From 206a28d84ad6d2a5c96bcb23fb7beedc4585b79d Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 20 Dec 2017 11:05:11 +0100 Subject: services: 'user-processes-service-type' can now be extended. * gnu/services/base.scm (user-processes-shepherd-service): New procedure, taken from former 'user-processes-service-type'. Add REQUIREMENTS argument; remove GRACE-DELAY argument. (user-processes-service-type): Redefine in terms of 'service-type'. (user-processes-service): Remove. (file-system-service-type): Extend USER-PROCESSES-SERVICE-TYPE. * gnu/system.scm (essential-services): Use USER-PROCESSES-SERVICE-TYPE directly. --- gnu/services/base.scm | 236 +++++++++++++++++++++++++++----------------------- 1 file changed, 129 insertions(+), 107 deletions(-) (limited to 'gnu/services') diff --git a/gnu/services/base.scm b/gnu/services/base.scm index a3654fd4d..85c442b38 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -57,7 +57,7 @@ file-system-service-type user-unmount-service swap-service - user-processes-service + user-processes-service-type host-name-service console-keymap-service %default-console-font @@ -162,6 +162,129 @@ ;;; ;;; Code: + + +;;; +;;; User processes. +;;; + +(define %do-not-kill-file + ;; Name of the file listing PIDs of processes that must survive when halting + ;; the system. Typical example is user-space file systems. + "/etc/shepherd/do-not-kill") + +(define (user-processes-shepherd-service requirements) + "Return the 'user-processes' Shepherd service with dependencies on +REQUIREMENTS (a list of service names). + +This is a synchronization point used to make sure user processes and daemons +get started only after crucial initial services have been started---file +system mounts, etc. This is similar to the 'sysvinit' target in systemd." + (define grace-delay + ;; Delay after sending SIGTERM and before sending SIGKILL. + 4) + + (list (shepherd-service + (documentation "When stopped, terminate all user processes.") + (provision '(user-processes)) + (requirement requirements) + (start #~(const #t)) + (stop #~(lambda _ + (define (kill-except omit signal) + ;; Kill all the processes with SIGNAL except those listed + ;; in OMIT and the current process. + (let ((omit (cons (getpid) omit))) + (for-each (lambda (pid) + (unless (memv pid omit) + (false-if-exception + (kill pid signal)))) + (processes)))) + + (define omitted-pids + ;; List of PIDs that must not be killed. + (if (file-exists? #$%do-not-kill-file) + (map string->number + (call-with-input-file #$%do-not-kill-file + (compose string-tokenize + (@ (ice-9 rdelim) read-string)))) + '())) + + (define (now) + (car (gettimeofday))) + + (define (sleep* n) + ;; Really sleep N seconds. + ;; Work around . + (define start (now)) + (let loop ((elapsed 0)) + (when (> n elapsed) + (sleep (- n elapsed)) + (loop (- (now) start))))) + + (define lset= (@ (srfi srfi-1) lset=)) + + (display "sending all processes the TERM signal\n") + + (if (null? omitted-pids) + (begin + ;; Easy: terminate all of them. + (kill -1 SIGTERM) + (sleep* #$grace-delay) + (kill -1 SIGKILL)) + (begin + ;; Kill them all except OMITTED-PIDS. XXX: We would + ;; like to (kill -1 SIGSTOP) to get a fixed list of + ;; processes, like 'killall5' does, but that seems + ;; unreliable. + (kill-except omitted-pids SIGTERM) + (sleep* #$grace-delay) + (kill-except omitted-pids SIGKILL) + (delete-file #$%do-not-kill-file))) + + (let wait () + ;; Reap children, if any, so that we don't end up with + ;; zombies and enter an infinite loop. + (let reap-children () + (define result + (false-if-exception + (waitpid WAIT_ANY (if (null? omitted-pids) + 0 + WNOHANG)))) + + (when (and (pair? result) + (not (zero? (car result)))) + (reap-children))) + + (let ((pids (processes))) + (unless (lset= = pids (cons 1 omitted-pids)) + (format #t "waiting for process termination\ + (processes left: ~s)~%" + pids) + (sleep* 2) + (wait)))) + + (display "all processes have been terminated\n") + #f)) + (respawn? #f)))) + +(define user-processes-service-type + (service-type + (name 'user-processes) + (extensions (list (service-extension shepherd-root-service-type + user-processes-shepherd-service))) + (compose concatenate) + (extend append) + + ;; The value is the list of Shepherd services 'user-processes' depends on. + ;; Extensions can add new services to this list. + (default-value '()) + + (description "The @code{user-processes} service is responsible for +terminating all the processes so that the root file system can be re-mounted +read-only, just before rebooting/halting. Processes still running after a few +seconds after @code{SIGTERM} has been sent are terminated with +@code{SIGKILL}."))) + ;;; ;;; File systems. @@ -349,7 +472,11 @@ FILE-SYSTEM." (list (service-extension shepherd-root-service-type file-system-shepherd-services) (service-extension fstab-service-type - identity))) + identity) + + ;; Have 'user-processes' depend on 'file-systems'. + (service-extension user-processes-service-type + (const '(file-systems))))) (compose concatenate) (extend append) (description @@ -389,111 +516,6 @@ file systems, as well as corresponding @file{/etc/fstab} entries."))) in KNOWN-MOUNT-POINTS when it is stopped." (service user-unmount-service-type known-mount-points)) -(define %do-not-kill-file - ;; Name of the file listing PIDs of processes that must survive when halting - ;; the system. Typical example is user-space file systems. - "/etc/shepherd/do-not-kill") - -(define user-processes-service-type - (shepherd-service-type - 'user-processes - (lambda (grace-delay) - (shepherd-service - (documentation "When stopped, terminate all user processes.") - (provision '(user-processes)) - (requirement '(file-systems)) - (start #~(const #t)) - (stop #~(lambda _ - (define (kill-except omit signal) - ;; Kill all the processes with SIGNAL except those listed - ;; in OMIT and the current process. - (let ((omit (cons (getpid) omit))) - (for-each (lambda (pid) - (unless (memv pid omit) - (false-if-exception - (kill pid signal)))) - (processes)))) - - (define omitted-pids - ;; List of PIDs that must not be killed. - (if (file-exists? #$%do-not-kill-file) - (map string->number - (call-with-input-file #$%do-not-kill-file - (compose string-tokenize - (@ (ice-9 rdelim) read-string)))) - '())) - - (define (now) - (car (gettimeofday))) - - (define (sleep* n) - ;; Really sleep N seconds. - ;; Work around . - (define start (now)) - (let loop ((elapsed 0)) - (when (> n elapsed) - (sleep (- n elapsed)) - (loop (- (now) start))))) - - (define lset= (@ (srfi srfi-1) lset=)) - - (display "sending all processes the TERM signal\n") - - (if (null? omitted-pids) - (begin - ;; Easy: terminate all of them. - (kill -1 SIGTERM) - (sleep* #$grace-delay) - (kill -1 SIGKILL)) - (begin - ;; Kill them all except OMITTED-PIDS. XXX: We would - ;; like to (kill -1 SIGSTOP) to get a fixed list of - ;; processes, like 'killall5' does, but that seems - ;; unreliable. - (kill-except omitted-pids SIGTERM) - (sleep* #$grace-delay) - (kill-except omitted-pids SIGKILL) - (delete-file #$%do-not-kill-file))) - - (let wait () - ;; Reap children, if any, so that we don't end up with - ;; zombies and enter an infinite loop. - (let reap-children () - (define result - (false-if-exception - (waitpid WAIT_ANY (if (null? omitted-pids) - 0 - WNOHANG)))) - - (when (and (pair? result) - (not (zero? (car result)))) - (reap-children))) - - (let ((pids (processes))) - (unless (lset= = pids (cons 1 omitted-pids)) - (format #t "waiting for process termination\ - (processes left: ~s)~%" - pids) - (sleep* 2) - (wait)))) - - (display "all processes have been terminated\n") - #f)) - (respawn? #f))))) - -(define* (user-processes-service #:key (grace-delay 4)) - "Return the service that is responsible for terminating all the processes so -that the root file system can be re-mounted read-only, just before -rebooting/halting. Processes still running GRACE-DELAY seconds after SIGTERM -has been sent are terminated with SIGKILL. - -The returned service will depend on 'file-systems', meaning that it is -considered started after all the auto-mount file systems have been mounted. - -All the services that spawn processes must depend on this one so that they are -stopped before 'kill' is called." - (service user-processes-service-type grace-delay)) - ;;; ;;; Preserve entropy to seed /dev/urandom on boot. -- cgit v1.3 From 4e9fd50857a917ea30106262e356838c4f45b6ba Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 20 Dec 2017 11:09:03 +0100 Subject: services: urandom-seed: Become a dependency of 'user-processes'. This ensures that 'urandom-seed' is started before programs that rely on sources of randomness. Fixes . Reported by Leo Famulari . * gnu/services/base.scm (urandom-seed-shepherd-service): Change 'requirement' to (file-systems). (urandom-seed-service-type): Extend USER-PROCESSES-SERVICE-TYPE. --- gnu/services/base.scm | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'gnu/services') diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 85c442b38..26525714a 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -529,7 +529,7 @@ in KNOWN-MOUNT-POINTS when it is stopped." (list (shepherd-service (documentation "Preserve entropy across reboots for /dev/urandom.") (provision '(urandom-seed)) - (requirement '(user-processes)) + (requirement '(file-systems)) (start #~(lambda _ ;; On boot, write random seed into /dev/urandom. (when (file-exists? #$%random-seed-file) @@ -590,7 +590,13 @@ in KNOWN-MOUNT-POINTS when it is stopped." (service-type (name 'urandom-seed) (extensions (list (service-extension shepherd-root-service-type - urandom-seed-shepherd-service))) + urandom-seed-shepherd-service) + + ;; Have 'user-processes' depend on 'urandom-seed'. + ;; This ensures that user processes and daemons don't + ;; start until we have seeded the PRNG. + (service-extension user-processes-service-type + (const '(urandom-seed))))) (description "Seed the @file{/dev/urandom} pseudo-random number generator (RNG) with the value recorded when the system was last shut -- cgit v1.3 From 8faaf8d7cc466c8caa55905798c9ff9aaad9a1c9 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 20 Dec 2017 11:13:54 +0100 Subject: services: urandom-seed: Deprecate the 'urandom-seed-service' procedure. * gnu/services/base.scm (urandom-seed-service-type)[default-value]: New field. (urandom-seed-service): Mark as deprecated. (%base-services): Use URANDOM-SEED-SERVICE-TYPE directly. * gnu/services/base.scm (%base-services): * doc/guix.texi (Base Services): Document 'urandom-seed-service-type' instead of 'urandom-seed-service'. --- doc/guix.texi | 4 ++-- gnu/services/base.scm | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index faad3ad6b..94d4d8f92 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -10031,12 +10031,12 @@ well as in the @var{groups} field of the @var{operating-system} record. @end example @end deffn -@deffn {Scheme Procedure} urandom-seed-service +@defvr {Scheme Variable} urandom-seed-service-type Save some entropy in @var{%random-seed-file} to seed @file{/dev/urandom} when rebooting. It also tries to seed @file{/dev/urandom} from @file{/dev/hwrng} while booting, if @file{/dev/hwrng} exists and is readable. -@end deffn +@end defvr @defvr {Scheme Variable} %random-seed-file This is the name of the file where some random bytes are saved by diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 26525714a..acc5c33f5 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -597,12 +597,13 @@ in KNOWN-MOUNT-POINTS when it is stopped." ;; start until we have seeded the PRNG. (service-extension user-processes-service-type (const '(urandom-seed))))) + (default-value #f) (description "Seed the @file{/dev/urandom} pseudo-random number generator (RNG) with the value recorded when the system was last shut down."))) -(define (urandom-seed-service) +(define (urandom-seed-service) ;deprecated (service urandom-seed-service-type #f)) @@ -1984,7 +1985,7 @@ This service is not part of @var{%base-services}." (ip "127.0.0.1") (provision '(loopback))))) (syslog-service) - (urandom-seed-service) + (service urandom-seed-service-type) (guix-service) (nscd-service) -- cgit v1.3 From 4a32f58aa135e97eedf23f725586f9651d726e73 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Thu, 21 Dec 2017 10:20:50 +0100 Subject: services: urandom-seed: Depend on udev. Suggested by Leo Famulari . * gnu/services/base.scm (urandom-seed-shepherd-service): Add 'udev' to 'requirement'. --- gnu/services/base.scm | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'gnu/services') diff --git a/gnu/services/base.scm b/gnu/services/base.scm index acc5c33f5..7fc8f6aa7 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -529,7 +529,10 @@ in KNOWN-MOUNT-POINTS when it is stopped." (list (shepherd-service (documentation "Preserve entropy across reboots for /dev/urandom.") (provision '(urandom-seed)) - (requirement '(file-systems)) + + ;; Depend on udev so that /dev/hwrng is available. + (requirement '(file-systems udev)) + (start #~(lambda _ ;; On boot, write random seed into /dev/urandom. (when (file-exists? #$%random-seed-file) -- cgit v1.3 From 28c03b4555e99da9524c697f5eba3783916050c7 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Sat, 23 Dec 2017 06:58:57 +0100 Subject: gnu: dovecot: Update to 2.3.0. * gnu/packages/mail.scm (dovecot): Update to 2.3.0. * gnu/services/mail.scm (dovecot-configuration)[director-doveadm-port] [ssl-parameters-regenerate]: Delete fields. [ssl-protocols]: Rename to... [ssl-min-protocol]: ...this. [mail-log-prefix, mdbox-rotate-size, ssl-cipher-list, imap-logout-format]: Update default values. * doc/guix.texi (Mail Services): Reflect the above changes to the service. --- doc/guix.texi | 29 ++++++++--------------------- gnu/packages/mail.scm | 4 ++-- gnu/services/mail.scm | 30 ++++++++++-------------------- 3 files changed, 20 insertions(+), 43 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index b8ace68ba..21b80a6e1 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -13072,13 +13072,6 @@ has any connections. Defaults to @samp{"15 min"}. @end deftypevr -@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer director-doveadm-port -TCP/IP port that accepts doveadm connections (instead of director -connections) If you enable this, you'll also need to add -@samp{inet-listener} for the port. -Defaults to @samp{0}. -@end deftypevr - @deftypevr {@code{dovecot-configuration} parameter} string director-username-hash How the username is translated before being hashed. Useful values include %Ln if user can log in with or without @@domain, %Ld if mailboxes @@ -13171,7 +13164,7 @@ Defaults to @samp{"%$: %s"}. @deftypevr {@code{dovecot-configuration} parameter} string mail-log-prefix Log prefix for mail processes. See doc/wiki/Variables.txt for list of possible variables you can use. -Defaults to @samp{"\"%s(%u): \""}. +Defaults to @samp{"\"%s(%u)<%{pid}><%{session}>: \""}. @end deftypevr @deftypevr {@code{dovecot-configuration} parameter} string deliver-log-format @@ -13516,7 +13509,7 @@ Defaults to @samp{0}. @deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mdbox-rotate-size Maximum dbox file size until it's rotated. -Defaults to @samp{2000000}. +Defaults to @samp{10000000}. @end deftypevr @deftypevr {@code{dovecot-configuration} parameter} string mdbox-rotate-interval @@ -13654,21 +13647,14 @@ x500UniqueIdentifier are the usual choices. You'll also need to set Defaults to @samp{"commonName"}. @end deftypevr -@deftypevr {@code{dovecot-configuration} parameter} hours ssl-parameters-regenerate -How often to regenerate the SSL parameters file. Generation is -quite CPU intensive operation. The value is in hours, 0 disables -regeneration entirely. -Defaults to @samp{168}. -@end deftypevr - -@deftypevr {@code{dovecot-configuration} parameter} string ssl-protocols -SSL protocols to use. -Defaults to @samp{"!SSLv2"}. +@deftypevr {@code{dovecot-configuration} parameter} string ssl-min-protocol +Minimum SSL protocol version to accept. +Defaults to @samp{"TLSv1"}. @end deftypevr @deftypevr {@code{dovecot-configuration} parameter} string ssl-cipher-list SSL ciphers to use. -Defaults to @samp{"ALL:!LOW:!SSLv2:!EXP:!aNULL"}. +Defaults to @samp{"ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@@STRENGTH"}. @end deftypevr @deftypevr {@code{dovecot-configuration} parameter} string ssl-crypto-device @@ -13770,7 +13756,8 @@ total number of bytes read from client @item %o total number of bytes sent to client. @end table -Defaults to @samp{"in=%i out=%o"}. +See @file{doc/wiki/Variables.txt} for a list of all the variables you can use. +Defaults to @samp{"in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}"}. @end deftypevr @deftypevr {@code{dovecot-configuration} parameter} string imap-capability diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm index 6aedcf7c3..3cfa7baeb 100644 --- a/gnu/packages/mail.scm +++ b/gnu/packages/mail.scm @@ -1137,7 +1137,7 @@ facilities for checking incoming mail.") (define-public dovecot (package (name "dovecot") - (version "2.2.33.2") + (version "2.3.0") (source (origin (method url-fetch) @@ -1145,7 +1145,7 @@ facilities for checking incoming mail.") (version-major+minor