Exactly. If the pict-rs dev allowed us to run an executable on each image before accepting it, it would make things much easier

You might be able however integrate with my AI Horde endpoint for NSFW checking between nginx and Lemmy.

https://aihorde.net/api/v2/interrogate/async

This might allow you to detect NSFW images before they are hosted

Just send a payload like this

curl -X 'POST' \
  'https://aihorde.net/api/v2/interrogate/async' \
  -H 'accept: application/json' \
  -H 'apikey: 0000000000' \
  -H 'Client-Agent: unknown:0:unknown' \
  -H 'Content-Type: application/json' \
  -d '{
  "forms": [
    {
      "name": "nsfw"
      }
  ],
  "source_image": "https://lemmy.dbzer0.com/pictrs/image/46c177f0-a7f8-43a3-a67b-7d2e4d696ced.jpeg?format=webp&thumbnail=256"
}'

Then retrieve the results asynchronously like this

{
  "state": "done",
  "forms": [
    {
      "form": "nsfw",
      "state": "done",
      "result": {
        "nsfw": false
      }
    }
  ]
}

or you could just run the nsfw model locally if you don't have so many uploads.

if you know a way to pre-process uploads before nginx sends them to lemmy, it might be useful