gnu/services/dns.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2017 Julien Lepiller <julien@lepiller.eu>
   3 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
   4 ;;; Copyright © 2020 Pierre Langlois <pierre.langlois@gmx.com>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu services dns)
  22   #:use-module (gnu services)
  23   #:use-module (gnu services configuration)
  24   #:use-module (gnu services shepherd)
  25   #:use-module (gnu system shadow)
  26   #:use-module (gnu packages admin)
  27   #:use-module (gnu packages dns)
  28   #:use-module (guix packages)
  29   #:use-module (guix records)
  30   #:use-module (guix gexp)
  31   #:use-module (srfi srfi-1)
  32   #:use-module (srfi srfi-26)
  33   #:use-module (srfi srfi-34)
  34   #:use-module (srfi srfi-35)
  35   #:use-module (ice-9 match)
  36   #:use-module (ice-9 regex)
  37   #:export (knot-service-type
  38             knot-acl-configuration
  39             knot-key-configuration
  40             knot-keystore-configuration
  41             knot-zone-configuration
  42             knot-remote-configuration
  43             knot-policy-configuration
  44             knot-configuration
  45             define-zone-entries
  46             zone-file
  47             zone-entry
  48
  49             knot-resolver-service-type
  50             knot-resolver-configuration
  51
  52             dnsmasq-service-type
  53             dnsmasq-configuration
  54
  55             ddclient-service-type
  56             ddclient-configuration))
  57
  58 ;;;
  59 ;;; Knot DNS.
  60 ;;;
  61
  62 (define-record-type* <knot-key-configuration>
  63   knot-key-configuration make-knot-key-configuration
  64   knot-key-configuration?
  65   (id        knot-key-configuration-id
  66              (default ""))
  67   (algorithm knot-key-configuration-algorithm
  68              (default #f)); one of #f, or an algorithm name
  69   (secret    knot-key-configuration-secret
  70              (default "")))
  71
  72 (define-record-type* <knot-acl-configuration>
  73   knot-acl-configuration make-knot-acl-configuration
  74   knot-acl-configuration?
  75   (id      knot-acl-configuration-id
  76            (default ""))
  77   (address knot-acl-configuration-address
  78            (default '()))
  79   (key     knot-acl-configuration-key
  80            (default '()))
  81   (action  knot-acl-configuration-action
  82            (default '()))
  83   (deny?   knot-acl-configuration-deny?
  84            (default #f)))
  85
  86 (define-record-type* <zone-entry>
  87   zone-entry make-zone-entry
  88   zone-entry?
  89   (name  zone-entry-name
  90          (default "@"))
  91   (ttl   zone-entry-ttl
  92          (default ""))
  93   (class zone-entry-class
  94          (default "IN"))
  95   (type  zone-entry-type
  96          (default "A"))
  97   (data  zone-entry-data
  98          (default "")))
  99
 100 (define-record-type* <zone-file>
 101   zone-file make-zone-file
 102   zone-file?
 103   (entries zone-file-entries
 104            (default '()))
 105   (origin  zone-file-origin
 106            (default ""))
 107   (ns      zone-file-ns
 108            (default "ns"))
 109   (mail    zone-file-mail
 110            (default "hostmaster"))
 111   (serial  zone-file-serial
 112            (default 1))
 113   (refresh zone-file-refresh
 114            (default (* 2 24 3600)))
 115   (retry   zone-file-retry
 116            (default (* 15 60)))
 117   (expiry  zone-file-expiry
 118            (default (* 2 7 24 3600)))
 119   (nx      zone-file-nx
 120            (default 3600)))
 121 (define-record-type* <knot-keystore-configuration>
 122   knot-keystore-configuration make-knot-keystore-configuration
 123   knot-keystore-configuration?
 124   (id knot-keystore-configuration-id
 125       (default ""))
 126   (backend knot-keystore-configuration-backend
 127            (default 'pem))
 128   (config  knot-keystore-configuration-config
 129            (default "/var/lib/knot/keys/keys")))
 130
 131 (define-record-type* <knot-policy-configuration>
 132   knot-policy-configuration make-knot-policy-configuration
 133   knot-policy-configuration?
 134   (id                   knot-policy-configuration-id
 135                         (default ""))
 136   (keystore             knot-policy-configuration-keystore
 137                         (default "default"))
 138   (manual?              knot-policy-configuration-manual?
 139                         (default #f))
 140   (single-type-signing? knot-policy-configuration-single-type-signing?
 141                         (default #f))
 142   (algorithm            knot-policy-configuration-algorithm
 143                         (default "ecdsap256sha256"))
 144   (ksk-size             knot-policy-configuration-ksk-size
 145                         (default 256))
 146   (zsk-size             knot-policy-configuration-zsk-size
 147                         (default 256))
 148   (dnskey-ttl           knot-policy-configuration-dnskey-ttl
 149                         (default 'default))
 150   (zsk-lifetime         knot-policy-configuration-zsk-lifetime
 151                         (default (* 30 24 3600)))
 152   (propagation-delay    knot-policy-configuration-propagation-delay
 153                         (default (* 24 3600)))
 154   (rrsig-lifetime       knot-policy-configuration-rrsig-lifetime
 155                         (default (* 14 24 3600)))
 156   (rrsig-refresh        knot-policy-configuration-rrsig-refresh
 157                         (default (* 7 24 3600)))
 158   (nsec3?               knot-policy-configuration-nsec3?
