I have been experimenting with a practical question: can a public web application use capable local AI without paying for a cloud GPU or exposing a computer in my home to the internet?
The answer is yes. I now run the public-facing application on an ordinary low-cost server while an Apple Silicon Mac handles the AI work locally through Ollama. A private, encrypted SSH tunnel connects the two.
This is not a replacement for every cloud AI service, but it is a useful option when privacy, cost, and control matter more than massive scale.
The Basic Idea
The public server does what a normal web server is good at. It hosts the website, accepts secure browser requests, manages the database, authenticates users, and prepares the information that should be sent to the model.
The Mac does one specialized job: it runs the local language model. When the web application needs an answer, it sends the request through a private connection that exists only inside the server. SSH carries that request to Ollama on the Mac, and the answer comes back along the same path.
From the visitor’s perspective, it behaves like any other browser application. The browser talks only to the public website over HTTPS. It never connects directly to the Mac and never needs to know that Ollama is involved.
Why I Like This Approach
- It keeps costs predictable. The public server does not need an expensive GPU because the Mac handles inference.
- It uses hardware I already own. Apple Silicon is surprisingly capable for running useful local models.
- It keeps the model private. Ollama is not given a public internet address or an open firewall port.
- It separates responsibilities. The web server handles public traffic, while the Mac concentrates on AI generation.
- It leaves room to grow. I can change the Mac, the model, or the public application independently.
How It Stays Private
The most important detail is that the Mac initiates the connection. I did not open an Ollama port on my router, add a new inbound firewall rule, or make the model reachable from the public internet.
The browser-to-server portion is protected by HTTPS. The server-to-Mac portion travels inside an authenticated SSH connection. On both machines, the Ollama-facing endpoints remain bound to their local loopback addresses. The public application is still responsible for authentication, authorization, rate limits, and deciding what information is allowed to reach the model.
That distinction matters. The SSH tunnel is not a public gateway to the Mac. It is a narrow, private bridge between two specific local services.
The Trade-Offs
This design is not magic. The Mac must be powered on, awake, connected to the internet, and running both Ollama and the tunnel. If any part of that chain is unavailable, local AI requests will fail unless the application has a fallback.
It is a strong fit for experiments, internal tools, private knowledge assistants, prototypes, and lower-volume applications. A service that needs guaranteed 24/7 availability or heavy simultaneous usage may still need dedicated infrastructure or a cloud model.
What I Learned
The public web server and the AI model do not have to live on the same machine. Once those responsibilities are separated, a modest cloud server and a capable local Mac can work together surprisingly well.
For me, the most appealing part is the upgrade path. As local models and Apple Silicon improve, the AI side can get faster and more capable without redesigning the public application.
Read the Full Technical Walkthrough
This post is the short version. I published a much more detailed guide at JAMD Technologies covering the complete architecture, request flow, security model, operational considerations, performance measurements, setup steps, and troubleshooting.
Read the complete guide: Using a Mac GPU as a Private AI Engine for a Low-Cost Cloud Server