1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
3 ;;; Copyright © 2015, 2016 Ludovic Courtès <ludo@gnu.org>
4 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
5 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
6 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
7 ;;; Copyright © 2018 Julien Lepiller <julien@lepiller.eu>
8 ;;; Copyright © 2019 Robert Vollmert <rob@vllmrt.net>
9 ;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
10 ;;; Copyright © 2021 David Larsson <david.larsson@selfhosted.xyz>
12 ;;; This file is part of GNU Guix.
14 ;;; GNU Guix is free software; you can redistribute it and/or modify it
15 ;;; under the terms of the GNU General Public License as published by
16 ;;; the Free Software Foundation; either version 3 of the License, or (at
17 ;;; your option) any later version.
19 ;;; GNU Guix is distributed in the hope that it will be useful, but
20 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
21 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 ;;; GNU General Public License for more details.
24 ;;; You should have received a copy of the GNU General Public License
25 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
27 (define-module (gnu services databases)
28 #:use-module (gnu services)
29 #:use-module (gnu services shepherd)
30 #:use-module (gnu system shadow)
31 #:use-module (gnu packages admin)
32 #:use-module (gnu packages databases)
33 #:use-module (guix build-system trivial)
34 #:use-module (guix build union)
35 #:use-module (guix deprecation)
36 #:use-module (guix modules)
37 #:use-module (guix packages)
38 #:use-module (guix records)
39 #:use-module (guix gexp)
40 #:use-module (srfi srfi-1)
41 #:use-module (ice-9 match)
42 #:export (postgresql-config-file
43 postgresql-config-file?
44 postgresql-config-file-log-destination
45 postgresql-config-file-hba-file
46 postgresql-config-file-ident-file
47 postgresql-config-file-socket-directory
48 postgresql-config-file-extra-config
50 postgresql-configuration
51 postgresql-configuration?
52 postgresql-configuration-postgresql
53 postgresql-configuration-port
54 postgresql-configuration-locale
55 postgresql-configuration-file
56 postgresql-configuration-log-directory
57 postgresql-configuration-data-directory
60 postgresql-service-type
65 postgresql-role-permissions
66 postgresql-role-create-database?
67 postgresql-role-configuration
68 postgresql-role-configuration?
69 postgresql-role-configuration-host
70 postgresql-role-configuration-roles
72 postgresql-role-service-type
74 memcached-service-type
75 memcached-configuration
76 memcached-configuration?
77 memcached-configuration-memecached
78 memcached-configuration-interfaces
79 memcached-configuration-tcp-port
80 memcached-configuration-udp-port
81 memcached-configuration-additional-options
94 ;;; Database services.
98 (define %default-postgres-hba
99 (plain-file "pg_hba.conf"
102 host all all 127.0.0.1/32 md5
103 host all all ::1/128 md5"))
105 (define %default-postgres-ident
106 (plain-file "pg_ident.conf"
107 "# MAPNAME SYSTEM-USERNAME PG-USERNAME"))
109 (define-record-type* <postgresql-config-file>
110 postgresql-config-file make-postgresql-config-file
111 postgresql-config-file?
112 (log-destination postgresql-config-file-log-destination
114 (hba-file postgresql-config-file-hba-file
115 (default %default-postgres-hba))
116 (ident-file postgresql-config-file-ident-file
117 (default %default-postgres-ident))
118 (socket-directory postgresql-config-file-socket-directory
120 (extra-config postgresql-config-file-extra-config
123 (define-gexp-compiler (postgresql-config-file-compiler
124 (file <postgresql-config-file>) system target)
126 (($ <postgresql-config-file> log-destination hba-file
127 ident-file socket-directory
129 ;; See: https://www.postgresql.org/docs/current/config-setting.html.
130 (define (format-value value)
133 (list (if value "on" "off")))
135 (list (number->string value)))
137 (list "'" value "'"))))
145 `(,key " = " ,@(append-map format-value values) "\n")))
147 `(("log_destination" ,log-destination)
148 ("hba_file" ,hba-file)
149 ("ident_file" ,ident-file)
150 ,@(if socket-directory
151 `(("unix_socket_directories" ,socket-directory))
157 #~(call-with-output-file (ungexp output "out")
160 (string-append #$@contents)
162 #:local-build? #t))))
164 (define-record-type* <postgresql-configuration>
165 postgresql-configuration make-postgresql-configuration
166 postgresql-configuration?
