Depend on pkgs and move code there; drop other distros but guix

1 files changed, 0 insertions, 2011 deletions

diff --git a/src/org/euandre/queue.scm b/src/org/euandre/queue.scm
deleted file mode 100644
index 16c9b1a..0000000
--- a/src/org/euandre/queue.scm
+++ /dev/null
@@ -1,2011 +0,0 @@
-(define-module (org euandre queue)
-  #:use-module ((ice-9 textual-ports) #:prefix textual-ports:)
-  #:use-module ((gnu build linux-container) #:prefix container:)
-  #:use-module ((guix licenses) #:prefix license:)
-  #:use-module ((srfi srfi-1) #:prefix s1:)
-  #:use-module (guix build-system meson)
-  #:use-module (guix build-system gnu)
-  #:use-module (guix build-system python)
-  #:use-module (guix build-system trivial)
-  #:use-module (guix download)
-  #:use-module (guix git-download)
-  #:use-module (guix least-authority)
-  #:use-module (guix packages)
-  #:use-module (guix records)
-  #:use-module (guix utils)
-  #:use-module (gnu)
-  #:use-module (gnu system privilege)
-  #:export (<shadow-group-configuration>
-             shadow-group-configuration
-        make-shadow-group-configuration
-             shadow-group-configuration?
-             shadow-group-configuration-group
-
-             shadow-group-activation
-             shadow-group-accounts
-             shadow-group-service-type
-
-
-            <cyrus-service-configuration>
-             cyrus-service-configuration
-        make-cyrus-service-configuration
-             cyrus-service-configuration?
-             cyrus-service-configuration-name
-             cyrus-service-configuration-authmech
-             cyrus-service-configuration-log-level
-             cyrus-service-configuration-raw-file
-
-            <cyrus-sasl-configuration>
-             cyrus-sasl-configuration
-        make-cyrus-sasl-configuration
-             cyrus-sasl-configuration?
-             cyrus-sasl-configuration-package
-             cyrus-sasl-configuration-user
-             cyrus-sasl-configuration-group
-             cyrus-sasl-configuration-supplementary-groups
-             cyrus-sasl-configuration-authmech
-             cyrus-sasl-configuration-services
-             cyrus-sasl-configuration-config-dirname
-             cyrus-sasl-configuration-run-directory
-             cyrus-sasl-configuration-run-in-container?
-             cyrus-sasl-configuration-container-name
-             cyrus-sasl-configuration-container-namespaces
-
-             cyrus-sasl-etc-files
-             cyrus-sasl-activation
-             cyrus-sasl-accounts
-             cyrus-sasl-shepherd-service
-             cyrus-sasl-service-type
-
-
-            <dkimproxyout-configuration>
-             dkimproxyout-configuration
-        make-dkimproxyout-configuration
-             dkimproxyout-configuration?
-             dkimproxyout-configuration-package
-             dkimproxyout-configuration-user
-             dkimproxyout-configuration-group
-             dkimproxyout-configuration-supplementary-groups
-             dkimproxyout-configuration-config-name
-             dkimproxyout-configuration-config-extra
-             dkimproxyout-configuration-raw-file
-             dkimproxyout-configuration-listen
-             dkimproxyout-configuration-relay
-             dkimproxyout-configuration-domains
-             dkimproxyout-configuration-selector
-             dkimproxyout-configuration-key-size
-             dkimproxyout-configuration-data-directory
-             dkimproxyout-configuration-run-in-container?
-             dkimproxyout-configuration-container-name
-             dkimproxyout-configuration-container-namespaces
-
-             dkimproxyout-etc-files
-             dkimproxyout-accounts
-             dkimproxyout-activation
-             dkimproxyout-shepherd-service
-             dkimproxyout-service-type
-
-
-            <postfix-configuration>
-             postfix-configuration
-        make-postfix-configuration
-             postfix-configuration?
-
-             postfix-configuration-postfix
-             postfix-configuration-enable-submission?
-             postfix-configuration-set-sendmail?
-             postfix-configuration-master.cf-file
-             postfix-configuration-main.cf-file
-             postfix-configuration-master.cf-extra
-             postfix-configuration-main.cf-extra
-             postfix-configuration-config-dirname
-             postfix-configuration-mail-directory
-             postfix-configuration-data-directory
-             postfix-configuration-queue-directory
-             postfix-configuration-user
-             postfix-configuration-group
-             postfix-configuration-setgid-group
-             postfix-configuration-root-aliases
-             postfix-configuration-cert-file
-             postfix-configuration-key-file
-             postfix-configuration-hostname
-             postfix-configuration-run-in-container?
-             postfix-configuration-container-name
-             postfix-configuration-container-namespaces
-
-             postfix-aliases
-             postfix-accounts
-             postfix-activation
-             postfix-etc-files
-             postfix-privileged-programs
-             postfix-shepherd-service
-       local-postfix-service-type
-    internet-postfix-service-type
-
-
-            <dovecot-configuration>
-             dovecot-configuration
-        make-dovecot-configuration
-             dovecot-configuration?
-
-             dovecot-configuration-package
-             dovecot-configuration-mail-location
-             dovecot-configuration-raw-file
-             dovecot-configuration-extra-content
-             dovecot-configuration-config-dirname
-             dovecot-configuration-config-filename
-             dovecot-configuration-user
-             dovecot-configuration-group
-             dovecot-configuration-supplementary-groups
-             dovecot-configuration-auth-worker-group
-             dovecot-configuration-untrusted-user
-             dovecot-configuration-untrusted-group
-             dovecot-configuration-untrusted-supplementary-groups
-             dovecot-configuration-base-dir
-             dovecot-configuration-state-dir
-             dovecot-configuration-hostname
-             dovecot-configuration-run-in-container?
-             dovecot-configuration-container-name
-             dovecot-configuration-container-namespaces
-
-             dovecot-etc-files
-             dovecot-accounts
-             dovecot-activation
-             dovecot-shepherd-service
-             dovecot-service-type))
-(use-package-modules
-  admin
-  check
-  crypto
-  cyrus-sasl
-  dbm
-  flex
-  gcc
-  golang
-  libedit
-  m4
-  mail
-  onc-rpc
-  perl
-  python-build
-  python-crypto
-  python-web
-  python-xyz
-  sqlite
-  ssh
-  time
-  tls
-  version-control
-  video
-  xml)
-(use-service-modules
-  certbot
-  cgit
-  dns
-  mail
-  shepherd
-  ssh
-  web)
-
-
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;; finished packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-
-
-(define-public postfix
-  (package
-    (name "postfix")
-    (version "3.8-20221023")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (string-append
-           "http://cdn.postfix.johnriley.me/mirrors/postfix-release/experimental/postfix-"
-           version
-           ".tar.gz"))
-        (sha256
-          (base32 "0aaylhn81n9z3kidx53kzf2jrilr3lgwfxsk1r4hn7nkrp62bcwm"))))
-    (build-system gnu-build-system)
-    (arguments
-      (list
-       #:tests? #f
-       #:modules `((srfi srfi-26)
-                   ,@%default-gnu-imported-modules)
-       #:phases
-       #~(modify-phases %standard-phases
-           (add-before 'configure 'patch-/bin/sh
-             (lambda _
-               (substitute* (find-files "." "^Makefile")
-                 (("/bin/sh")
-                  (which "sh")))))
-           (add-before 'configure 'patch-bdb-include
-             (lambda* (#:key inputs #:allow-other-keys)
-               (substitute* "makedefs"
-                 (("/usr/include")
-                  (string-append (assoc-ref inputs "bdb")
-                                 "/include")))))
-           (add-before 'configure 'dont-hardcode-PATH
-             (lambda _
-               (substitute* '("postfix-install"
-                              "conf/post-install")
-                 (("^PATH=")
-                  "# PATH="))))
-           (add-before 'configure 'fix-strict-PATH
-             (lambda _
-               (substitute* "src/util/sys_defs.h"
-                 (("^#define (ROOT_PATH|_PATH_DEFPATH|_PATH_STDPATH).*")
-                    "#define ROOT_PATH \"/run/setuid-programs:/run/current-system/profile/bin:/run/current-system/profile/sbin\"\n"))))
-           (add-before 'configure 'use-relative-symlink-to-store
-             (lambda _
-               (substitute* "postfix-install"
-                 (("ln -sf")
-                   "ln -rsf"))))
-           (add-before 'configure 'fix-absolute-path-to-setuid-programs
-             (lambda _
-               (substitute* "conf/postfix-script"
-                 (("\\$command_directory/postqueue")
-                   "/run/setuid-programs/postqueue")
-                 (("\\$command_directory/postdrop")
-                   "/run/setuid-programs/postdrop"))))
-           (add-before 'configure 'disable-warning-on-non-writable-config-files
-             (lambda _
-               (substitute* "conf/postfix-script"
-                 (("find \\$todo \\\\\\( -perm -020 -o -perm -002 \\\\\\) \\\\\n")
-                   " # find $todo \\( -perm -020 -o -perm -002 \\)"))))
-           (add-before 'configure 'disable-write-to-/etc/postfix
-             (lambda _
-               (substitute* "src/postconf/postconf_edit.c"
-                 (("pcf_set_config_dir.*")
-                  "return;"))))
-           (add-before 'configure 'setup-environment
-             (lambda* (#:key outputs inputs #:allow-other-keys)
-               (setenv "CCARGS"
-                       (string-join (list
-                                     "-DNO_NIS"
-                                     "-DUSE_TLS"
-                                     "-DUSE_SASL_AUTH"
-                                     "-DUSE_CYRUS_SASL"
-                                     "-I"
-                                     (string-append
-                                      (assoc-ref inputs "cyrus-sasl") "/include/sasl"))
-                                    " "))
-               (setenv "AUXLIBS" "-lnsl -lcrypto -lssl -lsasl2")
-               (let* ((out  (assoc-ref outputs "out"))
-                      (bin     (string-append out "/bin"))
-                      (sbin    (string-append out "/sbin"))
-                      (lib     (string-append out "/lib/postfix"))
-                      (libexec (string-append out "/libexec/postfix"))
-                      (etc     (string-append out "/etc/postfix"))
-                      (man     (string-append out "/share/man"))
-                      (doc     (string-append out "/share/doc/postfix-" #$version))
-                      (html    (string-append doc "/html")))
-                 (setenv "install_root"         "wip-prefix")
-                 (setenv "newaliases_path"      (string-append bin  "/newaliases"))
-                 (setenv "mailq_path"           (string-append bin  "/mailq"))
-                 (setenv "sendmail_path"        (string-append sbin "/sendmail"))
-                 (setenv "command_directory"    sbin)
-                 (setenv "shlib_directory"      lib)
-                 (setenv "daemon_directory"     libexec)
-                 (setenv "meta_directory"       etc)
-                 (setenv "sample_directory"     etc)
-                 (setenv "manpage_directory"    man)
-                 (setenv "readme_directory"     doc)
-                 (setenv "html_directory"       html)
-                 (setenv "sample_directory"     (string-append out "/share/postfix")))))
-           (replace 'configure
-             (lambda _
-               (invoke "make" "makefiles"
-                              "pie=yes"
-                              "dynamicmaps=yes")))
-           (replace 'install
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let ((out (assoc-ref outputs "out")))
-                 (invoke "make" "non-interactive-package")
-                 (delete-file-recursively "wip-prefix/var")
-                 (copy-recursively "wip-prefix/etc" (string-append out "/etc"))
-                 (copy-recursively (string-append "wip-prefix" out) out)))))))
-    (inputs
-      (list bdb
-            cyrus-sasl
-            libnsl
-            openssl
-            perl))
-    (native-inputs
-      (list m4))
-    (home-page "https://www.postfix.org")
-    (synopsis "sendmail compatible MTA")
-    (description
-     "Postfix is Wietse Venema's mail server that started life at IBM research
-as an alternative to the widely-used Sendmail program.  Now at Google, Wietse
-continues to support Postfix.
