Commit graph

1848 commits

Author SHA1 Message Date
Ludovic Courtès
deeee98a50
services: dicod: Use one inetd endpoint per interface.
* gnu/services/dict.scm (dicod-shepherd-service): Remove
the (= 1 (length interfaces)) restriction by adding one endpoint per
interface.
2023-06-24 16:11:07 +02:00
Saku Laesvuori
a82130de50
services: certbot: Fix nginx crash when certbot is used without domains.
* gnu/services/certbot.scm (certbot-nginx-server-configurations):
Don't return a broken nginx-server-configuration with empty server_name
when no certificate domains are configured. Instead add a separate
server for every certificate, so 0 certificates adds 0 servers.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Reviewed-by: Bruno Victal <mirai@makinata.eu>
2023-06-18 23:12:10 +02:00
Ludovic Courtès
c27479a739
services: qemu-guest-agent: Add dependency on udev.
Fixes <https://issues.guix.gnu.org/64057>.

* gnu/services/virtualization.scm (qemu-guest-agent-shepherd-service):
Add 'requirement' field.

Reported-by: Yann Dupont <yann.dupont@univ-nantes.fr>
2023-06-16 00:14:52 +02:00
Ludovic Courtès
26602f4063
services: static-netwoking: Wait for devices to show up.
Fixes <https://issues.guix.gnu.org/63516>.

* gnu/services/base.scm (network-set-up/linux): Add call to
'wait-for-link'.
2023-06-14 23:48:01 +02:00
muradm
f4f5ee6ad6
services: screen-locker-service-type: Configurable PAM and setuid.
screen-locker-service-type by default does both define PAM entry
and make program setuid binary. Normally both methods are
mutually exclusive, if binary has setuid set it does not really
needs PAM, otherway around also similar, if PAM is enabled
binary should not relay on setuid.

Recent swaylock package now compiled with PAM support. When PAM
support is compiled in, swaylock rejects executing if binary is
also setuid program.

This change turns screen-locker-configuration from strict
PAM AND setuid to more flexible PAM AND/OR setuid. Allowing
swaylock to be configured properly while supporting other
screen locker preferences.

* gnu/services/xorg.scm (screen-locker-configuration): Switch from
define-record-type to define-configuration.
[using-pam?]: New field to control PAM entry existence.
[using-setuid?]: New field to control setuid binary existence.
(screen-locker-pam-services): Should not make unix-pam-service if
using-pam? is set to #f.
(screen-locker-setuid-programs): Should not make program setuid
program if using-setuid? is set to #f.
(screen-locker-generate-doc): Internal function to generate
configuration documentation.
(screen-locker-service): Adapt to new screen-locker-configuration.
* gnu/services/desktop.scm (desktop-services-for-system): Adapt to
new screen-locker-configuration.
* doc/guix.texi: Reflect new changes to screen-locker-configuration.

Signed-off-by: Josselin Poiret <dev@jpoiret.xyz>
2023-06-04 10:33:55 +02:00
Ludovic Courtès
d23d8fcee9
services: herd: "Resolve" transient services only when needed.
This allows us to get rid of the "eval root" actions, which in turn
would lead to confusing "Evaluating user expression" messages.

Fixes <https://issues.guix.gnu.org/55857>.

* gnu/services/herd.scm (resolve-transients): In 'values', avoid
'eval-there' call when UNRESOLVED is empty.
2023-05-30 00:15:29 +02:00
Ludovic Courtès
689460f82a
services: guix: Depend on 'avahi-daemon' when 'discover?' is set.
Previously, with shepherd 0.10.0, guix-daemon would start quickly,
possibly before avahi-daemon is running.  Consequently, its "guix
discover" child process would exit immediately with a warning saying
"Avahi daemon is not running".

* gnu/services/base.scm (guix-shepherd-service): When DISCOVER? is true,
add 'avahi-daemon' to 'requirement'.
2023-05-24 15:04:00 +02:00
muradm
e02584b456
services: cups: Add cups PAM service.
Fixes <https://issues.guix.gnu.org/63198>.

Have the CUPS service extend pam-root-service-type providing minimal
configuration to authenticate users.  Since PAM authentication is provided,
the regular cups package can be used as default instead of the minimal,
PAM-lacking variant.

