This is guix.ru.info, produced by makeinfo version 6.8 from
guix.ru.texi.

Copyright © 2012–2025 Ludovic Courtès
Copyright © 2013, 2014, 2016, 2024 Andreas Enge
Copyright © 2013 Nikita Karetnikov
Copyright © 2014, 2015, 2016 Alex Kost
Copyright © 2015, 2016 Mathieu Lirzin
Copyright © 2014 Pierre-Antoine Rault
Copyright © 2015 Taylan Ulrich Bayırlı/Kammer
Copyright © 2015, 2016, 2017, 2019, 2020, 2021, 2023, 2025 Leo Famulari
Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Ricardo
Wurmus
Copyright © 2016 Ben Woodcroft
Copyright © 2016, 2017, 2018, 2021 Chris Marusich
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2025 Efraim
Flashner
Copyright © 2016 John Darrington
Copyright © 2016, 2017 Nikita Gillmann
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025
Janneke Nieuwenhuizen
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Julien Lepiller
Copyright © 2016 Alex ter Weele
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Christopher Baines
Copyright © 2017, 2018, 2019 Clément Lassieur
Copyright © 2017, 2018, 2020, 2021, 2022 Mathieu Othacehe
Copyright © 2017 Federico Beffa
Copyright © 2017, 2018, 2024, 2025 Carlo Zancanaro
Copyright © 2017 Thomas Danckaert
Copyright © 2017 humanitiesNerd
Copyright © 2017, 2021 Christine Lemmer-Webber
Copyright © 2017, 2018, 2019, 2020, 2021, 2022 Marius Bakke
Copyright © 2017, 2019, 2020, 2022 Hartmut Goebel
Copyright © 2017, 2019–2025 Maxim Cournoyer
Copyright © 2017–2022 Tobias Geerinckx-Rice
Copyright © 2017 George Clemmer
Copyright © 2017 Andy Wingo
Copyright © 2017, 2018, 2019, 2020, 2023, 2024, 2025 Arun Isaac
Copyright © 2017 nee
Copyright © 2018 Rutger Helling
Copyright © 2018, 2021, 2023, 2025 Oleg Pykhalov
Copyright © 2018 Mike Gerwitz
Copyright © 2018 Pierre-Antoine Rouby
Copyright © 2018, 2019 Gábor Boskovits
Copyright © 2018, 2019, 2020, 2022, 2023, 2024 Florian Pelz
Copyright © 2018 Laura Lazzati
Copyright © 2018 Alex Vong
Copyright © 2019 Josh Holland
Copyright © 2019, 2020 Diego Nicola Barbato
Copyright © 2019 Ivan Petkov
Copyright © 2019 Jakob L. Kreuze
Copyright © 2019 Kyle Andrews
Copyright © 2019 Alex Griffin
Copyright © 2019, 2020, 2021, 2022 Guillaume Le Vaillant
Copyright © 2020 Liliana Marie Prikler
Copyright © 2019, 2020, 2021, 2022, 2023 Simon Tournier
Copyright © 2020 Wiktor Żelazny
Copyright © 2020 Damien Cassou
Copyright © 2020 Jakub Kądziołka
Copyright © 2020 Jack Hill
Copyright © 2020 Naga Malleswari
Copyright © 2020, 2021 Brice Waegeneire
Copyright © 2020 R Veera Kumar
Copyright © 2020, 2021, 2022 Pierre Langlois
Copyright © 2020 pinoaffe
Copyright © 2020, 2023 André Batista
Copyright © 2020, 2021 Alexandru-Sergiu Marton
Copyright © 2020 raingloom
Copyright © 2020 Daniel Brooks
Copyright © 2020 John Soo
Copyright © 2020 Jonathan Brielmaier
Copyright © 2020 Edgar Vincent
Copyright © 2021, 2022 Maxime Devos
Copyright © 2021 B. Wilson
Copyright © 2021 Xinglu Chen
Copyright © 2021 Raghav Gururajan
Copyright © 2021 Domagoj Stolfa
Copyright © 2021 Hui Lu
Copyright © 2021 pukkamustard
Copyright © 2021 Alice Brenon
Copyright © 2021-2023 Josselin Poiret
Copyright © 2021, 2023 muradm
Copyright © 2021, 2022 Andrew Tropin
Copyright © 2021 Sarah Morgensen
Copyright © 2022 Remco van ’t Veer
Copyright © 2022 Aleksandr Vityazev
Copyright © 2022 Philip M^{c}Grath
Copyright © 2022 Karl Hallsby
Copyright © 2022 Justin Veilleux
Copyright © 2022 Reily Siegel
Copyright © 2022 Simon Streit
Copyright © 2022 (
Copyright © 2022 John Kehayias
Copyright © 2022⁠–⁠2023 Bruno Victal
Copyright © 2022 Ivan Vilata-i-Balaguer
Copyright © 2023-2025 Giacomo Leidi
Copyright © 2022 Antero Mejr
Copyright © 2023 Karl Hallsby
Copyright © 2023 Nathaniel Nicandro
Copyright © 2023 Tanguy Le Carrour
Copyright © 2023-2024 Zheng Junjie
Copyright © 2023 Brian Cully
Copyright © 2023 Felix Lechner
Copyright © 2023 Foundation Devices, Inc.
Copyright © 2023 Thomas Ieong
Copyright © 2023 Saku Laesvuori
Copyright © 2023 Graham James Addis
Copyright © 2023-2025 Tomas Volf
Copyright © 2024, 2025 Herman Rimm
Copyright © 2024 Matthew Trzcinski
Copyright © 2024 Richard Sent
Copyright © 2024 Dariqq
Copyright © 2024 Denis ’GNUtoo’ Carikli
Copyright © 2024 Fabio Natali
Copyright © 2024 Arnaud Daby-Seesaram
Copyright © 2024-2025 Nigko Yerden
Copyright © 2024 Troy Figiel
Copyright © 2024 Sharlatan Hellseher
Copyright © 2024 45mg
Copyright © 2024 Greg Hogan
Copyright © 2025 Sören Tempel
Copyright © 2025 Rostislav Svoboda
Copyright © 2025 Zacchaeus
Copyright © 2025 Sergio Pastor Pérez
Copyright © 2024 Evgeny Pisemsky
Copyright © 2025 jgart
Copyright © 2025 Artur Wroblewski
Copyright © 2025 Edouard Klein
Copyright © 2025 Rodion Goritskov
Copyright © 2025 dan
Copyright © 2025 Noé Lopez

   Разрешено копирование, распространение и/или модификация этого
документа на условиях лицензии свободной документации GNU (GNU FDL)
версии 1.3 или любой более поздней версии, опубликованной Фондом
свободного программного обеспечения (FSF), исключая неизменяемые секции,
исключая тексты, размещенные на переплёте и задней стороне обложки.
Копия лицензии включена в документ в разделе под названием "GNU Free
Documentation Licens".
INFO-DIR-SECTION Администрирование системы
START-INFO-DIR-ENTRY
* Guix.ru: (guix.ru).        Управление установленным ПО и настройка
                               системы.
* guix package: (guix.ru)Запуск guix package.  Установка, удаление и
                                                 обновление пакетов.
* guix gc: (guix.ru)Запуск guix gc.  Освобождение неиспользуемого места на
                                       диске.
* guix pull: (guix.ru)Запуск guix pull.  Обновление списка доступных
                                           пакетов.
* guix system: (guix.ru)Запуск guix system.  Управление конфигурацией ОС.
* guix deploy: (guix.ru)Запуск guix deploy.  Управление конфигурациями ОС на
                                               удалённых машинах.
END-INFO-DIR-ENTRY

INFO-DIR-SECTION Разработка программного обеспечения
START-INFO-DIR-ENTRY
* guix shell: (guix.ru)Запуск guix shell.  Creating software environments.
* guix environment: (guix.ru)Запуск guix environment.  Сборка среды
                                                         разработки с помощью
                                                         Guix.
* guix build: (guix.ru)Запуск guix build.  Сборка пакетов.
* guix pack: (guix.ru)Запуск guix pack.  Создание бинарных пакетов.
END-INFO-DIR-ENTRY


File: guix.ru.info,  Node: Сервисы упраления версиями,  Next: Игровые службы,  Prev: Сервисы виртуализации,  Up: Сервисы

11.10.32 Сервисы упраления версиями
-----------------------------------

The ‘(gnu services version-control)’ module provides a service to allow
remote access to local Git repositories.  There are three options: the
‘git-daemon-service-type’, which provides access to repositories via the
‘git://’ unsecured TCP-based protocol, extending the ‘nginx’ web server
to proxy some requests to ‘git-http-backend’, or providing a web
interface with ‘cgit-service-type’.

 -- Variable: git-daemon-service-type
     Type for a service that runs ‘git daemon’, a simple TCP server to
     expose repositories over the Git protocol for anonymous access.

     The value for this service type is a ‘<git-daemon-configuration>’
     record, by default it allows read-only access to exported(1)
     repositories under ‘/srv/git’.

 -- Data Type: git-daemon-configuration
     Data type representing the configuration for
     ‘git-daemon-service-type’.

     ‘speed’ (default: ‘1.0’)
          Package object of the Git distributed version control system.

     ‘speed’ (default: ‘1.0’)
          Whether to allow access for all Git repositories, even if they
          do not have the ‘git-daemon-export-ok’ file.

     ‘base-path’ (default: ‘/srv/git’)
          Whether to remap all the path requests as relative to the
          given path.  If you run ‘git daemon’ with ‘(base-path
          "/srv/git")’ on ‘example.com’, then if you later try to pull
          ‘git://example.com/hello.git’, git daemon will interpret the
          path as ‘/srv/git/hello.git’.

     ‘features’ (default: ‘'()’)
          Whether to allow ‘~user’ notation to be used in requests.
          When specified with empty string, requests to
          ‘git://host/~alice/foo’ is taken as a request to access ‘foo’
          repository in the home directory of user ‘alice’.  If
          ‘(user-path "PATH")’ is specified, the same request is taken
          as a request to access ‘PATH/foo’ repository in the home
          directory of user ‘alice’.

     ‘inputs’ (default: ‘'()’)
          Whether to listen on specific IP addresses or hostnames,
          defaults to all.

     ‘port’ (default: ‘22’)
          Whether to listen on an alternative port, which defaults to
          9418.

     ‘inputs’ (default: ‘'()’)
          If not empty, only allow access to this list of directories.

     ‘extra-options’ (default: ‘'()’)
          Extra options that will be passed to ‘git daemon’.(2)

   The ‘git://’ protocol lacks authentication.  When you pull from a
repository fetched via ‘git://’, you don’t know whether the data you
receive was modified or is even coming from the specified host, and your
connection is subject to eavesdropping.  It’s better to use an
authenticated and encrypted transport, such as ‘https’.  Although Git
allows you to serve repositories using unsophisticated file-based web
servers, there is a faster protocol implemented by the
‘git-http-backend’ program.  This program is the back-end of a proper
Git web service.  It is designed to sit behind a FastCGI proxy.  *Note
Веб-сервисы::, for more on running the necessary ‘fcgiwrap’ daemon.

   Guix has a separate configuration data type for serving Git
repositories over HTTP.

 -- Data Type: git-http-configuration
     Data type representing the configuration for a future
     ‘git-http-service-type’; can currently be used to configure Nginx
     through ‘git-http-nginx-location-configuration’.

     ‘package’ (default: GIT)
          Package object of the Git distributed version control system.

     ‘git-root’ (default: ‘/srv/git’)
          Directory containing the Git repositories to expose to the
          world.

     ‘speed’ (default: ‘1.0’)
          Whether to expose access for all Git repositories in GIT-ROOT,
          even if they do not have the ‘git-daemon-export-ok’ file.

     ‘port’ (default: ‘22’)
          Path prefix for Git access.  With the default ‘/git/’ prefix,
          this will map ‘http://SERVER/git/REPO.git’ to
          ‘/srv/git/REPO.git’.  Requests whose URI paths do not begin
          with this prefix are not passed on to this Git instance.

     ‘fcgiwrap-socket’ (default: ‘127.0.0.1:9000’)
          The socket on which the ‘fcgiwrap’ daemon is listening.  *Note
          Веб-сервисы::.

   There is no ‘git-http-service-type’, currently; instead you can
create an ‘nginx-location-configuration’ from a ‘git-http-configuration’
and then add that location to a web server.

 -- Procedure: git-http-nginx-location-configuration
          [config=(git-http-configuration)] Compute an
     ‘nginx-location-configuration’ that corresponds to the given Git
     http configuration.  An example nginx service definition to serve
     the default ‘/srv/git’ over HTTPS might be:

          (service nginx-service-type
                   (nginx-configuration
                    (server-blocks
                     (list
                      (nginx-server-configuration
                       (listen '("443 ssl"))
                       (server-name "git.my-host.org")
                       (ssl-certificate
                        "/etc/certs/git.my-host.org/fullchain.pem")
                       (ssl-certificate-key
                        "/etc/certs/git.my-host.org/privkey.pem")
                       (locations
                        (list
                         (git-http-nginx-location-configuration
                          (git-http-configuration (uri-path "/"))))))))))

     This example assumes that you are using Let’s Encrypt to get your
     TLS certificate.  *Note Сервисы сертификатов::.  The default
     ‘certbot’ service will redirect all HTTP traffic on
     ‘git.my-host.org’ to HTTPS.  You will also need to add an
     ‘fcgiwrap’ proxy to your system services.  *Note Веб-сервисы::.

Cgit Service
............

Cgit (https://git.zx2c4.com/cgit/) is a web frontend for Git
repositories written in C.

   The following example will configure the service with default values.
By default, Cgit can be accessed on port 80 (‘http://localhost:80’).

     (service cgit-service-type)

   The ‘file-object’ type designates either a file-like object (*note
file-like objects: G-Expressions.) or a string.

   Available ‘cgit-configuration’ fields are:

 -- cgit-configuration parameter: package package
     The CGIT package.

 -- cgit-configuration parameter: nginx-server-configuration-list nginx
     NGINX configuration.

 -- cgit-configuration parameter: file-object about-filter
     Specifies a command which will be invoked to format the content of
     about pages (both top-level and for each repository).

     Defaults to ‘""’.

 -- cgit-configuration parameter: string agefile
     Specifies a path, relative to each repository path, which can be
     used to specify the date and time of the youngest commit in the
     repository.

     Defaults to ‘""’.

 -- cgit-configuration parameter: file-object auth-filter
     Specifies a command that will be invoked for authenticating
     repository access.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string branch-sort
     Flag which, when set to ‘age’, enables date ordering in the branch
     ref list, and when set ‘name’ enables ordering by branch name.

     Defaults to ‘"name"’.

 -- cgit-configuration parameter: string cache-root
     Path used to store the cgit cache entries.

     Defaults to ‘"/var/cache/cgit"’.

 -- cgit-configuration parameter: integer cache-static-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of repository pages accessed with a fixed SHA1.

     Defaults to ‘-1’.

 -- cgit-configuration parameter: integer cache-dynamic-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of repository pages accessed without a fixed SHA1.

     Defaults to ‘5’.

 -- cgit-configuration parameter: integer cache-repo-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of the repository summary page.

     Defaults to ‘5’.

 -- cgit-configuration parameter: integer cache-root-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of the repository index page.

     Defaults to ‘5’.

 -- cgit-configuration parameter: integer cache-scanrc-ttl
     Number which specifies the time-to-live, in minutes, for the result
     of scanning a path for Git repositories.

     Defaults to ‘15’.

 -- cgit-configuration parameter: integer cache-about-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of the repository about page.

     Defaults to ‘15’.

 -- cgit-configuration parameter: integer cache-snapshot-ttl
     Number which specifies the time-to-live, in minutes, for the cached
     version of snapshots.

     Defaults to ‘5’.

 -- cgit-configuration parameter: integer cache-size
     The maximum number of entries in the cgit cache.  When set to ‘0’,
     caching is disabled.

     Defaults to ‘0’.

 -- cgit-configuration parameter: boolean case-sensitive-sort?
     Sort items in the repo list case sensitively.

     Defaults to ‘#t’.

 -- cgit-configuration parameter: list clone-prefix
     List of common prefixes which, when combined with a repository URL,
     generates valid clone URLs for the repository.

     Defaults to ‘'()’.

 -- cgit-configuration parameter: list clone-url
     List of ‘clone-url’ templates.

     Defaults to ‘'()’.

 -- cgit-configuration parameter: file-object commit-filter
     Command which will be invoked to format commit messages.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string commit-sort
     Flag which, when set to ‘date’, enables strict date ordering in the
     commit log, and when set to ‘topo’ enables strict topological
     ordering.

     Defaults to ‘"git log"’.

 -- cgit-configuration parameter: file-object css
     URL which specifies the css document to include in all cgit pages.

     Defaults to ‘"/share/cgit/cgit.css"’.

 -- cgit-configuration parameter: file-object email-filter
     Specifies a command which will be invoked to format names and email
     address of committers, authors, and taggers, as represented in
     various places throughout the cgit interface.

     Defaults to ‘""’.

 -- cgit-configuration parameter: boolean embedded?
     Flag which, when set to ‘#t’, will make cgit generate a HTML
     fragment suitable for embedding in other HTML pages.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-commit-graph?
     Flag which, when set to ‘#t’, will make cgit print an ASCII-art
     commit history graph to the left of the commit messages in the
     repository log page.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-filter-overrides?
     Flag which, when set to ‘#t’, allows all filter settings to be
     overridden in repository-specific cgitrc files.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-follow-links?
     Flag which, when set to ‘#t’, allows users to follow a file in the
     log view.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-http-clone?
     If set to ‘#t’, cgit will act as an dumb HTTP endpoint for Git
     clones.

     Defaults to ‘#t’.

 -- cgit-configuration parameter: boolean enable-index-links?
     Flag which, when set to ‘#t’, will make cgit generate extra links
     "summary", "commit", "tree" for each repo in the repository index.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-index-owner?
     Flag which, when set to ‘#t’, will make cgit display the owner of
     each repo in the repository index.

     Defaults to ‘#t’.

