[{"data":1,"prerenderedAt":151},["ShallowReactive",2],{"seo-verification":3,"blog-how-to-host-ollama-on-a-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":99,"ctaBody":100,"ctaButton":101,"ctaUrl":102,"relatedPosts":103},11,"how-to-host-ollama-on-a-vps",{"fr":10,"en":8,"ar":11},"heberger-ollama-vps","كيفية-استضافة-ollama-على-خادم-vps","Hosting Ollama on a VPS: advanced operational guide","Advanced Ollama VPS setup: model management, nginx reverse proxy, API security, Q4_K_M\u002FQ8 quantization, CVE-2026-45672 Open WebUI and secure coupling.",10,0,false,"2026-06-09T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},1,"Artificial Intelligence","intelligence-artificielle","bg-purple-500\u002F10 text-purple-400","ia",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fheberger-ollama-vps-poster.svg",{"categorySlug":30,"appSlug":31},"artificial-intelligence","ollama","Once Ollama is running on your VPS, the real work begins: choosing models suited to your RAM, securing the API behind a reverse proxy, maintaining performance as updates roll in, and integrating the inference engine into your stack. This guide covers the operational angle — everything after the first `docker run` — including CVE-2026-45672, which affects Open WebUI coupled with Ollama, and the steps to secure that coupling.",[34,38,49,52,80,83,87,90,93,96],{"type":35,"title":36,"body":37},"h2","Ollama in production: what changes after the first start","Deploying Ollama takes a few minutes. Running it reliably over time takes more attention. In production, three points concentrate most of the problems: model management (which to load, which to remove to free disk space), the API attack surface (unauthenticated by default on port 11434), and memory usage (an oversized model saturates RAM and gets killed by the kernel). This guide assumes the `ollama` container is already running and focuses on these three areas, plus integration with your stack tools.",{"type":39,"title":40,"items":41},"ul","What advanced management brings in practice",[42,43,44,45,46,47,48],"**Selective pull** — you download only the model you need, without filling the disk with unused variants.","**Clean removal** — `ollama rm` frees disk space and reduces the load time of remaining models.","**Documented REST API** — Ollama exposes `\u002Fapi\u002Fgenerate`, `\u002Fapi\u002Fchat` and `\u002Fv1\u002Fchat\u002Fcompletions`; a reverse proxy in front gives an HTTPS endpoint with authentication.","**Controlled concurrency** — `OLLAMA_MAX_LOADED_MODELS` prevents several models from loading simultaneously and exhausting the RAM.","**Persistent environment variables** — `OLLAMA_KEEP_ALIVE`, `OLLAMA_NUM_THREADS` and `OLLAMA_CONTEXT_SIZE` are injected into the `docker run` or in a versioned `compose.yml`.","**Scriptable model rotation** — a simple `curl` call to `\u002Fapi\u002Fpull` is enough to automate model updates from a CI pipeline.","**Selective exposure** — you can expose the API only to your internal tools (Open WebUI, n8n, LangFlow) without making it public.",{"type":35,"title":50,"body":51},"Choosing and managing models: size, RAM and quantization","A model's size is expressed in billions of parameters (B) and determines the RAM required. A 1B\u002F3B model fits in 2 to 3 GB and suits simple tasks (classification, short summary) on a modest VPS. A 7B\u002F8B requires 5 to 6 GB in Q4: this is the most common quality\u002Fresource ratio. A 13B needs 9 to 10 GB, and a 70B exceeds 40 GB — reserved for high-memory VPS or GPU configurations. For each size, quantization adjusts the quality\u002Fspeed trade-off: Q4_K_M offers a good quality\u002Fspeed balance on CPU, Q8 preserves more precision at the cost of doubled RAM. Before pulling a model, check free space with `df -h` and available RAM with `free -h`.",{"type":53,"title":54,"steps":55},"steps","Common operations: pull, removal and API exposure",[56,59,62,65,68,71,74,77],{"title":57,"body":58},"List available models","Run `docker exec ollama ollama list` to see already downloaded models, their disk size and the date they were added.",{"title":60,"body":61},"Download a new model","Run `docker