This causes authentication failures such as those generated by SSH brute force
attacks to appear in /var/log/secure, which is picked up by tools such as
fail2ban.
* gnu/services/base.scm (%default-syslog.conf): Add a auth.info selector for
the /var/log/secure log.
Series-to: 62802@debbugs.gnu.org
This is a cosmetic change.
* gnu/services/base.scm (%default-syslog.conf): Add a comment referencing the
documentation. Strip the extraneous leading trailing white space indent.
Having the configuration live at a static location makes it possible to
hot-reload it.
* gnu/services/base.scm (syslog.conf): New variable.
(syslog-etc, syslog-shepherd-service): New procedures.
(syslog-service-type): Rewrite using the above new variable and procedures,
extending etc-service-type with its configuration file.
Previously, on a typical setup without "console=ttyS0" or similar in
'kernel-arguments', the 'term-console' Shepherd service would always be
marked as failing to start. This is undesirable because it raises a
false alarm: the service is expected to do nothing in this case.
This patch instead marks it as succeeding and logs a message explaining
it's doing nothing.
* gnu/services/base.scm (agetty-shepherd-service): In 'start' method,
succeed when TTY is #f and print a message.
Previously, on a typical setup without "console=ttyS0" or similar in
'kernel-arguments', the 'term-console' Shepherd service would always be
marked as failing to start. This is undesirable because it raises a
false alarm: the service is expected to do nothing in this case.
This patch instead marks it as succeeding and logs a message explaining
it's doing nothing.
* gnu/services/base.scm (agetty-shepherd-service): In 'start' method,
succeed when TTY is #f and print a message.
Deprecate using strings for these fields and prefer user-account
(resp. user-group) instead to avoid duplication within account-service-type.
Fixes#61570 <https://issues.guix.gnu.org/61570>.
* gnu/services/audio.scm (%mpd-user, %mpd-group)
(mpd-serialize-user-account, mpd-serialize-user-group)
(mpd-user-sanitizer, mpd-group-sanitizer): New variables.
(mpd-configuration)[user]: Use user-account as value type.
Sanitize via mpd-user-sanitizer.
[group]: Use user-group as value type.
Sanitize via mpd-group-sanitizer.
(mpd-shepherd-service): Adjust accordingly.
(mpd-accounts): Likewise.
* doc/guix.texi (Audio Services)[Music Player Daemon]: Likewise.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
* gnu/services/audio.scm (mpd-output)[mixer-type]: Use sanitizer to
accept both strings and symbols as values.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
This is required to allow log file rotations using rottlog, etc.
* gnu/services/web.scm (nginx-shepherd-service): Add reopen shepherd action.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* gnu/services/audio.scm (%mympd-user, %mympd-group)
(mympd-user-sanitizer, mympd-group-sanitizer): New variables.
(mympd-configuration)[user]: Use user-account as value type.
Sanitize via mympd-user-sanitizer.
[group]: Use user-group as value type.
Sanitize via mympd-group-sanitizer.
(mympd-serialize-configuration): Adjust accordingly.
(mympd-accounts): Likewise.
* doc/guix.texi (Audio Services)[myMPD]: Likewise.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
Deprecate using strings for these fields and prefer user-account
(resp. user-group) instead to avoid duplication within account-service-type.
Fixes#61570 <https://issues.guix.gnu.org/61570>.
* gnu/services/audio.scm (%mpd-user, %mpd-group)
(mpd-serialize-user-account, mpd-serialize-user-group)
(mpd-user-sanitizer, mpd-group-sanitizer): New variables.
(mpd-configuration)[user]: Use user-account as value type.
Sanitize via mpd-user-sanitizer.
[group]: Use user-group as value type.
Sanitize via mpd-group-sanitizer.
(mpd-shepherd-service): Adjust accordingly.
(mpd-accounts): Likewise.
* doc/guix.texi (Audio Services)[Music Player Daemon]: Likewise.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
* gnu/services/audio.scm (mpd-output)[mixer-type]: Use sanitizer to
accept both strings and symbols as values.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
This changes the 'custom-serializer' field into a generic
'extra-args' field that can be extended to support new literals.
