services/machine-learning: drop privileges for llama-swap service

1 files changed, 20 insertions, 7 deletions

diff --git a/epistemia/services/machine-learning.scm b/epistemia/services/machine-learning.scm
index 0226300..3d94908 100644
--- a/epistemia/services/machine-learning.scm
+++ b/epistemia/services/machine-learning.scm
@@ -1,6 +1,8 @@
 (define-module (epistemia services machine-learning)
+  #:use-module (gnu packages admin)
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
+  #:use-module (gnu system shadow)
   #:use-module (guix gexp)
   #:use-module (guix records)
   #:export (llama-swap-configuration
@@ -20,6 +22,15 @@
   (watch-config? llama-swap-configuration-watch-config?
                  (default #f)))
 
+(define llama-swap-account-service
+  (list (user-account
+         (name "llama-swap")
+         (group "nogroup")
+         (system? #t)
+         (comment "llama-swap daemon user")
+         (home-directory "/var/empty")
+         (shell (file-append shadow "/sbin/nologin")))))
+
 (define (llama-swap-shepherd-service config)
   (let ((pkg       (llama-swap-configuration-package config))
         (lcpp      (llama-swap-configuration-llama-cpp config))
@@ -37,18 +48,20 @@
                        "-config" #$cfg
                        "-listen" #$listen)
                  (if #$watch? '("-watch-config") '()))
+                #:user "llama-swap"
                 #:environment-variables
                 (cons (string-append "PATH=" #$(file-append lcpp "/bin"))
                       (default-environment-variables))))
       (stop #~(make-kill-destructor))))))
 
 (define llama-swap-service-type
-  (service-type
-   (name 'llama-swap)
-   (extensions
-    (list (service-extension shepherd-root-service-type
-                             llama-swap-shepherd-service)))
-    (description
-     "llama-swap is an @code{OpenAI} API compatible server that gives you complete
+  (service-type (name 'llama-swap)
+                (extensions
+                 (list (service-extension account-service-type
+                                          (const llama-swap-account-service))
+                       (service-extension shepherd-root-service-type
+                                          llama-swap-shepherd-service)))
+                (description
+                 "llama-swap is an @code{OpenAI} API compatible server that gives you complete
 control over how you use your hardware. It automatically swaps to the
 configuration of your choice for serving a model.")))