1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2013-2022 Ludovic Courtès <ludo@gnu.org>
3 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
4 ;;; Copyright © 2016, 2018, 2020 Efraim Flashner <efraim@flashner.co.il>
5 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
6 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
7 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
8 ;;; Copyright © 2017, 2018 Marius Bakke <mbakke@fastmail.com>
9 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
10 ;;; Copyright © 2018 Chris Marusich <cmmarusich@gmail.com>
11 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
12 ;;; Copyright © 2019 Florian Pelz <pelzflorian@pelzflorian.de>
13 ;;; Copyright © 2019, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
14 ;;; Copyright © 2019 Sou Bunnbu <iyzsong@member.fsf.org>
15 ;;; Copyright © 2019 Alex Griffin <a@ajgrf.com>
16 ;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
17 ;;; Copyright © 2021 Oleg Pykhalov <go.wigust@gmail.com>
18 ;;; Copyright © 2021 Christine Lemmer-Webber <cwebber@dustycloud.org>
19 ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
20 ;;; Copyright © 2021 Guillaume Le Vaillant <glv@posteo.net>
22 ;;; This file is part of GNU Guix.
24 ;;; GNU Guix is free software; you can redistribute it and/or modify it
25 ;;; under the terms of the GNU General Public License as published by
26 ;;; the Free Software Foundation; either version 3 of the License, or (at
27 ;;; your option) any later version.
29 ;;; GNU Guix is distributed in the hope that it will be useful, but
30 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
31 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
32 ;;; GNU General Public License for more details.
34 ;;; You should have received a copy of the GNU General Public License
35 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
37 (define-module (gnu services networking)
38 #:use-module (gnu services)
39 #:use-module (gnu services base)
40 #:use-module (gnu services configuration)
41 #:use-module (gnu services linux)
42 #:use-module (gnu services shepherd)
43 #:use-module (gnu services dbus)
44 #:use-module (gnu services admin)
45 #:use-module (gnu system shadow)
46 #:use-module (gnu system pam)
47 #:use-module ((gnu system file-systems) #:select (file-system-mapping))
48 #:use-module (gnu packages admin)
49 #:use-module (gnu packages base)
50 #:use-module (gnu packages bash)
51 #:use-module (gnu packages cluster)
52 #:use-module (gnu packages connman)
53 #:use-module (gnu packages freedesktop)
54 #:use-module (gnu packages linux)
55 #:use-module (gnu packages tor)
56 #:use-module (gnu packages usb-modeswitch)
57 #:use-module (gnu packages messaging)
58 #:use-module (gnu packages networking)
59 #:use-module (gnu packages ntp)
60 #:use-module (gnu packages gnome)
61 #:use-module (gnu packages ipfs)
62 #:use-module (gnu build linux-container)
63 #:autoload (guix least-authority) (least-authority-wrapper)
64 #:use-module (guix gexp)
65 #:use-module (guix records)
66 #:use-module (guix modules)
67 #:use-module (guix packages)
68 #:use-module (guix deprecation)
69 #:use-module (guix diagnostics)
70 #:autoload (guix ui) (display-hint)
71 #:use-module (guix i18n)
72 #:use-module (rnrs enums)
73 #:use-module (srfi srfi-1)
74 #:use-module (srfi srfi-9)
75 #:use-module (srfi srfi-26)
76 #:use-module (srfi srfi-43)
77 #:use-module (ice-9 match)
79 #:re-export (static-networking-service
80 static-networking-service-type)
81 #:export (%facebook-host-aliases
82 dhcp-client-service-type
83 dhcp-client-configuration
84 dhcp-client-configuration?
85 dhcp-client-configuration-package
86 dhcp-client-configuration-interfaces
91 dhcpd-configuration-package
92 dhcpd-configuration-config-file
93 dhcpd-configuration-version
94 dhcpd-configuration-run-directory
95 dhcpd-configuration-lease-file
96 dhcpd-configuration-pid-file
97 dhcpd-configuration-interfaces
101 ntp-configuration-ntp
102 ntp-configuration-servers
103 ntp-allow-large-adjustment?
114 openntpd-configuration
115 openntpd-configuration?
116 openntpd-service-type
122 opendht-configuration
123 opendht-configuration-peer-discovery?
124 opendht-configuration-verbose?
125 opendht-configuration-bootstrap-host
126 opendht-configuration-port
127 opendht-configuration-proxy-server-port
128 opendht-configuration-proxy-server-port-tls
129 opendht-configuration->command-line-arguments
131 opendht-shepherd-service
139 network-manager-configuration
140 network-manager-configuration?
141 network-manager-configuration-dns
142 network-manager-configuration-vpn-plugins
143 network-manager-service-type
145 connman-configuration
146 connman-configuration?
149 modem-manager-configuration
150 modem-manager-configuration?
151 modem-manager-service-type
153 usb-modeswitch-configuration
154 usb-modeswitch-configuration?
155 usb-modeswitch-configuration-usb-modeswitch
156 usb-modeswitch-configuration-usb-modeswitch-data
157 usb-modeswitch-service-type
159 wpa-supplicant-configuration
160 wpa-supplicant-configuration?
161 wpa-supplicant-configuration-wpa-supplicant
162 wpa-supplicant-configuration-requirement
163 wpa-supplicant-configuration-pid-file
164 wpa-supplicant-configuration-dbus?
165 wpa-supplicant-configuration-interface
166 wpa-supplicant-configuration-config-file
167 wpa-supplicant-configuration-extra-options
168 wpa-supplicant-service-type
170 hostapd-configuration
171 hostapd-configuration?
172 hostapd-configuration-package
173 hostapd-configuration-interface
174 hostapd-configuration-ssid
175 hostapd-configuration-broadcast-ssid?
176 hostapd-configuration-channel
177 hostapd-configuration-driver
180 simulated-wifi-service-type
182 openvswitch-service-type
183 openvswitch-configuration
185 iptables-configuration
186 iptables-configuration?
187 iptables-configuration-iptables
188 iptables-configuration-ipv4-rules
189 iptables-configuration-ipv6-rules
190 iptables-service-type
192 nftables-service-type
193 nftables-configuration
194 nftables-configuration?
195 nftables-configuration-package
196 nftables-configuration-ruleset
197 %default-nftables-ruleset
199 pagekite-service-type
200 pagekite-configuration
201 pagekite-configuration?
202 pagekite-configuration-package
203 pagekite-configuration-kitename
204 pagekite-configuration-kitesecret
205 pagekite-configuration-frontend
206 pagekite-configuration-kites
207 pagekite-configuration-extra-file
209 yggdrasil-service-type
210 yggdrasil-configuration
211 yggdrasil-configuration?
212 yggdrasil-configuration-autoconf?
213 yggdrasil-configuration-config-file
214 yggdrasil-configuration-log-level
215 yggdrasil-configuration-log-to
216 yggdrasil-configuration-json-config
217 yggdrasil-configuration-package
222 ipfs-configuration-package
223 ipfs-configuration-gateway
224 ipfs-configuration-api
226 keepalived-configuration
227 keepalived-configuration?
228 keepalived-service-type))
232 ;;; Networking services.
236 (define %facebook-host-aliases
237 ;; This is the list of known Facebook hosts to be added to /etc/hosts if you
240 # Block Facebook IPv4.
241 127.0.0.1 www.facebook.com
242 127.0.0.1 facebook.com
243 127.0.0.1 login.facebook.com
244 127.0.0.1 www.login.facebook.com
246 127.0.0.1 www.fbcdn.net
248 127.0.0.1 www.fbcdn.com
249 127.0.0.1 static.ak.fbcdn.net
250 127.0.0.1 static.ak.connect.facebook.com
251 127.0.0.1 connect.facebook.net
252 127.0.0.1 www.connect.facebook.net
253 127.0.0.1 apps.facebook.com
255 # Block Facebook IPv6.
256 fe80::1%lo0 facebook.com
257 fe80::1%lo0 login.facebook.com
258 fe80::1%lo0 www.login.facebook.com
259 fe80::1%lo0 fbcdn.net
260 fe80::1%lo0 www.fbcdn.net
261 fe80::1%lo0 fbcdn.com
262 fe80::1%lo0 www.fbcdn.com
263 fe80::1%lo0 static.ak.fbcdn.net
264 fe80::1%lo0 static.ak.connect.facebook.com
265 fe80::1%lo0 connect.facebook.net
266 fe80::1%lo0 www.connect.facebook.net
267 fe80::1%lo0 apps.facebook.com\n")
270 (define-record-type* <dhcp-client-configuration>
271 dhcp-client-configuration make-dhcp-client-configuration
272 dhcp-client-configuration?
