mirror of
https://git.savannah.gnu.org/git/guix.git
synced 2026-04-06 21:20:33 +02:00
b657836863
The implementation of postgresql-role's password up until now relied on spawining a subshell reading the password file and passing its content via command line to a psql process which would create users and set passwords. This allowed a (fast) attacker to eavesdrop, via the kernel command line facility, the password while they were read, without having the permissions required for reading the password file. This new implementation reads passwords directly from password files into the Guile process, temporarily stores them in query files living in a memory backed file system and deletes the query files after executing them. It also makes sure to turn off logging of commands for the duration of the password setting transaction, so passwords don't get leaked to system logs through misconfiguration. * gnu/services/databases.scm (%postgresql-role-runtime-dir): New variable. (postgresql-create-roles): Rework the way passwords are set to avoid leaking them through subshells and command lines. (%postgresql-role-file-systems): New variable. (postgresql-role-service-type): Add file-system-service-type extension point. Change-Id: I52406d1d24f5d163081b5c21d3e1760fc0b67a1e
928 lines
37 KiB
Scheme
928 lines
37 KiB
Scheme
;;; GNU Guix --- Functional package management for GNU
|
||
;;; Copyright © 2015 David Thompson <davet@gnu.org>
|
||
;;; Copyright © 2015-2016, 2022-2023, 2025 Ludovic Courtès <ludo@gnu.org>
|
||
;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
|
||
;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
|
||
;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
|
||
;;; Copyright © 2018 Julien Lepiller <julien@lepiller.eu>
|
||
;;; Copyright © 2019 Robert Vollmert <rob@vllmrt.net>
|
||
;;; Copyright © 2020, 2022 Marius Bakke <marius@gnu.org>
|
||
;;; Copyright © 2021 David Larsson <david.larsson@selfhosted.xyz>
|
||
;;; Copyright © 2021 Aljosha Papsch <ep@stern-data.com>
|
||
;;; Copyright © 2025, 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
|
||
;;;
|
||
;;; This file is part of GNU Guix.
|
||
;;;
|
||
;;; GNU Guix is free software; you can redistribute it and/or modify it
|
||
;;; under the terms of the GNU General Public License as published by
|
||
;;; the Free Software Foundation; either version 3 of the License, or (at
|
||
;;; your option) any later version.
|
||
;;;
|
||
;;; GNU Guix is distributed in the hope that it will be useful, but
|
||
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
;;; GNU General Public License for more details.
|
||
;;;
|
||
;;; You should have received a copy of the GNU General Public License
|
||
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
|
||
|
||
(define-module (gnu services databases)
|
||
#:use-module (gnu services)
|
||
#:use-module (gnu services base)
|
||
#:use-module (gnu services configuration)
|
||
#:use-module (gnu services shepherd)
|
||
#:use-module (gnu system file-systems)
|
||
#:use-module (gnu system shadow)
|
||
#:autoload (gnu system accounts) (default-shell)
|
||
#:use-module (gnu packages admin)
|
||
#:use-module (gnu packages base)
|
||
#:use-module (gnu packages databases)
|
||
#:use-module (guix build-system trivial)
|
||
#:use-module (guix build union)
|
||
#:use-module (guix deprecation)
|
||
#:use-module (guix modules)
|
||
#:use-module (guix packages)
|
||
#:use-module (guix records)
|
||
#:use-module (guix gexp)
|
||
#:use-module (srfi srfi-1)
|
||
#:use-module (ice-9 match)
|
||
#:export (postgresql-config-file
|
||
postgresql-config-file?
|
||
postgresql-config-file-log-destination
|
||
postgresql-config-file-hba-file
|
||
postgresql-config-file-ident-file
|
||
postgresql-config-file-socket-directory
|
||
postgresql-config-file-extra-config
|
||
|
||
postgresql-configuration
|
||
postgresql-configuration?
|
||
postgresql-configuration-allow-login?
|
||
postgresql-configuration-create-account?
|
||
postgresql-configuration-data-directory
|
||
postgresql-configuration-extension-packages
|
||
postgresql-configuration-file
|
||
postgresql-configuration-gid
|
||
postgresql-configuration-home-directory
|
||
postgresql-configuration-locale
|
||
postgresql-configuration-log-directory
|
||
postgresql-configuration-port
|
||
postgresql-configuration-postgresql
|
||
postgresql-configuration-uid
|
||
|
||
postgresql-service
|
||
postgresql-service-type
|
||
|
||
%default-postgresql-role-shepherd-requirement
|
||
|
||
postgresql-role
|
||
postgresql-role?
|
||
postgresql-role-name
|
||
postgresql-role-password-file
|
||
postgresql-role-permissions
|
||
postgresql-role-create-database?
|
||
postgresql-role-configuration
|
||
postgresql-role-configuration?
