1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
3 ;;; Copyright © 2015, 2016 Ludovic Courtès <ludo@gnu.org>
4 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
5 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
6 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
7 ;;; Copyright © 2018 Julien Lepiller <julien@lepiller.eu>
8 ;;; Copyright © 2019 Robert Vollmert <rob@vllmrt.net>
9 ;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
11 ;;; This file is part of GNU Guix.
13 ;;; GNU Guix is free software; you can redistribute it and/or modify it
14 ;;; under the terms of the GNU General Public License as published by
15 ;;; the Free Software Foundation; either version 3 of the License, or (at
16 ;;; your option) any later version.
18 ;;; GNU Guix is distributed in the hope that it will be useful, but
19 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
20 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 ;;; GNU General Public License for more details.
23 ;;; You should have received a copy of the GNU General Public License
24 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
26 (define-module (gnu services databases)
27 #:use-module (gnu services)
28 #:use-module (gnu services shepherd)
29 #:use-module (gnu system shadow)
30 #:use-module (gnu packages admin)
31 #:use-module (gnu packages databases)
32 #:use-module (guix build-system trivial)
33 #:use-module (guix build union)
34 #:use-module (guix deprecation)
35 #:use-module (guix modules)
36 #:use-module (guix packages)
37 #:use-module (guix records)
38 #:use-module (guix gexp)
39 #:use-module (srfi srfi-1)
40 #:use-module (ice-9 match)
41 #:export (postgresql-config-file
42 postgresql-config-file?
43 postgresql-config-file-log-destination
44 postgresql-config-file-hba-file
45 postgresql-config-file-ident-file
46 postgresql-config-file-socket-directory
47 postgresql-config-file-extra-config
49 postgresql-configuration
50 postgresql-configuration?
51 postgresql-configuration-postgresql
52 postgresql-configuration-port
53 postgresql-configuration-locale
54 postgresql-configuration-file
55 postgresql-configuration-log-directory
56 postgresql-configuration-data-directory
59 postgresql-service-type
64 postgresql-role-permissions
65 postgresql-role-create-database?
66 postgresql-role-configuration
67 postgresql-role-configuration?
68 postgresql-role-configuration-host
69 postgresql-role-configuration-roles
71 postgresql-role-service-type
73 memcached-service-type
74 memcached-configuration
75 memcached-configuration?
76 memcached-configuration-memecached
77 memcached-configuration-interfaces
78 memcached-configuration-tcp-port
79 memcached-configuration-udp-port
80 memcached-configuration-additional-options
93 ;;; Database services.
97 (define %default-postgres-hba
98 (plain-file "pg_hba.conf"
101 host all all 127.0.0.1/32 md5
102 host all all ::1/128 md5"))
104 (define %default-postgres-ident
105 (plain-file "pg_ident.conf"
106 "# MAPNAME SYSTEM-USERNAME PG-USERNAME"))
108 (define-record-type* <postgresql-config-file>
109 postgresql-config-file make-postgresql-config-file
110 postgresql-config-file?
111 (log-destination postgresql-config-file-log-destination
113 (hba-file postgresql-config-file-hba-file
114 (default %default-postgres-hba))
115 (ident-file postgresql-config-file-ident-file
116 (default %default-postgres-ident))
117 (socket-directory postgresql-config-file-socket-directory
118 (default "/var/run/postgresql"))
119 (extra-config postgresql-config-file-extra-config
122 (define-gexp-compiler (postgresql-config-file-compiler
123 (file <postgresql-config-file>) system target)
125 (($ <postgresql-config-file> log-destination hba-file
126 ident-file socket-directory
128 ;; See: https://www.postgresql.org/docs/current/config-setting.html.
129 (define (format-value value)
132 (list (if value "on" "off")))
134 (list (number->string value)))
136 (list "'" value "'"))))
144 `(,key " = " ,@(append-map format-value values) "\n")))
146 `(("log_destination" ,log-destination)
147 ("hba_file" ,hba-file)
148 ("ident_file" ,ident-file)
149 ,@(if socket-directory
150 `(("unix_socket_directories" ,socket-directory))
156 #~(call-with-output-file (ungexp output "out")
159 (string-append #$@contents)
161 #:local-build? #t))))
163 (define-record-type* <postgresql-configuration>
164 postgresql-configuration make-postgresql-configuration
165 postgresql-configuration?
