feat(krz01): add a NGINX in front of ollama protected by password

This way, you can do direct requests to ollama from other places.

Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>

machines/krz01/_configuration.nix

@@ -12,11 +12,11 @@ lib.extra.mkConfig {
 
   enabledServices = [
     # INFO: This list needs to stay sorted alphabetically
+    # Machine learning API machine
+    "microvm-ml01"
     "microvm-router01"
     "nvidia-tesla-k80"
     "proxmox"
-    # Machine learning API machine
-    "microvm-ml01"
   ];
 
   extraConfig = {
@@ -57,7 +57,23 @@ lib.extra.mkConfig {
         ];
       }))
     ];
-    services.ollama = {
+
+    services = {
+      nginx = {
+        enable = true;
+        recommendedProxySettings = true;
+        virtualHosts."ollama01.beta.dgnum.eu" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://${config.services.ollama.host}:${toString config.services.ollama.port}";
+            basicAuthFile = pkgs.writeText "ollama-htpasswd" ''
+              raito:$y$j9T$UDEHpLtM52hRGK0I4qT6M0$N75AhENLqgtJnTGaPzq51imhjZvuPr.ow81Co1ZTcX2
+            '';
+          };
+        };
+      };
+      ollama = {
         enable = true;
         package = pkgs.callPackage ./ollama.nix {
           cudaPackages = pkgs.cudaPackages_11;
@@ -66,6 +82,7 @@ lib.extra.mkConfig {
         };
       };
     };
+  };
 
   root = ./.;
 }

meta/dns.nix

@@ -127,6 +127,14 @@ let
           "cas-eleves"
           "vote"
         ];
+
+        krz01.dual = [
+          # Beta-grade machine learning API servers
+          "ollama01.beta"
+          "openui.beta"
+          "whisper.beta"
+          "stable-diffusion.beta"
+        ];
       }
     )
   );