefault();
+    setCreating(true);
+    try {
+      const payload = { name: form.name };
+      if (form.expires_at)       payload.expires_at       = new Date(form.expires_at).toISOString();
+      if (form.daily_tokens)     payload.daily_tokens     = Number(form.daily_tokens) * 1000;
+      if (form.monthly_tokens)   payload.monthly_tokens   = Number(form.monthly_tokens) * 1000;
+      if (form.daily_requests)   payload.daily_requests   = Number(form.daily_requests);
+      if (form.monthly_requests) payload.monthly_requests = Number(form.monthly_requests);
+
+      const res = await axios.post('/api/api-keys', payload, { headers: authHeaders(password) });
+      setNewKey(res.data.plaintext_key);
+      setForm(EMPTY_KEY_FORM);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Erstellen des API-Keys.');
+    } finally {
+      setCreating(false);
+    }
+  };
+
+  const handleDeactivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/deactivate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Deaktivieren.');
+    }
+  };
+
+  const handleActivate = async (id) => {
+    try {
+      await axios.put(`/api/api-keys/${id}/activate`, {}, { headers: authHeaders(password) });
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Aktivieren.');
+    }
+  };
+
+  const handleDelete = async (id, name) => {
+    if (!window.confirm(`API-Key "${name}" wirklich löschen?`)) return;
+    try {
+      await axios.delete(`/api/api-keys/${id}`, { headers: authHeaders(password) });
+      if (editKey?.id === id) setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Löschen.');
+    }
+  };
+
+  const handleEdit = (key) => {
+    setEditKey(key);
+    setEditForm({
+      daily_tokens:     key.daily_tokens    != null ? key.daily_tokens / 1000    : '',
+      monthly_tokens:   key.monthly_tokens  != null ? key.monthly_tokens / 1000  : '',
+      daily_requests:   key.daily_requests  ?? '',
+      monthly_requests: key.monthly_requests ?? '',
+    });
+  };
+
+  const handleSaveEdit = async (e) => {
+    e.preventDefault();
+    try {
+      const payload = {
+        daily_tokens:     editForm.daily_tokens     !== '' ? Number(editForm.daily_tokens) * 1000     : null,
+        monthly_tokens:   editForm.monthly_tokens   !== '' ? Number(editForm.monthly_tokens) * 1000   : null,
+        daily_requests:   editForm.daily_requests   !== '' ? Number(editForm.daily_requests)   : null,
+        monthly_requests: editForm.monthly_requests !== '' ? Number(editForm.monthly_requests) : null,
+      };
+      await axios.patch(`/api/api-keys/${editKey.id}/quota`, payload, { headers: authHeaders(password) });
+      setEditKey(null);
+      await fetchApiKeys();
+    } catch {
+      setError('Fehler beim Speichern der Limits.');
+    }
+  };
+
+  const logout = () => {
+    sessionStorage.removeItem('admin_password');
+    setLastUpdated(null);
+    setPassword(null);
+  };
+
+  if (!password) return <Login onLogin={setPassword} />;
+  if (loading) return <div>Laden...</div>;
+  if (error) return <div className="error">{error}</div>;
+
+  return (
+    <div className="container">
+      <div className="header">
+        <h1>Ollama Proxy Admin</h1>
+        <div className="header-right">
+          {lastUpdated && (
+            <span className="last-updated">
+              Aktualisiert: {lastUpdated.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })}
+            </span>
+          )}
+          <button onClick={logout}>Abmelden</button>
+        </div>
+      </div>
+
+      <SettingsSection password={password} refreshKey={refreshKey} />
 