273 (package dhcp-client-configuration-package ;file-like
275 (interfaces dhcp-client-configuration-interfaces
276 (default 'all))) ;'all | list of strings
278 (define dhcp-client-shepherd-service
280 (($ <dhcp-client-configuration> package interfaces)
281 (let ((pid-file "/var/run/dhclient.pid"))
282 (list (shepherd-service
283 (documentation "Set up networking via DHCP.")
284 (requirement '(user-processes udev))
286 ;; XXX: Running with '-nw' ("no wait") avoids blocking for a minute when
287 ;; networking is unavailable, but also means that the interface is not up
288 ;; yet when 'start' completes. To wait for the interface to be ready, one
289 ;; should instead monitor udev events.
290 (provision '(networking))
294 (string-append #$package "/sbin/dhclient"))
296 ;; When invoked without any arguments, 'dhclient' discovers all
297 ;; non-loopback interfaces *that are up*. However, the relevant
298 ;; interfaces are typically down at this point. Thus we perform
299 ;; our own interface discovery here.
302 (and (arp-network-interface? interface)
303 (not (loopback-network-interface? interface))
304 ;; XXX: Make sure the interfaces are up so that
305 ;; 'dhclient' can actually send/receive over them.
306 ;; Ignore those that cannot be activated.
308 (set-network-interface-up interface)))))
313 #~(all-network-interface-names))
317 (false-if-exception (delete-file #$pid-file))
318 (let ((pid (fork+exec-command
319 (cons* dhclient "-nw"
320 "-pf" #$pid-file ifaces))))
321 (and (zero? (cdr (waitpid pid)))
322 (read-pid-file #$pid-file)))))
323 (stop #~(make-kill-destructor))))))
325 (warning (G_ "'dhcp-client' service now expects a \
326 'dhcp-client-configuration' record~%"))
327 (display-hint (G_ "The value associated with instances of
328 @code{dhcp-client-service-type} must now be a @code{dhcp-client-configuration}
329 record instead of a package. Please adjust your configuration accordingly."))
330 (dhcp-client-shepherd-service
331 (dhcp-client-configuration
332 (package package))))))
334 (define dhcp-client-service-type
335 (service-type (name 'dhcp-client)
337 (list (service-extension shepherd-root-service-type
338 dhcp-client-shepherd-service)))
339 (default-value (dhcp-client-configuration))
340 (description "Run @command{dhcp}, a Dynamic Host Configuration
341 Protocol (DHCP) client, on all the non-loopback network interfaces.")))
343 (define-record-type* <dhcpd-configuration>
344 dhcpd-configuration make-dhcpd-configuration
346 (package dhcpd-configuration-package ;file-like
348 (config-file dhcpd-configuration-config-file ;file-like
350 (version dhcpd-configuration-version ;"4", "6", or "4o6"
352 (run-directory dhcpd-configuration-run-directory
353 (default "/run/dhcpd"))
354 (lease-file dhcpd-configuration-lease-file
355 (default "/var/db/dhcpd.leases"))
356 (pid-file dhcpd-configuration-pid-file
357 (default "/run/dhcpd/dhcpd.pid"))
358 ;; list of strings, e.g. (list "enp0s25")
359 (interfaces dhcpd-configuration-interfaces
362 (define dhcpd-shepherd-service
364 (($ <dhcpd-configuration> package config-file version run-directory
365 lease-file pid-file interfaces)
367 (error "Must supply a config-file"))
368 (list (shepherd-service
369 ;; Allow users to easily run multiple versions simultaneously.
370 (provision (list (string->symbol
371 (string-append "dhcpv" version "-daemon"))))
372 (documentation (string-append "Run the DHCPv" version " daemon"))
373 (requirement '(networking))
374 (start #~(make-forkexec-constructor
375 '(#$(file-append package "/sbin/dhcpd")
376 #$(string-append "-" version)
381 #:pid-file #$pid-file))
382 (stop #~(make-kill-destructor)))))))
384 (define dhcpd-activation
386 (($ <dhcpd-configuration> package config-file version run-directory
387 lease-file pid-file interfaces)
388 (with-imported-modules '((guix build utils))
390 (unless (file-exists? #$run-directory)
391 (mkdir #$run-directory))
392 ;; According to the DHCP manual (man dhcpd.leases), the lease
393 ;; database must be present for dhcpd to start successfully.
394 (unless (file-exists? #$lease-file)
395 (with-output-to-file #$lease-file
396 (lambda _ (display ""))))
397 ;; Validate the config.
399 #$(file-append package "/sbin/dhcpd")
400 #$(string-append "-" version)
401 "-t" "-cf" #$config-file))))))
403 (define dhcpd-service-type
407 (list (service-extension shepherd-root-service-type dhcpd-shepherd-service)
408 (service-extension activation-service-type dhcpd-activation)))
409 (description "Run a DHCP (Dynamic Host Configuration Protocol) daemon. The
410 daemon is responsible for allocating IP addresses to its client.")))
418 (define %ntp-log-rotation
420 (files '("/var/log/ntpd.log")))))
422 (define ntp-server-types (make-enumeration
429 (define-record-type* <ntp-server>
430 ntp-server make-ntp-server
432 ;; The type can be one of the symbols of the NTP-SERVER-TYPE? enumeration.
433 (type ntp-server-type
435 (address ntp-server-address) ; a string
436 ;; The list of options can contain single option names or tuples in the form
438 (options ntp-server-options
441 (define (ntp-server->string ntp-server)
442 ;; Serialize the NTP server object as a string, ready to use in the NTP
443 ;; configuration file.
444 (define (flatten lst)
450 (cons (format #f "~a" x) res)))))
453 (($ <ntp-server> type address options)
454 ;; XXX: It'd be neater if fields were validated at the syntax level (for
455 ;; static ones at least). Perhaps the Guix record type could support a
456 ;; predicate property on a field?
457 (unless (enum-set-member? type ntp-server-types)
458 (error "Invalid NTP server type" type))
459 (string-join (cons* (symbol->string type)
461 (flatten options))))))
464 ;; Default set of NTP servers. These URLs are managed by the NTP Pool project.
465 ;; Within Guix, Leo Famulari <leo@famulari.name> is the administrative contact
466 ;; for this NTP pool "zone".
467 ;; The full list of available URLs are 0.guix.pool.ntp.org,
468 ;; 1.guix.pool.ntp.org, 2.guix.pool.ntp.org, and 3.guix.pool.ntp.org.
472 (address "0.guix.pool.ntp.org")
473 (options '("iburst"))))) ;as recommended in the ntpd manual
475 (define-record-type* <ntp-configuration>
476 ntp-configuration make-ntp-configuration
478 (ntp ntp-configuration-ntp
480 (servers %ntp-configuration-servers ;list of <ntp-server> objects
481 (default %ntp-servers))
482 (allow-large-adjustment? ntp-allow-large-adjustment?
483 (default #t))) ;as recommended in the ntpd manual
485 (define (ntp-configuration-servers ntp-configuration)
486 ;; A wrapper to support the deprecated form of this field.
487 (let ((ntp-servers (%ntp-configuration-servers ntp-configuration)))
489 (((? string?) (? string?) ...)
490 (format (current-error-port) "warning: Defining NTP servers as strings is \
491 deprecated. Please use <ntp-server> records instead.\n")
496 (options '()))) ntp-servers))
497 ((($ <ntp-server>) ($ <ntp-server>) ...)
500 (define ntp-shepherd-service
503 (($ <ntp-configuration> ntp servers allow-large-adjustment?)
504 (let ((servers (ntp-configuration-servers config)))
505 ;; TODO: Add authentication support.
507 (string-append "driftfile /var/run/ntpd/ntp.drift\n"
508 (string-join (map ntp-server->string servers)
511 # Disable status queries as a workaround for CVE-2013-5211:
512 # <http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using>.
513 restrict default kod nomodify notrap nopeer noquery limited
514 restrict -6 default kod nomodify notrap nopeer noquery limited
516 # Yet, allow use of the local 'ntpq'.
520 # This is required to use servers from a pool directive when using the 'nopeer'
521 # option by default, as documented in the 'ntp.conf' manual.
