Commit graph

1276 commits

Author SHA1 Message Date
Maxim Cournoyer
77c2f4e206
services/qemu-binfmt: Use the F flag and the static output of QEMU.
Fixes <https://issues.guix.gnu.org/36117>.

Before this change, the 'binfmt_misc' entries registered for QEMU would not be
usable in container contexts outside of guix-daemon (without manually bind
mounting file names).

For example:

$ docker run --rm arm32v7/debian true
standard_init_linux.go:207: exec user process caused "no such file or directory"

After this change, any container can make use of the QEMU binfmt_misc
registrations, as their corresponding QEMU static binaries are fully
pre-loaded by the kernel.

* gnu/services/virtualization.scm (<qemu-platform>): Define using
'define-record-type*'.
[flags]: New field, which defaults to "F" (fix binary).
(%i386, %i486, %alpha, %arm, %armeb, %sparc, %sparc32plus, %ppc, %ppc64)
(%ppc64le, %m68k, %mips, %mipsel, %mipsn32, %mipsn32el, %mips64, %mips64el)
(%riscv32, %riscv64, %sh4, %sh4eb, %s390x, %aarch64, %hppa): Adjust.
(qemu-binfmt-guix-chroot): Remove variable.
(qemu-binfmt-service-type): Remove the qemu-binfmt-guix-chroot extension.
* gnu/services/qemu-binfmt (qemu-platform->binfmt):  Use the static output of
QEMU.
* doc/contributing.texi (Submitting Patches): Update doc.
* doc/guix.texi (Virtualization Services): Update doc.
2021-03-15 18:00:35 -04:00
Maxime Devos
520bac7ed0
services: Prevent following symlinks during activation.
This addresses a potential security issue, where a compromised
service could trick the activation code in changing the permissions,
owner and group of arbitrary files.  However, this patch is
currently only a partial fix, due to a TOCTTOU (time-of-check to
time-of-use) race, which can be fixed once guile has bindings
to openat and friends.

Fixes: <https://lists.gnu.org/archive/html/guix-devel/2021-01/msg00388.html>

* gnu/build/activation.scm: new procedure 'mkdir-p/perms'.
* gnu/services/authentication.scm
  (%nslcd-activation, nslcd-service-type): use new procedure.
* gnu/services/cups.scm (%cups-activation): likewise.
* gnu/services/dbus.scm (dbus-activation): likewise.
* gnu/services/dns.scm (knot-activation): likewise.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2021-03-10 18:01:47 +01:00
Mathieu Othacehe
6c883d0f1d
services: cuirass: Remove simple cuirass configuration.
The Cuirass configuration has been simplified so that this is no longer
needed.

* gnu/services/cuirass.scm (<build-manifest>, <simple-cuirass-configuration>,
simple-cuirass-configuration->specs): Remove them.
2021-03-10 09:05:02 +01:00
Mathieu Othacehe
0be2474d42
services: cuirass: Do not create the database directory.
Fixes: <https://issues.guix.gnu.org/46683>.

* gnu/services/cuirass.scm (cuirass-activation): Since the PostgreSQL switch,
it is no longer needed to create the database directory.
2021-03-10 08:49:48 +01:00
Christopher Baines
c6c48494e3
services: guix-build-coordinator: Add dynamic auth with file record.
* gnu/services/guix.scm (guix-build-coordinator-agent-dynamic-auth-with-file,
guix-build-coordinator-agent-dynamic-auth-with-filen?,
guix-build-coordinator-agent-dynamic-auth-with-file-agent-name,
guix-build-coordinator-agent-dynamic-auth-with-file-token-file): New procedures.
(guix-build-coordinator-agent-shepherd-services): Handle new dynamic auth with
file record.
* doc/guix.texi (Guix Build Coordinator): Document the new dynamic auth with
file record.
2021-03-05 09:29:58 +00:00
Andrew Tropin
63bee8f0ad
services: shepherd: Make 'assert-valid-graph' public.
* gnu/services/shepherd.scm (assert-valid-graph): Make public.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2021-03-03 14:19:26 +01:00
Christopher Baines
8a7b4ce093
services: guix-build-coordinator: Add dynamic auth record.
* gnu/services/guix.scm (guix-build-coordinator-agent-dynamic-auth,
guix-build-coordinator-agent-dynamic-auth?,
guix-build-coordinator-agent-dynamic-auth-agent-name,
guix-build-coordinator-agent-dynamic-auth-token): New procedures.
(guix-build-coordinator-agent-shepherd-services): Handle new dynamic auth
record.
* doc/guix.texi (Guix Build Coordinator): Document the new dynamic auth
record.
2021-02-28 21:56:34 +00:00
Christopher Baines
7556130c2f
services: guix-build-coordinator: Rework authentication config.
A new authentication approach has been added to the coordinator, so to better
represent the options, this commit changes the configuration to accept
different records, each for different authentication approaches.