       <section>
-        <h2>Users</h2>
+        <h2>Neuer API-Key</h2>
-        <table>
+        <form onSubmit={handleCreate} className="create-form">
-          <thead>
+          <div className="edit-form">
-            <tr>
+            <label className="create-name">
-              <th>ID</th>
+              Name
-              <th>Username</th>
+              <small>&nbsp;</small>
-              <th>Email</th>
+              <input
-              <th>Status</th>
+                value={form.name}
-            </tr>
+                onChange={(e) => setForm({ ...form, name: e.target.value })}
-          </thead>
+                required
-          <tbody>
+                placeholder="z. B. alice"
-            {users.map(user => (
+              />
-              <tr key={user.id}>
+            </label>
-                <td>{user.id}</td>
+            <label className="create-date">
-                <td>{user.username}</td>
+              Ablaufdatum
-                <td>{user.email}</td>
+              <small>leer = unbegrenzt</small>
-                <td>{user.is_active ? 'Active' : 'Inactive'}</td>
+              <input
-              </tr>
+                type="date"
-            ))}
+                value={form.expires_at}
-          </tbody>
+                onChange={(e) => setForm({ ...form, expires_at: e.target.value })}
-        </table>
+              />
+            </label>
+            <div className="create-btn-wrap">
+              <button type="submit" disabled={creating} className="btn-save">Erstellen</button>
+            </div>
+          </div>
+          <div className="edit-form">
+            <label>
+              Tokens/Tag (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_tokens}
+                onChange={(e) => setForm({ ...form, daily_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Tokens/Monat (k)
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_tokens}
+                onChange={(e) => setForm({ ...form, monthly_tokens: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Tag
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.daily_requests}
+                onChange={(e) => setForm({ ...form, daily_requests: e.target.value })}
+              />
+            </label>
+            <label>
+              Requests/Monat
+              <small>leer = unbegrenzt</small>
+              <input
+                type="number"
+                min="0"
+                placeholder="∞"
+                value={form.monthly_requests}
+                onChange={(e) => setForm({ ...form, monthly_requests: e.target.value })}
+              />
+            </label>
+          </div>
+        </form>
+        {newKey && (
+          <div className="new-key-box">
+            <strong>Neuer Key (nur einmal sichtbar):</strong>
+            <code>{newKey}</code>
+            <button onClick={() => setNewKey(null)}>✕</button>
+          </div>
+        )}
       </section>
 
       <section>
@@ -68,28 +443,106 @@ function App() {
         <table>
           <thead>
             <tr>
-              <th>ID</th>
+              <th></th>
               <th>Name</th>
               <th>Key</th>
-              <th>User</th>
+              <th>Läuft ab</th>
-              <th>Status</th>
+              <th className="th-quota">Tokens/Tag</th>
+              <th className="th-quota">Tokens/Monat</th>
+              <th className="th-quota">Req/Tag</th>
+              <th className="th-quota">Req/Monat</th>
+              <th></th>
             </tr>
           </thead>
           <tbody>
             {apiKeys.map(key => (
-              <tr key={key.id}>
+              <tr key={key.id} className={editKey?.id === key.id ? 'row-editing' : ''}>
-                <td>{key.id}</td>
+                <td className="td-status">
+                  <span className={key.is_active ? 'status-active' : 'status-inactive'} title={key.is_active ? 'Aktiv' : 'Inaktiv'}>●</span>
+                </td>
                 <td>{key.name}</td>
-                <td>{maskKey(key.key)}</td>
+                <td>{displayKey(key.key_prefix)}</td>
-                <td>{key.user_id}</td>
+                <td>{key.expires_at ? new Date(key.expires_at).toLocaleDateString('de-DE', { timeZone: 'Europe/Berlin' }) : '∞'}</td>
-                <td>{key.is_active ? 'Active' : 'Inactive'}</td>
+                <td><QuotaBar used={key.tokens_used_today} limit={key.daily_tokens} isToken since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.tokens_used_month} limit={key.monthly_tokens} isToken since={key.monthly_reset_at} /></td>
+                <td><QuotaBar used={key.requests_today} limit={key.daily_requests} since={key.daily_reset_at} /></td>
+                <td><QuotaBar used={key.requests_month} limit={key.monthly_requests} since={key.monthly_reset_at} /></td>
+                <td className="action-cell">
+                  <button className="btn-icon btn-icon-edit" data-tooltip="Bearbeiten" onClick={() => handleEdit(key)}>✏</button>
+                  {key.is_active ? (
+                    <button className="btn-icon btn-icon-warn" data-tooltip="Deaktivieren" onClick={() => handleDeactivate(key.id)}>⏸</button>
+                  ) : (
+                    <button className="btn-icon btn-icon-ok" data-tooltip="Aktivieren" onClick={() => handleActivate(key.id)}>▶</button>
+                  )}
+                  <button className="btn-icon btn-icon-danger" data-tooltip="Löschen" onClick={() => handleDelete(key.id, key.name)}>✕</button>
+                </td>
               </tr>
             ))}
           </tbody>
         </table>
+
+        {editKey && (
+          <div className="edit-section">
+            <h3>Limits bearbeiten: <em>{editKey.name}</em></h3>
+            <form onSubmit={handleSaveEdit} className="edit-form">
+              <label>
+                Tokens/Tag (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, daily_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Tokens/Monat (k)
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_tokens}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_tokens: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Tag
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.daily_requests}
+                  onChange={(e) => setEditForm({ ...editForm, daily_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <label>
+                Requests/Monat
+                <small>leer = unbegrenzt</small>
+                <input
+                  type="number"
+                  min="0"
+                  value={editForm.monthly_requests}
+                  onChange={(e) => setEditForm({ ...editForm, monthly_requests: e.target.value })}
+                  placeholder="∞"
+                />
+              </label>
+              <div className="edit-actions">
+                <button type="submit" className="btn-save">Speichern</button>
+                <button type="button" className="btn-cancel" onClick={() => setEditKey(null)}>Abbrechen</button>
+              </div>
+            </form>
+          </div>
+        )}
       </section>
     </div>
   );
 }
 