Within extra-args, the literals 'sanitizer' and 'serializer' allow
for user-defined sanitization and serialization procedures respectively.
The 'empty-serializer' was also added as a literal to be used as before.
To prevent confusion between the new “explicit” style of specifying
a sanitizer, and the old “implicit” style, the latter has been
deprecated, and a warning is issued if it is encountered.
* gnu/services/configuration.scm (define-configuration-helper):
Rename 'custom-serializer' to 'extra-args'. Add support for literals
'sanitizer', 'serializer' and 'empty-serializer'. Rename procedure
'field-sanitizer' to 'default-field-sanitizer' to avoid syntax clash.
Only define default field sanitizers if user-defined ones are absent.
(normalize-extra-args): New variable.
(<configuration-field>)[sanitizer]: New field.
* doc/guix.texi (Complex Configurations): Document the newly added
literals.
* tests/services/configuration.scm: Add tests for the new literals.
Signed-off-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
Previously, only the first level of the list would be quoted,
resulting in a schedule of the sort:
'(next-second (range 0 60 30))
being incorrectly ungexp'd into:
(list next-second (0 30))
* gnu/services/linux.scm (fstrim-mcron-job): Fix schedule ungexp.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
This patch adds support for proper xorg server input rewriting. It uses the
lookup-package-direct-input procedure to configure the X server paths
dynamically, instead of always using the hard coded package. Something like
this is now possible:
(define other-mesa
(package-input-rewriting/spec `(("mesa" . ,(const other-mesa)))))
(xorg-configuration
(xorg-configuration
(server (other-mesa xorg-server))))
Without this patch the X server would still be configured with mesa (causing
version issues), and not with other-mesa (as per the input rewrite).
* gnu/services/xorg.scm (xorg-configuration-server-package-path)
(xorg-configuration-dri-driver-path, xorg-configuration-xkb-bin-dir)
(xorg-configuration-xkb-dir): New procedures.
(xorg-wrapper): Use them for dri and xkb paths.
Signed-off-by: 宋文武 <iyzsong@member.fsf.org>
These variables are necessary for PulseAudio to work properly out-of-the-box
for 'non-interactive' users.
* doc/guix.texi (Audio Services): Update environment-variables field description for
mpd-configuration data type.
* gnu/services/audio.scm (mpd-configuration)[environment-variables]: Set
PULSE_CLIENTCONFIG and PULSE_CONFIG environment variables to the system-wide
PulseAudio configuration.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* gnu/services/audio.scm (mympd-shepherd-service): Depend on 'syslog when
configured to log to syslog.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Modified-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Fixes <https://issues.guix.gnu.org/62409>.
* gnu/services/networking.scm (network-manager-shepherd-service): Set the
LINUX_MODULE_DIRECTORY environment variable.
The x11-socket-directory-service misuses activation-service-type
to create directories. This kind of usage is incorrect since
activation-service-type does not depend on file-systems, hence incompatible
with user defined /tmp mount.
This commit turns x11-socket-directory-service into a shepherd one-shot
service by defining a new x11-socket-directory-service-type.
* gnu/services/desktop.scm (x11-socket-directory-service-type): New variable.
(x11-socket-directory-service): Deprecate procedure.
(desktop-services-for-system): Use new service-type.
* gnu/tests/lightdm.scm: Ditto.
Reviewed-by: Josselin Poiret <dev@jpoiret.xyz>
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Reported by bjc on #guix.
* gnu/services/base.scm (valid-name, cidr->netmask): Wrap in 'eval-when'
since they are used by "compile-time procedures" (macros).
The 'stop' method of Shepherd services is supposed to return #f on
success.
* gnu/services/base.scm (console-font-shepherd-services): 'stop' method
returns #f.
* gnu/services/networking.scm (connman-shepherd-service): Make 'networking a
virtual service and set 'connman as its canonical name.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
According to the semantics in [1], 'networking should be a "virtual service"
and NetworkManager its canonical-name. This does not influence
existing services and they should continue to use the 'networking symbol.
