fix(ai): allow Ollama Cloud API key in AI settings (#4262)

The Ollama detection matched any URL containing "ollama", which hides
the API Key field for Ollama Cloud (ollama.com) and drops the key from
the createOllama() client, so cloud requests go out unauthenticated.

Narrow the rule to localhost-only Ollama and forward the API key as a
Bearer header when provided.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/dokploy/components/dashboard/settings/handle-ai.tsx

@@ -131,7 +131,10 @@ export const HandleAi = ({ aiId }: Props) => {
 	const apiUrl = form.watch("apiUrl");
 	const apiKey = form.watch("apiKey");
 
-	const isOllama = apiUrl.includes(":11434") || apiUrl.includes("ollama");
+	// Any Ollama instance on the default port 11434 is treated as no-auth
+	// (covers localhost and self-hosted LAN deployments). Ollama Cloud
+	// (ollama.com on 443) falls through and requires an API key.
+	const isLocalOllama = apiUrl.includes(":11434");
 	const {
 		data: models,
 		isFetching: isLoadingServerModels,
@@ -142,7 +145,7 @@ export const HandleAi = ({ aiId }: Props) => {
 			apiKey: apiKey ?? "",
 		},
 		{
-			enabled: !!apiUrl && (isOllama || !!apiKey),
+			enabled: !!apiUrl && (isLocalOllama || !!apiKey),
 		},
 	);
 
@@ -275,7 +278,7 @@ export const HandleAi = ({ aiId }: Props) => {
 							)}
 						/>
 
-						{!isOllama && (
+						{!isLocalOllama && (
 							<FormField
 								control={form.control}
 								name="apiKey"

packages/server/src/utils/ai/select-ai-provider.ts

@@ -74,8 +74,10 @@ export function selectAIProvider(config: { apiUrl: string; apiKey: string }) {
 			});
 		case "ollama":
 			return createOllama({
-				// optional settings, e.g.
 				baseURL: config.apiUrl,
+				headers: config.apiKey
+					? { Authorization: `Bearer ${config.apiKey}` }
+					: undefined,
 			});
 		case "deepinfra":
 			return createDeepInfra({