 159                         (default #f))
 160   (nsec3-iterations     knot-policy-configuration-nsec3-iterations
 161                         (default 5))
 162   (nsec3-salt-length    knot-policy-configuration-nsec3-salt-length
 163                         (default 8))
 164   (nsec3-salt-lifetime  knot-policy-configuration-nsec3-salt-lifetime
 165                         (default (* 30 24 3600))))
 166
 167 (define-record-type* <knot-zone-configuration>
 168   knot-zone-configuration make-knot-zone-configuration
 169   knot-zone-configuration?
 170   (domain            knot-zone-configuration-domain
 171                      (default ""))
 172   (file              knot-zone-configuration-file
 173                      (default "")) ; the file where this zone is saved.
 174   (zone              knot-zone-configuration-zone
 175                      (default (zone-file))) ; initial content of the zone file
 176   (master            knot-zone-configuration-master
 177                      (default '()))
 178   (ddns-master       knot-zone-configuration-ddns-master
 179                      (default #f))
 180   (notify            knot-zone-configuration-notify
 181                      (default '()))
 182   (acl               knot-zone-configuration-acl
 183                      (default '()))
 184   (semantic-checks?  knot-zone-configuration-semantic-checks?
 185                      (default #f))
 186   (disable-any?      knot-zone-configuration-disable-any?
 187                      (default #f))
 188   (zonefile-sync     knot-zone-configuration-zonefile-sync
 189                      (default 0))
 190   (zonefile-load     knot-zone-configuration-zonefile-load
 191                      (default #f))
 192   (journal-content   knot-zone-configuration-journal-content
 193                      (default #f))
 194   (max-journal-usage knot-zone-configuration-max-journal-usage
 195                      (default #f))
 196   (max-journal-depth knot-zone-configuration-max-journal-depth
 197                      (default #f))
 198   (max-zone-size     knot-zone-configuration-max-zone-size
 199                      (default #f))
 200   (dnssec-policy     knot-zone-configuration-dnssec-policy
 201                      (default #f))
 202   (serial-policy     knot-zone-configuration-serial-policy
 203                      (default 'increment)))
 204
 205 (define-record-type* <knot-remote-configuration>
 206   knot-remote-configuration make-knot-remote-configuration
 207   knot-remote-configuration?
 208   (id  knot-remote-configuration-id
 209        (default ""))
 210   (address knot-remote-configuration-address
 211            (default '()))
 212   (via     knot-remote-configuration-via
 213            (default '()))
 214   (key     knot-remote-configuration-key
 215            (default #f)))
 216
 217 (define-record-type* <knot-configuration>
 218   knot-configuration make-knot-configuration
 219   knot-configuration?
 220   (knot          knot-configuration-knot
 221                  (default knot))
 222   (run-directory knot-configuration-run-directory
 223                  (default "/var/run/knot"))
 224   (includes      knot-configuration-includes
 225                  (default '()))
 226   (listen-v4     knot-configuration-listen-v4
 227                  (default "0.0.0.0"))
 228   (listen-v6     knot-configuration-listen-v6
 229                  (default "::"))
 230   (listen-port   knot-configuration-listen-port
 231                  (default 53))
 232   (keys          knot-configuration-keys
 233                  (default '()))
 234   (keystores     knot-configuration-keystores
 235                  (default '()))
 236   (acls          knot-configuration-acls
 237                  (default '()))
 238   (remotes       knot-configuration-remotes
 239                  (default '()))
 240   (policies      knot-configuration-policies
 241                  (default '()))
 242   (zones         knot-configuration-zones
 243                  (default '())))
 244
 245 (define-syntax define-zone-entries
 246   (syntax-rules ()
 247     ((_ id (name ttl class type data) ...)
 248      (define id (list (make-zone-entry name ttl class type data) ...)))))
 249
 250 (define (error-out msg)
 251   (raise (condition (&message (message msg)))))
 252
 253 (define (verify-knot-key-configuration key)
 254   (unless (knot-key-configuration? key)
 255     (error-out "keys must be a list of only knot-key-configuration."))
 256   (let ((id (knot-key-configuration-id key)))
 257     (unless (and (string? id) (not (equal? id "")))
 258       (error-out "key id must be a non empty string.")))
 259   (unless (memq '(#f hmac-md5 hmac-sha1 hmac-sha224 hmac-sha256 hmac-sha384 hmac-sha512)
 260                 (knot-key-configuration-algorithm key))
 261           (error-out "algorithm must be one of: #f, 'hmac-md5, 'hmac-sha1,
 262 'hmac-sha224, 'hmac-sha256, 'hmac-sha384 or 'hmac-sha512")))
 263
 264 (define (verify-knot-keystore-configuration keystore)
 265   (unless (knot-keystore-configuration? keystore)
 266     (error-out "keystores must be a list of only knot-keystore-configuration."))
 267   (let ((id (knot-keystore-configuration-id keystore)))
 268     (unless (and (string? id) (not (equal? id "")))
 269       (error-out "keystore id must be a non empty string.")))
 270   (unless (memq '(pem pkcs11)
 271                 (knot-keystore-configuration-backend keystore))
 272           (error-out "backend must be one of: 'pem or 'pkcs11")))
 273
 274 (define (verify-knot-policy-configuration policy)
 275   (unless (knot-policy-configuration? policy)
 276     (error-out "policies must be a list of only knot-policy-configuration."))
