ollama-admin-proxy

A reverse proxy for Ollama with a built-in admin UI. Run it in front of your local ollama serve to:

• Override model options (e.g. num_ctx, temperature, num_predict) per model — without changing how clients call you.
• Strip unwanted options clients send (great for downstream apps that hard-code values you don't want).
• Queue concurrent requests with a configurable parallelism limit so you don't OOM your GPU.
• See live metrics — request rate, latency, token throughput, system CPU/RAM/GPU — in a web dashboard.
• Protect the admin UI with username/password and optionally gate the proxy itself behind API keys.
• Serve over HTTPS with your own cert/key.

The proxy is transparent: clients keep talking to /api/generate, /api/chat, /api/embed, /api/embeddings as if it were Ollama itself.

Install & run

Requires Node.js 22+.

# one-shot
npx ollama-admin-proxy

# or install globally
npm i -g ollama-admin-proxy
ollama-admin-proxy

On first run the server listens on http://0.0.0.0:11435 and proxies to http://127.0.0.1:11434 (default Ollama). Open the admin UI at http://localhost:11435/ — you'll be prompted to create the first admin user.

Point your Ollama clients at the proxy port instead of 11434 and you're done.

Data location

Runtime data (config, secrets, metrics database, TLS certs) is stored under your home directory:

• Linux / macOS: ~/.ollama-proxy/
• Windows: C:\Users\<you>\.ollama-proxy\

Files inside:

| File | Purpose | |---|---| | config.json | Port, host, parallelism, per-model rules, retention, etc. Edited via the admin UI; safe to edit by hand if the server is stopped. | | secrets.json | Cookie signing secret, hashed admin passwords, hashed API keys. Do not share. | | metrics.sqlite | Rolling request + system metrics. Pruned on the schedule set in config.json (metricsRetentionHours, default 24h). | | certs/ | Default location for HTTPS cert/key files (referenced from config.json). |

Override the location with OLLAMA_PROXY_DATA_DIR:

OLLAMA_PROXY_DATA_DIR=/var/lib/ollama-proxy ollama-admin-proxy

Configuration

Most settings are configured live via the admin UI, including:

• Listen port and host
• Upstream Ollama URL
• HTTPS (enable + cert/key paths)
• Concurrency (parallel)
• Per-model rules: ignore (drop these option keys from incoming requests) and overwrite (force these option values)
• Metrics retention window
• API keys (enable + create/revoke)

Changes take effect immediately; network changes (port/host/HTTPS) trigger an automatic listener restart.

Endpoints

| Path | Purpose | |---|---| | /api/* | Proxy to upstream Ollama (filtered to proxiedEndpoints in config). | | /admin/api/* | Admin REST API (session-cookie auth). | | /socket.io/* | Live metrics push to the admin UI. | | / | Admin UI (single-page app). |

Security notes

• The first request to the admin UI sets up the initial admin user. Lock down access (firewall, reverse proxy, or HTTPS) before exposing the server beyond localhost.
• API keys, when enabled, gate /api/*. They are stored hashed in secrets.json; the plaintext is shown once at creation time.
• Run as a non-privileged user. The default port (11435) does not require root.

License

MIT — see LICENSE.