version) "/" name "-" version ".tar.gz")) (sha256 (base32 - "117f9i62liz2pm96zi2lpldzlj2knzj7g410zhifwmlsc1w3n7py")))) + "10c5myzgys866c3x6jdr1s9x9pqnjd5vpyz8z384sph21m3wnq6y")))) (build-system gnu-build-system) (native-inputs `(("pkg-config" ,pkg-config))) diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index 6305f06f8..ab9094273 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -2,6 +2,7 @@ ;;; Copyright © 2015 Andy Wingo ;;; Copyright © 2017 Clément Lassieur ;;; Copyright © 2017 Carlo Zancanaro +;;; Copyright © 2017 Tobias Geerinckx-Rice ;;; ;;; This file is part of GNU Guix. ;;; @@ -745,12 +746,6 @@ allowed too, like 10.0.0.10-10.0.0.30.") "How long to redirect users to a specific server after it no longer has any connections.") - (director-doveadm-port - (non-negative-integer 0) - "TCP/IP port that accepts doveadm connections (instead of director -connections) If you enable this, you'll also need to add -@samp{inet-listener} for the port.") - (director-username-hash (string "%Lu") "How the username is translated before being hashed. Useful values @@ -831,7 +826,7 @@ string.") string, %$ contains the data we want to log.") (mail-log-prefix - (string "\"%s(%u): \"") + (string "\"%s(%u)<%{pid}><%{session}>: \"") "Log prefix for mail processes. See doc/wiki/Variables.txt for list of possible variables you can use.") @@ -1145,7 +1140,7 @@ files. If an index file already exists it's still read, just not updated.") (mdbox-rotate-size - (non-negative-integer #e2e6) + (non-negative-integer #e10e6) "Maximum dbox file size until it's rotated.") (mdbox-rotate-interval @@ -1262,18 +1257,12 @@ it, set @samp{auth-ssl-require-client-cert? #t} in auth section.") x500UniqueIdentifier are the usual choices. You'll also need to set @samp{auth-ssl-username-from-cert? #t}.") - (ssl-parameters-regenerate - (hours 168) - "How often to regenerate the SSL parameters file. Generation is -quite CPU intensive operation. The value is in hours, 0 disables -regeneration entirely.") - - (ssl-protocols - (string "!SSLv2") - "SSL protocols to use.") + (ssl-min-protocol + (string "TLSv1") + "Minimum SSL protocol version to accept.") (ssl-cipher-list - (string "ALL:!LOW:!SSLv2:!EXP:!aNULL") + (string "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH") "SSL ciphers to use.") (ssl-crypto-device @@ -1356,14 +1345,15 @@ get \"Too long argument\" or \"IMAP command line too large\" errors often.") (imap-logout-format - (string "in=%i out=%o") + (string "in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}") "IMAP logout format string: @table @code @item %i total number of bytes read from client @item %o total number of bytes sent to client. -@end table") +@end table +See @file{doc/wiki/Variables.txt} for a list of all the variables you can use.") (imap-capability (string "") -- cgit v1.3 From 7459cb9305ff8ae7e72ca29aad0f8f8e1e807641 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Sun, 24 Dec 2017 00:51:08 +0100 Subject: services: messaging: Use HTTPS for prosody.im URLs. * gnu/services/messaging.scm (prosody-configuration): Use HTTPS whenever referring to prosody.im URLs in documentation. * doc/guix.texi (Messaging Services): Likewise. --- doc/guix.texi | 48 +++++++++++++++++++++++----------------------- gnu/services/messaging.scm | 46 ++++++++++++++++++++++---------------------- 2 files changed, 47 insertions(+), 47 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index 8ecefa26e..7572ab876 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -13956,7 +13956,7 @@ definitions for messaging services: currently only Prosody is supported. @subsubheading Prosody Service @deffn {Scheme Variable} prosody-service-type -This is the type for the @uref{http://prosody.im, Prosody XMPP +This is the type for the @uref{https://prosody.im, Prosody XMPP communication server}. Its value must be a @code{prosody-configuration} record as in this example: @@ -14021,13 +14021,13 @@ The Prosody package. @deftypevr {@code{prosody-configuration} parameter} file-name data-path Location of the Prosody data storage directory. See -@url{http://prosody.im/doc/configure}. +@url{https://prosody.im/doc/configure}. Defaults to @samp{"/var/lib/prosody"}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} file-name-list plugin-paths Additional plugin directories. They are searched in all the specified -paths in order. See @url{http://prosody.im/doc/plugins_directory}. +paths in order. See @url{https://prosody.im/doc/plugins_directory}. Defaults to @samp{()}. @end deftypevr @@ -14040,15 +14040,15 @@ Defaults to @samp{"/etc/prosody/certs"}. @deftypevr {@code{prosody-configuration} parameter} string-list admins This is a list of accounts that are admins for the server. Note that you -must create the accounts separately. See @url{http://prosody.im/doc/admins} and -@url{http://prosody.im/doc/creating_accounts}. +must create the accounts separately. See @url{https://prosody.im/doc/admins} and +@url{https://prosody.im/doc/creating_accounts}. Example: @code{(admins '("user1@@example.com" "user2@@example.net"))} Defaults to @samp{()}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} boolean use-libevent? Enable use of libevent for better performance under high load. See -@url{http://prosody.im/doc/libevent}. +@url{https://prosody.im/doc/libevent}. Defaults to @samp{#f}. @end deftypevr @@ -14056,7 +14056,7 @@ Defaults to @samp{#f}. This is the list of modules Prosody will load on startup. It looks for @code{mod_modulename.lua} in the plugins folder, so make sure that exists too. Documentation on modules can be found at: -@url{http://prosody.im/doc/modules}. +@url{https://prosody.im/doc/modules}. Defaults to @samp{("roster" "saslauth" "tls" "dialback" "disco" "carbons" "private" "blocklist" "vcard" "version" "uptime" "time" "ping" "pep" "register" "admin_adhoc")}. @end deftypevr @@ -14069,13 +14069,13 @@ Defaults to @samp{()}. @deftypevr {@code{prosody-configuration} parameter} file-name groups-file Path to a text file where the shared groups are defined. If this path is empty then @samp{mod_groups} does nothing. See -@url{http://prosody.im/doc/modules/mod_groups}. +@url{https://prosody.im/doc/modules/mod_groups}. Defaults to @samp{"/var/lib/prosody/sharedgroups.txt"}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} boolean allow-registration? Disable account creation by default, for security. See -@url{http://prosody.im/doc/creating_accounts}. +@url{https://prosody.im/doc/creating_accounts}. Defaults to @samp{#f}. @end deftypevr @@ -14083,7 +14083,7 @@ Defaults to @samp{#f}. These are the SSL/TLS-related settings. Most of them are disabled so to use Prosody's defaults. If you do not completely understand these options, do not add them to your config, it is easy to lower the security of your server -using them. See @url{http://prosody.im/doc/advanced_ssl_config}. +using them. See @url{https://prosody.im/doc/advanced_ssl_config}. Available @code{ssl-configuration} fields are: @@ -14154,7 +14154,7 @@ Password for encrypted private keys. @deftypevr {@code{prosody-configuration} parameter} boolean c2s-require-encryption? Whether to force all client-to-server connections to be encrypted or not. -See @url{http://prosody.im/doc/modules/mod_tls}. +See @url{https://prosody.im/doc/modules/mod_tls}. Defaults to @samp{#f}. @end deftypevr @@ -14166,7 +14166,7 @@ Defaults to @samp{("DIGEST-MD5")}. @deftypevr {@code{prosody-configuration} parameter} boolean s2s-require-encryption? Whether to force all server-to-server connections to be encrypted or not. -See @url{http://prosody.im/doc/modules/mod_tls}. +See @url{https://prosody.im/doc/modules/mod_tls}. Defaults to @samp{#f}. @end deftypevr @@ -14174,7 +14174,7 @@ Defaults to @samp{#f}. Whether to require encryption and certificate authentication. This provides ideal security, but requires servers you communicate with to support encryption AND present valid, trusted certificates. See -@url{http://prosody.im/doc/s2s#security}. +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{#f}. @end deftypevr @@ -14182,14 +14182,14 @@ Defaults to @samp{#f}. Many servers don't support encryption or have invalid or self-signed certificates. You can list domains here that will not be required to authenticate using certificates. They will be authenticated using DNS. See -@url{http://prosody.im/doc/s2s#security}. +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{()}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} string-list s2s-secure-domains Even if you leave @code{s2s-secure-auth?} disabled, you can still require valid certificates for some domains by specifying a list here. See -@url{http://prosody.im/doc/s2s#security}. +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{()}. @end deftypevr @@ -14197,20 +14197,20 @@ Defaults to @samp{()}. Select the authentication backend to use. The default provider stores passwords in plaintext and uses Prosody's configured data storage to store the authentication data. If you do not trust your server please see -@url{http://prosody.im/doc/modules/mod_auth_internal_hashed} for information +@url{https://prosody.im/doc/modules/mod_auth_internal_hashed} for information about using the hashed backend. See also -@url{http://prosody.im/doc/authentication} +@url{https://prosody.im/doc/authentication} Defaults to @samp{"internal_plain"}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} maybe-string log Set logging options. Advanced logging configuration is not yet supported -by the GuixSD Prosody Service. See @url{http://prosody.im/doc/logging}. +by the GuixSD Prosody Service. See @url{https://prosody.im/doc/logging}. Defaults to @samp{"*syslog"}. @end deftypevr @deftypevr {@code{prosody-configuration} parameter} file-name pidfile -File to write pid in. See @url{http://prosody.im/doc/modules/mod_posix}. +File to write pid in. See @url{https://prosody.im/doc/modules/mod_posix}. Defaults to @samp{"/var/run/prosody/prosody.pid"}. @end deftypevr @@ -14237,7 +14237,7 @@ instance can serve many domains, each one defined as a VirtualHost entry in Prosody's configuration. Conversely a server that hosts a single domain would have just one VirtualHost entry. -See @url{http://prosody.im/doc/configure#virtual_host_settings}. +See @url{https://prosody.im/doc/configure#virtual_host_settings}. Available @code{virtualhost-configuration} fields are: @@ -14258,7 +14258,7 @@ Internal components are implemented with Prosody-specific plugins. To add an internal component, you simply fill the hostname field, and the plugin you wish to use for the component. -See @url{http://prosody.im/doc/components}. +See @url{https://prosody.im/doc/components}. Defaults to @samp{()}. Available @code{int-component-configuration} fields are: @@ -14277,10 +14277,10 @@ Multi-user chat (MUC) is Prosody's module for allowing you to create hosted chatrooms/conferences for XMPP users. General information on setting up and using multi-user chatrooms can be found -in the "Chatrooms" documentation (@url{http://prosody.im/doc/chatrooms}), +in the "Chatrooms" documentation (@url{https://prosody.im/doc/chatrooms}), which you should read if you are new to XMPP chatrooms. -See also @url{http://prosody.im/doc/modules/mod_muc}. +See also @url{https://prosody.im/doc/modules/mod_muc}. Available @code{mod-muc-configuration} fields are: @@ -14311,7 +14311,7 @@ Defaults to @samp{20}. @deftypevr {@code{prosody-configuration} parameter} ext-component-configuration-list ext-components External