diff options
Diffstat (limited to 'src/org')
| -rw-r--r-- | src/org/euandre/packages.scm | 1529 | ||||
| -rw-r--r-- | src/org/euandre/queue.scm | 2011 |
2 files changed, 125 insertions, 3415 deletions
diff --git a/src/org/euandre/packages.scm b/src/org/euandre/packages.scm index d4e7e77..e1adef9 100644 --- a/src/org/euandre/packages.scm +++ b/src/org/euandre/packages.scm @@ -1,1457 +1,178 @@ (define-module (org euandre packages) - #:use-module ((gnu build linux-container) #:prefix container:) + #:use-module ((im papo packages) #:prefix pkgs:) #:use-module ((guix licenses) #:prefix licenses:) - #:use-module ((guix transformations) #:prefix transformations:) - #:use-module ((ice-9 match) #:prefix m:) - #:use-module ((ice-9 textual-ports) #:prefix textual-ports:) - #:use-module ((org euandre queue) #:prefix q:) - #:use-module ((srfi srfi-1) #:prefix s1:) #:use-module (gnu) #:use-module (guix build-system gnu) + #:use-module (guix build-system trivial) #:use-module (guix git-download) - #:use-module (guix least-authority) #:use-module (guix packages) - #:use-module (guix records) #:use-module (guix utils) - #:export (<syskeep-configuration> - syskeep-configuration - make-syskeep-configuration - syskeep-configuration? - syskeep-configuration-package - syskeep-configuration-log-file - - <transactor-configuration> - transactor-configuration - make-transactor-configuration - transactor-configuration? - transactor-configuration-package - transactor-configuration-user - transactor-configuration-group - transactor-configuration-port - transactor-configuration-log-file - transactor-configuration-data-directory - transactor-configuration-run-in-container? - transactor-configuration-container-name - - <git-configuration> - git-configuration - make-git-configuration - git-configuration? - git-configuration-package - git-configuration-user - git-configuration-group - git-configuration-export-all? - git-configuration-base-path - git-configuration-user-path - git-configuration-run-in-container? - git-configuration-container-name - - <binder-configuration> - binder-configuration - make-binder-configuration - binder-configuration? - binder-configuration-name - binder-configuration-package - binder-configuration-user - binder-configuration-group - binder-configuration-log-file - binder-configuration-data-directory - binder-configuration-run-directory - binder-configuration-run-in-container? - binder-configuration-container-name - binder-configuration-options - binder-configuration-listen-socket - binder-configuration-upstream-socket - - <glaze-configuration> - glaze-configuration - make-glaze-configuration - glaze-configuration? - glaze-configuration-name - glaze-configuration-package - glaze-configuration-user - glaze-configuration-group - glaze-configuration-log-file - glaze-configuration-data-directory - glaze-configuration-run-directory - glaze-configuration-run-in-container? - glaze-configuration-container-name - glaze-configuration-options - glaze-configuration-listen-socket - glaze-configuration-upstream-socket - - <hsts-configuration> - hsts-configuration - make-hsts-configuration - hsts-configuration? - hsts-configuration-name - hsts-configuration-package - hsts-configuration-user - hsts-configuration-group - hsts-configuration-log-file - hsts-configuration-data-directory - hsts-configuration-run-directory - hsts-configuration-run-in-container? - hsts-configuration-container-name - hsts-configuration-options - hsts-configuration-listen-socket - hsts-configuration-upstream-socket - - <untls-configuration> - untls-configuration - make-untls-configuration - untls-configuration? - untls-configuration-name - untls-configuration-package - untls-configuration-user - untls-configuration-group - untls-configuration-log-file - untls-configuration-data-directory - untls-configuration-run-directory - untls-configuration-run-in-container? - untls-configuration-container-name - untls-configuration-options - untls-configuration-listen-socket - untls-configuration-upstream-socket - - <wscat-configuration> - wscat-configuration - make-wscat-configuration - wscat-configuration? - wscat-configuration-name - wscat-configuration-package - wscat-configuration-user - wscat-configuration-group - wscat-configuration-log-file - wscat-configuration-data-directory - wscat-configuration-run-directory - wscat-configuration-run-in-container? - wscat-configuration-container-name - wscat-configuration-options - wscat-configuration-listen-socket - wscat-configuration-upstream-socket - - <cicd-configuration> - cicd-configuration - make-cicd-configuration - cicd-configuration? - cicd-configuration-name - cicd-configuration-package - cicd-configuration-user - cicd-configuration-group - cicd-configuration-log-file - cicd-configuration-data-directory - cicd-configuration-run-directory - cicd-configuration-run-in-container? - cicd-configuration-container-name - - <papod-configuration> - papod-configuration - make-papod-configuration - papod-configuration? - papod-configuration-name - papod-configuration-package - papod-configuration-user - papod-configuration-group - papod-configuration-log-file - papod-configuration-data-directory - papod-configuration-run-directory - papod-configuration-run-in-container? - papod-configuration-container-name - papod-configuration-options - papod-configuration-listen-socket - papod-configuration-upstream-socket - - fmt - str - service-type-for)) + #:export ()) (use-package-modules - admin - base - bittorrent - gawk - guile - java - sqlite - texinfo - version-control) -(use-service-modules - admin - mcron - shepherd - sysctl) - + compiler-tools + gcc + video + xml) +(use-service-modules) -(define-public (mklist x) - (if (not x) - '() - (if (pair? x) - x - (list x)))) -(define-public (slurp path) - (call-with-input-file - path - textual-ports:get-string-all)) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Config ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -(define-public (str . rest) - (apply string-append rest)) +(define +working-dir+ + (dirname (dirname (dirname (current-source-directory))))) -(define-public (fmt . rest) - (apply format #f rest)) +(define +tld+ + (string-trim-right + (pkgs:slurp + (pkgs:str +working-dir+ "/tld.txt")))) -(define-public mktorrent-latest - ((transformations:options->transformation - '((with-commit . "mktorrent=de7d011b35458de1472665f50b96c9cf6c303f39"))) - mktorrent)) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;; Package definition functions ;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - -(define-public (pkg name version checksum) +(define (hunspell-dictionary-utf8 dict-name) (package - (name name) - (version version) + (name + (string-append "hunspell-dict-" dict-name "-utf8")) + (version "630b34e6f8f3cbe7aa7b27b6d8ab118e27252fd1") (source (origin (method git-fetch) (uri (git-reference - (url - (str "git://euandre.org/" name)) + (url "https://github.com/wooorm/dictionaries") (commit version))) - (sha256 - (base32 checksum)) (file-name - (git-file-name name version)))) - (build-system gnu-build-system) + (git-file-name "hunspell-dictionary-utf8" version)) + (sha256 + (base32 "1iknwzh5h04m067ddw9hlzc1qqj4mr9mdkcfapsnay304laaiyn5")))) + (build-system trivial-build-system) (arguments - (list - #:strip-binaries? #f - #:make-flags - #~(list - "-e" - (string-append "CC=" #$(cc-for-target)) - (string-append "PREFIX=" #$output) - (string-append "VERSION=" #$version)) - #:phases - #~(modify-phases %standard-phases - (delete 'configure)))) - (synopsis #f) ;; FIXME: get - (description #f) ;; from tarball! - (home-page (str "https://euandre.org/s/" name "/")) - (license licenses:agpl3+))) - - -(define-public eut - (pkg - "eut" - "ec7e36c2eb4a05c188fd222a1a775ef6f55be6b8" - "1knz14jkx8yc7fv5m2apshfsn3xym55vb78wx3kgq061jy58nxfd")) - -(define-public remembering - (pkg - "remembering" - "e1570edd3cdaa040f9664adb315f72e33f8b67c2" - "0y20flrbjh5gbbzl7h3rimg8jwy2ikgkj03yxclj8qg8mq2f9f4a")) + `(#:modules ((guix build utils)) + #:builder + (begin + (use-modules (guix build utils)) + (let ((source-prefix (string-append (assoc-ref %build-inputs "source") + "/dictionaries/" + ,dict-name + "/index")) + (install-prefix (string-append %output "/share/hunspell/"))) + (mkdir-p install-prefix) + (copy-file (string-append source-prefix ".aff") + (string-append install-prefix ,dict-name ".aff")) + (copy-file (string-append source-prefix ".dic") + (string-append install-prefix ,dict-name ".dic")))))) + (synopsis (string-append "Hunspell " dict-name " dictionary in UTF-8")) + (description (string-append "Hunspell " dict-name " dictionary in UTF-8")) + (license licenses:expat) + (home-page "https://github.com/wooorm/dictionaries"))) -(define-public cage - (pkg - "cage" - "c0482531fc16a55715b759b695d27d555d927ab8" - "1v5m7xqfb14y283mlc2kd714hnih1dwcmjcf4i6j52pphjscilys")) -(define-public nicely - (pkg - "nicely" - "8c963ba56495a382480ab96423df22beb19cb592" - "0c9vqjxlh4gjh09pavs5dscgxcnbii7jp1d8v0jhq3qjz9lf3k2w")) -(define-public q - (pkg - "q" - "d13bcb36bc84de95ebb9e8c27605c09b08c35cc5" - "1jbg9f6dwkkcjxbhc3a1pnaas6xgd1f0hiv95h6hchgs88phwssl")) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Inherited packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -(define-public syskeep - (pkg - "syskeep" - "2215cc0999e43b32751bc493f2fe9d2e8c822170" - "0p38fb8m35kjp9fj7bmwcayf9r4638q5fcin18ny7y65scij4jbb")) - -(define-public backupit - (pkg - "backupit" - "331f37ba29b1cb317b9bf1984e0efce40b14c03f" - "1zhwp1widxghjimg838fp7mffrsj97a5w22fy0ydr0pzh3rjzs23")) - -(define-public cicd - (pkg - "cicd" - "63d46fe31f3ae7b7eed1a2c801448160fe9e77d8" - "00brrbm6s45nqpbw2sigcwjwj2dgyl0rvagmgrgj930y9qv2nn31")) - -(define-public guile-heredoc +(define-public gm2 (package - (inherit - (pkg - "guile-heredoc" - "065435cdce609604e33b879b9be3e81ab89f3e7b" - "179qq17mgi4kakhj9w1dk26afljh5yad4j9ih9d8wms70x6h211m")) + (inherit gcc) + (name "gm2") + (arguments + (substitute-keyword-arguments (package-arguments gcc) + ((#:modules modules %default-gnu-modules) + (append '((ice-9 regex)) + modules)) + ((#:configure-flags flags) + #~(append + '("--enable-languages=m2") + (filter (lambda (s) + (not (string-match "--enable-languages.*" s))) + #$flags))))) (native-inputs - (list - guile-3.0 - texinfo)))) - -(define-public adoc - (package - (inherit - (pkg - "adoc" - "fab32a816259c943802ffa4c041ac63ac34e646a" - "04sk5bafw2h969v4fl9qzc67m4sjdlrw87xdliv7rny7v9d53zi8")) - (propagated-inputs - (append - (format-inputs (list eut)) - (normalize-inputs '(ruby-asciidoctor tidy-html)))))) - -(define-public eslaides - (pkg - "eslaides" - "40eb0452fd7689d1c40e4d53c1473fd42195cc49" - "0g4qdcfmk8asi1fzr1yk8khpngg9cg21i14xblxfisqsfaq5jycb")) + (modify-inputs (package-native-inputs gcc) + (append flex))))) -(define-public mkwb +(define-public ffmpegx (package - (inherit - (pkg - "mkwb" - "1c36a265c6b34c28c424eb0bc11ba3b0f9b932d0" - "1w8f3rsncxrb383i7pwg8bxrijvvg7q2l6b0fgjfdv1rs4xzlmqw")) - (propagated-inputs - (format-inputs (list eut adoc eslaides))))) - -(define-public (mkwbsite pkg) - (package - (inherit pkg) - (native-inputs - (append - (format-inputs (list mkwb mktorrent-latest)) - (normalize-inputs '(gnupg jq rsync po4a gettext ghostscript moreutils)))) + (inherit ffmpeg) + (name "ffmpegx") (arguments - (substitute-keyword-arguments (package-arguments pkg) - ((#:phases phases) - #~(modify-phases #$phases - (add-before 'build 'sethome-ghostscript - (lambda _ - (setenv "HOME" (getcwd)))))))))) - -(define-public euandre.org - (mkwbsite - (pkg - "euandre.org" - "6e493d66649925fccaa351f65ee6cac2dedf264f" - "05isnj2mmwg6k1qd94r3yaycy556f5d7br3f2vdmriqazrgj0grg"))) - -(define-public papo.im - (mkwbsite - (pkg - "papo.im" - "fa07fa576e07b4cc6b7c9123bd3a6c91e6afc609" - "084w89v15nmr45nv9av8pz7iq99aw3ggaxr0gzqfjbskb3wvvkml"))) - -(define-public datomic - (let ((p (pkg - "datomic" - "13edba0fa2bd4c3847160809499ce837f52d1264" - "158sqawmbszawa132bhfghzlkhd3b0bicdg5dr93v56vvm4i25kl"))) - (package - (inherit p) - (arguments - (substitute-keyword-arguments (package-arguments p) - ((#:phases phases) - #~(modify-phases #$phases - (add-after 'install 'wrap-program - (lambda* _ - (wrap-program - (string-append #$output "/bin/transactor") - `("PATH" ":" = - (,(string-append #$coreutils "/bin") - ,(string-append #$gawk "/bin") - ,(string-append #$openjdk23 "/bin") - ,(string-append #$sed "/bin") - ,(string-append #$sqlite-next "/bin"))))))))))))) + (substitute-keyword-arguments (package-arguments ffmpeg) + ((#:configure-flags flags) + #~(append + #$flags + '("--enable-libxml2"))))) + (inputs + (modify-inputs (package-inputs ffmpeg) + (append libxml2))))) - - -(define-public (format-inputs l) - (map (lambda (p) - (list (package-name p) - p - "out")) - l)) - -(define-public (normalize-inputs l) - (map (compose (lambda (l) - (cons (package-name (car l)) - l)) - list - specification->package+output - symbol->string) - l)) - -(define-public (gopkgbs name inputs version checksum) - (let ((p (pkg name version checksum))) - (package - (inherit p) - (arguments - (substitute-keyword-arguments (package-arguments p) - ((#:phases phases) - #~(modify-phases #$phases - (add-before 'build 'setenv-golang - (lambda _ - (define (path->flags option) - (let ((search-path (getenv "GOLIBPACKPATH"))) - (string-join - (map (lambda (path) - (string-append option " " path)) - (if search-path - (string-split search-path #\:) - '())) - " "))) - (setenv "GOCFLAGS" (path->flags "-I")) - (setenv "GOLDFLAGS" (path->flags "-L")))))))) - (native-inputs - (append - (format-inputs - (list - eut - q:gol)) - (normalize-inputs - '(gettext - po4a - ruby-asciidoctor)) - inputs)) - (native-search-paths - (list - (search-path-specification - (variable "GOLIBPACKPATH") - (files - (list "lib/go")))))))) - - -(define-public gotext - (gopkgbs - "gotext" - (format-inputs (list)) - "25af4baaab8db74ba809c863e93dd56e6ffb23ed" - "1cwh5fc45dii6mpg4fr6a3fdqy37ib63ax8srfhr9jwzw6majha2")) - -(define-public uuid - (gopkgbs - "uuid" - (format-inputs (list gotext)) - "8cba50466b837d2f4149ca22d6645f6d6127c63a" - "139d8vwd9l6hha2cc5skhh799c5b0n1l0dkp8r8m6nisla8bpals")) - -(define-public gobang - (gopkgbs - "gobang" - (format-inputs (list gotext uuid)) - "79011564903bd53bb036dea4c1f0745e40efb73c" - "1rjnvz2wznkxcdhdf0h6mvza2wj2hpirb4vzjxs49g7mfhsp394h")) - - -(define-public (gopkg name inputs version checksum) - (gopkgbs - name - (append inputs (format-inputs (list gotext uuid gobang))) - version - checksum)) - - -(define-public pds - (gopkg - "pds" - (format-inputs (list)) - "aa855d0dc1c62094d0fbf750f60b5b9f776b47d2" - "0k10pqqz0pmd4w7lq4qnwr96fl3vhi3c0b4f41knwaslr2lv17xl")) - -(define-public urubu - (gopkg - "urubu" - (format-inputs (list)) - "b2351328e54d4793d6691382079a9895dc84696d" - "1aqrg165qsi0pfihjqndjzqrdd4ipjydjm71rzccz34xf7k7m3ch")) - -(define-public stm - (gopkg - "stm" - (format-inputs (list pds)) - "cb89a691031acd7beac798a74d174b572b22319e" - "1ld84nchnbh7g1dcjw2hvzpqwlpa450rs3i3i0x918911264wcv9")) - -(define-public scrypt - (gopkg - "scrypt" - (format-inputs (list q:scryptkdf)) - "6071b32e9a6ab214a18c7ef7ffe59c0d6d68e9ca" - "0iv4lalmrn3hb71wzrgqgji72f4dwklbaphj3h8nj6lr1zpjzvyq")) - -(define-public golite - (gopkg - "golite" - (format-inputs (list q:sqlitex)) - "170dfdf2783c8c2431861f77193c92f40860ea07" - "13y9vzxhr8jn7px2sgfgjapykr258q12ckf458qi0rkcma1vsz59")) - -(define-public fiinha - (gopkg - "fiinha" - (format-inputs (list q:sqlitex golite)) - "24fafda1fe9e962c8e508220c7023dabd5407e4a" - "1h4ig562flpqsxi52h04npj0nm6038chby8nd2lb8vj1nhiq77al")) - -(define-public cracha - (gopkg - "cracha" - (format-inputs (list q:sqlitex golite q:scryptkdf scrypt fiinha)) - "84865499aa10aa42c8b9ac06325a05dd8354f458" - "0hsnw1rng4ccdmgp4vfgn8jnyp05mqs5z7qvw7micia07li73m70")) - -(define-public binder - (gopkg - "binder" - (normalize-inputs '(socat lsof)) - "a45f1e444f6f053635315c8f6fad6ad465f8b0dc" - "0vwmhb76cw499751228jkd6057bj57wkg1jlwal13mm4x0453mjv")) - -(define-public glaze - (gopkg - "glaze" - (format-inputs (list)) - "24e540da26aad0fb6fc6a8845b1cf83757b15dd0" - "0idyds5wh9rzav7n8q64gwhlsjrzh0kgwp98rwq5rkrc08dqv3sb")) - -(define-public hsts - (gopkg - "hsts" - (format-inputs (list)) - "783845f84860968dd5e0f971fea42045c8b8e58c" - "0c17x9mdka213fkkccxff1wld38qhpfr8gs2h3kzg0s8wnnfvn42")) - -(define-public untls - (gopkg - "untls" - (format-inputs (list)) - "b66067d503bac4cfeda83331e045d9c79d8b43c1" - "09pmvaw6rslvasaa6k598aki6c01anfgazzzkcggisdj775wl6in")) - -(define-public wscat - (gopkg - "wscat" - (format-inputs (list)) - "9cc15130935dfaa6b58231ec708a2c71e54c3968" - "1z85p3v40368jyphip067rlx1m1gpmbvh5d4rjvx1lz81ncpsyf8")) - -(define-public gistatic - (gopkg - "gistatic" - (format-inputs (list)) - "1eec478135876b7f325c507d1284aa5782bad09d" - "1hsdqaszkr52cy80yid5i7r7fa4crc7qkpd5mglzbd9v4v2sispy")) - -(define-public chat.papo.im +(define-public mpvx (package - (inherit - (pkg - "chat.papo.im" - "f9c959b2d8e36460395a425a51d480fac635c5ec" - "0h2y0kdfzpsgi64zi7brnj1p0dqz0fx4ksvy57wakr7pvv6rpf64")) - (native-inputs - (normalize-inputs '(node))))) - -(define-public papod - (gopkg - "papod" - (format-inputs - (list stm pds golite q:sqlitex scrypt q:scryptkdf fiinha cracha)) - "3da803b0ff65cf2af71b810ec8fbd28307280d79" - "1ppg1hg9qlkxg7mzsca0j3wdml5773s2x2h8d1j25hk7cg8kqiaj")) - - - -(define-public (user-accounts users) - (map (lambda (user) - (let ((name (s1:first user)) - (comment (s1:second user)) - (groups (s1:third user))) - (user-account - (name name) - (comment comment) - (group "users") - (supplementary-groups groups)))) - users)) - -(define-public (users->keys users) - (let ((users-with-keys (filter (compose not null? cdddr) - users))) - (append - (map (lambda (user) - (let ((name (s1:first user)) - (key (s1:fourth user))) - `(,name ,(plain-file (str name "-id_rsa.pub") - (slurp key))))) - users-with-keys) - `(("git" ,@(map (lambda (user) - (let ((name (s1:first user)) - (key (s1:fourth user))) - (plain-file (str name "-git-id_rsa.pub") - (slurp key)))) - users-with-keys)))))) - -(define (tuple->entry tuple) - (let* ((name (s1:first tuple)) - (package (s1:second tuple)) - (path (str "/etc/" name))) - (list - name - (computed-file - (str "syskeep-" name) - #~(begin - (use-modules - ((ice-9 textual-ports) #:prefix textual-ports:)) - - (define (slurp p) - (call-with-input-file p textual-ports:get-string-all)) - - (define (spit p s) - (call-with-output-file - p - (lambda (port) - (display s port)))) - - (spit #$output - (slurp #$(file-append package path)))))))) - -(define (etc-entries package paths) - (let ((tuples (map (lambda (path) - (list path package)) - paths))) - (map tuple->entry tuples))) - -(define-public (package-set symbols records) - (append - %base-packages - records - (map - (compose list specification->package+output symbol->string) - symbols))) - -(define-public skeletons - (etc-entries - syskeep - '(".profile"))) - -(define-public base-services - (append - (list -#; - (service fail2ban-service-type)) - %base-services)) - -(define-public (activation-gexp name user log-file data-directory run-directory) - #~(begin - (use-modules (guix build utils)) - (when #$log-file - (format (current-error-port) - "Creating ~a log directory for \"~a\".~%" #$name #$log-file) - (mkdir-p (dirname #$log-file)) - (when (not (file-exists? #$log-file)) - (call-with-output-file #$log-file (const #t))) - (chmod #$log-file #o644)) - (let ((user (getpwnam #$user))) - (when #$data-directory - (format (current-error-port) - "Creating ~a data directory \"~a\".~%" #$name #$data-directory) - (mkdir-p #$data-directory) - (chown #$data-directory (passwd:uid user) (passwd:gid user)) - (chmod #$data-directory #o750)) - (when #$run-directory - (format (current-error-port) - "Creating ~a run directory \"~a\".~%" #$name #$run-directory) - (mkdir-p #$run-directory) - (chown #$run-directory (passwd:uid user) (passwd:gid user)) - (chmod #$run-directory #o755))))) - - - -(define-record-type* <syskeep-configuration> - syskeep-configuration - make-syskeep-configuration - syskeep-configuration? - (package syskeep-configuration-package (default syskeep)) - (tld syskeep-configuration-tld (default #f)) - (secrets-user syskeep-configuration-secrets-user (default "secrets-keeper")) - (secrets-group syskeep-configuration-secrets-group (default "secrets-keeper")) - (become-secrets-group syskeep-configuration-become-secrets-group (default "become-secrets-keeper")) - (log-file syskeep-configuration-log-file (default "/var/log/cronjobs/cronjobs.log"))) - -(define (syskeep-profile config) - (match-record config <syskeep-configuration> - (package) - (package-set - '(parted - glibc-locales - guile-heredoc - acl - bind:utils - knot:tools - certbot - jq - file - git - lsof - moreutils - mailutils-sendmail - curl - make - borg - pv - rsync - sqlite - strace - rlwrap - trash-cli - tree) - (list - uuid - backupit - eut - nicely - package)))) - -(define (syskeep-rotations config) - (match-record config <syskeep-configuration> - (log-file) - (list -#; - (log-rotation - (frequency 'weekly) - (files (list log-file)) - (options '("rotate 52")))))) - -(define (syskeep-cronjobs config) - (match-record config <syskeep-configuration> - () - (list - #~(job "0 0 * * *" "cronjob env BORG_REPO=/mnt/backup/borg backupit -q -t cron") - #~(job "0 1 * * *" "cronjob backupit -q -t cron") - #~(job "0 2 * * *" "cronjob reconfigure") - #~(job "0 3 * * 0" "cronjob gc") - #~(job "0 4 * * *" "cronjob guix pull -v3") - #~(job "0 5 * * 0" "cronjob reconfigure") - #~(job "0 5 * * *" "cronjob check")))) - -(define (syskeep-etc-files config) - (match-record config <syskeep-configuration> - (package) - (etc-entries - package - '("rc.sh" - "backupit.txt" - "ssh.conf" - "init.scm" - "gitconfig")))) - -(define (syskeep-accounts config) - (match-record config <syskeep-configuration> - (secrets-user secrets-group become-secrets-group) - (list - (user-account - (name secrets-user) - (group secrets-group) - (system? #t) - (comment "System account used to manage production secrets") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin"))) - (user-group - (name secrets-group) - (system? #t)) - (user-group - (name become-secrets-group) - (system? #t))))) - -(define (syskeep-activation config) - (match-record config <syskeep-configuration> - (tld log-file) - (let ((privkey-path (fmt "../../opt/secrets/root@~a.id_rsa.txt" tld))) - #~(begin - #$(activation-gexp "syskeep" "root" log-file #f #f) - (define (dir target) - (format (current-error-port) - "Creating directory: \"~a\".~%" target) - (mkdir-p target)) - (define (link from to) - (format (current-error-port) - "Symlink: \"~a\" -> \"~a\".~%" to from) - (when (file-exists? to) - (delete-file to)) - (symlink from to)) - (dir "/var/crash") - (chmod "/var/crash" #o777) - (link "mnt/production/opt" "/opt") - (link "mnt/production/srv" "/srv") - (link "../mnt/production/mail" "/var/mail") - (dir "/root/.ssh") - (link #$privkey-path "/root/.ssh/id_rsa") - (link "../../etc/ssh.conf" "/root/.ssh/config") - (link "../../etc/id_rsa.pub" "/root/.ssh/id_rsa.pub") - (link "../../etc/known_hosts" "/root/.ssh/known_hosts"))))) - -(define-public (syskeep-sysctl _config) - '(("kernel/core_pattern" . "/var/crash/core-%t-%e-%p-%s-%u-%g"))) - -(define-public syskeep-sudoers-file - (plain-file "sudoers-syskeep" "\ -root ALL=(ALL) ALL -%wheel ALL= ALL -%wheel ALL= NOPASSWD: /run/current-system/profile/bin/reconfigure, /run/current-system/profile/bin/herd, /run/current-system/profile/bin/repo -%become-secrets-keeper ALL=(secrets-keeper) NOPASSWD: /run/current-system/profile/bin/rsync, /run/current-system/profile/bin/setfacl, /run/current-system/profile/bin/rm -%git ALL=(cicd) NOPASSWD: /run/current-system/profile/bin/cicd -")) - -(define-public syskeep-service-type - (service-type - (name 'syskeep) - (extensions - (list - (service-extension log-rotation-service-type - syskeep-rotations) - (service-extension mcron-service-type - syskeep-cronjobs) - (service-extension etc-service-type - syskeep-etc-files) - (service-extension account-service-type - syskeep-accounts) - (service-extension activation-service-type - syskeep-activation) - (service-extension sysctl-service-type - syskeep-sysctl) - (service-extension profile-service-type - syskeep-profile))) - (default-value (syskeep-configuration)) - (description "Common configuration of maintained servers."))) - - - -(define-record-type* <transactor-configuration> - transactor-configuration - make-transactor-configuration - transactor-configuration? - (package transactor-configuration-package (default datomic)) - (user transactor-configuration-user (default "transactor")) - (group transactor-configuration-group (default "peer")) - (port transactor-configuration-port (default 50200)) - (log-file transactor-configuration-log-file (default "/var/log/transactor/transactor.log")) - (base-directory transactor-configuration-data-directory (default "/var/lib/transactor")) - (run-in-container? transactor-configuration-run-in-container? (default #t)) - (container-name transactor-configuration-container-name (default "datomic-container"))) - -(define-public (transactor-command config) - (match-record config <transactor-configuration> - (package user group base-directory run-in-container? container-name) - (let ((bin (file-append package "/bin/transactor"))) - (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:user user - #:group group - #:directory base-directory - #:name container-name - #:namespaces (s1:fold delq container:%namespaces '(net)) - #:preserved-environment-variables - '() - #:mappings - (list - (file-system-mapping - (source base-directory) - (target source) - (writable? #t)))))))) - -(define-public (transactor-shepherd-services config) - (match-record config <transactor-configuration> - (port user group log-file base-directory) - (list - (shepherd-service - (provision '(transactor)) - (requirement '()) - (start - #~(make-forkexec-constructor - (list #$(transactor-command config) - "-p" (number->string #$port) - (string-append #$base-directory "/data/storage.db")) - #:user #$user - #:group #$group - #:log-file #$log-file - #:directory #$base-directory)) - (stop #~(make-kill-destructor)) - (documentation "Daemon transactor process."))))) - -(define-public (transactor-activation config) - (match-record config <transactor-configuration> - (user log-file base-directory) - #~(begin - (use-modules - (guix build utils)) - (format - (current-error-port) - "Creating Transactor data directories under: \"~a\".