-
-Postfix attempts to be fast, easy to administer, and secure.  The outside has a
-definite Sendmail-ish flavor, but the inside is completely different.")
-    (license (list license:ibmpl1.0
-                   license:epl2.0))))
-
-(define-public mailutils-sendmail
-  (package
-    (inherit mailutils)
-    (name "mailutils-sendmail")
-    (arguments
-      (substitute-keyword-arguments (package-arguments mailutils)
-        ((#:tests? _ #f) #f)
-        ((#:configure-flags flags)
-         #~(append '("CFLAGS=-DPATH_SENDMAIL=\\\"/run/setuid-programs/sendmail\\\"") #$flags))))))
-
-(define-public rottlog-mailutils-sendmail
-  (package
-    (inherit rottlog)
-    (name "rottlog-mailutils-sendmail")
-    (inputs
-      (list coreutils
-            mailutils-sendmail))))
-
-
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; WIP packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-
-
-(define-public pax-utils
-  (package
-    (name "pax-utils")
-    (version "1.3.7")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (string-append
-           "https://distfiles.gentoo.org/distfiles/pax-utils-"
-           version
-           ".tar.xz"))
-        (sha256
-          (base32 "16lkrvgffprwnd8w3bbiph6zq72cbaqn7p6an3vmrlk8jv9650qh"))))
-    (build-system meson-build-system)
-    (synopsis "ELF utils that can check files for security relevant properties")
-    (description
-     "A suite of ELF tools to aid auditing systems.  Contains various ELF
-related utils for ELF32, ELF64 binaries useful for displaying PaX and security
-information on a large group of binary files.")
-    (home-page "https://distfiles.gentoo.org/distfiles/pax-utils-1.3.7.tar.xz")
-    (license license:gpl2)))
-
-(define (hunspell-dictionary-utf8 dict-name)
-  (package
-    (name (string-append "hunspell-dict-" dict-name "-utf8"))
-    (version "630b34e6f8f3cbe7aa7b27b6d8ab118e27252fd1")
-    (source
-      (origin
-        (method git-fetch)
-        (uri
-          (git-reference
-            (url "https://github.com/wooorm/dictionaries")
-            (commit version)))
-        (file-name
-          (git-file-name "hunspell-dictionary-utf8" version))
-        (sha256
-          (base32 "1iknwzh5h04m067ddw9hlzc1qqj4mr9mdkcfapsnay304laaiyn5"))))
-    (build-system trivial-build-system)
-    (arguments
-      `(#:modules ((guix build utils))
-        #:builder
-        (begin
-          (use-modules (guix build utils))
-          (let ((source-prefix (string-append (assoc-ref %build-inputs "source")
-                                              "/dictionaries/"
-                                              ,dict-name
-                                              "/index"))
-                (install-prefix (string-append %output "/share/hunspell/")))
-            (mkdir-p install-prefix)
-            (copy-file (string-append source-prefix ".aff")
-                       (string-append install-prefix ,dict-name ".aff"))
-            (copy-file (string-append source-prefix ".dic")
-                       (string-append install-prefix ,dict-name ".dic"))))))
-    (synopsis    (string-append "Hunspell " dict-name " dictionary in UTF-8"))
-    (description (string-append "Hunspell " dict-name " dictionary in UTF-8"))
-    (license license:expat)
-    (home-page "https://github.com/wooorm/dictionaries")))
-
-(define-public hunspell-dict-en-utf8 (hunspell-dictionary-utf8 "en"))
-(define-public hunspell-dict-pt-utf8 (hunspell-dictionary-utf8 "pt"))
-(define-public hunspell-dict-fr-utf8 (hunspell-dictionary-utf8 "fr"))
-(define-public hunspell-dict-eo-utf8 (hunspell-dictionary-utf8 "eo"))
-(define-public hunspell-dict-es-utf8 (hunspell-dictionary-utf8 "es"))
-
-(define python-pytest-tornado5
-  (package
-    (name "python-pytest-tornado5")
-    (version "2.0.0")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (pypi-uri "pytest-tornado5" version))
-        (sha256
-         (base32 "0qb62jw2w0xr6y942yp0qxiy755bismjfpnxaxjjm05gy2pymr8d"))))
-    (build-system python-build-system)
-    (arguments
-      (list
-       #:tests? #f))
-    (propagated-inputs (list python-pytest python-tornado))
-    (home-page "https://github.com/vidartf/pytest-tornado")
-    (synopsis
-     "A py.test plugin providing fixtures and markers to simplify testing of asynchronous tornado applications.")
-    (description
-     "This package provides a py.test plugin providing fixtures and markers to
-simplify testing of asynchronous tornado applications.")
-    (license license:asl2.0)))
-
-(define python-ordereddict
-  (package
-    (name "python-ordereddict")
-    (version "1.1")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (pypi-uri "ordereddict" version))
-        (sha256
-          (base32 "07qvy11nvgxpzarrni3wrww3vpc9yafgi2bch4j2vvvc42nb8d8w"))))
-    (build-system python-build-system)
-    (arguments
-      `(#:tests? #f
-        #:phases
-        (modify-phases %standard-phases
-          (delete 'sanity-check))))
-    (home-page "UNKNOWN")
-    (synopsis
-     "A drop-in substitute for Py2.7's new collections.OrderedDict that works in Python 2.4-2.6.")
-    (description "This package provides a drop-in substitute for Py2.7's new
-collections.OrderedDict that works in Python 2.4-2.6.")