* gnu/services/cups.scm (cups-configuration)
[cups]: Replace cups-minimal with cups.
[allow-empty-password?]: PAM service configuration permitting empty passwords.
(opaque-cups-configuration): Likewise.
(cups-pam-service): New procedure.
(cups-service-type): Extend pam-root-service-type with cups-pam-service.

Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
2023-05-23 20:26:19 -04:00
Ludovic Courtès
896a51258a
services: Transient inetd services inherit requirements.
That way, per-connection transient services such as 'sshd-123' inherit
dependencies of their "parent" ('sshd' in this example), which is more
consistent than not depending on anything.

* gnu/services/dict.scm (dicod-shepherd-service): Pass #:requirements to
'make-inetd-constructor'.
* gnu/services/messaging.scm (bitlbee-shepherd-service): Likewise.
* gnu/services/ssh.scm (openssh-shepherd-service): Likewise.
* gnu/services/vnc.scm (xvnc-shepherd-service): Likewise.
2023-05-21 01:04:39 +02:00
Ludovic Courtès
d0168e1895
services: root-file-system: Remove reference to 'stop-logging'.
* gnu/services/base.scm (%root-file-system-shepherd-service): In 'stop'
method, remove reference to 'stop-logging'.  That procedure is gone in
Shepherd 0.10.0, leading to an unbound-variable exception.
Additionally, calling is unnecessary since 0.4.0, where shepherd logs to
syslog (thus the open file descriptor is not backed by an on-disk file).
2023-05-21 01:04:39 +02:00
Ludovic Courtès
d99a4c4cb3
services: agetty: 'stop' method does nothing when running is 'idle.
This is a followup to 57e731c358.

* gnu/services/base.scm (agetty-shepherd-service): Change 'stop' method
to return #f immediately when the running value is 'idle.
2023-05-21 01:04:39 +02:00
Maxim Cournoyer
d43d8377c7
services: rsync: Use least authority wrapper.
* gnu/services/rsync.scm (rsync-shepherd-service) Wrap rsync command in a
least-authority-wrapper.

Reviewed-by: Ludovic Courtès <ludo@gnu.org>
2023-05-18 23:11:19 -04:00
Maxim Cournoyer
03e601da49
services: rsync: Use make-inetd-constructor.
* gnu/services/rsync.scm (rsync-shepherd-service): Use make-inetd-constructor
if available in start slot.
* gnu/tests/rsync.scm (run-rsync-test): Delete "PID file" test.

Reviewed-by: Ludovic Courtès <ludo@gnu.org>
2023-05-18 23:10:56 -04:00
Maxim Cournoyer
5b700945fb
services: ssh: Really rename openssh-challenge-response-authentication?
Fixes up 9c161c1f0d, which renamed the accessor of <openssh-configuration> but
failed to adjust the single usage.

* gnu/services/ssh.scm (openssh-config-file): Rename
openssh-challenge-response-authentication? call to
openssh-configuration-challenge-response-authentication?.
2023-05-17 22:26:41 -04:00
Maxim Cournoyer
9c161c1f0d
services: ssh: Rename openssh-challenge-response-authentication?
This is a follow-up commit to the preceding commit, which exported all
<openssh-configuration> accessors.