522 restrict source notrap nomodify noquery\n"))
525 (plain-file "ntpd.conf" config))
527 (list (shepherd-service
529 (documentation "Run the Network Time Protocol (NTP) daemon.")
530 (requirement '(user-processes networking))
531 (start #~(make-forkexec-constructor
532 (list (string-append #$ntp "/bin/ntpd") "-n"
533 "-c" #$ntpd.conf "-u" "ntpd"
534 #$@(if allow-large-adjustment?
537 #:log-file "/var/log/ntpd.log"))
538 (stop #~(make-kill-destructor)))))))))
540 (define %ntp-accounts
545 (comment "NTP daemon user")
546 (home-directory "/var/empty")
547 (shell (file-append shadow "/sbin/nologin")))))
550 (define (ntp-service-activation config)
551 "Return the activation gexp for CONFIG."
552 (with-imported-modules '((guix build utils))
554 (use-modules (guix build utils))
558 (let ((directory "/var/run/ntpd"))
560 (chown directory (passwd:uid %user) (passwd:gid %user))))))
562 (define ntp-service-type
563 (service-type (name 'ntp)
565 (list (service-extension shepherd-root-service-type
566 ntp-shepherd-service)
567 (service-extension account-service-type
568 (const %ntp-accounts))
569 (service-extension activation-service-type
570 ntp-service-activation)
571 (service-extension rottlog-service-type
572 (const %ntp-log-rotation))))
574 "Run the @command{ntpd}, the Network Time Protocol (NTP)
575 daemon of the @uref{http://www.ntp.org, Network Time Foundation}. The daemon
576 will keep the system clock synchronized with that of the given servers.")
577 (default-value (ntp-configuration))))
584 (define %openntpd-servers
585 (map ntp-server-address %ntp-servers))
587 (define-record-type* <openntpd-configuration>
588 openntpd-configuration make-openntpd-configuration
589 openntpd-configuration?
590 (openntpd openntpd-configuration-openntpd
592 (listen-on openntpd-listen-on
593 (default '("127.0.0.1"
595 (query-from openntpd-query-from
597 (sensor openntpd-sensor
599 (server openntpd-server
601 (servers openntpd-servers
602 (default %openntpd-servers))
603 (constraint-from openntpd-constraint-from
605 (constraints-from openntpd-constraints-from
608 (define (openntpd-configuration->string config)
610 (define (quote-field? name)
611 (member name '("constraints from")))
613 (match-record config <openntpd-configuration>
614 (listen-on query-from sensor server servers constraint-from
619 (filter-map (lambda (field values)
621 (() #f) ;discard entry with filter-map
622 ((val ...) ;validate value type
624 (if (quote-field? field)
625 (format #f "~a \"~a\"" field value)
626 (format #f "~a ~a" field value)))
629 '("listen on" "query from" "sensor" "server" "servers"
630 "constraint from" "constraints from")
631 ;; The corresponding entry values.
632 (list listen-on query-from sensor server servers
633 constraint-from constraints-from)))
635 "\n"))) ;add a trailing newline
637 (define (openntpd-shepherd-service config)
638 (let ((openntpd (openntpd-configuration-openntpd config)))
641 (plain-file "ntpd.conf" (openntpd-configuration->string config)))
643 (list (shepherd-service
645 (documentation "Run the Network Time Protocol (NTP) daemon.")
646 (requirement '(user-processes networking))
647 (start #~(make-forkexec-constructor
648 (list (string-append #$openntpd "/sbin/ntpd")
650 "-d") ;; don't daemonize
651 ;; When ntpd is daemonized it repeatedly tries to respawn
652 ;; while running, leading shepherd to disable it. To
653 ;; prevent spamming stderr, redirect output to logfile.
654 #:log-file "/var/log/ntpd.log"))
655 (stop #~(make-kill-destructor))))))
657 (define (openntpd-service-activation config)
658 "Return the activation gexp for CONFIG."
659 (with-imported-modules '((guix build utils))
661 (use-modules (guix build utils))
665 (unless (file-exists? "/var/db/ntpd.drift")
666 (with-output-to-file "/var/db/ntpd.drift"
668 (format #t "0.0")))))))
670 (define openntpd-service-type
671 (service-type (name 'openntpd)
673 (list (service-extension shepherd-root-service-type
674 openntpd-shepherd-service)
675 (service-extension account-service-type
676 (const %ntp-accounts))
677 (service-extension profile-service-type
678 (compose list openntpd-configuration-openntpd))
679 (service-extension activation-service-type
680 openntpd-service-activation)
681 (service-extension rottlog-service-type
682 (const %ntp-log-rotation))))
683 (default-value (openntpd-configuration))
685 "Run the @command{ntpd}, the Network Time Protocol (NTP)
686 daemon, as implemented by @uref{http://www.openntpd.org, OpenNTPD}. The
687 daemon will keep the system clock synchronized with that of the given servers.")))
694 (define-record-type* <inetd-configuration> inetd-configuration
695 make-inetd-configuration
697 (program inetd-configuration-program ;file-like
698 (default (file-append inetutils "/libexec/inetd")))
699 (entries inetd-configuration-entries ;list of <inetd-entry>
702 (define-record-type* <inetd-entry> inetd-entry make-inetd-entry
704 (node inetd-entry-node ;string or #f
706 (name inetd-entry-name) ;string, from /etc/services
708 (socket-type inetd-entry-socket-type) ;stream | dgram | raw |
710 (protocol inetd-entry-protocol) ;string, from /etc/protocols
712 (wait? inetd-entry-wait? ;Boolean
714 (user inetd-entry-user) ;string
716 (program inetd-entry-program ;string or file-like object
717 (default "internal"))
718 (arguments inetd-entry-arguments ;list of strings or file-like objects
721 (define (inetd-config-file entries)
722 (apply mixed-text-file "inetd.conf"
725 (let* ((node (inetd-entry-node entry))
726 (name (inetd-entry-name entry))
728 (if node (string-append node ":" name) name))
730 (match (inetd-entry-socket-type entry)
731 ((or 'stream 'dgram 'raw 'rdm 'seqpacket)
732 (symbol->string (inetd-entry-socket-type entry)))))
733 (protocol (inetd-entry-protocol entry))
734 (wait (if (inetd-entry-wait? entry) "wait" "nowait"))
735 (user (inetd-entry-user entry))
736 (program (inetd-entry-program entry))
737 (args (inetd-entry-arguments entry)))
740 (list #$@(list socket type protocol wait user program) #$@args)
744 (define inetd-shepherd-service
746 (($ <inetd-configuration> program ()) '()) ; empty list of entries -> do nothing
747 (($ <inetd-configuration> program entries)
750 (documentation "Run inetd.")
752 (requirement '(user-processes networking syslogd))
753 (start #~(make-forkexec-constructor
754 (list #$program #$(inetd-config-file entries))
755 #:pid-file "/var/run/inetd.pid"))
756 (stop #~(make-kill-destructor)))))))
758 (define-public inetd-service-type
762 (list (service-extension shepherd-root-service-type
763 inetd-shepherd-service)))
765 ;; The service can be extended with additional lists of entries.
766 (compose concatenate)
767 (extend (lambda (config entries)
770 (entries (append (inetd-configuration-entries config)
773 "Start @command{inetd}, the @dfn{Internet superserver}. It is responsible
774 for listening on Internet sockets and spawning the corresponding services on
779 ;;; OpenDHT, the distributed hash table network used by Jami
782 (define-maybe/no-serialization number)
783 (define-maybe/no-serialization string)
785 ;;; To generate the documentation of the following configuration record, you
786 ;;; can evaluate: (configuration->documentation 'opendht-configuration)
787 (define-configuration/no-serialization opendht-configuration
790 "The @code{opendht} package to use.")
793 "Whether to enable the multicast local peer discovery mechanism.")
796 "Whether to enable logging messages to syslog. It is disabled by default
797 as it is rather verbose.")
800 "Whether to enable debug-level logging messages. This has no effect if
801 logging is disabled.")
803 (maybe-string "bootstrap.jami.net:4222")
804 "The node host name that is used to make the first connection to the
805 network. A specific port value can be provided by appending the @code{:PORT}
806 suffix. By default, it uses the Jami bootstrap nodes, but any host can be
807 specified here. It's also possible to disable bootstrapping by explicitly
808 setting this field to @code{%unset-value}.")
811 "The UDP port to bind to. When left unspecified, an available port is
812 automatically selected.")
815 "Spawn a proxy server listening on the specified port.")
