Server Authentication Setup

Install Required Tools

First, ensure Nginx and Apache utilities (for generating password files) are installed:

# Ubuntu/Debian
sudo apt update
sudo apt install nginx apache2-utils

# macOS
brew install nginx

Create Password File

Use the htpasswd command to create authentication users and passwords:

sudo htpasswd -c /etc/nginx/.htpasswd username

The system will prompt you to enter a password. To add more users, omit the -c flag:

sudo htpasswd /etc/nginx/.htpasswd another_user

Configure Nginx Reverse Proxy

Create or edit the Nginx configuration file (e.g., /etc/nginx/sites-available/ollama):

server {
    listen 8080;
    server_name your-server-domain.com;

    location / {
        # Enable Basic Auth
        auth_basic "Ollama Server";
        auth_basic_user_file /etc/nginx/.htpasswd;

        # Proxy to Ollama default port
        proxy_pass http://localhost:11434;

        # Required proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Handle WebSocket connections (if needed)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeout settings (large model inference may take time)
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
    }
}

Enable and Restart Nginx

# Create symbolic link (Ubuntu/Debian)
sudo ln -s /etc/nginx/sites-available/ollama /etc/nginx/sites-enabled/

# Test configuration
sudo nginx -t

# Restart Nginx
sudo systemctl restart nginx

Test Authentication Setup

Use curl to test if Basic Auth is working properly:

# Test unauthenticated request (should fail)
curl http://localhost:8080/api/tags

# Test authenticated request (should succeed)
curl -u username:password http://localhost:8080/api/tags

A successful response should return a list of models; failure will return a 401 Unauthorized error.

Install Caddy

# Ubuntu/Debian
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

# macOS
brew install caddy

Generate Password Hash

caddy hash-password

After entering your password, copy the generated hash.

Configure Caddyfile

Create or edit /etc/caddy/Caddyfile:

:8080 {
    basicauth {
        username $2a$14$hashed_password_here
    }

    reverse_proxy localhost:11434
}

Replace $2a$14$hashed_password_here with the password hash generated earlier.

Restart Caddy

sudo systemctl restart caddy

Open Server Settings

Click the Settings icon in the sidebar, then select the Servers tab.

Add or Edit Server

Click the "Add Server" button, or edit an existing server.

Pick an Authentication Scheme

In the server form, fill in the basics first:

1. Server Name: Give the server an easily recognizable name
2. Server URL: Enter the proxy or gateway address (e.g. http://192.168.1.100:8080)

Then, in the Authentication section, use the segmented control to pick the scheme that matches your server:

None

The default. No credentials are sent. Suitable for local or trusted intranet environments.

Basic

Matches Nginx/Caddy Basic Auth on the server side:

• Username: the auth username
• Password: the auth password (click the 👁 icon on the right to reveal it)

Bearer

Matches API gateways or Cloudflare Tunnel setups that require a Bearer token:

• Token: paste your access token (click the 👁 icon to reveal it)
• If you accidentally include a Bearer prefix, it's stripped automatically so you won't end up with Bearer Bearer xxx

Custom

Matches gateways like Cloudflare Access that don't use the Authorization header:

• Click "Add Header" to add a key/value pair
• Typical example: Cloudflare Access service tokens CF-Access-Client-Id and CF-Access-Client-Secret
• Multiple header pairs can be added at once

Test Connection

Click the "Test Connection" button.

If the authentication information is correct, you'll see:

• Connected: Green indicator
• Server version information

If authentication fails, it will display:

• Connection Failed: Red indicator
• Error message (usually "401 Unauthorized")

Save Configuration

After a successful test, click the "Save" button.