Files
SnapOtterandGitHub d10d0f544f fix: release QA hardening across processing, media, security, and CI gates (#649)
A release-readiness QA pass over the whole product. The commits split into
defects a user would hit and gates that were reporting green while measuring
nothing.

## Fixes that change behaviour

Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so
request.ip came from a client-set header and a forged X-Forwarded-For got past
the login limiter. The default is now a private-network trust list.

A transient Postgres outage stranded in-flight jobs, leaving finished output on
disk with no row pointing at it. A reconciler now resolves those rows and adopts
the bytes rather than dropping the work.

A Redis connection that moved to a new address wedged every read-blocked
consumer, so completions stopped signalling while health still answered 200.
Socket timeouts plus subscriber pings recover it.

Installing more than one AI bundle left the shared venv multi-versioned and
silently broke three tools. The installer now reconciles distributions to one
version each.

Converting an image to JXL at quality 1 through 4 returned a 500, because
libjxl 0.7 rejects the distance those values compute. The quality is floored at
what the encoder honours. A missing ffmpeg was also reported to the user as a
corrupt upload; it now says the engine is unavailable.

RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at
0.22.2, and the release scan was split so it can fail on an unfixed critical
instead of hiding it behind ignore-unfixed.

## Gates that could not fail

Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs
build; coverage discarded its whole report on any failing test; the lint gate
skipped root tests, scripts, and two workspaces; and several generated matrices
counted a host missing ffmpeg as a passing tool. Each now measures what it
claims.

Full evidence and the outstanding release items are tracked locally and are not
part of this branch.
2026-07-27 15:37:30 +08:00