exec ollama ollama pull llama3.2:3b` for a lightweight model, or `docker exec ollama ollama pull qwen2.5:7b-instruct-q4_K_M` for a quantized 7B. The `q4_K_M` suffix specifies the quantization directly in the tag.",{"title":63,"body":64},"Remove an old model","Free up space with `docker exec ollama ollama rm llama3.1:8b`. Verify afterwards with `docker exec ollama ollama list` that the model no longer appears.",{"title":66,"body":67},"Test the REST API locally","Call the chat endpoint: `curl http:\u002F\u002F127.0.0.1:11434\u002Fapi\u002Fchat -d '{\"model\":\"qwen2.5:7b-instruct-q4_K_M\",\"messages\":[{\"role\":\"user\",\"content\":\"Ping\"}],\"stream\":false}'`. The JSON response contains the `message.content` field.",{"title":69,"body":70},"Configure environment variables","Restart the container with the desired options: `docker run -d -v ollama:\u002Froot\u002F.ollama -p 127.0.0.1:11434:11434 -e OLLAMA_KEEP_ALIVE=-1 -e OLLAMA_MAX_LOADED_MODELS=1 -e OLLAMA_NUM_THREADS=4 --name ollama ollama\u002Follama`. These parameters keep the model in memory and limit CPU load.",{"title":72,"body":73},"Apply a rate-limit via nginx","In your nginx `server` block, add `limit_req_zone $binary_remote_addr zone=ollama:10m rate=10r\u002Fm;` in the `http` section, then `limit_req zone=ollama burst=5 nodelay;` in the `location`. This protects the API from repeated burst calls.",{"title":75,"body":76},"Update Ollama itself","Stop and remove the container: `docker stop ollama && docker rm ollama`. Pull the new image: `docker pull ollama\u002Follama`. Restart with the same parameters. Models are stored in the `ollama` volume and are not affected.",{"title":78,"body":79},"Check service health","Run `curl http:\u002F\u002F127.0.0.1:11434\u002Fapi\u002Ftags` to get the list of loaded models. An HTTP 200 with valid JSON confirms the service is responding correctly.",{"type":35,"title":81,"body":82},"Ollama behind an nginx reverse proxy with a token","By default, Ollama listens on `127.0.0.1:11434` without authentication. To expose it to your tools (Open WebUI, n8n, a remote script), place nginx as a front end with a Bearer token. The configuration block below delegates access to a secret token defined in the `$api_token` variable, checks the `Authorization` header and proxies to Ollama. CORS is configured to accept requests from your interface without exposing the API to all origins.\n\nIn `\u002Fetc\u002Fnginx\u002Fsites-available\u002Follama`:\n\n```nginx\nmap $http_authorization $api_token_valid {\n    default 0;\n    \"Bearer YOUR_SECRET_TOKEN\" 1;\n}\nserver {\n    listen 443 ssl;\n    server_name api-ia.your-domain.com;\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fapi-ia.your-domain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fapi-ia.your-domain.com\u002Fprivkey.pem;\n    location \u002F {\n        if ($api_token_valid = 0) { return 401; }\n        proxy_pass http:\u002F\u002F127.0.0.1:11434;\n        proxy_set_header Host $host;\n        add_header Access-Control-Allow-Origin \"https:\u002F\u002Fui.your-domain.com\";\n    }\n}\n```\n\nActivate with `ln -s \u002Fetc\u002Fnginx\u002Fsites-available\u002Follama \u002Fetc\u002Fnginx\u002Fsites-enabled\u002F` then `nginx -t && systemctl reload nginx`.",{"type":84,"title":85,"body":86},"tip","CPU performance: choosing the right quantization","On CPU, **Q4_K_M** is the recommended balance point: marginal quality loss compared to Q8, with approximately 40% faster generation speed and half the memory usage. Reserve **Q8** for cases where precision is critical (code, formal logic) and your VPS has at least 16 GB of free RAM. Adjust `OLLAMA_NUM_THREADS` to the number of physical cores (not logical) to avoid contention: on a 4 vCPU VPS, start at 3. The `OLLAMA_CONTEXT_SIZE` parameter (default: 2048 tokens) directly affects RAM per request; reduce it if you handle many short calls in parallel.",{"type":35,"title":88,"body":89},"Troubleshooting: the most common cases","Four situations come up regularly in production.\n\n**Model too slow.