Secure Ollama API Deployment with Nginx Reverse Proxy

🚀 Secure Ollama API with Nginx — Deployment Guide

Deploy Ollama behind Nginx with HTTPS (SSL) and Basic Authentication using Docker Compose.

🔧 Step 1: Create Certificates and Auth

mkdir -p nginx/certs nginx/auth
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout nginx/certs/server.key \
  -out nginx/certs/server.crt \
  -subj "/CN=192.168.0.6"

htpasswd -cb nginx/auth/.htpasswd admin yourpassword

🧩 Step 2: Nginx Configuration

events {}
http {
  server {
    listen 443 ssl;

    ssl_certificate     /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;

    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/auth/.htpasswd;

    location / {
      proxy_pass http://ollama:11434;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  }
}

📦 Step 3: Docker Compose Setup

version: '3'
services:
  ollama:
    image: ollama/ollama
    container_name: ollama
    restart: unless-stopped
    networks:
      - internal
    volumes:
      - ollama-data:/root/.ollama

  nginx:
    image: nginx:alpine
    container_name: nginx-secure
    restart: unless-stopped
    ports:
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/auth:/etc/nginx/auth:ro
      - ./nginx/certs:/etc/nginx/certs:ro
    depends_on:
      - ollama
    networks:
      - internal

volumes:
  ollama-data:

networks:
  internal:
    driver: bridge

⚙️ Step 4: Run & Test

docker-compose up -d
docker exec -it ollama ollama pull llama3

curl -k -u admin:yourpassword https://192.168.0.6/api/generate -d '{
  "model": "llama3",
  "prompt": "What is the capital of France?"
}'

✅ Expected Output: The capital of France is Paris.

🔍 Health Check Summary

Component	Command	Expected
Nginx	docker ps | grep nginx-secure	Container running
Ollama	docker ps | grep ollama	Container running
Model	docker exec ollama ollama list	Shows llama3
SSL Access	curl -k https://192.168.0.6	403 Forbidden
Auth Access	curl -k -u admin:yourpassword https://192.168.0.6	Success

💡 Pro Tip: For public deployments, replace self-signed SSL with Let's Encrypt and rotate passwords frequently.

---

© 2025 • Secure Ollama API Deployment • Made with 💚 by Sidhesh