167 (postgresql postgresql-configuration-postgresql) ;<package>
168 (port postgresql-configuration-port
170 (locale postgresql-configuration-locale
171 (default "en_US.utf8"))
172 (config-file postgresql-configuration-file
173 (default (postgresql-config-file)))
174 (log-directory postgresql-configuration-log-directory
175 (default "/var/log/postgresql"))
176 (data-directory postgresql-configuration-data-directory
177 (default "/var/lib/postgresql/data"))
178 (extension-packages postgresql-configuration-extension-packages
181 (define %postgresql-accounts
182 (list (user-group (name "postgres") (system? #t))
187 (comment "PostgreSQL server user")
188 (home-directory "/var/empty")
189 (shell (file-append shadow "/sbin/nologin")))))
191 (define (final-postgresql postgresql extension-packages)
192 (if (null? extension-packages)
197 (build-system trivial-build-system)
199 `(#:modules ((guix build utils) (guix build union))
202 (use-modules (guix build utils) (guix build union) (srfi srfi-26))
203 (union-build (assoc-ref %outputs "out")
204 (map (lambda (input) (cdr input))
208 `(("postgresql" ,postgresql)
209 ,@(map (lambda (extension) (list "extension" extension))
210 extension-packages))))))
212 (define postgresql-activation
214 (($ <postgresql-configuration> postgresql port locale config-file
215 log-directory data-directory
218 (use-modules (guix build utils)
221 (let ((user (getpwnam "postgres"))
222 (initdb (string-append
223 #$(final-postgresql postgresql
229 (list (string-append "--locale=" #$locale))
231 ;; Create db state directory.
232 (mkdir-p #$data-directory)
233 (chown #$data-directory (passwd:uid user) (passwd:gid user))
235 ;; Create the socket directory.
236 (let ((socket-directory
237 #$(postgresql-config-file-socket-directory config-file)))
238 (when (string? socket-directory)
239 (mkdir-p socket-directory)
240 (chown socket-directory (passwd:uid user) (passwd:gid user))))
242 ;; Create the log directory.
243 (when (string? #$log-directory)
244 (mkdir-p #$log-directory)
245 (chown #$log-directory (passwd:uid user) (passwd:gid user)))
247 ;; Drop privileges and init state directory in a new
248 ;; process. Wait for it to finish before proceeding.
249 (match (primitive-fork)
251 ;; Exit with a non-zero status code if an exception is thrown.
255 (setgid (passwd:gid user))
256 (setuid (passwd:uid user))
264 (primitive-exit 1))))
265 (pid (waitpid pid))))))))
267 (define postgresql-shepherd-service
269 (($ <postgresql-configuration> postgresql port locale config-file
270 log-directory data-directory
272 (let* ((pg_ctl-wrapper
273 ;; Wrapper script that switches to the 'postgres' user before
278 (use-modules (ice-9 match)
280 (match (command-line)
282 (let ((user (getpwnam "postgres"))
283 (pg_ctl #$(file-append
284 (final-postgresql postgresql
287 (options (format #f "--config-file=~a -p ~d"
288 #$config-file #$port)))
289 (setgid (passwd:gid user))
290 (setuid (passwd:uid user))
291 (execl pg_ctl pg_ctl "-D" #$data-directory
292 #$@(if (string? log-directory)
294 (string-append log-directory
299 (pid-file (in-vicinity data-directory "postmaster.pid"))
302 (invoke #$pg_ctl-wrapper #$@args)
305 (call-with-input-file #$pid-file read))
307 (list (shepherd-service
308 (provision '(postgres))
309 (documentation "Run the PostgreSQL daemon.")
310 (requirement '(user-processes loopback syslogd))
311 (modules `((ice-9 match)
313 (start (action "start"))
314 (stop (action "stop"))))))))
316 (define postgresql-service-type
320 (list (service-extension shepherd-root-service-type
321 postgresql-shepherd-service)
322 (service-extension activation-service-type
323 postgresql-activation)
324 (service-extension account-service-type
325 (const %postgresql-accounts))
328 (compose list postgresql-configuration-postgresql))))
329 (default-value (postgresql-configuration
330 (postgresql postgresql-10)))))
332 (define-deprecated (postgresql-service #:key (postgresql postgresql)
334 (locale "en_US.utf8")
335 (config-file (postgresql-config-file))
337 "/var/lib/postgresql/data")
338 (extension-packages '()))
339 postgresql-service-type
340 "Return a service that runs @var{postgresql}, the PostgreSQL database
343 The PostgreSQL daemon loads its runtime configuration from @var{config-file}
344 and stores the database cluster in @var{data-directory}."