166 (postgresql postgresql-configuration-postgresql) ;<package>
167 (port postgresql-configuration-port
169 (locale postgresql-configuration-locale
170 (default "en_US.utf8"))
171 (config-file postgresql-configuration-file
172 (default (postgresql-config-file)))
173 (log-directory postgresql-configuration-log-directory
174 (default "/var/log/postgresql"))
175 (data-directory postgresql-configuration-data-directory
176 (default "/var/lib/postgresql/data"))
177 (extension-packages postgresql-configuration-extension-packages
180 (define %postgresql-accounts
181 (list (user-group (name "postgres") (system? #t))
186 (comment "PostgreSQL server user")
187 (home-directory "/var/empty")
188 (shell (file-append shadow "/sbin/nologin")))))
190 (define (final-postgresql postgresql extension-packages)
191 (if (null? extension-packages)
196 (build-system trivial-build-system)
198 `(#:modules ((guix build utils) (guix build union))
201 (use-modules (guix build utils) (guix build union) (srfi srfi-26))
202 (union-build (assoc-ref %outputs "out")
203 (map (lambda (input) (cdr input))
207 `(("postgresql" ,postgresql)
208 ,@(map (lambda (extension) (list "extension" extension))
209 extension-packages))))))
211 (define postgresql-activation
213 (($ <postgresql-configuration> postgresql port locale config-file
214 log-directory data-directory
217 (use-modules (guix build utils)
220 (let ((user (getpwnam "postgres"))
221 (initdb (string-append
222 #$(final-postgresql postgresql
228 (list (string-append "--locale=" #$locale))
230 ;; Create db state directory.
231 (mkdir-p #$data-directory)
232 (chown #$data-directory (passwd:uid user) (passwd:gid user))
234 ;; Create the socket directory.
235 (let ((socket-directory
236 #$(postgresql-config-file-socket-directory config-file)))
237 (when (string? socket-directory)
238 (mkdir-p socket-directory)
239 (chown socket-directory (passwd:uid user) (passwd:gid user))))
241 ;; Create the log directory.
242 (when (string? #$log-directory)
243 (mkdir-p #$log-directory)
244 (chown #$log-directory (passwd:uid user) (passwd:gid user)))
246 ;; Drop privileges and init state directory in a new
247 ;; process. Wait for it to finish before proceeding.
248 (match (primitive-fork)
250 ;; Exit with a non-zero status code if an exception is thrown.
254 (setgid (passwd:gid user))
255 (setuid (passwd:uid user))
263 (primitive-exit 1))))
264 (pid (waitpid pid))))))))
266 (define postgresql-shepherd-service
268 (($ <postgresql-configuration> postgresql port locale config-file
269 log-directory data-directory
271 (let* ((pg_ctl-wrapper
272 ;; Wrapper script that switches to the 'postgres' user before
277 (use-modules (ice-9 match)
279 (match (command-line)
281 (let ((user (getpwnam "postgres"))
282 (pg_ctl #$(file-append
283 (final-postgresql postgresql
286 (options (format #f "--config-file=~a -p ~d"
287 #$config-file #$port)))
288 (setgid (passwd:gid user))
289 (setuid (passwd:uid user))
290 (execl pg_ctl pg_ctl "-D" #$data-directory
291 #$@(if (string? log-directory)
293 (string-append log-directory
298 (pid-file (in-vicinity data-directory "postmaster.pid"))
301 (invoke #$pg_ctl-wrapper #$@args)
304 (call-with-input-file #$pid-file read))
306 (list (shepherd-service
307 (provision '(postgres))
308 (documentation "Run the PostgreSQL daemon.")
309 (requirement '(user-processes loopback syslogd))
310 (modules `((ice-9 match)
312 (start (action "start"))
313 (stop (action "stop"))))))))
315 (define postgresql-service-type
319 (list (service-extension shepherd-root-service-type
320 postgresql-shepherd-service)
321 (service-extension activation-service-type
322 postgresql-activation)
323 (service-extension account-service-type
324 (const %postgresql-accounts))
327 (compose list postgresql-configuration-postgresql))))
328 (default-value (postgresql-configuration
329 (postgresql postgresql-10)))))
331 (define-deprecated (postgresql-service #:key (postgresql postgresql)
333 (locale "en_US.utf8")
334 (config-file (postgresql-config-file))
336 "/var/lib/postgresql/data")
337 (extension-packages '()))
338 postgresql-service-type
339 "Return a service that runs @var{postgresql}, the PostgreSQL database
342 The PostgreSQL daemon loads its runtime configuration from @var{config-file}
343 and stores the database cluster in @var{data-directory}."