|
||
postgresql-role-configuration-host
|
||
postgresql-role-configuration-shepherd-requirement
|
||
postgresql-role-configuration-roles
|
||
|
||
postgresql-role-service-type
|
||
|
||
memcached-service-type
|
||
memcached-configuration
|
||
memcached-configuration?
|
||
memcached-configuration-memecached
|
||
memcached-configuration-interfaces
|
||
memcached-configuration-tcp-port
|
||
memcached-configuration-udp-port
|
||
memcached-configuration-additional-options
|
||
|
||
mysql-service
|
||
mysql-service-type
|
||
mysql-configuration
|
||
mysql-configuration?
|
||
|
||
redis-configuration
|
||
redis-configuration?
|
||
redis-service-type))
|
||
|
||
;;; Commentary:
|
||
;;;
|
||
;;; Database services.
|
||
;;;
|
||
;;; Code:
|
||
|
||
(define %default-postgres-hba
|
||
(plain-file "pg_hba.conf"
|
||
"
|
||
local all all peer
|
||
host all all 127.0.0.1/32 md5
|
||
host all all ::1/128 md5"))
|
||
|
||
(define %default-postgres-ident
|
||
(plain-file "pg_ident.conf"
|
||
"# MAPNAME SYSTEM-USERNAME PG-USERNAME"))
|
||
|
||
(define-record-type* <postgresql-config-file>
|
||
postgresql-config-file make-postgresql-config-file
|
||
postgresql-config-file?
|
||
(log-destination postgresql-config-file-log-destination
|
||
(default "syslog"))
|
||
(hba-file postgresql-config-file-hba-file
|
||
(default %default-postgres-hba))
|
||
(ident-file postgresql-config-file-ident-file
|
||
(default %default-postgres-ident))
|
||
(socket-directory postgresql-config-file-socket-directory
|
||
(default "/var/run/postgresql"))
|
||
(extra-config postgresql-config-file-extra-config
|
||
(default '())))
|
||
|
||
(define-gexp-compiler (postgresql-config-file-compiler
|
||
(file <postgresql-config-file>) system target)
|
||
(match file
|
||
(($ <postgresql-config-file> log-destination hba-file
|
||
ident-file socket-directory
|
||
extra-config)
|
||
;; See: https://www.postgresql.org/docs/current/config-setting.html.
|
||
(define (format-value value)
|
||
(cond
|
||
((boolean? value)
|
||
(list (if value "on" "off")))
|
||
((number? value)
|
||
(list (number->string value)))
|
||
(else
|
||
(list "'" value "'"))))
|
||
|
||
(define contents
|
||
(append-map
|
||
(match-lambda
|
||
((key) '())
|
||
((key . #f) '())
|
||
((key values ...)
|
||
`(,key " = " ,@(append-map format-value values) "\n")))
|
||
|
||
`(("log_destination" ,log-destination)
|
||
("hba_file" ,hba-file)
|
||
("ident_file" ,ident-file)
|
||
,@(if socket-directory
|
||
`(("unix_socket_directories" ,socket-directory))
|
||
'())
|
||
,@extra-config)))
|
||
|
||
(gexp->derivation
|
||
"postgresql.conf"
|
||
#~(call-with-output-file (ungexp output "out")
|
||
(lambda (port)
|
||
(display
|
||
(string-append #$@contents)
|
||
port)))
|
||
#:local-build? #t))))
|
||
|
||
(define %default-home-directory "/var/empty")
|
||
|
||
(define-record-type* <postgresql-configuration>
|
||
postgresql-configuration make-postgresql-configuration
|
||
postgresql-configuration?
|
||
;; Setting no default ensures that the user sets its current postgresql
|
||
;; explicitely. Since major upgrades currently require a manual migration
|
||
;; of the database, this way the user is responsible for upgrading properly.
|
||
;; MAYBE TODO: Write an action to automatically upgrade in Guix.
|
||
(postgresql postgresql-configuration-postgresql) ;file-like
|
||
(port postgresql-configuration-port
|
||
(default 5432))
|
||
(locale postgresql-configuration-locale
|
||
(default "en_US.utf8"))
|
||
(config-file postgresql-configuration-file
|
||
(default (postgresql-config-file)))
|
||
(log-directory postgresql-configuration-log-directory
|
||
(default "/var/log/postgresql"))
|
||
(data-directory postgresql-configuration-data-directory
|
||
(default "/var/lib/postgresql/data"))
|
||
(extension-packages postgresql-configuration-extension-packages
|
||
(default '()))
|
||
(create-account? postgresql-configuration-create-account?
|
||
(default #t))
|
||
(home-directory postgresql-configuration-home-directory
|
||
(default %default-home-directory))
|
||
(allow-login? postgresql-configuration-allow-login?