134 lines
9.1 KiB
Plaintext

# SnapOtter
SnapOtter is open-source, self-hosted file-processing infrastructure. It runs conversion, compression, OCR, transcription, metadata scrubbing, and local AI across image, video, audio, PDF, and documents, through a web UI, REST API, and automation pipelines. Everything runs on your own infrastructure; files never leave your network. Runs as a single container with embedded Postgres + Redis for quick start, or a Docker Compose stack for production. No external services. Dual-licensed AGPLv3 and commercial. The catalog spans 243 tool routes across the five modalities, plus a layer-based image editor.
All processing happens locally. Files never leave your infrastructure.
## Quick Start
Single container (embedded Postgres + Redis), the fastest way to start:
docker run -d --name SnapOtter -p 1349:1349 -v SnapOtter-data:/data snapotter/snapotter:latest
For production, run alongside PostgreSQL 17 and Redis 8 with Compose. Minimal compose.yaml:
services:
snapotter:
image: snapotter/snapotter:latest
ports: ["1349:1349"]
environment:
DATABASE_URL: postgres://snapotter:snapotter@postgres:5432/snapotter
REDIS_URL: redis://redis:6379
volumes: ["SnapOtter-data:/data"]
depends_on: [postgres, redis]
postgres:
image: postgres:17-alpine
environment:
POSTGRES_USER: snapotter
POSTGRES_PASSWORD: snapotter
POSTGRES_DB: snapotter
volumes: ["SnapOtter-pgdata:/var/lib/postgresql/data"]
redis:
image: redis:8-alpine
volumes: ["SnapOtter-redisdata:/data"]
volumes:
SnapOtter-data:
SnapOtter-pgdata:
SnapOtter-redisdata:
Then run docker compose up -d, open http://localhost:1349, and log in with admin / admin (you must change it on first login). Add an NVIDIA GPU device reservation to the snapotter service for AI acceleration. Multi-arch: AMD64 and ARM64 (Intel, Apple Silicon, Raspberry Pi).
## Tools
243 catalog tool routes across 5 modalities: image, video, audio, PDF, and files. The AI tools run locally on your hardware with no cloud APIs.
### Image
Resize Image, Crop Image, Rotate & Flip Image, Convert Image, Compress Image, Optimize for Web, Remove Image Metadata, Edit Image Metadata, Bulk Rename, Image to PDF, Favicon Generator, Adjust Colors, Sharpen Image, Replace & Invert Color, Color Blindness Simulation, Remove Background, Remove GIF Background, Image Upscaling, Object Eraser, Extract Text from Image (OCR), Blur Faces & PII, Smart Crop, Image Enhancement, Face Enhancement, AI Colorization, Noise Removal, Red Eye Removal, Photo Restoration, Passport Photo, Content-Aware Resize, AI Canvas Expand, PNG Transparency Fixer, Background Replace, Blur Background, Text Watermark, Image Watermark, Text Overlay, Image Composition, Meme Generator, Image Info, Image Compare, Find Duplicates, Color Palette, QR Code Generator, HTML to Image, Barcode Reader, Image to Base64, Barcode Generator, Collage & Grid, Stitch Images, Split Image, Border & Frame, Beautify Screenshot, Circle Crop, Rounded Crop, Duotone, Image Pad, Pixelate, Vignette, GIF/WebP Converter, Histogram, LQIP Placeholder, Sprite Sheet, SVG to Raster, Image to SVG, GIF Tools. Plus format converters: JPG to PNG, PNG to JPG, JPG to WebP, PNG to WebP, WebP to JPG, WebP to PNG, JPG to AVIF, PNG to AVIF, WebP to AVIF, HEIC to JPG, HEIC to PNG, HEIC to AVIF, JPG to GIF, PNG to GIF, GIF to JPG, GIF to PNG, WebP to GIF, JPG to TIFF, PNG to TIFF, TIFF to JPG, TIFF to PNG, PSD to JPG, PSD to PNG, PNG to EPS, JPG to EPS, EPS to PNG, EPS to JPG, PNG to SVG, JPG to SVG, TIFF to SVG, PSD to SVG, EPS to SVG, SVG to PNG, SVG to JPG, JPG to PDF, PNG to PDF, HEIC to PDF, TIFF to PDF, WebP to PDF, GIF to PDF, EPS to PDF.
### Video
Auto Subtitles, Convert Video, Compress Video, Trim Video, Mute Video, Video to GIF, Resize Video, Crop Video, Rotate Video, Change FPS, Video Color, Video Speed, Reverse Video, Normalize Video Audio, Aspect Pad, Blur Pad, Watermark Video, Stabilize Video, GIF to Video, Video to WebP, Video to Frames, Merge Videos, Replace Audio, Burn Subtitles, Embed Subtitles, Extract Subtitles, Images to Video, Clean Video Metadata, Extract Audio. Plus format converters: MOV to MP4, WEBM to MP4, MKV to MP4, AVI to MP4, MP4 to MOV, MP4 to WEBM, WEBM to MOV, MKV to MOV, AVI to MOV, MP4 to AVI, MOV to AVI, MKV to AVI, AVI to MKV, MP4 to GIF, MOV to GIF, MKV to GIF, AVI to GIF, GIF to MP4, GIF to WEBM, GIF to MOV, MP4 to MP3, MOV to MP3, MKV to MP3, WEBM to MP3, AVI to MP3, MP4 to WAV, MOV to WAV, MP4 to OGG.