 277   (let ((id (knot-policy-configuration-id policy)))
 278     (unless (and (string? id) (not (equal? id "")))
 279       (error-out "policy id must be a non empty string."))))
 280
 281 (define (verify-knot-acl-configuration acl)
 282   (unless (knot-acl-configuration? acl)
 283     (error-out "acls must be a list of only knot-acl-configuration."))
 284   (let ((id (knot-acl-configuration-id acl))
 285         (address (knot-acl-configuration-address acl))
 286         (key (knot-acl-configuration-key acl))
 287         (action (knot-acl-configuration-action acl)))
 288     (unless (and (string? id) (not (equal? id "")))
 289       (error-out "acl id must be a non empty string."))
 290     (unless (and (list? address)
 291                  (fold (lambda (x1 x2) (and (string? x1) (string? x2))) "" address))
 292       (error-out "acl address must be a list of strings.")))
 293   (unless (boolean? (knot-acl-configuration-deny? acl))
 294     (error-out "deny? must be #t or #f.")))
 295
 296 (define (verify-knot-zone-configuration zone)
 297   (unless (knot-zone-configuration? zone)
 298     (error-out "zones must be a list of only knot-zone-configuration."))
 299   (let ((domain (knot-zone-configuration-domain zone)))
 300     (unless (and (string? domain) (not (equal? domain "")))
 301       (error-out "zone domain must be a non empty string."))))
 302
 303 (define (verify-knot-remote-configuration remote)
 304   (unless (knot-remote-configuration? remote)
 305     (error-out "remotes must be a list of only knot-remote-configuration."))
 306   (let ((id (knot-remote-configuration-id remote)))
 307     (unless (and (string? id) (not (equal? id "")))
 308       (error-out "remote id must be a non empty string."))))
 309
 310 (define (verify-knot-configuration config)
 311   (unless (package? (knot-configuration-knot config))
 312     (error-out "knot configuration field must be a package."))
 313   (unless (string? (knot-configuration-run-directory config))
 314     (error-out "run-directory must be a string."))
 315   (unless (list? (knot-configuration-includes config))
 316     (error-out "includes must be a list of strings or file-like objects."))
 317   (unless (list? (knot-configuration-keys config))
 318     (error-out "keys must be a list of knot-key-configuration."))
 319   (for-each (lambda (key) (verify-knot-key-configuration key))
 320             (knot-configuration-keys config))
 321   (unless (list? (knot-configuration-keystores config))
 322     (error-out "keystores must be a list of knot-keystore-configuration."))
 323   (for-each (lambda (keystore) (verify-knot-keystore-configuration keystore))
 324             (knot-configuration-keystores config))
 325   (unless (list? (knot-configuration-acls config))
 326     (error-out "acls must be a list of knot-acl-configuration."))
 327   (for-each (lambda (acl) (verify-knot-acl-configuration acl))
 328             (knot-configuration-acls config))
 329   (unless (list? (knot-configuration-zones config))
 330     (error-out "zones must be a list of knot-zone-configuration."))
 331   (for-each (lambda (zone) (verify-knot-zone-configuration zone))
 332             (knot-configuration-zones config))
 333   (unless (list? (knot-configuration-policies config))
 334     (error-out "policies must be a list of knot-policy-configuration."))
 335   (for-each (lambda (policy) (verify-knot-policy-configuration policy))
 336             (knot-configuration-policies config))
 337   (unless (list? (knot-configuration-remotes config))
 338     (error-out "remotes must be a list of knot-remote-configuration."))
 339   (for-each (lambda (remote) (verify-knot-remote-configuration remote))
 340             (knot-configuration-remotes config))
 341   #t)
 342
 343 (define (format-string-list l)
 344   "Formats a list of string in YAML"
 345   (if (eq? l '())
 346       ""
 347       (let ((l (reverse l)))
 348         (string-append
 349           "["
 350           (fold (lambda (x1 x2)
 351                   (string-append (if (symbol? x1) (symbol->string x1) x1) ", "
 352                                  (if (symbol? x2) (symbol->string x2) x2)))
 353                 (if (symbol? (car l)) (symbol->string (car l)) (car l)) (cdr l))
 354           "]"))))
 355
 356 (define (knot-acl-config acls)
 357   (with-output-to-string
 358     (lambda ()
 359       (for-each
 360         (lambda (acl-config)
 361           (let ((id (knot-acl-configuration-id acl-config))
 362                 (address (knot-acl-configuration-address acl-config))
 363                 (key (knot-acl-configuration-key acl-config))
 364                 (action (knot-acl-configuration-action acl-config))
 365                 (deny? (knot-acl-configuration-deny? acl-config)))
 366             (format #t "    - id: ~a\n" id)
 367             (unless (eq? address '())
 368               (format #t "      address: ~a\n" (format-string-list address)))
 369             (unless (eq? key '())
 370               (format #t "      key: ~a\n" (format-string-list key)))
 371             (unless (eq? action '())
 372               (format #t "      action: ~a\n" (format-string-list action)))
 373             (format #t "      deny: ~a\n" (if deny? "on" "off"))))
 374         acls))))
 375
 376 (define (knot-key-config keys)
 377   (with-output-to-string
 378     (lambda ()
 379       (for-each
 380         (lambda (key-config)
 381           (let ((id (knot-key-configuration-id key-config))
 382                 (algorithm (knot-key-configuration-algorithm key-config))
 383                 (secret (knot-key-configuration-secret key-config)))
 384             (format #t     "    - id: ~a\n" id)
 385             (if algorithm
 386                 (format #t "      algorithm: ~a\n" (symbol->string algorithm)))
 387             (format #t     "      secret: ~a\n" secret)))
 388         keys))))
 389
 390 (define (knot-keystore-config keystores)
 391   (with-output-to-string
 392     (lambda ()
 393       (for-each
 394         (lambda (keystore-config)
 395           (let ((id (knot-keystore-configuration-id keystore-config))
 396                 (backend (knot-keystore-configuration-backend keystore-config))
 397                 (config (knot-keystore-configuration-config keystore-config)))
 398             (format #t "    - id: ~a\n" id)
 399             (format #t "      backend: ~a\n" (symbol->string backend))
 400             (format #t "      config: \"~a\"\n" config)))
 401         keystores))))
 402
 403 (define (knot-policy-config policies)
 404   (with-output-to-string
 405     (lambda ()
 406       (for-each
 407         (lambda (policy-config)
 408           (let ((id (knot-policy-configuration-id policy-config))
 409                 (keystore (knot-policy-configuration-keystore policy-config))
 410                 (manual? (knot-policy-configuration-manual? policy-config))
 411                 (single-type-signing? (knot-policy-configuration-single-type-signing?
