move some profiles

.github/dependabot.yml

@@ -4,3 +4,6 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/hosts.yml

@@ -1,10 +1,10 @@
 name: "Build and cache hosts configurations"
 on:
-  push:
-    branches:
-      - master
-    paths:
-      - 'flake.lock'
+  # push:
+  #   branches:
+  #     - master
+  #   paths:
+  #     - 'flake.lock'
   workflow_dispatch:
 
 jobs:

machines/AMD-Workstation/default.nix

@@ -15,6 +15,8 @@
     customProfiles.nicotine
     customProfiles.sunshine
     customProfiles.wine-games
+
+    customProfiles.ollama
   ];
 
   security.pki.certificateFiles = [ ../../misc/mitmproxy-ca-cert.pem ];
@@ -118,46 +120,14 @@
     home.stateVersion = "24.05";
   };
 
-  services.ollama = {
-    enable = true;
-    host = "127.0.0.1";
-    port = 11434;
-    acceleration = "rocm";
-    openFirewall = false;
-    environmentVariables = {
-      HSA_OVERRIDE_GFX_VERSION = "10.3.0";
-      OLLAMA_KEEP_ALIVE = "-1";
-      # OLLAMA_LLM_LIBRARY = "";
-    };
-  };
-  services.open-webui = {
-    enable = true;
-    host = "127.0.0.1";
-    port = 8081;
-    openFirewall = false;
-    environment = {
-      ANONYMIZED_TELEMETRY = "False";
-      DO_NOT_TRACK = "True";
-      SCARF_NO_ANALYTICS = "True";
-      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
-      # Disable authentication
-      WEBUI_AUTH = "False";
-    };
-  };
-
   persist.state = {
-    directories = [
-      "/var/lib/ollama"
-      "/var/lib/open-webui"
-    ];
     homeDirectories = [
-    ".local/share/winbox"
-    ".local/share/PrismLauncher"
-    ".local/share/distrobox"
-    ".mitmproxy"
-    ".config/exercism"
-      ".llama"
-  ];
+      ".local/share/winbox"
+      ".local/share/PrismLauncher"
+      ".local/share/distrobox"
+      ".mitmproxy"
+      ".config/exercism"
+    ];
   };
 
   system.stateVersion = "23.05";

modules/persist.nix

@@ -111,14 +111,14 @@ in {
       startAt = cfg.cache.clean.dates;
     };
 
-    system.activationScripts = {
-      homedir.text = builtins.concatStringsSep "\n" (map (dir: ''
-        mkdir -p ${cfg.persistRoot}${dir}
-        chown ${config.mainuser}:users ${cfg.persistRoot}${dir}
-      '') (
-        (builtins.filter (lib.hasPrefix cfg.homeDir) allDirectories)
-          ++ absoluteHomePath allHomeDirectories
-      ));
-    };
+    # system.activationScripts = {
+    #   homedir.text = builtins.concatStringsSep "\n" (map (dir: ''
+    #     mkdir -p ${cfg.persistRoot}${dir}
+    #     chown ${config.mainuser}:users ${cfg.persistRoot}${dir}
+    #   '') (
+    #     (builtins.filter (lib.hasPrefix cfg.homeDir) allDirectories)
+    #       ++ absoluteHomePath allHomeDirectories
+    #   ));
+    # };
   };
 }

profiles/servers/ollama.nix

@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+let
+  gpu = config.deviceSpecific.devInfo.gpu.vendor;
+in {
+  services.ollama = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 11434;
+    sandbox = false;
+    acceleration =
+      if gpu == "amd" then
+        "rocm"
+      else if gpu == "nvidia" then
+        "cuda"
+      else false;
+    openFirewall = false;
+    environmentVariables = {
+      HSA_OVERRIDE_GFX_VERSION = "10.3.0";
+      OLLAMA_KEEP_ALIVE = "-1";
+      # OLLAMA_LLM_LIBRARY = "";
+    };
+  };
+  services.open-webui = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 8081;
+    openFirewall = false;
+    environment = {
+      ANONYMIZED_TELEMETRY = "False";
+      DO_NOT_TRACK = "True";
+      SCARF_NO_ANALYTICS = "True";
+      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
+      # Disable authentication
+      WEBUI_AUTH = "False";
+    };
+  };
+
+  users.groups.ollama = { };
+  users.users.ollama = {
+    description = "ollama user";
+    isSystemUser = true;
+    group = "ollama";
+    extraGroups = [ "video" "render" ];
+  };
+
+  systemd.services.ollama.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "ollama";
+    Group = "ollama";
+  };
+  systemd.services.open-webui.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "ollama";
+    Group = "ollama";
+  };
+
+  persist.state.directories = [
+    "/var/lib/ollama"
+    "/var/lib/open-webui"
+  ];
+}