|
||
(default #f))
|
||
(uid postgresql-configuration-uid
|
||
(default #f))
|
||
(gid postgresql-configuration-gid
|
||
(default #f)))
|
||
|
||
(define (create-postgresql-account config)
|
||
(match-record config <postgresql-configuration>
|
||
(create-account? allow-login? home-directory uid gid)
|
||
(if (not create-account?) '()
|
||
(list (user-group
|
||
(name "postgres")
|
||
(id gid)
|
||
(system? #t))
|
||
(user-account
|
||
(name "postgres")
|
||
(group "postgres")
|
||
(system? #t)
|
||
(uid uid)
|
||
(comment "PostgreSQL server user")
|
||
(create-home-directory?
|
||
(not (string=? home-directory %default-home-directory)))
|
||
(home-directory home-directory)
|
||
(shell (if allow-login?
|
||
(default-shell)
|
||
(file-append shadow "/sbin/nologin"))))))))
|
||
|
||
(define (final-postgresql postgresql extension-packages)
|
||
(if (null? extension-packages)
|
||
postgresql
|
||
(package
|
||
(inherit postgresql)
|
||
(source #f)
|
||
(build-system trivial-build-system)
|
||
(arguments
|
||
`(#:modules ((guix build utils) (guix build union))
|
||
#:builder
|
||
(begin
|
||
(use-modules (guix build utils) (guix build union) (srfi srfi-26))
|
||
(union-build (assoc-ref %outputs "out")
|
||
(map (lambda (input) (cdr input))
|
||
%build-inputs))
|
||
#t)))
|
||
(inputs
|
||
`(("postgresql" ,postgresql)
|
||
,@(map (lambda (extension) (list "extension" extension))
|
||
extension-packages))))))
|
||
|
||
(define postgresql-activation
|
||
(match-lambda
|
||
(($ <postgresql-configuration> postgresql port locale config-file
|
||
log-directory data-directory
|
||
extension-packages)
|
||
#~(begin
|
||
(use-modules (guix build utils)
|
||
(ice-9 match))
|
||
|
||
(let ((user (getpwnam "postgres")))
|
||
;; Create the socket directory.
|
||
(let ((socket-directory
|
||
#$(postgresql-config-file-socket-directory config-file)))
|
||
(when (string? socket-directory)
|
||
(mkdir-p socket-directory)
|
||
(chown socket-directory (passwd:uid user) (passwd:gid user))))
|
||
|
||
;; Create the log directory.
|
||
(when (string? #$log-directory)
|
||
(mkdir-p #$log-directory)
|
||
(chown #$log-directory (passwd:uid user) (passwd:gid user)))
|
||
|
||
(unless (file-exists? #$data-directory)
|
||
(let ((initdb (string-append
|
||
#$(final-postgresql postgresql
|
||
extension-packages)
|
||
"/bin/initdb"))
|
||
(initdb-args
|
||
(append
|
||
(if #$locale
|
||
(list (string-append "--locale=" #$locale))
|
||
'()))))
|
||
;; Create db state directory.
|
||
(mkdir-p #$data-directory)
|
||
(chown #$data-directory (passwd:uid user) (passwd:gid user))
|
||
|
||
;; Drop privileges and init state directory in a new
|
||
;; process. Wait for it to finish before proceeding.
|
||
(match (primitive-fork)
|
||
(0
|
||
;; Exit with a non-zero status code if an exception is
|
||
;; thrown.
|
||
(dynamic-wind
|
||
(const #t)
|
||
(lambda ()
|
||
(setgid (passwd:gid user))
|
||
(setuid (passwd:uid user))
|
||
(apply execl initdb
|
||
initdb "-D" #$data-directory
|
||
initdb-args))
|
||
(lambda ()
|
||
(primitive-exit 1))))
|
||
(pid (waitpid pid))))))))))
|
||
|
||
(define postgresql-shepherd-service
|
||
(match-lambda
|
||
(($ <postgresql-configuration> postgresql port locale config-file
|
||
log-directory data-directory
|
||
extension-packages)
|
||
(let* ((pg_ctl-wrapper
|
||
;; Wrapper script that switches to the 'postgres' user before
|
||
;; launching daemon.
|
||
(program-file
|
||
"pg_ctl-wrapper"
|
||
#~(begin
|
||
(use-modules (ice-9 match)
|
||
(ice-9 format))
|
||
(match (command-line)
|
||
((_ mode)
|
||
(let ((user (getpwnam "postgres"))
|
||
(pg_ctl #$(file-append
|
||
(final-postgresql postgresql
|
||
extension-packages)
|
||
"/bin/pg_ctl"))
|
||
(options (format #f "--config-file=~a -p ~d"
|
||
#$config-file #$port)))
|
||
(setgid (passwd:gid user))
|
||
(setuid (passwd:uid user))
|
||
(execl pg_ctl pg_ctl "-D" #$data-directory
|
||
#$@(if (string? log-directory)
|
||
(list "-l"
|
||
(string-append log-directory
|
||
"/pg_ctl.log"))
|
||
'())
|
||
"-o" options
|
||
mode)))))))
|
||
(pid-file (in-vicinity data-directory "postmaster.pid"))
|
||
(action (lambda args
|
||
#~(lambda _
|
||
(invoke #$pg_ctl-wrapper #$@args)
|
||
(match '#$args
|
||
(("start")
|
||
(call-with-input-file #$pid-file read))
|
||
(_ #f))))))
|
||
(list (shepherd-service
|
||
(provision '(postgres postgresql))
|
||
(documentation "Run the PostgreSQL daemon.")