 -- cgit-configuration parameter: boolean enable-log-filecount?
     Flag which, when set to ‘#t’, will make cgit print the number of
     modified files for each commit on the repository log page.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-log-linecount?
     Flag which, when set to ‘#t’, will make cgit print the number of
     added and removed lines for each commit on the repository log page.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-remote-branches?
     Flag which, when set to ‘#t’, will make cgit display remote
     branches in the summary and refs views.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-subject-links?
     Flag which, when set to ‘1’, will make cgit use the subject of the
     parent commit as link text when generating links to parent commits
     in commit view.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-html-serving?
     Flag which, when set to ‘#t’, will make cgit use the subject of the
     parent commit as link text when generating links to parent commits
     in commit view.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean enable-tree-linenumbers?
     Flag which, when set to ‘#t’, will make cgit generate linenumber
     links for plaintext blobs printed in the tree view.

     Defaults to ‘#t’.

 -- cgit-configuration parameter: boolean enable-git-config?
     Flag which, when set to ‘#f’, will allow cgit to use Git config to
     set any repo specific settings.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: file-object favicon
     URL used as link to a shortcut icon for cgit.

     Defaults to ‘"/favicon.ico"’.

 -- cgit-configuration parameter: string footer
     The content of the file specified with this option will be included
     verbatim at the bottom of all pages (i.e. it replaces the standard
     "generated by..." message).

     Defaults to ‘""’.

 -- cgit-configuration parameter: string head-include
     The content of the file specified with this option will be included
     verbatim in the HTML HEAD section on all pages.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string header
     The content of the file specified with this option will be included
     verbatim at the top of all pages.

     Defaults to ‘""’.

 -- cgit-configuration parameter: file-object include
     Name of a configfile to include before the rest of the current
     config- file is parsed.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string index-header
     The content of the file specified with this option will be included
     verbatim above the repository index.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string index-info
     The content of the file specified with this option will be included
     verbatim below the heading on the repository index page.

     Defaults to ‘""’.

 -- cgit-configuration parameter: boolean local-time?
     Flag which, if set to ‘#t’, makes cgit print commit and tag times
     in the servers timezone.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: file-object logo
     URL which specifies the source of an image which will be used as a
     logo on all cgit pages.

     Defaults to ‘"/share/cgit/cgit.png"’.

 -- cgit-configuration parameter: string logo-link
     URL loaded when clicking on the cgit logo image.

     Defaults to ‘""’.

 -- cgit-configuration parameter: file-object owner-filter
     Command which will be invoked to format the Owner column of the
     main page.

     Defaults to ‘""’.

 -- cgit-configuration parameter: integer max-atom-items
     Number of items to display in atom feeds view.

     Defaults to ‘10’.

 -- cgit-configuration parameter: integer max-commit-count
     Number of entries to list per page in "log" view.

     Defaults to ‘50’.

 -- cgit-configuration parameter: integer max-message-length
     Number of commit message characters to display in "log" view.

     Defaults to ‘80’.

 -- cgit-configuration parameter: integer max-repo-count
     Specifies the number of entries to list per page on the repository
     index page.

     Defaults to ‘50’.

 -- cgit-configuration parameter: integer max-repodesc-length
     Specifies the maximum number of repo description characters to
     display on the repository index page.

     Defaults to ‘80’.

 -- cgit-configuration parameter: integer max-blob-size
     Specifies the maximum size of a blob to display HTML for in KBytes.

     Defaults to ‘0’.

 -- cgit-configuration parameter: string max-stats
     Maximum statistics period.  Valid values are ‘week’,‘month’,
     ‘quarter’ and ‘year’.

     Defaults to ‘""’.

 -- cgit-configuration parameter: mimetype-alist mimetype
     Mimetype for the specified filename extension.

     Defaults to ‘'((gif "image/gif") (html "text/html") (jpg
     "image/jpeg") (jpeg "image/jpeg") (pdf "application/pdf") (png
     "image/png") (svg "image/svg+xml"))’.

 -- cgit-configuration parameter: file-object mimetype-file
     Specifies the file to use for automatic mimetype lookup.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string module-link
     Text which will be used as the formatstring for a hyperlink when a
     submodule is printed in a directory listing.

     Defaults to ‘""’.

 -- cgit-configuration parameter: boolean nocache?
     If set to the value ‘#t’ caching will be disabled.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean noplainemail?
     If set to ‘#t’ showing full author email addresses will be
     disabled.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: boolean noheader?
     Flag which, when set to ‘#t’, will make cgit omit the standard
     header on all pages.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: project-list project-list
     A list of subdirectories inside of ‘repository-directory’, relative
     to it, that should loaded as Git repositories.  An empty list means
     that all subdirectories will be loaded.

     Defaults to ‘'()’.

 -- cgit-configuration parameter: file-object readme
     Text which will be used as default ‘repository-cgit-configuration’
     ‘readme’.

     Defaults to ‘""’.

 -- cgit-configuration parameter: boolean remove-suffix?
     If set to ‘#t’ and ‘repository-directory’ is enabled, if any
     repositories are found with a suffix of ‘.git’, this suffix will be
     removed for the URL and name.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: integer renamelimit
     Maximum number of files to consider when detecting renames.

     Defaults to ‘-1’.

 -- cgit-configuration parameter: string repository-sort
     The way in which repositories in each section are sorted.

     Defaults to ‘""’.

 -- cgit-configuration parameter: robots-list robots
     Text used as content for the ‘robots’ meta-tag.

     Defaults to ‘'("noindex" "nofollow")’.

 -- cgit-configuration parameter: string root-desc
     Text printed below the heading on the repository index page.

     Defaults to ‘"a fast webinterface for the git dscm"’.

 -- cgit-configuration parameter: string root-readme
     The content of the file specified with this option will be included
     verbatim below the “about” link on the repository index page.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string root-title
     Text printed as heading on the repository index page.

     Defaults to ‘""’.

 -- cgit-configuration parameter: boolean scan-hidden-path
     If set to ‘#t’ and repository-directory is enabled,
     repository-directory will recurse into directories whose name
     starts with a period.  Otherwise, repository-directory will stay
     away from such directories, considered as “hidden”.  Note that this
     does not apply to the ‘.git’ directory in non-bare repos.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: list snapshots
     Text which specifies the default set of snapshot formats that cgit
     generates links for.

     Defaults to ‘'()’.

 -- cgit-configuration parameter: repository-directory
          repository-directory
     Name of the directory to scan for repositories (represents
     ‘scan-path’).

     Defaults to ‘"/srv/git"’.

 -- cgit-configuration parameter: string section
     The name of the current repository section - all repositories
     defined after this option will inherit the current section name.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string section-sort
     Flag which, when set to ‘1’, will sort the sections on the
     repository listing by name.

     Defaults to ‘""’.

 -- cgit-configuration parameter: integer section-from-path
     A number which, if defined prior to repository-directory, specifies
     how many path elements from each repo path to use as a default
     section name.

     Defaults to ‘0’.

 -- cgit-configuration parameter: boolean side-by-side-diffs?
     If set to ‘#t’ shows side-by-side diffs instead of unidiffs per
     default.

     Defaults to ‘#f’.

 -- cgit-configuration parameter: file-object source-filter
     Specifies a command which will be invoked to format plaintext blobs
     in the tree view.

     Defaults to ‘""’.

 -- cgit-configuration parameter: integer summary-branches
     Specifies the number of branches to display in the repository
     “summary” view.

     Defaults to ‘10’.

 -- cgit-configuration parameter: integer summary-log
     Specifies the number of log entries to display in the repository
     “summary” view.

     Defaults to ‘10’.

 -- cgit-configuration parameter: integer summary-tags
     Specifies the number of tags to display in the repository “summary”
     view.

     Defaults to ‘10’.

 -- cgit-configuration parameter: string strict-export
     Filename which, if specified, needs to be present within the
     repository for cgit to allow access to that repository.

     Defaults to ‘""’.

 -- cgit-configuration parameter: string virtual-root
     URL which, if specified, will be used as root for all cgit links.

     Defaults to ‘"/"’.

 -- cgit-configuration parameter: repository-cgit-configuration-list
          repositories
     A list of ‘repository-cgit-configuration’ records.

     Defaults to ‘'()’.

     Available ‘repository-cgit-configuration’ fields are:

      -- repository-cgit-configuration parameter: repo-list snapshots
          A mask of snapshot formats for this repo that cgit generates
          links for, restricted by the global ‘snapshots’ setting.

          Defaults to ‘'()’.

      -- repository-cgit-configuration parameter: repo-file-object
               source-filter
          Override the default ‘source-filter’.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string url
          The relative URL used to access the repository.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-file-object
               about-filter
          Override the default ‘about-filter’.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string
               branch-sort
          Flag which, when set to ‘age’, enables date ordering in the
          branch ref list, and when set to ‘name’ enables ordering by
          branch name.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-list clone-url
          A list of URLs which can be used to clone repo.

          Defaults to ‘'()’.

      -- repository-cgit-configuration parameter: repo-file-object
               commit-filter
          Override the default ‘commit-filter’.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string
               commit-sort
          Flag which, when set to ‘date’, enables strict date ordering
          in the commit log, and when set to ‘topo’ enables strict
          topological ordering.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string defbranch
          The name of the default branch for this repository.  If no
          such branch exists in the repository, the first branch name
          (when sorted) is used as default instead.  By default branch
          pointed to by HEAD, or “master” if there is no suitable HEAD.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string desc
          The value to show as repository description.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string homepage
          The value to show as repository homepage.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-file-object
               email-filter
          Override the default ‘email-filter’.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-commit-graph?
          A flag which can be used to disable the global setting
          ‘enable-commit-graph?’.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-log-filecount?
          A flag which can be used to disable the global setting
          ‘enable-log-filecount?’.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-log-linecount?
          A flag which can be used to disable the global setting
          ‘enable-log-linecount?’.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-remote-branches?
          Flag which, when set to ‘#t’, will make cgit display remote
          branches in the summary and refs views.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-subject-links?
          A flag which can be used to override the global setting
          ‘enable-subject-links?’.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: maybe-repo-boolean
               enable-html-serving?
          A flag which can be used to override the global setting
          ‘enable-html-serving?’.

          Defaults to ‘disabled’.

      -- repository-cgit-configuration parameter: repo-boolean hide?
          Flag which, when set to ‘#t’, hides the repository from the
          repository index.

          Defaults to ‘#f’.

      -- repository-cgit-configuration parameter: repo-boolean ignore?
          Flag which, when set to ‘#t’, ignores the repository.

          Defaults to ‘#f’.

      -- repository-cgit-configuration parameter: repo-file-object logo
          URL which specifies the source of an image which will be used
          as a logo on this repo’s pages.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string logo-link
          URL loaded when clicking on the cgit logo image.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-file-object
               owner-filter
          Override the default ‘owner-filter’.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string
               module-link
          Text which will be used as the formatstring for a hyperlink
          when a submodule is printed in a directory listing.  The
          arguments for the formatstring are the path and SHA1 of the
          submodule commit.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: module-link-path
               module-link-path
          Text which will be used as the formatstring for a hyperlink
          when a submodule with the specified subdirectory path is
          printed in a directory listing.

          Defaults to ‘'()’.

      -- repository-cgit-configuration parameter: repo-string max-stats
          Override the default maximum statistics period.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string name
          The value to show as repository name.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string owner
          A value used to identify the owner of the repository.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string path
          An absolute path to the repository directory.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string readme
          A path (relative to repo) which specifies a file to include
          verbatim as the “About” page for this repo.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-string section
          The name of the current repository section - all repositories
          defined after this option will inherit the current section
          name.

          Defaults to ‘""’.

      -- repository-cgit-configuration parameter: repo-list
               extra-options
          Extra options will be appended to cgitrc file.

          Defaults to ‘'()’.

 -- cgit-configuration parameter: list extra-options
     Extra options will be appended to cgitrc file.

     Defaults to ‘'()’.

   However, it could be that you just want to get a ‘cgitrc’ up and
running.  In that case, you can pass an ‘opaque-cgit-configuration’ as a
record to ‘cgit-service-type’.  As its name indicates, an opaque
configuration does not have easy reflective capabilities.

   Available ‘opaque-cgit-configuration’ fields are:

 -- opaque-cgit-configuration parameter: package cgit
     The cgit package.

 -- opaque-cgit-configuration parameter: string string
     The contents of the ‘cgitrc’, as a string.

   For example, if your ‘cgitrc’ is just the empty string, you could
instantiate a cgit service like this:

     (service cgit-service-type
              (opaque-cgit-configuration
               (cgitrc "")))

Gitolite Service
................

Gitolite (https://gitolite.com/gitolite/) is a tool for hosting Git
repositories on a central server.

   Gitolite can handle multiple repositories and users, and supports
flexible configuration of the permissions for the users on the
repositories.

   The following example will configure Gitolite using the default ‘git’
user, and the provided SSH public key.

     (service gitolite-service-type
              (gitolite-configuration
                (admin-pubkey (plain-file
                                "yourname.pub"
                                "ssh-rsa AAAA... guix@example.com"))))

   Gitolite is configured through a special admin repository which you
can clone, for example, if you setup Gitolite on ‘example.com’, you
would run the following command to clone the admin repository.

     git clone git@example.com:gitolite-admin

   When the Gitolite service is activated, the provided ‘admin-pubkey’
will be inserted in to the ‘keydir’ directory in the gitolite-admin
repository.  If this results in a change in the repository, it will be
committed using the message “gitolite setup by GNU Guix”.

 -- Data Type: gitolite-configuration
     Data type representing the configuration for
     ‘gitolite-service-type’.

     ‘package’ (default: ‘gitolite’)
          Gitolite package to use.  There are optional Gitolite
          dependencies that are not included in the default package,
          such as Redis and git-annex.  These features can be made
          available by using the ‘make-gitolite’ procedure in the ‘(gnu
          packages version-control’) module to produce a variant of
          Gitolite with the desired additional dependencies.

          The following code returns a package in which the Redis and
          git-annex programs can be invoked by Gitolite’s scripts:

               (use-modules (gnu packages databases)
                            (gnu packages haskell-apps)
                            (gnu packages version-control))
               (make-gitolite (list redis git-annex))

     ‘user’ (default: ‘"git"’)
          User to use for Gitolite.  This will be user that you use when
          accessing Gitolite over SSH.

     ‘group’ (default: ‘"git"’)
          Group to use for Gitolite.

     ‘home-directory’ (default: ‘"/var/lib/gitolite"’)
          Directory in which to store the Gitolite configuration and
          repositories.

     ‘rc-file’ (default: ‘(gitolite-rc-file)’)
          A “file-like” object (*note file-like objects:
          G-Expressions.), representing the configuration for Gitolite.

     ‘git-config’ (default: ‘(gitolite-git-configuration)’)
          A “file-like” object (*note file-like objects:
          G-Expressions.), representing the git configuration for
          Gitolite.

     ‘admin-pubkey’
          A “file-like” object (*note file-like objects: G-Expressions.)
          used to setup Gitolite.  This will be inserted in to the
          ‘keydir’ directory within the gitolite-admin repository.

          To specify the SSH key as a string, use the ‘plain-file’
          function.

               (plain-file "yourname.pub" "ssh-rsa AAAA... guix@example.com")

          The file has to have ‘.pub’ extension.

     ‘admin-name’ (default: ‘#f’)
          Usually the key name is derived by taking a base name of the
          ‘admin-pubkey’.  The resulting file name is the name of the
          gitolite user.  You can use this field to override the
          automatic name.

 -- Data Type: gitolite-rc-file
     Data type representing the Gitolite RC file.

     ‘umask’ (default: ‘#o0077’)
          This controls the permissions Gitolite sets on the
          repositories and their contents.

          A value like ‘#o0027’ will give read access to the group used
          by Gitolite (by default: ‘git’).  This is necessary when using
          Gitolite with software like cgit or gitweb.

     ‘local-code’ (default: ‘"$rc{GL_ADMIN_BASE}/local"’)
          Allows you to add your own non-core programs, or even override
          the shipped ones with your own.

          Please supply the FULL path to this variable.  By default,
          directory called "local" in your gitolite clone is used,
          providing the benefits of versioning them as well as making
          changes to them without having to log on to the server.

     ‘unsafe-pattern’ (default: ‘#f’)
          An optional Perl regular expression for catching unsafe
          configurations in the configuration file.  See Gitolite’s
          documentation
          (https://gitolite.com/gitolite/git-config.html#compensating-for-unsafe_patt)
          for more information.

          When the value is not ‘#f’, it should be a string containing a
          Perl regular expression, such as ‘"[`~#\$\&()|;<>]"’, which is
          the default value used by gitolite.  It rejects any special
          character in configuration that might be interpreted by a
          shell, which is useful when sharing the administration burden
          with other people that do not otherwise have shell access on
          the server.

     ‘git-config-keys’ (default: ‘""’)
          Gitolite allows you to set git config values using the
          ‘config’ keyword.  This setting allows control over the config
          keys to accept.

     ‘log-extra’ (default: ‘#f’)
          Whether gitolite should log extra details.

          For historical reasons, this field defaults to ‘#f’.  The
          default value from gitolite however is ‘1’ (written as ‘#t’ in
          this configuration).

     ‘host-name’ (default: ‘#f’)
          The host name of this gitolite instance.  It is used by the
          mirroring feature.

     ‘roles’ (default: ‘'(("READERS" . 1) ("WRITERS" . ))’)
          Set the role names allowed to be used by users running the
          perms command.

     ‘enable’ (default: ‘'("help" "desc" "info" "perms" "writable" "ssh-authkeys" "git-config" "daemon" "gitweb")’)
          This setting controls the commands and features to enable
          within Gitolite.

     ‘extra-content’ (default: ‘""’)
          Extra content to add verbatim into the ‘%RC’ hash.

 -- Data Type: gitolite-git-configuration
     Data type representing the git configuration file for gitolite.

     ‘name’ (default: ‘"GNU GNU"’)
          User name used for commits (e.g.  during setting up the admin
          repository).

     ‘email’ (default: ‘"guix@localhost"’)
          Email used for commits (e.g.  during setting up the admin
          repository).

     ‘default-branch’ (default: ‘#f’)
          If true, set the ‘init.defaultBranch’ option to that value.
          Common values are ‘"master"’ and ‘"main"’.

     ‘receive-fsck-objects’ (default: ‘#f’)
          If it is set to true, git-receive-pack will check all received
          objects.