816 (proxy-server-port-tls
818 "Spawn a proxy server listening to TLS connections on the specified
821 (define %opendht-accounts
822 ;; User account and groups for Tor.
823 (list (user-group (name "opendht") (system? #t))
828 (comment "OpenDHT daemon user")
829 (home-directory "/var/empty")
830 (shell (file-append shadow "/sbin/nologin")))))
832 (define (opendht-configuration->command-line-arguments config)
833 "Derive the command line arguments used to launch the OpenDHT daemon from
834 CONFIG, an <opendht-configuration> object."
835 (match-record config <opendht-configuration>
836 (opendht bootstrap-host enable-logging? port debug? peer-discovery?
837 proxy-server-port proxy-server-port-tls)
838 (let ((dhtnode (least-authority-wrapper
839 ;; XXX: Work around lack of support for multiple outputs
841 (computed-file "dhtnode"
843 (string-append #$opendht:tools
847 #:mappings (list (file-system-mapping
848 (source "/dev/log") ;for syslog
850 #:namespaces (delq 'net %namespaces))))
852 "--service" ;non-forking mode
853 ,@(if (string? bootstrap-host)
854 (list "--bootstrap" bootstrap-host))
855 ,@(if enable-logging?
859 (list "--port" (number->string port))
864 ,@(if peer-discovery?
865 (list "--peer-discovery")
867 ,@(if (number? proxy-server-port)
868 (list "--proxyserver" (number->string proxy-server-port))
870 ,@(if (number? proxy-server-port-tls)
871 (list "--proxyserverssl" (number->string proxy-server-port-tls))
874 (define (opendht-shepherd-service config)
875 "Return a <shepherd-service> running OpenDHT."
877 (documentation "Run an OpenDHT node.")
878 (provision '(opendht dhtnode dhtproxy))
879 (requirement '(networking syslogd))
880 (start #~(make-forkexec-constructor
881 (list #$@(opendht-configuration->command-line-arguments config))
884 (stop #~(make-kill-destructor))))
886 (define opendht-service-type
889 (default-value (opendht-configuration))
891 (list (service-extension shepherd-root-service-type
892 (compose list opendht-shepherd-service))
893 (service-extension account-service-type
894 (const %opendht-accounts))))
895 (description "Run the OpenDHT @command{dhtnode} command that allows
896 participating in the distributed hash table based OpenDHT network. The
897 service can be configured to act as a proxy to the distributed network, which
898 can be useful for portable devices where minimizing energy consumption is
899 paramount. OpenDHT was originally based on Kademlia and adapted for
900 applications in communication. It is used by Jami, for example.")))
907 (define-record-type* <tor-configuration>
908 tor-configuration make-tor-configuration
910 (tor tor-configuration-tor
912 (config-file tor-configuration-config-file
913 (default (plain-file "empty" "")))
914 (hidden-services tor-configuration-hidden-services
916 (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
918 (control-socket? tor-control-socket-path
921 (define %tor-accounts
922 ;; User account and groups for Tor.
923 (list (user-group (name "tor") (system? #t))
928 (comment "Tor daemon user")
929 (home-directory "/var/empty")
930 (shell (file-append shadow "/sbin/nologin")))))
932 (define-record-type <hidden-service>
933 (hidden-service name mapping)
935 (name hidden-service-name) ;string
936 (mapping hidden-service-mapping)) ;list of port/address tuples
938 (define (tor-configuration->torrc config)
939 "Return a 'torrc' file for CONFIG."
941 (($ <tor-configuration> tor config-file services
942 socks-socket-type control-socket?)
945 (with-imported-modules '((guix build utils))
947 (use-modules (guix build utils)
950 (call-with-output-file #$output
953 ### These lines were generated from your system configuration:
954 DataDirectory /var/lib/tor
955 Log notice syslog\n" port)
956 (when (eq? 'unix '#$socks-socket-type)
958 SocksPort unix:/var/run/tor/socks-sock
959 UnixSocksGroupWritable 1\n" port))
960 (when #$control-socket?
962 ControlSocket unix:/var/run/tor/control-sock GroupWritable RelaxDirModeCheck
963 ControlSocketsGroupWritable 1\n"
966 (for-each (match-lambda
967 ((service (ports hosts) ...)
969 HiddenServiceDir /var/lib/tor/hidden-services/~a~%"
971 (for-each (lambda (tcp-port host)
973 HiddenServicePort ~a ~a~%"
976 '#$(map (match-lambda
977 (($ <hidden-service> name mapping)
978 (cons name mapping)))
982 ### End of automatically generated lines.\n\n" port)
984 ;; Append the user's config file.
985 (call-with-input-file #$config-file
987 (dump-port input port)))
990 (define (tor-shepherd-service config)
991 "Return a <shepherd-service> running Tor."
993 (($ <tor-configuration> tor)
994 (let* ((torrc (tor-configuration->torrc config))
995 (tor (least-authority-wrapper
996 (file-append tor "/bin/tor")
998 #:mappings (list (file-system-mapping
999 (source "/var/lib/tor")
1002 (file-system-mapping
1003 (source "/dev/log") ;for syslog
1005 (file-system-mapping
1006 (source "/var/run/tor")
1009 (file-system-mapping
1012 #:namespaces (delq 'net %namespaces))))
1013 (with-imported-modules (source-module-closure
1014 '((gnu build shepherd)
1015 (gnu system file-systems)))
1016 (list (shepherd-service
1019 ;; Tor needs at least one network interface to be up, hence the
1020 ;; dependency on 'loopback'.
1021 (requirement '(user-processes loopback syslogd))
1023 (modules '((gnu build shepherd)
1024 (gnu system file-systems)))
1026 ;; XXX: #:pid-file won't work because the wrapped 'tor'
1027 ;; program would print its PID within the user namespace
1028 ;; instead of its actual PID outside. There's no inetd or
1029 ;; systemd socket activation support either (there's
1030 ;; 'sd_notify' though), so we're stuck with that.
1031 (start #~(make-forkexec-constructor
1032 (list #$tor "-f" #$torrc)
1033 #:user "tor" #:group "tor"))
1034 (stop #~(make-kill-destructor))
1035 (documentation "Run the Tor anonymous network overlay."))))))))
1037 (define (tor-activation config)
1038 "Set up directories for Tor and its hidden services, if any."
1040 (use-modules (guix build utils))
1045 (define (initialize service)
1046 (let ((directory (string-append "/var/lib/tor/hidden-services/"
1049 (chown directory (passwd:uid %user) (passwd:gid %user))
1051 ;; The daemon bails out if we give wider permissions.
1052 (chmod directory #o700)))
1054 ;; Allow Tor to write its PID file.
1055 (mkdir-p "/var/run/tor")
1056 (chown "/var/run/tor" (passwd:uid %user) (passwd:gid %user))
1057 ;; Set the group permissions to rw so that if the system administrator
1058 ;; has specified UnixSocksGroupWritable=1 in their torrc file, members
1059 ;; of the "tor" group will be able to use the SOCKS socket.
1060 (chmod "/var/run/tor" #o750)
1062 ;; Allow Tor to access the hidden services' directories.
1063 (mkdir-p "/var/lib/tor")
1064 (chown "/var/lib/tor" (passwd:uid %user) (passwd:gid %user))
1065 (chmod "/var/lib/tor" #o700)
1067 ;; Make sure /var/lib is accessible to the 'tor' user.
1068 (chmod "/var/lib" #o755)
1070 (for-each initialize
1071 '#$(map hidden-service-name
1072 (tor-configuration-hidden-services config)))))
1074 (define tor-service-type
1075 (service-type (name 'tor)
1077 (list (service-extension shepherd-root-service-type
1078 tor-shepherd-service)
1079 (service-extension account-service-type
1080 (const %tor-accounts))
1081 (service-extension activation-service-type
1084 ;; This can be extended with hidden services.
1085 (compose concatenate)
1086 (extend (lambda (config services)
1090 (append (tor-configuration-hidden-services config)
1092 (default-value (tor-configuration))
1094 "Run the @uref{https://torproject.org, Tor} anonymous
1095 networking daemon.")))
1097 (define tor-hidden-service-type
1098 ;; A type that extends Tor with hidden services.
1099 (service-type (name 'tor-hidden-service)
1101 (list (service-extension tor-service-type list)))
1103 "Define a new Tor @dfn{hidden service}.")))
