Make dither server more efficient

bin/dither/dither.rb

@@ -1,5 +1,6 @@
 require "sinatra"
 require "mini_magick"
+require "tempfile"
 
 MiniMagick.logger.level = Logger::DEBUG
 
@@ -16,17 +17,27 @@ get "/*" do |path|
   geometry = params["geo"] unless params["geo"] == ""
   geometry.gsub!(/\d+/) { |n| n.to_i * 2 } if geometry && !DITHER
 
-  decrypted = %x(
-    openssl \
-      aes-256-cbc \
-      -d \
-      -in #{ROOT}/#{path}.enc \
-      -pass file:#{KEY} \
-      -iter 1000000
+  decrypted = Tempfile.new(["dither", File.extname(path)])
+  decrypted.binmode
+  decrypted.close
+
+  begin
+    openssl_ok = system(
+      "openssl",
+      "aes-256-cbc",
+      "-d",
+      "-in", "#{ROOT}/#{path}.enc",
+      "-out", decrypted.path,
+      "-pass", "file:#{KEY}",
+      "-iter", "1000000"
     )
+    halt 500, {"Content-Type" => "text/plain"}, "decrypt failed" unless openssl_ok
 
     convert = MiniMagick::Tool::Convert.new
-  convert.stdin
+    convert.limit("memory", "128MiB")
+    convert.limit("map", "256MiB")
+    convert.limit("disk", "1GiB")
+    convert << decrypted.path
     convert.background("white")
     convert.layers("flatten")
     convert.strip
@@ -48,5 +59,8 @@ get "/*" do |path|
     end
 
     convert << "#{FORMAT.upcase}:-"
-  convert.call(stdin: decrypted)
+    convert.call
+  ensure
+    decrypted.unlink
+  end
 end