     ‘extra-content’ (default: ‘""’)
          Extra content to add verbatim into the git configuration file.

Gitile Service
..............

Gitile (https://git.lepiller.eu/gitile) is a Git forge for viewing
public git repository contents from a web browser.

   Gitile works best in collaboration with Gitolite, and will serve the
public repositories from Gitolite by default.  The service should listen
only on a local port, and a webserver should be configured to serve
static resources.  The gitile service provides an easy way to extend the
Nginx service for that purpose (*note NGINX::).

   The following example will configure Gitile to serve repositories
from a custom location, with some default messages for the home page and
the footers.

     (service gitile-service-type
              (gitile-configuration
                (repositories "/srv/git")
                (base-git-url "https://myweb.site/git")
                (index-title "My git repositories")
                (intro '((p "This is all my public work!")))
                (footer '((p "This is the end")))
                (nginx
                  (nginx-server-configuration
                    (ssl-certificate
                      "/etc/certs/myweb.site/fullchain.pem")
                    (ssl-certificate-key
                      "/etc/certs/myweb.site/privkey.pem")
                    (listen '("443 ssl http2" "[::]:443 ssl http2"))
                    (locations
                      (list
                        ;; Allow for https anonymous fetch on /git/ urls.
                        (git-http-nginx-location-configuration
                          (git-http-configuration
                            (uri-path "/git/")
                            (git-root "/var/lib/gitolite/repositories")))))))))

   In addition to the configuration record, you should configure your
git repositories to contain some optional information.  First, your
public repositories need to contain the ‘git-daemon-export-ok’ magic
file that allows Git to export the repository.  Gitile uses the presence
of this file to detect public repositories it should make accessible.
To do so with Gitolite for instance, modify your ‘conf/gitolite.conf’ to
include this in the repositories you want to make public:

     repo foo
         R = daemon

   In addition, Gitile can read the repository configuration to display
more information on the repository.  Gitile uses the gitweb namespace
for its configuration.  As an example, you can use the following in your
‘conf/gitolite.conf’:

     repo foo
         R = daemon
         desc = A long description, optionally with <i>HTML</i>, shown on the index page
         config gitweb.name = The Foo Project
         config gitweb.synopsis = A short description, shown on the main page of the project

   Do not forget to commit and push these changes once you are
satisfied.  You may need to change your gitolite configuration to allow
the previous configuration options to be set.  One way to do that is to
add the following service definition:

     (service gitolite-service-type
               (gitolite-configuration
                 (admin-pubkey (local-file "key.pub"))
                 (rc-file
                   (gitolite-rc-file
                     (umask #o0027)
                     ;; Allow to set any configuration key
                     (git-config-keys ".*")
                     ;; Allow any text as a valid configuration value
                     (unsafe-patt "^$")))))

 -- Data Type: gitile-configuration
     Data type representing the configuration for ‘gitile-service-type’.

     ‘package’ (default: GITILE)
          Gitile package to use.

     ‘host’ (default: ‘"localhost"’)
          The host on which gitile is listening.

     ‘port’ (default: ‘8080’)
          The port on which gitile is listening.

     ‘database’ (default: ‘"/var/lib/gitile/gitile-db.sql"’)
          The location of the database.

     ‘repositories’ (default: ‘"/var/lib/gitolite/repositories"’)
          The location of the repositories.  Note that only public
          repositories will be shown by Gitile.  To make a repository
          public, add an empty ‘git-daemon-export-ok’ file at the root
          of that repository.

     ‘git-owner-validation?’ (default: ‘#t’)
          Whether to check for the service user’s ownership of
          repositories.  By default, Git will refuse to process a
          repository owned by another user.

     ‘base-git-url’
          The base git url that will be used to show clone commands.

     ‘index-title’ (default: ‘"Index"’)
          The page title for the index page that lists all the available
          repositories.

     ‘intro’ (default: ‘'()’)
          The intro content, as a list of sxml expressions.  This is
          shown above the list of repositories, on the index page.

     ‘footer’ (default: ‘'()’)
          The footer content, as a list of sxml expressions.  This is
          shown on every page served by Gitile.

     ‘nginx’
          An nginx server block that will be extended and used as a
          reverse proxy by Gitile to serve its pages, and as a normal
          web server to serve its assets.

          You can use this block to add more custom URLs to your domain,
          such as a ‘/git/’ URL for anonymous clones, or serving any
          other files you would like to serve.

   ---------- Footnotes ----------

   (1) By creating the magic file ‘git-daemon-export-ok’ in the
repository directory.

   (2) Run ‘man git-daemon’ for more information.


File: guix.ru.info,  Node: Игровые службы,  Next: Службы подключения PAM,  Prev: Сервисы упраления версиями,  Up: Сервисы

11.10.33 Игровые службы
-----------------------

Joycond service
...............

The joycond service allows the pairing of Nintendo joycon game
controllers over Bluetooth.  (*note Сервисы рабочего стола:: for setting
up Bluetooth.)

 -- Data Type: joycond-configuration
     Data type representing the configuration of ‘joycond’.

     ‘package’ (default: ‘joycond’)
          The joycond package to use.

 -- Variable: joycond-service-type
     Service type for the joycond service.  It also extends the
     ‘udev-service-type’ with the ‘joycond’ package (provided via the
     ‘joycond-configuration’ configuration), so that joycond controllers
     can be detected and used by an unprivileged user.

The Battle for Wesnoth Service
..............................

The Battle for Wesnoth (https://wesnoth.org) is a fantasy, turn based
tactical strategy game, with several single player campaigns, and
multiplayer games (both networked and local).

 -- Variable: wesnothd-service-type
     Service type for the wesnothd service.  Its value must be a
     ‘wesnothd-configuration’ object.  To run wesnothd in the default
     configuration, instantiate it as:

          (service wesnothd-service-type)

 -- Data Type: wesnothd-configuration
     Data type representing the configuration of ‘wesnothd’.

     ‘package’ (default: ‘wesnoth-server’)
          The wesnoth server package to use.

     ‘port’ (default: ‘15000’)
          The port to bind the server to.


File: guix.ru.info,  Node: Службы подключения PAM,  Next: Сервисы Guix,  Prev: Игровые службы,  Up: Сервисы

11.10.34 Службы подключения PAM
-------------------------------

The ‘(gnu services pam-mount)’ module provides a service allowing users
to mount volumes when they log in.  It should be able to mount any
volume format supported by the system.

 -- Variable: pam-mount-service-type
     Service type for PAM Mount support.

 -- Data Type: pam-mount-configuration
     Управление конфигурацией операционной системы.

     It takes the following parameters:

     ‘rules’
          The configuration rules that will be used to generate
          ‘/etc/security/pam_mount.conf.xml’.

          The configuration rules are SXML elements (*note
          (guile)SXML::), and the default ones don’t mount anything for
          anyone at login:

               `((debug (@ (enable "0")))
                 (mntoptions (@ (allow ,(string-join
                                         '("nosuid" "nodev" "loop"
                                           "encryption" "fsck" "nonempty"
                                           "allow_root" "allow_other")
                                         ","))))
                 (mntoptions (@ (require "nosuid,nodev")))
                 (logout (@ (wait "0")
                            (hup "0")
                            (term "no")
                            (kill "no")))
                 (mkmountpoint (@ (enable "1")
                                  (remove "true"))))

          Some ‘volume’ elements must be added to automatically mount
          volumes at login.  Here’s an example allowing the user ‘alice’
          to mount her encrypted ‘HOME’ directory and allowing the user
          ‘bob’ to mount the partition where he stores his data:

               (define pam-mount-rules
               `((debug (@ (enable "0")))
                           (volume (@ (user "alice")
                                      (fstype "crypt")
                                      (path "/dev/sda2")
                                      (mountpoint "/home/alice")))
                           (volume (@ (user "bob")
                                      (fstype "auto")
                                      (path "/dev/sdb3")
                                      (mountpoint "/home/bob/data")
                                      (options "defaults,autodefrag,compress")))
                           (mntoptions (@ (allow ,(string-join
                                                   '("nosuid" "nodev" "loop"
                                                     "encryption" "fsck" "nonempty"
                                                     "allow_root" "allow_other")
                                                   ","))))
                           (mntoptions (@ (require "nosuid,nodev")))
                           (logout (@ (wait "0")
                                      (hup "0")
                                      (term "no")
                                      (kill "no")))
                           (mkmountpoint (@ (enable "1")
                                            (remove "true")))))

               (service pam-mount-service-type
                        (pam-mount-configuration
                          (rules pam-mount-rules)))

          The complete list of possible options can be found in the man
          page for pam_mount.conf
          (http://pam-mount.sourceforge.net/pam_mount.conf.5.html).

PAM Mount Volume Service
------------------------

PAM mount volumes are automatically mounted at login by the PAM login
service according to a set of per-volume rules.  Because they are
mounted by PAM the password entered during login may be used directly to
mount authenticated volumes, such as ‘cifs’, using the same credentials.

   These volumes will be added in addition to any volumes directly
specified in ‘pam-mount-rules’.

   Here is an example of a rule which will mount a remote CIFS share
from ‘//remote-server/share’ into a sub-directory of ‘/shares’ named
after the user logging in:

     (simple-service 'pam-mount-remote-share pam-mount-volume-service-type
                     (list (pam-mount-volume
                            (secondary-group "users")
                            (file-system-type "cifs")
                            (server "remote-server")
                            (file-name "share")
                            (mount-point "/shares/%(USER)")
                            (options "nosuid,nodev,seal,cifsacl"))))

 -- Data Type: pam-mount-volume-service-type
     Configuration for a single volume to be mounted.  Any fields not
     specified will be omitted from the run-time PAM configuration.  See
     the man page
     (http://pam-mount.sourceforge.net/pam_mount.conf.5.html) for the
     default values when unspecified.

     ‘user-name’ (type: maybe-string)
          Mount the volume for the given user.

     ‘user-id’ (type: maybe-integer-or-range)
          Mount the volume for the user with this ID. This field may
          also be specified as a pair of ‘(start . end)’ indicating a
          range of user IDs for whom to mount the volume.

     ‘primary-group’ (type: maybe-string)
          Mount the volume for users with this primary group name.

     ‘group-id’ (type: maybe-integer-or-range)
          Mount the volume for the users with this primary group ID.
          This field may also be specified as a cons cell of ‘(start .
          end)’ indicating a range of group ids for whom to mount the
          volume.

     ‘secondary-group’ (type: maybe-string)
          Mount the volume for users who are members of this group as
          either a primary or secondary group.

     ‘file-system-type’ (type: maybe-string)
          The file system type for the volume being mounted (e.g.,
          ‘cifs’)

     ‘no-mount-as-root?’ (type: maybe-boolean)
          Whether or not to mount the volume with root privileges.  This
          is normally disabled, but may be enabled for mounts of type
          ‘fuse’, or other user-level mounts.

     ‘server’ (type: maybe-string)
          The name of the remote server to mount the volume from, when
          necessary.

     ‘file-name’ (type: maybe-string)
          The location of the volume, either local or remote, depending
          on the ‘file-system-type’.

     ‘mount-point’ (type: maybe-string)
          Where to mount the volume in the local file-system.  This may
          be set to ‘~’ to indicate the home directory of the user
          logging in.  If this field is omitted then ‘/etc/fstab’ is
          consulted for the mount destination.

     ‘options’ (type: maybe-string)
          The options to be passed as-is to the underlying mount
          program.

     ‘ssh?’ (type: maybe-boolean)
          Enable this option to pass the login password to SSH for use
          with mounts involving SSH (e.g., ‘sshfs’).

     ‘cipher’ (type: maybe-string)
          Cryptsetup cipher name for the volume.  To be used with the
          ‘crypt’ ‘file-system-type’.

     ‘file-system-key-cipher’ (type: maybe-string)
          Cipher name used by the target volume.

     ‘file-system-key-hash’ (type: maybe-string)
          SSL hash name used by the target volume.

     ‘file-system-key-file-name’ (type: maybe-string)
          File name of the file system key for the target volume.


File: guix.ru.info,  Node: Сервисы Guix,  Next: Службы Linux,  Prev: Службы подключения PAM,  Up: Сервисы

11.10.35 Сервисы Guix
---------------------

Shared Cache Service
....................

Running ‘guix pull’, ‘guix time-machine’, ‘guix system reconfigure’, and
‘guix home reconfigure’ pulls the complete Git version control history
of your channels in ‘$HOME/.cache/guix/checkouts’.  If you have multiple
user accounts (typically ‘root’ and a main user account for your
personal computer), or if multiple users are using the system (typically
on a shared server), then this can quickly waste a lot of space.

   The ‘shared-cache’ service lets you prevent this waste by either
sharing or exposing a specific user’s cache to the other users.

   In the context of this service, _sharing_ and _exposing_ have the
same meaning as with ‘guix shell’: making the shared cache directory
read-only if you use mode ‘'expose’ (the default), and writable if you
use mode ‘'share’, (*note ‘--expose’ and ‘--share’: Запуск guix shell.).

   Whatever mode you choose, from the point of view of the user, the
cache appears writable.  With ‘'expose’, any write will be stored in a
user-owned overlay directory next to mountpoint, whereas with ‘'share’,
writes will be propagated back to the sharing user’s cache.

     Предупреждение: Use the ‘'share’ option _if and only if_ users on
     the machine trust each other.  This is a hard requirement since,
     with this option, any user could “poison” the shared cache to
     indirectly gain access to other user’s data and privileges.

     Предупреждение: Using ‘'share’ is meant for a single-seat computer
     where the single user has unprivileged user accounts—e.g.  one for
     work and one for gaming.  Even then, channels from one will leak
     into the other’s cache.  Use with caution.

     Предупреждение: ‘'share’ will not work for multiple concurrent
     invocation of ‘guix’, e.g.  if two user accounts run ‘guix time
     machine’ at the same time, the results will be fun but not useful.

   Here is an example configuration that exposes ‘root’’s guix checkout
cache to ‘alice’ and ‘bob’:

     (operating-system
       ;; ...
          (services
           (cons*
            (service shared-cache-service-type
                  (shared-cache-configuration
                    (users (list (user-cache (user "alice"))
                                 (user-cache (user "bob"))))))
                         %desktop-services)))

   The service can also be extended by providing a list of ‘user-cache’,
allowing for easier splitting of configuration.

     (operating-system
       ;; ...
       (services
        (cons*
         (simple-service 'bob-shared-guix-cache shared-cache-service-type
                         (list (user-cache (user "bob"))))
         %desktop-services)))

 -- Variable: shared-cache-service-type
     Service type for sharing a subdirectory of ‘~/.cache/’ between
     multiple users.

     This service allows different system users to share the contents of
     the user cache, avoiding duplication and saving disk space.  It can
     be configured in either “share” mode, where all users write to the
     same cache, or “expose” mode, where users get a read-only view with
     a writable overlay.  Its value must be a
     ‘shared-cache-configuration’ object.

 -- Data Type: shared-cache-configuration
     Data type representing the configuration of the shared cache.

     ‘mode’ (default: ‘'expose’)
          Either ‘'share’ (read-write, dangerous) or ‘'expose’
          (read-only with per-user overlay, the default).  In share
          mode, all writes go to the shared directory.  In expose mode,
          only reads use the shared directory; writes go to a user-owned
          overlay.

     ‘shared-directory’ (default: ‘"/root/.cache"’)
          The source cache directory that is shared between users.  Each
          user will see some or all of its subdirectories mounted into
          their own ‘~/.cache’.

     ‘users’ (default: ‘'()’)
          The list of users that will benefit from the shared directory.
          This must be a list of ‘user-info’ records.

 -- Data Type: user-info
     Data type representing the configuration for a single user
     benefitting from a shared cache.

     ‘user’
          The username of the user.

     ‘location’ (default: ‘"/home/USER/.cache"’)
          The cache directory of the user.

     ‘group’ (default: ‘"users"’)
          The primary group of the user.

     ‘directories’ (default: ‘'("guix/checkouts")’)
          List of subdirectories of the ‘shared-cache-configuration’’s
          ‘shared-directory’ (whose default is ‘/root/.cache’) to mount
          under LOCATION (whose default is ‘~/.cache/’) for the user.

Build Farm Front-End (BFFE)
...........................

The Build Farm Front-End (https://git.cbaines.net/guix/bffe/) assists
with building Guix packages in bulk.  It’s responsible for submitting
builds and displaying the status of the build farm.

 -- Variable: bffe-service-type
     Service type for the Build Farm Front-End.  Its value must be a
     ‘bffe-configuration’ object.

 -- Data Type: bffe-configuration
     Data type representing the configuration of the Build Farm
     Front-End.

     ‘package’ (default: ‘bffe’)
          The Build Farm Front-End package to use.

     ‘user’ (default: ‘"bffe"’)
          Сервис mcron.

     ‘group’ (default: ‘"bffe"’)
          The system group to run the service as.

     ‘arguments’
          A list of arguments to the Build Farm Front-End.  These are
          passed to the ‘run-bffe-service’ procedure when starting the
          service.

          For example, the following value directs the Build Farm
          Front-End to submit builds for derivations available from
          ‘data.guix.gnu.org’ to the Build Coordinator instance assumed
          to be running on the same machine.

               (list
                #:build
                (list
                 (build-from-guix-data-service
                  (data-service-url "https://data.guix.gnu.org")
                  (build-coordinator-url "http://127.0.0.1:8746")
                  (branches '("master"))
                  (systems '("x86_64-linux" "i686-linux"))
                  (systems-and-targets
                   (map (lambda (target)
                          (cons "x86_64-linux" target))
                        '("aarch64-linux-gnu"
                          "i586-pc-gnu")))))
                #:web-server-args
                '(#:event-source "https://example.com"
                  #:controller-args
                  (#:title "example.com build farm")))

     ‘extra-environment-variables’ (default: ’())
          Extra environment variables to set via the shepherd service.

Guix Build Coordinator
......................

The Guix Build Coordinator
(https://git.cbaines.net/guix/build-coordinator/) aids in distributing
derivation builds among machines running an “agent”.  The build daemon
is still used to build the derivations, but the Guix Build Coordinator
manages allocating builds and working with the results.

   The Guix Build Coordinator consists of one “coordinator”, and one or
more connected “agent” processes.  The coordinator process handles
clients submitting builds, and allocating builds to agents.  The agent
processes talk to a build daemon to actually perform the builds, then
send the results back to the coordinator.