345 (service postgresql-service-type
346 (postgresql-configuration
347 (postgresql postgresql)
350 (config-file config-file)
351 (data-directory data-directory)
352 (extension-packages extension-packages))))
354 (define-record-type* <postgresql-role>
355 postgresql-role make-postgresql-role
357 (name postgresql-role-name) ;string
358 (permissions postgresql-role-permissions
359 (default '(createdb login))) ;list
360 (create-database? postgresql-role-create-database? ;boolean
363 (define-record-type* <postgresql-role-configuration>
364 postgresql-role-configuration make-postgresql-role-configuration
365 postgresql-role-configuration?
366 (host postgresql-role-configuration-host ;string
368 (log postgresql-role-configuration-log ;string
369 (default "/var/log/postgresql_roles.log"))
370 (roles postgresql-role-configuration-roles
371 (default '()))) ;list
373 (define (postgresql-create-roles config)
374 ;; See: https://www.postgresql.org/docs/current/sql-createrole.html for the
375 ;; complete permissions list.
376 (define (format-permissions permissions)
377 (let ((dict '(bypassrls createdb createrole login replication superuser)))
378 (string-join (filter-map (lambda (permission)
379 (and (member permission dict)
381 (symbol->string permission))))
385 (define (roles->queries roles)
386 (apply mixed-text-file "queries"
389 (match-record role <postgresql-role>
390 (name permissions create-database?)
391 `("SELECT NOT(EXISTS(SELECT 1 FROM pg_catalog.pg_roles WHERE \
392 rolname = '" ,name "')) as not_exists;\n"
395 "CREATE ROLE \"" ,name "\""
396 " WITH " ,(format-permissions permissions)
398 ,@(if create-database?
399 `("CREATE DATABASE \"" ,name "\""
400 " OWNER \"" ,name "\";\n")
405 (let ((host (postgresql-role-configuration-host config))
406 (roles (postgresql-role-configuration-roles config)))
407 #~(let ((psql #$(file-append postgresql "/bin/psql")))
408 (list psql "-a" "-h" #$host "-f" #$(roles->queries roles)))))
410 (define (postgresql-role-shepherd-service config)
411 (match-record config <postgresql-role-configuration>
413 (list (shepherd-service
414 (requirement '(postgres))
415 (provision '(postgres-roles))
419 (let ((pid (fork+exec-command
420 #$(postgresql-create-roles config)
424 (zero? (cdr (waitpid pid))))))
425 (documentation "Create PostgreSQL roles.")))))
427 (define postgresql-role-service-type
428 (service-type (name 'postgresql-role)
430 (list (service-extension shepherd-root-service-type
431 postgresql-role-shepherd-service)))
432 (compose concatenate)
433 (extend (lambda (config extended-roles)
434 (match-record config <postgresql-role-configuration>
436 (postgresql-role-configuration
438 (roles (append roles extended-roles))))))
439 (default-value (postgresql-role-configuration))
440 (description "Ensure the specified PostgreSQL roles are
441 created after the PostgreSQL database is started.")))
448 (define-record-type* <memcached-configuration>
449 memcached-configuration make-memcached-configuration
450 memcached-configuration?
451 (memcached memcached-configuration-memcached ;<package>
453 (interfaces memcached-configuration-interfaces
454 (default '("0.0.0.0")))
455 (tcp-port memcached-configuration-tcp-port
457 (udp-port memcached-configuration-udp-port
459 (additional-options memcached-configuration-additional-options
462 (define %memcached-accounts
463 (list (user-group (name "memcached") (system? #t))
468 (comment "Memcached server user")
469 (home-directory "/var/empty")
470 (shell (file-append shadow "/sbin/nologin")))))
472 (define memcached-activation
474 (use-modules (guix build utils))
475 (let ((user (getpwnam "memcached")))
476 (mkdir-p "/var/run/memcached")
477 (chown "/var/run/memcached"
478 (passwd:uid user) (passwd:gid user)))))
480 (define memcached-shepherd-service
482 (($ <memcached-configuration> memcached interfaces tcp-port udp-port
484 (with-imported-modules (source-module-closure
485 '((gnu build shepherd)))
486 (list (shepherd-service
487 (provision '(memcached))
488 (documentation "Run the Memcached daemon.")
