Cloud proxy

server/cloud_proxy.go lets the local daemon transparently serve requests for cloud-only models (and a handful of cloud-only features like web search and web fetch) through ollama.com.

Purpose

Some models are too large for a typical user's hardware. Rather than fail with "model not found," Ollama Cloud hosts them and the local daemon forwards inference requests when those models are referenced by name. The same passthrough provides web search and web fetch as cloud-backed primitives.

Key abstractions

Symbol	Location	Purpose
cloudPassthroughMiddleware	server/cloud_proxy.go	Gin middleware that detects cloud-only models and forwards the request. Wraps every inference handler that supports remote models.
cloudModelPathPassthroughMiddleware	server/cloud_proxy.go	Same idea but for :model URL parameters (GET /v1/models/:model).
model_resolver.go	server/model_resolver.go	Decides whether a model name resolves to local or cloud.
Web search / fetch handlers	server/cloud_proxy.go, server/routes.go	Always remote; the local daemon forwards them as-is.

How it works

sequenceDiagram
    participant Client
    participant Gin
    participant CloudMW as cloudPassthroughMiddleware
    participant Resolver as model_resolver
    participant Cloud as ollama.com
    participant Local as ChatHandler

    Client->>Gin: POST /api/chat {model: gpt-oss-120b}
    Gin->>CloudMW: enter
    CloudMW->>Resolver: is gpt-oss-120b cloud-only?
    Resolver-->>CloudMW: yes
    CloudMW->>Cloud: signed POST
    Cloud-->>CloudMW: NDJSON stream
    CloudMW-->>Client: stream as-is
    note right of Local: Local handler is never called

For local models the middleware passes through to the local handler unchanged.

Errors

The cloud proxy uses dedicated error strings so handlers can return useful messages:

cloudErrRemoteInferenceUnavailable    = "remote model is unavailable"
cloudErrRemoteModelDetailsUnavailable = "remote model details are unavailable"
cloudErrWebSearchUnavailable          = "web search is unavailable"
cloudErrWebFetchUnavailable           = "web fetch is unavailable"

These map to specific HTTP status codes (typically 503) so clients can retry or surface a clear UI message.

Authentication

Every cloud request is signed with the local SSH key (see auth). The signature includes the request method, path, and body digest, so the cloud can validate the request came from the user's authorized device.

Integration points

• Wired into the route table in server/routes.go via s.withInferenceRequestLogging("...", cloudPassthroughMiddleware(...), ..., s.ChatHandler)... constructions.
• Reads the user identity through auth/auth.go to sign requests.
• Surfaces cloud disable state to the launcher via cloudStatusDisabled (used in cmd/launch/launch.go when the user supplies --model on a cloud model but cloud is disabled).

Disabling cloud

Cloud passthrough can be disabled per-installation. When disabled:

• Cloud model names fall through to the local handler, which returns model not found.
• cloudStatusDisabled returns true; the launcher warns when the user passes --model on a cloud model.
• Web search/fetch requests return the *Unavailable errors above.

Key source files

File	Purpose
server/cloud_proxy.go	Middleware, model resolution, web search/fetch passthrough.
server/model_resolver.go	Cloud-vs-local classification.
server/routes.go	Where the middleware is wired into the route table.
server/cloud_proxy_test.go	Behavior tests.
server/routes_cloud_test.go	End-to-end cloud route tests.