|
||
(requirement '(user-processes loopback syslogd))
|
||
(modules `((ice-9 match)
|
||
,@%default-modules))
|
||
(actions (list (shepherd-configuration-action config-file)))
|
||
(start (action "start"))
|
||
(stop (action "stop"))))))))
|
||
|
||
(define postgresql-service-type
|
||
(service-type
|
||
(name 'postgresql)
|
||
(extensions
|
||
(list (service-extension shepherd-root-service-type
|
||
postgresql-shepherd-service)
|
||
(service-extension activation-service-type
|
||
postgresql-activation)
|
||
(service-extension account-service-type
|
||
create-postgresql-account)
|
||
(service-extension
|
||
profile-service-type
|
||
(compose list postgresql-configuration-postgresql))))
|
||
(description "Run the PostgreSQL database server.")))
|
||
|
||
(define-deprecated (postgresql-service #:key (postgresql postgresql-10)
|
||
(port 5432)
|
||
(locale "en_US.utf8")
|
||
(config-file (postgresql-config-file))
|
||
(data-directory
|
||
"/var/lib/postgresql/data")
|
||
(extension-packages '()))
|
||
postgresql-service-type
|
||
"Return a service that runs @var{postgresql}, the PostgreSQL database
|
||
server.
|
||
|
||
The PostgreSQL daemon loads its runtime configuration from @var{config-file}
|
||
and stores the database cluster in @var{data-directory}."
|
||
(service postgresql-service-type
|
||
(postgresql-configuration
|
||
(postgresql postgresql)
|
||
(port port)
|
||
(locale locale)
|
||
(config-file config-file)
|
||
(data-directory data-directory)
|
||
(extension-packages extension-packages))))
|
||
|
||
(define-record-type* <postgresql-role>
|
||
postgresql-role make-postgresql-role
|
||
postgresql-role?
|
||
(name postgresql-role-name) ;string
|
||
(password-file postgresql-role-password-file ;string
|
||
(default #f))
|
||
(permissions postgresql-role-permissions
|
||
(default '(createdb login))) ;list
|
||
(create-database? postgresql-role-create-database? ;boolean
|
||
(default #f))
|
||
(encoding postgresql-role-encoding ;string
|
||
(default "UTF8"))
|
||
(collation postgresql-role-collation ;string
|
||
(default "en_US.utf8"))
|
||
(ctype postgresql-role-ctype ;string
|
||
(default "en_US.utf8"))
|
||
(template postgresql-role-template ;string
|
||
(default "template1")))
|
||
|
||
(define %default-postgresql-role-shepherd-requirement
|
||
'(user-processes postgres))
|
||
|
||
(define %postgresql-role-runtime-dir
|
||
"/run/postgresql-role")
|
||
|
||
(define-record-type* <postgresql-role-configuration>
|
||
postgresql-role-configuration make-postgresql-role-configuration
|
||
postgresql-role-configuration?
|
||
(shepherd-requirement
|
||
postgresql-role-configuration-shepherd-requirement ;list-of-symbols
|
||
(default %default-postgresql-role-shepherd-requirement))
|
||
(host postgresql-role-configuration-host ;string
|
||
(default "/var/run/postgresql"))
|
||
(log postgresql-role-configuration-log ;string
|
||
(default "/var/log/postgresql_roles.log"))
|
||
(roles postgresql-role-configuration-roles
|
||
(default '()))) ;list
|
||
|
||
(define (postgresql-create-roles config)
|
||
;; See: https://www.postgresql.org/docs/current/sql-createrole.html for the
|
||
;; complete permissions list.
|
||
(define (format-permissions permissions)
|
||
(let ((dict '(bypassrls createdb createrole login replication superuser)))
|
||
(string-join (filter-map (lambda (permission)
|
||
(and (member permission dict)
|
||
(string-upcase
|
||
(symbol->string permission))))
|
||
permissions)
|
||
" ")))
|
||
|
||
(define (role-has-password-file? role)
|
||
(define password-file
|
||
(postgresql-role-password-file role))
|
||
(and (string? password-file)
|
||
(not (string-null? password-file))))
|
||
|
||
(define (roles->queries roles)
|
||
(apply mixed-text-file "queries"
|
||
(append-map
|
||
(lambda (role)
|
||
(match-record role <postgresql-role>
|
||
(name permissions create-database? encoding collation ctype
|
||
template)
|
||
`("SELECT NOT(EXISTS(SELECT 1 FROM pg_catalog.pg_roles WHERE \
|
||
rolname = '" ,name "')) as not_exists;\n"
|
||
"\\gset\n"
|
||
"\\if :not_exists\n"
|
||
"CREATE ROLE \"" ,name "\""
|
||
" WITH " ,(format-permissions permissions)
|
||
";\n"
|
||
,@(if create-database?