-export default App;
+ReactDOM.createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>
+);

frontend/src/styles.css

@@ -44,12 +44,455 @@ tr:hover {
   background: #f8f9fa;
 }
 
-.status-active {
+
+.header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 40px;
+}
+
+.header h1 {
+  margin-bottom: 0;
+}
+
+.login-form {
+  max-width: 360px;
+  margin: 80px auto;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.login-form input {
+  padding: 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.login-form button, .header button {
+  padding: 10px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.login-form button:hover, .header button:hover {
+  background: #34495e;
+}
+
+.error {
+  color: #e74c3c;
+  font-size: 14px;
+}
+
+.create-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.create-form .edit-form {
+  margin-bottom: 0;
+}
+
+.create-name {
+  flex: 0 0 auto !important;
+}
+
+.create-name input {
+  width: 200px;
+}
+
+.create-date {
+  flex: 0 0 auto !important;
+}
+
+.create-date input[type="date"] {
+  width: 150px;
+}
+
+.create-btn-wrap {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: flex-end;
+}
+
+.create-form .btn-save:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.new-key-box {
+  margin-top: 16px;
+  padding: 12px 16px;
+  background: #eafaf1;
+  border: 1px solid #27ae60;
+  border-radius: 4px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.new-key-box code {
+  flex: 1;
+  font-size: 13px;
+  word-break: break-all;
+}
+
+.new-key-box button {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  color: #555;
+}
+
+.btn-danger {
+  padding: 4px 10px;
+  background: #e74c3c;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 12px;
+}
+
+.btn-danger:hover {
+  background: #c0392b;
+}
+
+.settings-form {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  max-width: 500px;
+}
+
+.settings-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.settings-row label {
+  width: 160px;
+  flex-shrink: 0;
+  font-size: 14px;
+  font-weight: 500;
+  color: #2c3e50;
+}
+
+.settings-row input, .settings-row select {
+  flex: 1;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.settings-input-wrap {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.settings-input-wrap input {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  font-size: 14px;
+  box-sizing: border-box;
+}
+
+.warning {
+  color: #b8520a;
+  background: #fff3e0;
+  border: 1px solid #e67e22;
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-size: 13px;
+}
+
+.settings-form button {
+  align-self: flex-start;
+  padding: 8px 20px;
+  background: #2c3e50;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 14px;
+}
+
+.settings-form button:hover {
+  background: #34495e;
+}
+
+.success {
   color: #27ae60;
+  font-size: 14px;
+}
+
+.settings-value {
+  flex: 1;
+  font-size: 14px;
+  color: #2c3e50;
+}
+
+.settings-value small {
+  margin-left: 8px;
+  color: #999;
+  font-size: 12px;
+}
+
+/* Quota progress bars */
+.th-quota {
+  width: 90px;
+}
+
+.quota-cell {
+  width: 100%;
+}
+
+.quota-label {
+  font-size: 12px;
+  color: #555;
+  white-space: nowrap;
+}
+
+.quota-unlimited {
+  color: #aaa;
+  font-size: 14px;
+}
+
+.quota-since {
+  display: block;
+  font-size: 10px;
+  color: #aaa;
+  margin-top: 2px;
+}
+
+.progress-bar {
+  height: 4px;
+  background: #e2e8f0;
+  border-radius: 2px;
+  margin-top: 4px;
+}
+
+.progress-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.3s ease;
+}
+
+/* Edit form */
+.td-status {
+  width: 20px;
+  text-align: center;
+}
+
+.status-active  { color: #27ae60; font-size: 12px; }
+.status-inactive { color: #bdc3c7; font-size: 12px; }
+
+.btn-icon {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px 4px;
+  margin-right: 2px;
+  border-radius: 3px;
+  line-height: 1;
+  position: relative;
+}
+
+.btn-icon:hover {
+  background: rgba(0, 0, 0, 0.06);
+}
+
+.btn-icon-edit   { color: #2980b9; }
+.btn-icon-warn   { color: #e67e22; }
+.btn-icon-ok     { color: #27ae60; }
+.btn-icon-danger { color: #e74c3c; }
+
+.btn-icon::after {
+  content: attr(data-tooltip);
+  position: absolute;
+  bottom: calc(100% + 8px);
+  left: 50%;
+  transform: translateX(-50%);
+  background: #2c3e50;
+  color: white;
+  padding: 5px 10px;
+  border-radius: 5px;
+  font-size: 12px;
+  font-weight: 400;
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon::before {
+  content: '';
+  position: absolute;
+  bottom: calc(100% + 2px);
+  left: 50%;
+  transform: translateX(-50%);
+  border: 5px solid transparent;
+  border-top-color: #2c3e50;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.15s;
+  z-index: 1000;
+}
+
+.btn-icon:hover::after,
+.btn-icon:hover::before {
+  opacity: 1;
+}
+
+.action-cell {
+  white-space: nowrap;
+  position: relative;
+  overflow: visible;
+}
+
+.row-editing {
+  background: #eaf4fb !important;
+}
+
+.edit-section {
+  margin-top: 20px;
+  padding: 16px 20px;
+  background: #f0f7ff;
+  border: 1px solid #3498db;
+  border-radius: 6px;
+}
+
+.edit-section h3 {
+  margin: 0 0 14px;
+  font-size: 15px;
+  color: #2c3e50;
   font-weight: 600;
 }
 
