84 lines
2.6 KiB
Markdown
84 lines
2.6 KiB
Markdown
# brewcode gateway
|
|
|
|
An OpenAI-compatible proxy (Cloudflare Worker) that sits in front of Ollama Cloud.
|
|
|
|
**Why it exists:** it holds your real Ollama Cloud API key server-side, so the
|
|
key never ships inside the brewcode binary. brewcode talks to this Worker with a
|
|
separate `GATEWAY_TOKEN` — if that token leaks, you rotate it cheaply and your
|
|
Ollama key is never exposed.
|
|
|
|
```
|
|
brewcode --(Bearer GATEWAY_TOKEN)--> Worker --(Bearer OLLAMA_API_KEY)--> ollama.com
|
|
```
|
|
|
|
## Prerequisites
|
|
|
|
- A free Cloudflare account
|
|
- Node.js installed (for `npx wrangler`)
|
|
- Your Ollama Cloud API key: https://ollama.com/settings/keys
|
|
|
|
## Deploy
|
|
|
|
Run these from this `gateway/` directory:
|
|
|
|
1. Log in to Cloudflare:
|
|
```
|
|
npx wrangler login
|
|
```
|
|
2. Set the two secrets (you are prompted to paste each value):
|
|
```
|
|
npx wrangler secret put OLLAMA_API_KEY
|
|
npx wrangler secret put GATEWAY_TOKEN
|
|
```
|
|
- `OLLAMA_API_KEY` — your real Ollama Cloud key.
|
|
- `GATEWAY_TOKEN` — any random string you choose. Generate one with
|
|
`openssl rand -hex 24`. This is the token brewcode will send.
|
|
3. Deploy:
|
|
```
|
|
npx wrangler deploy
|
|
```
|
|
Wrangler prints the URL, e.g.
|
|
`https://brewcode-gateway.<your-subdomain>.workers.dev`.
|
|
|
|
## Test it
|
|
|
|
Health check:
|
|
```
|
|
curl https://brewcode-gateway.<your-subdomain>.workers.dev/health
|
|
```
|
|
|
|
A real chat completion (replace `<GATEWAY_TOKEN>` and the URL):
|
|
```
|
|
curl https://brewcode-gateway.<your-subdomain>.workers.dev/v1/chat/completions \
|
|
-H "Authorization: Bearer <GATEWAY_TOKEN>" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"model":"kimi-k2.6","messages":[{"role":"user","content":"say hi"}],"stream":false}'
|
|
```
|
|
Expect a normal chat-completion JSON response.
|
|
|
|
## Point brewcode at the gateway
|
|
|
|
In brewcode's `.env`, replace the direct Ollama Cloud block with:
|
|
```
|
|
OPENAI_API_KEY=<GATEWAY_TOKEN>
|
|
OPENAI_BASE_URL=https://brewcode-gateway.<your-subdomain>.workers.dev/v1
|
|
```
|
|
Then `brewcode --model "openai/kimi-k2.6"` works with **no Ollama key on the
|
|
client**. (Keep the `openai/` prefix — see the main provider docs.)
|
|
|
|
## Rotating the token
|
|
|
|
If `GATEWAY_TOKEN` leaks: set a new value with
|
|
`npx wrangler secret put GATEWAY_TOKEN`, redeploy, and update clients. Your
|
|
Ollama key is never touched.
|
|
|
|
## Notes
|
|
|
|
- The Worker **requires** `GATEWAY_TOKEN` — it is not an open proxy.
|
|
- Streaming responses (SSE) pass straight through, so streaming chat
|
|
completions work.
|
|
- For abuse protection at scale, add a Cloudflare Rate Limiting rule on the
|
|
Worker route (Cloudflare dashboard → Security).
|
|
- A leaked `GATEWAY_TOKEN` is recoverable; a leaked Ollama key is not — that is
|
|
the whole point of running this gateway.
|