* gnu/services/guix.scm (guix-build-coordinator-agent-configuration-uuid,
guix-build-coordinator-agent-configuration-password,
guix-build-coordinator-agent-configuration-password-file): Removed
procedures.
(guix-build-coordinator-agent-password-auth,
guix-build-coordinator-agent-password-auth?,
guix-build-coordinator-agent-password-auth-uuid,
guix-build-coordinator-agent-password-auth-password,
guix-build-coordinator-agent-password-file-auth,
guix-build-coordinator-agent-password-file-auth?,
guix-build-coordinator-agent-password-file-auth-uuid,
guix-build-coordinator-agent-password-file-auth-password-file): New
procedures.
(guix-build-coordinator-agent-shepherd-services): Adjust to handle the
authentication field and it's possible record values.
* doc/guix.texi (Guix Build Coordinator): Update documentation.
2021-02-28 21:56:33 +00:00
Ludovic Courtès
412e4f081e
services: shepherd: Make /run/booted-system a symlink to the store item.
Fixes <https://bugs.gnu.org/46767>.

Previously /run/booted-system would end up referring to
/var/guix/profiles/system-NNN-link; consequently, the booted system
would not be GC-protected.

* gnu/services/shepherd.scm (shepherd-boot-gexp): Call
'canonicalize-path' instead of 'readlink'.
2021-02-25 11:29:35 +01:00
Mathieu Othacehe
f2b10e1b7f
services: cuirass: Fix services requirements.
* gnu/services/cuirass.scm (cuirass-shepherd-service): Add "postgres-roles" to
cuirass requirements. Set cuirass-web requirements to cuirass only. Remove
"guix-daemon" and "networking" from cuirass-remote-server requirements as are
already required by cuirass.
2021-02-23 11:22:22 +01:00
Mathieu Othacehe
1a8cfb6d4c
services: postgresql-roles: Fix race condition.
Make sure that the postgresql-roles script is completed before declaring the
postgresql-roles service as started.

* gnu/services/databases.scm (postgresql-create-roles): Return the command
line instead of a program-file.
(postgresql-role-shepherd-service): Use fork+exec-command to start the role
creation script and wait for its completion before returning.
2021-02-23 11:00:18 +01:00
Mathieu Othacehe
bebcf97600
services: cuirass: Improve simple-cuirass-services.
Instead of returning multiple services in simple-cuirass-services, rely on the
instantiate-missing-services procedure to instantiate postgresql and
postgresql-role-service-type when missing.

Turn simple-cuirass-services procedure into
simple-cuirass-configuration->specs, that takes a simple-cuirass-configuration
record and returns a Cuirass specification.