-.status-inactive {
+.edit-section h3 em {
-  color: #e74c3c;
+  font-style: normal;
+  color: #2980b9;
+}
+
+.edit-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px;
+  align-items: flex-end;
+}
+
+.edit-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  font-size: 13px;
+  font-weight: 500;
+  color: #34495e;
+}
+
+.edit-form label small {
+  font-weight: 400;
+  color: #999;
+  font-size: 12px;
+}
+
+.edit-form input {
+  padding: 6px 8px;
+  border: 1px solid #bdc3c7;
+  border-radius: 4px;
+  font-size: 14px;
+  width: 130px;
+}
+
+.edit-actions {
+  display: flex;
+  gap: 8px;
+  padding-bottom: 2px;
+}
+
+.btn-save {
+  padding: 6px 18px;
+  background: #27ae60;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-save:hover {
+  background: #219a52;
+}
+
+.btn-cancel {
+  padding: 6px 18px;
+  background: #95a5a6;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+}
+
+.btn-cancel:hover {
+  background: #7f8c8d;
+}
+
+.log-section {
+  margin-top: 24px;
+  border-top: 1px solid #eee;
+  padding-top: 16px;
+}
+
+.log-section h3 {
+  font-size: 14px;
   font-weight: 600;
+  color: #34495e;
+  margin: 0 0 6px;
+}
+
+.log-pre {
+  background: #1e2a35;
+  color: #c8d6df;
+  font-family: 'Menlo', 'Consolas', monospace;
+  font-size: 11px;
+  line-height: 1.6;
+  padding: 10px 14px;
+  border-radius: 4px;
+  margin: 0 0 14px;
+  overflow-x: auto;
+  white-space: pre;
+}
+
+.log-pre-error {
+  background: #2d1b1b;
+  color: #f5a0a0;
+  margin-bottom: 0;
+}
+
+.header-right {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+}
+
+.last-updated {
+  font-size: 12px;
+  color: #95a5a6;
 }