* gnu/services/ssh.scm (<openssh-configuration>): Rename
openssh-challenge-response-authentication? to
openssh-configuration-challenge-response-authentication?.  It's a mouthful,
but is at least consistent with the rest.
2023-05-17 21:45:08 -04:00
Maxim Cournoyer
760fadec15
services: openssh: Export openssh-configuration accessors.
* gnu/services/ssh.scm: Export openssh-configuration accessors.
2023-05-17 21:37:03 -04:00
Ludovic Courtès
134c10241a
services: shepherd: Default to 0.10.
* gnu/services/shepherd.scm (<shepherd-configuration>)[shepherd]:
Default to SHEPHERD-0.10.
* gnu/home/services/shepherd.scm (<home-shepherd-configuration>)[shepherd]:
Likewise.
2023-05-13 16:27:55 +02:00
Christopher Baines
9a6bbea9d4
services: nar-herder: Support extra environment vars.
* gnu/services/guix.scm (nar-herder-configuration-extra-environment-variables):
New procedure.
(nar-herder-shepherd-services): Pass the environment variables to the
shepherd.
* doc/guix.texi (Guix Services): Document it.
2023-05-13 11:26:37 +01:00
Bruno Victal
ca52cdd647
services: inetd: Export accessors.
* gnu/services/networking.scm: Export inetd-configuration?,
inetd-configuration-program, inetd-configuration-entries, inetd-entry?,
inetd-entry-node, inetd-entry-name, inetd-entry-socket-type,
inetd-entry-protocol, inetd-entry-wait?, inetd-entry-user, inetd-entry-program
and inetd-entry-arguments.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-11 16:38:29 +02:00
Bruno Victal
0e3bb48d36
services: Add vnstat-service-type.
* gnu/services/monitoring.scm (vnstat-service-type): New variable.
* doc/guix.texi (Monitoring Services): Document it.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-11 16:38:29 +02:00
Sergey Trofimov
61031dd32f
services: dhcp-client-configuration: Add 'shepherd-requirement' field.
* gnu/services/networking.scm (<dhcp-client-configuration>)
[shepherd-requirement]: New field.
(dhcp-client-shepherd-service): Honor it.
(dhcp-client-configuration-shepherd-requirement): Export accessor.
* doc/guix.texi (Networking Setup): Document it.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-11 16:38:28 +02:00
Josselin Poiret
c970edad23
services: elogind: Add elogind as a shepherd PAM requirement.
* gnu/services/desktop.scm (pam-extension-procedure): Add the elogind shepherd
requirement to the PAM extension.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-11 13:21:45 +02:00
Josselin Poiret
2df5d4fd18
system: pam: Let PAM extensions add shepherd requirements.
* gnu/system/pam.scm (<pam-extension>): New record type.
(pam-shepherd-service): Add Shepherd synchronization point.

* gnu/services/mail.scm (dovecot-shepherd-service)
* gnu/services/lightdm.scm (lightdm-shepherd-service)
* gnu/services/mail.scm (opensmtpd-shepherd-service)
* gnu/services/sddm.scm (sddm-shepherd-service)
* gnu/services/ssh.scm (lsh-shepherd-service, openssh-shepherd-service)
* gnu/services/xorg.scm (slim-shepherd-service, gdm-shepherd-service)
* gnu/services/base.scm (greetd-shepherd-services): Add PAM requirement.

* gnu/system/pam.scm (/etc-entry, extend-configuration,
pam-root-service-type, pam-root-service)
* gnu/services/authentication.scm (pam-ldap-pam-service)
* gnu/services/base.scm (pam-limits-service-type)
(greetd-pam-service)
* gnu/services/desktop.scm (pam-gnome-keyring)
* gnu/services/kerberos.scm (pam-krb5-pam-service)
* gnu/services/pam-mount.scm (pam-mount-pam-service): Adapt to use
pam-extension.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-11 13:21:45 +02:00
Ludovic Courtès
695042ff10
services: syslog: Do not call 'umask' in PID 1.
Fixes a race condition when starting services in parallel with shepherd
0.10.x whereby a service might create files and directories with umask #o137.

An example is the bitlbee service with its least-authority wrapper: the
wrapper would create a tree with directories set to #o640, thereby
making the whole directory tree inaccessible.

* gnu/services/base.scm (syslog-shepherd-service): Pass #:file-creation-mask
to 'make-forkexec-constructor' instead of calling 'umask' in PID 1.
2023-05-11 13:21:45 +02:00
Ludovic Courtès
3a00aba9e9
services: dicod, bitlbee: Pass 'make-inetd-constructor' a list of endpoints.
'make-inetd-constructor' accepts a list of endpoints since version 0.9.1
of the Shepherd (released in May 2022).

* gnu/services/dict.scm (dicod-shepherd-service): Pass
'make-inetd-constructor' a list of endpoints.
* gnu/services/messaging.scm (bitlbee-shepherd-service): Likewise.
2023-05-11 13:21:45 +02:00
Christopher Baines
98c3931641
services: guix-build-coordinator-agent: Support max-parallel-uploads.
This should be usable with the new guile-gnutls.

* gnu/services/guix.scm
(guix-build-coordinator-agent-configuration-max-parallel-uploads): New
procedure.
* gnu/services/guix.scm (guix-build-coordinator-agent-shepherd-services): Use
the new argument.
* doc/guix.texi (Guix Services): Document it.
2023-05-10 11:06:20 +01:00
Christopher Baines
a759cbffaf
services: guix-build-coordinator: Support extra environment vars.
I'm looking at this because I need to do some debugging of Guile's GC, and
there are some useful environment variables for that, but it should be
generally useful.