344 (service postgresql-service-type
345 (postgresql-configuration
346 (postgresql postgresql)
349 (config-file config-file)
350 (data-directory data-directory)
351 (extension-packages extension-packages))))
353 (define-record-type* <postgresql-role>
354 postgresql-role make-postgresql-role
356 (name postgresql-role-name) ;string
357 (permissions postgresql-role-permissions
358 (default '(createdb login))) ;list
359 (create-database? postgresql-role-create-database? ;boolean
362 (define-record-type* <postgresql-role-configuration>
363 postgresql-role-configuration make-postgresql-role-configuration
364 postgresql-role-configuration?
365 (host postgresql-role-configuration-host ;string
366 (default "/var/run/postgresql"))
367 (log postgresql-role-configuration-log ;string
368 (default "/var/log/postgresql_roles.log"))
369 (roles postgresql-role-configuration-roles
370 (default '()))) ;list
372 (define (postgresql-create-roles config)
373 ;; See: https://www.postgresql.org/docs/current/sql-createrole.html for the
374 ;; complete permissions list.
375 (define (format-permissions permissions)
376 (let ((dict '(bypassrls createdb createrole login replication superuser)))
377 (string-join (filter-map (lambda (permission)
378 (and (member permission dict)
380 (symbol->string permission))))
384 (define (roles->queries roles)
385 (apply mixed-text-file "queries"
388 (match-record role <postgresql-role>
389 (name permissions create-database?)
390 `("SELECT NOT(EXISTS(SELECT 1 FROM pg_catalog.pg_roles WHERE \
391 rolname = '" ,name "')) as not_exists;\n"
394 "CREATE ROLE \"" ,name "\""
395 " WITH " ,(format-permissions permissions)
397 ,@(if create-database?
398 `("CREATE DATABASE \"" ,name "\""
399 " OWNER \"" ,name "\";\n")
404 (let ((host (postgresql-role-configuration-host config))
405 (roles (postgresql-role-configuration-roles config)))
406 #~(let ((psql #$(file-append postgresql "/bin/psql")))
407 (list psql "-a" "-h" #$host "-f" #$(roles->queries roles)))))
409 (define (postgresql-role-shepherd-service config)
410 (match-record config <postgresql-role-configuration>
412 (list (shepherd-service
413 (requirement '(postgres))
414 (provision '(postgres-roles))
418 (let ((pid (fork+exec-command
419 #$(postgresql-create-roles config)
423 (zero? (cdr (waitpid pid))))))
424 (documentation "Create PostgreSQL roles.")))))
426 (define postgresql-role-service-type
427 (service-type (name 'postgresql-role)
429 (list (service-extension shepherd-root-service-type
430 postgresql-role-shepherd-service)))
431 (compose concatenate)
432 (extend (lambda (config extended-roles)
433 (match-record config <postgresql-role-configuration>
435 (postgresql-role-configuration
437 (roles (append roles extended-roles))))))
438 (default-value (postgresql-role-configuration))
439 (description "Ensure the specified PostgreSQL roles are
440 created after the PostgreSQL database is started.")))
447 (define-record-type* <memcached-configuration>
448 memcached-configuration make-memcached-configuration
449 memcached-configuration?
450 (memcached memcached-configuration-memcached ;<package>
452 (interfaces memcached-configuration-interfaces
453 (default '("0.0.0.0")))
454 (tcp-port memcached-configuration-tcp-port
456 (udp-port memcached-configuration-udp-port
458 (additional-options memcached-configuration-additional-options
461 (define %memcached-accounts
462 (list (user-group (name "memcached") (system? #t))
467 (comment "Memcached server user")
468 (home-directory "/var/empty")
469 (shell (file-append shadow "/sbin/nologin")))))
471 (define memcached-activation
473 (use-modules (guix build utils))
474 (let ((user (getpwnam "memcached")))
475 (mkdir-p "/var/run/memcached")
476 (chown "/var/run/memcached"
477 (passwd:uid user) (passwd:gid user)))))
479 (define memcached-shepherd-service
481 (($ <memcached-configuration> memcached interfaces tcp-port udp-port
483 (with-imported-modules (source-module-closure
484 '((gnu build shepherd)))
485 (list (shepherd-service
486 (provision '(memcached))
487 (documentation "Run the Memcached daemon.")