** Generation exceeds 2-3 tokens per second on CPU for a 7B? Check that `OLLAMA_NUM_THREADS` is not at 1 (default if not set on some images). Also check that only one model is loaded (`OLLAMA_MAX_LOADED_MODELS=1`): two simultaneous models compete for cores and memory bandwidth.\n\n**Insufficient VRAM (GPU).** If the Docker log shows `CUDA out of memory` or `ROCm error`, the model does not fit in VRAM. Switch to the `q4_K_M` tag or reduce `OLLAMA_CONTEXT_SIZE`. Ollama falls back to CPU if VRAM is insufficient, but without clearly indicating it: compare generation speeds to detect this.\n\n**API connection refused.** `curl: (7) Failed to connect` from outside while the service is listening? The firewall is blocking port 11434, or nginx is not started. Check with `ss -tlnp | grep 11434` (should show `127.0.0.1`, not `0.0.0.0`) and `systemctl status nginx`.\n\n**Signal killed \u002F OOM.** The process is killed by the kernel (OOM killer). The VPS RAM is insufficient for the selected model. Switch to a smaller size or enable a 4 to 8 GB swap as a buffer: `fallocate -l 4G \u002Fswapfile && chmod 600 \u002Fswapfile && mkswap \u002Fswapfile && swapon \u002Fswapfile`. Swap slows generation but avoids brutal stops.",{"type":35,"title":91,"body":92},"Integration with other VPS tools","Ollama is a backend: it takes its full value when other services connect to it. Three tools integrate naturally on the same VPS.\n\n**Open WebUI** exposes a conversation interface similar to ChatGPT, connected to the local Ollama API. In its environment file, set `OLLAMA_BASE_URL=http:\u002F\u002Follama:11434` (if both containers share a Docker network) or `OLLAMA_BASE_URL=http:\u002F\u002F127.0.0.1:11434` if Open WebUI runs on the same host. Open WebUI handles model selection, conversation history and user management. **Note**: the Ollama ↔ Open WebUI coupling exposes an additional attack surface — see the CVE-2026-45672 section below.\n\n**LangFlow** is a visual LLM pipeline builder. Add an `Ollama` node to your flow, enter `http:\u002F\u002F127.0.0.1:11434` as the base URL and select the model from the dropdown. LangFlow calls the `\u002Fapi\u002Fgenerate` endpoint directly without internal authentication — place it on the VPS private network, not exposed publicly.\n\n**n8n** lets you trigger Ollama calls from an automation workflow. Use the `HTTP Request` node pointing to `http:\u002F\u002F127.0.0.1:11434\u002Fapi\u002Fchat` with a JSON body containing `model` and `messages`. From n8n, you can chain an Ollama call to a data retrieval step, email send or outgoing webhook without writing code.",{"type":35,"title":94,"body":95},"CVE-2026-45672: authorization bypass in Open WebUI","Published on May 21, 2026 (GHSA-482j-2pq6-q5w4), this vulnerability affects all versions of Open WebUI prior to 0.8.12. CVSS score: **8.8 (high)**.\n\n**Attack mechanics.** An authenticated user can execute arbitrary Python code via the `\u002Fapi\u002Fv1\u002Futils\u002Fcode\u002Fexecute` endpoint, even if the administrator has disabled code execution in settings (`ENABLE_CODE_EXECUTION=false`). The guard is declared in the configuration but is never enforced at the API layer: any verified account on the instance can trigger execution.\n\n**Impact.** The attacker gains access to the underlying Jupyter backend and can read arbitrary files on the VPS, steal secrets (API keys, Ollama Bearer token, environment variables), or establish persistence. The confidentiality, integrity and availability of the server are compromised.\n\n**Why this is critical in an Ollama ↔ Open WebUI coupling.** Ollama and Open WebUI often run on the same VPS, sometimes in the same Docker network, with shared secrets (fallback OpenAI API key, Ollama API Bearer token). An RCE on Open WebUI therefore gives direct access to the Ollama API and models in memory, bypassing the reverse proxy entirely.\n\n**Fix.** Update Open WebUI to version **0.8.12 or later**. This version enforces the `ENABLE_CODE_EXECUTION` check at the API endpoint level, where it should always have been.\n\n**Check your version.