fixed config

Both use an allowlist so only the files each Dockerfile copies are sent
to the build context. For caddy this keeps the TLS certificates and keys
in data/ and config/ out of the context; for api it skips training code,
datasets, saved models and caches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

api/.dockerignore

@@ -0,0 +1,13 @@
+# Allowlist: the Dockerfile only copies these three things, so nothing
+# else (training code, datasets, saved models, caches) is sent to the daemon.
+*
+!requirements.txt
+!src/production
+!build_models
+
+# Re-exclude junk inside the allowed paths
+**/__pycache__
+**/*.pyc
+**/*.bat
+**/.env
+**/*.env

api/src/production/server.py

@@ -38,17 +38,22 @@ IMAGE_SIZE_CNN = 64
 IMAGE_SIZE_YOLO = 64
 
 # ---- Resource limits (the server is weak, keep everything small and bounded) ----
-TORCH_THREADS = int(os.getenv("TORCH_THREADS", "1"))
+# Number of predictions (bird or face) that may run at the same time.
-MAX_PENDING_INFERENCES = int(os.getenv("MAX_PENDING_INFERENCES", "2"))  # running + waiting
+PARALLEL_INFERENCES = max(1, int(os.getenv("PARALLEL_INFERENCES", "1")))
-MAX_UPLOAD_BYTES = 5 * 1024 * 1024
+# Extra requests allowed to wait for a free slot; anything beyond is rejected.
+QUEUED_INFERENCES = max(0, int(os.getenv("QUEUED_INFERENCES", "1")))
+# PyTorch threads used by EACH running prediction. Total CPU use is roughly
+# PARALLEL_INFERENCES * TORCH_THREADS, so keep the product <= your CPU cores.
+TORCH_THREADS = max(1, int(os.getenv("TORCH_THREADS", "1")))
+MAX_UPLOAD_BYTES = int(max(1, float(os.getenv("MAX_UPLOAD_MEGABYTES", "15"))) * 1024 * 1024)
 MAX_FRAME_BYTES = 1 * 1024 * 1024
 MAX_IMAGE_PIXELS = 20_000_000
 MAX_WEBSOCKETS = 3
 MAX_WEBSOCKETS_PER_IP = 1
-FACE_MIN_INTERVAL = 1 / 2.1
+FACE_MAX_FPS = float(os.getenv("FACE_MAX_FPS", "5.5"))  # per websocket connection
+FACE_MIN_INTERVAL = 1 / FACE_MAX_FPS
 DECODE_DRAFT_SIZE = (256, 256)  # JPEG decodes at reduced scale, still larger than the 64px model input
 
-torch.set_num_threads(TORCH_THREADS)
 Image.MAX_IMAGE_PIXELS = MAX_IMAGE_PIXELS
 
 origins = [
@@ -165,8 +170,14 @@ class RateLimiter:
         return True
 
 
-predict_limiter = RateLimiter(limit=10, window=60)
+predict_limiter = RateLimiter(
-review_limiter = RateLimiter(limit=5, window=60)
+    limit=max(1, int(os.getenv("PREDICT_RATE_LIMIT", "10"))),
+    window=max(1.0, float(os.getenv("PREDICT_RATE_WINDOW", "60"))),
+)
+review_limiter = RateLimiter(
+    limit=max(1, int(os.getenv("REVIEW_RATE_LIMIT", "5"))),
+    window=max(1.0, float(os.getenv("REVIEW_RATE_WINDOW", "60"))),
+)
 
 
 def rate_limit(limiter: RateLimiter):
@@ -180,15 +191,28 @@ class Busy(Exception):
     pass
 
 
-class InferenceGate:
+def init_inference_thread():
-    """One worker thread runs all inference. At most `max_pending` jobs
+    # Must run inside each worker thread: with OpenMP the thread count is a
-    (running + waiting) are admitted; everything else is rejected at once
+    # per-thread setting, so setting it once in the main thread is not enough.
-    instead of queueing up and eating memory."""
+    torch.set_num_threads(TORCH_THREADS)
 
-    def __init__(self, max_pending: int):
+
-        self.max_pending = max_pending
+class InferenceGate:
+    """Runs predictions on `parallel` worker threads. At most
+    `parallel + queued` jobs (running + waiting) are admitted; everything
+    else is rejected at once instead of queueing up and eating memory.
+
+    The models are in eval mode under torch.inference_mode(), so several
+    threads can safely run forward passes on the same model object."""
+
+    def __init__(self, parallel: int, queued: int):
+        self.max_pending = parallel + queued
         self.pending = 0
-        self.executor = ThreadPoolExecutor(max_workers=1, thread_name_prefix="inference")
+        self.executor = ThreadPoolExecutor(
+            max_workers=parallel,
+            thread_name_prefix="inference",
+            initializer=init_inference_thread,
+        )
 
     async def run(self, fn, *args):
         if self.pending >= self.max_pending:
@@ -200,7 +224,7 @@ class InferenceGate:
             self.pending -= 1
 
 
-gate = InferenceGate(MAX_PENDING_INFERENCES)
+gate = InferenceGate(PARALLEL_INFERENCES, QUEUED_INFERENCES)
 
 
 class InvalidImage(Exception):

caddy/.dockerignore

@@ -0,0 +1,5 @@
+# Allowlist: only the Caddyfile is copied into the image.
+# data/ and config/ hold TLS certificates and private keys at runtime
+# (mounted as volumes) and must never end up in the build context.
+*
+!Caddyfile

caddy/Caddyfile

@@ -1,5 +1,5 @@
 {
-	email marvin.krausser277@gmail.com
+	email {$CADDY_EMAIL:marvin.krausser277@gmail.com}
 }
 
