open-webui/ollama-auth/default.conf.template

map_hash_bucket_size 128;

map $http_authorization $ollama_auth_ok {
    "Bearer ${OLLAMA_AUTH_TOKEN}" 1;
    default 0;
}

server {
    listen 11434;

    location / {
        if ($ollama_auth_ok = 0) {
            return 401;
        }

        # Ollama itself now serves no models -- this proxy targets
        # llama-mtp (the relaxed-MTP server) instead, so LAN clients that
        # already trust this URL/token (e.g. Home Assistant's voice
        # pipeline) don't need reconfiguring. Docker's embedded DNS
        # (127.0.0.11) can reassign a container hostname to a new IP on
        # restart; proxy_pass to a literal upstream caches that IP for the
        # container's lifetime, so route through a variable to force
        # nginx to re-resolve via this resolver on each request instead.
        resolver 127.0.0.11 valid=10s;
        set $mtp_upstream llama-mtp;
        proxy_pass http://$mtp_upstream:8030;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        # Client presents OLLAMA_AUTH_TOKEN (validated above); llama-server
        # behind this proxy expects its own MTP_AUTH_TOKEN instead, so swap
        # it here rather than requiring every client to be reconfigured.
        proxy_set_header Authorization "Bearer ${MTP_AUTH_TOKEN}";
        proxy_buffering off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        client_max_body_size 0;
    }
}