~/tools / Run a local LLM on your server / Ollama nginx Config Generator

Ollama nginx Config Generator — Build an nginx config for Ollama: HTTPS, basic auth, allow list, streaming

Build an nginx server block that puts Ollama behind a proxy: HTTPS with your certificate, a redirect from port 80, a password with basic authentication, an address allow list, and settings that let streamed answers arrive as they are written. It starts from the proxy example in the official Ollama FAQ and uses only directives from the nginx documentation. Nothing leaves your browser.

server {
    listen 80;
    server_name ollama.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name ollama.example.com;

    ssl_certificate /etc/ssl/ollama.crt;
    ssl_certificate_key /etc/ssl/ollama.key;

    auth_basic "ollama";
    auth_basic_user_file /etc/nginx/ollama.htpasswd;

    location / {
        proxy_pass http://localhost:11434;
        proxy_set_header Host localhost:11434;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_read_timeout 300s;
    }
}

sudo htpasswd -c /etc/nginx/ollama.htpasswd alice
sudo nginx -t
sudo nginx -s reload

Ollama listens only on the server itself by default, and the Ollama FAQ describes no authentication for it. When another machine has to reach it, the FAQ points to a proxy server such as nginx, with an example that forwards requests to http://localhost:11434 and sets the Host header to localhost:11434. This tool builds on that example with directives from the nginx documentation: listen 443 ssl with a certificate and key, a server on port 80 that redirects to HTTPS, auth_basic with a password file, allow and deny for addresses, client_max_body_size, proxy_http_version 1.1, proxy_buffering off for streaming, and proxy_read_timeout for a slow first answer. The combination is ours, not a single example from the documents, so we tested it: the output passed nginx -t on the official nginx 1.29.8 image and on nginx 1.24.0 from Ubuntu 24.04, and through nginx 1.29.8 we reached Ollama 0.40.11 only with the right password, saw a streamed answer arrive in 81 pieces, and got 403 from an address outside the allow list.

The core logic of this tool is open source under the MIT License. github.com/seigo5555/toolkitbox-lib/src/ollama-nginx.ts