Api2Pdf

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the document conversion service that replaces Api2Pdf.

The useful idea is the wrapper: **one endpoint, several engines, chosen by what came in.** That routing is the whole design.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- Playwright with Chromium for HTML, LibreOffice headless for Office documents, ImageMagick and Ghostscript for the rest
- Caddy in front

THE ROUTER
- HTML or a URL goes to Chromium
- .docx, .xlsx, .pptx and .odt go to LibreOffice headless
- Images go to ImageMagick; PDF merging, splitting and compression to Ghostscript or qpdf
- **Detect the type from the bytes, never from the extension.** It decides which engine runs, and letting the caller choose is how you feed a crafted file to the wrong tool

THE ENGINES, EACH WITH ITS OWN TRAP
- **Chromium**: recycle the pool, wait for fonts, kill on timeout, block internal addresses after redirects
- **LibreOffice**: it is slow, it is single-threaded per instance, and it occasionally hangs. Run it in a subprocess with a hard timeout and a kill, one document at a time per worker. **Fonts must be installed on the machine** or a Word document renders in a substitute and the layout moves
- **Ghostscript and ImageMagick**: both have had serious vulnerabilities involving crafted input files. Keep them current, run them with a restrictive policy file, and never pass caller-controlled options through to the command line

SAFETY, WHICH IS THE MAIN EVENT HERE
- **You are running four programs over files strangers send you.** Every one of them is an attack surface with a history
- Each conversion in its own container or namespace, unprivileged, with no network, a memory limit, a CPU limit and a wall-clock limit
- Never build a shell command from user input. Pass arguments as an array, always
- Size, page count and dimension caps before anything starts
- Delete the input immediately after conversion

THE API
- POST returns a job id; everything queued, nothing rendered in the request
- Per-engine concurrency limits, because LibreOffice and Chromium have completely different capacity profiles
- A queue depth limit that returns a clear error when full
- Signed expiring URLs for output, and a retention sweeper that actually deletes

OPERATIONS
- Per-engine duration percentiles, timeout rate and failure rate. **The timeout rate per engine tells you which one needs more capacity** and they never need it at the same time
- Store the input hash and deduplicate

WHAT MATTERS MOST
Sandboxing each engine and detecting the type from the bytes. This service's job is running risky software on untrusted files, and everything else is secondary to containing that.