update-1.6.2

services/knowledge/.env.example

@@ -1,4 +1,6 @@
 # Betriebsmodus desselben Images:
+# Optional: Bearer token sent as Authorization: Bearer <token> to Ollama-compatible endpoints.
+OLLAMA_API_KEY=
 #   editor = vollständiger Einzel-/Masseneditor mit Schreibzugriff
 #   google = schreibgeschützte Helpdesk-Suchmaschine mit Artikel-Viewer
 APP_MODE=editor

services/knowledge/cmd/server/main.go

@@ -269,6 +269,7 @@ func aiServiceFromEnv(mode string, st *staging.Store) (*aifallback.Service, time
 	}
 	svc, err := aifallback.New(aifallback.Config{
 		BaseURL:       envOr("OLLAMA_BASE_URL", "http://ollama:11434"),
+		APIKey:        strings.TrimSpace(os.Getenv("OLLAMA_API_KEY")),
 		Model:         strings.TrimSpace(os.Getenv("OLLAMA_MODEL")),
 		Timeout:       timeout,
 		MaxConcurrent: maxConcurrent,

services/knowledge/docker-compose.dual.yml

@@ -49,6 +49,7 @@ services:
       BASIC_AUTH_PASSWORD: "${SEARCH_AUTH_PASSWORD:-}"
       AI_FALLBACK_ENABLED: "${AI_FALLBACK_ENABLED:-false}"
       OLLAMA_BASE_URL: "${OLLAMA_BASE_URL:-http://ollama:11434}"
+      OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
       OLLAMA_MODEL: "${OLLAMA_MODEL:-}"
       OLLAMA_TIMEOUT: "${OLLAMA_TIMEOUT:-10m}"
       OLLAMA_MAX_CONCURRENT: "${OLLAMA_MAX_CONCURRENT:-1}"

services/knowledge/docker-compose.yml

@@ -18,6 +18,7 @@ services:
       BASIC_AUTH_PASSWORD: "${BASIC_AUTH_PASSWORD:-}"
       AI_FALLBACK_ENABLED: "${AI_FALLBACK_ENABLED:-false}"
       OLLAMA_BASE_URL: "${OLLAMA_BASE_URL:-http://ollama:11434}"
+      OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
       OLLAMA_MODEL: "${OLLAMA_MODEL:-}"
       OLLAMA_TIMEOUT: "${OLLAMA_TIMEOUT:-10m}"
       OLLAMA_MAX_CONCURRENT: "${OLLAMA_MAX_CONCURRENT:-1}"

services/knowledge/internal/aifallback/ollama.go

@@ -18,6 +18,7 @@ import (
 type Config struct {
 	BaseURL       string
 	Model         string
+	APIKey        string
 	Timeout       time.Duration
 	MaxConcurrent int
 	AutoReply     bool
@@ -148,6 +149,9 @@ func (s *Service) askOllama(ctx context.Context, query string) (staging.Draft, e
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json")
+	if token := strings.TrimSpace(s.cfg.APIKey); token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
 	resp, err := s.client.Do(req)
 	if err != nil {
 		if errors.Is(err, context.DeadlineExceeded) || errors.Is(ctx.Err(), context.DeadlineExceeded) {

services/knowledge/internal/aifallback/ollama_test.go

@@ -50,3 +50,27 @@ func TestGenerateUsesStructuredChatAndStoresResult(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestGenerateSendsOllamaBearerToken(t *testing.T) {
+	const token = "ollama-secret"
+	var auth string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth = r.Header.Get("Authorization")
+		_ = json.NewEncoder(w).Encode(map[string]any{"message": map[string]any{"content": `{"title":"T","text":"X","answer":"A","categories":[],"keywords":[]}`}})
+	}))
+	defer server.Close()
+	st, err := staging.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	svc, err := New(Config{BaseURL: server.URL, Model: "test", APIKey: token, Timeout: time.Second, MaxConcurrent: 1, MinScore: 0.78}, st)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.Generate(context.Background(), "secure ollama request"); err != nil {
+		t.Fatal(err)
+	}
+	if auth != "Bearer "+token {
+		t.Fatalf("authorization=%q", auth)
+	}
+}