1105 (define (tor-hidden-service name mapping)
1106 "Define a new Tor @dfn{hidden service} called @var{name} and implementing
1107 @var{mapping}. @var{mapping} is a list of port/host tuples, such as:
1110 '((22 \"127.0.0.1:22\")
1111 (80 \"127.0.0.1:8080\"))
1114 In this example, port 22 of the hidden service is mapped to local port 22, and
1115 port 80 is mapped to local port 8080.
1117 This creates a @file{/var/lib/tor/hidden-services/@var{name}} directory, where
1118 the @file{hostname} file contains the @code{.onion} host name for the hidden
1121 See @uref{https://www.torproject.org/docs/tor-hidden-service.html.en, the Tor
1122 project's documentation} for more information."
1123 (service tor-hidden-service-type
1124 (hidden-service name mapping)))
1131 (define-record-type* <modem-manager-configuration>
1132 modem-manager-configuration make-modem-manager-configuration
1133 modem-manager-configuration?
1134 (modem-manager modem-manager-configuration-modem-manager
1135 (default modem-manager)))
1142 (define-record-type* <network-manager-configuration>
1143 network-manager-configuration make-network-manager-configuration
1144 network-manager-configuration?
1145 (network-manager network-manager-configuration-network-manager
1146 (default network-manager))
1147 (dns network-manager-configuration-dns
1148 (default "default"))
1149 (vpn-plugins network-manager-configuration-vpn-plugins ;list of file-like
1152 (define network-manager-activation
1153 ;; Activation gexp for NetworkManager
1155 (($ <network-manager-configuration> network-manager dns vpn-plugins)
1157 (use-modules (guix build utils))
1158 (mkdir-p "/etc/NetworkManager/system-connections")
1159 #$@(if (equal? dns "dnsmasq")
1160 ;; create directory to store dnsmasq lease file
1161 '((mkdir-p "/var/lib/misc"))
1164 (define (vpn-plugin-directory plugins)
1165 "Return a directory containing PLUGINS, the NM VPN plugins."
1166 (directory-union "network-manager-vpn-plugins" plugins))
1168 (define (network-manager-accounts config)
1169 "Return the list of <user-account> and <user-group> for CONFIG."
1171 (file-append shadow "/sbin/nologin"))
1174 (append-map (lambda (package)
1176 (user-account (system? #t)
1178 (group "network-manager")
1179 (comment "NetworkManager helper")
1180 (home-directory "/var/empty")
1181 (create-home-directory? #f)
1183 (or (assoc-ref (package-properties package)
1186 (network-manager-configuration-vpn-plugins config)))
1192 (cons (user-group (name "network-manager") (system? #t))
1195 (define network-manager-environment
1197 (($ <network-manager-configuration> network-manager dns vpn-plugins)
1198 ;; Define this variable in the global environment such that
1199 ;; "nmcli connection import type openvpn file foo.ovpn" works.
1200 `(("NM_VPN_PLUGIN_DIR"
1201 . ,(file-append (vpn-plugin-directory vpn-plugins)
1202 "/lib/NetworkManager/VPN"))))))
1204 (define network-manager-shepherd-service
1206 (($ <network-manager-configuration> network-manager dns vpn-plugins)
1207 (let ((conf (plain-file "NetworkManager.conf"
1208 (string-append "[main]\ndns=" dns "\n")))
1209 (vpn (vpn-plugin-directory vpn-plugins)))
1210 (list (shepherd-service
1211 (documentation "Run the NetworkManager.")
1212 (provision '(networking))
1213 (requirement '(user-processes dbus-system wpa-supplicant loopback))
1214 (start #~(make-forkexec-constructor
1215 (list (string-append #$network-manager
1216 "/sbin/NetworkManager")
1217 (string-append "--config=" #$conf)
1219 #:environment-variables
1220 (list (string-append "NM_VPN_PLUGIN_DIR=" #$vpn
1221 "/lib/NetworkManager/VPN")
1222 ;; Override non-existent default users
1224 "NM_OPENVPN_GROUP=")))
1225 (stop #~(make-kill-destructor))))))))
1227 (define network-manager-service-type
1231 (($ <network-manager-configuration> network-manager _ vpn-plugins)
1232 `(,network-manager ,@vpn-plugins)))))
1235 (name 'network-manager)
1237 (list (service-extension shepherd-root-service-type
1238 network-manager-shepherd-service)
1239 (service-extension dbus-root-service-type config->packages)
1240 (service-extension polkit-service-type
1243 network-manager-configuration-network-manager))
1244 (service-extension account-service-type
1245 network-manager-accounts)
1246 (service-extension activation-service-type
1247 network-manager-activation)
1248 (service-extension session-environment-service-type
1249 network-manager-environment)
1250 ;; Add network-manager to the system profile.
1251 (service-extension profile-service-type config->packages)))
1252 (default-value (network-manager-configuration))
1254 "Run @uref{https://wiki.gnome.org/Projects/NetworkManager,
1255 NetworkManager}, a network management daemon that aims to simplify wired and
1256 wireless networking."))))
1263 (define-record-type* <connman-configuration>
1264 connman-configuration make-connman-configuration
1265 connman-configuration?
1266 (connman connman-configuration-connman
1268 (disable-vpn? connman-configuration-disable-vpn?
1271 (define (connman-activation config)
1272 (let ((disable-vpn? (connman-configuration-disable-vpn? config)))
1273 (with-imported-modules '((guix build utils))
1275 (use-modules (guix build utils))
1276 (mkdir-p "/var/lib/connman/")
1277 (unless #$disable-vpn?
1278 (mkdir-p "/var/lib/connman-vpn/"))))))
1280 (define (connman-shepherd-service config)
1281 "Return a shepherd service for Connman"
1283 (connman-configuration? config)
1284 (let ((connman (connman-configuration-connman config))
1285 (disable-vpn? (connman-configuration-disable-vpn? config)))
1286 (list (shepherd-service
1287 (documentation "Run Connman")
1288 (provision '(networking))
1290 '(user-processes dbus-system loopback wpa-supplicant))
1291 (start #~(make-forkexec-constructor
1292 (list (string-append #$connman
1296 #$@(if disable-vpn? '("--noplugin=vpn") '()))
1298 ;; As connman(8) notes, when passing '-n', connman
1299 ;; "directs log output to the controlling terminal in
1300 ;; addition to syslog." Redirect stdout and stderr
1301 ;; to avoid spamming the console (XXX: for some reason
1302 ;; redirecting to /dev/null doesn't work.)
1303 #:log-file "/var/log/connman.log"))
1304 (stop #~(make-kill-destructor)))))))
1306 (define %connman-log-rotation
1308 (files '("/var/log/connman.log")))))
1310 (define connman-service-type
1311 (let ((connman-package (compose list connman-configuration-connman)))
1312 (service-type (name 'connman)
1314 (list (service-extension shepherd-root-service-type
1315 connman-shepherd-service)
1316 (service-extension polkit-service-type
1318 (service-extension dbus-root-service-type
1320 (service-extension activation-service-type
1322 ;; Add connman to the system profile.
1323 (service-extension profile-service-type
1325 (service-extension rottlog-service-type
1326 (const %connman-log-rotation))))
1327 (default-value (connman-configuration))
1329 "Run @url{https://01.org/connman,Connman},
1330 a network connection manager."))))
1337 (define modem-manager-service-type
1338 (let ((config->package
1340 (($ <modem-manager-configuration> modem-manager)
1341 (list modem-manager)))))
1342 (service-type (name 'modem-manager)
1344 (list (service-extension dbus-root-service-type
1346 (service-extension udev-service-type
1348 (service-extension polkit-service-type
1350 (default-value (modem-manager-configuration))
1352 "Run @uref{https://wiki.gnome.org/Projects/ModemManager,
1353 ModemManager}, a modem management daemon that aims to simplify dialup
1361 (define-record-type* <usb-modeswitch-configuration>
1362 usb-modeswitch-configuration make-usb-modeswitch-configuration
1363 usb-modeswitch-configuration?
1364 (usb-modeswitch usb-modeswitch-configuration-usb-modeswitch
1365 (default usb-modeswitch))
1366 (usb-modeswitch-data usb-modeswitch-configuration-usb-modeswitch-data
1367 (default usb-modeswitch-data))
1368 (config-file usb-modeswitch-configuration-config-file
1369 (default #~(string-append #$usb-modeswitch:dispatcher
1370 "/etc/usb_modeswitch.conf"))))
1372 (define (usb-modeswitch-sh usb-modeswitch config-file)
1373 "Build a copy of usb_modeswitch.sh located in package USB-MODESWITCH,
1374 modified to pass the CONFIG-FILE in its calls to usb_modeswitch_dispatcher,
1375 and wrap it to actually find the dispatcher in USB-MODESWITCH. The script
1376 will be run by USB_ModeSwitch’s udev rules file when a modeswitchable USB
1377 device is detected."