   There is a script to run the coordinator component of the Guix Build
Coordinator, but the Guix service uses a custom Guile script instead, to
provide better integration with G-expressions used in the configuration.

 -- Variable: guix-build-coordinator-service-type
     Service type for the Guix Build Coordinator.  Its value must be a
     ‘guix-build-coordinator-configuration’ object.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘speed’ (default: ‘1.0’)
          Используемый пакет Guix Build Coordinator.

     ‘speed’ (default: ‘1.0’)
          Сервис mcron.

     ‘port’ (default: ‘22’)
          The system group to run the service as.

     ‘database-uri-string’ (default: ‘"sqlite:///var/lib/guix-build-coordinator/guix_build_coordinator.db"’)
          URI для использования в базе данных.

     ‘speed’ (default: ‘1.0’)
          The URI describing how to listen to requests from agent
          processes.

     ‘speed’ (default: ‘1.0’)
          The URI describing how to listen to requests from clients.
          The client API allows submitting builds and currently isn’t
          authenticated, so take care when configuring this value.

     ‘features’ (default: ‘'()’)
          A G-expression for the allocation strategy to be used.  This
          is a procedure that takes the datastore as an argument and
          populates the allocation plan in the database.

     ‘inputs’ (default: ‘'()’)
          An association list of hooks.  These provide a way to execute
          arbitrary code upon certain events, like a build result being
          processed.

     ‘parallel-hooks’ (default: ’())
          Hooks can be configured to run in parallel.  This parameter is
          an association list of hooks to do in parallel, where the key
          is the symbol for the hook and the value is the number of
          threads to run.

     ‘listen-repl’ (default: #F)
          Port or filename to spawn a REPL listening on, pass ‘#t’ to
          listen on the default port or ‘#f’ to disable.

     ‘port’ (default: ‘22’)
          The Guile package with which to run the Guix Build
          Coordinator.

     ‘extra-environment-variables’ (default: ’())
          Extra environment variables to set via the shepherd service.

 -- Variable: guix-build-coordinator-agent-service-type
     Service type for a Guix Build Coordinator agent.  Its value must be
     a ‘guix-build-coordinator-agent-configuration’ object.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘package’ (default: ‘guix-build-coordinator/agent-only’)
          Используемый пакет Guix Build Coordinator.

     ‘speed’ (default: ‘1.0’)
          Сервис mcron.

     ‘port’ (default: ‘22’)
          The URI to use when connecting to the coordinator.

     ‘authentication’
          Record describing how this agent should authenticate with the
          coordinator.  Possible record types are described below.

     ‘speed’ (default: ‘1.0’)
          The systems for which this agent should fetch builds.  The
          agent process will use the current system it’s running on as
          the default.

     ‘max-parallel-builds’ (default: ‘#f’)
          Число сборок, которые могут быть запущены на машине.

     ‘max-parallel-uploads’ (default: ‘#f’)
          The number of uploads to perform in parallel.

     ‘max-allocated-builds’ (default: ‘#f’)
          The maximum number of builds this agent can be allocated.

     ‘port’ (default: ‘22’)
          Load average value to look at when considering starting new
          builds, if the 1 minute load average exceeds this value, the
          agent will wait before starting new builds.

          This will be unspecified if the value is ‘#f’, and the agent
          will use the number of cores reported by the system as the max
          1 minute load average.

     ‘port’ (default: ‘22’)
          URLs from which to attempt to fetch substitutes for
          derivations, if the derivations aren’t already available.

     ‘native-inputs’ (default: ‘'()’)
          URLs from which to attempt to fetch substitutes for build
          inputs, if the input store items aren’t already available.

     ‘extra-options’ (default: ’())
          Extra command line options for ‘guix-build-coordinator-agent’.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘uuid’
          The UUID of the agent.  This should be generated by the
          coordinator process, stored in the coordinator database, and
          used by the intended agent.

     ‘password’
          The password to use when connecting to the coordinator.

 -- Конфигурирование: системы
     Data type representing an agent authenticating with a coordinator
     via a UUID and password read from a file.

     ‘uuid’
          The UUID of the agent.  This should be generated by the
          coordinator process, stored in the coordinator database, and
          used by the intended agent.

     ‘профиль’
          A file containing the password to use when connecting to the
          coordinator.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘каналы’
          Name of an agent, this is used to match up to an existing
          entry in the database if there is one.  When no existing entry
          is found, a new entry is automatically added.

     ‘token’
          Dynamic auth token, this is created and stored in the
          coordinator database, and is used by the agent to
          authenticate.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘каналы’
          Name of an agent, this is used to match up to an existing
          entry in the database if there is one.  When no existing entry
          is found, a new entry is automatically added.

     ‘профиль’
          File containing the dynamic auth token, this is created and
          stored in the coordinator database, and is used by the agent
          to authenticate.

Сервисы баз данных
..................

The Guix Data Service (http://data.guix.gnu.org) processes, stores and
provides data about GNU Guix.  This includes information about packages,
derivations and lint warnings.

   The data is stored in a PostgreSQL database, and available through a
web interface.

 -- Variable: guix-data-service-type
     Service type for the Guix Data Service.  Its value must be a
     ‘guix-data-service-configuration’ object.  The service optionally
     extends the getmail service, as the guix-commits mailing list is
     used to find out about changes in the Guix git repository.

 -- Data Type: guix-data-service-configuration
     Data type representing the configuration of the Guix Data Service.

     ‘speed’ (default: ‘1.0’)
          The Guix Data Service package to use.

     ‘speed’ (default: ‘1.0’)
          Сервис mcron.

     ‘port’ (default: ‘22’)
          The system group to run the service as.

     ‘port’ (default: ‘22’)
          Сервис rottlog.

     ‘speed’ (default: ‘1.0’)
          Сервис rottlog.

     ‘parallel-builds’ (default: ‘1’)
          If set, this is the list of mailboxes that the getmail service
          will be configured to listen to.

     ‘compression-level’ (default: ‘3’)
          If set, this is the ‘getmail-retriever-configuration’ object
          with which to configure getmail to fetch mail from the
          guix-commits mailing list.

     ‘extra-options’ (default: ’())
          Дополнительные параметры командной строки для
          ‘guix-data-service’.

     ‘features’ (default: ‘'()’)
          Extra command line options for
          ‘guix-data-service-process-jobs’.

     ‘git-repositories’ (default: #F)
          List of git-repository information to insert into the
          database.

     ‘build-servers’ (default: #F)
          List of build-server information to insert into the database.

Guix Home Service
.................

The Guix Home service is a way to let Guix System deploy the home
environment of one or more users (*note Home Configuration::, for more
on Guix Home).  That way, the system configuration embeds declarations
of the home environment of those users and can be used to deploy
everything consistently at once, saving users the need to run ‘guix home
reconfigure’ independently.

   ‘guix home’ can operate on the home environment configured for
current user via this service, but its effect won’t last beyond the next
system activation.  This can be used for quick testing and may avoid the
need of keeping a separate home configuration.

 -- Variable: guix-home-service-type
     Service type for the Guix Home service.  Its value must be a list
     of lists containing user and home environment pairs.  The key of
     each pair is a string representing the user to deploy the
     configuration under and the value is a home-environment
     configuration.

          (use-modules (gnu services guix))

          (define my-home
            (home-environment
              ...))

          (operating-system
            (services (append (list (service guix-home-service-type
                                             `(("alice" ,my-home))))
                              %base-services)))

     This service can be extended by other services to add additional
     home environments, as in this example:

          (simple-service 'my-extra-home guix-home-service-type
                          `(("bob" ,my-extra-home)))

Nar Herder
..........

The Nar Herder (https://git.cbaines.net/guix/nar-herder/about/) is a
utility for managing a collection of nars.

 -- Variable: nar-herder-type
     Service type for the Guix Data Service.  Its value must be a
     ‘nar-herder-configuration’ object.  The service optionally extends
     the getmail service, as the guix-commits mailing list is used to
     find out about changes in the Guix git repository.

 -- Data Type: nar-herder-configuration
     Data type representing the configuration of the Guix Data Service.

     ‘package’ (default: ‘nar-herder’)
          The Nar Herder package to use.

     ‘user’ (default: ‘"nar-herder"’)
          Сервис mcron.

     ‘group’ (default: ‘"nar-herder"’)
          The system group to run the service as.

     ‘port’ (default: ‘8734’)
          The port to bind the server to.

     ‘speed’ (default: ‘1.0’)
          The host to bind the server to.

     ‘control-port’ (default: ‘8734’)
          The port to bind the control server to.

     ‘control-host’ (default: ‘"127.0.0.1"’)
          The host to bind the control server to.

     ‘features’ (default: ‘'()’)
          Optional URL of the other Nar Herder instance which should be
          mirrored.  This means that this Nar Herder instance will
          download it’s database, and keep it up to date.

     ‘database’ (default: ‘"/var/lib/nar-herder/nar_herder.db"’)
          Location for the database.  If this Nar Herder instance is
          mirroring another, the database will be downloaded if it
          doesn’t exist.  If this Nar Herder instance isn’t mirroring
          another, an empty database will be created.

     ‘database-dump’ (default: ‘"/var/lib/nar-herder/nar_herder_dump.db"’)
          Location of the database dump.  This is created and regularly
          updated by taking a copy of the database.  This is the version
          of the database that is available to download.

     ‘storage’ (default: ‘#f’)
          Optional location in which to store nars.

     ‘storage-limit’ (default: ‘"none"’)
          Limit in bytes for the nars stored in the storage location.
          This can also be set to “none” so that there is no limit.

          When the storage location exceeds this size, nars are removed
          according to the nar removal criteria.

     ‘storage-nar-removal-criteria’ (default: ‘'()’)
          Criteria used to remove nars from the storage location.  These
          are used in conjunction with the storage limit.

          When the storage location exceeds the storage limit size, nars
          will be checked against the nar removal criteria and if any of
          the criteria match, they will be removed.  This will continue
          until the storage location is below the storage limit size.

          Each criteria is specified by a string, then an equals sign,
          then another string.  Currently, only one criteria is
          supported, checking if a nar is stored on another Nar Herder
          instance.

     ‘ttl’ (default: ‘#f’)
          Produce ‘Cache-Control’ HTTP headers that advertise a
          time-to-live (TTL) of TTL.  TTL must denote a duration: ‘5d’
          means 5 days, ‘1m’ means 1 month, and so on.

          This allows the user’s Guix to keep substitute information in
          cache for TTL.

     ‘new-ttl’ (default: ‘#f’)
          If specified, this will override the ‘ttl’ setting when used
          for the ‘Cache-Control’ headers, but this value will be used
          when scheduling the removal of nars.

          Use this setting when the TTL is being reduced to avoid
          removing nars while clients still have cached narinfos.

     ‘negative-ttl’ (default: ‘#f’)
          Similarly produce ‘Cache-Control’ HTTP headers to advertise
          the time-to-live (TTL) of _negative_ lookups—missing store
          items, for which the HTTP 404 code is returned.  By default,
          no negative TTL is advertised.

     ‘log-level’ (default: ‘'DEBUG’)
          Log level to use, specify a log level like ‘'INFO’ to stop
          logging individual requests.

     ‘cached-compressions’ (default: ‘'()’)
          Activate generating cached nars with different compression
          details from the stored nars.  This is a list of
          nar-herder-cached-compression-configuration records.

     ‘min-uses’ (default: ‘3’)
          When cached-compressions are enabled, generate cached nars
          when at least this number of requests are made for a nar.

     ‘workers’ (default: ‘2’)
          Number of cached nars to generate at a time.

     ‘nar-source’ (default: ‘#f’)
          Location to fetch nars from when computing cached
          compressions.  By default, the storage location will be used.

     ‘extra-environment-variables’ (default: ‘'()’)
          Extra environment variables to set via the shepherd service.

 -- Data Type: nar-herder-cached-compression-configuration
     Data type representing the cached compression configuration.

     ‘type’
          Type of compression to use, e.g.  ‘'zstd’.

     ‘workers’ (default: ‘#f’)
          Level of the compression to use.

     ‘directory’ (default: ‘#f’)
          Location to store the cached nars.  If unspecified, they will
          be stored in /var/cache/nar-herder/nar/TYPE.

     ‘directory-max-size’ (default: ‘#f’)
          Maximum size in bytes of the directory.

     ‘unused-removal-duration’ (default: ‘#f’)
          If a cached nar isn’t used for ‘unused-removal-duration’, it
          will be scheduled for removal.

          UNUSED-REMOVAL-DURATION must denote a duration: ‘5d’ means 5
          days, ‘1m’ means 1 month, and so on.

     ‘ttl’ (default: ‘#f’)
          If specified this overrides the ‘ttl’ used for narinfos when
          this cached compression is available.

     ‘new-ttl’ (default: ‘#f’)
          As with the ‘new-ttl’ option for ‘nar-herder-configuration’,
          this value will override the ‘ttl’ when used for narinfo
          requests.


File: guix.ru.info,  Node: Службы Linux,  Next: Сервисы Hurd,  Prev: Сервисы Guix,  Up: Сервисы

11.10.36 Службы Linux
---------------------

VFS Mapping Service
...................

The VFS (Virtual File System) Mapping service allows you to bind a file
name under a different name in the global namespace.  For example, this
is used by the Shared Cache Service (*note Сервисы Guix::) to bind the
‘root’ user’s cache over another user’s cache.  Another use case may be
to expose game data from the store over your home directory, and apply
modifications there.

   The service has three _policies_ to choose from with respect to
access rights on the bound over path:

‘'bind’
     Use a bind mount; the ownership and file permissions of the
     destination are the same as the source.

‘'translate’
     Use bindfs to make the destination appear as owned by the target
     user and group.  Writes will be propagated back to the source as if
     made by the original owner.

‘'overlay’
     Use an overlay to make the destination appear as owned by the
     target user and group.  Writes will not appear in the source, but
     will be stored in a target-user-owned ‘-overlay’ suffixed directory
     near the destination.

   Here is an example configuration that exposes the default data
directory of ‘tuxpaint’ under the home directory of ‘alice’.  Any
modification made by Alice to the brushes or stamps will not propagate
back to the store (which is read-only anyway).

     (operating-system
       ;; ...
       (services
        (cons*
         (service vfs-mapping-service-type
                  (vfs-mapping-configuration
                   (bindings (list (vfs-mapping
                                    (source      #~(string-append #$tuxpaint
                                                                  "/share/tuxpaint"))
                                    (destination "/home/alice/.tuxpaint")
                                    (user        "alice")
                                    (policy      'overlay)
                                    (name        "alice-tuxpaint-overlay"))))))
         %desktop-services)))

   The service can also be extended by providing a list of
‘vfs-mapping’, allowing for easier splitting of configuration.

     (operating-system
       ;; ...
       (services
        (cons*
         (simple-service 'bob-too-wants-to-hack-on-tuxpaint
                         vfs-mapping-service-type
                         (list (vfs-mapping
                                (source      #~(string-append #$tuxpaint "/share/tuxpaint"))
                                (destination "/home/bob/.tuxpaint")
                                (user        "bob")
                                (policy      'overlay)
                                (name        "bob-tuxpaint-overlay"))))
         %desktop-services)))

   The ‘source’ file name must exist for the service to start.  The
‘destination’ directory will be created if it does not exist.

 -- Variable: vfs-mapping-service-type
     Service type for binding a directory in multiple places on the file
     system.

     The access rights are either the same in source and destination
     (‘'bind’), or writes are translated back to the source as if made
     by the source’s owner (‘'translate’), or kept in an overlay
     directory near the destination (‘'overlay’).  The service’s value
     must be a ‘vfs-mapping-configuration’ object.

 -- Data Type: vfs-mapping-configuration
     Data type representing the configuration of the vfs-mapping
     service.

     ‘bindfs’ (default: ‘#~(string-append #$bindfs "/bin/bindfs")’)
          The ‘bindfs’ command to use for mounting.

     ‘fusermount’ (default: ‘#~(string-append #$fuse-2 "/bin/fusermount")’)
          The ‘fusermount’ command to use.

     ‘umount’ (default: ‘#~(string-append #$util-linux+udev "/bin/umount")’)
          The ‘umount’ command to use.

     ‘bindings’ (default: ‘'()’)
          A list of ‘vfs-mapping’ records.

 -- Data Type: vfs-mapping
     Data type representing the configuration for a single shared
     directory.

     ‘source’
          The source file name to be shared.

     ‘destination’
          The destination at which the contents of ‘source’ will be
          exposed.

     ‘policy’ (default: ‘'translate’)
          Either ‘'bind’ (same ownership and access rights for ‘source’
          and ‘destination’), ‘'translate’ (read-write, with writes
          translated as if made by ‘source’’s owner), or ‘'overlay’
          (read-only with ‘user’-owned writable overlay).

     ‘user’ (default: ‘#f’)
          The user that will own the ‘destination’ directory, and appear
          to own its content.  It must be kept at its default ‘#f’ value
          when using the ‘'bind’ policy.

     ‘group’ (default: ‘"users"’)
          The group that will own the ‘destination’ directory, and
          appear to own its content.

     ‘name’ (default: ‘"<src>-[<policy>]-><dst>"’)
          The name of the shepherd service to mount and unmount the
          binding.

     ‘requirement’ (default: ‘'(file-systems user-homes)’)
          The list of services that Shepherd ought to provision before
          trying to mount.

Почтовые сервисы
................

Early OOM (https://github.com/rfjakob/earlyoom), also known as Earlyoom,
is a minimalist out of memory (OOM) daemon that runs in user space and
provides a more responsive and configurable alternative to the in-kernel
OOM killer.  It is useful to prevent the system from becoming
unresponsive when it runs out of memory.

 -- Variable: earlyoom-service-type
     The service type for running ‘earlyoom’, the Early OOM daemon.  Its
     value must be a ‘earlyoom-configuration’ object, described below.
     The service can be instantiated in its default configuration with:

          (service earlyoom-service-type)

 -- Data Type: earlyoom-configuration
     This is the configuration record for the ‘earlyoom-service-type’.

     ‘port’ (default: ‘22’)
          Используемый пакет Earlyoom.

     ‘parallel-builds’ (default: ‘1’)
          The threshold for the minimum _available_ memory, in
          percentages.