 412                                         policy-config))
 413                 (algorithm (knot-policy-configuration-algorithm policy-config))
 414                 (ksk-size (knot-policy-configuration-ksk-size policy-config))
 415                 (zsk-size (knot-policy-configuration-zsk-size policy-config))
 416                 (dnskey-ttl (knot-policy-configuration-dnskey-ttl policy-config))
 417                 (zsk-lifetime (knot-policy-configuration-zsk-lifetime policy-config))
 418                 (propagation-delay (knot-policy-configuration-propagation-delay
 419                                      policy-config))
 420                 (rrsig-lifetime (knot-policy-configuration-rrsig-lifetime
 421                                   policy-config))
 422                 (nsec3? (knot-policy-configuration-nsec3? policy-config))
 423                 (nsec3-iterations (knot-policy-configuration-nsec3-iterations
 424                                     policy-config))
 425                 (nsec3-salt-length (knot-policy-configuration-nsec3-salt-length
 426                                      policy-config))
 427                 (nsec3-salt-lifetime (knot-policy-configuration-nsec3-salt-lifetime
 428                                        policy-config)))
 429             (format #t "    - id: ~a\n" id)
 430             (format #t "      keystore: ~a\n" keystore)
 431             (format #t "      manual: ~a\n" (if manual? "on" "off"))
 432             (format #t "      single-type-signing: ~a\n" (if single-type-signing?
 433                                                              "on" "off"))
 434             (format #t "      algorithm: ~a\n" algorithm)
 435             (format #t "      ksk-size: ~a\n" (number->string ksk-size))
 436             (format #t "      zsk-size: ~a\n" (number->string zsk-size))
 437             (unless (eq? dnskey-ttl 'default)
 438               (format #t "      dnskey-ttl: ~a\n" dnskey-ttl))
 439             (format #t "      zsk-lifetime: ~a\n" zsk-lifetime)
 440             (format #t "      propagation-delay: ~a\n" propagation-delay)
 441             (format #t "      rrsig-lifetime: ~a\n" rrsig-lifetime)
 442             (format #t "      nsec3: ~a\n" (if nsec3? "on" "off"))
 443             (format #t "      nsec3-iterations: ~a\n"
 444                     (number->string nsec3-iterations))
 445             (format #t "      nsec3-salt-length: ~a\n"
 446                     (number->string nsec3-salt-length))
 447             (format #t "      nsec3-salt-lifetime: ~a\n" nsec3-salt-lifetime)))
 448         policies))))
 449
 450 (define (knot-remote-config remotes)
 451   (with-output-to-string
 452     (lambda ()
 453       (for-each
 454         (lambda (remote-config)
 455           (let ((id (knot-remote-configuration-id remote-config))
 456                 (address (knot-remote-configuration-address remote-config))
 457                 (via (knot-remote-configuration-via remote-config))
 458                 (key (knot-remote-configuration-key remote-config)))
 459             (format #t "    - id: ~a\n" id)
 460             (unless (eq? address '())
 461               (format #t "      address: ~a\n" (format-string-list address)))
 462             (unless (eq? via '())
 463               (format #t "      via: ~a\n" (format-string-list via)))
 464             (if key
 465               (format #t "      key: ~a\n" key))))
 466         remotes))))
 467
 468 (define (serialize-zone-entries entries)
 469   (with-output-to-string
 470     (lambda ()
 471       (for-each
 472         (lambda (entry)
 473           (let ((name (zone-entry-name entry))
 474                 (ttl (zone-entry-ttl entry))
 475                 (class (zone-entry-class entry))
 476                 (type (zone-entry-type entry))
 477                 (data (zone-entry-data entry)))
 478             (format #t "~a ~a ~a ~a ~a\n" name ttl class type data)))
 479         entries))))
 480
 481 (define (serialize-zone-file zone domain)
 482   (computed-file (string-append domain ".zone")
 483     #~(begin
 484         (call-with-output-file #$output
 485           (lambda (port)
 486             (format port "$ORIGIN ~a.\n"
 487                     #$(zone-file-origin zone))
 488             (format port "@ IN SOA ~a ~a (~a ~a ~a ~a ~a)\n"
 489                     #$(zone-file-ns zone)
 490                     #$(zone-file-mail zone)
 491                     #$(zone-file-serial zone)
 492                     #$(zone-file-refresh zone)
 493                     #$(zone-file-retry zone)
 494                     #$(zone-file-expiry zone)
 495                     #$(zone-file-nx zone))
 496             (format port "~a\n"
 497                     #$(serialize-zone-entries (zone-file-entries zone))))))))
 498
 499 (define (knot-zone-config zone)
 500   (let ((content (knot-zone-configuration-zone zone)))
 501     #~(with-output-to-string
 502         (lambda ()
 503           (let ((domain #$(knot-zone-configuration-domain zone))
 504                 (file #$(knot-zone-configuration-file zone))
 505                 (master (list #$@(knot-zone-configuration-master zone)))
