· about 35 minutes · runs on ubuntu-26.04-automation · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
This box is the team's little model server: Ollama with the qwen2.5:0.5b model on disk, and
nginx in front of it on port 8080 so colleagues do not have to talk to Ollama directly.
Nothing works. The internal chat page times out, http://127.0.0.1:8080/api/tags returns nothing
useful, and after last week's tidy-up — when the models were moved to /srv/models — no one has
seen a single generated token. People who tried longer prompts said the answer "just stops".
What is expected, and graded:
ollama service runs, as the ollama account, and starts at boot./srv/models, and nobody else can write there.http://127.0.0.1:8080/api/tags lists qwen2.5:0.5b through nginx.POST http://127.0.0.1:8080/api/generate returns a completion through nginx.You have root through sudo. Everything must still hold after a reboot.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_ollama_service_runs | Make the deployment survive a reboot |
| 02_models_readable_by_ollama | Run a local model server as a service account that can read its models |
| 03_tags_through_the_proxy | Publish an internal API through nginx without breaking streamed responses |
| 04_generate_through_the_proxy | Publish an internal API through nginx without breaking streamed responses |
| 05_proxy_ready_for_streaming | Publish an internal API through nginx without breaking streamed responses |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 1 journalctlman 1 chownman 8 ss4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
Short prompts work through nginx; long answers requested with "stream": false end in a 504 after exactly 5 seconds. Which directive is responsible?
proxy_read_timeout, the longest gap allowed between two reads from the backend
proxy_read_timeout limits the time between two successive reads from the upstream, not the total response. A non-streamed answer sends nothing until generation ends, so the whole generation is one gap. The connection itself succeeded (not connect timeout), the request is small (not body size), and buffering changes how data is forwarded, not when nginx gives up.
https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout
Why is `sudo -u ollama ollama list` not a test of whether the ollama account can read its models?
ollama list is a client that asks the running server; it reads nothing from disk
The CLI talks HTTP to the server at OLLAMA_HOST. With the server down it cannot connect; with it up it shows what the server sees, whoever runs the client. `sudo -u ollama ls /srv/models` tests the account's permissions.
https://github.com/ollama/ollama/blob/main/docs/faq.md
nginx returns 502 and its error log says `connect() failed (111: Connection refused)`. What does that mean?
Nothing is listening on the address and port nginx connected to
errno 111 is a refused connection: a wrong port or a stopped backend (`ss -lntp` settles it). 110 is a timeout; 13 is a permission refusal by a security policy; a client closing early is logged as 499.
man 3 errno · https://nginx.org/en/docs/http/ngx_http_proxy_module.html