1380 (with-imported-modules '((guix build utils))
1382 (use-modules (guix build utils))
1385 #~(string-append " --config-file=" #$config-file)
1388 (install-file (string-append #$usb-modeswitch:dispatcher
1389 "/lib/udev/usb_modeswitch")
1392 ;; insert CFG-PARAM into usb_modeswitch_dispatcher command-lines
1393 (substitute* (string-append #$output "/usb_modeswitch")
1394 (("(exec usb_modeswitch_dispatcher .*)( 2>>)" _ left right)
1395 (string-append left cfg-param right))
1396 (("(exec usb_modeswitch_dispatcher .*)( &)" _ left right)
1397 (string-append left cfg-param right)))
1399 ;; wrap-program needs bash in PATH:
1400 (putenv (string-append "PATH=" #$bash "/bin"))
1401 (wrap-program (string-append #$output "/usb_modeswitch")
1402 `("PATH" ":" = (,(string-append #$coreutils "/bin")
1404 #$usb-modeswitch:dispatcher
1407 (define (usb-modeswitch-configuration->udev-rules config)
1408 "Build a rules file for extending udev-service-type from the rules in the
1409 usb-modeswitch package specified in CONFIG. The rules file will invoke
1410 usb_modeswitch.sh from the usb-modeswitch package, modified to pass the right
1413 (($ <usb-modeswitch-configuration> usb-modeswitch data config-file)
1415 "usb_modeswitch.rules"
1416 (with-imported-modules '((guix build utils))
1418 (use-modules (guix build utils))
1419 (let ((in (string-append #$data "/udev/40-usb_modeswitch.rules"))
1420 (out (string-append #$output "/lib/udev/rules.d"))
1421 (script #$(usb-modeswitch-sh usb-modeswitch config-file)))
1424 (install-file in out)
1425 (substitute* "40-usb_modeswitch.rules"
1426 (("PROGRAM=\"usb_modeswitch")
1427 (string-append "PROGRAM=\"" script "/usb_modeswitch"))
1428 (("RUN\\+=\"usb_modeswitch")
1429 (string-append "RUN+=\"" script "/usb_modeswitch"))))))))))
1431 (define usb-modeswitch-service-type
1433 (name 'usb-modeswitch)
1439 (let ((rules (usb-modeswitch-configuration->udev-rules config)))
1441 (default-value (usb-modeswitch-configuration))
1442 (description "Run @uref{http://www.draisberghof.de/usb_modeswitch/,
1443 USB_ModeSwitch}, a mode switching tool for controlling USB devices with
1444 multiple @dfn{modes}. When plugged in for the first time many USB
1445 devices (primarily high-speed WAN modems) act like a flash storage containing
1446 installers for Windows drivers. USB_ModeSwitch replays the sequence the
1447 Windows drivers would send to switch their mode from storage to modem (or
1448 whatever the thing is supposed to do).")))
1455 (define-record-type* <wpa-supplicant-configuration>
1456 wpa-supplicant-configuration make-wpa-supplicant-configuration
1457 wpa-supplicant-configuration?
1458 (wpa-supplicant wpa-supplicant-configuration-wpa-supplicant ;file-like
1459 (default wpa-supplicant))
1460 (requirement wpa-supplicant-configuration-requirement ;list of symbols
1461 (default '(user-processes loopback syslogd)))
1462 (pid-file wpa-supplicant-configuration-pid-file ;string
1463 (default "/var/run/wpa_supplicant.pid"))
1464 (dbus? wpa-supplicant-configuration-dbus? ;Boolean
1466 (interface wpa-supplicant-configuration-interface ;#f | string
1468 (config-file wpa-supplicant-configuration-config-file ;#f | <file-like>
1470 (extra-options wpa-supplicant-configuration-extra-options ;list of strings
1473 (define wpa-supplicant-shepherd-service
1475 (($ <wpa-supplicant-configuration> wpa-supplicant requirement pid-file dbus?
1476 interface config-file extra-options)
1477 (list (shepherd-service
1478 (documentation "Run the WPA supplicant daemon")
1479 (provision '(wpa-supplicant))
1480 (requirement (if dbus?
1481 (cons 'dbus-system requirement)
1483 (start #~(make-forkexec-constructor
1484 (list (string-append #$wpa-supplicant
1485 "/sbin/wpa_supplicant")
1486 (string-append "-P" #$pid-file)
1487 "-B" ;run in background
1488 "-s" ;log to syslogd
1493 #~((string-append "-i" #$interface))
1496 #~((string-append "-c" #$config-file))
1499 #:pid-file #$pid-file))
1500 (stop #~(make-kill-destructor)))))))
1502 (define wpa-supplicant-service-type
1503 (let ((config->package
1505 (($ <wpa-supplicant-configuration> wpa-supplicant)
1506 (list wpa-supplicant)))))
1507 (service-type (name 'wpa-supplicant)
1509 (list (service-extension shepherd-root-service-type
1510 wpa-supplicant-shepherd-service)
1511 (service-extension dbus-root-service-type config->package)
1512 (service-extension profile-service-type config->package)))
1513 (description "Run the WPA Supplicant daemon, a service that
1514 implements authentication, key negotiation and more for wireless networks.")
1515 (default-value (wpa-supplicant-configuration)))))
1522 (define-record-type* <hostapd-configuration>
1523 hostapd-configuration make-hostapd-configuration
1524 hostapd-configuration?
1525 (package hostapd-configuration-package
1527 (interface hostapd-configuration-interface ;string
1529 (ssid hostapd-configuration-ssid) ;string
1530 (broadcast-ssid? hostapd-configuration-broadcast-ssid? ;Boolean
1532 (channel hostapd-configuration-channel ;integer
1534 (driver hostapd-configuration-driver ;string
1535 (default "nl80211"))
1536 ;; See <https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf> for a list of
1537 ;; additional options we could add.
1538 (extra-settings hostapd-configuration-extra-settings ;string
1541 (define (hostapd-configuration-file config)
1542 "Return the configuration file for CONFIG, a <hostapd-configuration>."
1543 (match-record config <hostapd-configuration>
1544 (interface ssid broadcast-ssid? channel driver extra-settings)
1545 (plain-file "hostapd.conf"
1547 # Generated from your Guix configuration.
1549 interface=" interface "
1551 ignore_broadcast_ssid=" (if broadcast-ssid? "0" "1") "
1552 channel=" (number->string channel) "\n"
1553 extra-settings "\n"))))
1555 (define* (hostapd-shepherd-services config #:key (requirement '()))
1556 "Return Shepherd services for hostapd."
1557 (list (shepherd-service
1558 (provision '(hostapd))
1559 (requirement `(user-processes ,@requirement))
1560 (documentation "Run the hostapd WiFi access point daemon.")
1561 (start #~(make-forkexec-constructor
1562 (list #$(file-append (hostapd-configuration-package config)
1564 #$(hostapd-configuration-file config))
1565 #:log-file "/var/log/hostapd.log"))
1566 (stop #~(make-kill-destructor)))))
1568 (define %hostapd-log-rotation
1570 (files '("/var/log/hostapd.log")))))
1572 (define hostapd-service-type
1576 (list (service-extension shepherd-root-service-type
1577 hostapd-shepherd-services)
1578 (service-extension rottlog-service-type
1579 (const %hostapd-log-rotation))))
1581 "Run the @uref{https://w1.fi/hostapd/, hostapd} daemon for Wi-Fi access
1582 points and authentication servers.")))
1584 (define (simulated-wifi-shepherd-services config)
1585 "Return Shepherd services to run hostapd with CONFIG, a
1586 <hostapd-configuration>, as well as services to set up WiFi hardware
1588 (append (hostapd-shepherd-services config
1591 kernel-module-loader))
1592 (list (shepherd-service
1593 (provision '(unblocked-wifi))
1594 (requirement '(file-systems kernel-module-loader))
1596 "Unblock WiFi devices for use by mac80211_hwsim.")
