NVIDIA DGX Spark Remote Access: Run Inference From Anywhere

The NVIDIA DGX Spark puts a genuinely large amount of inference compute on a desk: a Grace Blackwell Superchip with unified memory big enough to hold models that would otherwise need a multi-GPU server. The catch is that most people don't sit next to it. It lives under a desk, in a home lab rack, or in an office closet, and you want to run inference against it from a laptop somewhere else - another room, another building, another city.

That's a remote access problem, and the default options for solving it are all worse than they should be.

The Usual Ways to Reach a DGX Spark

None of these give you what a model endpoint should look like: one URL, that you and your team can point coding agents and chat clients at, with access controlled by who you are rather than what network you happen to be on.

Run Ollama on the Spark, Reach It Through Pangolin

Pangolin is an identity-aware AI gateway that proxies OpenAI, Anthropic, Gemini, and other model APIs behind one endpoint - and it treats a model running on your own hardware the same way it treats a cloud provider. A lightweight connector on the Spark opens an outbound-only tunnel to Pangolin, so the box never needs an inbound port, a public IP, or a VPN client of its own. You reach it with the same desktop app you'd use to reach any other private resource, authenticated with your existing SSO login instead of an API key.

Ollama is the fastest path to an endpoint on a DGX Spark: one install command, an OpenAI-compatible API out of the box, and enough unified memory on the Spark to run models most laptops can't touch locally. Nothing here is Spark-specific - the same setup works for vLLM, llama.cpp, or LM Studio if you'd rather run one of those instead.

1. Install Ollama on the Spark

DGX OS is Ubuntu-based, so the standard install works:

curl -fsSL https://ollama.com/install.sh | sh

Pull a model sized for the Spark's memory:

ollama pull llama3.3:70b

Ollama listens on 11434 and serves an OpenAI-compatible API at /v1/chat/completions.

2. Install a Site Connector on the Spark

In the dashboard, go to Sites > Create, choose Newt as the site type, and name it (e.g. "DGX Spark"). Pangolin generates a site ID, secret, and a ready-to-copy install command. Run that command on the Spark itself:

curl -fsSL https://static.pangolin.net/get-newt.sh | bash
newt --id <site-id> --secret <site-secret> --endpoint https://app.pangolin.net

See Install Sites for the full reference.

Newt makes an outbound connection to Pangolin and holds it open. The Spark makes no inbound listener changes and needs no public IP - the same posture as any other machine behind NAT.

3. Create a Custom Provider Pointed at Ollama

In the dashboard, go to AI Gateway > Providers > Create:

1. Set Provider Type to Custom and name it (e.g. "DGX Spark").
2. Select the OpenAI Chat Completions capability.
3. Set Routing Mode to Site Targets.
4. Set Auth Type to No Auth (Ollama has none by default on a private LAN).
5. Allow the model id you pulled, e.g. llama3.3:70b.
6. Save, then add a target on the Network tab: host localhost (or the Spark's LAN IP), port 11434, method HTTP.

Full field reference: Ollama as a Custom provider.

4. Create an AI Gateway Resource

Resources > Create > Type AI Gateway. Attach the provider from step 3. Choose:

• Private, if you want to authenticate with the Pangolin desktop app and avoid dealing with virtual API keys.
• Public, if you want auth with a virtual API key from user machines, a service, or CI job

5. Connect

If you go with private resources, install the Pangolin desktop app on your laptop and log in with your identity provider - Okta, Azure, Google, or whatever your org already uses. No key to generate or paste. Point any OpenAI-compatible client (Open WebUI, a coding agent, your own script) at the resource's URL, and you're running inference on the Spark from wherever you're sitting. For how to configure common coding clients see the docs.

For a private resource the API key field is unused by Pangolin, but most clients still need something typed in it - use the literal string none.

Frontier Models on the Same Endpoint

The DGX Spark is enormous for a desktop box, but it still isn't a frontier-scale cluster. Attach an Anthropic or OpenAI provider to the same resource, and both the Spark's local model and a cloud model are reachable from the exact same URL - your coding agent or chat client switches models without touching an endpoint or a key. See Multiple Gateway Resources if different people on your team should see different sets of models.

What You Get That a VPN Doesn't

• No static credentials. Access comes from your SSO login and a WireGuard-backed connection the desktop app builds for you, not an API key that can leak, get pasted into the wrong Slack channel, or outlive the person who generated it.
• Scoped, not network-wide. You reach the AI Gateway resource, not the Spark's whole LAN, and not the rest of your home or office network.
• Nothing inbound on the Spark. Newt only makes outbound connections. No forwarded port, no public IP, no NVIDIA Sync agent to keep patched.
• One URL for local and frontier models. The Spark's Ollama endpoint and any cloud provider you also use sit behind the same gateway resource.
• Usage without extra tooling. Every call is attributed to a user and shows up in session logs and usage analytics, the same as a cloud provider.

FAQ

How do I access my NVIDIA DGX Spark remotely?

Install a lightweight site connector (Newt) on the Spark, which opens an outbound-only tunnel to Pangolin. Run an inference server like Ollama on the Spark, attach it as a provider on an AI Gateway resource, then connect from anywhere with the Pangolin desktop app or CLI - no port forwarding, VPN, or SSH tunnel required.

Do I need to open a port on my router to reach my DGX Spark from outside my home network?

No. The site connector on the Spark makes an outbound connection to Pangolin and keeps it open, so the Spark never listens for inbound traffic. This works from behind NAT and typical home or corporate firewalls without any router configuration.

What inference server should I run on a DGX Spark?

Ollama is the fastest path - one install script and an OpenAI-compatible API. vLLM is a good option if you want higher-throughput batched serving. Both work as a Custom provider in Pangolin's AI gateway; pick whichever fits how you plan to use the box.

Can I use my DGX Spark and a frontier model like Claude or GPT at the same time?

Yes. Attach both the Spark's provider and a cloud provider (Anthropic, OpenAI, and others) to the same AI Gateway resource. Clients call one endpoint and switch models without reconfiguring anything.

Do I need an API key to use my DGX Spark remotely?

Not if you connect through a private AI Gateway resource. Identity comes from your SSO login through the Pangolin desktop app, not a key. Public resources - for CI jobs or unattended callers - do use a virtual API key instead of a real provider credential.

Is this safer than exposing Ollama directly to the internet?

Considerably. Ollama has no built-in auth by default, so port-forwarding it means anyone who finds the address can run inference on your hardware for free, or worse. Pangolin authenticates every caller - by identity for private resources, by virtual key for public ones - before a request ever reaches the Spark.

See Also

• AI Gateway Overview: providers, resources, and virtual keys
• Ollama as a Custom Provider: full configuration reference
• Private AI Gateway: identity-based access with no API key
• vLLM and Ollama Clusters: the same pattern for a multi-GPU cluster
• How Pangolin Punches Through NATs and Firewalls: how the outbound-only tunnel works
• How to Stop Using Virtual API Keys: moving human users to identity-based access instead of keys