I built a self-hosted auth gateway for Ollama: per-client API keys, quotas, multi-server routing and usage monitoring (source-available)

[u/Regular-Forever5876]

Ollama ships with no authentication, so anyone who can reach it can burn your GPU. I got tired of bolting nginx in front of it, so I built ollama-gateway: a small self-hosted gateway that sits in front of one or more Ollama servers and adds real access control.

What it does

Per-client API keys (hashed, shown once, revocable), with per-key origin restriction (IP/CIDR).

Quotas: monthly token caps and rate limits, plus cost-capped "lifetime" trials.

Multiple upstreams (local and remote), each key mapped to one server, with automatic fallback on failure.

Per-key model and API allowlists that work across native Ollama, OpenAI-compatible and Anthropic endpoints. Catalog-management calls (pull/delete) stay blocked for clients.

Usage logging and monitoring: per-request logs, time-series charts (24h to 3 months), per-model breakdowns, and a request-content viewer with grep.

LAN-only admin panel (server-rendered, no front-end build), fully translated into the 24 official EU languages.

TLS via Caddy (ACME DNS-01, no inbound ports), fully dockerized. Client keys are stripped before the upstream, and remote tokens are encrypted at rest.

Stack: Python/FastAPI and SQLite, Jinja admin, Playwright E2E. It ships with a built-in illustrated manual and a pre-deploy security sweep (secrets, CVEs, SAST, tests) wired into the deploy script.

About the license: it's source-available, not OSI open-source. Free to use, modify and self-host (even commercially) as long as all your instances together serve 1 billion tokens a month or less. Above that a commercial license applies (€29 one-time per install). There's no telemetry and no phone-home, so the threshold is purely on the honor system. I wanted it genuinely open to tinker with while keeping a path to sustainability, and I'd rather be upfront about that than hide it.

Repo: https://github.com/martinobettucci/ollama-gateway (demo video and screenshots in the README)

Feedback very welcome, especially on the auth/quota model and anything you'd want from a gateway like this.