* gnu/services/guix.scm (guix-build-coordinator-configuration-extra-environment-variables):
New procedure.
(guix-build-coordinator-shepherd-services): Pass the environment variables to
the shepherd.
* doc/guix.texi (Guix Services): Document it.
2023-05-09 16:19:21 +01:00
Efraim Flashner
c1ffe2f21b
service: qemu-binfmt: Remove broken qemu targets.
* gnu/services.virtualization.scm (%qemu-platforms): Remove %i486,
%aarch64be.
2023-05-09 17:27:49 +03:00
Christopher Baines
c229937c6a
services: guix-build-coordinator: Simpify service startup.
Take advantage of changes in the build coordinator to reduce the complexity of
the service startup script.

* gnu/services/guix.scm (make-guix-build-coordinator-start-script): Remove the
metrics registry and datastore.
2023-05-06 12:51:51 +01:00
Efraim Flashner
0584f5b489
services: qemu-binfmt: Add more targets.
* gnu/services/virtualization.scm (%i486, %sparc64, %aarch64be, %xtensa,
%xtensaeb, %microblaze, %microblazeel, %or1k, %hexagon, %loongson64):
New variables.
(%armeb): Correct family field.
(%qemu-platforms): Add them.
2023-05-04 22:28:56 +03:00
Efraim Flashner
f66344ed81
services: earlyoom: Rotate log files.
* gnu/services/linux.scm (%earlyoom-log-rotation): New variable.
(earlyoom-service-type): Add service-extension for log rotation.
2023-05-04 21:32:32 +03:00
Maxim Cournoyer
6bc3e3f9ba
services: cups: Use cups-minimal to avoid PAM authentication.
Fixes <https://issues.guix.gnu.org/63198>.

Our CUPS service doesn't currently extend the PAM configuration, and prevents
users from authenticating.  Use cups-minimal, which has no PAM support.

* gnu/services/cups.scm (cups-configuration) [cups]: Use cups-minimal.
(opaque-cups-configuration): Likewise.
2023-05-03 08:20:31 -04:00
Josselin Poiret
9f09903aff
system: guix: Use config's ACL file location.
* gnu/services/base.scm (substitute-key-authorization): Use %acl-file instead of
hardcoded "/etc/guix/acl".

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-04-30 23:11:05 +02:00
Bruno Victal
9be1ee6a49
services: tor: Deprecate 'tor-hidden-service' procedure.
Due to (now renamed) 'hidden-service' record type not being exported, the only
way Onion services (formely hidden services) could have worked is through the
now deprecated 'tor-hidden-service' procedure.

This commit updates the Tor service documentation, corrects some inconsistently
named accessors in <tor-configuration> record-type, renames and refactors
tor-hidden-service-configuration to tor-onion-service-configuration using
define-configuration and also exports it, allowing Onion services to be
configured directly within a <tor-configuration> record.
Lastly, it also deprecates the 'tor-hidden-service' procedure.

* doc/guix.texi (Networking Services): Substitute mentions of “Hidden services”
with “Onion Services”. Add a Tor Onion service configuration example.
Document <tor-onion-service-configuration>. Remove mention of
'tor-hidden-service' procedure.
* gnu/services/networking.scm: Export tor-configuration-tor,
tor-configuration-config-file, tor-configuration-hidden-services,
tor-configuration-socks-socket-type, tor-configuration-control-socket-path,
tor-onion-service-configuration, tor-onion-service-configuration?,
tor-onion-service-configuration-name, tor-onion-service-configuration-mapping.
(<tor-configuration>)[control-socket?]: Rename accessor.
(<hidden-service>): Replace with …
(<tor-onion-service-configuration>): … this.
(tor-configuration->torrc): Update record-type name.
(tor-activation): Ditto.
(tor-hidden-service-type): Remove variable.
(tor-hidden-service): Deprecate procedure.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-04-25 17:19:21 +02:00
Andreas Enge
d1252b597d
Merge remote-tracking branch 'origin/master' into core-updates 2023-04-22 09:21:22 +02:00
Ludovic Courtès
95731b4ef1
services: herd: 'load-services/safe' is synonymous with 'load-services'.
This is a followup to 547965aa27.

* gnu/services/herd.scm (load-services/safe): Make an alias for
'load-services'.
2023-04-21 16:16:37 +02:00
Ludovic Courtès
9385c82c54
services: nscd: Depend on syslogd.
This gets rid of nscd debug messages on the console at boot time.