-    (license #f)))
-
-(define python-funcsigs
-  (package
-    (name "python-funcsigs")
-    (version "1.0.2")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (pypi-uri "funcsigs" version))
-        (sha256
-          (base32 "0l4g5818ffyfmfs1a924811azhjj8ax9xd1cffr1mzd3ycn0zfx7"))))
-    (build-system python-build-system)
-    (arguments
-      `(#:tests? #f))
-    (propagated-inputs
-      (list python-ordereddict))
-#;
-    (native-inputs
-      (list python-unittest2))
-    (home-page "http://funcsigs.readthedocs.org")
-    (synopsis
-     "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+")
-    (description
-     "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+")
-    (license #f)))
-
-(define python-apscheduler
-  (package
-    (name "python-apscheduler")
-    (version "3.9.1")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (pypi-uri "APScheduler" version))
-        (sha256
-          (base32 "1qzi1pr7q72vs49p7vr1mp350zaggs52lpq43lvqsjcmcd5mgrk5"))))
-    (build-system python-build-system)
-    (arguments
-      `(#:tests? #f))
-    (propagated-inputs
-      (list python-funcsigs
-            ; python-futures
-            python-pytz
-            python-six
-            python-tzlocal))
-    (native-inputs
-      (list python-mock
-            python-pytest
-            python-pytest-asyncio
-            python-pytest-cov
-            python-pytest-tornado5
-            python-setuptools
-            python-setuptools-scm))
-    (home-page "https://github.com/agronholm/apscheduler")
-    (synopsis "In-process task scheduler with Cron-like capabilities")
-    (description "In-process task scheduler with Cron-like capabilities")
-    (license license:expat)))
-
-(define-public python-telegram-bot
-  (package
-    (name "python-telegram-bot")
-    (version "13.12")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (pypi-uri "python-telegram-bot" version))
-        (sha256
-          (base32 "1rbdyr1f9mndlh83in47k8if65yp9n1dy4px2wipbf0qyjv5zxfs"))))
-    (build-system python-build-system)
-    (arguments
-      (list
-       #:tests? #f
-       #:phases
-       #~(modify-phases %standard-phases
-            (delete 'sanity-check))))
-    (native-inputs
-      (list python-apscheduler))
-    (propagated-inputs
-      (list python-apscheduler
-            python-cachetools
-            python-certifi
-            python-pytz
-            python-tornado-6))
-    (home-page "https://python-telegram-bot.org/")
-    (synopsis "Python library to interface with the Telegram Bot API")
-    (description "We have made you a wrapper you can't refuse")
-    (license #f)))
-
-(define-public gm2
-  (package
-    (inherit gcc-14)
-    (name "gm2")
-    (arguments
-      (substitute-keyword-arguments (package-arguments gcc-14)
-        ((#:modules modules %default-gnu-modules)
-         (append '((ice-9 regex)) modules))
-        ((#:configure-flags flags)
-         #~(append
-            (list
-             "--enable-languages=m2")
-            (filter (lambda (s)
-                      (not (string-match "--enable-languages.*" s)))
-                    #$flags)))))
-    (native-inputs
-      (modify-inputs (package-native-inputs gcc-14)
-        (append flex)))))
-
-(define-public ffmpegx
-  (package
-    (inherit ffmpeg)
-    (name "ffmpegx")
-    (arguments
-      (substitute-keyword-arguments (package-arguments ffmpeg)
-        ((#:configure-flags flags)
-         #~(append
-            #$flags
-            '("--enable-libxml2")))))
-    (inputs
-      (modify-inputs (package-inputs ffmpeg)
-        (append libxml2)))))
-
-(define-public mpvx
-  (package
-    (inherit mpv)
-    (name "mpvx")
-    (propagated-inputs
-      (modify-inputs (package-propagated-inputs mpv)
-        (replace "ffmpeg" ffmpegx)))))
-
-(define-public dovecotx
-  (package
-    (inherit dovecot)
-    (name "dovecotx")
-    (arguments
-      (substitute-keyword-arguments (package-arguments dovecot)
-        ((#:tests? _ #f) #f)
-        ((#:configure-flags flags)
-         #~(filter (lambda (flag)
-                     (not (string=? flag "--with-moduledir=/usr/lib/dovecot")))
-                   #$flags))))))
-
-
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;; finished services ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-
-
-(define-record-type* <shadow-group-configuration>
-  shadow-group-configuration
-  make-shadow-group-configuration
-  shadow-group-configuration?
-  (group shadow-group-configuration-group (default "etc-shadow")))
-
-(define (shadow-group-activation config)
-  (match-record config <shadow-group-configuration>
-      (group)
-    #~(begin
-        (use-modules (guix build utils))
-        (format (current-error-port)
-         "Setting ownership and permission for \"/etc/shadow\".~%")
-        (chown "/etc/shadow"
-               (passwd:uid (getpwnam "root"))
-               (group:gid  (getgrnam #$group)))
-        (chmod "/etc/shadow" #o640))))
-
-(define (shadow-group-accounts config)
-  (match-record config <shadow-group-configuration>
-      (group)
-    (list
-     (user-group
-       (name group)
-       (system? #t)))))
-
-(define shadow-group-service-type
-  (service-type
-    (name 'shadow-group)
-    (extensions
-      (list
-       (service-extension activation-service-type
-                          shadow-group-activation)
-       (service-extension account-service-type
-                          shadow-group-accounts)))
-    (default-value (shadow-group-configuration))
-    (description "Provide the infrastructure to allow access to the
-@file{/etc/shadow} file without requiring superuser privileges, by:
-
-@itemize
-@item adding a dedicated group to the system (default: @code{etc-shadow});
-@item granting said group @emph{read-only access} to the @file{/etc/shadow}
-file.
-@end itemize
-
-The goal is to allow unprivileged processes to perform password authentication
-against the @file{/etc/passwd} database, by adding the @code{etc-shadow} group
-to the list of supplementary groups of the user of such running process.")))
-
-
-(define-record-type* <cyrus-service-configuration>
-  cyrus-service-configuration
-  make-cyrus-service-configuration
-  cyrus-service-configuration?
-  (name      cyrus-service-configuration-name)
-  (authmech  cyrus-service-configuration-authmech  (default "saslauthd"))
-  (log-level cyrus-service-configuration-log-level (default 7))
-  (raw-file  cyrus-service-configuration-raw-file  (default #f)))
-
-(define-record-type* <cyrus-sasl-configuration>
-  cyrus-sasl-configuration
-  make-cyrus-sasl-configuration
-  cyrus-sasl-configuration?
-  (package              cyrus-sasl-configuration-package              (default cyrus-sasl))
-  (user                 cyrus-sasl-configuration-user                 (default "cyrus-sasl"))
-  (group                cyrus-sasl-configuration-group                (default "cyrus-sasl"))
-  (supplementary-groups cyrus-sasl-configuration-supplementary-groups (default '("etc-shadow")))
-  (authmech             cyrus-sasl-configuration-authmech             (default "shadow"))
-  (services             cyrus-sasl-configuration-services             (default '()))
-  (config-dirname       cyrus-sasl-configuration-config-dirname       (default "sasl2"))
-  (run-directory        cyrus-sasl-configuration-run-directory        (default "/var/run/saslauthd"))
-  (run-in-container?    cyrus-sasl-configuration-run-in-container?    (default #t))
-  (container-name       cyrus-sasl-configuration-container-name       (default "saslauthd"))
-  (container-namespaces cyrus-sasl-configuration-container-namespaces (default container:%namespaces)))
-
-(define (cyrus-sasl-etc-files config)
-  (match-record config <cyrus-sasl-configuration>
-      (services config-dirname run-directory)
-    `((,config-dirname
-       ,(file-union
-         config-dirname
-         (map (lambda (service-config)
-                (match-record service-config <cyrus-service-configuration>
-                    (name authmech log-level raw-file)
-                  `(,name ,(plain-file
-                            name
-                            (or raw-file
-                               (format #f
-                                "pwcheck_method: ~a~%saslauthd_path: ~a/mux~%log_level: ~a~%"
-                                authmech
-                                run-directory
-                                log-level))))))
-              services))))))
-
-(define (cyrus-sasl-activation config)
-  (match-record config <cyrus-sasl-configuration>
-      (user run-directory)
-    #~(begin
-        (use-modules (guix build utils))
-        (format (current-error-port)
-         "Creating Cyrus SASL socket directory: \"~a\".~%" #$run-directory)
-        (mkdir-p/perms #$run-directory (getpwnam #$user) #o755))))
-
-(define (cyrus-sasl-accounts config)
-  (match-record config <cyrus-sasl-configuration>
-      (user group supplementary-groups)
-    (list
-     (user-account
-       (name user)
-       (group group)
-       (supplementary-groups supplementary-groups)
-       (comment "Cyrus SASL system user")
-       (home-directory "/var/empty")
-       (create-home-directory? #f)
-       (shell
-         (file-append shadow "/sbin/nologin"))
-       (system? #t))
-     (user-group
-       (name group)
-       (system? #t)))))
-
-(define (cyrus-sasl-shepherd-service config)
-  (match-record config <cyrus-sasl-configuration>
-      (package user group supplementary-groups authmech config-dirname run-directory
-       services run-in-container? container-name container-namespaces)
-    (let* ((bin (file-append package "/sbin/saslauthd"))
-           (cmd (if (not run-in-container?)
-                  bin
-                  (least-authority-wrapper
-                   bin
-                   #:name container-name
-                   #:namespaces container-namespaces
-                   #:mappings (list
-                               (file-system-mapping
-                                 (source run-directory)
-                                 (target source)
-                                 (writable? #t))
-                               (file-system-mapping
-                                 (source "/etc/passwd")
-                                 (target source))
-                               (file-system-mapping
-                                 (source "/etc/shadow")
-                                 (target source)))))))
-      (list
-       (shepherd-service
-         (provision '(cyrus-sasl))
-         (documentation "Run the saslauthd daemon of Cyrus SASL.")
-         (start #~(make-forkexec-constructor
-                   (list #$cmd "-a" #$authmech "-d" "-m" #$run-directory)
-                   #:user #$user
-                   #:group #$group
-                   #:supplementary-groups '(#$@supplementary-groups)))
-         (stop #~(make-kill-destructor))
-         (actions
-           (list
-            (shepherd-action
-              (name 'configuration)
-              (documentation "Display the name of all registered configuration files.")
