From 38d29789c4d01a7921952f09ef54f2875308d46c Mon Sep 17 00:00:00 2001
From: Vineet Kumar <git@vineetk.net>
Date: Mon, 27 Apr 2026 11:37:12 -0400
Subject: services/machine-learning: drop privileges for llama-swap service

---
 epistemia/services/machine-learning.scm | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

(limited to 'epistemia')

diff --git a/epistemia/services/machine-learning.scm b/epistemia/services/machine-learning.scm
index 0226300..3d94908 100644
--- a/epistemia/services/machine-learning.scm
+++ b/epistemia/services/machine-learning.scm
@@ -1,6 +1,8 @@
 (define-module (epistemia services machine-learning)
+  #:use-module (gnu packages admin)
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
+  #:use-module (gnu system shadow)
   #:use-module (guix gexp)
   #:use-module (guix records)
   #:export (llama-swap-configuration
@@ -20,6 +22,15 @@
   (watch-config? llama-swap-configuration-watch-config?
                  (default #f)))
 
+(define llama-swap-account-service
+  (list (user-account
+         (name "llama-swap")
+         (group "nogroup")
+         (system? #t)
+         (comment "llama-swap daemon user")
+         (home-directory "/var/empty")
+         (shell (file-append shadow "/sbin/nologin")))))
+
 (define (llama-swap-shepherd-service config)
   (let ((pkg       (llama-swap-configuration-package config))
         (lcpp      (llama-swap-configuration-llama-cpp config))
@@ -37,18 +48,20 @@
                        "-config" #$cfg
                        "-listen" #$listen)
                  (if #$watch? '("-watch-config") '()))
+		#:user "llama-swap"
                 #:environment-variables
 		(cons (string-append "PATH=" #$(file-append lcpp "/bin"))
 		      (default-environment-variables))))
       (stop #~(make-kill-destructor))))))
 
 (define llama-swap-service-type
-  (service-type
-   (name 'llama-swap)
-   (extensions
-    (list (service-extension shepherd-root-service-type
-                             llama-swap-shepherd-service)))
-    (description
-     "llama-swap is an @code{OpenAI} API compatible server that gives you complete
+  (service-type (name 'llama-swap)
+		(extensions
+		 (list (service-extension account-service-type
+					  (const llama-swap-account-service))
+		       (service-extension shepherd-root-service-type
+					  llama-swap-shepherd-service)))
+		(description
+		 "llama-swap is an @code{OpenAI} API compatible server that gives you complete
 control over how you use your hardware. It automatically swaps to the
 configuration of your choice for serving a model.")))
-- 
cgit v1.2.3