 506                 (ddns-master #$(knot-zone-configuration-ddns-master zone))
 507                 (notify (list #$@(knot-zone-configuration-notify zone)))
 508                 (acl (list #$@(knot-zone-configuration-acl zone)))
 509                 (semantic-checks? #$(knot-zone-configuration-semantic-checks? zone))
 510                 (disable-any? #$(knot-zone-configuration-disable-any? zone))
 511                 (zonefile-sync #$(knot-zone-configuration-zonefile-sync zone))
 512                 (zonefile-load '#$(knot-zone-configuration-zonefile-load zone))
 513                 (journal-content #$(knot-zone-configuration-journal-content zone))
 514                 (max-journal-usage #$(knot-zone-configuration-max-journal-usage zone))
 515                 (max-journal-depth #$(knot-zone-configuration-max-journal-depth zone))
 516                 (max-zone-size #$(knot-zone-configuration-max-zone-size zone))
 517                 (dnssec-policy #$(knot-zone-configuration-dnssec-policy zone))
 518                 (serial-policy '#$(knot-zone-configuration-serial-policy zone)))
 519             (format #t "    - domain: ~a\n" domain)
 520             (if (eq? master '())
 521                 ;; This server is a master
 522                 (if (equal? file "")
 523                   (format #t "      file: ~a\n"
 524                     #$(serialize-zone-file content
 525                                            (knot-zone-configuration-domain zone)))
 526                   (format #t "      file: ~a\n" file))
 527                 ;; This server is a slave (has masters)
 528                 (begin
 529                   (format #t "      master: ~a\n"
 530                           #$(format-string-list
 531                               (knot-zone-configuration-master zone)))
 532                   (if ddns-master (format #t "      ddns-master ~a\n" ddns-master))))
 533             (unless (eq? notify '())
 534               (format #t "      notify: ~a\n"
 535                       #$(format-string-list
 536                           (knot-zone-configuration-notify zone))))
 537             (unless (eq? acl '())
 538               (format #t "      acl: ~a\n"
 539                       #$(format-string-list
 540                           (knot-zone-configuration-acl zone))))
 541             (format #t "      semantic-checks: ~a\n" (if semantic-checks? "on" "off"))
 542             (format #t "      disable-any: ~a\n" (if disable-any? "on" "off"))
 543             (if zonefile-sync
 544               (format #t "      zonefile-sync: ~a\n" zonefile-sync))
 545             (if zonefile-load
 546               (format #t "      zonefile-load: ~a\n"
 547                       (symbol->string zonefile-load)))
 548             (if journal-content
 549               (format #t "      journal-content: ~a\n"
 550                       (symbol->string journal-content)))
 551             (if max-journal-usage
 552               (format #t "      max-journal-usage: ~a\n" max-journal-usage))
 553             (if max-journal-depth
 554               (format #t "      max-journal-depth: ~a\n" max-journal-depth))
 555             (if max-zone-size
 556               (format #t "      max-zone-size: ~a\n" max-zone-size))
 557             (if dnssec-policy
 558                 (begin
 559                   (format #t "      dnssec-signing: on\n")
 560                   (format #t "      dnssec-policy: ~a\n" dnssec-policy)))
 561             (format #t "      serial-policy: ~a\n"
 562                     (symbol->string serial-policy)))))))
 563
 564 (define (knot-config-file config)
 565   (verify-knot-configuration config)
 566   (computed-file "knot.conf"
 567     #~(begin
 568         (call-with-output-file #$output
 569           (lambda (port)
 570             (for-each (lambda (inc)
 571                         (format port "include: ~a\n" inc))
 572                       '#$(knot-configuration-includes config))
 573             (format port "server:\n")
 574             (format port "    rundir: ~a\n" #$(knot-configuration-run-directory config))
 575             (format port "    user: knot\n")
 576             (format port "    listen: ~a@~a\n"
 577                     #$(knot-configuration-listen-v4 config)
 578                     #$(knot-configuration-listen-port config))
 579             (format port "    listen: ~a@~a\n"
 580                     #$(knot-configuration-listen-v6 config)
 581                     #$(knot-configuration-listen-port config))
 582             (format port "\nkey:\n")
 583             (format port #$(knot-key-config (knot-configuration-keys config)))
 584             (format port "\nkeystore:\n")
 585             (format port #$(knot-keystore-config (knot-configuration-keystores config)))
 586             (format port "\nacl:\n")
 587             (format port #$(knot-acl-config (knot-configuration-acls config)))
 588             (format port "\nremote:\n")
 589             (format port #$(knot-remote-config (knot-configuration-remotes config)))
 590             (format port "\npolicy:\n")
