本地模型局域网安全反向代理配置（Bearer 鉴权 + CORS 放行 + 零缓冲流式转发） (nginx-ollama-lan-auth.conf)

# Tinker AI — Secure Nginx Reverse Proxy for Local Ollama (Keep Ollama on 127.0.0.1:11434)
map $http_authorization $auth_ok {
    default 0;
    "Bearer sk-tinker-homelab-secret-2026" 1;
}

server {
    listen 0.0.0.0:11435;
    server_name _;

    location / {
        # Handle browser / Chrome extension CORS preflight
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin "*" always;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
            return 204;
        }

        if ($auth_ok = 0) {
            return 401 '{"error":"Unauthorized: valid Bearer token required"}';
        }

        proxy_pass http://127.0.0.1:11434;
        proxy_set_header Host localhost:11434;
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 300s;
        chunked_transfer_encoding on;
    }
}