~%" - #$base-directory) - (mkdir-p/perms (string-append #$base-directory "/data") - (getpwnam #$user) - #o750) - (mkdir-p/perms (string-append #$base-directory "/backup") - (getpwnam #$user) - #o750) - (format - (current-error-port) - "Creating Transactor log directory for \"~a\".~%" - #$log-file) - (mkdir-p (dirname #$log-file)) - (when (not (file-exists? #$log-file)) - (call-with-output-file #$log-file (const #t))) - (chmod #$log-file #o644)))) - -(define-public (transactor-accounts config) - (match-record config <transactor-configuration> - (user group) - (list - (user-account - (name user) - (group group) - (comment "Datomic transactor system user") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-group - (name group) - (system? #t))))) - -(define (transactor-cronjobs config) - (match-record config <transactor-configuration> - (base-directory) - (let ((from (string-append base-directory "/data/storage.db")) - (to (string-append base-directory "/backup"))) - (list - #~(job "0 23 * * *" (format #f "cronjob datomic backup ~a ~a" #$from #$to)) - #~(job "0 6 * * *" (format #f "cronjob datomic gc ~a" #$from)))))) - -(define-public transactor-service-type - (service-type - (name 'transactor) - (extensions - (list - (service-extension shepherd-root-service-type - transactor-shepherd-services) - (service-extension activation-service-type - transactor-activation) - (service-extension account-service-type - transactor-accounts) - (service-extension mcron-service-type - transactor-cronjobs) - (service-extension profile-service-type - (compose list transactor-configuration-package)))) - (default-value (transactor-configuration)) - (description "Transactor service."))) - - -(define-record-type* <git-configuration> - git-configuration - make-git-configuration - git-configuration? - (package git-configuration-package (default git)) - (user git-configuration-user (default "git")) - (group git-configuration-group (default "git")) - (export-all? git-configuration-export-all? (default #f)) - (base-path git-configuration-base-path (default "/srv/git")) - (user-path git-configuration-user-path (default #f)) - (run-in-container? git-configuration-run-in-container? (default #f)) - (container-name git-configuration-container-name (default "git-container")) - (run-server? git-configuration-run-server? (default #f))) - -(define-public (git-command config) - (match-record config <git-configuration> - (package user group base-path run-in-container? container-name) - (let ((bin (file-append package "/bin/git"))) - (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:user user - #:group group - #:name container-name - #:directory base-path - #:preserved-environment-variables - '() - #:mappings - (list - (file-system-mapping - (source base-path) - (target source) - (writable? #t)))))))) - -(define-public (git-shepherd-services config) - (match-record config <git-configuration> - (user group export-all? base-path user-path run-server?) - (if (not run-server?) - (list) - (list - (shepherd-service - (provision '(git)) - (requirement '(networking)) - (start - #~(make-forkexec-constructor - (list #$(git-command config) - "daemon" "--syslog" "--reuseaddr" - #$@(mklist (and export-all? "--export-all")) - #$@(mklist (and base-path (str "--base-path=" base-path))) - #$@(mklist (and user-path (str "--user-path=" user-path)))) - #:user #$user - #:group #$group)) - (documentation "Daemon process of the git:// protocol.")))))) - -(define-public (git-accounts config) - (match-record config <git-configuration> - (user group base-path) - (list - (user-account - (name user) - (group group) - (system? #t) - (comment "External SSH Git service user") - (home-directory base-path) - (create-home-directory? #f)) - (user-group - (name group) - (system? #t))))) - -(define-public git-service-type - (service-type - (name 'git) - (extensions - (list - (service-extension shepherd-root-service-type - git-shepherd-services) - (service-extension account-service-type - git-accounts) - (service-extension profile-service-type - (compose list git-configuration-package)))) - (default-value (git-configuration)) - (description "Better git:// service."))) - - - -(define-record-type* <binder-configuration> - binder-configuration - make-binder-configuration - binder-configuration? - (name binder-configuration-name (default "binder")) - (package binder-configuration-package (default binder)) - (user binder-configuration-user (default "binder")) - (group binder-configuration-group (default "binder")) - (log-file binder-configuration-log-file (default "/var/log/binder/binder.log")) - (data-directory binder-configuration-data-directory (default #f)) - (run-directory binder-configuration-run-directory (default "/var/run/binder")) - (run-in-container? binder-configuration-run-in-container? (default #t)) - (container-name binder-configuration-container-name (default "binder-container")) - (options binder-configuration-options (default '())) - (listen-socket binder-configuration-listen-socket (default "0.0.0.0:4443")) - (upstream-socket binder-configuration-upstream-socket (default "/var/run/untls/untls.socket"))) - -(define-record-type* <glaze-configuration> - glaze-configuration - make-glaze-configuration - glaze-configuration? - (name glaze-configuration-name (default "glaze")) - (package glaze-configuration-package (default glaze)) - (user glaze-configuration-user (default "glaze")) - (group glaze-configuration-group (default "glaze")) - (log-file glaze-configuration-log-file (default "/var/log/glaze/glaze.log")) - (data-directory glaze-configuration-data-directory (default "/var/lib/glaze")) - (run-directory glaze-configuration-run-directory (default "/var/run/glaze")) - (run-in-container? glaze-configuration-run-in-container? (default #t)) - (container-name glaze-configuration-container-name (default "glaze-container")) - (options glaze-configuration-options (default '())) - (listen-socket glaze-configuration-listen-socket (default "/var/run/glaze/glaze.socket")) - (upstream-socket glaze-configuration-upstream-socket (default #f))) - -(define-record-type* <hsts-configuration> - hsts-configuration - make-hsts-configuration - hsts-configuration? - (name hsts-configuration-name (default "hsts")) - (package hsts-configuration-package (default hsts)) - (user hsts-configuration-user (default "hsts")) - (group hsts-configuration-group (default "hsts")) - (log-file hsts-configuration-log-file (default "/var/log/hsts/hsts.log")) - (data-directory hsts-configuration-data-directory (default #f)) - (run-directory hsts-configuration-run-directory (default "/var/run/hsts")) - (run-in-container? hsts-configuration-run-in-container? (default #t)) - (container-name hsts-configuration-container-name (default "hsts-container")) - (options hsts-configuration-options (default '())) - (listen-socket hsts-configuration-listen-socket (default "/var/run/hsts/hsts.socket")) - (upstream-socket hsts-configuration-upstream-socket (default #f))) - -(define-record-type* <untls-configuration> - untls-configuration - make-untls-configuration - untls-configuration? - (name untls-configuration-name (default "untls")) - (package untls-configuration-package (default untls)) - (user untls-configuration-user (default "untls")) - (group untls-configuration-group (default "untls")) - (log-file untls-configuration-log-file (default "/var/log/untls/untls.log")) - (data-directory untls-configuration-data-directory (default #f)) - (run-directory untls-configuration-run-directory (default "/var/run/untls")) - (run-in-container? untls-configuration-run-in-container? (default #t)) - (container-name untls-configuration-container-name (default "untls-container")) - (options untls-configuration-options (default '())) - (listen-socket untls-configuration-listen-socket (default "/var/run/untls/untls.socket")) - (upstream-socket untls-configuration-upstream-socket (default #f))) - -(define-record-type* <wscat-configuration> - wscat-configuration - make-wscat-configuration - wscat-configuration? - (name wscat-configuration-name (default "wscat")) - (package wscat-configuration-package (default wscat)) - (user wscat-configuration-user (default "wscat")) - (group wscat-configuration-group (default "wscat")) - (log-file wscat-configuration-log-file (default "/var/log/wscat/wscat.log")) - (data-directory wscat-configuration-data-directory (default #f)) - (run-directory wscat-configuration-run-directory (default "/var/run/wscat")) - (run-in-container? wscat-configuration-run-in-container? (default #t)) - (container-name wscat-configuration-container-name (default "wscat-container")) - (options wscat-configuration-options (default '())) - (listen-socket wscat-configuration-listen-socket (default "/var/run/wscat/wscat.socket")) - (upstream-socket wscat-configuration-upstream-socket (default "/var/run/papod/papod.socket"))) - -(define-public (profile-for config-type) - (lambda (config) - (m:match config - (($ config-type _name package) - (list package))))) - -(define-public (rotations-for config-type) - (lambda (config) - (m:match config - (($ config-type _name _package _user _group log-file) - (list -#; - (log-rotation - (frequency 'weekly) - (files (list log-file)) - (options '("rotate 5200")))))))) - -(define-public (activation-for config-type) - (lambda (config) - (m:match config - (($ config-type name _package user _group log-file data-directory - run-directory) - (activation-gexp name user log-file data-directory run-directory))))) - -(define-public (accounts-for config-type) - (lambda (config) - (m:match config - (($ config-type name _package user group) - (list - (user-group - (name group) - (system? #t)) - (user-account - (name user) - (group group) - (system? #t) - (comment (format #f "The user for runtime execution of ~a code" name)) - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")))))))) - -(define-public (cmd-for config-type config) - (m:match config - (($ config-type name package user group _log-file data-directory - _run-directory run-in-container? container-name) - (let ((bin (file-append package (str "/bin/" name)))) - (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:user user - #:group group - #:name container-name - #:directory (or data-directory "/") - #:preserved-environment-variables - '() - #:mappings - (mklist - (and data-directory - (file-system-mapping - (source data-directory) - (target source) - (writable? #t)))))))))) - -(define-public (shepherd-services-for config-type) - (lambda (config) - (m:match config - (($ config-type name _package user group log-file data-directory - _run-directory _run-in-container? _container-name options - listen-socket upstream-socket) - (list - (shepherd-service - (provision (list (string->symbol name))) - (requirement '(networking)) - (auto-start? #f) - (start - #~(make-forkexec-constructor - (list #$(cmd-for config-type config) - #$@options - #$@(mklist listen-socket) - #$@(mklist upstream-socket)) - #:user #$user - #:group #$group - #:log-file #$log-file - #:directory #$data-directory)) - (documentation - (fmt "The Shepherd service that runs the server via \"~a\"." name)))))))) - -(define-public (service-type-for name config-type config extensions) - (service-type - (name name) - (extensions - (append - (list - (service-extension shepherd-root-service-type - (shepherd-services-for config-type)) - (service-extension profile-service-type - (profile-for config-type)) - (service-extension activation-service-type - (activation-for config-type)) - (service-extension account-service-type - (accounts-for config-type)) - (service-extension log-rotation-service-type - (rotations-for config-type))) - extensions)) - (default-value config) - (description - (fmt "The top-level generic system service, generated for ~a code. - -It includes: -- the Shepherd service for starting, stopping and reloading the service; -- activation script for setting up the initial directories and permissions; -- the group and account for running the production service; -- log management (storage and rotation) for logs produced by the running services. - -The default configuration should provide sane values for all of these." - name)))) - -(define-public (without-shepherd-services lst) - (filter (lambda (extension) - (not (eq? shepherd-root-service-type - (service-extension-target extension)))) - lst)) - -(define-public (replacing-shepherd-services service fn) - (service-type - (inherit service) - (extensions - (append - (without-shepherd-services - (service-type-extensions service)) - (list - (service-extension shepherd-root-service-type - fn)))))) - -(define-public (with-services-from-args service config-type args) - (replacing-shepherd-services - service - (lambda (config) - (m:match config - (($ config-type _name _package user group log-file data-directory) - (map (lambda (tuple) - (let ((provision (s1:first tuple)) - (args (s1:second tuple))) - (shepherd-service - (provision provision) - (requirement '(networking)) - (auto-start? #f) - (start - #~(make-forkexec-constructor - (list #$(cmd-for config-type config) - #$@args) - #:user #$user - #:group #$group - #:log-file #$log-file - #:directory #$data-directory))))) - args)))))) - - - -(define-public binder-service-type - (service-type-for 'binder <binder-configuration> (binder-configuration) '())) - -(define-public