-              (procedure
-                (let ((names (map cyrus-service-configuration-name services)))
-                  #~(lambda _
-                      (for-each (lambda (name)
-                                  (format #t "/etc/~a/~a~%" #$config-dirname name))
-                                '#$names))))))))))))
-
-(define cyrus-sasl-service-type
-  (service-type
-    (name 'cyrus-sasl)
-    (extensions
-      (list
-       (service-extension etc-service-type
-                          cyrus-sasl-etc-files)
-       (service-extension activation-service-type
-                          cyrus-sasl-activation)
-       (service-extension profile-service-type
-                          (compose list cyrus-sasl-configuration-package))
-       (service-extension account-service-type
-                          cyrus-sasl-accounts)
-       (service-extension shepherd-root-service-type
-                          cyrus-sasl-shepherd-service)))
-    (compose s1:concatenate)
-    (extend (lambda (config services)
-              (cyrus-sasl-configuration
-                (inherit config)
-                (services
-                  (append
-                   (cyrus-sasl-configuration-services config)
-                   services)))))
-    (default-value (cyrus-sasl-configuration))
-    (description "Run the @code{saslauthd} daemon from the Cyrus SASL package.
-
-Services can extend @code{cyrus-sasl-service-type}, and provide their own list
-of @code{cyrus-service-configuration} entries to be registered in this service.
-
-For the @code{saslauthd} daemon to be able to authenticate using the \"shadow\"
-@code{authmech}, it needs read access to the @file{/etc/shadow} file.  This is
-accomplished by default by adding the @code{etc-shadow} group to the list of
-supplementary groups of the running daemon, and by enabling the
-@code{shadow-group-service-type} service.
-
-By default, the daemon runs in a container.")))
-
-
-(define-record-type* <dkimproxyout-configuration>
-  dkimproxyout-configuration
-  make-dkimproxyout-configuration
-  dkimproxyout-configuration?
-  (package              dkimproxyout-configuration-package              (default dkimproxy))
-  (user                 dkimproxyout-configuration-user                 (default "dkimproxyout"))
-  (group                dkimproxyout-configuration-group                (default "dkimproxyout"))
-  (supplementary-groups dkimproxyout-configuration-supplementary-groups (default '()))
-  (config-name          dkimproxyout-configuration-config-name          (default "dkimproxyout.conf"))
-  (config-extra         dkimproxyout-configuration-config-extra         (default ""))
-  (raw-file             dkimproxyout-configuration-raw-file             (default #f))
-  (listen               dkimproxyout-configuration-listen               (default "127.0.0.1:10027"))
-  (relay                dkimproxyout-configuration-relay                (default "127.0.0.1:10028"))
-  (domains              dkimproxyout-configuration-domains              (default (list (gethostname))))
-  (selector             dkimproxyout-configuration-selector             (default "dkimproxyout"))
-  (key-size             dkimproxyout-configuration-key-size             (default 2048))
-  (data-directory       dkimproxyout-configuration-data-directory       (default "/var/lib/dkimproxyout"))
-  (run-in-container?    dkimproxyout-configuration-run-in-container?    (default #t))
-  (container-name       dkimproxyout-configuration-container-name       (default "dkimproxyout"))
-  (container-namespaces dkimproxyout-configuration-container-namespaces (default (s1:fold delq container:%namespaces '(net)))))
-
-(define (generate-out.cf config)
-  (match-record config <dkimproxyout-configuration>
-      (config-extra listen relay domains selector data-directory)
-    (format #f
-     "listen ~a
-relay ~a
-
-domain ~a
-selector ~a
-
-signature dkim(c=relaxed/relaxed,a=rsa-sha256)
-
-keyfile ~a/private.key
-~a"
-       listen
-       relay
-       (string-join domains ",")
-       selector
-       data-directory
-       config-extra)))
-
-(define (dkimproxyout-etc-files config)
-  (match-record config <dkimproxyout-configuration>
-      (config-name raw-file)
-    `((,config-name ,(plain-file config-name
-                                 (or raw-file
-                                     (generate-out.cf config)))))))
-
-(define (dkimproxyout-accounts config)
-  (match-record config <dkimproxyout-configuration>
-      (user group supplementary-groups)
-    (list
-     (user-account
-       (name user)
-       (group group)
-       (supplementary-groups supplementary-groups)
-       (comment "DKIMproxy.out signing system user")
-       (home-directory "/var/empty")
-       (create-home-directory? #f)
-       (shell
-         (file-append shadow "/sbin/nologin"))
-       (system? #t))
-     (user-group
-       (name group)
-       (system? #t)))))
-
-(define (dkimproxyout-activation config)
-  (match-record config <dkimproxyout-configuration>
-      (user data-directory key-size)
-    #~(begin
-        (use-modules (guix build utils))
-        (let* ((user (getpwnam #$user))
-               (uid (passwd:uid user))
-               (gid (passwd:gid user))
-               (private-key (string-append #$data-directory "/private.key"))
-               (public-key  (string-append #$data-directory "/public.key")))
-          (format (current-error-port)
-           "Creating DKIMproxy.out data directory: \"~a\".~%" #$data-directory)
-          (mkdir-p/perms #$data-directory user #o755)
-          (unless (file-exists? private-key)
-            (format (current-error-port)
-             "The public/private keypair doesn't exist yet.  Generating one...~%")
-            (cond
-              ((zero? (system* #$(file-append openssl "/bin/openssl")
-                               "genrsa"
-                               "-out"
-                               private-key
-                               (number->string #$key-size)))
-               (format (current-error-port)
-                "DKIMproxy.out private key file created: \"~a\".~%" private-key)
-               (invoke #$(file-append openssl "/bin/openssl")
-                       "rsa"
-                       "-in"
-                       private-key
-                       "-pubout"
-                       "-out"
-                       public-key)
-               (format (current-error-port)
-                "Setting permissions for the public/private DKIMproxy.out keypair: \"~a/{public,private}.key\".~%" #$data-directory)
-               (chown private-key uid gid)
-               (chown public-key  uid gid)
-               (chmod private-key #o400)
-               (chmod public-key  #o644))
-              (else
-               (format (current-error-port)
-                "ERROR: failed to create DKIMproxy.out private key file: \"~a\".~%" private-key))))))))
-
-(define (dkimproxyout-shepherd-service config)
-  (match-record config <dkimproxyout-configuration>
-      (package user group supplementary-groups config-name data-directory
-       run-in-container? container-name container-namespaces)
-    (let* ((config-file (string-append "/etc/" config-name))
-           (bin (file-append package "/bin/dkimproxy.out"))
-           (cmd (if (not run-in-container?)
-                  bin
-                  (least-authority-wrapper
-                   bin
-                   #:name container-name
-                   #:namespaces container-namespaces
-                   #:mappings (list
-                               (file-system-mapping
-                                 (source "/etc/protocols")
-                                 (target source))
-                               (file-system-mapping
-                                 (source config-file)
-                                 (target source))
-                               (file-system-mapping
-                                 (source
-                                   (string-append data-directory "/private.key"))
-                                 (target source)))))))
-      (list
-       (shepherd-service
-         (provision '(dkimproxyout))
-         (documentation "Run the outbound DKIMProxy.out daemon.")
-         (start #~(make-forkexec-constructor
-                   (list #$cmd "--conf_file" #$config-file)
-                   #:user #$user
-                   #:group #$group
-                   #:supplementary-groups '(#$@supplementary-groups)))
-         (stop #~(make-kill-destructor))
-         (actions
-           (list
-            (shepherd-action
-              (name 'configuration)
-              (documentation "Display the name of the configuration file being used.")
-              (procedure
-                #~(lambda _
-                    (format #t "~a~%" #$config-file)))))))))))
-
-(define dkimproxyout-service-type
-  (service-type
-    (name 'dkimproxyout)
-    (extensions
-      (list
-       (service-extension etc-service-type
-                          dkimproxyout-etc-files)
-       (service-extension account-service-type
-                          dkimproxyout-accounts)
-       (service-extension activation-service-type
-                          dkimproxyout-activation)
-       (service-extension profile-service-type
-                          (compose list dkimproxyout-configuration-package))
-       (service-extension shepherd-root-service-type
-                          dkimproxyout-shepherd-service)))
-    (default-value (dkimproxyout-configuration))
-    (description "Run the @code{dkimproxy.out} SMTP outbound proxy for adding
-DKIM signature headers to emails.  This daemon is meant to be used in companiong
-with an SMTP server, such as Postfix.
-
-On startup, it creates the keypair to be used for signing if the keypair doesn't
-exist yet.  The corresponding public.key is kept in the same directory as the
-private key.  The default location for the private key is
-@file{/var/lib/dkimproxyout/private.key}, so the public key is kept at
-@file{/var/lib/dkimproxyout/public.key}, so that it can be added as a TXT DNS
-entry.
-
-By default, the daemon runs in a container.")))
-
-
-(define-record-type* <postfix-configuration>
-  postfix-configuration
-  make-postfix-configuration
-  postfix-configuration?