* gnu/services/base.scm (nscd-shepherd-service): Add dependency on
'syslogd'.
2023-04-21 16:16:37 +02:00
Ludovic Courtès
e45306c198
services: postgresql: Add default package.
* gnu/services/databases.scm (<postgresql-configuration>)[postgresql]:
Add default value, moved from...
(postgresql-service-type)[default-value]: ... here.
2023-04-21 16:16:37 +02:00
Ludovic Courtès
1fa038324d
services: knot: Add 'configuration' action.
* gnu/services/dns.scm (knot-shepherd-service): Add 'actions' field.
2023-04-21 16:16:37 +02:00
Ludovic Courtès
70677d8822
services: rsync: Add 'configuration' action.
* gnu/services/rsync.scm (rsync-shepherd-service): Add 'actions' field.
2023-04-21 16:16:37 +02:00
Ludovic Courtès
0ac2ada05a
services: redis: Add 'configuration' action.
* gnu/services/databases.scm (redis-shepherd-service): Add 'actions'
field.
2023-04-21 16:16:36 +02:00
Ludovic Courtès
97f91aa4ac
services: mysql: Add 'configuration' action.
* gnu/services/databases.scm (mysql-shepherd-service): Add 'actions'
field.
2023-04-21 16:16:36 +02:00
Ludovic Courtès
a5fc3fc921
services: postgresql: Add 'configuration' action.
* gnu/services/databases.scm (postgresql-shepherd-service): Add
'actions' field.
2023-04-21 16:16:36 +02:00
Ludovic Courtès
7aaf278286
services: postgresql: Add the 'postgresql' Shepherd service name.
* gnu/services/databases.scm (postgresql-shepherd-service): Add
'postgresql' to 'provision'.
2023-04-21 16:16:36 +02:00
Maxim Cournoyer
2c1e17071d
services: syslog: Log auth.info to /var/log/secure in default configuration.
This causes authentication failures such as those generated by SSH brute force
attacks to appear in /var/log/secure, which is picked up by tools such as
fail2ban.

* gnu/services/base.scm (%default-syslog.conf): Add a auth.info selector for
the /var/log/secure log.

Series-to: 62802@debbugs.gnu.org
2023-04-21 09:04:40 -04:00
Maxim Cournoyer
9f890e39e4
services/syslog: Strip leading white space indent in syslog.conf.
This is a cosmetic change.

* gnu/services/base.scm (%default-syslog.conf): Add a comment referencing the
documentation.  Strip the extraneous leading trailing white space indent.
2023-04-21 09:04:40 -04:00
Maxim Cournoyer
2c67e98b37
services: syslog: Add a reload action.
* gnu/services/base.scm (syslog-service-type) [actions]: Add a reload action.
* doc/guix.texi (Base Services): Document it.
2023-04-21 09:04:40 -04:00
Maxim Cournoyer
1ae279d7c8
services: syslog: Move configuration to /etc/syslog.conf.
Having the configuration live at a static location makes it possible to
hot-reload it.

* gnu/services/base.scm (syslog.conf): New variable.
(syslog-etc, syslog-shepherd-service): New procedures.
(syslog-service-type): Rewrite using the above new variable and procedures,
extending etc-service-type with its configuration file.
2023-04-21 09:04:39 -04:00
Ludovic Courtès
2886a59d18
services: agetty: 'term-console' succeeds by default.
Previously, on a typical setup without "console=ttyS0" or similar in
'kernel-arguments', the 'term-console' Shepherd service would always be
marked as failing to start.  This is undesirable because it raises a
false alarm: the service is expected to do nothing in this case.

This patch instead marks it as succeeding and logs a message explaining
it's doing nothing.

* gnu/services/base.scm (agetty-shepherd-service): In 'start' method,
succeed when TTY is #f and print a message.
2023-04-19 20:12:20 -04:00
Ludovic Courtès
57e731c358
services: agetty: 'term-console' succeeds by default.
Previously, on a typical setup without "console=ttyS0" or similar in
'kernel-arguments', the 'term-console' Shepherd service would always be
marked as failing to start.  This is undesirable because it raises a
false alarm: the service is expected to do nothing in this case.

This patch instead marks it as succeeding and logs a message explaining
it's doing nothing.

* gnu/services/base.scm (agetty-shepherd-service): In 'start' method,
succeed when TTY is #f and print a message.
2023-04-17 23:50:41 +02:00