Your local Ollama has no API key. Here’s how to require one (Caddy or nginx) and still use Open WebUI, n8n and OpenAI clients

说明与用途

该方案通过 Caddy 或 nginx 反向代理，要求在 Authorization: Bearer 头中提供令牌，以保护本地 Ollama 实例，同时保持与 OpenAI 风格客户端的兼容性。

问题

Ollama’s local API on port 11434 is unauthenticated, exposing GPU resources to any host that can reach the port when OLLAMA_HOST is set to 0.0.0.0.

结果

The recipe enables secure access to a local Ollama instance by requiring a bearer token via a reverse proxy, preventing unauthorized use while maintaining compatibility with existing OpenAI‑style clients.

工作流

• Generate a 32‑byte hex key with openssl rand -hex 32
• Configure Caddy or nginx to listen on a public domain and proxy to 127.0.0.1:11434
• Set the proxy to match the Authorization header exactly and reject others with 401
• Strip the Authorization header before forwarding to Ollama
• Test the proxy with curl to confirm 401 on missing key and success on correct key
• Verify that external access to 127.0.0.1:11434 fails when the proxy is active
• Configure n8n, Open WebUI, OpenAI SDK, and ollama‑python to use the proxy URL and the generated key

证据

The local API at http://localhost:11434 does not require authentication.

来源

From then on, anyone who can reach port 11434 can run prompts on your GPU and pull, create or delete models.

来源

The Caddyfile now holds a secret, so make it readable only by root and Caddy.

来源