frontend/vite.config.js

@@ -3,8 +3,15 @@ import react from '@vitejs/plugin-react'
 
 export default defineConfig({
   plugins: [react()],
+  clearScreen: false,
   server: {
+    open: true,
     proxy: {
+      '/api/api-keys': 'http://localhost:8001',
+      '/api/settings': 'http://localhost:8001',
+      '/api/ollama-models': 'http://localhost:8001',
+      '/api/proxy-info': 'http://localhost:8001',
+      '/api/logs': 'http://localhost:8001',
       '/api': 'http://localhost:8000',
     },
   },

run_dev.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Dev runner: startet Proxy, Admin-API und Frontend gemeinsam."""
+import os
+import sys
+import signal
+import subprocess
+import threading
+from pathlib import Path
+
+
+def load_env(path: Path):
+    if not path.exists():
+        return
+    for line in path.read_text(encoding='utf-8').splitlines():
+        line = line.strip()
+        if line and not line.startswith('#') and '=' in line:
+            key, _, val = line.partition('=')
+            os.environ.setdefault(key.strip(), val.strip().strip('"\''))
+
+
+def pipe_output(proc: subprocess.Popen, label: str, color: str):
+    reset = '\033[0m'
+    prefix = f'\033[{color}m[{label}]{reset} '
+    for raw in iter(proc.stdout.readline, b''):
+        sys.stdout.write(prefix + raw.decode(errors='replace'))
+        sys.stdout.flush()
+
+
+def main():
+    root = Path(__file__).parent
+    load_env(root / '.env')
+
+    if not os.environ.get('ADMIN_PASSWORD'):
+        print('Fehler: ADMIN_PASSWORD nicht gesetzt (siehe .env)')
+        sys.exit(1)
+
+    python  = root / '.venv' / 'bin' / 'python'
+    backend = root / 'backend'
+    frontend = root / 'frontend'
+
+    proxy_host = os.environ.get('PROXY_HOST', '0.0.0.0')
+    proxy_port = os.environ.get('PROXY_PORT', '8000')
+    admin_host = os.environ.get('ADMIN_HOST', '127.0.0.1')
+    admin_port = os.environ.get('ADMIN_PORT', '8001')
+
+    print('Initialisiere Datenbank...')
+    subprocess.run([str(python), 'init_db.py'], cwd=backend, check=True)
+
+    print(f'Starte Proxy      → http://{proxy_host}:{proxy_port}')
+    print(f'Starte Admin-API  → http://{admin_host}:{admin_port}')
+    print('Starte Frontend   → http://localhost:5173')
+
+    env = {**os.environ, 'PYTHONUNBUFFERED': '1'}
+
+    procs = [
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'main:app', '--reload',
+             '--host', proxy_host, '--port', proxy_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Proxy   ', '34'),  # blau
+        (subprocess.Popen(
+            [str(python), '-m', 'uvicorn', 'admin:app', '--reload',
+             '--host', admin_host, '--port', admin_port],
+            cwd=backend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env,
+        ), 'Admin   ', '33'),  # gelb
+        (subprocess.Popen(
+            ['npm', 'run', 'dev'],
+            cwd=frontend, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        ), 'Frontend', '32'),  # grün
+    ]
+
+    for proc, label, color in procs:
+        threading.Thread(target=pipe_output, args=(proc, label, color), daemon=True).start()
+
+    def stop(*_):
+        for p, _, _ in procs:
+            p.terminate()
+
+    signal.signal(signal.SIGINT, stop)
+    signal.signal(signal.SIGTERM, stop)
+
+    for p, _, _ in procs:
+        p.wait()
+
+
+if __name__ == '__main__':
+    main()

run_tests.py

@@ -1,8 +0,0 @@
-#!/usr/bin/env python3
-"""Pytest runner for Ollama Proxy tests."""
-import subprocess
-import sys
-
-if __name__ == "__main__":
-    result = subprocess.run([sys.executable, "-m", "pytest"] + sys.argv[1:], cwd="backend")
-    sys.exit(result.returncode)

