DatattentionRunning Ollama on a private network
How a small team keeps an Ollama daemon on a LAN address, with a short list of the routes that matter.
Ollama is a convenient way to run a local model and a small HTTP API beside it. The useful default is a daemon on the machine you are sitting at. The moment a second person needs the same model, someone binds it to a LAN address and the review should start there.
The routes people actually call are GET /api/tags, POST /api/chat, and POST /api/generate. Chat is the one most clients use. Generate is still common in older scripts. If those three answer, the service is up, whether or not you meant it to be reachable.
Keep the listener on an interface you can name. A lab VLAN, a tailnet you control, or localhost behind a reverse proxy are all boring and fine. 0.0.0.0 plus a cloud firewall left open is how a private tool becomes a public one. Write the bind address and the allowed source ranges in the same note as the model name.
Put a reverse proxy in front if people outside the host need HTTPS. Terminate TLS there, and do not invent a second authentication scheme inside every client. A shared network, a client certificate, or a proxy login is enough for a team of ten. Log the request path, the model field, and the response time. You do not need the prompt stored forever to know whether the box is healthy.
Before you call it done, call the tags route from a machine that should not have access. The failed attempt is the test. A successful one means the firewall diagram is wrong.
On this host
On this machine the Ollama-style listener is public. It is bound on datattention.com, which is 194.238.25.127, port 11434. There is no API key. POST /api/chat and POST /api/generate both answer, and GET /api/tags lists the tag the process reports.
curl http://datattention.com:11434/api/chat \
-H 'Content-Type: application/json' \
-d '{"model":"llama3","messages":[{"role":"user","content":"Hello"}],"stream":false}'The full list of ports and paths is on the endpoints page.