server {
    listen 80;
    server_name 你的域名;  # 换成你的域名或公网IP

    # 核心：/ollama/ 路径反向代理+鉴权
    location /ollama/ {
        # 1. 预检请求放行（跨域）
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            add_header Access-Control-Allow-Headers Authorization,Content-Type;
            return 204;
        }

        # 2. Bearer Key 校验（关键！）
        set $auth $http_authorization;
        if ($auth != "Bearer ollamakey") {  # 密钥：ollamakey，可自定义
            add_header WWW-Authenticate 'Bearer realm="Ollama API"';
            return 401;  # 鉴权失败返回401
        }

        # 3. 反向代理到本地 Ollama
        proxy_pass http://127.0.0.1:11434/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
    }
}

    #if ($http_authorization != "Bearer E4613") {
    #    return 401 Unauthorized;
    #}

    # 反向代理到 11434
    #location /ollama/ {
        
        # 反向代理
        #proxy_pass http://127.0.0.1:11434/;
        #proxy_set_header Host $host;
        #proxy_set_header X-Real-IP $remote_addr;
        #proxy_http_version 1.1;
        #proxy_set_header Authorization "";  # 清除转发时的 Authorization

        #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header X-Forwarded-Proto $scheme;
    #}

    # 放行模型列表API
    location = /ollama/api/tags {
        proxy_pass http://127.0.0.1:11434/api/tags;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location = /ollama/api/show {
        proxy_pass http://127.0.0.1:11434/api/show;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # 其他所有 /ollama/ 下的请求都需要鉴权
    location /ollama/ {
        # OPTIONS预检
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            add_header Access-Control-Allow-Headers Authorization,Content-Type;
            return 204;
        }
        
        # 鉴权
        if ($http_authorization != "Bearer E43") {
            add_header WWW-Authenticate 'Bearer realm="Ollama API"';
            return 401;
        }
        
        proxy_pass http://127.0.0.1:11434/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Authorization "";
    }