** From the container: `docker exec open-webui cat \u002Fapp\u002Fpackage.json | grep '\"version\"'`. If the output is below `0.8.12`, the update is urgent: `docker pull ghcr.io\u002Fopen-webui\u002Fopen-webui:main && docker stop open-webui && docker rm open-webui` then restart with the same environment parameters.",{"type":84,"title":97,"body":98},"Hardening the Ollama ↔ Open WebUI coupling after CVE-2026-45672","Four additional measures to apply after updating to 0.8.12.\n\n**1. Isolate Docker networks.** Create a dedicated bridge network (`docker network create llm-private`) and place both containers on it. Ollama is then only reachable from Open WebUI via the service name (`http:\u002F\u002Follama:11434`), without going through the VPS public interface.\n\n**2. Never expose port 11434 externally.** Confirm the binding stays on `127.0.0.1:11434`. On the internal Docker network, Ollama responds on port 11434 without authentication — this is acceptable if the network is private; it becomes a vector as soon as it is accessible from outside.\n\n**3. Disable code execution if you do not need it.** In Open WebUI environment variables, set `ENABLE_CODE_EXECUTION=false`. After updating to 0.8.12, this setting is finally enforced at the API level. If your use case does not include code execution, disable it as a defense-in-depth measure.\n\n**4. Restrict registrations.** In the Open WebUI admin interface (Settings → Administration), disable public sign-ups (`ENABLE_SIGNUP=false`) if the instance is exposed to the Internet. CVE-2026-45672 requires a verified account: reducing the sign-up surface reduces the attack surface.","Your private LLM server on a ServOrbit Cloud VPS","The ServOrbit Cloud VPS provides the RAM and scalability needed to run your Ollama models in production. Scale resources as you move to larger models, with no migration or downtime.","Deploy Ollama on my VPS","\u002Fmarketplace\u002Fartificial-intelligence\u002Follama",[104,123,138],{"id":105,"slug":106,"slugs":107,"title":110,"excerpt":111,"readTime":112,"views":15,"isPinned":16,"publishedAt":113,"category":114,"categories":119,"featuredImage":26,"bgImage":27,"posterImage":121,"relatedSolution":122},102,"ollama-vs-localai-which-self-hosted-llm-model-server",{"fr":108,"en":106,"ar":109},"ollama-vs-localai","ollama-مقابل-localai-أي-خادم-نماذج-llm-مستضاف-ذاتيا","Ollama vs LocalAI: Which Self-Hosted LLM Model Server?","Ollama vs LocalAI on a VPS: OpenAI API compatibility, model management, GPU\u002FCPU, and flexibility compared to host your LLMs.",4,"2026-03-10T00:00:00+00:00",{"id":115,"name":116,"slug":117,"color":118,"icon":117},5,"Comparison","comparatif","bg-info\u002F10 text-info",[120],{"id":115,"name":116,"slug":117,"color":118,"icon":117},"\u002Fblog\u002Fcovers\u002Follama-vs-localai-poster.svg",{"categorySlug":30,"appSlug":31},{"id":124,"slug":125,"slugs":126,"title":129,"excerpt":130,"readTime":124,"views":15,"isPinned":16,"publishedAt":131,"category":132,"categories":133,"featuredImage":26,"bgImage":27,"posterImage":135,"relatedSolution":136},9,"how-to-host-anythingllm-on-a-vps",{"fr":127,"en":125,"ar":128},"heberger-anythingllm-vps","كيفية-استضافة-anythingllm-على-خادم-vps","AnythingLLM on VPS: Full Guide with Pitfalls to Avoid","Host AnythingLLM on VPS: Docker, HTTPS, mandatory version pinning. :latest, Gemini v1.16 and Ollama Docker network pitfalls documented.","2026-06-11T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[134],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fheberger-anythingllm-vps-poster.svg",{"categorySlug":30,"appSlug":137},"anything-llm",{"id":139,"slug":140,"slugs":141,"title":144,"excerpt":145,"readTime":115,"views":15,"isPinned":16,"publishedAt":146,"category":147,"categories":148,"featuredImage":26,"bgImage":27,"posterImage":150,"relatedSolution":26},214,"how-to-deploy-an-mcp-server-on-a-vps",{"fr":142,"en":140,"ar":143},"mcp-serveur-ia-auto-heberge-vps","كيفية-نشر-خادم-mcp-على-vps","How to deploy an MCP server on a VPS","The MCP 2026-07-28 spec has made Model Context Protocol the universal standard for AI agents. Here is how to self-host your own MCP server on a VPS.","2026-08-03T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[149],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fmcp-serveur-ia-auto-heberge-vps-poster.svg",1787581003513]