wolcen/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow access to ollama from VPN servers

Browse source
This commit is contained in:
Chris (wolcen) Thompson 2025-05-31 17:50:40 -04:00
parent f304b82399
commit 2da8f22d2d
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/default/configuration.nix
View file

@ -195,6 +195,11 @@
# if packets are still dropped, they will show up in dmesg # if packets are still dropped, they will show up in dmesg
logReversePathDrops = true; logReversePathDrops = true;
checkReversePath = "loose"; checkReversePath = "loose";
extraCommands = ''
# Enable connections to Ollama for VPN users:
iptables -t filter -I INPUT --protocol TCP --source 10.40.4.2/32 --destination 10.40.4.2 --dport 11434 -j ACCEPT
iptables -t filter -I INPUT --protocol TCP --source 10.0.7.0/24 --destination 10.40.4.2 --dport 11434 -j ACCEPT
'';
# wireguard trips rpfilter up # wireguard trips rpfilter up
#extraCommands = '' #extraCommands = ''
# ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN # ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
@ -375,6 +380,7 @@
#environmentVariables = { #environmentVariables = {
# HCC_AMDGPU_TARGET = "gfx1031"; # used to be necessary, but doesn't seem to anymore # HCC_AMDGPU_TARGET = "gfx1031"; # used to be necessary, but doesn't seem to anymore
#}; #};
host = "10.40.4.2"; # See also ip46tables update in firewall extracommands
rocmOverrideGfx = "10.3.0"; rocmOverrideGfx = "10.3.0";
}; };
system.activationScripts = { system.activationScripts = {
@ -395,8 +401,8 @@
environment = { environment = {
"TZ" = "America/New York"; "TZ" = "America/New York";
"OLLAMA_API_BASE_URL" = "http://127.0.0.1:11434/api"; "OLLAMA_API_BASE_URL" = "http://10.40.4.2:11434/api";
"OLLAMA_BASE_URL" = "http://127.0.0.1:11434"; "OLLAMA_BASE_URL" = "http://10.40.4.2:11434";
"WEBUI_URL" = "http://127.0.0.1:8080/"; "WEBUI_URL" = "http://127.0.0.1:8080/";
}; };