One visible change is that 'herd status' doesn't show 'networking' anymore,
instead listing 'NetworkManager' in its place but both symbols are can be used
to start and stop the same service.
Note: Though the symbol NetworkManager doesn't really conform with the overall kebab-case
used throughout Guix, this is intentional as we really want to make it clear that
that the symbol NetworkManager really refers to the software called NetworkManager,
since it's a canonical name here. (rather than risk misleading the user to interpret
the symbol network-manager as a symbol for some unspecific network management software)
[1]: https://www.gnu.org/software/shepherd/manual/html_node/Jump-Start.html
* gnu/services/networking.scm (network-manager-shepherd-service): Make 'networking a
virtual service and set 'NetworkManager as its canonical name.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This is similar to its NetworkManager-wait-online.service systemd counterpart,
with the main difference being that we handle it all in 'networking symbol, rather than
introduce a new 'networking-online symbol. (see discussion #47253)
As a result of this change, with opensmtpd-service-type as an example,
manual 'herd restart smtpd' after system bootups are no longer required
when opensmtpd is configured with a smtpd.conf containing non-loopback interfaces.
(this issue is described in more detail at #60300)
Fixes <https://issues.guix.gnu.org/60300>.
* gnu/services/networking.scm (network-manager-shepherd-service): Await for
NetworkManager to finish starting up.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/services/networking.scm (<connman-configuration>)
[iwd?]: Use helper to warn deprecated field.
(connman-shepherd-service): Make iwd? a local variable independent from
the deprecated field.
* doc/guix.texi (Networking Setup): Remove mention of iwd? field.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/services/networking.scm (warn-iwd?-field-deprecation): New procedure,
helper for deprecated field.
(<network-manager-configuration>)[iwd?]: Use helper to warn deprecated field.
(network-manager-shepherd-service): Make iwd? a local variable independent
from the deprecated field.
* doc/guix.texi (Networking Setup): Remove mention of iwd? field.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Note: This also makes wpa-supplicant an optional requirement.
* gnu/services/networking.scm (<network-manager-configuration>)
[shepherd-requirement]: New field.
(network-manager-shepherd-service): Honor it.
(network-manager-configuration-shepherd-requirement): Export accessor.
* doc/guix.texi (Networking Setup): Document it.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
The Knot DNS service in Guix uses two days, or 48 hours, for the SOA
refresh interval but that is outside the range of RFC 1912, which is
entitled "Common DNS Operational and Configuration Errors." [1]
Section 2.2 of RFC 1912 recommends a maximum of 12 hours for the SOA
refresh rate: "You can keep it short (20 mins to 2 hours) if you
aren't worried about a small increase in bandwidth used, or longer
(2-12 hours) if your Internet connection is slow or is started on
demand."
This commit sets the default refresh interval at the nearest value
recommended by the standard, which is 12 hours.
Due to the widespread adoption of NOTIFY messages between primary and
secondary DNS servers, the SOA refresh interval has arguably lost some
importance, but the Guix default should still be in line with the
standards.
Values outside the recommended range can provoke warning messages from
services commonly used to find bugs in DNS configurations, such as the
MX Toolbox Super Tool. [2]
[1] https://datatracker.ietf.org/doc/rfc1912/
[2] https://mxtoolbox.com/SuperTool.aspx
* gnu/services/dns.scm (<zone-file>)[refresh]: Default to (* 12 3600).
Signed-off-by: 宋文武 <iyzsong@member.fsf.org>
* gnu/services/desktop.scm (<sugar-desktop-configuration>): Add new fields for
activities and gobject-introspection.
(sugar-gobject-introspection, sugar-activities): New procedures.
(sugar-desktop-service-type): Install packages for activities and
gobject-introspection alongside the sugar package.
* doc/guix.texi (Desktop Services): Document changes.
Fixes <https://issues.guix.gnu.org/61201>.
Previously, common practice was to splice arbitrary strings (user names,
file names, etc.) into Texinfo snippets passed to 'display-hint'. This
is unsafe in the general case because at signs and braces need to be
escaped to produced valid Texinfo. This commit addresses that.
