05 — Production: From Personal Setup to Team Deployment

# Option A: Allow sign-up (good for small teams)
docker run -d -p 3000:8080 \
 -v open-webui:/app/backend/data \
 -e OLLAMA_BASE_URL=http://host.docker.internal:11434 \
 -e WEBUI_NAME="Team AI" \
 -e ENABLE_SIGNUP=true \
 --name open-webui --restart always \
 ghcr.io/open-webui/open-webui:main

# Option B: Invite-only (recommended for production)
# Same as above, but set:
-e ENABLE_SIGNUP=false

# Edit the Ollama service configuration
sudo mkdir -p /etc/systemd/system/ollama.service.d
cat > /etc/systemd/system/ollama.service.d/override.conf << 'EOF'
[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"
EOF

# Reload and restart
sudo systemctl daemon-reload
sudo systemctl restart ollama

# Add to ~/.zshrc or ~/.bashrc
export OLLAMA_HOST=0.0.0.0:11434
# Then restart Ollama from the menu bar icon

docker run -d \
 -p 11434:11434 \
 -v ollama:/root/.ollama \
 --name ollama \
 --restart always \
 ollama/ollama

# Install nginx and create a password file
sudo apt-get install nginx apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd admin
# Enter a strong password when prompted

# Optional: add more users
sudo htpasswd /etc/nginx/.htpasswd teammate1

# /etc/nginx/sites-available/ollama
server {
 listen 8080;
 server_name _;

 # === Authentication ===
 # Every request must provide a valid username:password
 auth_basic "Ollama API — Authorized Access Only";
 auth_basic_user_file /etc/nginx/.htpasswd;

 # === Rate Limiting ===
 # Max 30 requests per minute per IP address
 limit_req zone=ollama burst=5 nodelay;
 limit_req_status 429;

 location / {
 proxy_pass http://127.0.0.1:11434;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;

 # Increase timeout for long-running model generations
 proxy_read_timeout 300;
 proxy_send_timeout 300;
 }
}

# Define the rate limit zone (in http block, usually /etc/nginx/nginx.conf)
# limit_req_zone $binary_remote_addr zone=ollama:10m rate=30r/m;

# Enable the site and restart nginx
sudo ln -s /etc/nginx/sites-available/ollama /etc/nginx/sites-enabled/
sudo nginx -t # Test config for syntax errors
sudo systemctl restart nginx

# Without auth — should get 401 Unauthorized
curl -sk http://your-server-ip:8080/api/tags

# With auth — should work
curl -sk -u admin:yourpassword http://your-server-ip:8080/api/tags

# Send a chat request via API
curl -sk -u admin:yourpassword \
 -X POST http://your-server-ip:8080/api/chat \
 -d '{
 "model": "qwen2.5:7b",
 "messages": [{"role": "user", "content": "Say hello in one word"}],
 "stream": false
 }'

# Using the OpenAI Python library with Ollama
curl -sk -u admin:yourpassword \
 -X POST http://your-server-ip:8080/v1/chat/completions \
 -H "Content-Type: application/json" \
 -d '{
 "model": "qwen2.5:7b",
 "messages": [{"role": "user", "content": "Hello!"}]
 }'

# 1. Ollama (model server)
docker run -d \
 -p 11434:11434 \
 -v ollama:/root/.ollama \
 --name ollama \
 --restart always \
 ollama/ollama

# What this does:
# - `-d` → run in background (detached mode)
# - `-p 11434:11434` → map port 11434 from container to your machine
# - `-v ollama:/root/.ollama` → save models to a persistent volume
# (without this, models disappear when the container is recreated)
# - `--restart always` → auto-start on boot and after crashes

# 2. Open WebUI (chat interface, connects to Ollama)
docker run -d \
 -p 3000:8080 \
 -v open-webui:/app/backend/data \
 -e OLLAMA_BASE_URL=http://ollama:11434 \
 --name open-webui \
 --restart always \
 ghcr.io/open-webui/open-webui:main

# If Ollama and WebUI are on different machines:
# -e OLLAMA_BASE_URL=http://YOUR_SERVER_IP:11434

version: "3.8"

services:
 # === Model Server ===
 ollama:
 image: ollama/ollama:latest
 container_name: ollama
 restart: always
 ports:
 - "11434:11434"
 volumes:
 - ollama_data:/root/.ollama
 environment:
 - OLLAMA_HOST=0.0.0.0:11434
 # 🖥️ GPU support (remove this section if you don't have NVIDIA GPU)
 deploy:
 resources:
 reservations:
 devices:
 - driver: nvidia
 count: all
 capabilities: [gpu]

 # === Web Interface ===
 open-webui:
 image: ghcr.io/open-webui/open-webui:main
 container_name: open-webui
 restart: always
 ports:
 - "3000:8080"
 volumes:
 - open_webui_data:/app/backend/data
 environment:
 - OLLAMA_BASE_URL=http://ollama:11434
 - WEBUI_NAME=My Local AI
 - ENABLE_SIGNUP=false
 depends_on:
 - ollama