### Audio
Transcribe Audio, Convert Audio, Trim Audio, Adjust Volume, Normalize Audio, Fade Audio, Reverse Audio, Audio Speed, Pitch Shift, Audio Channels, Silence Removal, Noise Reduction, Merge Audio, Split Audio, Ringtone Maker, Waveform Image, Audio Metadata. Plus format converters: M4A to MP3, M4A to WAV, AAC to MP3, AAC to WAV, AAC to FLAC, OGG to MP3, OGG to WAV, WAV to MP3, MP3 to WAV, FLAC to MP3.
### PDF
PDF OCR, PDF to Image, Merge PDFs, Split PDF, Compress PDF, Rotate PDF, Extract Pages, Remove Pages, Organize PDF, Protect PDF, Unlock PDF, Repair PDF, Web-Optimize PDF, Grayscale PDF, PDF/A Converter, Crop PDF, Pages Per Sheet (N-up), Booklet PDF, Watermark PDF, PDF Page Numbers, Flatten PDF, Redact PDF, Sign PDF, PDF to Text, PDF to Word, PDF Metadata. Plus format converters: PDF to JPG, PDF to PNG, PDF to TIFF.
### Files
Convert Document, Convert Presentation, Convert Spreadsheet, Excel to PDF, Word to PDF, PowerPoint to PDF, HTML to PDF, Markdown to Word, Markdown to HTML, Markdown to PDF, Convert from EPUB, Convert to EPUB, Chart Maker, CSV to Excel, CSV to JSON, JSON to XML, Split CSV, Merge CSVs, Convert YAML / JSON, XML to CSV, Create ZIP, Extract ZIP. Plus format converters: Excel to CSV.
## Local AI (all on your hardware, no cloud APIs)
Background removal (rembg), image upscaling 2x/4x (RealESRGAN), object eraser (LaMa inpainting), OCR for images and PDFs (built-in Tesseract plus an optional RapidOCR/ONNX accuracy pack), speech transcription and auto subtitles (faster-whisper), face and PII blur plus face enhancement (MediaPipe), AI colorization, noise removal, red-eye removal, photo restoration, smart crop, content-aware resize, and AI canvas expand (outpainting). Built-in Fast OCR adds about 25 MiB to the official image; optional model bundles install on demand.
## REST API
Base URL: http://localhost:1349/api/v1
Interactive docs: http://localhost:1349/api/docs (Scalar UI)
OpenAPI YAML: http://localhost:1349/api/v1/openapi.yaml
Runtime LLM summary: http://localhost:1349/llms.txt
Full plain-text API docs: http://localhost:1349/llms-full.txt
Authentication methods:
- Session cookie (browser login)
- Bearer token: Authorization: Bearer si_<key> (API keys are prefixed si_)
API keys support scoped permissions that intersect with user role permissions.
Processing a file:
POST /api/v1/tools/:section/:toolId
Content-Type: multipart/form-data
Body: file (binary), settings (JSON string), optional clientJobId, optional fileId
Fast response: { jobId, downloadUrl, originalSize, processedSize }
Async response: { jobId, async: true }
Fast tools usually return 200, but any queued tool can return 202 if it exceeds the synchronous wait window. Long-running tools and queued jobs stream progress via SSE:
GET /api/v1/jobs/:jobId/progress (EventSource)
Pipelines (chained tool workflows):
POST /api/v1/pipeline/execute (run a pipeline on uploaded files)
POST /api/v1/pipeline/save
GET /api/v1/pipeline/list
DELETE /api/v1/pipeline/:id
POST /api/v1/pipeline/batch
Batch processing: POST /api/v1/tools/:section/:toolId/batch (multiple files in, ZIP archive out).
Surrounding APIs:
- Auth: local login, OIDC, SAML, MFA, users, sessions, API keys
- Files: uploads, library versions, downloads, thumbnails, previews, URL imports
- Admin: health, readiness, metrics, log level, support bundles, usage, backup status, AI bundles
- Enterprise: audit export, config import/export, IP allowlist, legal hold, SCIM, SIEM, webhooks, GDPR lifecycle, upgrade checks
## Tech Stack
Frontend: React 19, Vite 8, Tailwind CSS 4, Zustand
Backend: Fastify 5; Sharp (images), FFmpeg (video/audio), qpdf and LibreOffice (documents); Drizzle ORM on PostgreSQL 17; BullMQ on Redis 8 for durable async jobs
AI/ML: Python sidecar (rembg, RealESRGAN, RapidOCR/ONNX Runtime, faster-whisper, MediaPipe, LaMa) plus native Tesseract OCR
Auth: Session-based with OIDC/SSO support (Google, GitHub, Okta, any OIDC provider)
Languages: 21 locales with RTL support
## Key Features
- Pipelines: chain tools into reusable workflows, import/export as JSON
- Batch processing: process hundreds of files at once, ZIP output
- Image editor: layer-based editor with brushes, shapes, filters, curves
- OIDC/SSO: Google, GitHub, Okta, or any OpenID Connect provider
- Role-based access: admin, editor, user roles with 17 granular permissions
- Custom roles and API key scoping
## Links
- Source code: https://github.com/snapotter-hq/snapotter
- Documentation: https://docs.snapotter.com
- Live demo: https://demo.snapotter.com
- Docker Hub: https://hub.docker.com/r/snapotter/snapotter
- GHCR: ghcr.io/snapotter-hq/snapotter
- Discord: https://discord.gg/hr3s7HPUsr
- Website: https://snapotter.com