 591             (format port #$(knot-policy-config (knot-configuration-policies config)))
 592             (unless #$(eq? (knot-configuration-zones config) '())
 593               (format port "\nzone:\n")
 594               (format port "~a\n"
 595                       (string-concatenate
 596                         (list #$@(map knot-zone-config
 597                                       (knot-configuration-zones config)))))))))))
 598
 599 (define %knot-accounts
 600   (list (user-group (name "knot") (system? #t))
 601         (user-account
 602           (name "knot")
 603           (group "knot")
 604           (system? #t)
 605           (comment "knot dns server user")
 606           (home-directory "/var/empty")
 607           (shell (file-append shadow "/sbin/nologin")))))
 608
 609 (define (knot-activation config)
 610   #~(begin
 611       (use-modules (guix build utils))
 612       (define (mkdir-p/perms directory owner perms)
 613         (mkdir-p directory)
 614         (chown directory (passwd:uid owner) (passwd:gid owner))
 615         (chmod directory perms))
 616       (mkdir-p/perms #$(knot-configuration-run-directory config)
 617                      (getpwnam "knot") #o755)
 618       (mkdir-p/perms "/var/lib/knot" (getpwnam "knot") #o755)
 619       (mkdir-p/perms "/var/lib/knot/keys" (getpwnam "knot") #o755)
 620       (mkdir-p/perms "/var/lib/knot/keys/keys" (getpwnam "knot") #o755)))
 621
 622 (define (knot-shepherd-service config)
 623   (let* ((config-file (knot-config-file config))
 624          (knot (knot-configuration-knot config)))
 625     (list (shepherd-service
 626             (documentation "Run the Knot DNS daemon.")
 627             (provision '(knot dns))
 628             (requirement '(networking))
 629             (start #~(make-forkexec-constructor
 630                        (list (string-append #$knot "/sbin/knotd")
 631                              "-c" #$config-file)))
 632             (stop #~(make-kill-destructor))))))
 633
 634 (define knot-service-type
 635   (service-type (name 'knot)
 636                 (extensions
 637                   (list (service-extension shepherd-root-service-type
 638                                            knot-shepherd-service)
 639                         (service-extension activation-service-type
 640                                            knot-activation)
 641                         (service-extension account-service-type
 642                                            (const %knot-accounts))))
 643                 (description
 644                  "Run @uref{https://www.knot-dns.cz/, Knot}, an authoritative
 645 name server for the @acronym{DNS, Domain Name System}.")))
 646
 647 \f
 648 ;;;
 649 ;;; Knot Resolver.
 650 ;;;
 651
 652 (define-record-type* <knot-resolver-configuration>
 653   knot-resolver-configuration
 654   make-knot-resolver-configuration
 655   knot-resolver-configuration?
 656   (package knot-resolver-configuration-package
 657            (default knot-resolver))
 658   (kresd-config-file knot-resolver-kresd-config-file
 659                      (default %kresd.conf))
 660   (garbage-collection-interval knot-resolver-garbage-collection-interval
 661                                (default 1000)))
 662
 663 (define %kresd.conf
 664   (plain-file "kresd.conf" "-- -*- mode: lua -*-
 665 trust_anchors.add_file('/var/cache/knot-resolver/root.keys')
 666 net = { '127.0.0.1', '::1' }
 667 user('knot-resolver', 'knot-resolver')
 668 modules = { 'hints > iterate', 'stats', 'predict' }
 669 cache.size = 100 * MB
 670 "))
 671
 672 (define %knot-resolver-accounts
 673   (list (user-group
 674          (name "knot-resolver")
 675          (system? #t))
 676         (user-account
 677          (name "knot-resolver")
 678          (group "knot-resolver")
 679          (system? #t)
 680          (home-directory "/var/cache/knot-resolver")
 681          (shell (file-append shadow "/sbin/nologin")))))
 682
 683 (define (knot-resolver-activation config)
 684   #~(begin
 685       (use-modules (guix build utils))
 686       (let ((rundir "/var/cache/knot-resolver")
 687             (owner (getpwnam "knot-resolver")))
 688         (mkdir-p rundir)
 689         (chown rundir (passwd:uid owner) (passwd:gid owner)))))
 690
 691 (define knot-resolver-shepherd-services
 692   (match-lambda
 693     (($ <knot-resolver-configuration> package
 694                                       kresd-config-file
 695                                       garbage-collection-interval)
 696      (list
 697       (shepherd-service
 698        (provision '(kresd))
 699        (requirement '(networking))
 700        (documentation "Run the Knot Resolver daemon.")
 701        (start #~(make-forkexec-constructor
 702                  '(#$(file-append package "/sbin/kresd")
 703                    "-c" #$kresd-config-file "-f" "1"
 704                    "/var/cache/knot-resolver")))
 705        (stop #~(make-kill-destructor)))
 706       (shepherd-service
 707        (provision '(kres-cache-gc))
 708        (requirement '(user-processes))
 709        (documentation "Run the Knot Resolver Garbage Collector daemon.")
