OllamaとFastAPIでカスタムAIマイクロサービスを構築する方法｜認証・レート制限・ロギングを追加してチームAPIを本番運用する

この記事のポイント

・FastAPIとhttpxでOllamaの/api/chatをラップするカスタムAPIサーバーを構築し、Ollamaポートを外部から完全に隔離できる
・APIKeyHeaderとDependencyを使ってチームメンバーごとにAPIキーを発行し、不正利用を403でブロックできる
・slowapiで1分あたりのリクエスト上限を設定し、Ollamaが過負荷で応答不能になるリスクを防げる
・structlogで構造化JSON形式のログを出力し、チーム名・レスポンス時間・リクエストIDをjqで即座に絞り込める

$ python3 --version
Python 3.11.9

$ sudo add-apt-repository ppa:deadsnakes/ppa
$ sudo apt update
$ sudo apt install python3.11 python3.11-venv -y

$ sudo mkdir -p /opt/ollama-api
$ sudo chown ubuntu:ubuntu /opt/ollama-api
$ python3 -m venv /opt/ollama-api/venv
$ source /opt/ollama-api/venv/bin/activate
$ pip install fastapi uvicorn httpx slowapi structlog

$ sudo mkdir -p /etc/systemd/system/ollama.service.d
$ sudo tee /etc/systemd/system/ollama.service.d/override.conf << 'EOF'
[Service]
Environment="OLLAMA_HOST=127.0.0.1"
EOF
$ sudo systemctl daemon-reload
$ sudo systemctl restart ollama
$ curl -s http://127.0.0.1:11434/api/tags | python3 -m json.tool | head -5

from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse
import httpx

app = FastAPI(title="Ollama Gateway")
OLLAMA_BASE = "http://127.0.0.1:11434"

@app.post("/v1/chat")
async def chat(request: Request):
    body = await request.json()
    async with httpx.AsyncClient(timeout=180) as client:
        resp = await client.post(
            f"{OLLAMA_BASE}/api/chat",
            json=body,
        )
    return resp.json()

$ cd /opt/ollama-api && source venv/bin/activate
$ uvicorn main:app --host 0.0.0.0 --port 8000 &
$ curl -s -X POST http://localhost:8000/v1/chat \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:8b","messages":[{"role":"user","content":"ping"}],"stream":false}' \
  | python3 -m json.tool
{
  "model": "llama3.3:8b",
  "message": {
    "role": "assistant",
    "content": "pong. How can I help you?"
  },
  "done": true
}

from fastapi import Depends, HTTPException
from fastapi.security import APIKeyHeader
import os

api_key_header = APIKeyHeader(name="X-API-Key", auto_error=True)

# 本番では環境変数からパースする（コードに認証情報を埋め込まない）
# 例: API_KEYS="devkey123:dev_team,opskey456:ops_team"
def _load_keys() -> dict:
    raw = os.environ.get("API_KEYS", "devkey123:dev_team")
    return dict(pair.split(":") for pair in raw.split(","))

VALID_KEYS = _load_keys()

async def verify_api_key(api_key: str = Depends(api_key_header)) -> str:
    if api_key not in VALID_KEYS:
        raise HTTPException(status_code=403, detail="Invalid API key")
    return VALID_KEYS[api_key]  # チーム名を返す

@app.post("/v1/chat")
async def chat(
    request: Request,
    team: str = Depends(verify_api_key),
):
    body = await request.json()
    async with httpx.AsyncClient(timeout=180) as client:
        resp = await client.post(f"{OLLAMA_BASE}/api/chat", json=body)
    return resp.json()

# APIキーなし → 403
$ curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:8000/v1/chat \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:8b","messages":[{"role":"user","content":"test"}],"stream":false}'
403

# 正しいAPIキーあり → 200
$ curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:8000/v1/chat \
  -H "Content-Type: application/json" \
  -H "X-API-Key: devkey123" \
  -d '{"model":"llama3.3:8b","messages":[{"role":"user","content":"test"}],"stream":false}'
200

from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

@app.post("/v1/chat")
@limiter.limit("10/minute")
async def chat(
    request: Request,
    team: str = Depends(verify_api_key),
):
    body = await request.json()
    async with httpx.AsyncClient(timeout=180) as client:
        resp = await client.post(f"{OLLAMA_BASE}/api/chat", json=body)
    return resp.json()

$ for i in $(seq 1 12); do
    CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST http://localhost:8000/v1/chat \
      -H "Content-Type: application/json" \
      -H "X-API-Key: devkey123" \
      -d '{"model":"llama3.3:8b","messages":[{"role":"user","content":"test"}],"stream":false}')
    echo "req${i}: ${CODE}"
  done
req1: 200
req2: 200
...
req10: 200
req11: 429
req12: 429

import structlog
import uuid
import time

structlog.configure(
    processors=[
        structlog.processors.TimeStamper(fmt="iso"),
        structlog.processors.JSONRenderer(),
    ]
)
log = structlog.get_logger()

from starlette.middleware.base import BaseHTTPMiddleware

class LoggingMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        req_id = str(uuid.uuid4())[:8]
        start = time.monotonic()
        response = await call_next(request)
        elapsed_ms = round((time.monotonic() - start) * 1000)
        log.info(
            "http_request",
            req_id=req_id,
            method=request.method,
            path=request.url.path,
            status=response.status_code,
            elapsed_ms=elapsed_ms,
        )
        return response

app.add_middleware(LoggingMiddleware)

{"event": "http_request", "req_id": "a3f1c9e2", "method": "POST",
 "path": "/v1/chat", "status": 200, "elapsed_ms": 1842,
 "timestamp": "2026-07-26T10:00:01Z"}

$ journalctl -u ollama-api -o cat | jq 'select(.elapsed_ms > 5000)'

$ sudo tee /etc/systemd/system/ollama-api.service << 'EOF'
[Unit]
Description=Ollama FastAPI Gateway
After=network.target ollama.service
Requires=ollama.service

[Service]
User=ubuntu
WorkingDirectory=/opt/ollama-api
EnvironmentFile=/opt/ollama-api/.env
ExecStart=/opt/ollama-api/venv/bin/uvicorn main:app \
    --host 0.0.0.0 --port 8000 --workers 2
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# enable and verify the service
$ sudo systemctl daemon-reload
$ sudo systemctl enable --now ollama-api
$ sudo systemctl status ollama-api
* ollama-api.service - Ollama FastAPI Gateway
     Active: active (running) since 2026-07-26 10:00:00 JST
   Main PID: 12345 (uvicorn)

version: "3.9"
services:
  ollama-api:
    build: .
    ports:
      - "8000:8000"
    env_file: .env
    environment:
      - OLLAMA_BASE=http://host.docker.internal:11434
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

$ sudo ufw allow from 192.168.1.0/24 to any port 8000 comment "ollama-api internal"
$ sudo ufw reload
$ sudo ufw status numbered | grep 8000
[ 5] 8000                       ALLOW IN    192.168.1.0/24

FastAPIでOllamaを本番運用する2日間ハンズオン

APIゲートウェイの設計から認証・レート制限・監視・デプロイまで、実機GPU環境で手を動かしながら体系的に習得したい方向けに、「ローカルAIマスターセミナー」を開催しています。
少人数（最大8名）ZOOMハンズオン形式で実施しています。