-  (package              postfix-configuration-package              (default postfix))
-  (enable-submission?   postfix-configuration-enable-submission?   (default #f))
-  (set-sendmail?        postfix-configuration-set-sendmail?        (default #t))
-  (master.cf-file       postfix-configuration-master.cf-file       (default #f))
-  (main.cf-file         postfix-configuration-main.cf-file         (default #f))
-  (master.cf-extra      postfix-configuration-master.cf-extra      (default ""))
-  (main.cf-extra        postfix-configuration-main.cf-extra        (default ""))
-  (config-dirname       postfix-configuration-config-dirname       (default "postfix"))
-  (mail-directory       postfix-configuration-mail-directory       (default "/var/mail/"))
-  (data-directory       postfix-configuration-data-directory       (default "/var/lib/postfix"))
-  (queue-directory      postfix-configuration-queue-directory      (default "/var/spool/postfix"))
-  (user                 postfix-configuration-user                 (default "postfix"))
-  (group                postfix-configuration-group                (default "postfix"))
-  (supplementary-groups postfix-configuration-supplementary-groups (default '()))
-  (setgid-group         postfix-configuration-setgid-group         (default "postdrop"))
-  (root-aliases         postfix-configuration-root-aliases         (default '("abuse" "admin" "hostmaster" "postmaster")))
-  (cert-file            postfix-configuration-cert-file            (default #f))
-  (key-file             postfix-configuration-key-file             (default #f))
-  (hostname             postfix-configuration-hostname             (default (gethostname)))
-  (dkim-filter-listen   postfix-configuration-dkim-filter-listen   (default "[127.0.0.1]:10027"))
-  (dkim-filter-relay    postfix-configuration-dkim-filter-relay    (default "127.0.0.1:10028"))
-  (sasl-dirname         postfix-configuration-sasl-dirname         (default "/etc/sasl2"))
-  (run-in-container?    postfix-configuration-run-in-container?    (default #f))
-  (container-name       postfix-configuration-container-name       (default "postfix"))
-  (container-namespaces postfix-configuration-container-namespaces (default (s1:fold delq container:%namespaces '(net)))))
-
-(define (dksign-filter dkim-filter-listen)
-  (format #f
-   "
-  -o content_filter=dksign:~a"
-   dkim-filter-listen))
-
-(define (submission-config dkim-filter-listen)
-  (format #f
-   "
-submission  inet       n        -       n       -        -        smtpd -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o content_filter=dksign:~a"
-   dkim-filter-listen))
-
-(define (dksign-config dkim-filter-relay)
-  (format #f
-   "
-
-dksign      unix       -        -       n       -        -        smtp
-  -o syslog_name=postfix/dkimproxyout-listen
-  -o smtp_send_xforward_command=yes
-  -o smtp_discard_ehlo_keywords=8bitmime,starttls
-
-~a inet   n        -       n       -        -        smtpd
-  -o syslog_name=postfix/dkimproxyout-relay
-  -o content_filter=
-  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-  -o smtpd_helo_restrictions=
-  -o smtpd_client_restrictions=
-  -o smtpd_sender_restrictions=
-  -o smtpd_recipient_restrictions=permit_mynetworks,reject
-  -o mynetworks=127.0.0.0/8
-  -o smtpd_authorized_xforward_hosts=127.0.0.0/8
-"
-   dkim-filter-relay))
-
-(define (generate-master.cf config)
-  (match-record config <postfix-configuration>
-      (enable-submission? master.cf-extra dkim-filter-listen dkim-filter-relay)
-    (format #f
-     "# ============================================================================================================
-# service   type       private  unpriv  chroot  wakeup   maxproc  command + args
-#                      (yes)    (yes)   (no)    (never)  (100)
-# =============================================================================================================
-
-anvil       unix       -        -       n       -        1        anvil
-bounce      unix       -        -       n       -        0        bounce
-cleanup     unix       n        -       n       -        0        cleanup
-defer       unix       -        -       n       -        0        bounce
-discard     unix       -        -       n       -        -        discard
-error       unix       -        -       n       -        -        error
-flush       unix       n        -       n       1000?    0        flush
-lmtp        unix       -        -       n       -        -        lmtp
-local       unix       -        n       n       -        -        local
-pickup      unix       n        -       n       60       1        pickup~a
-proxymap    unix       -        -       n       -        -        proxymap
-proxywrite  unix       -        -       n       -        1        proxymap
-qmgr        unix       n        -       n       300      1        qmgr
-relay       unix       -        -       n       -        -        smtp
-retry       unix       -        -       n       -        -        error
-rewrite     unix       -        -       n       -        -        trivial-rewrite
-scache      unix       -        -       n       -        1        scache
-showq       unix       n        -       n       -        -        showq
-smtp        inet       n        -       n       -        -        smtpd -o syslog_name=postfix/smtp
-smtp        unix       -        -       n       -        -        smtp
-tlsmgr      unix       -        -       n       1000?    1        tlsmgr
-trace       unix       -        -       n       -        0        bounce
-verify      unix       -        -       n       -        1        verify
-virtual     unix       -        n       n       -        -        virtual
-postlog     unix-dgram n        -       n       -        1        postlogd
-~a~a~a"
-     (if enable-submission? (dksign-filter dkim-filter-listen)      "")
-     (if enable-submission? (submission-config dkim-filter-listen)  "")
-     (if enable-submission? (dksign-config dkim-filter-relay)       "")
-     master.cf-extra)))
-
-(define (cert-for prefix config)
-  (match-record config <postfix-configuration>
-      (cert-file hostname)
-    (or cert-file (format #f "/etc/letsencrypt/live/~a~a/fullchain.pem" prefix hostname))))
-
-(define (key-for prefix config)
-  (match-record config <postfix-configuration>
-      (key-file hostname)
-    (or key-file (format #f "/etc/letsencrypt/live/~a~a/privkey.pem" prefix hostname))))
-
-(define (main.cf-internet-extra hostname cert key sasl-dirname)
-  (format #f
-   "
-myhostname = ~a
-
-smtpd_use_tls = yes
-smtpd_tls_cert_file = ~a
-smtpd_tls_key_file  = ~a
-smtp_use_tls       = $smtpd_use_tls
-smtp_tls_cert_file = $smtpd_tls_cert_file
-smtp_tls_key_file  = $smtpd_tls_key_file
-
-smtp_tls_security_level  = may
-
-recipient_delimiter = +
-
-smtpd_sasl_tls_security_options = noanonymous
-smtpd_tls_security_level = may
-smtpd_tls_auth_only = yes
-
-smtpd_relay_restrictions = $smtpd_recipient_restrictions
-smtpd_recipient_restrictions = permit_mynetworks,
-  permit_sasl_authenticated, reject_unauth_destination
-smtpd_sasl_auth_enable = yes
-cyrus_sasl_config_path = ~a
-debug_peer_list = 127.0.0.1
-
-milter_default_action = accept
-"
-  hostname
-  cert
-  key
-  sasl-dirname))
-(define main.cf-local-extra
-  "
-mynetworks = 127.0.0.0/8
-")
-
-(define (generate-main.cf config)
-  (match-record config <postfix-configuration>
-      (enable-submission? mail-directory queue-directory data-directory
-       user setgid-group hostname main.cf-extra sasl-dirname)
-    (format #f
-     "compatibility_level = 3.6
-
-queue_directory = ~a
-data_directory = ~a
-mail_owner = ~a
-setgid_group = ~a
-
-header_checks = regexp:{ { /^Received:.*/ IGNORE }, { /^X-Originating-IP:.*/ IGNORE } }
-
-mail_spool_directory = ~a
-
-message_size_limit = 102400000
-mailbox_size_limit = 5120000000
-
-~a~a"
-
-     queue-directory
-     data-directory
-     user
-     setgid-group
-     mail-directory
-     main.cf-extra
-     (if enable-submission?
-       (main.cf-internet-extra
-        hostname
-        (cert-for "" config)
-        (key-for  "" config)
-        sasl-dirname)
-       main.cf-local-extra))))
-
-(define (postfix-etc-files config)
-  (match-record config <postfix-configuration>
-      (master.cf-file main.cf-file config-dirname)
-    `((,config-dirname
-       ,(file-union
-         config-dirname
-         `(("master.cf" ,(plain-file "master.cf" (or master.cf-file (generate-master.cf config))))
-           ("main.cf"   ,(plain-file "main.cf"   (or main.cf-file   (generate-main.cf   config))))))))))
-
-(define (postfix-accounts config)
-  (match-record config <postfix-configuration>
-      (user group supplementary-groups setgid-group)
-    (list
-     (user-account
-       (name user)
-       (group group)
-       (supplementary-groups supplementary-groups)
-       (comment "Postfix system user")
-       (home-directory "/var/empty")
-       (create-home-directory? #f)
-       (shell
-         (file-append shadow "/sbin/nologin"))
-       (system? #t))
-     (user-group
-       (name group)
-       (system? #t))
-     (user-group
-       (name setgid-group)
-       (system? #t)))))
-
-(define (postfix-privileged-programs config)
-  (match-record config <postfix-configuration>
-      (package setgid-group set-sendmail?)
-    (append (list
-      (privileged-program
-        (program (file-append package "/sbin/postdrop"))
-        (setuid? #f)
-        (setgid? #t)
-        (group setgid-group))
-      (privileged-program
-        (program (file-append package "/sbin/postqueue"))
-        (setuid? #f)
-        (setgid? #t)
-        (group setgid-group)))
-     (if set-sendmail?
-       (list
-        (privileged-program
-          (program (file-append package "/sbin/sendmail"))
-          (setuid? #f)
-          (setgid? #t)
-          (group setgid-group)))
-       '()))))
-
-(define (postfix-activation config)
-  (match-record config <postfix-configuration>
-      (package mail-directory queue-directory)
-    #~(begin
-        (use-modules (guix build utils))
-        (let ((user (getpwnam "root")))
-          (unless (directory-exists? #$mail-directory)
-            (format (current-error-port)
-             "Creating email spool director: \"~a\".~%" #$mail-directory)
-            (mkdir-p/perms #$mail-directory user #o755))
-          (format (current-error-port)
-           "Creating Postfix queue directory: \"~a\".~%" #$queue-directory)
-          (mkdir-p/perms #$queue-directory user #o755)
-          (format (current-error-port)
-           "Updating /etc/aliases.~%")
-;; FIXME
-#;
-          (invoke #$(file-append package "/bin/newaliases"))))))
-
-(define (postfix-shepherd-service config)
-  (match-record config <postfix-configuration>
-      (package config-dirname data-directory queue-directory
-       run-in-container? container-name container-namespaces)
-    (let* ((config-dir (string-append "/etc/" config-dirname))
-           (bin (file-append package "/sbin/postfix"))
-           (cmd (if (not run-in-container?)
