[inferno-ml] Move inferno-ml-server to system service

nix/inferno-ml/images/common/cpu.nix

@@ -12,7 +12,7 @@
     configuration = {
       port = 8080;
       cache = {
-        path = "/home/inferno/.cache/inferno-ml-server/models";
+        path = "/home/inferno/.cache/models";
         max-size = 10 * 1073741824;
       };
       # NOTE This should be overridden for real deployments

nix/inferno-ml/images/common/gpu.nix

@@ -29,7 +29,7 @@
     configuration = {
       port = 8080;
       cache = {
-        path = "/home/inferno/.cache/inferno-ml-server/models";
+        path = "/home/inferno/.cache/models";
         max-size = 10 * 1073741824;
       };
       # NOTE This should be overridden for real deployments

nix/inferno-ml/images/default.nix

@@ -38,7 +38,7 @@ in
           {
             imports = [ ./common/gpu.nix ];
             # The big one
-            amazonImage.sizeMB = 107374;
+            amazonImage.sizeMB = 53687;
           }
         ];
       };
@@ -63,7 +63,7 @@ in
           {
             imports = [ ./common/cpu.nix ];
             # The big one
-            amazonImage.sizeMB = 107374;
+            amazonImage.sizeMB = 53687;
           }
         ];
       };

nix/inferno-ml/images/qcow2.nix

@@ -10,7 +10,7 @@
       # Ten minute timeout
       timeout = 600;
       cache = {
-        path = "/home/inferno/.cache/inferno-ml-server/models";
+        path = "/home/inferno/.cache/models";
         max-size = 10 * 1073741824;
       };
       # NOTE This can be overridden, unless you plan on running the VM and

nix/inferno-ml/modules/inferno-ml-server.nix

@@ -144,7 +144,13 @@ in
         }.${builtins.typeOf cfg.configuration};
       in
       {
-        systemd.user.services.inferno-ml-server = {
+        # FIXME Ideally we should have a system user to run this. However,
+        # we are doing some urgent testing and that would require more work.
+        # We will fix having this run as `inferno` once we finalize the image
+        # config
+        #
+        # See https://github.com/plow-technologies/inferno/issues/151
+        systemd.services.inferno-ml-server = {
           description = "Start `inferno-ml-server` server";
           wantedBy = [ "default.target" ];
           after = [ "network-online.target" ];
@@ -153,6 +159,11 @@ in
             ExecStart = "${cfg.package}/bin/inferno-ml-server --config ${configFile}";
             Restart = "always";
             RestartSec = 5;
+            User = "inferno";
+            Group = "inferno";
+            PrivateTmp = "yes";
+            ProtectDevices = "yes";
+            NoNewPrivileges = "yes";
           };
         };
 
@@ -171,10 +182,6 @@ in
                 mkdir -p ${path}
                 chown -R ${cfg.user}:${cfg.group} ${path}
                 chmod u+rwx ${path}
-
-                mkdir -p /home/${cfg.user}/.cache/bridge
-                chown -R ${cfg.user}:${cfg.group} /home/${cfg.user}/.cache/bridge
-                chmod u+rwx /home/${cfg.user}/.cache/bridge
               '';
         };
       }

nix/inferno-ml/tests/server.nix

@@ -151,13 +151,13 @@ pkgs.nixosTest {
     };
 
     systemd = {
-      user.services.inferno-ml-server = {
-        # Silences logs
-        serviceConfig.StandardOutput = pkgs.lib.mkForce "null";
-        serviceConfig.StandardError = pkgs.lib.mkForce "null";
-      };
-
       services = {
+        inferno-ml-server = {
+          # Silences logs
+          serviceConfig.StandardOutput = pkgs.lib.mkForce "null";
+          serviceConfig.StandardError = pkgs.lib.mkForce "null";
+        };
+
         dummy-bridge = {
           description = "Run dummy bridge server";
           wantedBy = [ "default.target" ];
@@ -177,12 +177,6 @@ pkgs.nixosTest {
     };
     # See https://github.com/NixOS/nixpkgs/issues/183629
     system.activationScripts = {
-      enableLingering = ''
-        rm -rf /var/lib/systemd/linger
-        mkdir -p /var/lib/systemd/linger
-        touch /var/lib/systemd/linger/inferno
-      '';
-
       setupDummyDir = ''
         mkdir /tmp/dummy
         chmod a+rwx /tmp/dummy
@@ -225,9 +219,11 @@ pkgs.nixosTest {
       'psql -U inferno -d inferno -f ${../migrations/v1-create-tables.sql}'
     )
     node.succeed('insert-mnist-model')
+    node.wait_for_unit("inferno-ml-server.service")
+    node.succeed('curl --fail localhost:8080/status')
+
     node.succeed('sudo -HE -u inferno parse-scripts-and-save-params')
 
-    node.systemctl("start inferno-ml-server.service", user="inferno")
     node.succeed('sudo -HE -u inferno run-db-test >&2')
 
     # `tests/scripts/ones.inferno`