488 (requirement '(user-processes loopback))
489 (modules '((gnu build shepherd)))
490 (start #~(make-forkexec-constructor
491 `(#$(file-append memcached "/bin/memcached")
492 "-l" #$(string-join interfaces ",")
493 "-p" #$(number->string tcp-port)
494 "-U" #$(number->string udp-port)
496 ;; Memcached changes to the memcached user prior to
497 ;; writing the pid file, so write it to a directory
498 ;; that memcached owns.
499 "-P" "/var/run/memcached/pid"
501 ,#$@additional-options)
502 #:log-file "/var/log/memcached"
503 #:pid-file "/var/run/memcached/pid"))
504 (stop #~(make-kill-destructor))))))))
506 (define memcached-service-type
507 (service-type (name 'memcached)
509 (list (service-extension shepherd-root-service-type
510 memcached-shepherd-service)
511 (service-extension activation-service-type
512 (const memcached-activation))
513 (service-extension account-service-type
514 (const %memcached-accounts))))
515 (default-value (memcached-configuration))))
522 (define-record-type* <mysql-configuration>
523 mysql-configuration make-mysql-configuration
525 (mysql mysql-configuration-mysql (default mariadb))
526 (bind-address mysql-configuration-bind-address (default "127.0.0.1"))
527 (port mysql-configuration-port (default 3306))
528 (socket mysql-configuration-socket (default "/run/mysqld/mysqld.sock"))
529 (extra-content mysql-configuration-extra-content (default ""))
530 (auto-upgrade? mysql-configuration-auto-upgrade? (default #t)))
532 (define %mysql-accounts
540 (home-directory "/var/empty")
541 (shell (file-append shadow "/sbin/nologin")))))
543 (define mysql-configuration-file
545 (($ <mysql-configuration> mysql bind-address port socket extra-content)
546 (mixed-text-file "my.cnf" "[mysqld]
547 datadir=/var/lib/mysql
549 bind-address=" bind-address "
550 port=" (number->string port) "
554 (define (%mysql-activation config)
555 "Return an activation gexp for the MySQL or MariaDB database server."
556 (let ((mysql (mysql-configuration-mysql config))
557 (my.cnf (mysql-configuration-file config)))
559 (use-modules (ice-9 popen)
561 (let* ((mysqld (string-append #$mysql "/bin/mysqld"))
562 (user (getpwnam "mysql"))
563 (uid (passwd:uid user))
564 (gid (passwd:gid user))
565 (datadir "/var/lib/mysql")
566 (rundir "/run/mysqld"))
568 (chown datadir uid gid)
570 (chown rundir uid gid)
571 ;; Initialize the database when it doesn't exist.
572 (when (not (file-exists? (string-append datadir "/mysql")))
573 (if (string-prefix? "mysql-" (strip-store-file-name #$mysql))
576 (string-append "--defaults-file=" #$my.cnf)
580 ;; XXX: The 'mysql_install_db' script doesn't work directly
581 ;; due to missing 'mkdir' in PATH.
582 (let ((p (open-pipe* OPEN_WRITE mysqld
584 "--defaults-file=" #$my.cnf)
587 ;; Create the system database, as does by 'mysql_install_db'.
588 (display "create database mysql;\n" p)
589 (display "use mysql;\n" p)
592 (call-with-input-file
593 (string-append #$mysql:lib "/share/mysql/" sql)
594 (lambda (in) (dump-port in p))))
595 '("mysql_system_tables.sql"
596 "mysql_performance_tables.sql"
597 "mysql_system_tables_data.sql"
598 "fill_help_tables.sql"))
599 ;; Remove the anonymous user and disable root access from
600 ;; remote machines, as does by 'mysql_secure_installation'.