489 (requirement '(user-processes loopback))
490 (modules '((gnu build shepherd)))
491 (start #~(make-forkexec-constructor
492 `(#$(file-append memcached "/bin/memcached")
493 "-l" #$(string-join interfaces ",")
494 "-p" #$(number->string tcp-port)
495 "-U" #$(number->string udp-port)
497 ;; Memcached changes to the memcached user prior to
498 ;; writing the pid file, so write it to a directory
499 ;; that memcached owns.
500 "-P" "/var/run/memcached/pid"
502 ,#$@additional-options)
503 #:log-file "/var/log/memcached"
504 #:pid-file "/var/run/memcached/pid"))
505 (stop #~(make-kill-destructor))))))))
507 (define memcached-service-type
508 (service-type (name 'memcached)
510 (list (service-extension shepherd-root-service-type
511 memcached-shepherd-service)
512 (service-extension activation-service-type
513 (const memcached-activation))
514 (service-extension account-service-type
515 (const %memcached-accounts))))
516 (default-value (memcached-configuration))))
523 (define-record-type* <mysql-configuration>
524 mysql-configuration make-mysql-configuration
526 (mysql mysql-configuration-mysql (default mariadb))
527 (bind-address mysql-configuration-bind-address (default "127.0.0.1"))
528 (port mysql-configuration-port (default 3306))
529 (socket mysql-configuration-socket (default "/run/mysqld/mysqld.sock"))
530 (extra-content mysql-configuration-extra-content (default ""))
531 (extra-environment mysql-configuration-extra-environment (default #~'()))
532 (auto-upgrade? mysql-configuration-auto-upgrade? (default #t)))
534 (define %mysql-accounts
542 (home-directory "/var/empty")
543 (shell (file-append shadow "/sbin/nologin")))))
545 (define mysql-configuration-file
547 (($ <mysql-configuration> mysql bind-address port socket extra-content)
548 (mixed-text-file "my.cnf" "[mysqld]
549 datadir=/var/lib/mysql
551 bind-address=" bind-address "
552 port=" (number->string port) "
556 (define (%mysql-activation config)
557 "Return an activation gexp for the MySQL or MariaDB database server."
558 (let ((mysql (mysql-configuration-mysql config))
559 (my.cnf (mysql-configuration-file config)))
561 (use-modules (ice-9 popen)
563 (let* ((mysqld (string-append #$mysql "/bin/mysqld"))
564 (user (getpwnam "mysql"))
565 (uid (passwd:uid user))
566 (gid (passwd:gid user))
567 (datadir "/var/lib/mysql")
568 (rundir "/run/mysqld"))
570 (chown datadir uid gid)
572 (chown rundir uid gid)
573 ;; Initialize the database when it doesn't exist.
574 (when (not (file-exists? (string-append datadir "/mysql")))
575 (if (string-prefix? "mysql-" (strip-store-file-name #$mysql))
578 (string-append "--defaults-file=" #$my.cnf)
582 ;; XXX: The 'mysql_install_db' script doesn't work directly
583 ;; due to missing 'mkdir' in PATH.
584 (let ((p (open-pipe* OPEN_WRITE mysqld
586 "--defaults-file=" #$my.cnf)
589 ;; Create the system database, as does by 'mysql_install_db'.
590 (display "create database mysql;\n" p)
591 (display "use mysql;\n" p)
594 (call-with-input-file
595 (string-append #$mysql:lib "/share/mysql/" sql)
596 (lambda (in) (dump-port in p))))
597 '("mysql_system_tables.sql"
598 "mysql_performance_tables.sql"
599 "mysql_system_tables_data.sql"
600 "fill_help_tables.sql"))
601 ;; Remove the anonymous user and disable root access from
602 ;; remote machines, as does by 'mysql_secure_installation'.
604 DELETE FROM user WHERE User='';
605 DELETE FROM user WHERE User='root' AND
606 Host NOT IN ('localhost', '127.0.0.1', '::1');
609 (close-pipe p))))))))
611 (define (mysql-shepherd-service config)
612 (list (shepherd-service
614 (documentation "Run the MySQL server.")