|
||
`("CREATE DATABASE \"" ,name "\""
|
||
" OWNER \"" ,name "\"\n"
|
||
" ENCODING '" ,encoding "'\n"
|
||
" LC_COLLATE '" ,collation "'\n"
|
||
" LC_CTYPE '" ,ctype "'\n"
|
||
" TEMPLATE " ,template ";")
|
||
'())
|
||
"\\endif\n")))
|
||
roles)))
|
||
|
||
(let ((host (postgresql-role-configuration-host config))
|
||
(roles (postgresql-role-configuration-roles config)))
|
||
(program-file "run-queries"
|
||
(with-imported-modules (source-module-closure
|
||
'((guix build utils)))
|
||
#~(begin
|
||
(use-modules (guix build utils)
|
||
(ice-9 format)
|
||
(ice-9 match)
|
||
(ice-9 textual-ports)
|
||
(srfi srfi-1))
|
||
(define role->password-statement
|
||
(match-lambda
|
||
(#f "")
|
||
((name file)
|
||
(if (file-exists? file)
|
||
(format
|
||
#f "ALTER ROLE ~a WITH ENCRYPTED PASSWORD '~a';"
|
||
name
|
||
(call-with-input-file file get-string-all))
|
||
(begin
|
||
(format (current-error-port)
|
||
(string-append
|
||
"~a does not exist! ~a's "
|
||
"password will not be set.")
|
||
file name)
|
||
"")))))
|
||
|
||
(define (create-password-query roles)
|
||
(define password-query
|
||
(string-append
|
||
#$%postgresql-role-runtime-dir "/set-passwords.sql"))
|
||
(with-output-to-file password-query
|
||
(lambda _
|
||
(display
|
||
(string-join
|
||
`("BEGIN;"
|
||
;; Avoid leaking unencrypted password in the logs.
|
||
"SET LOCAL log_statement = 'none';"
|
||
,@(map role->password-statement roles)
|
||
"COMMIT;\n")
|
||
"\n"))))
|
||
password-query)
|
||
|
||
(let* ((psql #$(file-append postgresql "/bin/psql"))
|
||
(roles
|
||
(list
|
||
#$@(map
|
||
(lambda (role)
|
||
(and (role-has-password-file? role)
|
||
#~'(#$(postgresql-role-name role)
|
||
#$(postgresql-role-password-file role))))
|
||
roles)))
|
||
(any-password? (any identity roles)))
|
||
|
||
(invoke psql "-a" "-h" #$host "-f" #$(roles->queries roles))
|
||
|
||
(when any-password?
|
||
;; This way passwords do not leak to the command line.
|
||
(let ((password-query (create-password-query roles)))
|
||
(invoke psql "-h" #$host "-f" password-query)
|
||
(delete-file password-query)))))))))
|
||
|
||
(define (postgresql-role-shepherd-service config)
|
||
(match-record config <postgresql-role-configuration>
|
||
(log shepherd-requirement)
|
||
(list (shepherd-service
|
||
(requirement shepherd-requirement)
|
||
(provision '(postgres-roles))
|
||
(one-shot? #t)
|
||
(start
|
||
#~(lambda args
|
||
(zero? (spawn-command
|
||
(list #$(postgresql-create-roles config))
|
||
#:user "postgres"
|
||
#:group "postgres"
|
||
;; XXX: As of Shepherd 1.0.2, #:log-file is not
|
||
;; supported.
|
||
;; #:log-file #$log
|
||
))))
|
||
(documentation "Create PostgreSQL roles.")))))
|
||
|
||
(define %postgresql-role-file-systems
|
||
(list (file-system
|
||
(device "none")
|
||
(mount-point %postgresql-role-runtime-dir)
|
||
(type "tmpfs"))))
|
||
|
||
(define postgresql-role-service-type
|
||
(service-type (name 'postgresql-role)
|
||
(extensions
|
||
(list (service-extension shepherd-root-service-type
|
||
postgresql-role-shepherd-service)
|
||
(service-extension file-system-service-type
|
||
(const %postgresql-role-file-systems))))
|
||
(compose concatenate)
|
||
(extend (lambda (config extended-roles)
|
||
(match-record config <postgresql-role-configuration>
|
||
(host roles)
|
||
(postgresql-role-configuration
|
||
(inherit config)
|
||
(host host)
|
||
(roles (append roles extended-roles))))))
|
||
(default-value (postgresql-role-configuration))
|
||
(description "Ensure the specified PostgreSQL roles are
|
||
created after the PostgreSQL database is started.")))