602 DELETE FROM user WHERE User='';
603 DELETE FROM user WHERE User='root' AND
604 Host NOT IN ('localhost', '127.0.0.1', '::1');
607 (close-pipe p))))))))
609 (define (mysql-shepherd-service config)
610 (list (shepherd-service
612 (documentation "Run the MySQL server.")
613 (start (let ((mysql (mysql-configuration-mysql config))
614 (my.cnf (mysql-configuration-file config)))
615 #~(make-forkexec-constructor
616 (list (string-append #$mysql "/bin/mysqld")
617 (string-append "--defaults-file=" #$my.cnf))
618 #:user "mysql" #:group "mysql")))
619 (stop #~(make-kill-destructor)))))
621 (define (mysql-upgrade-wrapper mysql socket-file)
622 ;; The MySQL socket and PID file may appear before the server is ready to
623 ;; accept connections. Ensure the socket is responsive before attempting
624 ;; to run the upgrade script.
626 "mysql-upgrade-wrapper"
628 (let ((mysql-upgrade #$(file-append mysql "/bin/mysql_upgrade"))
634 (let ((sock (socket PF_UNIX SOCK_STREAM 0)))
635 (connect sock AF_UNIX #$socket-file)
637 ;; The socket is ready!
638 (execl mysql-upgrade mysql-upgrade
639 (string-append "--socket=" #$socket-file))))
646 (throw 'timeout-error
647 "MySQL server did not appear in time!"))))))))))
649 (define (mysql-upgrade-shepherd-service config)
650 (list (shepherd-service
651 (provision '(mysql-upgrade))
652 (requirement '(mysql))
654 (documentation "Upgrade MySQL database schemas.")
655 (start (let ((mysql (mysql-configuration-mysql config))
656 (socket (mysql-configuration-socket config)))
657 #~(make-forkexec-constructor
658 (list #$(mysql-upgrade-wrapper mysql socket))
659 #:user "mysql" #:group "mysql"))))))
661 (define (mysql-shepherd-services config)
662 (if (mysql-configuration-auto-upgrade? config)
663 (append (mysql-shepherd-service config)
664 (mysql-upgrade-shepherd-service config))
665 (mysql-shepherd-service config)))
667 (define mysql-service-type
671 (list (service-extension account-service-type
672 (const %mysql-accounts))
673 (service-extension activation-service-type
675 (service-extension shepherd-root-service-type
676 mysql-shepherd-services)))
677 (default-value (mysql-configuration))))
679 (define-deprecated (mysql-service #:key (config (mysql-configuration)))
681 (service mysql-service-type config))
688 (define-record-type* <redis-configuration>
689 redis-configuration make-redis-configuration
691 (redis redis-configuration-redis ;<package>
693 (bind redis-configuration-bind
694 (default "127.0.0.1"))
695 (port redis-configuration-port
697 (working-directory redis-configuration-working-directory
698 (default "/var/lib/redis"))
699 (config-file redis-configuration-config-file
702 (define (default-redis.conf bind port working-directory)
703 (mixed-text-file "redis.conf"
705 "port " (number->string port) "\n"
706 "dir " working-directory "\n"
709 (define %redis-accounts
710 (list (user-group (name "redis") (system? #t))
715 (comment "Redis server user")
716 (home-directory "/var/empty")
717 (shell (file-append shadow "/sbin/nologin")))))
719 (define redis-activation
721 (($ <redis-configuration> redis bind port working-directory config-file)
723 (use-modules (guix build utils)
726 (let ((user (getpwnam "redis")))
727 (mkdir-p #$working-directory)
728 (chown #$working-directory (passwd:uid user) (passwd:gid user)))))))
730 (define redis-shepherd-service
732 (($ <redis-configuration> redis bind port working-directory config-file)
735 (default-redis.conf bind port working-directory))))
736 (list (shepherd-service
738 (documentation "Run the Redis daemon.")
739 (requirement '(user-processes syslogd))
740 (start #~(make-forkexec-constructor
741 '(#$(file-append redis "/bin/redis-server")
745 (stop #~(make-kill-destructor))))))))
747 (define redis-service-type
748 (service-type (name 'redis)
750 (list (service-extension shepherd-root-service-type
751 redis-shepherd-service)
752 (service-extension activation-service-type
754 (service-extension account-service-type
755 (const %redis-accounts))))
756 (default-value (redis-configuration))))