 710        (start #~(make-forkexec-constructor
 711                  '(#$(file-append package "/sbin/kres-cache-gc")
 712                    "-d" #$(number->string garbage-collection-interval)
 713                    "-c" "/var/cache/knot-resolver")
 714                  #:user "knot-resolver"
 715                  #:group "knot-resolver"))
 716        (stop #~(make-kill-destructor)))))))
 717
 718 (define knot-resolver-service-type
 719   (service-type
 720    (name 'knot-resolver)
 721    (extensions
 722     (list (service-extension shepherd-root-service-type
 723                              knot-resolver-shepherd-services)
 724           (service-extension activation-service-type
 725                              knot-resolver-activation)
 726           (service-extension account-service-type
 727                              (const %knot-resolver-accounts))))
 728    (default-value (knot-resolver-configuration))
 729    (description "Run the Knot DNS Resolver.")))
 730
 731 \f
 732 ;;;
 733 ;;; Dnsmasq.
 734 ;;;
 735
 736 (define-record-type* <dnsmasq-configuration>
 737   dnsmasq-configuration make-dnsmasq-configuration
 738   dnsmasq-configuration?
 739   (package          dnsmasq-configuration-package
 740                     (default dnsmasq))  ;package
 741   (no-hosts?        dnsmasq-configuration-no-hosts?
 742                     (default #f))       ;boolean
 743   (port             dnsmasq-configuration-port
 744                     (default 53))       ;integer
 745   (local-service?   dnsmasq-configuration-local-service?
 746                     (default #t))       ;boolean
 747   (listen-addresses dnsmasq-configuration-listen-address
 748                     (default '()))      ;list of string
 749   (resolv-file      dnsmasq-configuration-resolv-file
 750                     (default "/etc/resolv.conf")) ;string
 751   (no-resolv?       dnsmasq-configuration-no-resolv?
 752                     (default #f))       ;boolean
 753   (servers          dnsmasq-configuration-servers
 754                     (default '()))      ;list of string
 755   (addresses        dnsmasq-configuration-addresses
 756                     (default '()))      ;list of string
 757   (cache-size       dnsmasq-configuration-cache-size
 758                     (default 150))      ;integer
 759   (negative-cache?  dnsmasq-configuration-negative-cache?
 760                     (default #t)))      ;boolean
 761
 762 (define dnsmasq-shepherd-service
 763   (match-lambda
 764     (($ <dnsmasq-configuration> package
 765                                 no-hosts?
 766                                 port local-service? listen-addresses
 767                                 resolv-file no-resolv? servers
 768                                 addresses cache-size negative-cache?)
 769      (shepherd-service
 770       (provision '(dnsmasq))
 771       (requirement '(networking))
 772       (documentation "Run the dnsmasq DNS server.")
 773       (start #~(make-forkexec-constructor
 774                 '(#$(file-append package "/sbin/dnsmasq")
 775                   "--keep-in-foreground"
 776                   "--pid-file=/run/dnsmasq.pid"
 777                   #$@(if no-hosts?
 778                          '("--no-hosts")
 779                          '())
 780                   #$(format #f "--port=~a" port)
 781                   #$@(if local-service?
 782                          '("--local-service")
 783                          '())
 784                   #$@(map (cut format #f "--listen-address=~a" <>)
 785                           listen-addresses)
 786                   #$(format #f "--resolv-file=~a" resolv-file)
 787                   #$@(if no-resolv?
 788                          '("--no-resolv")
 789                          '())
 790                   #$@(map (cut format #f "--server=~a" <>)
 791                           servers)
 792                   #$@(map (cut format #f "--address=~a" <>)
 793                           addresses)
 794                   #$(format #f "--cache-size=~a" cache-size)
 795                   #$@(if negative-cache?
 796                          '()
 797                          '("--no-negcache")))
 798                 #:pid-file "/run/dnsmasq.pid"))
 799       (stop #~(make-kill-destructor))))))
 800
 801 (define dnsmasq-service-type
 802   (service-type
 803    (name 'dnsmasq)
 804    (extensions
 805     (list (service-extension shepherd-root-service-type
 806                              (compose list dnsmasq-shepherd-service))))
 807    (default-value (dnsmasq-configuration))
 808    (description "Run the dnsmasq DNS server.")))
 809
 810 \f
 811 ;;;
 812 ;;; ddclient
 813 ;;;
 814
 815 (define (uglify-field-name field-name)
 816   (string-delete #\? (symbol->string field-name)))
 817
 818 (define (serialize-field field-name val)
 819   (when (not (member field-name '(group secret-file user)))
 820     (format #t "~a=~a\n" (uglify-field-name field-name) val)))
 821
 822 (define (serialize-boolean field-name val)
 823   (serialize-field field-name (if val "yes" "no")))
 824
 825 (define (serialize-integer field-name val)
 826   (serialize-field field-name (number->string val)))
 827
 828 (define (serialize-string field-name val)
 829   (if (and (string? val) (string=? val ""))
 830       ""
 831       (serialize-field field-name val)))
 832
 833 (define (serialize-list field-name val)
 834   (if (null? val) "" (serialize-field field-name (string-join val))))
 835
 836 (define (serialize-extra-options extra-options)
 837   (string-join extra-options "\n" 'suffix))
 838
 839 (define-configuration ddclient-configuration
 840   (ddclient
 841    (package ddclient)
 842    "The ddclient package.")