glaze-service-type - (service-type-for 'glaze <glaze-configuration> (glaze-configuration) '())) - -(define-public hsts-service-type - (service-type-for 'hsts <hsts-configuration> (hsts-configuration) '())) - -(define-public untls-service-type - (service-type-for 'untls <untls-configuration> (untls-configuration) '())) + (inherit mpv) + (name "mpvx") + (propagated-inputs + (modify-inputs (package-propagated-inputs mpv) + (replace "ffmpeg" ffmpegx))))) -(define-public wscat-service-type - (service-type-for 'wscat <wscat-configuration> (wscat-configuration) '())) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Our packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -(define-record-type* <cicd-configuration> - cicd-configuration - make-cicd-configuration - cicd-configuration? - (name cicd-configuration-name (default "cicd")) - (package cicd-configuration-package (default cicd)) - (user cicd-configuration-user (default "cicd")) - (group cicd-configuration-group (default "cicd")) - (log-file cicd-configuration-log-file (default "/var/log/cicd/cicd.log")) - (data-directory cicd-configuration-data-directory (default "/var/lib/cicd")) - (run-directory cicd-configuration-run-directory (default "/var/run/cicd")) - (run-in-container? cicd-configuration-run-in-container? (default #f)) - (container-name cicd-configuration-container-name (default "cicd"))) +(define-public euandre.org + (pkgs:mkwbpkg + +tld+ + "euandre.org" + (list pkgs:eslaides pkgs:eut pkgs:mktorrent pkgs:mkwb pkgs:xadoc) + '(ghostscript gnupg imagemagick lilypond moreutils ruby-asciidoctor + tidy-html) + "7c016c48b6356147c567a9222de45dd50dd8a405" + "18fx5ww67hligr2mfgcvcmn4pdwjnr4qqgkbh306ia7rd2km8yyw" + "" + "")) -(define (cicd-profile config) - (match-record config <cicd-configuration> - (package) - (list - q - package))) +(define-public hunspell-dict-en-utf8 + (hunspell-dictionary-utf8 "en")) -(define (cicd-shepherd-services config) - (match-record config <cicd-configuration> - (user group log-file data-directory) - (list - (shepherd-service - (provision '(cicd)) - (requirement '()) - (auto-start? #f) - (start - #~(make-forkexec-constructor - (list - #$(cmd-for <cicd-configuration> config) - "daemon") - #:user #$user - #:group #$group - #:log-file #$log-file - #:directory #$data-directory)) - (documentation "The background daemon service that powers the CI."))))) +(define-public hunspell-dict-pt-utf8 + (hunspell-dictionary-utf8 "pt")) -(define-public cicd-service-type - (service-type - (name 'cicd) - (extensions - (list - (service-extension shepherd-root-service-type - cicd-shepherd-services) - (service-extension profile-service-type - cicd-profile) - (service-extension activation-service-type - (activation-for <cicd-configuration>)) - (service-extension account-service-type - (accounts-for <cicd-configuration>)) - (service-extension log-rotation-service-type - (rotations-for <cicd-configuration>)))) - (default-value (cicd-configuration)) - (description (fmt "The CI agent service that backs a Git server.")))) +(define-public hunspell-dict-fr-utf8 + (hunspell-dictionary-utf8 "fr")) +(define-public hunspell-dict-eo-utf8 + (hunspell-dictionary-utf8 "eo")) -(define-record-type* <papod-configuration> - papod-configuration - make-papod-configuration - papod-configuration? - (name papod-configuration-name - (default "papod")) - (package papod-configuration-package - (default papod)) - (user papod-configuration-user - (default "papod")) - (group papod-configuration-group - (default "papod")) - (log-file papod-configuration-log-file - (default "/var/log/papod/papod.log")) - (data-directory papod-configuration-data-directory - (default "/var/lib/papod")) - (run-directory papod-configuration-run-directory - (default "/var/run/papod")) - (run-in-container? papod-configuration-run-in-container? - (default #t)) - (container-name papod-configuration-container-name - (default "papod-container")) - (options papod-configuration-options - (default '())) - (listen-socket papod-configuration-listen-socket - (default "/var/run/papod/papod.socket")) - (upstream-socket papod-configuration-upstream-socket - (default #f))) +(define-public hunspell-dict-es-utf8 + (hunspell-dictionary-utf8 "es")) +(define-public hunspell-dict-de-utf8 + (hunspell-dictionary-utf8 "de")) -#; -(define-public papod-service-type - (pkg:service-type-for 'papod - <papod-configuration> - (papod-configuration) - '())) +(define-public hunspell-dict-it-utf8 + (hunspell-dictionary-utf8 "it")) (list - mktorrent-latest - remembering - eut - cage - backupit - nicely - syskeep - q - cicd - guile-heredoc - adoc - eslaides - mkwb + gm2 + ffmpegx + mpvx euandre.org - - datomic - - gotext - uuid - gobang - pds - stm - golite - binder - glaze - hsts - untls - wscat - gistatic - urubu - fiinha - cracha - - papo.im - chat.papo.im - papod) + hunspell-dict-en-utf8 + hunspell-dict-pt-utf8 + hunspell-dict-fr-utf8 + hunspell-dict-eo-utf8 + hunspell-dict-es-utf8 + hunspell-dict-de-utf8 + hunspell-dict-it-utf8) diff --git a/src/org/euandre/queue.scm b/src/org/euandre/queue.scm deleted file mode 100644 index 16c9b1a..0000000 --- a/src/org/euandre/queue.scm +++ /dev/null @@ -1,2011 +0,0 @@ -(define-module (org euandre queue) - #:use-module ((ice-9 textual-ports) #:prefix textual-ports:) - #:use-module ((gnu build linux-container) #:prefix container:) - #:use-module ((guix licenses) #:prefix license:) - #:use-module ((srfi srfi-1) #:prefix s1:) - #:use-module (guix build-system meson) - #:use-module (guix build-system gnu) - #:use-module (guix build-system python) - #:use-module (guix build-system trivial) - #:use-module (guix download) - #:use-module (guix git-download) - #:use-module (guix least-authority) - #:use-module (guix packages) - #:use-module (guix records) - #:use-module (guix utils) - #:use-module (gnu) - #:use-module (gnu system privilege) - #:export (<shadow-group-configuration> - shadow-group-configuration - make-shadow-group-configuration - shadow-group-configuration? - shadow-group-configuration-group - - shadow-group-activation - shadow-group-accounts - shadow-group-service-type - - - <cyrus-service-configuration> - cyrus-service-configuration - make-cyrus-service-configuration - cyrus-service-configuration? - cyrus-service-configuration-name - cyrus-service-configuration-authmech - cyrus-service-configuration-log-level - cyrus-service-configuration-raw-file - - <cyrus-sasl-configuration> - cyrus-sasl-configuration - make-cyrus-sasl-configuration - cyrus-sasl-configuration? - cyrus-sasl-configuration-package - cyrus-sasl-configuration-user - cyrus-sasl-configuration-group - cyrus-sasl-configuration-supplementary-groups - cyrus-sasl-configuration-authmech - cyrus-sasl-configuration-services - cyrus-sasl-configuration-config-dirname - cyrus-sasl-configuration-run-directory - cyrus-sasl-configuration-run-in-container? - cyrus-sasl-configuration-container-name - cyrus-sasl-configuration-container-namespaces - - cyrus-sasl-etc-files - cyrus-sasl-activation - cyrus-sasl-accounts - cyrus-sasl-shepherd-service - cyrus-sasl-service-type - - - <dkimproxyout-configuration> - dkimproxyout-configuration - make-dkimproxyout-configuration - dkimproxyout-configuration? - dkimproxyout-configuration-package - dkimproxyout-configuration-user - dkimproxyout-configuration-group - dkimproxyout-configuration-supplementary-groups - dkimproxyout-configuration-config-name - dkimproxyout-configuration-config-extra - dkimproxyout-configuration-raw-file - dkimproxyout-configuration-listen - dkimproxyout-configuration-relay - dkimproxyout-configuration-domains - dkimproxyout-configuration-selector - dkimproxyout-configuration-key-size - dkimproxyout-configuration-data-directory - dkimproxyout-configuration-run-in-container? - dkimproxyout-configuration-container-name - dkimproxyout-configuration-container-namespaces - - dkimproxyout-etc-files - dkimproxyout-accounts - dkimproxyout-activation - dkimproxyout-shepherd-service - dkimproxyout-service-type - - - <postfix-configuration> - postfix-configuration - make-postfix-configuration - postfix-configuration? - - postfix-configuration-postfix - postfix-configuration-enable-submission? - postfix-configuration-set-sendmail? - postfix-configuration-master.cf-file - postfix-configuration-main.cf-file - postfix-configuration-master.cf-extra - postfix-configuration-main.cf-extra - postfix-configuration-config-dirname - postfix-configuration-mail-directory - postfix-configuration-data-directory - postfix-configuration-queue-directory - postfix-configuration-user - postfix-configuration-group - postfix-configuration-setgid-group - postfix-configuration-root-aliases - postfix-configuration-cert-file - postfix-configuration-key-file - postfix-configuration-hostname - postfix-configuration-run-in-container? - postfix-configuration-container-name - postfix-configuration-container-namespaces - - postfix-aliases - postfix-accounts - postfix-activation - postfix-etc-files - postfix-privileged-programs - postfix-shepherd-service - local-postfix-service-type - internet-postfix-service-type - - - <dovecot-configuration> - dovecot-configuration - make-dovecot-configuration - dovecot-configuration? - - dovecot-configuration-package - dovecot-configuration-mail-location - dovecot-configuration-raw-file - dovecot-configuration-extra-content - dovecot-configuration-config-dirname - dovecot-configuration-config-filename - dovecot-configuration-user - dovecot-configuration-group - dovecot-configuration-supplementary-groups - dovecot-configuration-auth-worker-group - dovecot-configuration-untrusted-user - dovecot-configuration-untrusted-group - dovecot-configuration-untrusted-supplementary-groups - dovecot-configuration-base-dir - dovecot-configuration-state-dir - dovecot-configuration-hostname - dovecot-configuration-run-in-container? - dovecot-configuration-container-name - dovecot-configuration-container-namespaces - - dovecot-etc-files - dovecot-accounts - dovecot-activation - dovecot-shepherd-service - dovecot-service-type)) -(use-package-modules - admin - check - crypto - cyrus-sasl - dbm - flex - gcc - golang - libedit - m4 - mail - onc-rpc - perl - python-build - python-crypto - python-web - python-xyz - sqlite - ssh - time - tls - version-control - video - xml) -(use-service-modules - certbot - cgit - dns - mail - shepherd - ssh - web) - - - -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;;;; finished packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - - - -(define-public postfix - (package - (name "postfix") - (version "3.8-20221023") - (source - (origin - (method url-fetch) - (uri - (string-append - "http://cdn.postfix.johnriley.me/mirrors/postfix-release/experimental/postfix-" - version - ".tar.gz")) - (sha256 - (base32 "0aaylhn81n9z3kidx53kzf2jrilr3lgwfxsk1r4hn7nkrp62bcwm")))) - (build-system gnu-build-system) - (arguments - (list - #:tests? #f - #:modules `((srfi srfi-26) - ,@%default-gnu-imported-modules) - #:phases - #~(modify-phases %standard-phases - (add-before 'configure 'patch-/bin/sh - (lambda _ - (substitute* (find-files "." "^Makefile") - (("/bin/sh") - (which "sh"))))) - (add-before 'configure 'patch-bdb-include - (lambda* (#:key inputs #:allow-other-keys) - (substitute* "makedefs" - (("/usr/include") - (string-append (assoc-ref inputs "bdb") - "/include"))))) - (add-before 'configure 'dont-hardcode-PATH - (lambda _ - (substitute* '("postfix-install" - "conf/post-install") - (("^PATH=") - "# PATH=")))) - (add-before 'configure 'fix-strict-PATH - (lambda _ - (substitute* "src/util/sys_defs.h" - (("^#define (ROOT_PATH|_PATH_DEFPATH|_PATH_STDPATH).*") - "#define ROOT_PATH \"/run/setuid-programs:/run/current-system/profile/bin:/run/current-system/profile/sbin\"\n")))) - (add-before 'configure 'use-relative-symlink-to-store - (lambda _ - (substitute* "postfix-install" - (("ln -sf") - "ln -rsf")))) - (add-before 'configure 'fix-absolute-path-to-setuid-programs - (lambda _ - (substitute* "conf/postfix-script" - (("\\$command_directory/postqueue") - "/run/setuid-programs/postqueue") - (("\\$command_directory/postdrop") - "/run/setuid-programs/postdrop")))) - (add-before 'configure 'disable-warning-on-non-writable-config-files - (lambda _ - (substitute* "conf/postfix-script" - (("find \\$todo \\\\\\( -perm -020 -o -perm -002 \\\\\\) \\\\\n") - " # find $todo \\( -perm -020 -o -perm -002 \\)")))) - (add-before 'configure 'disable-write-to-/etc/postfix - (lambda _ - (substitute* "src/postconf/postconf_edit.c" - (("pcf_set_config_dir.