     ‘speed’ (default: ‘1.0’)
          The threshold for the minimum free swap memory, in
          percentages.

     ‘speed’ (default: ‘1.0’)
          A regular expression (as a string) to match the names of the
          processes that should be preferably killed.

     ‘port’ (default: ‘22’)
          A regular expression (as a string) to match the names of the
          processes that should _not_ be killed.

     ‘port’ (default: ‘22’)
          The interval in seconds at which a memory report is printed.
          It is disabled by default.

     ‘compression-level’ (default: ‘3’)
          A boolean indicating whether the positive adjustments set in
          ‘/proc/*/oom_score_adj’ should be ignored.

     ‘speed’ (default: ‘1.0’)
          A boolean indicating whether debug messages should be printed.
          The logs are saved at ‘/var/log/earlyoom.log’.

     ‘speed’ (default: ‘1.0’)
          This can be used to provide a custom command used for sending
          notifications.

fstrim Service
..............

The command ‘fstrim’ can be used to discard (or “trim”) unused blocks on
a mounted file system.

     Предупреждение: Running ‘fstrim’ frequently, or even using ‘mount
     -o discard’, might negatively affect the lifetime of poor-quality
     SSD devices.  For most desktop and server systems a sufficient
     trimming frequency is once a week.  Note that not all devices
     support a queued trim, so each trim command incurs a performance
     penalty on whatever else might be trying to use the disk at the
     time.

 -- Variable: fstrim-service-type
     Type for a service that periodically runs ‘fstrim’, whose value
     must be an ‘<fstrim-configuration>’ object.  The service can be
     instantiated in its default configuration with:

          (service fstrim-service-type)

 -- Data Type: fstrim-configuration
     Доступными полями ‘fstrim-configuration’ являются:

     ‘package’ (default: ‘util-linux’) (type: file-like)
          The package providing the ‘fstrim’ command.

     ‘schedule’ (default: ‘"0 0 * * 0"’) (type: Shepherd calendar event)
          Schedule for launching ‘fstrim’, expressed as a string in
          traditional cron syntax or as a gexp evaluating to a Shepherd
          calendar event (*note (shepherd)Timers::).  By default this is
          set to run weekly on Sunday at 00:00.

     ‘listed-in’ (default: ‘'("/etc/fstab" "/proc/self/mountinfo")’) (type: maybe-list-of-strings)
          List of files in fstab or kernel mountinfo format.  All
          missing or empty files are silently ignored.  The evaluation
          of the list _stops_ after the first non-empty file.  File
          systems with ‘X-fstrim.notrim’ mount option in fstab are
          skipped.

     ‘verbose?’ (default: ‘#t’) (type: boolean)
          Verbose execution.

     ‘quiet-unsupported?’ (default: ‘#t’) (type: boolean)
          Suppress error messages if trim operation (ioctl) is
          unsupported.

     ‘extra-arguments’ (type: maybe-list-of-strings)
          Extra options to append to ‘fstrim’ (run ‘man fstrim’ for more
          information).

Сервисы Kerberos
................

The kernel module loader service allows one to load loadable kernel
modules at boot.  This is especially useful for modules that don’t
autoload and need to be manually loaded, as is the case with ‘ddcci’.

 -- Variable: kernel-module-loader-service-type
     The service type for loading loadable kernel modules at boot with
     ‘modprobe’.  Its value must be a list of strings representing
     module names.  For example loading the drivers provided by
     ‘ddcci-driver-linux’, in debugging mode by passing some module
     parameters, can be done as follow:

          (use-modules (gnu) (gnu services))
          (use-package-modules linux)
          (use-service-modules linux)

          (define ddcci-config
            (plain-file "ddcci.conf"
                        "options ddcci dyndbg delay=120"))

          (operating-system
            ...
            (services (cons* (service kernel-module-loader-service-type
                                      '("ddcci" "ddcci_backlight"))
                             (simple-service 'ddcci-config etc-service-type
                                             (list `("modprobe.d/ddcci.conf"
                                                     ,ddcci-config)))
                             %base-services))
            (kernel-loadable-modules (list ddcci-driver-linux)))

Cachefilesd Service
...................

The Cachefilesd service starts a daemon that caches network file system
data locally.  It is especially useful for NFS and AFS shares, where it
reduces latencies for repeated access when reading files.

   The daemon can be configured as follows:

     (service cachefilesd-service-type
              (cachefilesd-configuration
                (cache-directory "/var/cache/fscache")))

 -- Variable: cachefilesd-service-type
     The service type for starting ‘cachefilesd’.  The value for this
     service type is a ‘cachefilesd-configuration’, whose only required
     field is CACHE-DIRECTORY.

 -- Data Type: cachefilesd-configuration
     Available ‘cachefilesd-configuration’ fields are:

     ‘cachefilesd’ (default: ‘cachefilesd’) (type: file-like)
          The cachefilesd package to use.

     ‘debug-output?’ (default: ‘#f’) (type: boolean)
          Print debugging output to stderr.

     ‘use-syslog?’ (default: ‘#t’) (type: boolean)
          Log to syslog facility instead of stdout.

     ‘scan?’ (default: ‘#t’) (type: boolean)
          Scan for cacheable objects.

     ‘cache-directory’ (type: maybe-string)
          Location of the cache directory.

     ‘cache-name’ (default: ‘"CacheFiles"’) (type: maybe-string)
          Name of cache (keep unique).

     ‘security-context’ (type: maybe-string)
          SELinux security context.

     ‘pause-culling-for-block-percentage’ (default: ‘7’) (type: maybe-non-negative-integer)
          Pause culling when available blocks exceed this percentage.

     ‘pause-culling-for-file-percentage’ (default: ‘7’) (type: maybe-non-negative-integer)
          Pause culling when available files exceed this percentage.

     ‘resume-culling-for-block-percentage’ (default: ‘5’) (type: maybe-non-negative-integer)
          Start culling when available blocks drop below this
          percentage.

     ‘resume-culling-for-file-percentage’ (default: ‘5’) (type: maybe-non-negative-integer)
          Start culling when available files drop below this percentage.

     ‘pause-caching-for-block-percentage’ (default: ‘1’) (type: maybe-non-negative-integer)
          Pause further allocations when available blocks drop below
          this percentage.

     ‘pause-caching-for-file-percentage’ (default: ‘1’) (type: maybe-non-negative-integer)
          Pause further allocations when available files drop below this
          percentage.

     ‘log2-table-size’ (default: ‘12’) (type: maybe-non-negative-integer)
          Size of tables holding cullable objects in logarithm of base
          2.

     ‘cull?’ (default: ‘#t’) (type: boolean)
          Create free space by culling (consumes system load).

     ‘trace-function-entry-in-kernel-module?’ (default: ‘#f’) (type: boolean)
          Trace function entry in the kernel module (for debugging).

     ‘trace-function-exit-in-kernel-module?’ (default: ‘#f’) (type: boolean)
          Trace function exit in the kernel module (for debugging).

     ‘trace-internal-checkpoints-in-kernel-module?’ (default: ‘#f’) (type: boolean)
          Trace internal checkpoints in the kernel module (for
          debugging).

Почтовые сервисы
................

The Rasdaemon service provides a daemon which monitors platform RAS
(Reliability, Availability, and Serviceability) reports from Linux
kernel trace events, logging them to syslogd.

   Reliability, Availability and Serviceability is a concept used on
servers meant to measure their robustness.

   *Relability* is the probability that a system will produce correct
outputs:

   • Generally measured as Mean Time Between Failures (MTBF), and
   • Enhanced by features that help to avoid, detect and repair hardware
     по умолчанию

   *Availability* is the probability that a system is operational at a
given time:

   • Generally measured as a percentage of downtime per a period of
     time, and
   • Often uses mechanisms to detect and correct hardware faults in
     runtime.

   *Serviceability* is the simplicity and speed with which a system can
be repaired or maintained:

   • Generally measured on Mean Time Between Repair (MTBR).

   Among the monitoring measures, the most usual ones include:

   • CPU – detect errors at instruction execution and at L1/L2/L3
     caches;
   • Memory – add error correction logic (ECC) to detect and correct
     errors;
   • I/O – add CRC checksums for transferred data;
   • Storage – RAID, journal file systems, checksums, Self-Monitoring,
     Analysis and Reporting Technology (SMART).

   By monitoring the number of occurrences of error detections, it is
possible to identify if the probability of hardware errors is
increasing, and, on such case, do a preventive maintenance to replace a
degraded component while those errors are correctable.

   For detailed information about the types of error events gathered and
how to make sense of them, see the kernel administrator’s guide at
<https://www.kernel.org/doc/html/latest/admin-guide/ras.html>.

 -- Variable: rasdaemon-service-type
     Service type for the ‘rasdaemon’ service.  It accepts a
     ‘rasdaemon-configuration’ object.  Instantiating like

          (service openssh-service-type)

     will load with a default configuration, which monitors all events
     and logs to syslogd.

 -- Data Type: pagekite-configuration
     Управление конфигурацией операционной системы.

     ‘features’ (default: ‘'()’)

          A boolean indicating whether to record the events in an SQLite
          database.  This provides a more structured access to the
          information contained in the log file.  The database location
          is hard-coded to ‘/var/lib/rasdaemon/ras-mc_event.db’.

Игровые службы
..............

The Zram device service provides a compressed swap device in system
memory.  The Linux Kernel documentation has more information about zram
(https://www.kernel.org/doc/html/latest/admin-guide/blockdev/zram.html)
devices.

 -- Variable: zram-device-service-type
     This service creates the zram block device, formats it as swap and
     enables it as a swap device.  The service’s value is a
     ‘zram-device-configuration’ record.

      -- Data Type: pagekite-configuration
          Управление конфигурацией операционной системы.

          ‘port’ (default: ‘22’)
               This is the amount of space you wish to provide for the
               zram device.  It accepts a string and can be a number of
               bytes or use a suffix, eg.: ‘"512M"’ or ‘1024000’.
          ‘compression-level’ (default: ‘3’)
               This is the compression algorithm you wish to use.  It is
               difficult to list all the possible compression options,
               but common ones supported by Guix’s Linux Libre Kernel
               include ‘'lzo’, ‘'lz4’ and ‘'zstd’.
          ‘port’ (default: ‘22’)
               This is the maximum amount of memory which the zram
               device can use.  Setting it to ’0’ disables the limit.
               While it is generally expected that compression will be
               2:1, it is possible that uncompressable data can be
               written to swap and this is a method to limit how much
               memory can be used.  It accepts a string and can be a
               number of bytes or use a suffix, eg.: ‘"2G"’.
          ‘priority’ (default ‘#f’)
               This is the priority of the swap device created from the
               zram device.  *Note Swap Space:: for a description of
               swap priorities.  You might want to set a specific
               priority for the zram device, otherwise it could end up
               not being used much for the reasons described there.


File: guix.ru.info,  Node: Сервисы Hurd,  Next: Разнообразные службы,  Prev: Службы Linux,  Up: Сервисы

11.10.37 Сервисы Hurd
---------------------

 -- Variable: hurd-console-service-type
     This service starts the fancy ‘VGA’ console client on the Hurd.

     The service’s value is a ‘hurd-console-configuration’ record.

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          Используемый пакет Hurd.

 -- Variable: hurd-getty-service-type
     This service starts a tty using the Hurd ‘getty’ program.

     The service’s value is a ‘hurd-getty-configuration’ record.

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          Используемый пакет Hurd.

     ‘tty’
          The name of the console this Getty runs on—e.g., ‘"tty1"’.

     ‘port’ (default: ‘22’)
          An integer specifying the baud rate of the tty.


File: guix.ru.info,  Node: Разнообразные службы,  Prev: Сервисы Hurd,  Up: Сервисы

11.10.38 Разнообразные службы
-----------------------------

Fingerprint Service
...................

The ‘(gnu services authentication)’ module provides a DBus service to
read and identify fingerprints via a fingerprint sensor.

 -- Variable: fprintd-service-type
     The service type for ‘fprintd’, which provides the fingerprint
     reading capability.

          (service fprintd-service-type)

System Control Service
......................

The ‘(gnu services sysctl)’ provides a service to configure kernel
parameters at boot.

 -- Variable: sysctl-service-type
     The service type for ‘sysctl’, which modifies kernel parameters
     under ‘/proc/sys/’.  To enable IPv4 forwarding, it can be
     instantiated as:

          (service sysctl-service-type
                   (sysctl-configuration
                     (settings '(("net.ipv4.ip_forward" . "1")))))

     Поскольку ‘sysctl-service-type’ используется в списках служб по
     умолчанию, ‘%base-services’ и ‘%desktop-services’, вы можете
     использовать ‘modify-services’, чтобы изменить его конфигурации и
     добить нужные параметры ядра (*note ‘modify-services’: Интерфейс
     сервиса.).

          (service postgresql-role-service-type
                      (postgresql-role-configuration
                       (roles
                        (list (postgresql-role
                               (name "test")
                               (create-database? #t))))))

 -- Data Type: sysctl-configuration
     The data type representing the configuration of ‘sysctl’.

     ‘sysctl’ (default: ‘(file-append procps "/sbin/sysctl"’)
          The ‘sysctl’ executable to use.

     ‘port’ (default: ‘22’)
          An association list specifies kernel parameters and their
          values.

 -- Variable: %default-sysctl-settings
     An association list specifying the default ‘sysctl’ parameters on
     Guix System.

PC/SC Smart Card Daemon Service
...............................

The ‘(gnu services security-token)’ module provides the following
service to run ‘pcscd’, the PC/SC Smart Card Daemon.  ‘pcscd’ is the
daemon program for pcsc-lite and the MuscleCard framework.  It is a
resource manager that coordinates communications with smart card
readers, smart cards and cryptographic tokens that are connected to the
system.

 -- Variable: pcscd-service-type
     Service type for the ‘pcscd’ service.  Its value must be a
     ‘pcscd-configuration’ object.  To run pcscd in the default
     configuration, instantiate it as:

          (service pcscd-service-type)

 -- Data Type: pcscd-configuration
     The data type representing the configuration of ‘pcscd’.

     ‘pcsc-lite’ (default: ‘pcsc-lite’)
          The pcsc-lite package that provides pcscd.
     ‘usb-drivers’ (default: ‘(list ccid)’)
          List of packages that provide USB drivers to pcscd.  Drivers
          are expected to be under ‘pcsc/drivers’ in the store directory
          of the package.

LIRC Service
............

The ‘(gnu services lirc)’ module provides the following service.

 -- Variable: lirc-service-type
     Type for a service that runs LIRC (http://www.lirc.org), a daemon
     that decodes infrared signals from remote controls.

     The value for this service is a ‘<lirc-configuration>’ object.

 -- Data Type: lirc-configuration
     Data type representing the configuration of ‘lircd’.

     ‘lirc’ (default: ‘lirc’) (type: file-like)
          Package object for ‘lirc’.

     ‘device’ (default: ‘#f’) (type: string)
     ‘driver’ (default: ‘#f’) (type: string)
     ‘config-file’ (default: ‘#f’) (type: string-or-file-like)
          TODO. See ‘lircd’ manual for details.

     ‘extra-options’ (default: ‘'()’) (type: list-of-string)
          Additional command-line options to pass to ‘lircd’.

SPICE Service
.............

The ‘(gnu services spice)’ module provides the following service.

 -- Variable: spice-vdagent-service-type
     Type of the service that runs VDAGENT
     (https://www.spice-space.org), a daemon that enables sharing the
     clipboard with a vm and setting the guest display resolution when
     the graphical console window resizes.

 -- Data Type: spice-vdagent-configuration
     Data type representing the configuration of
     ‘spice-vdagent-service-type’.

     ‘spice-vdagent’ (default: ‘spice-vdagent’) (type: file-like)
          Package object for VDAGENT.

inputattach Service
...................

The inputattach (https://linuxwacom.github.io/) service allows you to
use input devices such as Wacom tablets, touchscreens, or joysticks with
the Xorg display server.

 -- Variable: inputattach-service-type
     Type of a service that runs ‘inputattach’ on a device and
     dispatches events from it.

 -- Data Type: inputattach-configuration
     ‘device-type’ (default: ‘"wacom"’)
          The type of device to connect to.  Run ‘inputattach --help’,
          from the ‘inputattach’ package, to see the list of supported
          device types.

     ‘device’ (default: ‘"/dev/ttyS0"’)
          The device file to connect to the device.

     ‘baud-rate’ (default: ‘#f’)
          Baud rate to use for the serial connection.  Should be a
          number or ‘#f’.

     ‘log-file’ (default: ‘#f’)
          If true, this must be the name of a file to log messages to.

Создание служб
..............

The ‘(gnu services dict)’ module provides the following service:

 -- Variable: dicod-service-type
     This is the type of the service that runs the ‘dicod’ daemon, an
     implementation of DICT server (*note (dico)Dicod::).

     You can add ‘open localhost’ to your ‘~/.dico’ file to make
     ‘localhost’ the default server for ‘dico’ client (*note
     (dico)Initialization File::).

          Примечание: This service is also available for Guix Home,
          where it runs directly with your user privileges (*note
          ‘home-dicod-service-type’: Miscellaneous Home Services.).

 -- Data Type: dicod-configuration
     Data type representing the configuration of dicod.

     ‘dico’ (default: DICO)
          Package object of the GNU Dico dictionary server.

     ‘interfaces’ (default: ’("LOCALHOST"))
          This is the list of IP addresses and ports and possibly socket
          file names to listen to (*note ‘listen’ directive:
          (dico)Server Settings.).

     ‘handlers’ (default: ’())
          List of ‘<dicod-handler>’ objects denoting handlers (module
          instances).

     ‘databases’ (default: (LIST %DICOD-DATABASE:GCIDE))
          List of ‘<dicod-database>’ objects denoting dictionaries to be
          served.

 -- Data Type: dicod-handler
     Data type representing a dictionary handler (module instance).

     ‘name’
          Name of the handler (module instance).

     ‘module’ (default: #F)
          Name of the dicod module of the handler (instance).  If it is
          ‘#f’, the module has the same name as the handler.  (*note
          (dico)Modules::).

     ‘options’
          List of strings or gexps representing the arguments for the
          module handler

 -- Data Type: dicod-database
     Data type representing a dictionary database.