|
||
|
||
|
||
;;;
|
||
;;; Memcached
|
||
;;;
|
||
|
||
(define-record-type* <memcached-configuration>
|
||
memcached-configuration make-memcached-configuration
|
||
memcached-configuration?
|
||
(memcached memcached-configuration-memcached ;file-like
|
||
(default memcached))
|
||
(interfaces memcached-configuration-interfaces
|
||
(default '("0.0.0.0")))
|
||
(tcp-port memcached-configuration-tcp-port
|
||
(default 11211))
|
||
(udp-port memcached-configuration-udp-port
|
||
(default 11211))
|
||
(additional-options memcached-configuration-additional-options
|
||
(default '())))
|
||
|
||
(define %memcached-accounts
|
||
(list (user-group (name "memcached") (system? #t))
|
||
(user-account
|
||
(name "memcached")
|
||
(group "memcached")
|
||
(system? #t)
|
||
(comment "Memcached server user")
|
||
(home-directory "/var/empty")
|
||
(shell (file-append shadow "/sbin/nologin")))))
|
||
|
||
(define memcached-activation
|
||
#~(begin
|
||
(use-modules (guix build utils))
|
||
(let ((user (getpwnam "memcached")))
|
||
(mkdir-p "/var/run/memcached")
|
||
(chown "/var/run/memcached"
|
||
(passwd:uid user) (passwd:gid user)))))
|
||
|
||
(define memcached-shepherd-service
|
||
(match-lambda
|
||
(($ <memcached-configuration> memcached interfaces tcp-port udp-port
|
||
additional-options)
|
||
(list (shepherd-service
|
||
(provision '(memcached))
|
||
(documentation "Run the Memcached daemon.")
|
||
(requirement '(user-processes loopback))
|
||
(start #~(make-forkexec-constructor
|
||
`(#$(file-append memcached "/bin/memcached")
|
||
"-l" #$(string-join interfaces ",")
|
||
"-p" #$(number->string tcp-port)
|
||
"-U" #$(number->string udp-port)
|
||
"--daemon"
|
||
;; Memcached changes to the memcached user prior to
|
||
;; writing the pid file, so write it to a directory
|
||
;; that memcached owns.
|
||
"-P" "/var/run/memcached/pid"
|
||
"-u" "memcached"
|
||
,#$@additional-options)
|
||
#:log-file "/var/log/memcached"
|
||
#:pid-file "/var/run/memcached/pid"))
|
||
(stop #~(make-kill-destructor)))))))
|
||
|
||
(define memcached-service-type
|
||
(service-type (name 'memcached)
|
||
(extensions
|
||
(list (service-extension shepherd-root-service-type
|
||
memcached-shepherd-service)
|
||
(service-extension activation-service-type
|
||
(const memcached-activation))
|
||
(service-extension account-service-type
|
||
(const %memcached-accounts))))
|
||
(default-value (memcached-configuration))
|
||
(description "Run @command{memcached}, a daemon that provides
|
||
an in-memory caching service, intended for use by dynamic web
|
||
applications.")))
|
||
|
||
|
||
;;;
|
||
;;; MySQL.
|
||
;;;
|
||
|
||
(define-record-type* <mysql-configuration>
|
||
mysql-configuration make-mysql-configuration
|
||
mysql-configuration?
|
||
(mysql mysql-configuration-mysql (default mariadb))
|
||
(bind-address mysql-configuration-bind-address (default "127.0.0.1"))
|
||
(port mysql-configuration-port (default 3306))
|
||
(socket mysql-configuration-socket (default "/run/mysqld/mysqld.sock"))
|
||
(datadir mysql-configuration-datadir (default "/var/lib/mysql"))
|
||
(extra-content mysql-configuration-extra-content (default ""))
|
||
(extra-environment mysql-configuration-extra-environment (default #~'()))
|
||
(auto-upgrade? mysql-configuration-auto-upgrade? (default #t)))
|
||
|
||
(define %mysql-accounts
|
||
(list (user-group
|
||
(name "mysql")
|
||
(system? #t))
|
||
(user-account
|
||
(name "mysql")
|
||
(group "mysql")
|
||
(system? #t)
|
||
(home-directory "/var/empty")
|
||
(shell (file-append shadow "/sbin/nologin")))))
|
||
|
||
(define mysql-configuration-file
|
||
(match-lambda
|
||
(($ <mysql-configuration> mysql bind-address port socket datadir extra-content)
|
||
(mixed-text-file "my.cnf" "[mysqld]
|
||
datadir=" datadir "
|
||
socket=" socket "
|
||
bind-address=" bind-address "
|
||
port=" (number->string port) "
|
||
" extra-content "
|
||
"))))
|
||
|
||
(define (mysqld-wrapper config)
|
||
"Start mysqld, and initialize the system tables if necessary."