615 (start (let ((mysql (mysql-configuration-mysql config))
616 (extra-env (mysql-configuration-extra-environment config))
617 (my.cnf (mysql-configuration-file config)))
618 #~(make-forkexec-constructor
619 (list (string-append #$mysql "/bin/mysqld")
620 (string-append "--defaults-file=" #$my.cnf))
621 #:user "mysql" #:group "mysql"
622 #:log-file "/var/log/mysqld.log"
623 #:environment-variables #$extra-env)))
624 (stop #~(make-kill-destructor)))))
626 (define (mysql-upgrade-wrapper mysql socket-file)
627 ;; The MySQL socket and PID file may appear before the server is ready to
628 ;; accept connections. Ensure the socket is responsive before attempting
629 ;; to run the upgrade script.
631 "mysql-upgrade-wrapper"
633 (let ((mysql-upgrade #$(file-append mysql "/bin/mysql_upgrade"))
639 (let ((sock (socket PF_UNIX SOCK_STREAM 0)))
640 (connect sock AF_UNIX #$socket-file)
642 ;; The socket is ready!
643 (execl mysql-upgrade mysql-upgrade
644 (string-append "--socket=" #$socket-file))))
651 (throw 'timeout-error
652 "MySQL server did not appear in time!"))))))))))
654 (define (mysql-upgrade-shepherd-service config)
655 (list (shepherd-service
656 (provision '(mysql-upgrade))
657 (requirement '(mysql))
659 (documentation "Upgrade MySQL database schemas.")
660 (start (let ((mysql (mysql-configuration-mysql config))
661 (socket (mysql-configuration-socket config)))
662 #~(make-forkexec-constructor
663 (list #$(mysql-upgrade-wrapper mysql socket))
664 #:user "mysql" #:group "mysql"))))))
666 (define (mysql-shepherd-services config)
667 (if (mysql-configuration-auto-upgrade? config)
668 (append (mysql-shepherd-service config)
669 (mysql-upgrade-shepherd-service config))
670 (mysql-shepherd-service config)))
672 (define mysql-service-type
676 (list (service-extension account-service-type
677 (const %mysql-accounts))
678 (service-extension activation-service-type
680 (service-extension shepherd-root-service-type
681 mysql-shepherd-services)))
682 (default-value (mysql-configuration))))
684 (define-deprecated (mysql-service #:key (config (mysql-configuration)))
686 (service mysql-service-type config))
693 (define-record-type* <redis-configuration>
694 redis-configuration make-redis-configuration
696 (redis redis-configuration-redis ;<package>
698 (bind redis-configuration-bind
699 (default "127.0.0.1"))
700 (port redis-configuration-port
702 (working-directory redis-configuration-working-directory
703 (default "/var/lib/redis"))
704 (config-file redis-configuration-config-file
707 (define (default-redis.conf bind port working-directory)
708 (mixed-text-file "redis.conf"
710 "port " (number->string port) "\n"
711 "dir " working-directory "\n"
714 (define %redis-accounts
715 (list (user-group (name "redis") (system? #t))
720 (comment "Redis server user")
721 (home-directory "/var/empty")
722 (shell (file-append shadow "/sbin/nologin")))))
724 (define redis-activation
726 (($ <redis-configuration> redis bind port working-directory config-file)
728 (use-modules (guix build utils)
731 (let ((user (getpwnam "redis")))
732 (mkdir-p #$working-directory)
733 (chown #$working-directory (passwd:uid user) (passwd:gid user)))))))
735 (define redis-shepherd-service
737 (($ <redis-configuration> redis bind port working-directory config-file)
740 (default-redis.conf bind port working-directory))))
741 (list (shepherd-service
743 (documentation "Run the Redis daemon.")
744 (requirement '(user-processes syslogd))
745 (start #~(make-forkexec-constructor
746 '(#$(file-append redis "/bin/redis-server")
750 (stop #~(make-kill-destructor))))))))
752 (define redis-service-type
753 (service-type (name 'redis)
755 (list (service-extension shepherd-root-service-type
756 redis-shepherd-service)
757 (service-extension activation-service-type
759 (service-extension account-service-type
760 (const %redis-accounts))))
761 (default-value (redis-configuration))))