colin
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/ollama: add options to bypass sandboxing

This commit is contained in:
abysssol 2024-04-18 10:47:35 -04:00
parent 457c341784
commit 552eb75964
1 changed files with 36 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
nixos/modules/services/misc/ollama.nix
View File

@ -21,6 +21,8 @@ in
example = "/home/foo";
description = ''
The home directory that the ollama service is started in.
See also `services.ollama.writablePaths` and `services.ollama.sandbox`.
'';
};
models = lib.mkOption {
@ -29,6 +31,37 @@ in
example = "/path/to/ollama/models";
description = ''
The directory that the ollama service will read models from and download new models to.
See also `services.ollama.writablePaths` and `services.ollama.sandbox`
if downloading models or other mutation of the filesystem is required.
'';
};
sandbox = lib.mkOption {
type = types.bool;
default = true;
example = false;
description = ''
Whether to enable systemd's sandboxing capabilities.
This sets [`DynamicUser`](
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
), which runs the server as a unique user with read-only access to most of the filesystem.
See also `services.ollama.writablePaths`.
'';
};
writablePaths = lib.mkOption {
type = types.listOf types.str;
default = [ ];
example = [ "/home/foo" "/mnt/foo" ];
description = ''
Paths that the server should have write access to.
This sets [`ReadWritePaths`](
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ReadWritePaths=
), which allows specified paths to be written to through the default sandboxing.
See also `services.ollama.sandbox`.
'';
};
listenAddress = lib.mkOption {
@ -59,8 +92,8 @@ in
type = types.attrsOf types.str;
default = { };
example = {
HOME = "/tmp";
OLLAMA_LLM_LIBRARY = "cpu";
HIP_VISIBLE_DEVICES = "0,1";
};
description = ''
Set arbitrary environment variables for the ollama service.
@ -87,7 +120,8 @@ in
ExecStart = "${lib.getExe ollamaPackage} serve";
WorkingDirectory = cfg.home;
StateDirectory = [ "ollama" ];
DynamicUser = true;
DynamicUser = cfg.sandbox;
ReadWritePaths = cfg.writablePaths;
};
};