Merge remote-tracking branch 'origin'

modules/nixos-modules/ollama.nix

@@ -7,7 +7,8 @@
     services.ollama.exposePort = lib.mkEnableOption "should we expose ollama on tailscale";
   };
 
-  config = lib.mkMerge [
+  config = lib.mkIf config.services.ollama.enable (
+    lib.mkMerge [
       {
         services.ollama = {
           # TODO: these should match whats set in the users file
@@ -15,7 +16,17 @@
           user = "ollama";
         };
       }
-    (lib.mkIf config.host.impermanence.enable (lib.mkIf config.services.ollama.enable {
+      (lib.mkIf config.services.ollama.exposePort (let
+        ports = [
+          config.services.ollama.port
+        ];
+      in {
+        networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {
+          allowedTCPPorts = ports;
+          allowedUDPPorts = ports;
+        };
+      }))
+      (lib.mkIf config.host.impermanence.enable {
         environment.persistence."/persist/system/root" = {
           enable = true;
           hideMounts = true;
@@ -25,17 +36,16 @@
               user = config.services.ollama.user;
               group = config.services.ollama.group;
             }
+            {
+              directory = "/var/lib/private/ollama";
+              user = config.services.ollama.user;
+              group = config.services.ollama.group;
+              mode = "0700";
+              defaultPerms.mode = "0700";
+            }
           ];
         };
-      networking.firewall.interfaces.${config.services.tailscale.interfaceName} = let
+      })
-        ports = [
+    ]
-          config.services.ollama.port
+  );
-        ];
-      in
-        lib.mkIf config.services.ollama.exposePort {
-          allowedTCPPorts = ports;
-          allowedUDPPorts = ports;
-        };
-    }))
-  ];
 }