components use XEP-0114, which most standalone components support. To add an external component, you simply fill the hostname field. See -@url{http://prosody.im/doc/components}. +@url{https://prosody.im/doc/components}. Defaults to @samp{()}. Available @code{ext-component-configuration} fields are: diff --git a/gnu/services/messaging.scm b/gnu/services/messaging.scm index d57a7562a..a9820ed21 100644 --- a/gnu/services/messaging.scm +++ b/gnu/services/messaging.scm @@ -320,13 +320,13 @@ can create such a file with: (data-path (file-name "/var/lib/prosody") "Location of the Prosody data storage directory. See -@url{http://prosody.im/doc/configure}." +@url{https://prosody.im/doc/configure}." global) (plugin-paths (file-name-list '()) "Additional plugin directories. They are searched in all the specified -paths in order. See @url{http://prosody.im/doc/plugins_directory}." +paths in order. See @url{https://prosody.im/doc/plugins_directory}." global) (certificates @@ -339,15 +339,15 @@ certificates/keys from the directory specified here." (admins (string-list '()) "This is a list of accounts that are admins for the server. Note that you -must create the accounts separately. See @url{http://prosody.im/doc/admins} and -@url{http://prosody.im/doc/creating_accounts}. +must create the accounts separately. See @url{https://prosody.im/doc/admins} and +@url{https://prosody.im/doc/creating_accounts}. Example: @code{(admins '(\"user1@@example.com\" \"user2@@example.net\"))}" common) (use-libevent? (boolean #f) "Enable use of libevent for better performance under high load. See -@url{http://prosody.im/doc/libevent}." +@url{https://prosody.im/doc/libevent}." common) (modules-enabled @@ -355,7 +355,7 @@ Example: @code{(admins '(\"user1@@example.com\" \"user2@@example.net\"))}" "This is the list of modules Prosody will load on startup. It looks for @code{mod_modulename.lua} in the plugins folder, so make sure that exists too. Documentation on modules can be found at: -@url{http://prosody.im/doc/modules}." +@url{https://prosody.im/doc/modules}." common) (modules-disabled @@ -368,13 +368,13 @@ should you want to disable them then add them to this list." (file-name "/var/lib/prosody/sharedgroups.txt") "Path to a text file where the shared groups are defined. If this path is empty then @samp{mod_groups} does nothing. See -@url{http://prosody.im/doc/modules/mod_groups}." +@url{https://prosody.im/doc/modules/mod_groups}." common) (allow-registration? (boolean #f) "Disable account creation by default, for security. See -@url{http://prosody.im/doc/creating_accounts}." +@url{https://prosody.im/doc/creating_accounts}." common) (ssl @@ -382,13 +382,13 @@ empty then @samp{mod_groups} does nothing. See "These are the SSL/TLS-related settings. Most of them are disabled so to use Prosody's defaults. If you do not completely understand these options, do not add them to your config, it is easy to lower the security of your server -using them. See @url{http://prosody.im/doc/advanced_ssl_config}." +using them. See @url{https://prosody.im/doc/advanced_ssl_config}." common) (c2s-require-encryption? (boolean #f) "Whether to force all client-to-server connections to be encrypted or not. -See @url{http://prosody.im/doc/modules/mod_tls}." +See @url{https://prosody.im/doc/modules/mod_tls}." common) (disable-sasl-mechanisms @@ -400,7 +400,7 @@ See @url{http://prosody.im/doc/modules/mod_tls}." (s2s-require-encryption? (boolean #f) "Whether to force all server-to-server connections to be encrypted or not. -See @url{http://prosody.im/doc/modules/mod_tls}." +See @url{https://prosody.im/doc/modules/mod_tls}." common) (s2s-secure-auth? @@ -408,7 +408,7 @@ See @url{http://prosody.im/doc/modules/mod_tls}." "Whether to require encryption and certificate authentication. This provides ideal security, but requires servers you communicate with to support encryption AND present valid, trusted certificates. See -@url{http://prosody.im/doc/s2s#security}." +@url{https://prosody.im/doc/s2s#security}." common) (s2s-insecure-domains @@ -416,14 +416,14 @@ encryption AND present valid, trusted certificates. See "Many servers don't support encryption or have invalid or self-signed certificates. You can list domains here that will not be required to authenticate using certificates. They will be authenticated using DNS. See -@url{http://prosody.im/doc/s2s#security}." +@url{https://prosody.im/doc/s2s#security}." common) (s2s-secure-domains (string-list '()) "Even if you leave @code{s2s-secure-auth?} disabled, you can still require valid certificates for some domains by specifying a list here. See -@url{http://prosody.im/doc/s2s#security}." +@url{https://prosody.im/doc/s2s#security}." common) (authentication @@ -431,21 +431,21 @@ valid certificates for some domains by specifying a list here. See "Select the authentication backend to use. The default provider stores passwords in plaintext and uses Prosody's configured data storage to store the authentication data. If you do not trust your server please see -@url{http://prosody.im/doc/modules/mod_auth_internal_hashed} for information +@url{https://prosody.im/doc/modules/mod_auth_internal_hashed} for information about using the hashed backend. See also -@url{http://prosody.im/doc/authentication}" +@url{https://prosody.im/doc/authentication}" common) ;; TODO: Handle more complicated log structures. (log (maybe-string "*syslog") "Set logging options. Advanced logging configuration is not yet supported -by the GuixSD Prosody Service. See @url{http://prosody.im/doc/logging}." +by the GuixSD Prosody Service. See @url{https://prosody.im/doc/logging}." common) (pidfile (file-name "/var/run/prosody/prosody.pid") - "File to write pid in. See @url{http://prosody.im/doc/modules/mod_posix}." + "File to write pid in. See @url{https://prosody.im/doc/modules/mod_posix}." global) (http-max-content-size @@ -476,7 +476,7 @@ instance can serve many domains, each one defined as a VirtualHost entry in Prosody's configuration. Conversely a server that hosts a single domain would have just one VirtualHost entry. -See @url{http://prosody.im/doc/configure#virtual_host_settings}." +See @url{https://prosody.im/doc/configure#virtual_host_settings}." global) (int-components @@ -490,14 +490,14 @@ Internal components are implemented with Prosody-specific plugins. To add an internal component, you simply fill the hostname field, and the plugin you wish to use for the component. -See @url{http://prosody.im/doc/components}." +See @url{https://prosody.im/doc/components}." global) (ext-components (ext-component-configuration-list '()) "External components use XEP-0114, which most standalone components support. To add an external component, you simply fill the hostname field. See -@url{http://prosody.im/doc/components}." +@url{https://prosody.im/doc/components}." global) (component-secret @@ -536,10 +536,10 @@ support. To add an external component, you simply fill the hostname field. See hosted chatrooms/conferences for XMPP users. General information on setting up and using multi-user chatrooms can be found -in the \"Chatrooms\" documentation (@url{http://prosody.im/doc/chatrooms}), +in the \"Chatrooms\" documentation (@url{https://prosody.im/doc/chatrooms}), which you should read if you are new to XMPP chatrooms. -See also @url{http://prosody.im/doc/modules/mod_muc}." +See also @url{https://prosody.im/doc/modules/mod_muc}." int-component) (hostname -- cgit v1.3 From db8ed7cee81cbd60b0f8d89a7bee377b369fdac1 Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Tue, 31 Oct 2017 21:38:21 +0100 Subject: services: networking: Add a dependency override mechanism to . * gnu/services/networking.scm ()[requirement]: New field. (static-networking-shepherd-service): Don't override requirement for loopback. (static-networking-service): Expose 'requirement' parameter. Default to UDEV. * gnu/services/base.scm (%base-services): Add (requirement '()) for loopback service. * doc/guix.texi (Networking Services): Document it. --- doc/guix.texi | 5 ++++- gnu/services/base.scm | 1 + gnu/services/networking.scm | 14 +++++++++----- 3 files changed, 14 insertions(+), 6 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index d925b4eda..ad018ffc8 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -10392,9 +10392,12 @@ This is the type for statically-configured network interfaces. @deffn {Scheme Procedure} static-networking-service @var{interface} @var{ip} @ [#:netmask #f] [#:gateway #f] [#:name-servers @code{'()}] + [#:requirement @code{'(udev)}] Return a service that starts @var{interface} with address @var{ip}. If @var{netmask} is true, use it as the network mask. If @var{gateway} is true, -it must be a string specifying the default network gateway. +it must be a string specifying the default network gateway. @var{requirement} +can be used to declare a dependency on another service before configuring the +interface. This procedure can be called several times, one for each network interface of interest. Behind the scenes what it does is extend diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 7fc8f6aa7..f4681c804 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -1986,6 +1986,7 @@ This service is not part of @var{%base-services}." (service static-networking-service-type (list (static-networking (interface "lo") (ip "127.0.0.1") + (requirement '()) (provision '(loopback))))) (syslog-service) (service urandom-seed-service-type) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index b0c23aafc..c3ba0787c 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -5,6 +5,7 @@ ;;; Copyright © 2016 John Darrington ;;; Copyright © 2017 Clément Lassieur ;;; Copyright © 2017 Thomas Danckaert +;;; Copyright © 2017 Marius Bakke ;;; ;;; This file is part of GNU Guix. ;;; @@ -51,6 +52,7 @@ static-networking-ip static-networking-netmask static-networking-gateway + static-networking-requirement static-networking-service static-networking-service-type @@ -145,22 +147,21 @@ fe80::1%lo0 apps.facebook.com\n") (default #f)) (provision static-networking-provision (default #f)) + (requirement static-networking-requirement + (default '())) (name-servers static-networking-name-servers ;FIXME: doesn't belong here (default '()))) (define static-networking-shepherd-service (match-lambda (($ interface ip netmask gateway provision - name-servers) + requirement name-servers) (let ((loopback? (and provision (memq 'loopback provision)))) (shepherd-service - ;; Unless we're providing the loopback interface, wait for udev to be up - ;; and running so that INTERFACE is actually usable. - (requirement (if loopback? '() '(udev))) - (documentation "Bring up the networking interface using a static IP address.") + (requirement requirement) (provision (or provision (list (symbol-append 'networking- (string->symbol interface))))) @@ -263,6 +264,8 @@ network interface."))) (define* (static-networking-service interface ip #:key netmask gateway provision + ;; Most interfaces require udev to be usable. + (requirement '(udev)) (name-servers '())) "Return a service that starts @var{interface} with address @var{ip}. If @var{netmask} is true, use it as the network mask. If @var{gateway} is true, @@ -277,6 +280,7 @@ to handle." (list (static-networking (interface interface) (ip ip) (netmask netmask) (gateway gateway) (provision provision) + (requirement requirement) (name-servers name-servers))))) (define dhcp-client-service-type -- cgit v1.3 From 431703ffd022e77c50e09ceedfa110a7eb7e4ee5 