start.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# .env laden
+if [ -f "$SCRIPT_DIR/.env" ]; then
+    set -a
+    source "$SCRIPT_DIR/.env"
+    set +a
+fi
+
+# Virtuelle Umgebung aktivieren falls vorhanden
+if [ -f "$SCRIPT_DIR/.venv/bin/activate" ]; then
+    source "$SCRIPT_DIR/.venv/bin/activate"
+elif [ -f "$SCRIPT_DIR/venv/bin/activate" ]; then
+    source "$SCRIPT_DIR/venv/bin/activate"
+fi
+
+if [ -z "$ADMIN_PASSWORD" ]; then
+    echo "Fehler: ADMIN_PASSWORD ist nicht gesetzt. Bitte .env befüllen."
+    exit 1
+fi
+
+PROXY_HOST=${PROXY_HOST:-0.0.0.0}
+PROXY_PORT=${PROXY_PORT:-8000}
+ADMIN_HOST=${ADMIN_HOST:-127.0.0.1}
+ADMIN_PORT=${ADMIN_PORT:-8001}
+FRONTEND_PORT=5173
+
+PIDS=()
+
+cleanup() {
+    echo "Beende alle Prozesse..."
+    for pid in "${PIDS[@]}"; do
+        kill "$pid" 2>/dev/null
+    done
+    wait 2>/dev/null
+}
+
+port_in_use() {
+    lsof -iTCP:"$1" -sTCP:LISTEN -t &>/dev/null
+}
+
+# Ports prüfen bevor irgendetwas gestartet wird
+for port in "$PROXY_PORT" "$ADMIN_PORT" "$FRONTEND_PORT"; do
+    if port_in_use "$port"; then
+        echo "Fehler: Port $port ist bereits belegt."
+        exit 1
+    fi
+done
+
+trap cleanup EXIT INT TERM
+
+# Datenbank initialisieren
+echo "Initialisiere Datenbank..."
+cd backend
+python3 init_db.py
+cd ..
+
+# Backend starten
+echo "Starte Backend (Proxy) auf ${PROXY_HOST}:${PROXY_PORT}..."
+cd backend
+python3 -m uvicorn main:app --reload --host "$PROXY_HOST" --port "$PROXY_PORT" &
+PIDS+=($!)
+
+echo "Starte Admin-API auf ${ADMIN_HOST}:${ADMIN_PORT}..."
+python3 -m uvicorn admin:app --reload --host "$ADMIN_HOST" --port "$ADMIN_PORT" &
+PIDS+=($!)
+cd ..
+
+# Frontend starten
+echo "Starte Frontend..."
+cd frontend
+npm install --silent
+npm run dev &
+PIDS+=($!)
+cd ..
+
+echo "Backend läuft (Port $PROXY_PORT)"
+echo "Admin-API läuft (${ADMIN_HOST}:${ADMIN_PORT})"
+echo "Admin-Oberfläche: http://localhost:$FRONTEND_PORT"
+
+wait

start_claude.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# .env laden
+if [ -f "$SCRIPT_DIR/.env" ]; then
+    set -a
+    source "$SCRIPT_DIR/.env"
+    set +a
+fi
+
+# API-Key: erstes Argument hat Vorrang, sonst Umgebungsvariable PROXY_API_KEY
+API_KEY="${1:-$PROXY_API_KEY}"
+
+if [ -z "$API_KEY" ]; then
+    echo "Fehler: Kein API-Key angegeben."
+    echo "Verwendung: ./start_claude.sh sk-dein-key"
+    echo "       oder: PROXY_API_KEY=sk-dein-key ./start_claude.sh"
+    exit 1
+fi
+
+# 0.0.0.0 ist eine Bind-Adresse, kein gültiger Client-Host
+PROXY_HOST="${PROXY_HOST:-0.0.0.0}"
+PROXY_PORT="${PROXY_PORT:-8000}"
+if [ "$PROXY_HOST" = "0.0.0.0" ]; then
+    PROXY_HOST="localhost"
+fi
+
+export ANTHROPIC_BASE_URL="http://${PROXY_HOST}:${PROXY_PORT}"
+export ANTHROPIC_AUTH_TOKEN="$API_KEY"
+
+echo "Verbinde mit Proxy: $ANTHROPIC_BASE_URL"
+exec claude

test_api.sh

@@ -1,7 +0,0 @@
-curl -X POST http://localhost:8000/api/generate \
-  -H "Authorization: sk-admin-key" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "model": "llama3",
-    "prompt": "Test"
-  }'