     ‘name’
          Name of the database, will be used in DICT commands.

     ‘handler’
          Name of the dicod handler (module instance) used by this
          database (*note (dico)Handlers::).

     ‘complex?’ (default: #F)
          Whether the database configuration complex.  The complex
          configuration will need a corresponding ‘<dicod-handler>’
          object, otherwise not.

     ‘options’
          List of strings or gexps representing the arguments for the
          database (*note (dico)Databases::).

 -- Variable: %dicod-database:gcide
     A ‘<dicod-database>’ object serving the GNU Collaborative
     International Dictionary of English using the ‘gcide’ package.

 -- Procedure: dicod-freedict-database dictionary-name
     Returns a record of type ‘dicod-database’ for purpose of
     configuring a database for the FreeDict multilingual dictionary
     named by DICTIONARY-NAME, a string such as ‘"kur-eng"’ for the
     Kurdish-to-English dictionary, into a service of type
     ‘dicod-service-type’.

 -- Variable: %dicod-databases:freedict
     A relatively large list of records of type ‘dicod-database’, made
     available for users who wish to configure all the FreeDict
     multilingual dictionaries provided by the ‘freedict-dictionaries’
     package into a service of type ‘dicod-service-type’.

   The following is an example ‘dicod-service-type’ configuration,
extending a ‘dicod’ daemon serving databases for the wordnet and gcide
dictionaries, as well as a selection of FreeDict multilingual
dictionaries.

     (service dicod-service-type
              (dicod-configuration
               (handlers (list
                          (dicod-handler
                           (name "wordnet")
                           (module "wordnet")
                           (options
                            (list #~(string-append "wnhome=" #$wordnet))))))
               (databases (cons*
                           (dicod-database
                            (name "wordnet")
                            (complex? #t)
                            (handler "wordnet"))
                           %dicod-database:gcide
                           (map
                            dicod-freedict-database
                            '("fra-eng" "eng-fra" "eng-spa" "spa-eng"))))))

Docker Service
..............

Модуль ‘(gnu services docker)’ предоставляет следующие сервисы.

 -- Variable: containerd-service-type

     This service type operates containerd containerd
     (https://containerd.io), a daemon responsible for overseeing the
     entire container lifecycle on its host system.  This includes image
     handling, storage management, container execution, supervision,
     low-level storage operations, network connections, and more.

 -- Data Type: containerd-configuration
     This is the data type representing the configuration of containerd.

     ‘containerd’ (default: ‘containerd’)
          The containerd daemon package to use.

     ‘features’ (default: ‘'()’)
          Как включить или отключить подстановки.

     ‘environment-variables’ (default: ‘'()’)
          List of environment variables to set for ‘containerd’.

          This must be a list of strings where each string has the form
          ‘KEY=VALUE’ as in this example:

               (list "HTTP_PROXY=socks5://127.0.0.1:9150"
                     "HTTPS_PROXY=socks5://127.0.0.1:9150")

 -- Variable: docker-service-type

     This is the type of the service that runs Docker
     (https://www.docker.com), a daemon that can execute application
     bundles (sometimes referred to as “containers”) in isolated
     environments.

     The ‘containerd-service-type’ service need to be added to a system
     configuration, otherwise a message about not any service provides
     ‘containerd’ will be displayed during ‘guix system reconfigure’.

 -- Data Type: docker-configuration
     This is the data type representing the configuration of Docker and
     Containerd.

     ‘docker’ (default: ‘docker’)
          Используемый пакет Docker демона.

     ‘docker-cli’ (default: ‘docker-cli’)
          Используемый Docker клиент.

     ‘containerd’ (default: CONTAINERD)
          This field is deprecated in favor of ‘containerd-service-type’
          service.

     ‘port’ (default: ‘22’)
          Используемый пользователей сетевой прокси-пакет Docker.

     ‘speed’ (default: ‘1.0’)
          Enable or disable the use of the Docker user-land networking
          proxy.

     ‘features’ (default: ‘'()’)
          Как включить или отключить подстановки.

     ‘speed’ (default: ‘1.0’)
          Enable or disable the addition of iptables rules.

     ‘environment-variables’ (default: ‘'()’)
          List of environment variables to set for ‘dockerd’.

          This must be a list of strings where each string has the form
          ‘KEY=VALUE’ as in this example:

               (list "LANGUAGE=eo:ca:eu"
                     "TMPDIR=/tmp/dockerd")

     ‘config-file’ (type: maybe-file-like)
          JSON configuration file pass to ‘dockerd’.

 -- Variable: singularity-service-type
     This is the type of the service that allows you to run Singularity
     (https://www.sylabs.io/singularity/), a Docker-style tool to create
     and run application bundles (aka.  “containers”).  The value for
     this service is the Singularity package to use.

     The service does not install a daemon; instead, it installs helper
     programs as setuid-root (*note Privileged Programs::) such that
     unprivileged users can invoke ‘singularity run’ and similar
     commands.

Rootless Podman Service
.......................

The ‘(gnu services containers)’ module provides the following service.

 -- Variable: rootless-podman-service-type
     This is the service type for Podman (https://podman.io) is a
     container management tool.

     In addition to providing a drop-in replacement for Docker, Podman
     offers the ability to run containers in “root-less” mode, meaning
     that regular users can deploy containers without elevated
     privileges.  It does so mainly by leveraging two Linux kernel
     features: unprivileged user namespaces, and subordinate user and
     group IDs (*note the subordinate user and group ID service:
     subordinate-user-group-ids.).

     The ‘rootless-podman-service-type’ sets up the system to allow
     unprivileged users to run ‘podman’ commands:

          (use-service-modules containers dbus desktop networking ...)
          (use-modules (gnu system accounts))  ;for 'subid-range'

          (operating-system
            ;; ...
            (users (cons (user-account
                          (name "alice")
                          (comment "Bob's sister")
                          (group "users")

                          ;; Adding the account to the "cgroup" group
                          ;; makes it possible to run podman commands.
                          (supplementary-groups '("cgroup" "wheel"
                                                  "audio" "video")))
                         %base-user-accounts))
            (services
              (cons* (service dbus-root-service-type)
                     (service dhcpcd-service-type)
                     (service elogind-service-type)
                     (service iptables-service-type)
                     (service rootless-podman-service-type
                              (rootless-podman-configuration
                                (subgids
                                 (list (subid-range (name "alice"))))
                                (subuids
                                 (list (subid-range (name "alice"))))))
                     %base-services)))

     The ‘iptables-service-type’ is required for Podman to be able to
     setup its own networks.  Due to the change in user groups and file
     systems it is recommended to reboot (or at least logout), before
     trying to run Podman commands.

     To test your installation you can run:

          $ podman run -it --rm docker.io/alpine cat /etc/*release*
          NAME="Alpine Linux"
          ID=alpine
          VERSION_ID=3.20.2
          PRETTY_NAME="Alpine Linux v3.20"
          HOME_URL="https://alpinelinux.org/"
          BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"

 -- Data Type: rootless-podman-configuration
     Available ‘rootless-podman-configuration’ fields are:

     ‘podman’ (default: ‘podman’) (type: package-or-#f)
          The Podman package that will be installed in the system
          profile.  Pass ‘#f’ to not install Podman.

     ‘group-name’ (default: ‘"cgroup"’) (type: string)
          The name of the group that will own /sys/fs/cgroup resources.
          Users that want to use rootless Podman have to be in this
          group.

     ‘containers-registries’ (type: lowerable)
          A string or a gexp evaluating to the path of Podman’s
          ‘containers/registries.conf’ configuration file.

     ‘containers-storage’ (type: lowerable)
          A string or a gexp evaluating to the path of Podman’s
          ‘containers/storage.conf’ configuration file.

     ‘containers-policy’ (type: lowerable)
          A string or a gexp evaluating to the path of Podman’s
          ‘containers/policy.json’ configuration file.

     ‘pam-limits’ (type: list-of-pam-limits-entries)
          The PAM limits to be set for rootless Podman.

     ‘subgids’ (default: ‘()’) (type: list-of-subid-ranges)
          A list of subid ranges representing the subgids that will be
          available for each configured user.

     ‘subuids’ (default: ‘()’) (type: list-of-subid-ranges)
          A list of subid ranges representing the subuids that will be
          available for each configured user.

OCI backed services
...................

Should you wish to manage your Open Container Initiative (OCI)
containers with the same consistent interface you use for your other
Shepherd services, OCI-SERVICE-TYPE is the tool to use: given an OCI
container image, it will run it in a Shepherd service.  One example
where this is useful: it lets you run services that are available as OCI
images but not yet packaged for Guix.

 -- Variable: oci-service-type

     This is a thin wrapper around Docker’s or Podman’s CLI that
     executes OCI images backed processes as Shepherd Services.

          (simple-service 'oci-provisioning
                          oci-service-type
                          (oci-extension
                            (networks
                              (list
                                (oci-network-configuration (name "monitoring"))))
                            (containers
                             (list
                              (oci-container-configuration
                               (network "monitoring")
                               (image
                                (oci-image
                                  (repository "guile")
                                  (tag "3")
                                  (value (specifications->manifest '("guile")))
                                  (pack-options '(#:symlinks (("/bin/guile" -> "bin/guile"))
                                                  #:max-layers 2))))
                               (entrypoint "/bin/guile")
                               (command
                                '("-c" "(display \"hello!\n\")")))
                              (oci-container-configuration
                                (image "prom/prometheus")
                                (network "host")
                                (ports
                                 '(("9000" . "9000")
                                   ("9090" . "9090"))))
                              (oci-container-configuration
                                (image "grafana/grafana:10.0.1")
                                (network "host")
                                (volumes
                                 '("/var/lib/grafana:/var/lib/grafana")))))))

     In this example three different Shepherd services are going to be
     added to the system.  Each ‘oci-container-configuration’ record
     translates to a ‘docker run’ or ‘podman run’ invocation and its
     fields directly map to options.  You can refer to the Docker
     (https://docs.docker.com/engine/reference/commandline/run) or
     Podman
     (https://docs.podman.io/en/stable/markdown/podman-run.1.html)
     upstream documentation for semantics of each value.  If the images
     are not found, they will be pulled.  You can refer to the Docker
     (https://docs.docker.com/engine/reference/commandline/pull/) or
     Podman
     (https://docs.podman.io/en/stable/markdown/podman-pull.1.html)
     upstream documentation for semantics.  The services with ‘(network
     "host")’ are going to be attached to the host network and are
     supposed to behave like native processes with regard to networking.

 -- Data Type: oci-configuration
     Available ‘oci-configuration’ fields are:

     ‘runtime’ (default: ‘'docker’) (type: symbol)
          The OCI runtime to use to run commands.  It can be either
          ‘'docker’ or ‘'podman’.

     ‘runtime-cli’ (type: maybe-package-or-string)
          The OCI runtime command line to be installed in the system
          profile and used to provision OCI resources, it can be either
          a package or a string representing an absolute file name to
          the runtime binary entrypoint.  When unset it will default to
          ‘docker-cli’ package for the ‘'docker’ runtime or to ‘podman’
          package for the ‘'podman’ runtime.

     ‘runtime-extra-arguments’ (default: ‘'()’) (type: list)
          A list of strings, gexps or file-like objects that will be
          placed after each ‘docker’ or ‘podman’ invokation.

     ‘user’ (type: maybe-string)
          The user name under whose authority OCI commands will be run.
          This field will override the ‘user’ field of
          ‘oci-configuration’.

     ‘group’ (type: maybe-string)
          The group name under whose authority OCI commands will be run.
          When using the ‘'podman’ OCI runtime, this field will be
          ignored and the default group of the user configured in the
          ‘user’ field will be used.  This field will override the
          ‘group’ field of ‘oci-configuration’.

     ‘subuids-range’ (type: maybe-subid-range)
          An optional ‘subid-range’ record allocating subuids for the
          user from the ‘user’ field.  When unset, with the rootless
          Podman OCI runtime, it defaults to ‘(subid-range (name
          "oci-container"))’.

     ‘subgids-range’ (type: maybe-subid-range)
          An optional ‘subid-range’ record allocating subgids for the
          user from the ‘user’ field.  When unset, with the rootless
          Podman OCI runtime, it defaults to ‘(subid-range (name
          "oci-container"))’.

     ‘containers’ (default: ‘'()’) (type: list-of-oci-containers)
          The list of ‘oci-container-configuration’ records representing
          the containers to provision.  The use of the ‘oci-extension’
          record should be preferred for most cases.

     ‘networks’ (default: ‘'()’) (type: list-of-oci-networks)
          The list of ‘oci-network-configuration’ records representing
          the containers to provision.  The use of the ‘oci-extension’
          record should be preferred for most cases.

     ‘volumes’ (default: ‘'()’) (type: list-of-oci-volumes)
          The list of ‘oci-volumes-configuration’ records representing
          the containers to provision.  The use of the ‘oci-extension’
          record should be preferred for most cases.

     ‘verbose?’ (default: ‘#f’) (type: boolean)
          When true, additional output will be printed, allowing to
          better follow the flow of execution.

 -- Data Type: oci-extension
     Available ‘oci-extension’ fields are:

     ‘containers’ (default: ‘'()’) (type: list-of-oci-containers)
          The list of ‘oci-container-configuration’ records representing
          the containers to provision.

     ‘networks’ (default: ‘'()’) (type: list-of-oci-networks)
          The list of ‘oci-network-configuration’ records representing
          the containers to provision.

     ‘volumes’ (default: ‘'()’) (type: list-of-oci-volumes)
          The list of ‘oci-volumes-configuration’ records representing
          the containers to provision.

 -- Data Type: oci-container-configuration
     Available ‘oci-container-configuration’ fields are:

     ‘user’ (default: ‘"oci-container"’) (type: string)
          The user under whose authority docker commands will be run.

     ‘group’ (default: ‘"docker"’) (type: string)
          The group under whose authority docker commands will be run.

     ‘command’ (default: ‘'()’) (type: list-of-strings)
          Overwrite the default command (‘CMD’) of the image.

     ‘entrypoint’ (default: ‘""’) (type: string)
          Overwrite the default entrypoint (‘ENTRYPOINT’) of the image.

     ‘host-environment’ (default: ‘'()’) (type: list)
          Set environment variables in the host environment where
          ‘docker run’ or ‘podman run’ are invoked.  This is especially
          useful to pass secrets from the host to the container without
          having them on the OCI runtime command line, for example: by
          setting the ‘MYSQL_PASSWORD’ on the host and by passing ‘--env
          MYSQL_PASSWORD’ through the ‘extra-arguments’ field, it is
          possible to securely set values in the container environment.
          This field’s value can be a list of pairs or strings, even
          mixed:

               (list '("LANGUAGE" . "eo:ca:eu")
                     "JAVA_HOME=/opt/java")

          Pair members can be strings, gexps or file-like objects.
          Strings are passed directly to ‘make-forkexec-constructor’.

     ‘environment’ (default: ‘'()’) (type: list)
          Set environment variables inside the container.  This can be a
          list of pairs or strings, even mixed:

               (list '("LANGUAGE" . "eo:ca:eu")
                     "JAVA_HOME=/opt/java")

          Pair members can be strings, gexps or file-like objects.
          Strings are passed directly to the OCI runtime CLI. You can
          refer to the Docker
          (https://docs.docker.com/engine/reference/commandline/run/#env)
          or Podman
          (https://docs.podman.io/en/stable/markdown/podman-run.1.html#env-e-env)
          upstream documentation for semantics.

     ‘image’ (type: string-or-oci-image)
          The image used to build the container.  It can be a string or
          an ‘oci-image’ record.  Strings are resolved by the OCI
          runtime, and follow the usual format
          ‘myregistry.local:5000/testing/test-image:tag’.

     ‘provision’ (default: ‘""’) (type: string)
          Set the name of the provisioned Shepherd service.

     ‘requirement’ (default: ‘'()’) (type: list-of-symbols)
          Set additional Shepherd services dependencies to the
          provisioned Shepherd service.

     ‘log-file’ (type: maybe-string)
          When ‘log-file’ is set, it names the file to which the
          service’s standard output and standard error are redirected.
          ‘log-file’ is created if it does not exist, otherwise it is
          appended to.

     ‘auto-start?’ (default: ‘#t’) (type: boolean)
          Whether this service should be started automatically by the
          Shepherd.  If it is ‘#f’, the service has to be started
          manually with ‘herd start’.

     ‘respawn?’ (default: ‘#f’) (type: boolean)
          Whether to have Shepherd restart the service when it stops,
          for instance when the underlying process dies.

     ‘shepherd-actions’ (default: ‘'()’) (type: list-of-shepherd-actions)
          This is a list of ‘shepherd-action’ records defining actions
          supported by the service.

     ‘network’ (default: ‘""’) (type: string)
          Set an OCI network for the spawned container.

     ‘ports’ (default: ‘'()’) (type: list)
          Set the port or port ranges to expose from the spawned
          container.  This can be a list of pairs or strings, even
          mixed:

               (list '("8080" . "80")
                     "10443:443")

          Pair members can be strings, gexps or file-like objects.
          Strings are passed directly to the OCI runtime CLI. You can
          refer to the Docker
          (https://docs.docker.com/engine/reference/commandline/run/#publish)
          or Podman
          (https://docs.podman.io/en/stable/markdown/podman-run.1.html#publish-p-ip-hostport-containerport-protocol)
          upstream documentation for semantics.

     ‘volumes’ (default: ‘'()’) (type: list)
          Set volume mappings for the spawned container.  This can be a
          list of pairs or strings, even mixed:

               (list '("/root/data/grafana" . "/var/lib/grafana")
                     "/gnu/store:/gnu/store")

          Pair members can be strings, gexps or file-like objects.
          Strings are passed directly to the OCI runtime CLI. You can
          refer to the Docker
          (https://docs.docker.com/engine/reference/commandline/run/#volume)
          or Podman
          (https://docs.podman.io/en/stable/markdown/podman-run.1.html#volume-v-source-volume-host-dir-container-dir-options)
          upstream documentation for semantics.

     ‘container-user’ (default: ‘""’) (type: string)
          Set the current user inside the spawned container.  You can
          refer to the Docker
          (https://docs.docker.com/engine/reference/run/#user) or Podman
          (https://docs.podman.io/en/stable/markdown/podman-run.1.html#user-u-user-group)
          upstream documentation for semantics.