1598 (invoke #$(file-append util-linux "/sbin/rfkill")
1600 (invoke #$(file-append util-linux "/sbin/rfkill")
1604 (define simulated-wifi-service-type
1606 (name 'simulated-wifi)
1608 (list (service-extension shepherd-root-service-type
1609 simulated-wifi-shepherd-services)
1610 (service-extension kernel-module-loader-service-type
1611 (const '("mac80211_hwsim")))))
1612 (default-value (hostapd-configuration
1614 (ssid "Test Network")))
1615 (description "Run hostapd to simulate WiFi connectivity.")))
1622 (define-record-type* <openvswitch-configuration>
1623 openvswitch-configuration make-openvswitch-configuration
1624 openvswitch-configuration?
1625 (package openvswitch-configuration-package
1626 (default openvswitch)))
1628 (define openvswitch-activation
1630 (($ <openvswitch-configuration> package)
1631 (let ((ovsdb-tool (file-append package "/bin/ovsdb-tool")))
1632 (with-imported-modules '((guix build utils))
1634 (use-modules (guix build utils))
1635 (mkdir-p "/var/run/openvswitch")
1636 (mkdir-p "/var/lib/openvswitch")
1637 (let ((conf.db "/var/lib/openvswitch/conf.db"))
1638 (unless (file-exists? conf.db)
1639 (system* #$ovsdb-tool "create" conf.db)))))))))
1641 (define openvswitch-shepherd-service
1643 (($ <openvswitch-configuration> package)
1644 (let ((ovsdb-server (file-append package "/sbin/ovsdb-server"))
1645 (ovs-vswitchd (file-append package "/sbin/ovs-vswitchd")))
1648 (provision '(ovsdb))
1649 (documentation "Run the Open vSwitch database server.")
1650 (start #~(make-forkexec-constructor
1651 (list #$ovsdb-server "--pidfile"
1652 "--remote=punix:/var/run/openvswitch/db.sock")
1653 #:pid-file "/var/run/openvswitch/ovsdb-server.pid"))
1654 (stop #~(make-kill-destructor)))
1656 (provision '(vswitchd))
1657 (requirement '(ovsdb))
1658 (documentation "Run the Open vSwitch daemon.")
1659 (start #~(make-forkexec-constructor
1660 (list #$ovs-vswitchd "--pidfile")
1661 #:pid-file "/var/run/openvswitch/ovs-vswitchd.pid"))
1662 (stop #~(make-kill-destructor))))))))
1664 (define openvswitch-service-type
1668 (list (service-extension activation-service-type
1669 openvswitch-activation)
1670 (service-extension profile-service-type
1671 (compose list openvswitch-configuration-package))
1672 (service-extension shepherd-root-service-type
1673 openvswitch-shepherd-service)))
1675 "Run @uref{http://www.openvswitch.org, Open vSwitch}, a multilayer virtual
1676 switch designed to enable massive network automation through programmatic
1678 (default-value (openvswitch-configuration))))
1684 (define %iptables-accept-all-rules
1685 (plain-file "iptables-accept-all.rules"
1693 (define-record-type* <iptables-configuration>
1694 iptables-configuration make-iptables-configuration iptables-configuration?
1695 (iptables iptables-configuration-iptables
1697 (ipv4-rules iptables-configuration-ipv4-rules
1698 (default %iptables-accept-all-rules))
1699 (ipv6-rules iptables-configuration-ipv6-rules
1700 (default %iptables-accept-all-rules)))
1702 (define iptables-shepherd-service
1704 (($ <iptables-configuration> iptables ipv4-rules ipv6-rules)
1705 (let ((iptables-restore (file-append iptables "/sbin/iptables-restore"))
1706 (ip6tables-restore (file-append iptables "/sbin/ip6tables-restore")))
1708 (documentation "Packet filtering framework")
1709 (provision '(iptables))
1711 (invoke #$iptables-restore #$ipv4-rules)
1712 (invoke #$ip6tables-restore #$ipv6-rules)))
1714 (invoke #$iptables-restore #$%iptables-accept-all-rules)
1715 (invoke #$ip6tables-restore #$%iptables-accept-all-rules))))))))
1717 (define iptables-service-type
1721 "Run @command{iptables-restore}, setting up the specified rules.")
1723 (list (service-extension shepherd-root-service-type
1724 (compose list iptables-shepherd-service))))))
1730 (define %default-nftables-ruleset
1731 (plain-file "nftables.conf"
1732 "# A simple and safe firewall
1735 type filter hook input priority 0; policy drop;
1737 # early drop of invalid connections
1738 ct state invalid drop
1740 # allow established/related connections
1741 ct state { established, related } accept
1743 # allow from loopback
1747 ip protocol icmp accept
1748 ip6 nexthdr icmpv6 accept
1751 tcp dport ssh accept
1753 # reject everything else
1754 reject with icmpx type port-unreachable
1757 type filter hook forward priority 0; policy drop;
1760 type filter hook output priority 0; policy accept;
1765 (define-record-type* <nftables-configuration>
1766 nftables-configuration
1767 make-nftables-configuration
1768 nftables-configuration?
1769 (package nftables-configuration-package
1771 (ruleset nftables-configuration-ruleset ; file-like object
1772 (default %default-nftables-ruleset)))
1774 (define nftables-shepherd-service
1776 (($ <nftables-configuration> package ruleset)
1777 (let ((nft (file-append package "/sbin/nft")))
1779 (documentation "Packet filtering and classification")
1780 (provision '(nftables))
1782 (invoke #$nft "--file" #$ruleset)))
1784 (invoke #$nft "flush" "ruleset"))))))))
1786 (define nftables-service-type
1790 "Run @command{nft}, setting up the specified ruleset.")
1792 (list (service-extension shepherd-root-service-type
1793 (compose list nftables-shepherd-service))
1794 (service-extension profile-service-type
1795 (compose list nftables-configuration-package))))
1796 (default-value (nftables-configuration))))
1803 (define-record-type* <pagekite-configuration>
1804 pagekite-configuration
1805 make-pagekite-configuration
1806 pagekite-configuration?
1807 (package pagekite-configuration-package
1809 (kitename pagekite-configuration-kitename
1811 (kitesecret pagekite-configuration-kitesecret
1813 (frontend pagekite-configuration-frontend
1815 (kites pagekite-configuration-kites
1816 (default '("http:@kitename:localhost:80:@kitesecret")))
1817 (extra-file pagekite-configuration-extra-file
1820 (define (pagekite-configuration-file config)
1821 (match-record config <pagekite-configuration>
1822 (package kitename kitesecret frontend kites extra-file)
1823 (mixed-text-file "pagekite.rc"
1825 (string-append "optfile = " extra-file "\n")
1828 (string-append "kitename = " kitename "\n")
1831 (string-append "kitesecret = " kitesecret "\n")
1834 (string-append "frontend = " frontend "\n")
1836 (string-join (map (lambda (kite)
1837 (string-append "service_on = " kite))
1842 (define (pagekite-shepherd-service config)
1843 (match-record config <pagekite-configuration>
1844 (package kitename kitesecret frontend kites extra-file)
1845 (with-imported-modules (source-module-closure
1846 '((gnu build shepherd)
1847 (gnu system file-systems)))
1849 (documentation "Run the PageKite service.")
1850 (provision '(pagekite))
1851 (requirement '(networking))
1852 (modules '((gnu build shepherd)
1853 (gnu system file-systems)))
1854 (start #~(make-forkexec-constructor/container
1855 (list #$(file-append package "/bin/pagekite")
1859 "--runas=pagekite:pagekite"
1860 (string-append "--optfile="
1861 #$(pagekite-configuration-file config)))
1862 #:log-file "/var/log/pagekite.log"
1863 #:mappings #$(if extra-file
1864 #~(list (file-system-mapping
1865 (source #$extra-file)
1868 ;; SIGTERM doesn't always work for some reason.
1869 (stop #~(make-kill-destructor SIGINT))))))
1871 (define %pagekite-log-rotation
1873 (files '("/var/log/pagekite.log")))))
1875 (define %pagekite-accounts
1876 (list (user-group (name "pagekite") (system? #t))
1881 (comment "PageKite user")
1882 (home-directory "/var/empty")
1883 (shell (file-append shadow "/sbin/nologin")))))
1885 (define pagekite-service-type
1888 (default-value (pagekite-configuration))
1890 (list (service-extension shepherd-root-service-type
1891 (compose list pagekite-shepherd-service))
1892 (service-extension account-service-type
1893 (const %pagekite-accounts))
1894 (service-extension rottlog-service-type
1895 (const %pagekite-log-rotation))))
1897 "Run @url{https://pagekite.net/,PageKite}, a tunneling solution to make
1898 local servers publicly accessible on the web, even behind NATs and firewalls.")))
