Run Gemma 4 AI on Debian Machine

setup.sh

#!/bin/bash

# ==============================================================================
# CONFIGURATION - CHANGE ALL OF THESE BEFORE RUNNING
# ==============================================================================
API_KEY="YOUR_SECRET_API_KEY_HERE"
MODEL_NAME="gemma4:e4b"
DOMAIN_NAME="yourdomain.com"  # Must point to your IP via DNS
EMAIL_ADDRESS="you@example.com"    # Required by Let's Encrypt for renewal notices

# Exit immediately if a command exits with a non-zero status
set -e

echo "🚀 Starting master configuration for Debian 13 with SSL..."

# 1. UPDATE SYSTEM PACKAGES
echo "🔄 Updating package lists..."
sudo apt update && sudo apt upgrade -y

# 2. CREATE A 4GB SWAP FILE FOR RAM SAFETY
echo "💾 Creating 4GB swap file..."
if [ ! -f /swapfile ]; then
    sudo fallocate -l 4G /swapfile
    sudo chmod 600 /swapfile
    sudo mkswap /swapfile
    sudo swapon /swapfile
    echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
    echo "✅ Swap file created successfully."
else
    echo "⚠️ Swap file already exists. Skipping."
fi

# 3. INSTALL OLLAMA
echo "🦙 Installing Ollama..."
curl -fsSL https://ollama.com/install.sh | sh

# 4. CONFIGURE OLLAMA ENVIRONMENT VARIABLES (THREAD LIMITS & LOCALHOST ONLY)
echo "⚙️ Tuning Ollama systemd settings..."
sudo mkdir -p /etc/systemd/system/ollama.service.d

cat <<EOF | sudo tee /etc/systemd/system/ollama.service.d/override.conf
[Service]
Environment="OLLAMA_HOST=127.0.0.1"
Environment="OLLAMA_NUM_PARALLEL=1"
Environment="OLLAMA_MAX_LOADED_MODELS=1"
EOF

# Reload systemd and restart Ollama to apply constraints
sudo systemctl daemon-reload
sudo systemctl restart ollama

# 5. DOWNLOAD THE SELECTED AI MODEL
echo "📥 Pulling AI model: ${MODEL_NAME} (This may take a few minutes)..."
ollama pull ${MODEL_NAME}

# 6. INSTALL NGINX AND CERTBOT (SSL TOOL)
echo "🌐 Installing Nginx and Certbot..."
sudo apt install nginx certbot python3-certbot-nginx -y

# 7. CREATE PRELIMINARY NGINX PROFILE (FOR CERTBOT VALIDATION)
echo "🔒 Creating temporary Nginx profile..."
cat <<EOF | sudo tee /etc/nginx/sites-available/ollama_proxy
server {
    listen 80;
    server_name ${DOMAIN_NAME};

    location / {
        return 403 "Pending SSL configuration...\n";
    }
}
EOF

# Enable configuration and remove default splash page
sudo ln -sf /etc/nginx/sites-available/ollama_proxy /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo systemctl restart nginx

# 8. REQUEST LET'S ENCRYPT SSL CERTIFICATE
echo "🔑 Requesting SSL certificate from Let's Encrypt..."
# --nginx handles the validation challenge and updates the Nginx config blocks automatically [2]
sudo certbot --nginx \
  --non-interactive \
  --agree-tos \
  --email "${EMAIL_ADDRESS}" \
  -d "${DOMAIN_NAME}" \
  --redirect # Automatically routes all http:// traffic to https:// [2]

# 9. RE-INJECT SECURE ROUTING CONFIG WITH API KEY VALIDATION
echo "⚙️ Applying API Key validation rules to the SSL block..."
cat <<EOF | sudo tee /etc/nginx/sites-available/ollama_proxy
server {
    listen 80;
    server_name ${DOMAIN_NAME};
    return 301 https://\$host\$request_uri; # Force HTTPS redirect
}

server {
    listen 443 ssl; # Managed by Certbot [2]
    server_name ${DOMAIN_NAME};

    # SSL Certificates managed by Certbot
    ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem; # Managed by Certbot [2]
    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem; # Managed by Certbot [2]
    include /etc/letsencrypt/options-ssl-nginx.conf; # Managed by Certbot [2]
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # Managed by Certbot [2]

    location / {
        # Enforce API Key authentication
        if (\$http_x_api_key != "${API_KEY}") {
            return 403 "Forbidden: Invalid API Key\n";
        }

        # Route to local Ollama instance
        proxy_pass http://127.0.0.1:11434;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;

        # Disable buffering to allow smooth streaming token generation
        proxy_buffering off;
        proxy_read_timeout 300s;
    }
}
EOF

# 10. RESTART NGINX TO APPLY SECURE RULES
echo "🔄 Reloading secure Nginx configuration..."
sudo nginx -t
sudo systemctl restart nginx

# 11. VERIFY CERTBOT'S RENEWAL TIMER IS ACTUALLY ACTIVE
# (apt installs this timer as a side effect of installing the certbot package in
# step 6 — this step just confirms it, rather than assuming it.)
echo "🔍 Verifying Certbot renewal timer..."
if systemctl is-enabled certbot.timer >/dev/null 2>&1 && systemctl is-active certbot.timer >/dev/null 2>&1; then
    RENEWAL_STATUS="✅ Verified: certbot.timer is enabled and active"
else
    RENEWAL_STATUS="⚠️ WARNING: certbot.timer is NOT enabled/active — renewals will not happen automatically. Run 'sudo systemctl enable --now certbot.timer' to fix."
fi

echo "🎉 SECURE CONFIGURATION COMPLETE!"
echo "--------------------------------------------------------"
echo "Your Secure API Endpoint is live at: https://${DOMAIN_NAME}/api"
echo "Required Header: X-API-Key = ${API_KEY}"
echo "Configured Model: ${MODEL_NAME}"
echo "SSL Auto-Renewal: ${RENEWAL_STATUS}"
echo "--------------------------------------------------------"