map_hash_bucket_size 128;

map $http_authorization $ollama_auth_ok {
    "Bearer ${OLLAMA_AUTH_TOKEN}" 1;
    default 0;
}

server {
    listen 11434;

    location / {
        if ($ollama_auth_ok = 0) {
            return 401;
        }

        # Docker's embedded DNS (127.0.0.11) can reassign the "ollama"
        # hostname to a new container IP on restart. proxy_pass to a
        # literal upstream caches that IP for the container's lifetime;
        # routing through a variable forces nginx to re-resolve via this
        # resolver on each request instead, so a restarted ollama doesn't
        # need a matching ollama-auth restart to be reachable again.
        resolver 127.0.0.11 valid=10s;
        set $ollama_upstream ollama;
        proxy_pass http://$ollama_upstream:11434;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_buffering off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        client_max_body_size 0;
    }
}