secure-by-default docker compose templates for self-hosted ai stacks. each template puts an nginx basic-auth gate in front of the service and publishes nothing else — and each template's ci proves it grades A under aicheck.
| template | stack | only published port(s) |
|---|---|---|
| ollama-auth-proxy | ollama behind nginx basic auth | 127.0.0.1:11435 |
| n8n-locked | n8n behind nginx basic auth | 127.0.0.1:5679 |
| open-webui-locked | open webui behind nginx basic auth | 127.0.0.1:3003 |
| weaviate-qdrant-locked | two vector dbs behind one nginx | 127.0.0.1:8081 + 127.0.0.1:6335 |
- one image does the auth:
nginx:1.27.4withauth_basic. no idp, no sidecar, deterministic in ci. - backends publish no ports. they exist only on the internal compose network.
- every published port is loopback-only (
127.0.0.1) and deliberately not a well-known ai port. - each template ships a
compose.exposed.yamlthat publishes the backend directly. ci uses it to prove the grade collapses the moment the proxy is bypassed. - each workflow has two jobs:
secureasserts grade A;negativeasserts the scan step fails with grade F or D when the backend is exposed.
cd into a template, cp .env.example .env, edit it, generate .htpasswd (one command, in the template's readme), docker compose up -d.
verify any of these in one command: pip install aicheck-scan.