* guix/ui.scm (texinfo-quote): New procedure.
(display-hint): When ARGUMENTS is non-empty, pass it to 'texinfo-quote'
and call 'format'.
(report-unbound-variable-error, check-module-matches-file)
(display-collision-resolution-hint, run-guix-command): Remove explicit
'format' call; pass 'format' arguments as extra arguments to 'display-hint'.
* gnu/services/monitoring.scm (zabbix-front-end-config): Likewise.
* guix/scripts.scm (warn-about-disk-space): Likewise.
* guix/scripts/build.scm (%standard-cross-build-options)
(%standard-native-build-options): Likewise.
* guix/scripts/describe.scm (display-checkout-info): Likewise.
* guix/scripts/environment.scm (suggest-command-name): Likewise.
* guix/scripts/home.scm (process-command): Likewise.
* guix/scripts/home/edit.scm (service-type-not-found): Likewise.
* guix/scripts/import.scm (guix-import): Likewise.
* guix/scripts/package.scm (display-search-path-hint): Likewise.
* guix/scripts/pull.scm (build-and-install): Likewise.
* guix/scripts/shell.scm (auto-detect-manifest): Likewise.
* guix/scripts/system.scm (check-file-system-availability): Likewise.
(guix-system): Likewise.
* guix/scripts/system/edit.scm (service-type-not-found): Likewise.
* guix/status.scm (print-build-event): Likewise.
This follows up on commit ae0975332c60818793c6c63a3646c982d686bf49?.
* gnu/services/desktop.scm (geoclue-service-type): Set default-value.
Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
* doc/guix.texi (Miscellaneous Services): Replace 'lirc-service' with 'lirc-service-type'.
Document <lirc-configuration>.
* gnu/services/lirc.scm (<lirc-configuration>): Set default values based on
the arguments from the now deprecated 'lirc-service' procedure.
(lirc-service-type): Set default value.
(lirc-service): Deprecate procedure.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* doc/guix.texi (Desktop Services): Replace 'geoclue-service' with 'geoclue-service-type'.
* gnu/services/desktop.scm (<geoclue-configuration>): Set default values
based on the values from the now deprecated geoclue-service procedure.
(geoclue-service): Deprecate procedure.
(desktop-services-for-system): Use geoclue-service-type.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/services/desktop.scm (<elogind-configuration>)[handle-hibernate-key]: Set default value to 'hibernate.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* doc/guix.texi (Networking Services): Remove mention of lsh-service.
Document lsh-service-type and lsh-service-configuration.
* gnu/services/ssh.scm (<lsh-configuration>): Set default values based
on the now deprecated 'lsh-service' procedure.
(lsh-service-type): Set default value.
(lsh-service): Deprecate procedure.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* doc/guix.texi (Base Services): Replace rngd-service with rngd-service-type.
Document <rngd-configuration>.
* gnu/services/base.scm (<rngd-configuration>): Set default values from
the values in the now deprecated 'rngd-service' procedure.
(rngd-service): Deprecate procedure.
(rngd-service-type): Set default value.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/services/desktop.scm (gnome-setuid-programs): New variable.
(gnome-desktop-service-type): Extend setuid-program-service-type with it.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* gnu/services/desktop.scm (<gnome-desktop-configuration>): Rename gnome
package accessor to gnome-desktop-configuration-gnome, to avoid name conflict.
(gnome-packages): Change first argument from a config object to a the gnome
package used. Rename second argument from package to name. Extract core
logic into...
(gnome-package): ... this.
(gnome-udev-rules, gnome-polkit-settings): Adjust accordingly.
(gnome-desktop-service-type): Likewise.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* gnu/services/desktop.scm (gnome-polkit-settings): Add spice-gtk to the GNOME
packages providing polkit rules.
(package-direct-input-selector): Allow passing a list corresponding to the
dependency tree, so that non-propagated transitive inputs can be specified.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Ludovic Courtès
Maxim Cournoyer
Bruno Victal
r0man
Andreas Enge
Andrew Tropin
Sergey Trofimov
Felix Lechner
Christopher Baines
Ricardo Wurmus