*") - "return;")))) - (add-before 'configure 'setup-environment - (lambda* (#:key outputs inputs #:allow-other-keys) - (setenv "CCARGS" - (string-join (list - "-DNO_NIS" - "-DUSE_TLS" - "-DUSE_SASL_AUTH" - "-DUSE_CYRUS_SASL" - "-I" - (string-append - (assoc-ref inputs "cyrus-sasl") "/include/sasl")) - " ")) - (setenv "AUXLIBS" "-lnsl -lcrypto -lssl -lsasl2") - (let* ((out (assoc-ref outputs "out")) - (bin (string-append out "/bin")) - (sbin (string-append out "/sbin")) - (lib (string-append out "/lib/postfix")) - (libexec (string-append out "/libexec/postfix")) - (etc (string-append out "/etc/postfix")) - (man (string-append out "/share/man")) - (doc (string-append out "/share/doc/postfix-" #$version)) - (html (string-append doc "/html"))) - (setenv "install_root" "wip-prefix") - (setenv "newaliases_path" (string-append bin "/newaliases")) - (setenv "mailq_path" (string-append bin "/mailq")) - (setenv "sendmail_path" (string-append sbin "/sendmail")) - (setenv "command_directory" sbin) - (setenv "shlib_directory" lib) - (setenv "daemon_directory" libexec) - (setenv "meta_directory" etc) - (setenv "sample_directory" etc) - (setenv "manpage_directory" man) - (setenv "readme_directory" doc) - (setenv "html_directory" html) - (setenv "sample_directory" (string-append out "/share/postfix"))))) - (replace 'configure - (lambda _ - (invoke "make" "makefiles" - "pie=yes" - "dynamicmaps=yes"))) - (replace 'install - (lambda* (#:key outputs #:allow-other-keys) - (let ((out (assoc-ref outputs "out"))) - (invoke "make" "non-interactive-package") - (delete-file-recursively "wip-prefix/var") - (copy-recursively "wip-prefix/etc" (string-append out "/etc")) - (copy-recursively (string-append "wip-prefix" out) out))))))) - (inputs - (list bdb - cyrus-sasl - libnsl - openssl - perl)) - (native-inputs - (list m4)) - (home-page "https://www.postfix.org") - (synopsis "sendmail compatible MTA") - (description - "Postfix is Wietse Venema's mail server that started life at IBM research -as an alternative to the widely-used Sendmail program. Now at Google, Wietse -continues to support Postfix. - -Postfix attempts to be fast, easy to administer, and secure. The outside has a -definite Sendmail-ish flavor, but the inside is completely different.") - (license (list license:ibmpl1.0 - license:epl2.0)))) - -(define-public mailutils-sendmail - (package - (inherit mailutils) - (name "mailutils-sendmail") - (arguments - (substitute-keyword-arguments (package-arguments mailutils) - ((#:tests? _ #f) #f) - ((#:configure-flags flags) - #~(append '("CFLAGS=-DPATH_SENDMAIL=\\\"/run/setuid-programs/sendmail\\\"") #$flags)))))) - -(define-public rottlog-mailutils-sendmail - (package - (inherit rottlog) - (name "rottlog-mailutils-sendmail") - (inputs - (list coreutils - mailutils-sendmail)))) - - - -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; WIP packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - - - -(define-public pax-utils - (package - (name "pax-utils") - (version "1.3.7") - (source - (origin - (method url-fetch) - (uri - (string-append - "https://distfiles.gentoo.org/distfiles/pax-utils-" - version - ".tar.xz")) - (sha256 - (base32 "16lkrvgffprwnd8w3bbiph6zq72cbaqn7p6an3vmrlk8jv9650qh")))) - (build-system meson-build-system) - (synopsis "ELF utils that can check files for security relevant properties") - (description - "A suite of ELF tools to aid auditing systems. Contains various ELF -related utils for ELF32, ELF64 binaries useful for displaying PaX and security -information on a large group of binary files.") - (home-page "https://distfiles.gentoo.org/distfiles/pax-utils-1.3.7.tar.xz") - (license license:gpl2))) - -(define (hunspell-dictionary-utf8 dict-name) - (package - (name (string-append "hunspell-dict-" dict-name "-utf8")) - (version "630b34e6f8f3cbe7aa7b27b6d8ab118e27252fd1") - (source - (origin - (method git-fetch) - (uri - (git-reference - (url "https://github.com/wooorm/dictionaries") - (commit version))) - (file-name - (git-file-name "hunspell-dictionary-utf8" version)) - (sha256 - (base32 "1iknwzh5h04m067ddw9hlzc1qqj4mr9mdkcfapsnay304laaiyn5")))) - (build-system trivial-build-system) - (arguments - `(#:modules ((guix build utils)) - #:builder - (begin - (use-modules (guix build utils)) - (let ((source-prefix (string-append (assoc-ref %build-inputs "source") - "/dictionaries/" - ,dict-name - "/index")) - (install-prefix (string-append %output "/share/hunspell/"))) - (mkdir-p install-prefix) - (copy-file (string-append source-prefix ".aff") - (string-append install-prefix ,dict-name ".aff")) - (copy-file (string-append source-prefix ".dic") - (string-append install-prefix ,dict-name ".dic")))))) - (synopsis (string-append "Hunspell " dict-name " dictionary in UTF-8")) - (description (string-append "Hunspell " dict-name " dictionary in UTF-8")) - (license license:expat) - (home-page "https://github.com/wooorm/dictionaries"))) - -(define-public hunspell-dict-en-utf8 (hunspell-dictionary-utf8 "en")) -(define-public hunspell-dict-pt-utf8 (hunspell-dictionary-utf8 "pt")) -(define-public hunspell-dict-fr-utf8 (hunspell-dictionary-utf8 "fr")) -(define-public hunspell-dict-eo-utf8 (hunspell-dictionary-utf8 "eo")) -(define-public hunspell-dict-es-utf8 (hunspell-dictionary-utf8 "es")) - -(define python-pytest-tornado5 - (package - (name "python-pytest-tornado5") - (version "2.0.0") - (source - (origin - (method url-fetch) - (uri - (pypi-uri "pytest-tornado5" version)) - (sha256 - (base32 "0qb62jw2w0xr6y942yp0qxiy755bismjfpnxaxjjm05gy2pymr8d")))) - (build-system python-build-system) - (arguments - (list - #:tests? #f)) - (propagated-inputs (list python-pytest python-tornado)) - (home-page "https://github.com/vidartf/pytest-tornado") - (synopsis - "A py.test plugin providing fixtures and markers to simplify testing of asynchronous tornado applications.") - (description - "This package provides a py.test plugin providing fixtures and markers to -simplify testing of asynchronous tornado applications.") - (license license:asl2.0))) - -(define python-ordereddict - (package - (name "python-ordereddict") - (version "1.1") - (source - (origin - (method url-fetch) - (uri - (pypi-uri "ordereddict" version)) - (sha256 - (base32 "07qvy11nvgxpzarrni3wrww3vpc9yafgi2bch4j2vvvc42nb8d8w")))) - (build-system python-build-system) - (arguments - `(#:tests? #f - #:phases - (modify-phases %standard-phases - (delete 'sanity-check)))) - (home-page "UNKNOWN") - (synopsis - "A drop-in substitute for Py2.7's new collections.OrderedDict that works in Python 2.4-2.6.") - (description "This package provides a drop-in substitute for Py2.7's new -collections.OrderedDict that works in Python 2.4-2.6.") - (license #f))) - -(define python-funcsigs - (package - (name "python-funcsigs") - (version "1.0.2") - (source - (origin - (method url-fetch) - (uri - (pypi-uri "funcsigs" version)) - (sha256 - (base32 "0l4g5818ffyfmfs1a924811azhjj8ax9xd1cffr1mzd3ycn0zfx7")))) - (build-system python-build-system) - (arguments - `(#:tests? #f)) - (propagated-inputs - (list python-ordereddict)) -#; - (native-inputs - (list python-unittest2)) - (home-page "http://funcsigs.readthedocs.org") - (synopsis - "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+") - (description - "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+") - (license #f))) - -(define python-apscheduler - (package - (name "python-apscheduler") - (version "3.9.1") - (source - (origin - (method url-fetch) - (uri - (pypi-uri "APScheduler" version)) - (sha256 - (base32 "1qzi1pr7q72vs49p7vr1mp350zaggs52lpq43lvqsjcmcd5mgrk5")))) - (build-system python-build-system) - (arguments - `(#:tests? #f)) - (propagated-inputs - (list python-funcsigs - ; python-futures - python-pytz - python-six - python-tzlocal)) - (native-inputs - (list python-mock - python-pytest - python-pytest-asyncio - python-pytest-cov - python-pytest-tornado5 - python-setuptools - python-setuptools-scm)) - (home-page "https://github.com/agronholm/apscheduler") - (synopsis "In-process task scheduler with Cron-like capabilities") - (description "In-process task scheduler with Cron-like capabilities") - (license license:expat))) - -(define-public python-telegram-bot - (package - (name "python-telegram-bot") - (version "13.12") - (source - (origin - (method url-fetch) - (uri - (pypi-uri "python-telegram-bot" version)) - (sha256 - (base32 "1rbdyr1f9mndlh83in47k8if65yp9n1dy4px2wipbf0qyjv5zxfs")))) - (build-system python-build-system) - (arguments - (list - #:tests? #f - #:phases - #~(modify-phases %standard-phases - (delete 'sanity-check)))) - (native-inputs - (list python-apscheduler)) - (propagated-inputs - (list python-apscheduler - python-cachetools - python-certifi - python-pytz - python-tornado-6)) - (home-page "https://python-telegram-bot.org/") - (synopsis "Python library to interface with the Telegram Bot API") - (description "We have made you a wrapper you can't refuse") - (license #f))) - -(define-public gm2 - (package - (inherit gcc-14) - (name "gm2") - (arguments - (substitute-keyword-arguments (package-arguments gcc-14) - ((#:modules modules %default-gnu-modules) - (append '((ice-9 regex)) modules)) - ((#:configure-flags flags) - #~(append - (list - "--enable-languages=m2") - (filter (lambda (s) - (not (string-match "--enable-languages.*" s))) - #$flags))))) - (native-inputs - (modify-inputs (package-native-inputs gcc-14) - (append flex))))) - -(define-public ffmpegx - (package - (inherit ffmpeg) - (name "ffmpegx") - (arguments - (substitute-keyword-arguments (package-arguments ffmpeg) - ((#:configure-flags flags) - #~(append - #$flags - '("--enable-libxml2"))))) - (inputs - (modify-inputs (package-inputs ffmpeg) - (append libxml2))))) - -(define-public mpvx - (package - (inherit mpv) - (name "mpvx") - (propagated-inputs - (modify-inputs (package-propagated-inputs mpv) - (replace "ffmpeg" ffmpegx))))) - -(define-public dovecotx - (package - (inherit dovecot) - (name "dovecotx") - (arguments - (substitute-keyword-arguments (package-arguments dovecot) - ((#:tests? _ #f) #f) - ((#:configure-flags flags) - #~(filter (lambda (flag) - (not (string=? flag "--with-moduledir=/usr/lib/dovecot"))) - #$flags)))))) - - - -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;; finished services ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - - - -(define-record-type* <shadow-group-configuration> - shadow-group-configuration - make-shadow-group-configuration - shadow-group-configuration? - (group shadow-group-configuration-group (default "etc-shadow"))) - -(define (shadow-group-activation config) - (match-record config <shadow-group-configuration> - (group) - #~(begin - (use-modules (guix build utils)) - (format (current-error-port) - "Setting ownership and permission for \"/etc/shadow\".~%") - (chown "/etc/shadow" - (passwd:uid (getpwnam "root")) - (group:gid (getgrnam #$group))) - (chmod "/etc/shadow" #o640)))) - -(define (shadow-group-accounts config) - (match-record config <shadow-group-configuration> - (group) - (list - (user-group - (name group) - (system? #t))))) - -(define shadow-group-service-type - (service-type - (name 'shadow-group) - (extensions - (list - (service-extension activation-service-type - shadow-group-activation) - (service-extension account-service-type - shadow-group-accounts))) - (default-value (shadow-group-configuration)) - (description "Provide the infrastructure to allow access to the -@file{/etc/shadow} file without requiring superuser privileges, by: - -@itemize -@item adding a dedicated group to the system (default: @code{etc-shadow}); -@item granting said group @emph{read-only access} to the @file{/etc/shadow} -file. -@end itemize - -The goal is to allow unprivileged processes to perform password authentication -against the @file{/etc/passwd} database, by adding the @code{etc-shadow} group -to the list of supplementary groups of the user of such running process."))) - - -(define-record-type* <cyrus-service-configuration> - cyrus-service-configuration - make-cyrus-service-configuration - cyrus-service-configuration? - (name cyrus-service-configuration-name) - (authmech cyrus-service-configuration-authmech (default "saslauthd")) - (log-level cyrus-service-configuration-log-level (default 7)) - (raw-file cyrus-service-configuration-raw-file (default #f))) - -(define-record-type* <cyrus-sasl-configuration> - cyrus-sasl-configuration - make-cyrus-sasl-configuration - cyrus-sasl-configuration? - (package cyrus-sasl-configuration-package (default cyrus-sasl)) - (user cyrus-sasl-configuration-user (default "cyrus-sasl")) - (group cyrus-sasl-configuration-group (default "cyrus-sasl")) - (supplementary-groups cyrus-sasl-configuration-supplementary-groups (default '("etc-shadow"))) - (authmech cyrus-sasl-configuration-authmech (default "shadow")) - (services cyrus-sasl-configuration-services (default '())) - (config-dirname cyrus-sasl-configuration-config-dirname (default "sasl2")) - (run-directory cyrus-sasl-configuration-run-directory (default "/var/run/saslauthd")) - (run-in-container? cyrus-sasl-configuration-run-in-container? (default #t)) - (container-name cyrus-sasl-configuration-container-name (default "saslauthd")) - (container-namespaces cyrus-sasl-configuration-container-namespaces (default container:%namespaces))) - -(define (cyrus-sasl-etc-files config) - (match-record config <cyrus-sasl-configuration> - (services config-dirname run-directory) - `((,config-dirname - ,(file-union - config-dirname - (map (lambda (service-config) - (match-record service-config <cyrus-service-configuration> - (name authmech log-level raw-file) - `(,name ,(plain-file - name - (or raw-file - (format #f - "pwcheck_method: ~a~%saslauthd_path: ~a/mux~%log_level: ~a~%" - authmech - run-directory - log-level)))))) - services)))))) - -(define (cyrus-sasl-activation config) - (match-record config <cyrus-sasl-configuration> - (user run-directory) - #~(begin - (use-modules (guix build utils)) - (format (current-error-port) - "Creating Cyrus SASL socket directory: \"~a\".