From db96bd1ac79379d54fa0592a6f5a1befd0ce76ae Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Wed, 24 Jun 2026 14:04:09 -0700
Subject: [PATCH] dedicated ollama user/group

---
 hw/straylight/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index e9ca2c6..af8b97a 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -17,6 +17,8 @@
     services.ollama = {
       enable = true;
       acceleration = "vulkan";
+      user = "ollama";
+      group = "ollama";
     };
     # straylight is the unikernel host. The shared mcp.nix locks the agent
     # down with PrivateDevices=true, which hides /dev/kvm and /dev/net/tun.