-                  bin
-                  (least-authority-wrapper
-                   bin
-                   #:name container-name
-                   #:namespaces container-namespaces
-                   #:mappings (list
-                               (file-system-mapping
-                                 (source data-directory)
-                                 (target source)
-                                 (writable? #t))
-                               (file-system-mapping
-                                 (source queue-directory)
-                                 (target source)
-                                 (writable? #t)))))))
-      (list
-       (shepherd-service
-         (provision '(postfix))
-         (documentation
-           "Run the Postfix MTA.
-
-This is the entrypoint for starting the \"master\" process.  Then the \"master\"
-process itself takes responsability of starting all the required daemons and
-commands.")
-         (start #~(make-forkexec-constructor
-                   (list #$cmd "-c" #$config-dir "start-fg")
-                   #:pid-file "/var/lib/postfix/master.lock"))
-         (actions
-           (list
-            (shepherd-action
-              (name 'configuration)
-              (documentation "Display the name of the \"master.cf\" and \"main.cf\" file being used.")
-              (procedure
-                #~(lambda _
-                    (format #t "~a/master.cf~%" #$config-dir)
-                    (format #t "~a/main.cf~%"   #$config-dir))))
-            (shepherd-action
-              (name 'reload)
-              (documentation
-                "Re-read the \"master.cf\" and \"main.cf\" configuration files.
-
-Daemon processes terminate when possible, and when restarted use the values of
-the new configuration files.
-
-This live-reload option is usually preferable over a stop/start cycle, as it
-incurs in no interruption of the running service.")
-              (procedure
-                #~(lambda _
-                    (invoke #$cmd "-c" #$config-dir "reload")))))))))))
-
-(define (postfix-aliases config)
-  (match-record config <postfix-configuration>
-      (root-aliases)
-    (map (lambda (alias)
-           `(,alias "root"))
-         root-aliases)))
-
-(define (postfix-nginx-locations config)
-  (match-record config <postfix-configuration>
-      (hostname)
-    (list
-     (nginx-server-configuration
-       (server-name (list (string-append "mta-sts." hostname)))
-       (listen '("[::]:443 ssl" "443 ssl"))
-       (ssl-certificate     (cert-for "mta-sts." config))
-       (ssl-certificate-key (key-for  "mta-sts." config))
-       (locations
-         (list
-          (nginx-location-configuration
-            (uri "= /.well-known/mta-sts.txt")
-            (body
-              (list
-               (list "alias "
-                     (plain-file
-                      "mta-sts.txt"
-                      (format #f
-                       "version: STSv1
-mode: enforce
-mx: ~a
-max_age: 604800
-"
-                       hostname))
-                     ";"))))))))))
-
-(define (postfix-certificates config)
-  (match-record config <postfix-configuration>
-      (hostname)
-    (list
-     (certificate-configuration
-       (domains (list (string-append "mta-sts." hostname)))))))
-
-(define (postfix-sasl-services _config)
-  (list
-   (cyrus-service-configuration
-     (name "smtpd.conf"))))
-
-(define local-postfix-service-extensions
-  (list
-   (service-extension etc-service-type
-                      postfix-etc-files)
-   (service-extension account-service-type
-                      postfix-accounts)
-   (service-extension privileged-program-service-type
-                      postfix-privileged-programs)
-   (service-extension activation-service-type
-                      postfix-activation)
-   (service-extension profile-service-type
-                      (compose list postfix-configuration-package))
-   (service-extension shepherd-root-service-type
-                      postfix-shepherd-service)))
-
-(define local-postfix-service-type
-  (service-type
-    (name 'postfix)
-    (extensions local-postfix-service-extensions)
-    (default-value (postfix-configuration))
-    (description
-      "Run the Postfix MTA.
-
-This is the top-level system service for Postfix, targeted at \"local\"
-installations, that is, not internet-facing, usually for delivery of cronjob
-emails, or for offline email sending in a laptop via a relay.
-
-It includes:
-@itemize
-@item populating @file{/etc/postfix/} with read-only configuration files;
-@item the user and groups used by Postfix when handling email delivery;
-@item the special setgid binaries for daily usage, such as \"sendmail\";
-@item the Shepherd service for starting, stopping and @emph{reloading} the
-      service without restarting it;
-@item the activation script for creating the required directories and
-      configuring them with the correct permissions;
-@item the binaries in the system profile so that one doesn't need to explicilty
-      include the package when the service is already enabled.
-@end itemize
-
-An extension to the log-rotation service isn't included: the default rottlog
-configuration already includes @file{/var/log/maillog} in its routine, so it is
-kept out.
-
-The defaults of @code{<postfix-configuration>} provides sane default values for
-most things, such as group names, data and queue directories, etc.  When used
-as-is, it creates a Postfix server that sends email locally-only, and one can
-add relaying configuration via the @code{main.cf-extra} parameter.")))
-
-(define internet-postfix-service-type
-  (service-type
-    (name 'postfix)
-    (extensions
-      (append
-       local-postfix-service-extensions
-       (list
-        (service-extension mail-aliases-service-type
-                           postfix-aliases)
-        (service-extension nginx-service-type
-                           postfix-nginx-locations)
-        (service-extension certbot-service-type
-                           postfix-certificates)
-        (service-extension cyrus-sasl-service-type
-                           postfix-sasl-services))))
-    (default-value (postfix-configuration
-                     (enable-submission? #t)))
-    (description
-      "Run the Postfix MTA.
-
-This is the top-level system service for Postfix, targeted at \"internet\"
-installations, that is, internet-facing SMTP servers, for sending and receiving
-emails to other servers, as well as local delivery of emails between users or by
-system users such as cronjobs.
-
-It includes everything from @code{local-postfix-service-type}, plus:
-@itemize
-@item nginx configuration for answering the @code{mta-sts.$domain} HTTP
-      subdomain, specifically the @code{.well-known/mta-sts.txt} URL;
-@item certbot extension for acquiring the certificate for @code{mta-sts.$domain}
-      so that the item above happens via HTTPS;
-@item best-practices email aliases for administering a SMTP server;
-@item cyrus-sasl extension for authenticating SMTP users via the Cyrus SASL
-      @code{saslauthd} daemon.
-@end itemize
-
-The defaults of @code{<postfix-configuration>} provides sane default values for
-most things, hostname, certificates, permissions, etc.  When used as-is, it
-creates a Postfix server that can send and receive emails from the internet
-correctly.")))
-
-
-
-(define-record-type* <dovecot-configuration>
-  dovecot-configuration
-  make-dovecot-configuration
-  dovecot-configuration?