|
||
(program-file
|
||
"mysqld-wrapper"
|
||
(with-imported-modules (source-module-closure
|
||
'((guix build utils)))
|
||
(let ((mysql (mysql-configuration-mysql config))
|
||
(datadir (mysql-configuration-datadir config))
|
||
(my.cnf (mysql-configuration-file config)))
|
||
#~(begin
|
||
(use-modules (guix build utils))
|
||
(let* ((mysqld (string-append #$mysql "/bin/mysqld"))
|
||
(user (getpwnam "mysql"))
|
||
(uid (passwd:uid user))
|
||
(gid (passwd:gid user))
|
||
(rundir "/run/mysqld"))
|
||
(mkdir-p #$datadir)
|
||
(chown #$datadir uid gid)
|
||
(mkdir-p rundir)
|
||
(chown rundir uid gid)
|
||
(unless (file-exists? (string-append #$datadir "/mysql"))
|
||
(let ((init (system* #$(mysql-install config))))
|
||
(unless (= 0 (status:exit-val init))
|
||
(throw 'system-error "MySQL initialization failed."))))
|
||
;; Drop privileges and start the server.
|
||
(setgid gid) (setuid uid)
|
||
(execl mysqld mysqld
|
||
(string-append "--defaults-file=" #$my.cnf))))))))
|
||
|
||
(define (mysql-shepherd-service config)
|
||
(list (shepherd-service
|
||
(provision '(mysql))
|
||
(requirement '(user-processes))
|
||
(documentation "Run the MySQL server.")
|
||
(actions (list (shepherd-configuration-action
|
||
(mysql-configuration-file config))))
|
||
(start (let ((mysql (mysql-configuration-mysql config))
|
||
(extra-env (mysql-configuration-extra-environment config))
|
||
(my.cnf (mysql-configuration-file config)))
|
||
#~(make-forkexec-constructor
|
||
(list #$(mysqld-wrapper config))
|
||
#:log-file "/var/log/mysqld.log"
|
||
#:environment-variables #$extra-env)))
|
||
(stop #~(make-kill-destructor)))))
|
||
|
||
(define (mysql-install config)
|
||
"Install MySQL system database and secure the installation."
|
||
(let ((mysql (mysql-configuration-mysql config))
|
||
(my.cnf (mysql-configuration-file config)))
|
||
(program-file
|
||
"mysql-install"
|
||
(with-imported-modules (source-module-closure
|
||
'((guix build utils)))
|
||
#~(begin
|
||
(use-modules (guix build utils))
|
||
;; Make sed, mkdir, uname, etc available for mariadb-install-db.
|
||
(set-path-environment-variable "PATH" '("bin")
|
||
(list #$sed #$coreutils))
|
||
(if (string=? "mariadb" #$(package-name mysql))
|
||
;; For MariaDB.
|
||
(system* #$(file-append mysql "/bin/mariadb-install-db")
|
||
(string-append "--defaults-file=" #$my.cnf)
|
||
"--skip-test-db"
|
||
"--user=mysql")
|
||
;; For MySQL.
|
||
(system* #$(file-append mysql "/bin/mysqld")
|
||
(string-append "--defaults-file=" #$my.cnf)
|
||
"--initialize"
|
||
"--user=mysql")))))))
|
||
|
||
(define (mysql-upgrade-wrapper config)
|
||
;; The MySQL socket and PID file may appear before the server is ready to
|
||
;; accept connections. Ensure the socket is responsive before attempting
|
||
;; to run the upgrade script.
|
||
(let ((mysql (mysql-configuration-mysql config))
|
||
(socket-file (mysql-configuration-socket config))
|
||
(config-file (mysql-configuration-file config)))
|
||
(program-file
|
||
"mysql-upgrade-wrapper"
|
||
#~(begin
|
||
(let ((mysql-upgrade #$(file-append mysql "/bin/mysql_upgrade"))
|
||
(timeout 20))
|
||
(begin
|
||
(let loop ((i 0))
|
||
(catch 'system-error
|
||
(lambda ()
|
||
(let ((sock (socket PF_UNIX SOCK_STREAM 0)))
|
||
(connect sock AF_UNIX #$socket-file)
|
||
(close-port sock)
|
||
;; The socket is ready!
|
||
(execl mysql-upgrade mysql-upgrade
|
||
(string-append "--defaults-file=" #$config-file)
|
||
"--user=mysql")))
|
||
(lambda args
|
||
(if (< i timeout)
|
||
(begin
|
||
(sleep 1)
|
||
(loop (+ 1 i)))
|
||
;; No luck, give up.
|
||
(throw 'timeout-error
|
||
"MySQL server did not appear in time!")))))))))))
