How to Configure Nginx as Reverse Proxy for AI APIs

Running AI APIs without a proper reverse proxy exposes them to abuse and overload. Nginx provides rate limiting, authentication and SSL for any AI API endpoint.

Basic Reverse Proxy for Ollama

server {
    listen 443 ssl;
    server_name ai.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/ai.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ai.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:11434;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 300s;
        proxy_buffering off;  # Required for streaming responses
    }
}

Add API Key Authentication

# nginx.conf — add in http block
map $http_authorization $valid_token {
    default 0;
    "Bearer your-secret-api-key-here" 1;
    "Bearer another-valid-key" 1;
}

server {
    location /api/ {
        if ($valid_token = 0) {
            return 401 '{"error":"Unauthorized"}';
        }
        proxy_pass http://127.0.0.1:11434;
    }
}

Rate Limiting

# Limit requests per IP
http {
    limit_req_zone $binary_remote_addr zone=ai_limit:10m rate=10r/m;
}

server {
    location /api/generate {
        limit_req zone=ai_limit burst=5 nodelay;
        proxy_pass http://127.0.0.1:11434;
    }
}

Load Balance Multiple AI Servers

upstream ai_backends {
    least_conn;
    server ai-server-1:11434;
    server ai-server-2:11434;
    server ai-server-3:11434;
    keepalive 10;
}

server {
    location / {
        proxy_pass http://ai_backends;
        proxy_read_timeout 600s;
    }
}

Cache Common Responses

proxy_cache_path /tmp/ai_cache levels=1:2 keys_zone=ai_cache:10m max_size=1g;

location /api/tags {
    # Cache model list for 60 seconds
    proxy_cache ai_cache;
    proxy_cache_valid 200 60s;
    proxy_pass http://127.0.0.1:11434;
}

Conclusion

A proper Nginx configuration protects AI APIs from abuse. Our team configures production AI server environments with secure API gateways.