-  (package                        dovecot-configuration-package                        (default dovecotx))
-  (mail-location                  dovecot-configuration-mail-location                  (default "/var/mail/"))
-  (raw-file                       dovecot-configuration-raw-file                       (default #f))
-  (extra-content                  dovecot-configuration-extra-content                  (default ""))
-  (config-dirname                 dovecot-configuration-config-dirname                 (default "dovecot"))
-  (config-filename                dovecot-configuration-config-filename                (default "dovecot.conf"))
-  (user                           dovecot-configuration-user                           (default "dovecot"))
-  (group                          dovecot-configuration-group                          (default "dovecot"))
-  (supplementary-groups           dovecot-configuration-supplementary-groups           (default '()))
-  (auth-worker-group              dovecot-configuration-auth-worker-group              (default "etc-shadow"))
-  (untrusted-user                 dovecot-configuration-untrusted-user                 (default "dovenull"))
-  (untrusted-group                dovecot-configuration-untrusted-group                (default "dovenull"))
-  (untrusted-supplementary-groups dovecot-configuration-untrusted-supplementary-groups (default '()))
-  (base-dir                       dovecot-configuration-base-dir                       (default "/var/run/dovecot"))
-  (state-dir                      dovecot-configuration-state-dir                      (default "/var/lib/dovecot"))
-  (hostname                       dovecot-configuration-hostname                       (default (gethostname)))
-  (run-in-container?              dovecot-configuration-run-in-container?              (default #f))
-  (container-name                 dovecot-configuration-container-name                 (default "dovecot"))
-  (container-namespaces           dovecot-configuration-container-namespaces           (default (s1:fold delq container:%namespaces '(net)))))
-
-(define (generate-dovecot-config config)
-  (match-record config <dovecot-configuration>
-      (mail-location user group auth-worker-group untrusted-user
-       hostname base-dir state-dir extra-content)
-    (format #f
-     "protocols = imap
-
-default_internal_user = ~a
-default_internal_group = ~a
-default_login_user = ~a
-auth_mechanisms = plain login
-auth_username_format = %n
-
-passdb {
-  driver = shadow
-}
-userdb {
-  driver = passwd
-}
-service auth-worker {
-  group = ~a
-}
-
-ssl = required
-ssl_cert = </etc/letsencrypt/live/~a/fullchain.pem
-ssl_key  = </etc/letsencrypt/live/~a/privkey.pem
-ssl_dh = <~a/dhparam.pem
-
-base_dir = ~a
-state_dir = ~a
-
-verbose_proctitle = yes
-
-mail_location = maildir:~a%u:INBOX=~a%u:LAYOUT=fs
-
-namespace inbox {
-  inbox = yes
-  mailbox Drafts {
-    special_use = \\Drafts
-    auto = subscribe
-  }
-  mailbox Sent {
-    special_use = \\Sent
-    auto = subscribe
-  }
-  mailbox Archive {
-    special_use = \\Archive
-    auto = subscribe
-  }
-  mailbox Junk {
-    special_use = \\Junk
-    auto = subscribe
-    autoexpunge = 30d
-  }
-  mailbox Trash {
-    special_use = \\Trash
-    auto = subscribe
-  }
-}
-~a"
-     user
-     group
-     untrusted-user
-     auth-worker-group
-     hostname
-     hostname
-     state-dir
-     base-dir
-     state-dir
-     mail-location
-     mail-location
-     extra-content)))
-
-(define (dovecot-etc-files config)
-  (match-record config <dovecot-configuration>
-      (raw-file config-dirname config-filename)
-    `((,config-dirname
-       ,(file-union
-         config-dirname
-         `((,config-filename ,(plain-file config-filename
-                                          (or raw-file
-                                              (generate-dovecot-config config))))))))))
-
-(define (dovecot-accounts config)
-  (match-record config <dovecot-configuration>
-      (          user           group           supplementary-groups
-       untrusted-user untrusted-group untrusted-supplementary-groups)
-    (list
-     (user-account
-       (name user)
-       (group group)
-       (supplementary-groups supplementary-groups)
-       (comment "Dovecot system user")
-       (home-directory "/var/empty")
-       (create-home-directory? #f)
-       (shell
-         (file-append shadow "/sbin/nologin"))
-       (system? #t))
-     (user-account
-       (name untrusted-user)
-       (group untrusted-group)
-       (supplementary-groups untrusted-supplementary-groups)
-       (comment "Dovecot user for untrusted logins")
-       (home-directory "/var/empty")
-       (create-home-directory? #f)
-       (shell
-         (file-append shadow "/sbin/nologin"))
-       (system? #t))
-     (user-group
-       (name group)
-       (system? #t))
-     (user-group
-       (name untrusted-group)
-       (system? #t)))))
-
-(define (dovecot-activation config)
-  (match-record config <dovecot-configuration>
-      (base-dir state-dir)
-    #~(begin
-        (use-modules (guix build utils))
-        (let ((user (getpwnam "root"))
-              (dhparam.pem (string-append #$state-dir "/dhparam.pem")))
-          (format (current-error-port)
-           "Creating Dovecot base_dir directory: \"~a\".~%" #$base-dir)
-          (mkdir-p/perms #$base-dir  user #o755)
-          (mkdir-p/perms #$state-dir user #o755)
-          (unless (file-exists? dhparam.pem)
-            (format (current-error-port)
-             "dhparam.pem file doesn't exist yet.  Generating one...~%")
-            (cond
-             ((zero? (system* (string-append #$openssl "/bin/openssl")
-                              "dhparam" "-out" dhparam.pem "2048"))
-              (format (current-error-port)
-               "Dovecot2 dhparam.pem file created: \"~a\".~%" dhparam.pem))
-             (else
-              (format (current-error-port)
-               "Failed to create dhparam.pem file: \"~a\".~%" dhparam.pem))))))))
-
-(define (dovecot-shepherd-service config)
-  (match-record config <dovecot-configuration>
-      (package config-dirname config-filename
-       run-in-container? container-name container-namespaces)
-    (let* ((config-file (string-append "/etc/" config-dirname "/" config-filename))
-           (bin (file-append package "/sbin/dovecot"))
-           (cmd (if (not run-in-container?)
-                  bin
-                  (least-authority-wrapper
-                   bin
-                   #:name container-name
-                   #:namespaces container-namespaces
-                   #:mappings (list
-                               (file-system-mapping
-                                 (source "/etc/shadow")
-                                 (target source)))))))
-      (list
-       (shepherd-service
-         (provision '(dovecot))
-         (documentation "Run the Dovecot daemon.")
-         (start #~(make-forkexec-constructor
-                   (list #$cmd "-F" "-c" #$config-file)))
-         (stop #~(make-kill-destructor))
-         (actions
-           (list
-            (shepherd-action
-              (name 'configuration)
-              (documentation "Display the name of the configuration file being used.")
-              (procedure
-                #~(lambda _
-                    (format #t "~a~%" #$config-file))))
-            (shepherd-action
-              (name 'reload)
-              (documentation "Re-read the configuration file without restarting the running dovecot daemon.")
-              (procedure
-                #~(lambda _
-                    (invoke #$(file-append package "/bin/doveadm")
-                            "-c"
-                            #$config-file
-                            "reload")))))))))))
-
-(define dovecot-service-type
-  (service-type
-    (name 'dovecot)
-    (extensions
-      (list
-       (service-extension etc-service-type
-                          dovecot-etc-files)
-       (service-extension account-service-type
-                          dovecot-accounts)
-       (service-extension activation-service-type
-                          dovecot-activation)
-       (service-extension profile-service-type
-                          (compose list dovecot-configuration-package))
-       (service-extension shepherd-root-service-type
-                          dovecot-shepherd-service)))
-    (default-value (dovecot-configuration))
-    (description "Run the Dovecot IMAP @code{dovecot} daemon.
-
-This is the top-level system service for Dovecot, using the UNIX password stored
-at @file{/etc/shadow} for authenticating IMAP connections.
-
-It includes:
-@itemize
-@item creating the configuration file at @file{/etc/dovecot/dovecot.conf} by
-      default;
-@item the user and groups used by Dovecot both system and untrusted users;
-@item the activation script for creating the required directories and the
-      @file{dhparam.pem} file if it is missing;
-@item the Shepherd service for starting, stopping and @emph{reloading} the
-      service without restarting it;
-@item the binaries in the system profile so that one doesn't need to explicilty
-      include the package when the service is already enabled.
-@end itemize
-
-An extension to the log-rotation service isn't included: the default rottlog
-configuration already includes @file{/var/log/maillog} in its routine, so it is
-kept out.
-
-The defaults of @code{<dovecot-configuration>} provides sane default values for
-most things, such as group names, data and mail directories, etc.  When used
-as-is, it creates a Dovecot server that and serve and authenticate IMAP
-connections correctly.")))
-
-
-
-(define setenvfmt "Environment variable `~a' set to `~a'.~%")
-(define-public gol
-  (let ((pkg go-1.23))
-    (package
-      (inherit pkg)
-      (name "gol")
-      (arguments
-        (substitute-keyword-arguments (package-arguments pkg)
-          ((#:tests? _) #f)
-          ((#:phases phases)
-           #~(modify-phases #$phases
-               (add-before 'build 'recover-binary-stdlib
-                 (lambda _
-                   (let ((name  "GODEBUG")
-                         (value "installgoroot=all"))
-                     (setenv name value)
-                     (format #t #$setenvfmt name value))))
-               ;; Not all of us work with fancy modern computers that have have
-               ;; too much memory and computing power for programmers to waste.
-               ;; Therefore, Go's default timeout of 10 minutes (!!) to run all
-               ;; tests isn't enough, so we disable it with an huge value and
-               ;; instead inherit the effective timeout from Guix itself.  How not
-               ;; to like software that adheres so well to the Unix philosophy?
-               (add-before 'build 'tolerate-slow-tests
-                 (lambda _
-                   (let ((name  "GO_TEST_TIMEOUT_SCALE")
-                         (value "10"))
-                     (setenv name value)
-                     (format #t #$setenvfmt name value))))
-               (add-after 'install 'install-binaries
-                 (lambda _
-                   (copy-recursively "pkg"
-                                     (string-append #$output "/lib/go/pkg"))))
-               (delete 'strip))))))))
-
-(define-public cgit-pre-configuration
-  (cgit-configuration
-    (nginx '())
-    (source-filter (file-append cgit "/lib/cgit/filters/syntax-highlighting.py"))
-    (about-filter  (file-append cgit "/lib/cgit/filters/about-formatting.sh"))
-    (virtual-root "/git/")
-    (remove-suffix? #t)
-    (nocache? #t)
-    (enable-commit-graph? #t)
-    (enable-follow-links? #t)
-    (enable-index-links? #t)
-    (enable-index-owner? #f)
-    (enable-log-filecount? #t)
-    (enable-log-linecount? #t)
-    (enable-remote-branches? #t)
-    (enable-subject-links? #t)
-    (max-repo-count 0)
-    (snapshots '("tar.gz" "tar.xz"))
-    (root-desc "Patches welcome!")