~%" #$run-directory) - (mkdir-p/perms #$run-directory (getpwnam #$user) #o755)))) - -(define (cyrus-sasl-accounts config) - (match-record config <cyrus-sasl-configuration> - (user group supplementary-groups) - (list - (user-account - (name user) - (group group) - (supplementary-groups supplementary-groups) - (comment "Cyrus SASL system user") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-group - (name group) - (system? #t))))) - -(define (cyrus-sasl-shepherd-service config) - (match-record config <cyrus-sasl-configuration> - (package user group supplementary-groups authmech config-dirname run-directory - services run-in-container? container-name container-namespaces) - (let* ((bin (file-append package "/sbin/saslauthd")) - (cmd (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:name container-name - #:namespaces container-namespaces - #:mappings (list - (file-system-mapping - (source run-directory) - (target source) - (writable? #t)) - (file-system-mapping - (source "/etc/passwd") - (target source)) - (file-system-mapping - (source "/etc/shadow") - (target source))))))) - (list - (shepherd-service - (provision '(cyrus-sasl)) - (documentation "Run the saslauthd daemon of Cyrus SASL.") - (start #~(make-forkexec-constructor - (list #$cmd "-a" #$authmech "-d" "-m" #$run-directory) - #:user #$user - #:group #$group - #:supplementary-groups '(#$@supplementary-groups))) - (stop #~(make-kill-destructor)) - (actions - (list - (shepherd-action - (name 'configuration) - (documentation "Display the name of all registered configuration files.") - (procedure - (let ((names (map cyrus-service-configuration-name services))) - #~(lambda _ - (for-each (lambda (name) - (format #t "/etc/~a/~a~%" #$config-dirname name)) - '#$names)))))))))))) - -(define cyrus-sasl-service-type - (service-type - (name 'cyrus-sasl) - (extensions - (list - (service-extension etc-service-type - cyrus-sasl-etc-files) - (service-extension activation-service-type - cyrus-sasl-activation) - (service-extension profile-service-type - (compose list cyrus-sasl-configuration-package)) - (service-extension account-service-type - cyrus-sasl-accounts) - (service-extension shepherd-root-service-type - cyrus-sasl-shepherd-service))) - (compose s1:concatenate) - (extend (lambda (config services) - (cyrus-sasl-configuration - (inherit config) - (services - (append - (cyrus-sasl-configuration-services config) - services))))) - (default-value (cyrus-sasl-configuration)) - (description "Run the @code{saslauthd} daemon from the Cyrus SASL package. - -Services can extend @code{cyrus-sasl-service-type}, and provide their own list -of @code{cyrus-service-configuration} entries to be registered in this service. - -For the @code{saslauthd} daemon to be able to authenticate using the \"shadow\" -@code{authmech}, it needs read access to the @file{/etc/shadow} file. This is -accomplished by default by adding the @code{etc-shadow} group to the list of -supplementary groups of the running daemon, and by enabling the -@code{shadow-group-service-type} service. - -By default, the daemon runs in a container."))) - - -(define-record-type* <dkimproxyout-configuration> - dkimproxyout-configuration - make-dkimproxyout-configuration - dkimproxyout-configuration? - (package dkimproxyout-configuration-package (default dkimproxy)) - (user dkimproxyout-configuration-user (default "dkimproxyout")) - (group dkimproxyout-configuration-group (default "dkimproxyout")) - (supplementary-groups dkimproxyout-configuration-supplementary-groups (default '())) - (config-name dkimproxyout-configuration-config-name (default "dkimproxyout.conf")) - (config-extra dkimproxyout-configuration-config-extra (default "")) - (raw-file dkimproxyout-configuration-raw-file (default #f)) - (listen dkimproxyout-configuration-listen (default "127.0.0.1:10027")) - (relay dkimproxyout-configuration-relay (default "127.0.0.1:10028")) - (domains dkimproxyout-configuration-domains (default (list (gethostname)))) - (selector dkimproxyout-configuration-selector (default "dkimproxyout")) - (key-size dkimproxyout-configuration-key-size (default 2048)) - (data-directory dkimproxyout-configuration-data-directory (default "/var/lib/dkimproxyout")) - (run-in-container? dkimproxyout-configuration-run-in-container? (default #t)) - (container-name dkimproxyout-configuration-container-name (default "dkimproxyout")) - (container-namespaces dkimproxyout-configuration-container-namespaces (default (s1:fold delq container:%namespaces '(net))))) - -(define (generate-out.cf config) - (match-record config <dkimproxyout-configuration> - (config-extra listen relay domains selector data-directory) - (format #f - "listen ~a -relay ~a - -domain ~a -selector ~a - -signature dkim(c=relaxed/relaxed,a=rsa-sha256) - -keyfile ~a/private.key -~a" - listen - relay - (string-join domains ",") - selector - data-directory - config-extra))) - -(define (dkimproxyout-etc-files config) - (match-record config <dkimproxyout-configuration> - (config-name raw-file) - `((,config-name ,(plain-file config-name - (or raw-file - (generate-out.cf config))))))) - -(define (dkimproxyout-accounts config) - (match-record config <dkimproxyout-configuration> - (user group supplementary-groups) - (list - (user-account - (name user) - (group group) - (supplementary-groups supplementary-groups) - (comment "DKIMproxy.out signing system user") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-group - (name group) - (system? #t))))) - -(define (dkimproxyout-activation config) - (match-record config <dkimproxyout-configuration> - (user data-directory key-size) - #~(begin - (use-modules (guix build utils)) - (let* ((user (getpwnam #$user)) - (uid (passwd:uid user)) - (gid (passwd:gid user)) - (private-key (string-append #$data-directory "/private.key")) - (public-key (string-append #$data-directory "/public.key"))) - (format (current-error-port) - "Creating DKIMproxy.out data directory: \"~a\".~%" #$data-directory) - (mkdir-p/perms #$data-directory user #o755) - (unless (file-exists? private-key) - (format (current-error-port) - "The public/private keypair doesn't exist yet. Generating one...~%") - (cond - ((zero? (system* #$(file-append openssl "/bin/openssl") - "genrsa" - "-out" - private-key - (number->string #$key-size))) - (format (current-error-port) - "DKIMproxy.out private key file created: \"~a\".~%" private-key) - (invoke #$(file-append openssl "/bin/openssl") - "rsa" - "-in" - private-key - "-pubout" - "-out" - public-key) - (format (current-error-port) - "Setting permissions for the public/private DKIMproxy.out keypair: \"~a/{public,private}.key\".~%" #$data-directory) - (chown private-key uid gid) - (chown public-key uid gid) - (chmod private-key #o400) - (chmod public-key #o644)) - (else - (format (current-error-port) - "ERROR: failed to create DKIMproxy.out private key file: \"~a\".~%" private-key)))))))) - -(define (dkimproxyout-shepherd-service config) - (match-record config <dkimproxyout-configuration> - (package user group supplementary-groups config-name data-directory - run-in-container? container-name container-namespaces) - (let* ((config-file (string-append "/etc/" config-name)) - (bin (file-append package "/bin/dkimproxy.out")) - (cmd (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:name container-name - #:namespaces container-namespaces - #:mappings (list - (file-system-mapping - (source "/etc/protocols") - (target source)) - (file-system-mapping - (source config-file) - (target source)) - (file-system-mapping - (source - (string-append data-directory "/private.key")) - (target source))))))) - (list - (shepherd-service - (provision '(dkimproxyout)) - (documentation "Run the outbound DKIMProxy.out daemon.") - (start #~(make-forkexec-constructor - (list #$cmd "--conf_file" #$config-file) - #:user #$user - #:group #$group - #:supplementary-groups '(#$@supplementary-groups))) - (stop #~(make-kill-destructor)) - (actions - (list - (shepherd-action - (name 'configuration) - (documentation "Display the name of the configuration file being used.") - (procedure - #~(lambda _ - (format #t "~a~%" #$config-file))))))))))) - -(define dkimproxyout-service-type - (service-type - (name 'dkimproxyout) - (extensions - (list - (service-extension etc-service-type - dkimproxyout-etc-files) - (service-extension account-service-type - dkimproxyout-accounts) - (service-extension activation-service-type - dkimproxyout-activation) - (service-extension profile-service-type - (compose list dkimproxyout-configuration-package)) - (service-extension shepherd-root-service-type - dkimproxyout-shepherd-service))) - (default-value (dkimproxyout-configuration)) - (description "Run the @code{dkimproxy.out} SMTP outbound proxy for adding -DKIM signature headers to emails. This daemon is meant to be used in companiong -with an SMTP server, such as Postfix. - -On startup, it creates the keypair to be used for signing if the keypair doesn't -exist yet. The corresponding public.key is kept in the same directory as the -private key. The default location for the private key is -@file{/var/lib/dkimproxyout/private.key}, so the public key is kept at -@file{/var/lib/dkimproxyout/public.key}, so that it can be added as a TXT DNS -entry. - -By default, the daemon runs in a container."))) - - -(define-record-type* <postfix-configuration> - postfix-configuration - make-postfix-configuration - postfix-configuration? - (package postfix-configuration-package (default postfix)) - (enable-submission? postfix-configuration-enable-submission? (default #f)) - (set-sendmail? postfix-configuration-set-sendmail? (default #t)) - (master.cf-file postfix-configuration-master.cf-file (default #f)) - (main.cf-file postfix-configuration-main.cf-file (default #f)) - (master.cf-extra postfix-configuration-master.cf-extra (default "")) - (main.cf-extra postfix-configuration-main.cf-extra (default "")) - (config-dirname postfix-configuration-config-dirname (default "postfix")) - (mail-directory postfix-configuration-mail-directory (default "/var/mail/")) - (data-directory postfix-configuration-data-directory (default "/var/lib/postfix")) - (queue-directory postfix-configuration-queue-directory (default "/var/spool/postfix")) - (user postfix-configuration-user (default "postfix")) - (group postfix-configuration-group (default "postfix")) - (supplementary-groups postfix-configuration-supplementary-groups (default '())) - (setgid-group postfix-configuration-setgid-group (default "postdrop")) - (root-aliases postfix-configuration-root-aliases (default '("abuse" "admin" "hostmaster" "postmaster"))) - (cert-file postfix-configuration-cert-file (default #f)) - (key-file postfix-configuration-key-file (default #f)) - (hostname postfix-configuration-hostname (default (gethostname))) - (dkim-filter-listen postfix-configuration-dkim-filter-listen (default "[127.0.0.1]:10027")) - (dkim-filter-relay postfix-configuration-dkim-filter-relay (default "127.0.0.1:10028")) - (sasl-dirname postfix-configuration-sasl-dirname (default "/etc/sasl2")) - (run-in-container? postfix-configuration-run-in-container? (default #f)) - (container-name postfix-configuration-container-name (default "postfix")) - (container-namespaces postfix-configuration-container-namespaces (default (s1:fold delq container:%namespaces '(net))))) - -(define (dksign-filter dkim-filter-listen) - (format #f - " - -o content_filter=dksign:~a" - dkim-filter-listen)) - -(define (submission-config dkim-filter-listen) - (format #f - " -submission inet n - n - - smtpd -o syslog_name=postfix/submission - -o smtpd_tls_security_level=encrypt - -o content_filter=dksign:~a" - dkim-filter-listen)) - -(define (dksign-config dkim-filter-relay) - (format #f - " - -dksign unix - - n - - smtp - -o syslog_name=postfix/dkimproxyout-listen - -o smtp_send_xforward_command=yes - -o smtp_discard_ehlo_keywords=8bitmime,starttls - -~a inet n - n - - smtpd - -o syslog_name=postfix/dkimproxyout-relay - -o content_filter= - -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks - -o smtpd_helo_restrictions= - -o smtpd_client_restrictions= - -o smtpd_sender_restrictions= - -o smtpd_recipient_restrictions=permit_mynetworks,reject - -o mynetworks=127.0.0.0/8 - -o smtpd_authorized_xforward_hosts=127.0.0.0/8 -" - dkim-filter-relay)) - -(define (generate-master.cf config) - (match-record config <postfix-configuration> - (enable-submission? master.cf-extra dkim-filter-listen dkim-filter-relay) - (format #f - "# ============================================================================================================ -# service type private unpriv chroot wakeup maxproc command + args -# (yes) (yes) (no) (never) (100) -# ============================================================================================================= - -anvil unix - - n - 1 anvil -bounce unix - - n - 0 bounce -cleanup unix n - n - 0 cleanup -defer unix - - n - 0 bounce -discard unix - - n - - discard -error unix - - n - - error -flush unix n - n 1000? 0 flush -lmtp unix - - n - - lmtp -local unix - n n - - local -pickup unix n - n 60 1 pickup~a -proxymap unix - - n - - proxymap -proxywrite unix - - n - 1 proxymap -qmgr unix n - n 300 1 qmgr -relay unix - - n - - smtp -retry unix - - n - - error -rewrite unix - - n - - trivial-rewrite -scache unix - - n - 1 scache -showq unix n - n - - showq -smtp inet n - n - - smtpd -o syslog_name=postfix/smtp -smtp unix - - n - - smtp -tlsmgr unix - - n 1000? 