commit 38d29789c4d01a7921952f09ef54f2875308d46c parent 24e471ddc7b5367e7cdcd1bcbd70c45a812a3131 Author: Vineet Kumar <git@vineetk.net> Date: Mon, 27 Apr 2026 11:37:12 -0400 services/machine-learning: drop privileges for llama-swap service Diffstat:
| M | epistemia/services/machine-learning.scm | | | 27 | ++++++++++++++++++++------- |
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/epistemia/services/machine-learning.scm b/epistemia/services/machine-learning.scm @@ -1,6 +1,8 @@ (define-module (epistemia services machine-learning) + #:use-module (gnu packages admin) #:use-module (gnu services) #:use-module (gnu services shepherd) + #:use-module (gnu system shadow) #:use-module (guix gexp) #:use-module (guix records) #:export (llama-swap-configuration @@ -20,6 +22,15 @@ (watch-config? llama-swap-configuration-watch-config? (default #f))) +(define llama-swap-account-service + (list (user-account + (name "llama-swap") + (group "nogroup") + (system? #t) + (comment "llama-swap daemon user") + (home-directory "/var/empty") + (shell (file-append shadow "/sbin/nologin"))))) + (define (llama-swap-shepherd-service config) (let ((pkg (llama-swap-configuration-package config)) (lcpp (llama-swap-configuration-llama-cpp config)) @@ -37,18 +48,20 @@ "-config" #$cfg "-listen" #$listen) (if #$watch? '("-watch-config") '())) + #:user "llama-swap" #:environment-variables (cons (string-append "PATH=" #$(file-append lcpp "/bin")) (default-environment-variables)))) (stop #~(make-kill-destructor)))))) (define llama-swap-service-type - (service-type - (name 'llama-swap) - (extensions - (list (service-extension shepherd-root-service-type - llama-swap-shepherd-service))) - (description - "llama-swap is an @code{OpenAI} API compatible server that gives you complete + (service-type (name 'llama-swap) + (extensions + (list (service-extension account-service-type + (const llama-swap-account-service)) + (service-extension shepherd-root-service-type + llama-swap-shepherd-service))) + (description + "llama-swap is an @code{OpenAI} API compatible server that gives you complete control over how you use your hardware. It automatically swaps to the configuration of your choice for serving a model.")))