-    (root-title (string-append (gethostname) " repositories"))
-    (logo    "/git/static/cgit.png")
-    (favicon "/git/static/favicon.ico")
-    (css     "/git/static/cgit.css")
-    (extra-options
-      '("enable-blame=1"
-        "nocache=1"
-        "mimetype.mjs=text/javascript"
-        "readme=:README.md"
-        "readme=:README"))))
-
-(define-public (tld-certbot-configuration tld)
-  (certbot-configuration
-    (email (string-append "root@" tld))
-    (certificates
-      (list
-       (certificate-configuration
-         (domains (list tld))))))) ;; FIXME: SIGHUP nginx/untls
-
-(define-public (openssh-default-configuration authorized-keys)
-  (openssh-configuration
-    (openssh openssh-sans-x)
-    (password-authentication? #f)
-    (authorized-keys authorized-keys)
-    (extra-content "MaxSessions 20
-ClientAliveInterval 30
-ClientAliveCountMax 23
-SetEnv GIT_CONFIG_GLOBAL=/etc/gitconfig")))
-
-
-
-(define-public (dkim-public-key-from path)
-  (if (file-exists? path)
-    (string-join (reverse
-                  (cddr
-                   (reverse
-                    (cdr
-                     (string-split (call-with-input-file
-                                    path
-                                    textual-ports:get-string-all)
-                                   #\newline)))))
-                 "")
-    "stub-public-key-for-building"))
-
-(define-public (build-ipv4-reverse-domain ipv4)
-  (string-append
-   (string-join (reverse
-                 (string-split ipv4
-                               #\.))
-                ".")
-   ".in-addr.arpa"))
-
-(define-public (build-ipv6-reverse-domain ipv6)
-  (string-append
-   (string-join (reverse
-                 (map (lambda (s) (format #f "~a" s))
-                      (string->list
-                       (string-delete #\: ipv6))))
-                ".")
-   ".ip6.arpa"))
-
-(define-public (knot-zones-for tld ipv4 ipv6)
-  (define dkim-selector        "dkimproxyout")
-  (define dkim-public-key-path "/var/lib/dkimproxyout/public.key")
-  (define dkim-name            (string-append dkim-selector "._domainkey"))
-  (let ((tld. (string-append tld "."))
-        (ns1  (format #f "ns1.~a." tld))
-        (ns2  (format #f "ns2.~a." tld))
-        (mail (format #f "hostmaster.~a." tld))
-        (dkim-public-key (dkim-public-key-from dkim-public-key-path))
-        (ipv4-reverse-domain (build-ipv4-reverse-domain ipv4))
-        (ipv6-reverse-domain (build-ipv6-reverse-domain ipv6)))
-    (define-zone-entries tld-zone
-      ("@"         ""   "IN"   "NS"    ns1)
-      ("@"         ""   "IN"   "NS"    ns2)
-      ("ns1"       ""   "IN"   "A"     ipv4)
-      ("ns1"       ""   "IN"   "AAAA"  ipv6)
-      ("ns2"       ""   "IN"   "A"     ipv4)
-      ("ns2"       ""   "IN"   "AAAA"  ipv6)
-      ("@"         ""   "IN"   "A"     ipv4)
-      ("@"         ""   "IN"   "AAAA"  ipv6)
-      ("@"         ""   "IN"   "CAA"   "0 issue \"letsencrypt.org\"")
-      ("@"         ""   "IN"   "CAA"   "0 issuewild \";\"")
-      ("@"         ""   "IN"   "CAA"   "0 iodef \"mailto:eu@euandre.org\"")
-      ("mta-sts"   ""   "IN"   "A"     ipv4)
-      ("mta-sts"   ""   "IN"   "AAAA"  ipv6)
-      ("_mta-sts"  ""   "IN"   "TXT"   "\"v=STSv1; id=20230314\"")
-      ("@"         ""   "IN"   "MX"    (format #f "10 ~a." tld))
-      ("_dmarc"    ""   "IN"   "TXT"   "\"v=DMARC1; p=quarantine\"")
-      ("@"         ""   "IN"   "TXT"   (format #f "\"v=spf1 a:~a -all\"" tld))
-      (dkim-name   ""   "IN"   "TXT"   (format #f "\"v=DKIM1; k=rsa; t=s; p=~a\"" dkim-public-key)))
-    (define-zone-entries ipv4-reverse-domain-zone
-      ("@"         ""   "IN"   "PTR"   tld.)
-      ("@"         ""   "IN"   "NS"    ns1)
-      ("@"         ""   "IN"   "NS"    ns2))
-    (define-zone-entries ipv6-reverse-domain-zone
-      ("@"         ""   "IN"   "PTR"   tld.)
-      ("@"         ""   "IN"   "NS"    ns1)
-      ("@"         ""   "IN"   "NS"    ns2))
-    (list
-     (knot-zone-configuration
-       (domain tld)
-       (semantic-checks? #t)
-       (zone
-         (zone-file
-           (origin tld)
-           (ns ns1)
-           (mail mail)
-           (entries tld-zone))))
-     (knot-zone-configuration
-       (domain ipv4-reverse-domain)
-       (semantic-checks? #t)
-       (zone
-         (zone-file
-           (origin ipv4-reverse-domain)
-           (ns ns1)
-           (mail mail)
-           (entries ipv4-reverse-domain-zone))))
-     (knot-zone-configuration
-       (domain ipv6-reverse-domain)
-       (semantic-checks? #t)
-       (zone
-         (zone-file
-           (origin ipv6-reverse-domain)
-           (ns ns1)
-           (mail mail)
-           (entries ipv6-reverse-domain-zone)))))))
-
-(define-public (knot-zones-configuration tld ipv4 ipv6)
-  (knot-configuration
-    (zones
-      (knot-zones-for tld ipv4 ipv6))))
-
-(define-public sqlitex
-  (package
-    (inherit sqlite-next)
-    (name "sqlitex")
-    (arguments
-      (list
-       #:tests? #f
-       #:configure-flags
-       #~(list
-          "--disable-option-checking"
-          "--disable-shared"
-          "--enable-static"
-          "--disable-editline"
-          "--disable-readline"
-          "--enable-threadsafe"
-          "--disable-dynamic-extensions"
-          "--disable-math"
-          "--disable-fts3"
-          "--disable-fts4"
-          "--enable-fts5"
-          "--disable-rtree"
-          "--disable-debug"
-          "--disable-session"
-          (string-join
-           '("CFLAGS="
-             "-D_POSIX_C_SOURCE=200809L"
-             "-D_XOPEN_SOURCE=700"
-             "-DSQLITE_DEFAULT_FOREIGN_KEYS=1"
-             "-DSQLITE_ENABLE_COLUMN_METADATA"
-             "-DSQLITE_DQS=0"
-             "-DSQLITE_THREADSAFE=1"
-             "-DSQLITE_DEFAULT_MEMSTATUS=0"
-             "-DSQLITE_DEFAULT_SYNCHRONOUS=3"
-             "-DSQLITE_DEFAULT_WAL_SYNCHRONOUS=3"
-             "-DSQLITE_LIKE_DOESNT_MATCH_BLOBS"
-             "-DSQLITE_MAX_EXPR_DEPTH=0"
-             "-DSQLITE_OMIT_DEPRECATED"
-             "-DSQLITE_OMIT_PROGESS_CALLBACK"
-             "-DSQLITE_USE_ALLOCA"
-             "-DSQLITE_STRICT_SUBTYPE=1"
-             "-DSQLITE_OMIT_AUTOMATIC_INDEX"
-             "-DSQLITE_CASE_SENSITIVE_LIKE"
-             "-DSQLITE_OMIT_CASE_SENSITIVE_LIKE_PRAGMA"
-             "-DSQLITE_DIRECT_OVERFLOW_READ"
-             "-DSQLITE_USE_URI"
-             "-DSQLITE_ENABLE_API_ARMOR"
-             "-DSQLITE_ENABLE_QPSG"
-             "-DSQLITE_ENABLE_SNAPSHOT"
-             "-DSQLITE_OMIT_SEH"
-             "-DSQLITE_DISABLE_PAGECACHE_OVERFLOW_STATS"
-             "-DSQLITE_OMIT_CASE_SENSITIVE_LIKE_PRAGMA"
-             "-DSQLITE_OMIT_GET_TABLE"
-             "-DSQLITE_OMIT_TCL_VARIABLE"
-             "-DSQLITE_OMIT_TRACE"
-             "-DSQLITE_OMIT_UTF16"
-             "-g"
-             "-O3"
-             "-march=native"
-             "-std=c99"
-             "-Wvla"
-             "-fPIE"))
-          "LDFLAGS=--static -flto")))
-    (inputs
-      (list))
-    (native-inputs
-      (list
-       editline))
-    (outputs
-      '("out"))))
-
-(define-public scryptkdf
-  (package
-    (inherit scrypt)
-    (name "scryptkdf")
-    (inputs
-      `(("openssl:out"    ,openssl "out")
-        ("openssl:static" ,openssl "static")))
-    (arguments
-      (substitute-keyword-arguments (package-arguments scrypt)
-        ((#:configure-flags flags ''())
-         #~(append
-            #$flags
-            (list
-             "--enable-libscrypt-kdf"
-             "--disable-shared"
-             "--enable-static"
-             (string-join
-              '("CFLAGS="
-                "-D_POSIX_C_SOURCE=200809L"
-                "-D_XOPEN_SOURCE=700"
-                "-g"
-                "-O2"
-                "-march=native"
-                "-std=c99"
-                "-Wvla"
-                "-fPIE"))
-             "LDFLAGS=--static")))))))
-
-
-
-(list
- postfix
- mailutils-sendmail
- rottlog-mailutils-sendmail
- pax-utils
- hunspell-dict-en-utf8
- hunspell-dict-pt-utf8
- hunspell-dict-fr-utf8
- hunspell-dict-eo-utf8
- hunspell-dict-es-utf8
- python-telegram-bot
- gm2
- ffmpegx
- mpvx
- dovecotx
- sqlitex
- scryptkdf
- gol)