     ‘workdir’ (default: ‘""’) (type: string)
          Set the current working directory for the spawned Shepherd
          service.  You can refer to the Docker
          (https://docs.docker.com/engine/reference/run/#workdir) or
          Podman
          (https://docs.podman.io/en/stable/markdown/podman-run.1.html#workdir-w-dir)
          upstream documentation for semantics.

     ‘extra-arguments’ (default: ‘'()’) (type: list)
          A list of strings, gexps or file-like objects that will be
          directly passed to the ‘docker run’ or ‘podman run’
          invokation.

 -- Data Type: oci-network-configuration
     Available ‘oci-network-configuration’ fields are:

     ‘name’ (type: string)
          The name of the OCI network to provision.

     ‘driver’ (type: maybe-string)
          The driver to manage the network.

     ‘gateway’ (type: maybe-string)
          IPv4 or IPv6 gateway for the subnet.

     ‘internal?’ (default: ‘#f’) (type: boolean)
          Restrict external access to the network

     ‘ip-range’ (type: maybe-string)
          Allocate container ip from a sub-range in CIDR format.

     ‘ipam-driver’ (type: maybe-string)
          IP Address Management Driver.

     ‘ipv6?’ (default: ‘#f’) (type: boolean)
          Enable IPv6 networking.

     ‘subnet’ (type: maybe-string)
          Subnet in CIDR format that represents a network segment.

     ‘labels’ (default: ‘'()’) (type: list)
          The list of labels that will be used to tag the current
          volume.

     ‘extra-arguments’ (default: ‘'()’) (type: list)
          A list of strings, gexps or file-like objects that will be
          directly passed to the ‘docker network create’ or ‘podman
          network create’ invokation.

 -- Data Type: oci-volume-configuration
     Available ‘oci-volume-configuration’ fields are:

     ‘name’ (type: string)
          The name of the OCI volume to provision.

     ‘labels’ (default: ‘'()’) (type: list)
          The list of labels that will be used to tag the current
          volume.

     ‘extra-arguments’ (default: ‘'()’) (type: list)
          A list of strings, gexps or file-like objects that will be
          directly passed to the ‘docker volume create’ or ‘podman
          volume create’ invokation.

 -- Data Type: oci-image
     Available ‘oci-image’ fields are:

     ‘repository’ (type: string)
          A string like ‘myregistry.local:5000/testing/test-image’ that
          names the OCI image.

     ‘tag’ (default: ‘"latest"’) (type: string)
          A string representing the OCI image tag.  Defaults to
          ‘latest’.

     ‘value’ (type: oci-lowerable-image)
          A ‘manifest’ or ‘operating-system’ record that will be lowered
          into an OCI compatible tarball.  Otherwise this field’s value
          can be a file-like object that evaluates to an OCI compatible
          tarball.

     ‘pack-options’ (default: ‘'()’) (type: list)
          An optional set of keyword arguments that will be passed to
          the ‘docker-image’ procedure from ‘guix scripts pack’.  They
          can be used to replicate ‘guix pack’ behavior:

               (oci-image
                 (repository "guile")
                 (tag "3")
                 (value
                   (specifications->manifest '("guile")))
                 (pack-options '(#:symlinks (("/bin/guile" -> "bin/guile"))
                                 #:max-layers 2)))

          If the ‘value’ field is an ‘operating-system’ record, this
          field’s value will be ignored.

     ‘system’ (default: ‘""’) (type: string)
          Attempt to build for a given system, e.g. "i686-linux"

     ‘target’ (default: ‘""’) (type: string)
          Attempt to cross-build for a given triple, e.g.
          "aarch64-linux-gnu"

     ‘grafts?’ (default: ‘#f’) (type: boolean)
          Whether to allow grafting or not in the pack build.

Subordinate User and Group ID Service
.....................................

Among the virtualization facilities implemented by the Linux kernel is
the concept of “subordinate IDs”.  Subordinate IDs allow for mapping
user and group IDs inside process namespaces to user and group IDs of
the host system.  Subordinate user ID ranges (subuids) allow users to
map virtual user IDs inside containers to the user ID of an unprivileged
user of the host system.  Subordinate group ID ranges (subgids), instead
map virtual group IDs to the group ID of an unprivileged user on the
host system.  You can access ‘subuid(5)’ and ‘subgid(5)’ Linux man pages
for more details.

   The ‘(gnu system shadow)’ module exposes the ‘subids-service-type’,
its configuration record ‘subids-configuration’ and its extension record
‘subids-extension’.

   With ‘subids-service-type’, subuids and subgids ranges can be
reserved for users that desire so:

     (use-modules (gnu system shadow)     ;for 'subids-service-type'
                  (gnu system accounts)   ;for 'subid-range'
                  ...)

     (operating-system
       ;; ...
       (services
         (list
           (simple-service 'alice-bob-subids
                           subids-service-type
                           (subids-extension
                             (subgids
                              (list
                               (subid-range (name "alice"))))
                             (subuids
                              (list
                               (subid-range (name "alice"))
                               (subid-range (name "bob")
                                            (start 100700)))))))))

   Users (definitely other services), usually, are supposed to extend
the service instead of adding subids directly to ‘subids-configuration’,
unless the want to change the default behavior for root.  With default
settings the ‘subids-service-type’ adds, if it’s not already there, a
configuration for the root account to both ‘/etc/subuid’ and
‘/etc/subgid’, possibly starting at the minimum possible subid.
Otherwise the root subuids and subgids ranges are fitted wherever
possible.

   The above configuration will yield the following:

     # cat /etc/subgid
     root:100000:65536
     alice:165536:65536
     # cat /etc/subuid
     root:100000:700
     bob:100700:65536
     alice:166236:65536

 -- Data Type: subids-configuration

     With default settings the ‘subids-service-type’ adds, if it’s not
     already there, a configuration for the root account to both
     ‘/etc/subuid’ and ‘/etc/subgid’, possibly starting at the minimum
     possible subid.  To disable the default behavior and provide your
     own definition for the root subid ranges you can set to ‘#f’ the
     ‘add-root?’ field:

          (use-modules (gnu system shadow)     ;for 'subids-service-type'
                       (gnu system accounts)   ;for 'subid-range'
                       ...)

          (operating-system
            ;; ...
            (services
              (list
                (service subids-service-type
                         (subids-configuration
                          (add-root? #f)
                          (subgids
                            (subid-range (name "root")
                                         (start 120000)
                                         (count 100)))
                          (subuids
                            (subid-range (name "root")
                                         (start 120000)
                                         (count 100)))))
                (simple-service 'alice-bob-subids
                                subids-service-type
                                (subids-extension
                                  (subgids
                                   (list
                                    (subid-range (name "alice"))))
                                  (subuids
                                   (list
                                    (subid-range (name "alice"))
                                    (subid-range (name "bob")
                                                 (start 100700)))))))))

     Available ‘subids-configuration’ fields are:

     ‘add-root?’ (default: ‘#t’) (type: boolean)
          Whether to automatically configure subuids and subgids for
          root.

     ‘subgids’ (default: ‘'()’) (type: list-of-subid-ranges)
          The list of ‘subid-range’s that will be serialized to
          ‘/etc/subgid’.  If a range doesn’t specify a start it will be
          fitted based on its number of requested subids.  If a range
          doesn’t specify a count the default size of 65536 will be
          assumed.

     ‘subuids’ (default: ‘'()’) (type: list-of-subid-ranges)
          The list of ‘subid-range’s that will be serialized to
          ‘/etc/subuid’.  If a range doesn’t specify a start it will be
          fitted based on its number of requested subids.  If a range
          doesn’t specify a count the default size of 65536 will be
          assumed.

 -- Data Type: subids-extension

     Available ‘subids-extension’ fields are:

     ‘subgids’ (default: ‘'()’) (type: list-of-subid-ranges)
          The list of ‘subid-range’s that will be appended to
          ‘subids-configuration-subgids’.  Entries with the same name
          are deduplicated upon merging.

     ‘subuids’ (default: ‘'()’) (type: list-of-subid-ranges)
          The list of ‘subid-range’s that will be appended to
          ‘subids-configuration-subuids’.  Entries with the same name
          are deduplicated upon merging.

 -- Data Type: subid-range

     The ‘subid-range’ record is defined at ‘(gnu system accounts)’.
     Available fields are:

     ‘name’ (type: string)
          The name of the user or group that will own this range.

     ‘start’ (default: ‘#f’) (type: integer)
          The first requested subid.  When false the first available
          subid with enough contiguous subids will be assigned.

     ‘count’ (default: ‘#f’) (type: integer)
          The number of total allocated subids.  When #f the default of
          65536 will be assumed .

Сервисы аудио
.............

Модуль ‘(gnu services auditd)’ предоставляет следующие сервисы.

 -- Variable: auditd-service-type

     This is the type of the service that runs auditd
     (https://people.redhat.com/sgrubb/audit/), a daemon that tracks
     security-relevant information on your system.

     Examples of things that can be tracked:

       1. Файловые системы
       2. Установка системы
       3. Вызов ‘guix gc’
       4. Failed login attempts
       5. Firewall filtering
       6. Сервисы сети

     ‘auditctl’ from the ‘audit’ package can be used in order to add or
     remove events to be tracked (until the next reboot).  In order to
     permanently track events, put the command line arguments of
     auditctl into a file called ‘audit.rules’ in the configuration
     directory (see below).  ‘aureport’ from the ‘audit’ package can be
     used in order to view a report of all recorded events.  The audit
     daemon by default logs into the file ‘/var/log/audit.log’.

 -- Тип данных: build-machine
     This is the data type representing the configuration of auditd.

     ‘port’ (default: ‘22’)
          Пакет аудита для использования.

     ‘features’ (default: ‘'()’)
          The directory containing the configuration file for the audit
          package, which must be named ‘auditd.conf’, and optionally
          some audit rules to instantiate on startup.

Сервисы DNS
...........

Модуль ‘(gnu services science)’ предоставляет следующие сервис.

 -- Variable: rshiny-service-type

     This is a type of service which is used to run a webapp created
     with ‘r-shiny’.  This service sets the ‘R_LIBS_USER’ environment
     variable and runs the provided script to call ‘runApp’.

      -- Конфигурирование: системы
          Управление конфигурацией операционной системы.

          ‘speed’ (default: ‘1.0’)
               Пакет для использования.

          ‘binary’ (default ‘"rshiny"’)
               The name of the binary or shell script located at
               ‘package/bin/’ to run when the service is run.

               The common way to create this file is as follows:

                    ...
                    (let* ((out       (assoc-ref %outputs "out"))
                           (targetdir (string-append out "/share/" ,name))
                           (app       (string-append out "/bin/" ,name))
                           (Rbin      (search-input-file %build-inputs "/bin/Rscript")))
                      ;; ...
                      (mkdir-p (string-append out "/bin"))
                      (call-with-output-file app
                        (lambda (port)
                          (format port
                    "#!~a
                    library(shiny)
                    setwd(\"~a\")
                    runApp(launch.browser=0, port=4202)~%\n"
                          Rbin targetdir))))

Сервисы DNS
...........

Модуль ‘(gnu services nix)’ предоставляет следующий сервис.

 -- Variable: nix-service-type

     This is the type of the service that runs build daemon of the Nix
     (https://nixos.org/nix/) package manager.  Here is an example
     showing how to use it:

          (use-modules (gnu))
          (use-service-modules nix)
          (use-package-modules package-management)

          (operating-system
            ;; ...
            (packages (append (list nix)
                              %base-packages))

            (services (append (list (service nix-service-type))
                              %base-services)))

     After ‘guix system reconfigure’ configure Nix for your user:

        • Add a Nix channel and update it.  See Nix channels
          (https://wiki.nixos.org/wiki/Nix_channels) for more
          information about the available channels.  If you would like
          to use the unstable Nix channel you can do this by running:

               $ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
               $ nix-channel --update

        • Create your Nix profile directory:

               $ sudo mkdir -p /nix/var/nix/profiles/per-user/$USER
               $ sudo chown $USER:root /nix/var/nix/profiles/per-user/$USER

        • Create a symlink to your profile and activate Nix profile:

               $ ln -s "/nix/var/nix/profiles/per-user/$USER/profile" ~/.nix-profile
               $ source /run/current-system/profile/etc/profile.d/nix.sh

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘speed’ (default: ‘1.0’)
          Используемый пакет Nix.

     ‘port’ (default: ‘22’)
          Specifies whether builds are sandboxed by default.

     ‘build-directory’ (default: ‘"/tmp"’)
          The directory where build directory are stored during builds.
          This is useful to change if, for example, the default location
          does not have enough space to hold build trees for big
          packages.

          This is similar to setting the ‘TMPDIR’ environment variable
          for ‘guix-daemon’.  *note ‘TMPDIR’: Установка окружения
          сборки, for more info.

     ‘inputs’ (default: ‘'()’)
          This is a list of strings or objects appended to the
          ‘build-sandbox-items’ field of the configuration file.

     ‘extra-config’ (default: ‘'()’)
          This is a list of strings or objects appended to the
          configuration file.  It is used to pass extra text to be added
          verbatim to the configuration file.

     ‘extra-options’ (default: ‘'()’)
          Дополнительные параметры командной строки для
          ‘nix-service-type’.

Fail2Ban service
................

‘fail2ban’ (http://www.fail2ban.org/) scans log files (e.g.
‘/var/log/apache/error_log’) and bans IP addresses that show malicious
signs – repeated password failures, attempts to make use of exploits,
etc.

   ‘fail2ban-service-type’ service type is provided by the ‘(gnu
services security)’ module.

   This service type runs the ‘fail2ban’ daemon.  It can be configured
in various ways, which are:

Basic configuration
     The basic parameters of the Fail2Ban service can be configured via
     its ‘fail2ban’ configuration, which is documented below.

User-specified jail extensions
     The ‘fail2ban-jail-service’ function can be used to add new
     Fail2Ban jails.

Shepherd extension mechanism
     Service developers can extend the ‘fail2ban-service-type’ service
     type itself via the usual service extension mechanism.

 -- Variable: fail2ban-service-type

     This is the type of the service that runs ‘fail2ban’ daemon.  Below
     is an example of a basic, explicit configuration:

          (append
           (list
            (service fail2ban-service-type
                     (fail2ban-configuration
                      (extra-jails
                       (list
                        (fail2ban-jail-configuration
                         (name "sshd")
                         (enabled? #t))))))
            ;; There is no implicit dependency on an actual SSH
            ;; service, so you need to provide one.
            (service openssh-service-type))
           %base-services)

 -- Procedure: fail2ban-jail-service svc-type jail
     Extend SVC-TYPE, a ‘<service-type>’ object with JAIL, a
     ‘fail2ban-jail-configuration’ object.

     Например:

          (append
           (list
            (service
             ;; The 'fail2ban-jail-service' procedure can extend any service type
             ;; with a fail2ban jail.  This removes the requirement to explicitly
             ;; extend services with fail2ban-service-type.
             (fail2ban-jail-service
              openssh-service-type
              (fail2ban-jail-configuration
               (name "sshd")
               (enabled? #t)))
             (openssh-configuration ...))))

   Below is the reference for the different ‘jail-service-type’
configuration records.

 -- Data Type: fail2ban-configuration
     Available ‘fail2ban-configuration’ fields are:

     ‘fail2ban’ (default: ‘fail2ban’) (type: package)
          The ‘fail2ban’ package to use.  It is used for both binaries
          and as base default configuration that is to be extended with
          ‘<fail2ban-jail-configuration>’ objects.

     ‘run-directory’ (default: ‘"/var/run/fail2ban"’) (type: string)
          The state directory for the ‘fail2ban’ daemon.

     ‘jails’ (default: ‘'()’) (type: list-of-fail2ban-jail-configurations)
          Instances of ‘<fail2ban-jail-configuration>’ collected from
          extensions.

     ‘extra-jails’ (default: ‘'()’) (type: list-of-fail2ban-jail-configurations)
          Instances of ‘<fail2ban-jail-configuration>’ explicitly
          provided.

     ‘extra-content’ (default: ‘'()’) (type: text-config)
          Extra raw content to add to the end of the ‘jail.local’ file,
          provided as a list of file-like objects.

 -- Data Type: fail2ban-ignore-cache-configuration
     Available ‘fail2ban-ignore-cache-configuration’ fields are:

     ‘key’ (type: string)
          Cache key.

     ‘max-count’ (type: integer)
          Cache size.

     ‘max-time’ (type: integer)
          Cache time.

 -- Data Type: fail2ban-jail-action-configuration
     Available ‘fail2ban-jail-action-configuration’ fields are:

     ‘name’ (type: string)
          Action name.

     ‘arguments’ (default: ‘'()’) (type: list-of-arguments)
          Action arguments.

 -- Data Type: fail2ban-jail-configuration
     Available ‘fail2ban-jail-configuration’ fields are:

     ‘name’ (type: string)
          Required name of this jail configuration.

     ‘enabled?’ (default: ‘#t’) (type: boolean)
          Whether this jail is enabled.

     ‘backend’ (type: maybe-symbol)
          Backend to use to detect changes in the ‘log-path’.  The
          default is ’auto.  To consult the defaults of the jail
          configuration, refer to the ‘/etc/fail2ban/jail.conf’ file of
          the ‘fail2ban’ package.

     ‘max-retry’ (type: maybe-integer)
          The number of failures before a host gets banned (e.g.
          ‘(max-retry 5)’).

     ‘max-matches’ (type: maybe-integer)
          The number of matches stored in ticket (resolvable via tag
          ‘<matches>’) in action.

     ‘find-time’ (type: maybe-string)
          The time window during which the maximum retry count must be
          reached for an IP address to be banned.  A host is banned if
          it has generated ‘max-retry’ during the last ‘find-time’
          seconds (e.g.  ‘(find-time "10m")’).  It can be provided in
          seconds or using Fail2Ban’s "time abbreviation format", as
          described in ‘man 5 jail.conf’.

     ‘ban-time’ (type: maybe-string)
          The duration, in seconds or time abbreviated format, that a
          ban should last.  (e.g.  ‘(ban-time "10m")’).

     ‘ban-time-increment?’ (type: maybe-boolean)
          Whether to consider past bans to compute increases to the
          default ban time of a specific IP address.