Suggested-by: Ludovic Courtès <ludo@gnu.org>

* gnu/services/cuirass.scm (%default-cuirass-config): Remove it.
(simple-cuirass-services): Rename it to ...
(simple-cuirass-configuration->specs): ... this procedure.
* gnu/tests/cuirass.scm (cuirass-services): Remove postgresql and
postgresql-role services that are automatically instantiated.
(simple-cuirass-service): New variable.
(%cuirass-simple-test): Adapt it to use simple-cuirass-configuration->specs
instead of simple-cuirass-services.
* doc/guix.texi (Simple Cuirass): Update it.
2021-02-23 09:45:09 +01:00
Mathieu Othacehe
8163f74542
services: postgresql: Define a default value.
* gnu/services/databases.scm (postgresql-service-type): Define a default value.
2021-02-22 16:24:34 +01:00
Mathieu Othacehe
3bcfd41620
services: cuirass: Instantiate postgresql service.
* gnu/services/cuirass.scm (cuirass-service-type): Instantiate postgresql
service when missing.
2021-02-22 16:24:34 +01:00
Christopher Lemmer Webber
b309a28678
services: tor: Add control-socket? option.
* doc/guix.texi (Networking Services): Document new `control-socket?'
option for `tor-configuration`.
* gnu/services/networking.scm (<tor-configuration>):
(tor-configuration->torrc):
2021-02-22 10:03:02 -05:00
Mathieu Othacehe
1443e2dd98
services: cuirass: Add parameters support.
* gnu/services/cuirass.scm (<cuirass-configuration>)[parameters]: New field.
[zabbix-uri]: Remove it.
(cuirass-shepherd-service): Honor it.
2021-02-22 10:23:04 +01:00
Mathieu Othacehe
e9bf511082
services: cuirass: Add "simple-cuirass-services".
* gnu/services/cuirass.scm (<build-manifest>,
<simple-cuirass-configuration>): New records.
(build-manifest, build-manifest?, simple-cuirass-configuration,
simple-cuirass-configuration?, simple-cuirass-services): New procedures.
(%default-cuirass-config): New variable.
* gnu/tests/cuirass.scm (%cuirass-simple-test): New variable.
* doc/guix.texi (Continuous Integration): Document it.
2021-02-19 20:10:09 +01:00
Mathieu Othacehe
43b2e440c3
services: wireguard: New service.
* gnu/services/vpn.scm (wireguard-peer, wireguard-configuration): New records.
(wireguard-service-type): New variable.
* doc/guix.texi (VPN Services): Document it.
2021-02-17 10:32:15 +01:00
Alexandru-Sergiu Marton
2b5a81dfd3
services: Add Agate Gemini service.
* gnu/services/web.scm (<agate-configuration>): New record type.
(agate-accounts, agate-shepherd-service): New procedures.
(agate-service-type): New variable.
* doc/guix.texi (Web Services): Document it.

Signed-off-by: Nicolas Goaziou <mail@nicolasgoaziou.fr>
2021-02-15 13:35:04 +01:00
Mathieu Othacehe
66c31d5072
services: cuirass: Add server argument for the remote-worker.
* gnu/services/cuirass.scm (<cuirass-remote-worker-configuration>)[server]:
New field.
(cuirass-remote-worker-shepherd-service): Honor it.
2021-02-12 14:57:47 +01:00
Simon South
db6b9d2f4b
services: Add transmission-daemon service.
* gnu/services/file-sharing.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
* po/packages/POTFILES.in: Add it.
* tests/services/file-sharing.scm: New file.
* Makefile.am (SCM_TESTS): Add it.
* doc/guix.texi (File-Sharing Services): New section.

Signed-off-by: 宋文武 <iyzsong@member.fsf.org>
2021-02-12 15:11:36 +08:00
宋文武
e429325d37
services: Add 'xorg-server-service-type'.
* gnu/services/xorg.scm (xorg-server-service-type): New service type.
(xorg-server-profile-service): New procedure.
2021-02-11 17:01:43 +08:00
Alexey Abramov
408f0b4c4d
services: knot: Fix configuration verification.
* gnu/services/dns.scm (verify-knot-key-configuration): Fix the
order of memq arguments.
(verify-knot-keystore-configuration): Likewise.
(verify-knot-acl-configuration): Replace fold with every procedure.

Signed-off-by: 宋文武 <iyzsong@member.fsf.org>
2021-02-11 11:11:39 +08:00
Mathieu Othacehe
91911b9382
services: cuirass: Move zabbix argument to the web process.
This is a follow-up of 703e5c92ee.

* gnu/services/cuirass.scm (cuirass-shepherd-service): Move "zabbix-uri"
argument to the web process.
2021-02-09 09:20:55 +01:00
Mathieu Othacehe
703e5c92ee
services: cuirass: Add Zabbix support.
* gnu/services/cuirass.scm (<cuirass-configuration>)[zabbix-uri]: New field.
(cuirass-shepherd-service): Honor it.
2021-02-08 13:44:06 +01:00
raid5atemyhomework
fe7529d71b
gnu: Remove 'file-systems requirement from kernel-module-loader.
* gnu/services/linux.scm (kernel-module-loader-shepherd-service):
Remove 'file-systems requirement.