Mon Sep 17 00:00:00 2001 From: ng0 Date: Sat, 30 Dec 2017 22:52:54 +0100 Subject: gnu: services: Add MATE desktop service. * gnu/services/desktop.scm (, mate-desktop-service-type): New variable. (mate-desktop-service): New public variable. * doc/guix.texi (Desktop Services): Document the service. Signed-off-by: Danny Milosavljevic --- doc/guix.texi | 26 +++++++++++++++++++------- gnu/services/desktop.scm | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 7 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index ad018ffc8..2289d8201 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -26,7 +26,7 @@ Copyright @copyright{} 2016 Ben Woodcroft@* Copyright @copyright{} 2016, 2017 Chris Marusich@* Copyright @copyright{} 2016, 2017 Efraim Flashner@* Copyright @copyright{} 2016 John Darrington@* -Copyright @copyright{} 2016 ng0@* +Copyright @copyright{} 2016, 2017 ng0@* Copyright @copyright{} 2016, 2017 Jan Nieuwenhuizen@* Copyright @copyright{} 2016 Julien Lepiller@* Copyright @copyright{} 2016 Alex ter Weele@* @@ -12106,7 +12106,7 @@ The @code{(gnu services desktop)} module provides services that are usually useful in the context of a ``desktop'' setup---that is, on a machine running a graphical display server, possibly with graphical user interfaces, etc. It also defines services that provide specific desktop -environments like GNOME and XFCE. +environments like GNOME, XFCE or MATE. To simplify things, the module defines a variable containing the set of services that users typically expect on a machine with a graphical @@ -12131,9 +12131,10 @@ The @var{%desktop-services} variable can be used as the @code{services} field of an @code{operating-system} declaration (@pxref{operating-system Reference, @code{services}}). -Additionally, the @code{gnome-desktop-service} and -@code{xfce-desktop-service} procedures can add GNOME and/or XFCE to a -system. To ``add GNOME'' means that system-level services like the +Additionally, the @code{gnome-desktop-service}, +@code{xfce-desktop-service} and @code{mate-desktop-service} +procedures can add GNOME, XFCE and/or MATE to a system. +To ``add GNOME'' means that system-level services like the backlight adjustment helpers and the power management utilities are added to the system, extending @code{polkit} and @code{dbus} appropriately, allowing GNOME to operate with elevated privileges on a @@ -12144,6 +12145,11 @@ not only adds the @code{xfce} metapackage to the system profile, but it also gives the Thunar file manager the ability to open a ``root-mode'' file management window, if the user authenticates using the administrator's password via the standard polkit graphical interface. +To ``add MATE'' means that @code{polkit} and @code{dbus} are extended +appropriately, allowing MATE to operate with elevated privileges on a +limited number of special-purpose system interfaces. Additionally, +adding a service made by @code{mate-desktop-service} adds the MATE +metapackage to the system profile. @deffn {Scheme Procedure} gnome-desktop-service Return a service that adds the @code{gnome} package to the system @@ -12158,9 +12164,15 @@ file system as root from within a user session, after the user has authenticated with the administrator's password. @end deffn -Because the GNOME and XFCE desktop services pull in so many packages, +@deffn {Scheme Procedure} mate-desktop-service +Return a service that adds the @code{mate} package to the system +profile, and extends polkit with the actions from +@code{mate-settings-daemon}. +@end deffn + +Because the GNOME, XFCE and MATE desktop services pull in so many packages, the default @code{%desktop-services} variable doesn't include either of -them by default. To add GNOME or XFCE, just @code{cons} them onto +them by default. To add GNOME, XFCE orMATE, just @code{cons} them onto @code{%desktop-services} in the @code{services} field of your @code{operating-system}: diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm index 78530b345..64b999cab 100644 --- a/gnu/services/desktop.scm +++ b/gnu/services/desktop.scm @@ -4,6 +4,7 @@ ;;; Copyright © 2015 Mark H Weaver ;;; Copyright © 2016 Sou Bunnbu ;;; Copyright © 2017 Maxim Cournoyer +;;; Copyright © 2017 ng0 ;;; ;;; This file is part of GNU Guix. ;;; @@ -42,6 +43,7 @@ #:use-module (gnu packages suckless) #:use-module (gnu packages linux) #:use-module (gnu packages libusb) + #:use-module (gnu packages mate) #:use-module (guix records) #:use-module (guix packages) #:use-module (guix store) @@ -82,6 +84,11 @@ gnome-desktop-service gnome-desktop-service-type + mate-desktop-configuration + mate-desktop-configuration? + mate-desktop-service + mate-desktop-service-type + xfce-desktop-configuration xfce-desktop-configuration? xfce-desktop-service @@ -817,6 +824,32 @@ rules." and extends polkit with the actions from @code{gnome-settings-daemon}." (service gnome-desktop-service-type config)) +;; MATE Desktop service. +;; TODO: Add mate-screensaver. + +(define-record-type* mate-desktop-configuration + make-mate-desktop-configuration + mate-desktop-configuration + (mate-package mate-package (default mate))) + +(define mate-desktop-service-type + (service-type + (name 'mate-desktop) + (extensions + (list (service-extension polkit-service-type + (compose list + (package-direct-input-selector + "mate-settings-daemon") + mate-package)) + (service-extension profile-service-type + (compose list + mate-package)))))) + +(define* (mate-desktop-service #:key (config (mate-desktop-configuration))) + "Return a service that adds the @code{mate} package to the system profile, +and extends polkit with the actions from @code{mate-settings-daemon}." + (service mate-desktop-service-type config)) + ;;; ;;; XFCE desktop service. -- cgit v1.3