 (common) {
@@ -25,7 +25,7 @@ marvinkrausser.com {
 api.marvinkrausser.com {
 	import common
 	request_body {
-		max_size 10MB
+		max_size {$CADDY_MAX_BODY:16MB}
 	}
 	reverse_proxy cnn_api:8000
 }
@@ -34,3 +34,8 @@ portfolio.marvinkrausser.com {
 	import common
 	reverse_proxy portfolio_website:8081
 }
+
+git.marvinkrausser.com {
+	import common
+	reverse_proxy gitea:3000
+}

compose.yaml

@@ -7,6 +7,10 @@ services:
       - "80:80"
       - "443:443"
     restart: unless-stopped
+    environment:
+      - CADDY_EMAIL=marvin.krausser277@gmail.com
+      # Keep about 1 MB above the API's MAX_UPLOAD_MEGABYTES (multipart overhead).
+      - CADDY_MAX_BODY=16MB
     volumes:
       - ./caddy/data:/data/caddy
       - ./caddy/config:/config/caddy
@@ -15,6 +19,7 @@ services:
       - cnn_website
     networks:
       - cnn_network
+      - gitea_network
     pull_policy: never
     container_name: caddy_proxy
 
@@ -32,6 +37,18 @@ services:
       - cnn_network
     pull_policy: never
     container_name: cnn_api
+    environment:
+      - PARALLEL_INFERENCES=4
+      - QUEUED_INFERENCES=4
+      - TORCH_THREADS=1
+      - FACE_MAX_FPS=5.5
+      - PREDICT_RATE_LIMIT=10
+      - PREDICT_RATE_WINDOW=60
+      - REVIEW_RATE_LIMIT=5
+      - REVIEW_RATE_WINDOW=60
+      - MAX_UPLOAD_MEGABYTES=15
+    cpus: "5"
+    mem_limit: 3g
 
 
   cnn_website:
@@ -48,4 +65,6 @@ services:
 
 networks:
   cnn_network:
-    name: cnn_network
+    name: cnn_network
+  gitea_network:
+    name: gitea_network

website/src/Bird_CNN.jsx

@@ -1,6 +1,38 @@
 import { useState, useRef } from 'react';
 import styles from './Bird_CNN.module.css';
 
+const MAX_SIDE = 1024;
+const JPEG_QUALITY = 0.9;
+
+// Shrinks the photo before upload. The model only uses 64x64 pixels, so this
+// keeps uploads small (~100-300 KB) without affecting the result. Falls back
+// to the original file if the browser can't decode or encode it.
+async function downscale(file) {
+    try {
+        const bitmap = await createImageBitmap(file, { imageOrientation: 'from-image' });
+        const scale = Math.min(1, MAX_SIDE / Math.max(bitmap.width, bitmap.height));
+        const w = Math.round(bitmap.width * scale);
+        const h = Math.round(bitmap.height * scale);
+
+        const canvas = document.createElement('canvas');
+        canvas.width = w;
+        canvas.height = h;
+        const ctx = canvas.getContext('2d');
+        ctx.fillStyle = '#fff'; // transparent PNGs would turn black as JPEG
+        ctx.fillRect(0, 0, w, h);
+        ctx.drawImage(bitmap, 0, 0, w, h);
+        bitmap.close();
+
+        const blob = await new Promise((resolve) =>
+            canvas.toBlob(resolve, 'image/jpeg', JPEG_QUALITY));
+
+        // Keep the original if re-encoding failed or somehow made it bigger.
+        return blob && blob.size < file.size ? blob : file;
+    } catch {
+        return file;
+    }
+}
+
 function Bird_CNN() {
     const apiUrl = process.env.NODE_ENV === "development"
         ? "https://api.marvinkrausser.com"
@@ -50,12 +82,13 @@ function Bird_CNN() {
 
         scrollRefClassifiction.current.scrollIntoView({ behavior: "smooth" });
 
-        const formData = new FormData();
-        formData.append("file", file);
-
         setLoading(true);
 
         try {
+            const upload = await downscale(file);
+            const formData = new FormData();
+            formData.append("file", upload, "image.jpg");
+
             const response = await fetch(`${apiUrl}/predict`, {
                 method: "POST",
                 body: formData,

website/src/Object_Detection.jsx

@@ -1,6 +1,10 @@
 import styles from './Object_Detection.module.css';
 import { useRef, useEffect, useState } from 'react'
 
+const FRAME_QUALITY = 0.7;
+
+const FRAMES_PER_SECOND = 5;
+
 function Object_Detection() {
     const videoRef = useRef(null);
     const canvasRefBBox = useRef(null);
@@ -66,7 +70,7 @@ function Object_Detection() {
             } catch (e) {
                 setError(true);
             }
-        }, "image/jpeg", 1);
+        }, "image/jpeg", FRAME_QUALITY);
     };
 
     const printDefault = () => {
@@ -123,7 +127,7 @@ function Object_Detection() {
             if (!canvas) return;
 
             ctx.clearRect(0, 0, canvas.width, canvas.height);
-            sendImageIntervall.current = setInterval(sendImage, 1000 / 2);
+            sendImageIntervall.current = setInterval(sendImage, 1000 / FRAMES_PER_SECOND);
         }
         socket.onmessage = (event) => {
             drawBBox(JSON.parse(event.data).bboxes);
@@ -176,7 +180,7 @@ function Object_Detection() {
             <h1 className='site-headline'>Face Detection</h1>
             <div className={styles["text-container-introduction"]}>
                 <p>
-                    The model's performance has been limited to 2 FPS due to low-end server hardware constraints.
+                    The model's performance has been limited to 5 FPS due to low-end server hardware constraints.
                 </p>
                 <p>
                     The webcam video is transmitted to a server for processing. The server does not store, train on, or use the data for any purpose other than face detection.