1905 (define-record-type* <yggdrasil-configuration>
1906 yggdrasil-configuration
1907 make-yggdrasil-configuration
1908 yggdrasil-configuration?
1909 (package yggdrasil-configuration-package
1910 (default yggdrasil))
1911 (json-config yggdrasil-configuration-json-config
1913 (config-file yggdrasil-config-file
1914 (default "/etc/yggdrasil-private.conf"))
1915 (autoconf? yggdrasil-configuration-autoconf?
1917 (log-level yggdrasil-configuration-log-level
1919 (log-to yggdrasil-configuration-log-to
1922 (define (yggdrasil-configuration-file config)
1923 (define (scm->yggdrasil-json x)
1926 (define (param->camel str)
1930 (string-split str (cut eqv? <> #\-)))))
1937 (param->camel (symbol->string k))
1940 ((list? x) (map scm->yggdrasil-json x))
1941 ((vector? x) (vector-map scm->yggdrasil-json x))
1945 #~(call-with-output-file #$output
1947 ;; it's HJSON, so comments are a-okay
1948 (display "# Generated by yggdrasil-service\n" port)
1949 (display #$(scm->json-string
1950 (scm->yggdrasil-json
1951 (yggdrasil-configuration-json-config config)))
1954 (define (yggdrasil-shepherd-service config)
1955 "Return a <shepherd-service> for yggdrasil with CONFIG."
1956 (define yggdrasil-command
1958 (list (string-append
1959 #$(yggdrasil-configuration-package config)
1962 #$(yggdrasil-configuration-file config))
1963 (if #$(yggdrasil-configuration-autoconf? config)
1966 (let ((extraconf #$(yggdrasil-config-file config)))
1968 (list "-extraconffile" extraconf)
1972 (yggdrasil-configuration-log-level config))
1975 (yggdrasil-configuration-log-to config)))))
1976 (list (shepherd-service
1977 (documentation "Connect to the Yggdrasil mesh network")
1978 (provision '(yggdrasil))
1979 (requirement '(networking))
1980 (start #~(make-forkexec-constructor
1982 #:log-file "/var/log/yggdrasil.log"
1983 #:group "yggdrasil"))
1984 (stop #~(make-kill-destructor)))))
1986 (define %yggdrasil-log-rotation
1988 (files '("/var/log/yggdrasil.log")))))
1990 (define %yggdrasil-accounts
1991 (list (user-group (name "yggdrasil") (system? #t))))
1993 (define yggdrasil-service-type
1997 "Connect to the Yggdrasil mesh network.
1998 See @command{yggdrasil -genconf} for config options.")
2000 (list (service-extension shepherd-root-service-type
2001 yggdrasil-shepherd-service)
2002 (service-extension account-service-type
2003 (const %yggdrasil-accounts))
2004 (service-extension profile-service-type
2005 (compose list yggdrasil-configuration-package))
2006 (service-extension rottlog-service-type
2007 (const %yggdrasil-log-rotation))))))
2014 (define-record-type* <ipfs-configuration>
2016 make-ipfs-configuration
2018 (package ipfs-configuration-package
2020 (gateway ipfs-configuration-gateway
2021 (default "/ip4/127.0.0.1/tcp/8082"))
2022 (api ipfs-configuration-api
2023 (default "/ip4/127.0.0.1/tcp/5001")))
2025 (define %ipfs-home "/var/lib/ipfs")
2027 (define %ipfs-accounts
2032 (comment "IPFS daemon user")
2033 (home-directory "/var/lib/ipfs")
2034 (shell (file-append shadow "/sbin/nologin")))
2039 (define (ipfs-binary config)
2041 (file-append (ipfs-configuration-package config) "/bin/ipfs"))
2043 (least-authority-wrapper
2046 #:mappings (list %ipfs-home-mapping)
2047 #:namespaces (delq 'net %namespaces)))
2049 (define %ipfs-home-mapping
2050 (file-system-mapping
2055 (define %ipfs-environment
2056 #~(list #$(string-append "HOME=" %ipfs-home)))
2058 (define (ipfs-shepherd-service config)
2059 "Return a <shepherd-service> for IPFS with CONFIG."
2060 (define ipfs-daemon-command
2061 #~(list #$(ipfs-binary config) "daemon"))
2063 (list (shepherd-service
2065 ;; While IPFS is most useful when the machine is connected
2066 ;; to the network, only loopback is required for starting
2068 (requirement '(loopback))
2069 (documentation "Connect to the IPFS network")
2070 (start #~(make-forkexec-constructor
2071 #$ipfs-daemon-command
2072 #:log-file "/var/log/ipfs.log"
2073 #:user "ipfs" #:group "ipfs"
2074 #:environment-variables #$%ipfs-environment))
2075 (stop #~(make-kill-destructor)))))
2077 (define %ipfs-log-rotation
2079 (files '("/var/log/ipfs.log")))))
2081 (define (%ipfs-activation config)
2082 "Return an activation gexp for IPFS with CONFIG"
2083 (define (exec-command . args)
2084 ;; Exec the given ifps command with the right authority.
2085 #~(let ((pid (primitive-fork)))
2090 ;; Run ipfs init and ipfs config from a container,
2091 ;; in case the IPFS daemon was compromised at some point
2092 ;; and ~/.ipfs is now a symlink to somewhere outside
2094 (let ((pw (getpwnam "ipfs")))
2096 (setgid (passwd:gid pw))
2097 (setuid (passwd:uid pw))
2098 (environ #$%ipfs-environment)
2099 (execl #$(ipfs-binary config) #$@args)))
2101 (primitive-exit 127)))
2105 `(("Addresses.API" ,(ipfs-configuration-api config))
2106 ("Addresses.Gateway" ,(ipfs-configuration-gateway config))))
2111 ;; Create $HOME/.ipfs structure
2112 #$(exec-command "ipfs" "init")
2114 #$@(map (match-lambda
2116 (exec-command "ipfs" "config" setting value)))
2119 (define inner-script
2120 (program-file "ipfs-activation-inner" inner-gexp))
2122 ;; The activation may happen from the initrd, which uses
2123 ;; a statically-linked guile, while the guix container
2124 ;; procedures require a working dynamic-link.
2125 #~(system* #$inner-script))
2127 (define ipfs-service-type
2131 (list (service-extension account-service-type
2132 (const %ipfs-accounts))
2133 (service-extension activation-service-type
2135 (service-extension shepherd-root-service-type
2136 ipfs-shepherd-service)
2137 (service-extension rottlog-service-type
2138 (const %ipfs-log-rotation))))
2139 (default-value (ipfs-configuration))
2141 "Run @command{ipfs daemon}, the reference implementation
2142 of the IPFS peer-to-peer storage network.")))
2149 (define-record-type* <keepalived-configuration>
2150 keepalived-configuration make-keepalived-configuration
2151 keepalived-configuration?
2152 (keepalived keepalived-configuration-keepalived ;file-like
2153 (default keepalived))
2154 (config-file keepalived-configuration-config-file ;file-like
2157 (define keepalived-shepherd-service
2159 (($ <keepalived-configuration> keepalived config-file)
2162 (provision '(keepalived))
2163 (documentation "Run keepalived.")
2164 (requirement '(loopback))
2165 (start #~(make-forkexec-constructor
2166 (list (string-append #$keepalived "/sbin/keepalived")
2167 "--dont-fork" "--log-console" "--log-detail"
2168 "--pid=/var/run/keepalived.pid"
2169 (string-append "--use-file=" #$config-file))
2170 #:pid-file "/var/run/keepalived.pid"
2171 #:log-file "/var/log/keepalived.log"))
2173 (stop #~(make-kill-destructor)))))))
2175 (define %keepalived-log-rotation
2177 (files '("/var/log/keepalived.log")))))
2179 (define keepalived-service-type
2180 (service-type (name 'keepalived)
2181 (extensions (list (service-extension shepherd-root-service-type
2182 keepalived-shepherd-service)
2183 (service-extension rottlog-service-type
2184 (const %keepalived-log-rotation))))
2186 "Run @uref{https://www.keepalived.org/, Keepalived}
2187 routing software.")))
2189 ;;; networking.scm ends here