|
||
|
||
(define (mysql-upgrade-shepherd-service config)
|
||
(list (shepherd-service
|
||
(provision '(mysql-upgrade))
|
||
(requirement '(mysql))
|
||
(one-shot? #t)
|
||
(documentation "Upgrade MySQL database schemas.")
|
||
(start #~(make-forkexec-constructor
|
||
(list #$(mysql-upgrade-wrapper config))
|
||
#:user "mysql" #:group "mysql"
|
||
#:log-file "/var/log/mysql_upgrade.log")))))
|
||
|
||
(define (mysql-shepherd-services config)
|
||
(let ((mysql-services (mysql-shepherd-service config)))
|
||
(if (mysql-configuration-auto-upgrade? config)
|
||
(append mysql-services
|
||
(mysql-upgrade-shepherd-service config))
|
||
mysql-services)))
|
||
|
||
(define mysql-service-type
|
||
(service-type
|
||
(name 'mysql)
|
||
(extensions
|
||
(list (service-extension account-service-type
|
||
(const %mysql-accounts))
|
||
(service-extension shepherd-root-service-type
|
||
mysql-shepherd-services)))
|
||
(default-value (mysql-configuration))
|
||
(description "Run the MySQL or MariaDB database server,
|
||
@command{mysqld}.")))
|
||
|
||
(define-deprecated (mysql-service #:key (config (mysql-configuration)))
|
||
mysql-service-type
|
||
(service mysql-service-type config))
|
||
|
||
|
||
;;;
|
||
;;; Redis
|
||
;;;
|
||
|
||
(define-maybe string)
|
||
|
||
(define (uglify-field-name field-name)
|
||
(string-delete #\? (symbol->string field-name)))
|
||
|
||
(define (serialize-field field-name val)
|
||
#~(format #f "~a=~a\n" #$(uglify-field-name field-name) #$val))
|
||
|
||
(define serialize-string serialize-field)
|
||
(define serialize-number serialize-field)
|
||
|
||
(define-configuration redis-configuration
|
||
(redis (package redis)
|
||
"The Redis package to use.")
|
||
(bind (string "127.0.0.1")
|
||
"Network interface on which to listen.")
|
||
(port (number 6379)
|
||
"Port on which to accept connections on,
|
||
a value of 0 will disable listening on a TCP socket.")
|
||
(working-directory (string "/var/lib/redis")
|
||
"Directory in which to store the
|
||
database and related files.")
|
||
(config-file maybe-string "Default location for config file."))
|
||
|
||
(define (default-redis.conf bind port working-directory)
|
||
(mixed-text-file "redis.conf"
|
||
"bind " bind "\n"
|
||
"port " (number->string port) "\n"
|
||
"dir " working-directory "\n"
|
||
"daemonize no\n"))
|
||
|
||
(define %redis-accounts
|
||
(list (user-group (name "redis") (system? #t))
|
||
(user-account
|
||
(name "redis")
|
||
(group "redis")
|
||
(system? #t)
|
||
(comment "Redis server user")
|
||
(home-directory "/var/empty")
|
||
(shell (file-append shadow "/sbin/nologin")))))
|
||
|
||
(define redis-activation
|
||
(match-lambda
|
||
(($ <redis-configuration> redis bind port working-directory config-file)
|
||
#~(begin
|
||
(use-modules (guix build utils)
|
||
(ice-9 match))
|
||
|
||
(let ((user (getpwnam "redis")))
|
||
(mkdir-p #$working-directory)
|
||
(chown #$working-directory (passwd:uid user) (passwd:gid user)))))))
|
||
|
||
(define redis-shepherd-service
|
||
(match-lambda
|
||
(($ <redis-configuration> redis bind port working-directory config-file)
|
||
(let ((config-file
|
||
(if (maybe-value-set? config-file)
|
||
config-file
|
||
(default-redis.conf bind port working-directory))))
|
||
(list (shepherd-service
|
||
(provision '(redis))
|
||
(documentation "Run the Redis daemon.")
|
||
(requirement '(user-processes syslogd))
|
||
(actions (list (shepherd-configuration-action config-file)))
|
||
(start #~(make-forkexec-constructor
|
||
'(#$(file-append redis "/bin/redis-server")
|
||
#$config-file)
|
||
#:user "redis"
|
||
#:group "redis"))
|
||
(stop #~(make-kill-destructor))))))))
|
||
|
||
(define redis-service-type
|
||
(service-type (name 'redis)
|
||
(extensions
|
||
(list (service-extension shepherd-root-service-type
|
||
redis-shepherd-service)
|
||
(service-extension activation-service-type
|
||
redis-activation)
|
||
(service-extension account-service-type
|
||
(const %redis-accounts))))
|
||
(default-value (redis-configuration))
|
||
(description "Run Redis, a caching key/value store.")))
|
||
|
||
;;;
|
||
;;; Generate documentation.
|
||
;;;
|
||
(define (redis-generate-doc)
|
||
(configuration->documentation 'redis-configuration))
|