1 tlsmgr -trace unix - - n - 0 bounce -verify unix - - n - 1 verify -virtual unix - n n - - virtual -postlog unix-dgram n - n - 1 postlogd -~a~a~a" - (if enable-submission? (dksign-filter dkim-filter-listen) "") - (if enable-submission? (submission-config dkim-filter-listen) "") - (if enable-submission? (dksign-config dkim-filter-relay) "") - master.cf-extra))) - -(define (cert-for prefix config) - (match-record config <postfix-configuration> - (cert-file hostname) - (or cert-file (format #f "/etc/letsencrypt/live/~a~a/fullchain.pem" prefix hostname)))) - -(define (key-for prefix config) - (match-record config <postfix-configuration> - (key-file hostname) - (or key-file (format #f "/etc/letsencrypt/live/~a~a/privkey.pem" prefix hostname)))) - -(define (main.cf-internet-extra hostname cert key sasl-dirname) - (format #f - " -myhostname = ~a - -smtpd_use_tls = yes -smtpd_tls_cert_file = ~a -smtpd_tls_key_file = ~a -smtp_use_tls = $smtpd_use_tls -smtp_tls_cert_file = $smtpd_tls_cert_file -smtp_tls_key_file = $smtpd_tls_key_file - -smtp_tls_security_level = may - -recipient_delimiter = + - -smtpd_sasl_tls_security_options = noanonymous -smtpd_tls_security_level = may -smtpd_tls_auth_only = yes - -smtpd_relay_restrictions = $smtpd_recipient_restrictions -smtpd_recipient_restrictions = permit_mynetworks, - permit_sasl_authenticated, reject_unauth_destination -smtpd_sasl_auth_enable = yes -cyrus_sasl_config_path = ~a -debug_peer_list = 127.0.0.1 - -milter_default_action = accept -" - hostname - cert - key - sasl-dirname)) -(define main.cf-local-extra - " -mynetworks = 127.0.0.0/8 -") - -(define (generate-main.cf config) - (match-record config <postfix-configuration> - (enable-submission? mail-directory queue-directory data-directory - user setgid-group hostname main.cf-extra sasl-dirname) - (format #f - "compatibility_level = 3.6 - -queue_directory = ~a -data_directory = ~a -mail_owner = ~a -setgid_group = ~a - -header_checks = regexp:{ { /^Received:.*/ IGNORE }, { /^X-Originating-IP:.*/ IGNORE } } - -mail_spool_directory = ~a - -message_size_limit = 102400000 -mailbox_size_limit = 5120000000 - -~a~a" - - queue-directory - data-directory - user - setgid-group - mail-directory - main.cf-extra - (if enable-submission? - (main.cf-internet-extra - hostname - (cert-for "" config) - (key-for "" config) - sasl-dirname) - main.cf-local-extra)))) - -(define (postfix-etc-files config) - (match-record config <postfix-configuration> - (master.cf-file main.cf-file config-dirname) - `((,config-dirname - ,(file-union - config-dirname - `(("master.cf" ,(plain-file "master.cf" (or master.cf-file (generate-master.cf config)))) - ("main.cf" ,(plain-file "main.cf" (or main.cf-file (generate-main.cf config)))))))))) - -(define (postfix-accounts config) - (match-record config <postfix-configuration> - (user group supplementary-groups setgid-group) - (list - (user-account - (name user) - (group group) - (supplementary-groups supplementary-groups) - (comment "Postfix system user") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-group - (name group) - (system? #t)) - (user-group - (name setgid-group) - (system? #t))))) - -(define (postfix-privileged-programs config) - (match-record config <postfix-configuration> - (package setgid-group set-sendmail?) - (append (list - (privileged-program - (program (file-append package "/sbin/postdrop")) - (setuid? #f) - (setgid? #t) - (group setgid-group)) - (privileged-program - (program (file-append package "/sbin/postqueue")) - (setuid? #f) - (setgid? #t) - (group setgid-group))) - (if set-sendmail? - (list - (privileged-program - (program (file-append package "/sbin/sendmail")) - (setuid? #f) - (setgid? #t) - (group setgid-group))) - '())))) - -(define (postfix-activation config) - (match-record config <postfix-configuration> - (package mail-directory queue-directory) - #~(begin - (use-modules (guix build utils)) - (let ((user (getpwnam "root"))) - (unless (directory-exists? #$mail-directory) - (format (current-error-port) - "Creating email spool director: \"~a\".~%" #$mail-directory) - (mkdir-p/perms #$mail-directory user #o755)) - (format (current-error-port) - "Creating Postfix queue directory: \"~a\".~%" #$queue-directory) - (mkdir-p/perms #$queue-directory user #o755) - (format (current-error-port) - "Updating /etc/aliases.~%") -;; FIXME -#; - (invoke #$(file-append package "/bin/newaliases")))))) - -(define (postfix-shepherd-service config) - (match-record config <postfix-configuration> - (package config-dirname data-directory queue-directory - run-in-container? container-name container-namespaces) - (let* ((config-dir (string-append "/etc/" config-dirname)) - (bin (file-append package "/sbin/postfix")) - (cmd (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:name container-name - #:namespaces container-namespaces - #:mappings (list - (file-system-mapping - (source data-directory) - (target source) - (writable? #t)) - (file-system-mapping - (source queue-directory) - (target source) - (writable? #t))))))) - (list - (shepherd-service - (provision '(postfix)) - (documentation - "Run the Postfix MTA. - -This is the entrypoint for starting the \"master\" process. Then the \"master\" -process itself takes responsability of starting all the required daemons and -commands.") - (start #~(make-forkexec-constructor - (list #$cmd "-c" #$config-dir "start-fg") - #:pid-file "/var/lib/postfix/master.lock")) - (actions - (list - (shepherd-action - (name 'configuration) - (documentation "Display the name of the \"master.cf\" and \"main.cf\" file being used.") - (procedure - #~(lambda _ - (format #t "~a/master.cf~%" #$config-dir) - (format #t "~a/main.cf~%" #$config-dir)))) - (shepherd-action - (name 'reload) - (documentation - "Re-read the \"master.cf\" and \"main.cf\" configuration files. - -Daemon processes terminate when possible, and when restarted use the values of -the new configuration files. - -This live-reload option is usually preferable over a stop/start cycle, as it -incurs in no interruption of the running service.") - (procedure - #~(lambda _ - (invoke #$cmd "-c" #$config-dir "reload"))))))))))) - -(define (postfix-aliases config) - (match-record config <postfix-configuration> - (root-aliases) - (map (lambda (alias) - `(,alias "root")) - root-aliases))) - -(define (postfix-nginx-locations config) - (match-record config <postfix-configuration> - (hostname) - (list - (nginx-server-configuration - (server-name (list (string-append "mta-sts." hostname))) - (listen '("[::]:443 ssl" "443 ssl")) - (ssl-certificate (cert-for "mta-sts." config)) - (ssl-certificate-key (key-for "mta-sts." config)) - (locations - (list - (nginx-location-configuration - (uri "= /.well-known/mta-sts.txt") - (body - (list - (list "alias " - (plain-file - "mta-sts.txt" - (format #f - "version: STSv1 -mode: enforce -mx: ~a -max_age: 604800 -" - hostname)) - ";")))))))))) - -(define (postfix-certificates config) - (match-record config <postfix-configuration> - (hostname) - (list - (certificate-configuration - (domains (list (string-append "mta-sts." hostname))))))) - -(define (postfix-sasl-services _config) - (list - (cyrus-service-configuration - (name "smtpd.conf")))) - -(define local-postfix-service-extensions - (list - (service-extension etc-service-type - postfix-etc-files) - (service-extension account-service-type - postfix-accounts) - (service-extension privileged-program-service-type - postfix-privileged-programs) - (service-extension activation-service-type - postfix-activation) - (service-extension profile-service-type - (compose list postfix-configuration-package)) - (service-extension shepherd-root-service-type - postfix-shepherd-service))) - -(define local-postfix-service-type - (service-type - (name 'postfix) - (extensions local-postfix-service-extensions) - (default-value (postfix-configuration)) - (description - "Run the Postfix MTA. - -This is the top-level system service for Postfix, targeted at \"local\" -installations, that is, not internet-facing, usually for delivery of cronjob -emails, or for offline email sending in a laptop via a relay. - -It includes: -@itemize -@item populating @file{/etc/postfix/} with read-only configuration files; -@item the user and groups used by Postfix when handling email delivery; -@item the special setgid binaries for daily usage, such as \"sendmail\"; -@item the Shepherd service for starting, stopping and @emph{reloading} the - service without restarting it; -@item the activation script for creating the required directories and - configuring them with the correct permissions; -@item the binaries in the system profile so that one doesn't need to explicilty - include the package when the service is already enabled. -@end itemize - -An extension to the log-rotation service isn't included: the default rottlog -configuration already includes @file{/var/log/maillog} in its routine, so it is -kept out. - -The defaults of @code{<postfix-configuration>} provides sane default values for -most things, such as group names, data and queue directories, etc. When used -as-is, it creates a Postfix server that sends email locally-only, and one can -add relaying configuration via the @code{main.cf-extra} parameter."))) - -(define internet-postfix-service-type - (service-type - (name 'postfix) - (extensions - (append - local-postfix-service-extensions - (list - (service-extension mail-aliases-service-type - postfix-aliases) - (service-extension nginx-service-type - postfix-nginx-locations) - (service-extension certbot-service-type - postfix-certificates) - (service-extension cyrus-sasl-service-type - postfix-sasl-services)))) - (default-value (postfix-configuration - (enable-submission? #t))) - (description - "Run the Postfix MTA. - -This is the top-level system service for Postfix, targeted at \"internet\" -installations, that is, internet-facing SMTP servers, for sending and receiving -emails to other servers, as well as local delivery of emails between users or by -system users such as cronjobs. - -It includes everything from @code{local-postfix-service-type}, plus: -@itemize -@item nginx configuration for answering the @code{mta-sts.$domain} HTTP - subdomain, specifically the @code{.well-known/mta-sts.txt} URL; -@item certbot extension for acquiring the certificate for @code{mta-sts.$domain} - so that the item above happens via HTTPS; -@item best-practices email aliases for administering a SMTP server; -@item cyrus-sasl extension for authenticating SMTP users via the Cyrus SASL - @code{saslauthd} daemon. -@end itemize - -The defaults of @code{<postfix-configuration>} provides sane default values for -most things, hostname, certificates, permissions, etc. When used as-is, it -creates a Postfix server that can send and receive emails from the internet -correctly."))) - - - -(define-record-type* <dovecot-configuration> - dovecot-configuration - make-dovecot-configuration - dovecot-configuration? - (package dovecot-configuration-package (default dovecotx)) - (mail-location dovecot-configuration-mail-location (default "/var/mail/")) - (raw-file dovecot-configuration-raw-file (default #f)) - (extra-content dovecot-configuration-extra-content (default "")) - (config-dirname dovecot-configuration-config-dirname (default "dovecot")) - (config-filename dovecot-configuration-config-filename (default "dovecot.conf")) - (user dovecot-configuration-user (default "dovecot")) - (group dovecot-configuration-group (default "dovecot")) - (supplementary-groups dovecot-configuration-supplementary-groups (default '())) - (auth-worker-group dovecot-configuration-auth-worker-group (default "etc-shadow")) - (untrusted-user dovecot-configuration-untrusted-user (default "dovenull")) - (untrusted-group dovecot-configuration-untrusted-group (default "dovenull")) - (untrusted-supplementary-groups dovecot-configuration-untrusted-supplementary-groups (default '())) - (base-dir dovecot-configuration-base-dir (default "/var/run/dovecot")) - (state-dir dovecot-configuration-state-dir (default "/var/lib/dovecot")) - (hostname dovecot-configuration-hostname (default (gethostname))) - (run-in-container? dovecot-configuration-run-in-container? (default #f)) - (container-name dovecot-configuration-container-name (default "dovecot")) - (container-namespaces dovecot-configuration-container-namespaces (default (s1:fold delq container:%namespaces '(net))))) - -(define (generate-dovecot-config config) - (match-record config <dovecot-configuration> - (mail-location user group auth-worker-group untrusted-user - hostname base-dir state-dir extra-content) - (format #f - "protocols = imap - -default_internal_user = ~a -default_internal_group = ~a -default_login_user = ~a -auth_mechanisms = plain login -auth_username_format = %n - -passdb { - driver = shadow -} -userdb { - driver = passwd -} -service auth-worker { - group = ~a -} - -ssl = required -ssl_cert = </etc/letsencrypt/live/~a/fullchain.pem -ssl_key = </etc/letsencrypt/live/~a/privkey.pem -ssl_dh = <~a/dhparam.pem - -base_dir = ~a -state_dir = ~a - -verbose_proctitle = yes - -mail_location = maildir:~a%u:INBOX=~a%u:LAYOUT=fs - -namespace inbox { - inbox = yes - mailbox Drafts { - special_use = \\Drafts - auto = subscribe - } - mailbox Sent { - special_use = \\Sent - auto = subscribe - } - mailbox Archive { - special_use = \\Archive - auto = subscribe - } - mailbox Junk { - special_use = \\Junk - auto = subscribe - autoexpunge = 30d - } - mailbox Trash { - special_use = \\Trash - auto = subscribe - } -} -~a" - user - group - untrusted-user - auth-worker-group - hostname - hostname - state-dir - base-dir - state-dir - mail-location - mail-location - extra-content))) - -(define (dovecot-etc-files config) - (match-record config <dovecot-configuration> - (raw-file config-dirname config-filename) - `((,config-dirname - ,(file-union - config-dirname - `((,config-filename ,(plain-file config-filename - (or raw-file - (generate-dovecot-config config)))))))))) - -(define (dovecot-accounts config) - (match-record config <dovecot-configuration> - ( user group supplementary-groups - untrusted-user untrusted-group untrusted-supplementary-groups) - (list - (user-account - (name user) - (group group) - (supplementary-groups supplementary-groups) - (comment "Dovecot system user") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-account - (name untrusted-user) - (group untrusted-group) - (supplementary-groups untrusted-supplementary-groups) - (comment "Dovecot user for untrusted logins") - (home-directory "/var/empty") - (create-home-directory? #f) - (shell - (file-append shadow "/sbin/nologin")) - (system? #t)) - (user-group - (name group) - (system? #t)) - (user-group - (name untrusted-group) - (system? #t))))) - -(define (dovecot-activation config) - (match-record config <dovecot-configuration> - (base-dir state-dir) - #~(begin - (use-modules (guix build utils)) - (let ((user (getpwnam "root")) - (dhparam.pem (string-append #$state-dir "/dhparam.pem"))) - (format (current-error-port) - "Creating Dovecot base_dir directory: \"~a\".