 # === Optional: AnythingLLM (RAG) ===
 anythingllm:
 image: mintplexlabs/anythingllm:latest
 container_name: anythingllm
 restart: always
 ports:
 - "3001:3001"
 volumes:
 - anythingllm_data:/app/server/storage
 environment:
 - LLM_PROVIDER=ollama
 - OLLAMA_BASE_PATH=http://ollama:11434
 - OLLAMA_MODEL_PREF=qwen2.5:7b
 - EMBEDDING_PROVIDER=ollama
 - OLLAMA_EMBEDDING_MODEL=qwen2.5:7b
 depends_on:
 - ollama

volumes:
 ollama_data:
 open_webui_data:
 anythingllm_data:

# Start everything
cd /path/to/your/project
docker compose up -d

# Check if containers are running
docker compose ps

# View logs
docker compose logs -f ollama

# Pull a model
docker exec ollama ollama pull qwen2.5:7b

# Stop everything
docker compose down

# Update images (when new versions are available)
docker compose pull
docker compose up -d

# Check if Ollama is running
curl -s http://localhost:11434/api/tags | python3 -c "import sys,json; models=json.load(sys.stdin); print(f'{len(models[\"models\"])} models loaded')"

# Check GPU usage (NVIDIA only)
watch -n 2 nvidia-smi

# Check RAM usage
free -h

# Check Docker container status
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# See real-time Ollama logs
docker logs -f ollama

# See Open WebUI logs
docker logs -f open-webui

# Save logs to a file (searchable later)
docker logs ollama > ~/ollama-logs-$(date +%Y%m%d).txt 2>&1

# Count API requests per hour from Ollama logs
docker logs ollama 2>&1 | grep "\[API\]" | \
 awk '{print $1}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10

# === Local Setup — One-Time Cost ===
RTX 4090 (or used RTX 3090) $1,500–2,500
Rest of PC (if needed) $500–1,000
Total upfront: $2,000–3,500

# === Local — Monthly Costs ===
Electricity (0.4 kWh × 8h/day × $0.15) ~$18/month
Internet (negligible) $0
Total monthly: ~$18/month

# === Cloud — Monthly Costs ===
ChatGPT Pro / Claude Pro $200/month
API calls (heavy user) $50–100/month
Total monthly: $200–300/month

Break-even (months) = Hardware Cost / (Cloud monthly cost - Local monthly cost)

Example with RTX 4090 ($2,500) vs ChatGPT Pro ($200):
$2,500 / ($200 - $18) = 13.7 months

 # Allow only local network access (192.168.x.x)
 sudo ufw allow from 192.168.0.0/16 to any port 11434
 sudo ufw deny 11434 # Block external access

 # If using nginx reverse proxy (port 8080), allow from VPN only
 sudo ufw allow from 10.0.0.0/8 to any port 8080

 ollama --version
 # Compare with https://github.com/ollama/ollama/releases

#!/bin/bash
# save as: security-audit.sh && chmod +x security-audit.sh

echo "=== Local LLM Security Audit ==="

# Check 1: Is Ollama exposed?
EXTERNAL_CHECK=$(curl -s -o /dev/null -w "%{http_code}" \
 http://localhost:11434/api/tags 2>/dev/null)
if [ "$EXTERNAL_CHECK" == "200" ]; then
 echo "⚠️ Ollama API is accessible (port 11434)"
 echo " If this machine has a public IP, the world can run models on your GPU!"
else
 echo "✅ Ollama API is not accessible"
fi

# Check 2: Is there authentication?
AUTH_CHECK=$(curl -s -o /dev/null -w "%{http_code}" \
 http://localhost:8080/api/tags 2>/dev/null)
if [ "$AUTH_CHECK" == "401" ]; then
 echo "✅ Reverse proxy auth is working"
elif [ "$AUTH_CHECK" == "200" ]; then
 echo "⚠️ No authentication on port 8080"
else
 echo "ℹ️ No reverse proxy detected on port 8080"
fi

# Check 3: Firewall status
if command -v ufw &>/dev/null; then
 echo "--- UFW Status ---"
 sudo ufw status verbose
fi

# Check 4: GPU usage (snapshot)
if command -v nvidia-smi &>/dev/null; then
 echo "--- GPU ---"
 nvidia-smi --query-gpu=name,memory.used,memory.total,temperature.gpu \
 --format=csv,noheader
fi

 ┌──────────────┐
 │ Internet │
 └──────┬───────┘
 │
 ┌──────▼───────┐ ┌──────────────┐
 │ Nginx Proxy │────▶│ htpasswd Auth │
 │ (port 8080) │ └──────────────┘
 └──────┬───────┘
 │ (internal network only)
 ┌──────▼───────┐
 │ Ollama │
 │ (port 11434)│
 └──────┬───────┘
 │
 ┌─────────┼─────────┐
 │ │ │
 ┌──────▼──┐ ┌───▼────┐ ┌──▼──────┐
 │Open WebUI│ │Anything│ │ Custom │
 │ (3000) │ │ LLM │ │ Apps │
 └─────────┘ └────────┘ └─────────┘