 843   (daemon
 844    (integer 300)
 845    "The period after which ddclient will retry to check IP and domain name.")
 846   (syslog
 847    (boolean #t)
 848    "Use syslog for the output.")
 849   (mail
 850    (string "root")
 851    "Mail to user.")
 852   (mail-failure
 853    (string "root")
 854    "Mail failed update to user.")
 855   (pid
 856    (string "/var/run/ddclient/ddclient.pid")
 857    "The ddclient PID file.")
 858   (ssl
 859    (boolean #t)
 860    "Enable SSL support.")
 861   (user
 862    (string "ddclient")
 863    "Specifies the user name or ID that is used when running ddclient
 864 program.")
 865   (group
 866    (string "ddclient")
 867    "Group of the user who will run the ddclient program.")
 868   (secret-file
 869    (string "/etc/ddclient/secrets.conf")
 870    "Secret file which will be appended to @file{ddclient.conf} file.  This
 871 file contains credentials for use by ddclient.  You are expected to create it
 872 manually.")
 873   (extra-options
 874    (list '())
 875    "Extra options will be appended to @file{ddclient.conf} file."))
 876
 877 (define (ddclient-account config)
 878   "Return the user accounts and user groups for CONFIG."
 879   (let ((ddclient-user (ddclient-configuration-user config))
 880         (ddclient-group (ddclient-configuration-group config)))
 881     (list (user-group
 882            (name ddclient-group)
 883            (system? #t))
 884           (user-account
 885            (name ddclient-user)
 886            (system? #t)
 887            (group ddclient-group)
 888            (comment "ddclientd privilege separation user")
 889            (home-directory (string-append "/var/run/" ddclient-user))))))
 890
 891 (define (ddclient-activation config)
 892   "Return the activation GEXP for CONFIG."
 893   (with-imported-modules '((guix build utils)
 894                            (ice-9 rdelim))
 895     #~(begin
 896         (use-modules (guix build utils)
 897                      (ice-9 rdelim))
 898         (let ((ddclient-user
 899                (passwd:uid (getpw #$(ddclient-configuration-user config))))
 900               (ddclient-group
 901                (passwd:gid (getpw #$(ddclient-configuration-group config))))
 902               (ddclient-secret-file
 903                #$(ddclient-configuration-secret-file config)))
 904           ;; 'ddclient' complains about ddclient.conf file permissions, which
 905           ;; rules out /gnu/store.  Thus we copy the ddclient.conf to /etc.
 906           (for-each (lambda (dir)
 907                       (mkdir-p dir)
 908                       (chmod dir #o700)
 909                       (chown dir ddclient-user ddclient-group))
 910                     '("/var/cache/ddclient" "/var/run/ddclient"
 911                       "/etc/ddclient"))
 912           (with-output-to-file "/etc/ddclient/ddclient.conf"
 913             (lambda ()
 914               (display
 915                (string-append
 916                 "# Generated by 'ddclient-service'.\n\n"
 917                 #$(with-output-to-string
 918                     (lambda ()
 919                       (serialize-configuration config
 920                                                ddclient-configuration-fields)))
 921                 (if (string-null? ddclient-secret-file)
 922                     ""
 923                     (format #f "\n\n# Appended from '~a'.\n\n~a"
 924                             ddclient-secret-file
 925                             (with-input-from-file ddclient-secret-file
 926                               read-string)))))))
 927           (chmod "/etc/ddclient/ddclient.conf" #o600)
 928           (chown "/etc/ddclient/ddclient.conf"
 929                  ddclient-user ddclient-group)))))
 930
 931 (define (ddclient-shepherd-service config)
 932   "Return a <shepherd-service> for ddclient with CONFIG."
 933   (let ((ddclient (ddclient-configuration-ddclient config))
 934         (ddclient-pid (ddclient-configuration-pid config))
 935         (ddclient-user (ddclient-configuration-user config))
 936         (ddclient-group (ddclient-configuration-group config)))
 937     (list (shepherd-service
 938            (provision '(ddclient))
 939            (documentation "Run ddclient daemon.")
 940            (start #~(make-forkexec-constructor
 941                      (list #$(file-append ddclient "/bin/ddclient")
 942                            "-foreground"
 943                            "-file" "/etc/ddclient/ddclient.conf")
 944                      #:pid-file #$ddclient-pid
 945                      #:environment-variables
 946                      (list "SSL_CERT_DIR=/run/current-system/profile\
 947 /etc/ssl/certs"
 948                            "SSL_CERT_FILE=/run/current-system/profile\
 949 /etc/ssl/certs/ca-certificates.crt")
 950                      #:user #$ddclient-user
 951                      #:group #$ddclient-group))
 952            (stop #~(make-kill-destructor))))))
 953
 954 (define ddclient-service-type
 955   (service-type
 956    (name 'ddclient)
 957    (extensions
 958     (list (service-extension account-service-type
 959                              ddclient-account)
 960           (service-extension shepherd-root-service-type
 961                              ddclient-shepherd-service)
 962           (service-extension activation-service-type
 963                              ddclient-activation)))
 964    (default-value (ddclient-configuration))
 965    (description "Configure address updating utility for dynamic DNS services,
 966 ddclient.")))
 967
 968 (define (generate-ddclient-documentation)
 969   (generate-documentation
 970    `((ddclient-configuration ,ddclient-configuration-fields))
 971    'ddclient-configuration))