~%" #$base-dir) - (mkdir-p/perms #$base-dir user #o755) - (mkdir-p/perms #$state-dir user #o755) - (unless (file-exists? dhparam.pem) - (format (current-error-port) - "dhparam.pem file doesn't exist yet. Generating one...~%") - (cond - ((zero? (system* (string-append #$openssl "/bin/openssl") - "dhparam" "-out" dhparam.pem "2048")) - (format (current-error-port) - "Dovecot2 dhparam.pem file created: \"~a\".~%" dhparam.pem)) - (else - (format (current-error-port) - "Failed to create dhparam.pem file: \"~a\".~%" dhparam.pem)))))))) - -(define (dovecot-shepherd-service config) - (match-record config <dovecot-configuration> - (package config-dirname config-filename - run-in-container? container-name container-namespaces) - (let* ((config-file (string-append "/etc/" config-dirname "/" config-filename)) - (bin (file-append package "/sbin/dovecot")) - (cmd (if (not run-in-container?) - bin - (least-authority-wrapper - bin - #:name container-name - #:namespaces container-namespaces - #:mappings (list - (file-system-mapping - (source "/etc/shadow") - (target source))))))) - (list - (shepherd-service - (provision '(dovecot)) - (documentation "Run the Dovecot daemon.") - (start #~(make-forkexec-constructor - (list #$cmd "-F" "-c" #$config-file))) - (stop #~(make-kill-destructor)) - (actions - (list - (shepherd-action - (name 'configuration) - (documentation "Display the name of the configuration file being used.") - (procedure - #~(lambda _ - (format #t "~a~%" #$config-file)))) - (shepherd-action - (name 'reload) - (documentation "Re-read the configuration file without restarting the running dovecot daemon.") - (procedure - #~(lambda _ - (invoke #$(file-append package "/bin/doveadm") - "-c" - #$config-file - "reload"))))))))))) - -(define dovecot-service-type - (service-type - (name 'dovecot) - (extensions - (list - (service-extension etc-service-type - dovecot-etc-files) - (service-extension account-service-type - dovecot-accounts) - (service-extension activation-service-type - dovecot-activation) - (service-extension profile-service-type - (compose list dovecot-configuration-package)) - (service-extension shepherd-root-service-type - dovecot-shepherd-service))) - (default-value (dovecot-configuration)) - (description "Run the Dovecot IMAP @code{dovecot} daemon. - -This is the top-level system service for Dovecot, using the UNIX password stored -at @file{/etc/shadow} for authenticating IMAP connections. - -It includes: -@itemize -@item creating the configuration file at @file{/etc/dovecot/dovecot.conf} by - default; -@item the user and groups used by Dovecot both system and untrusted users; -@item the activation script for creating the required directories and the - @file{dhparam.pem} file if it is missing; -@item the Shepherd service for starting, stopping and @emph{reloading} the - service without restarting it; -@item the binaries in the system profile so that one doesn't need to explicilty - include the package when the service is already enabled. -@end itemize - -An extension to the log-rotation service isn't included: the default rottlog -configuration already includes @file{/var/log/maillog} in its routine, so it is -kept out. - -The defaults of @code{<dovecot-configuration>} provides sane default values for -most things, such as group names, data and mail directories, etc. When used -as-is, it creates a Dovecot server that and serve and authenticate IMAP -connections correctly."))) - - - -(define setenvfmt "Environment variable `~a' set to `~a'.~%") -(define-public gol - (let ((pkg go-1.23)) - (package - (inherit pkg) - (name "gol") - (arguments - (substitute-keyword-arguments (package-arguments pkg) - ((#:tests? _) #f) - ((#:phases phases) - #~(modify-phases #$phases - (add-before 'build 'recover-binary-stdlib - (lambda _ - (let ((name "GODEBUG") - (value "installgoroot=all")) - (setenv name value) - (format #t #$setenvfmt name value)))) - ;; Not all of us work with fancy modern computers that have have - ;; too much memory and computing power for programmers to waste. - ;; Therefore, Go's default timeout of 10 minutes (!!) to run all - ;; tests isn't enough, so we disable it with an huge value and - ;; instead inherit the effective timeout from Guix itself. How not - ;; to like software that adheres so well to the Unix philosophy? - (add-before 'build 'tolerate-slow-tests - (lambda _ - (let ((name "GO_TEST_TIMEOUT_SCALE") - (value "10")) - (setenv name value) - (format #t #$setenvfmt name value)))) - (add-after 'install 'install-binaries - (lambda _ - (copy-recursively "pkg" - (string-append #$output "/lib/go/pkg")))) - (delete 'strip)))))))) - -(define-public cgit-pre-configuration - (cgit-configuration - (nginx '()) - (source-filter (file-append cgit "/lib/cgit/filters/syntax-highlighting.py")) - (about-filter (file-append cgit "/lib/cgit/filters/about-formatting.sh")) - (virtual-root "/git/") - (remove-suffix? #t) - (nocache? #t) - (enable-commit-graph? #t) - (enable-follow-links? #t) - (enable-index-links? #t) - (enable-index-owner? #f) - (enable-log-filecount? #t) - (enable-log-linecount? #t) - (enable-remote-branches? #t) - (enable-subject-links? #t) - (max-repo-count 0) - (snapshots '("tar.gz" "tar.xz")) - (root-desc "Patches welcome!") - (root-title (string-append (gethostname) " repositories")) - (logo "/git/static/cgit.png") - (favicon "/git/static/favicon.ico") - (css "/git/static/cgit.css") - (extra-options - '("enable-blame=1" - "nocache=1" - "mimetype.mjs=text/javascript" - "readme=:README.md" - "readme=:README")))) - -(define-public (tld-certbot-configuration tld) - (certbot-configuration - (email (string-append "root@" tld)) - (certificates - (list - (certificate-configuration - (domains (list tld))))))) ;; FIXME: SIGHUP nginx/untls - -(define-public (openssh-default-configuration authorized-keys) - (openssh-configuration - (openssh openssh-sans-x) - (password-authentication? #f) - (authorized-keys authorized-keys) - (extra-content "MaxSessions 20 -ClientAliveInterval 30 -ClientAliveCountMax 23 -SetEnv GIT_CONFIG_GLOBAL=/etc/gitconfig"))) - - - -(define-public (dkim-public-key-from path) - (if (file-exists? path) - (string-join (reverse - (cddr - (reverse - (cdr - (string-split (call-with-input-file - path - textual-ports:get-string-all) - #\newline))))) - "") - "stub-public-key-for-building")) - -(define-public (build-ipv4-reverse-domain ipv4) - (string-append - (string-join (reverse - (string-split ipv4 - #\.)) - ".") - ".in-addr.arpa")) - -(define-public (build-ipv6-reverse-domain ipv6) - (string-append - (string-join (reverse - (map (lambda (s) (format #f "~a" s)) - (string->list - (string-delete #\: ipv6)))) - ".") - ".ip6.arpa")) - -(define-public (knot-zones-for tld ipv4 ipv6) - (define dkim-selector "dkimproxyout") - (define dkim-public-key-path "/var/lib/dkimproxyout/public.key") - (define dkim-name (string-append dkim-selector "._domainkey")) - (let ((tld. (string-append tld ".")) - (ns1 (format #f "ns1.~a." tld)) - (ns2 (format #f "ns2.~a." tld)) - (mail (format #f "hostmaster.~a." tld)) - (dkim-public-key (dkim-public-key-from dkim-public-key-path)) - (ipv4-reverse-domain (build-ipv4-reverse-domain ipv4)) - (ipv6-reverse-domain (build-ipv6-reverse-domain ipv6))) - (define-zone-entries tld-zone - ("@" "" "IN" "NS" ns1) - ("@" "" "IN" "NS" ns2) - ("ns1" "" "IN" "A" ipv4) - ("ns1" "" "IN" "AAAA" ipv6) - ("ns2" "" "IN" "A" ipv4) - ("ns2" "" "IN" "AAAA" ipv6) - ("@" "" "IN" "A" ipv4) - ("@" "" "IN" "AAAA" ipv6) - ("@" "" "IN" "CAA" "0 issue \"letsencrypt.org\"") - ("@" "" "IN" "CAA" "0 issuewild \";\"") - ("@" "" "IN" "CAA" "0 iodef \"mailto:eu@euandre.org\"") - ("mta-sts" "" "IN" "A" ipv4) - ("mta-sts" "" "IN" "AAAA" ipv6) - ("_mta-sts" "" "IN" "TXT" "\"v=STSv1; id=20230314\"") - ("@" "" "IN" "MX" (format #f "10 ~a." tld)) - ("_dmarc" "" "IN" "TXT" "\"v=DMARC1; p=quarantine\"") - ("@" "" "IN" "TXT" (format #f "\"v=spf1 a:~a -all\"" tld)) - (dkim-name "" "IN" "TXT" (format #f "\"v=DKIM1; k=rsa; t=s; p=~a\"" dkim-public-key))) - (define-zone-entries ipv4-reverse-domain-zone - ("@" "" "IN" "PTR" tld.) - ("@" "" "IN" "NS" ns1) - ("@" "" "IN" "NS" ns2)) - (define-zone-entries ipv6-reverse-domain-zone - ("@" "" "IN" "PTR" tld.) - ("@" "" "IN" "NS" ns1) - ("@" "" "IN" "NS" ns2)) - (list - (knot-zone-configuration - (domain tld) - (semantic-checks? #t) - (zone - (zone-file - (origin tld) - (ns ns1) - (mail mail) - (entries tld-zone)))) - (knot-zone-configuration - (domain ipv4-reverse-domain) - (semantic-checks? #t) - (zone - (zone-file - (origin ipv4-reverse-domain) - (ns ns1) - (mail mail) - (entries ipv4-reverse-domain-zone)))) - (knot-zone-configuration - (domain ipv6-reverse-domain) - (semantic-checks? #t) - (zone - (zone-file - (origin ipv6-reverse-domain) - (ns ns1) - (mail mail) - (entries ipv6-reverse-domain-zone))))))) - -(define-public (knot-zones-configuration tld ipv4 ipv6) - (knot-configuration - (zones - (knot-zones-for tld ipv4 ipv6)))) - -(define-public sqlitex - (package - (inherit sqlite-next) - (name "sqlitex") - (arguments - (list - #:tests? #f - #:configure-flags - #~(list - "--disable-option-checking" - "--disable-shared" - "--enable-static" - "--disable-editline" - "--disable-readline" - "--enable-threadsafe" - "--disable-dynamic-extensions" - "--disable-math" - "--disable-fts3" - "--disable-fts4" - "--enable-fts5" - "--disable-rtree" - "--disable-debug" - "--disable-session" - (string-join - '("CFLAGS=" - "-D_POSIX_C_SOURCE=200809L" - "-D_XOPEN_SOURCE=700" - "-DSQLITE_DEFAULT_FOREIGN_KEYS=1" - "-DSQLITE_ENABLE_COLUMN_METADATA" - "-DSQLITE_DQS=0" - "-DSQLITE_THREADSAFE=1" - "-DSQLITE_DEFAULT_MEMSTATUS=0" - "-DSQLITE_DEFAULT_SYNCHRONOUS=3" - "-DSQLITE_DEFAULT_WAL_SYNCHRONOUS=3" - "-DSQLITE_LIKE_DOESNT_MATCH_BLOBS" - "-DSQLITE_MAX_EXPR_DEPTH=0" - "-DSQLITE_OMIT_DEPRECATED" - "-DSQLITE_OMIT_PROGESS_CALLBACK" - "-DSQLITE_USE_ALLOCA" - "-DSQLITE_STRICT_SUBTYPE=1" - "-DSQLITE_OMIT_AUTOMATIC_INDEX" - "-DSQLITE_CASE_SENSITIVE_LIKE" - "-DSQLITE_OMIT_CASE_SENSITIVE_LIKE_PRAGMA" - "-DSQLITE_DIRECT_OVERFLOW_READ" - "-DSQLITE_USE_URI" - "-DSQLITE_ENABLE_API_ARMOR" - "-DSQLITE_ENABLE_QPSG" - "-DSQLITE_ENABLE_SNAPSHOT" - "-DSQLITE_OMIT_SEH" - "-DSQLITE_DISABLE_PAGECACHE_OVERFLOW_STATS" - "-DSQLITE_OMIT_CASE_SENSITIVE_LIKE_PRAGMA" - "-DSQLITE_OMIT_GET_TABLE" - "-DSQLITE_OMIT_TCL_VARIABLE" - "-DSQLITE_OMIT_TRACE" - "-DSQLITE_OMIT_UTF16" - "-g" - "-O3" - "-march=native" - "-std=c99" - "-Wvla" - "-fPIE")) - "LDFLAGS=--static -flto"))) - (inputs - (list)) - (native-inputs - (list - editline)) - (outputs - '("out")))) - -(define-public scryptkdf - (package - (inherit scrypt) - (name "scryptkdf") - (inputs - `(("openssl:out" ,openssl "out") - ("openssl:static" ,openssl "static"))) - (arguments - (substitute-keyword-arguments (package-arguments scrypt) - ((#:configure-flags flags ''()) - #~(append - #$flags - (list - "--enable-libscrypt-kdf" - "--disable-shared" - "--enable-static" - (string-join - '("CFLAGS=" - "-D_POSIX_C_SOURCE=200809L" - "-D_XOPEN_SOURCE=700" - "-g" - "-O2" - "-march=native" - "-std=c99" - "-Wvla" - "-fPIE")) - "LDFLAGS=--static"))))))) - - - -(list - postfix - mailutils-sendmail - rottlog-mailutils-sendmail - pax-utils - hunspell-dict-en-utf8 - hunspell-dict-pt-utf8 - hunspell-dict-fr-utf8 - hunspell-dict-eo-utf8 - hunspell-dict-es-utf8 - python-telegram-bot - gm2 - ffmpegx - mpvx - dovecotx - sqlitex - scryptkdf - gol) |