Signed-off-by: Danny Milosavljevic <dannym@scratchpost.org>
2021-02-08 03:34:40 +01:00
Marius Bakke
221985ce6b
services: PostgreSQL: Quote database names.
* gnu/services/databases.scm (postgresql-create-roles): Quote the name in
the SQL query so that roles/usernames containing hyphens will work.
2021-02-06 15:18:40 +01:00
Maxim Cournoyer
9e2d275b27
gnu: services: Fix the NFS service.
* gnu/services/nfs.scm (rpcbind-service-type): Adjust for the file name change
of the rpcbind command.
2021-02-05 17:19:10 -05:00
Maxime Devos
95f72dcd7a
services: shepherd: Allow custom 'shepherd' package.
* gnu/services/shepherd.scm (<shepherd-configuration>): New record.
(shepherd-boot-gexp, shepherd-root-service-type): Use it.
(scm->go, shepherd-configuration-file): Allow passing custom
shepherd package.
* gnu/system.scm (operating-system-shepherd-service-names): Use the new
record.
* guix/scripts/system.scm (export-shepherd-graph): Adjust accordingly.
* doc/guix.texi (Shepherd Services). Document it.

Co-authored-by: Ludovic Courtès <ludo@gnu.org>
2021-01-30 15:36:57 +01:00
Mathieu Othacehe
5ba7e828ad
services: cuirass: Create remote-server cache directory.
* gnu/services/cuirass.scm (cuirass-activation): Create remote-server cache
directory if needed.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 16:22:56 +01:00
Mathieu Othacehe
8d8bbe7c63
services: cuirass: Fix syntax error.
This is a follow-up of 189e62fa69.

* gnu/services/cuirass.scm (<cuirass-remote-server-configuration>): Fix
syntax.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 16:22:55 +01:00
Mathieu Othacehe
eff80711f3
services: cuirass: Add log-file support.
* gnu/services/cuirass.scm (cuirass-remote-worker-shepherd-service): Add
log-file support.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 15:53:03 +01:00
Mathieu Othacehe
eb9adede34
services: cuirass: Fix workers argument.
* gnu/services/cuirass.scm (cuirass-remote-worker-shepherd-service): Fix
workers arguments.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 15:27:55 +01:00
Mathieu Othacehe
a19b6889ad
services: cuirass: Add systems argument.
* gnu/services/cuirass.scm (<cuirass-remote-worker-configuration>)[systems]:
New field.
(cuirass-remote-worker-shepherd-service): Honor it.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 14:04:52 +01:00
Mathieu Othacehe
189e62fa69
services: cuirass: Add remote build support. 2021-01-28 12:57:27 +01:00
Mathieu Othacehe
0f01493dc8
service: cuirass: Update it. 2021-01-28 12:57:27 +01:00
Mathieu Othacehe
ec145a2ff9
services: postgresql: Add postgresql-role-service-type.
* gnu/services/databases.scm (postgresql-role,
postgresql-role?, postgresql-role-name,
postgresql-role-permissions, postgresql-role-create-database?,
postgresql-role-configuration, postgresql-role-configuration?,
postgresql-role-configuration-host, postgresql-role-configuration-roles,
postgresql-role-service-type): New procedures.
* gnu/tests/databases.scm: Test it.
* doc/guix.texi: Document it.
2021-01-28 12:57:27 +01:00
Mathieu Othacehe
33687aa3d0
services: postgresql: Wrap long lines.
* gnu/services/databases.scm: Wrap long lines, no functional change.
2021-01-28 12:57:27 +01:00
Mathieu Othacehe
fe4b882350
services: postgresql: Add log directory support.
* gnu/services/databases.scm (postgresql-configuration-log-directory): New
procedure.
(<postgresql-configuration>)[log-directory]: New field.
(postgresql-activation): Create the log directory.
(postgresql-shepherd-service): Honor it.
* gnu/tests/databases.scm (%postgresql-log-directory): New variable.
(log-file): New test case.
* doc/guix.texi (Database Services): Document it.
2021-01-28 12:57:26 +01:00
Mathieu Othacehe
6c0679215f
services: postgresql: Add socket directory support.
* gnu/services/databases.scm (postgresql-config-file-socket-directory): New
procedure.
(<postgresql-config-file>)[socket-directory]: New field.
(postgresql-config-file-compiler): Honor it.
(postgresql-activation): Create the socket directory if needed.
* doc/guix.texi (Database Services): Document it.
* gnu/tests/guix.scm (%guix-data-service-os): Adapt it.
* gnu/tests/monitoring.scm (%zabbix-os): Ditto.
* gnu/tests/web.scm (patchwork-os): Ditto.

Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2021-01-28 12:57:26 +01:00
Mathieu Othacehe
a38d0b0137
services: postgresql: Use Guile datatypes.
* gnu/services/databases.scm (postgresql-config-file-compiler): Support Guile
datatypes in the "extra-config" field.
* gnu/tests/databases.scm (%postgresql-os): Test it.
* doc/guix.texi (Database Services): Document it.
2021-01-28 12:57:26 +01:00
Julien Lepiller
e82a713c15
gnu: php-fpm: Ensure no duplicate group.
* gnu/services/web.scm (php-fpm-accounts): Ensure `php-fpm` group is not
duplicated.

Signed-off-by: Leo Prikler <leo.prikler@student.tugraz.at>
2021-01-17 20:40:52 +01:00
Leo Prikler
476b333fbc
services: cups: reuse lp from %base-groups.
* gnu/services/cups.scm (%cups-accounts): Try to reuse lp from %base-groups.
2021-01-17 20:16:05 +01:00
Simon South
181f290aa2
services: openntpd: Remove support for deprecated "-s" option.
* gnu/services/networking.scm (openntpd-configuration): Remove
"allow-large-adjustment?" field.
(openntpd-shepherd-service): Remove use of "allow-large-adjustment?"
configuration field and "-s" daemon option.
* tests/networking.scm (%openntpd-conf-sample): Remove
"allow-large-adjustment?" field.
* doc/guix.texi (Networking Services)[openntpd-service-type]: Remove
"allow-large-adjustment?" field from sample configuration.
[openntpd-configuration]: Remove description of "allow-large-adjustment?"
field.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2021-01-16 23:30:59 +01:00
Stefan
d4f5ea502d
services: qemu-binfmt: 'guix-support?' defaults to #t.
* gnu/services/virtualization.scm (qemu-binfmt-service-type)[guix-support?]:
Change the default from #f to #t.
* doc/guix.texi (Transparent Emulation with QEMU): Change the default of
‘guix-support?’ from #f to #t.  Describe the implication of setting it to #f.

Co-authored-by: Ludovic Courtès <ludo@gnu.org>
2021-01-16 22:38:17 +01:00
Jan (janneke) Nieuwenhuizen
5b785b2a62
services: hurd-vm: Respect hurd-vm-configuration's disk-size.
This is a follow-up to commit 859b362f81.

* gnu/services/virtualization.scm (hurd-vm-disk-image): Use diks-size from
config to set image's size.
2021-01-14 20:18:09 +01:00
Ludovic Courtès
0d22fc8d36
services: shepherd: 'shepherd-service-type' requires documentation.
* gnu/services/shepherd.scm (shepherd-service-type): Require a
'description' form.
* gnu/services/base.scm (root-file-system-service-type)
(rngd-service-type, host-name-service-type):
(virtual-terminal-service-type, console-keymap-service-type)
(syslog-service-type, swap-service-type)
(kmscon-service-type): Add description.
* gnu/services/networking.scm (dhcp-client-service-type): Likewise.
* gnu/system/install.scm (cow-store-service-type): Likewise.
* gnu/system/linux-container.scm (dummy-networking-service-type):
Likewise.
* gnu/system/mapped-devices.scm (device-mapping-service-type):
Likewise.
* tests/guix-system.sh: Likewise.
2021-01-13 22:24:18 +01:00
Oleg Pykhalov
4e511fcfce
services: Add keepalived service.
* gnu/services/networking.scm (<keepalived-configuration>): New record.
(keepalived-shepherd-service): New procedure.
(keepalived-service-type): New variable.
* doc/guix.texi (Networking Services): Document this.
2021-01-12 14:40:36 +03:00
Oleg Pykhalov
79ba12a1db
services: Add syncthing service.
* gnu/services/syncthing.scm: New file.
* gnu/local.mk: Add this.
* doc/guix.texi: Document this.
2021-01-12 14:40:36 +03:00
Tobias Geerinckx-Rice
2a4fdb4194
services: cups: Add brlaser extension by default.
* gnu/services/cups.scm (cups-configuration): Add brlaser to the default
extensions.
* doc/guix.texi (Printing Services): Document it.
2021-01-10 23:38:49 +01:00