Chad Feierstein

Linux - Ollama Installation

En ëmfassenden Schrëtt-fir-Schrëtt Guide fir Ollama op Debian 12 ze installéieren mat Apache2 Reverse Proxy, SSL-Verschlësselung an HTTP Basic Authentication fir sécher ëffentlech API-Notzung.

Debian 12OllamaApache2SSL/TLSAPI

Wichteg Hiweiser

Bedenkt dës wichteg Punkten virum Setup

Root-Zougang Erfuerderlech

Root-Zougang oder sudo-Berechtigungen sinn fir all Installatiounsschrëtt erfuerderlech

Domain Erfuerderlech

Eng gëlteg Domain mat DNS-Konfiguratioun ass néideg fir SSL-Zertifikater

Firewall-Konfiguratioun

Maacht d'Porten 80 an 443 an Ärer Firewall op fir HTTP/HTTPS-Zougang

Séchert Passwuert

Benotzt e staarkt Passwuert fir d'API-Authentifizéierung

Backup Erstellen

Sécheréiert all Konfiguratiounsdateien ier Dir wichteg Ännerungen maacht

Hardware-Ufuerderungen

Op d'mannst 8GB RAM sinn recommandéiert fir Ollama-Modeller ze bedreiwen

Setup Schrëtt

Update package lists again
apt update -y && apt upgrade -y
Install basic packages
apt install sudo curl
Download and install Ollama
curl -fsSL https://ollama.com/install.sh | sh
Download and test small test model
ollama run gemma3:4b
Open Ollama service configuration
systemctl edit ollama.service
override.conf
[Service]
Environment="OLLAMA_NUM_PARALLEL=6"
Environment="OLLAMA_MAX_QUEUE=512"
Environment="OLLAMA_MAX_LOADED_MODELS=3"
Reload systemd manager
sudo systemctl daemon-reexec
Reload Ollama service
sudo systemctl daemon-reload
Restart Ollama service
sudo systemctl restart ollama
Check if Ollama is listening on port 11434
sudo ss -tulpen | grep 11434
Install Apache2 and SSL modules
sudo apt update && sudo apt install apache2 apache2-utils -y
Enable required Apache modules
sudo a2enmod proxy proxy_http ssl headers rewrite
Restart Apache2
sudo systemctl restart apache2
Install Certbot for Let's Encrypt
sudo apt install certbot python3-certbot-apache -y
Request SSL certificate for domain
sudo certbot --apache -d server.chad.lu --register-unsafely-without-email
Create directory for auth files
sudo mkdir -p /etc/apache2/htpasswd
Create user with password for HTTP Basic Auth
sudo htpasswd -c /etc/apache2/htpasswd/ollama-api.htpasswd apiuser
Note: Enter a secure password when prompted
server.chad.lu.conf
<VirtualHost *:80>
    ServerName server.chad.lu
    Redirect permanent / https://server.chad.lu/
</VirtualHost>

<VirtualHost *:443>
    ServerName server.chad.lu
    DocumentRoot /var/www/server.chad.lu

    <Directory /var/www/server.chad.lu>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Rewrite-Rule for redirect outside of /ollama/
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/ollama/
    RewriteRule ^ https://www.chad.lu%{REQUEST_URI} [R=301,L]

    # Proxy Ollama API
    ProxyPreserveHost On
    ProxyPass "/ollama/" "http://localhost:11434/"
    ProxyPassReverse "/ollama/" "http://localhost:11434/"

    <Location "/ollama/">
        AuthType Basic
        AuthName "Ollama API"
        AuthUserFile /etc/apache2/htpasswd/ollama-api.htpasswd
        Require valid-user
    </Location>

    # SSL configuration
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/server.chad.lu/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/server.chad.lu/privkey.pem

    # Security headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
</VirtualHost>
Enable new site configuration
sudo a2ensite server.chad.lu.conf
Disable default Apache site
sudo a2dissite 000-default.conf
Disable default SSL site
sudo a2dissite 000-default-le-ssl.conf
Reload Apache configuration
sudo systemctl reload apache2
Test API endpoint with curl
curl -u apiuser https://server.chad.lu/ollama/api/generate -H "Content-Type: application/json" -d '{"model": "gemma3:4b", "prompt": "Erzähl mir eine Geschichte.", "stream": true}'
Note: You will be prompted for the 'apiuser' password. On successful test, you will receive JSON responses with generated text fragments.

Problemléisung

Heefeg Problemer an hir Léisungen

Installation ofgeschloss!

Äre Ollama-Server ass elo komplett konfiguréiert a mat HTTPS a Basic Authentication geséchert. Dir kënnt elo sécher op d'API zougräifen.