     ‘ban-time-factor’ (type: maybe-string)
          The coefficient to use to compute an exponentially growing ban
          time.

     ‘ban-time-formula’ (type: maybe-string)
          This is the formula used to calculate the next value of a ban
          time.

     ‘ban-time-multipliers’ (type: maybe-string)
          Used to calculate next value of ban time instead of formula.

     ‘ban-time-max-time’ (type: maybe-string)
          The maximum number of seconds a ban should last.

     ‘ban-time-rnd-time’ (type: maybe-string)
          The maximum number of seconds a randomized ban time should
          last.  This can be useful to stop “clever” botnets calculating
          the exact time an IP address can be unbanned again.

     ‘ban-time-overall-jails?’ (type: maybe-boolean)
          When true, it specifies the search of an IP address in the
          database should be made across all jails.  Otherwise, only the
          current jail of the ban IP address is considered.

     ‘ignore-self?’ (type: maybe-boolean)
          Never ban the local machine’s own IP address.

     ‘ignore-ip’ (default: ‘'()’) (type: list-of-strings)
          A list of IP addresses, CIDR masks or DNS hosts to ignore.
          ‘fail2ban’ will not ban a host which matches an address in
          this list.

     ‘ignore-cache’ (type: maybe-fail2ban-ignore-cache-configuration)
          Provide cache parameters for the ignore failure check.

     ‘filter’ (type: maybe-fail2ban-jail-filter-configuration)
          The filter to use by the jail, specified via a
          ‘<fail2ban-jail-filter-configuration>’ object.  By default,
          jails have names matching their filter name.

     ‘log-time-zone’ (type: maybe-string)
          The default time zone for log lines that do not have one.

     ‘log-encoding’ (type: maybe-symbol)
          The encoding of the log files handled by the jail.  Possible
          values are: ‘'ascii’, ‘'utf-8’ and ‘'auto’.

     ‘log-path’ (default: ‘'()’) (type: list-of-strings)
          The file names of the log files to be monitored.

     ‘action’ (default: ‘'()’) (type: list-of-fail2ban-jail-actions)
          A list of ‘<fail2ban-jail-action-configuration>’.

     ‘extra-content’ (default: ‘'()’) (type: text-config)
          Extra content for the jail configuration, provided as a list
          of file-like objects.

 -- Data Type: fail2ban-jail-filter-configuration
     Available ‘fail2ban-jail-filter-configuration’ fields are:

     ‘name’ (type: string)
          Filter to use.

     ‘mode’ (type: maybe-string)
          Mode for filter.

Resize File System Service
..........................

This service type lets you resize a live file system during boot, which
can be convenient if a Guix image is flashed on an SD Card (e.g.  for an
embedded device) or uploaded to a VPS. In both cases the medium the
image will reside upon may be larger than the image you want to produce.

   For an embedded device booting from an SD card you may use something
like:
     (service resize-file-system-service-type
              (resize-file-system-configuration
               (file-system
                (file-system (device (file-system-label "root"))
                             (type "ext4")))))

     Предупреждение: Be extra cautious to use the correct device and
     type.  The service has little error handling of its own and relies
     on the underlying tools.  Wrong use could end in loss of data or
     the corruption of the operating system.

   Partitions and file systems are grown to the maximum size available.
File systems can only grow when they are on the last partition on a
device and have empty space available.

   This service supports the ext2, ext3, ext4, btrfs, and bcachefs file
systems.

‘file-system’ (type: file-system)
     The file-system object to resize (*note Файловые системы::).  This
     object must have the ‘device’ and ‘type’ fields set.  Other fields
     are ignored.

‘cloud-utils’ (default: ‘cloud-utils’) (type: file-like)
     The cloud-utils package to use.  This package is used for the
     ‘growpart’ command.

‘e2fsprogs’ (default: ‘e2fsprogs’) (type: file-like)
     The e2fsprogs package to use, used for resizing ext2, ext3, and
     ext4 file systems.

‘btrfs-progs’ (default: ‘btrfs-progs’) (type: file-like)
     The btrfs-progs package to use, used for resizing the btrfs file
     system.

‘bcachefs-tools’ (default: ‘bcachefs-tools’) (type: file-like)
     The bcachefs-tools package to use, used for resizing the bcachefs
     file system.

Backup Services
...............

The ‘(gnu services backup)’ module offers services for backing up file
system trees.  For now, it provides the ‘restic-backup-service-type’.

   With ‘restic-backup-service-type’, you can periodically back up
directories and files with Restic (https://restic.net/), which supports
end-to-end encryption and deduplication.  Consider the following
configuration:

     (use-service-modules backup ...) ;for 'restic-backup-service-type'
     (use-package-modules sync ...)   ;for 'rclone'

     (operating-system
       ;; ...
       (packages (append (list rclone)    ;for use by restic
                         %base-packages))
       (services
         (list
           (service restic-backup-service-type
                    (restic-backup-configuration
                      (jobs
                        (list (restic-backup-job
                                (name "remote-ftp")
                                (repository "rclone:remote-ftp:backup/restic")
                                (password-file "/root/.restic")
                                ;; Every day at 23.
                                (schedule "0 23 * * *")
                                (files '("/root/.restic"
                                         "/root/.config/rclone"
                                         "/etc/ssh/ssh_host_rsa_key"
                                         "/etc/ssh/ssh_host_rsa_key.pub"
                                         "/etc/guix/signing-key.pub"
                                         "/etc/guix/signing-key.sec"))))))))))

   Each ‘restic-backup-job’ translates to a Shepherd timer which sets
the ‘RESTIC_PASSWORD’ environment variable by reading the first line of
‘password-file’ and runs ‘restic backup’, creating backups using rclone
of all the files listed in the ‘files’ field.

   The ‘restic-backup-service-type’ provides the ability to
instantaneously trigger a backup with the ‘trigger’ Shepherd action:

     sudo herd trigger remote-ftp

 -- Data Type: restic-backup-configuration
     Available ‘restic-backup-configuration’ fields are:

     ‘jobs’ (default: ‘'()’) (type: list-of-restic-backup-jobs)
          The list of backup jobs for the current system.

 -- Data Type: restic-backup-job
     Available ‘restic-backup-job’ fields are:

     ‘restic’ (default: ‘restic’) (type: package)
          The restic package to be used for the current job.

     ‘user’ (default: ‘"root"’) (type: string)
          The user used for running the current job.

     ‘group’ (default: ‘"root"’) (type: string)
          The group used for running the current job.

     ‘log-file’ (type: maybe-string)
          The file system path to the log file for this job.  By default
          the file will have be ‘/var/log/restic-backup/JOB-NAME.log’,
          where JOB-NAME is the name defined in the ‘name’ field.  For
          Guix Home services it defaults to
          ‘$XDG_STATE_HOME/shepherd/restic-backup/JOB-NAME.log’.

     ‘max-duration’ (type: maybe-number)
          The maximum duration in seconds that a job may last.  Past
          ‘max-duration’ seconds, the job is forcefully terminated.

     ‘wait-for-termination?’ (default: ‘#f’) (type: boolean)
          Wait until the job has finished before considering executing
          it again; otherwise, perform it strictly on every occurrence
          of event, at the risk of having multiple instances running
          concurrently.

     ‘repository’ (type: string)
          The restic repository target of this job.

     ‘name’ (type: string)
          A string denoting a name for this job.

     ‘password-file’ (type: string)
          Name of the password file, readable by the configured ‘user’,
          that will be used to set the ‘RESTIC_PASSWORD’ environment
          variable for the current job.

     ‘schedule’ (type: gexp-or-string)
          A string or a gexp representing the frequency of the backup.
          Gexp must evaluate to ‘calendar-event’ records or to strings.
          Strings must contain Vixie cron date lines.

     ‘requirement’ (type: maybe-list-of-symbols)
          The list of Shepherd services that this backup job depends
          upon.  When unset it defaults to ‘'()’, for Guix Home.
          Otherwise to ‘'(user-processes file-systems)’.

     ‘files’ (default: ‘'()’) (type: list-of-lowerables)
          The list of files or directories to be backed up.  It must be
          a list of values that can be lowered to strings.

     ‘verbose?’ (default: ‘#f’) (type: boolean)
          Whether to enable verbose output for the current backup job.

     ‘extra-flags’ (default: ‘'()’) (type: list-of-lowerables)
          A list of values that are lowered to strings.  These will be
          passed as command-line arguments to the current job ‘restic
          backup’ invocation.

DLNA/UPnP Services
..................

The ‘(gnu services upnp)’ module offers services related to UPnP
(Universal Plug and Play) and DLNA (Digital Living Network Alliance),
networking protocols that can be used for media streaming and device
interoperability within a local network.  For now, this module provides
the ‘readymedia-service-type’.

   ReadyMedia (https://minidlna.sourceforge.net/) (formerly known as
MiniDLNA) is a DLNA/UPnP-AV media server.  The project’s daemon,
‘minidlnad’, can serve media files (audio, pictures, and video) to
DLNA/UPnP-AV clients available on the network.
‘readymedia-service-type’ is a Guix service that wraps around
ReadyMedia’s ‘minidlnad’.

   Consider the following configuration:
     (use-service-modules upnp ...)

     (operating-system
       ...
       (services
        (list (service readymedia-service-type
                       (readymedia-configuration
                        (media-directories
                         (list (readymedia-media-directory
                                (path "/media/audio")
                                (types '(A)))
                               (readymedia-media-directory
                                (path "/media/video")
                                (types '(V)))
                               (readymedia-media-directory
                                (path "/media/misc"))))
                        (extra-config '(("notify_interval" . "60")))))
              ...)))

   This sets up the ReadyMedia daemon to serve files from the media
folders specified in ‘media-directories’.  The ‘media-directories’ field
is mandatory.  All other fields (such as network ports and the server
name) come with a predefined default and can be omitted.

     Примечание: This service is also available for Guix Home, where it
     runs directly with your user privileges (*note
     ‘home-readymedia-service-type’: Miscellaneous Home Services.).

 -- Data Type: readymedia-configuration
     Available ‘readymedia-configuration’ fields are:

     ‘readymedia’ (default: ‘readymedia’) (type: package)
          The ReadyMedia package to be used for the service.

     ‘friendly-name’ (default: ‘#f’) (type: maybe-string)
          A custom name that will be displayed on connected clients.

     ‘media-directories’ (type: list)
          The list of media folders to serve content from.  Each item is
          a ‘readymedia-media-directory’.

     ‘cache-directory’ (default: ‘"/var/cache/readymedia"’) (type: string)
          A folder for ReadyMedia’s cache files.  If not existing
          already, the folder will be created as part of the service
          activation and the ReadyMedia user will be assigned ownership.

     ‘log-directory’ (default: ‘"/var/log/readymedia"’) (type: string)
          A folder for ReadyMedia’s log files.  If not existing already,
          the folder will be created as part of the service activation
          and the ReadyMedia user will be assigned ownership.

     ‘port’ (default: ‘#f’) (type: maybe-integer)
          A custom port that the service will be listening on.

     ‘extra-config’ (default: ‘'()’) (type: alist)
          An association list of further options, as accepted by
          ReadyMedia.

 -- Data Type: readymedia-media-directory
     A ‘media-directories’ entry includes a folder ‘path’ and,
     optionally, the ‘types’ of media files included within the folder.

     ‘path’ (type: string)
          The media folder location.

     ‘types’ (default: ‘'()’) (type: list)
          A list indicating the types of file included in the media
          folder.  Valid values are combinations of individual media
          types, i.e.  symbol ‘A’ for audio, ‘P’ for pictures, ‘V’ for
          video.  An empty list means that no type is specified.


File: guix.ru.info,  Node: Privileged Programs,  Next: Сертификаты X.509,  Prev: Сервисы,  Up: Настройка системы

11.11 Privileged Programs
=========================

Some programs need to run with elevated privileges, even when they are
launched by unprivileged users.  A notorious example is the ‘passwd’
program, which users can run to change their password, and which needs
to access the ‘/etc/passwd’ and ‘/etc/shadow’ files—something normally
restricted to root, for obvious security reasons.  To address that,
‘passwd’ should be “setuid-root”, meaning that it always runs with root
privileges (*note (libc)How Change Persona::, for more info about the
setuid mechanism).

   The store itself _cannot_ contain privileged programs: that would be
a security issue since any user on the system can write derivations that
populate the store (*note Хранилище::).  Thus, a different mechanism is
used: instead of directly granting permissions to files that are in the
store, we let the system administrator _declare_ which programs should
be entrusted with these additional privileges.

   The ‘privileged-programs’ field of an ‘operating-system’ declaration
contains a list of ‘<privileged-program>’ denoting the names of programs
to have a setuid or setgid bit set (*note Использование системы
конфигурации::).  For instance, the ‘mount.nfs’ program, which is part
of the nfs-utils package, with a setuid root can be designated like
this:

     (privileged-program
       (program (file-append nfs-utils "/sbin/mount.nfs"))
       (setuid? #t))

   And then, to make ‘mount.nfs’ setuid on your system, add the previous
example to your operating system declaration by appending it to
‘%default-privileged-programs’ like this:

     (operating-system
       ;; Some fields omitted...
       (privileged-programs
         (append (list (privileged-program
                         (program (file-append nfs-utils "/sbin/mount.nfs"))
                         (setuid? #t)))
                 %default-privileged-programs)))

 -- Data Type: privileged-program
     This data type represents a program with special privileges, such
     as setuid

     ‘program’
          A file-like object to which all given privileges should apply.

     ‘setuid?’ (default: ‘#f’)
          Whether to set user setuid bit.

     ‘setgid?’ (default: ‘#f’)
          Whether to set group setgid bit.

     ‘user’ (default: ‘0’)
          UID (integer) or user name (string) for the user owner of the
          program, defaults to root.

     ‘group’ (default: ‘0’)
          GID (integer) group name (string) for the group owner of the
          program, defaults to root.

     ‘capabilities’ (default: ‘#f’)
          A string representing the program’s POSIX capabilities, as
          described by the ‘cap_to_text(3)’ man page from the libcap
          package, or ‘#f’ to make no changes.

   A default set of privileged programs is defined by the
‘%default-privileged-programs’ variable of the ‘(gnu system)’ module.

 -- Variable: Scheme Variable %default-privileged-programs
     A list of ‘<privileged-program>’ denoting common programs with
     elevated privileges.

     The list includes commands such as ‘passwd’, ‘ping’, ‘su’, and
     ‘sudo’.

   Under the hood, the actual privileged programs are created in the
‘/run/privileged/bin’ directory at system activation time.  The files in
this directory refer to the “real” binaries, which are in the store.


File: guix.ru.info,  Node: Сертификаты X.509,  Next: Переключатель службы имен,  Prev: Privileged Programs,  Up: Настройка системы

11.12 Сертификаты X.509
=======================

Web servers available over HTTPS (that is, HTTP over the transport-layer
security mechanism, TLS) send client programs an “X.509 certificate”
that the client can then use to _authenticate_ the server.  To do that,
clients verify that the server’s certificate is signed by a so-called
“certificate authority” (CA). But to verify the CA’s signature, clients
must have first acquired the CA’s certificate.

   Web browsers such as GNU IceCat include their own set of CA
certificates, such that they are able to verify CA signatures
out-of-the-box.

   However, most other programs that can talk HTTPS—‘wget’, ‘git’,
‘w3m’, etc.—need to be told where CA certificates can be found.

   For users of Guix System, this is done by adding a package that
provides certificates to the ‘packages’ field of the ‘operating-system’
declaration (*note Интерфейс operating-system::).  Guix includes one
such package, ‘nss-certs’, which is a set of CA certificates provided as
part of Mozilla’s Network Security Services.

   This package is part of ‘%base-packages’, so there is no need to
explicitly add it.  The ‘/etc/ssl/certs’ directory, which is where most
applications and libraries look for certificates by default, points to
the certificates installed globally.

   Unprivileged users, including users of Guix on a foreign distro, can
also install their own certificate package in their profile.  A number
of environment variables need to be defined so that applications and
libraries know where to find them.  Namely, the OpenSSL library honors
the ‘SSL_CERT_DIR’ and ‘SSL_CERT_FILE’ variables.  Some applications add
their own environment variables; for instance, the Git version control
system honors the certificate bundle pointed to by the ‘GIT_SSL_CAINFO’
environment variable.  Thus, you would typically run something like:

     guix install nss-certs
     export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
     export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
     export GIT_SSL_CAINFO="$SSL_CERT_FILE"

   As another example, R requires the ‘CURL_CA_BUNDLE’ environment
variable to point to a certificate bundle, so you would have to run
something like this:

     $ guix install glibc-locales
     $ export GUIX_LOCPATH=$HOME/.guix-profile/lib/locale

   For other applications you may want to look up the required
environment variable in the relevant documentation.


File: guix.ru.info,  Node: Переключатель службы имен,  Next: Начальный RAM-диск,  Prev: Сертификаты X.509,  Up: Настройка системы

11.13 Переключатель службы имен
===============================

The ‘(gnu system nss)’ module provides bindings to the configuration
file of the libc “name service switch” or “NSS” (*note (libc)NSS
Configuration File::).  In a nutshell, the NSS is a mechanism that
allows libc to be extended with new “name” lookup methods for system
databases, which includes host names, service names, user accounts, and
more (*note System Databases and Name Service Switch: (libc)Name Service
Switch.).

   The NSS configuration specifies, for each system database, which
lookup method is to be used, and how the various methods are chained
together—for instance, under which circumstances NSS should try the next
method in the list.  The NSS configuration is given in the
‘name-service-switch’ field of ‘operating-system’ declarations (*note
‘name-service-switch’: Интерфейс operating-system.).

   As an example, the declaration below configures the NSS to use the
‘nss-mdns’ back-end (https://0pointer.de/lennart/projects/nss-mdns/),
which supports host name lookups over multicast DNS (mDNS) for host
names ending in ‘.local’:

     (name-service-switch
        (hosts (list %files    ;first, check /etc/hosts

                     ;; If the above did not succeed, try
                     ;; with 'mdns_minimal'.
                     (name-service
                       (name "mdns_minimal")

                       ;; 'mdns_minimal' is authoritative for
                       ;; '.local'.  When it returns "not found",
                       ;; no need to try the next methods.
                       (reaction (lookup-specification
                                  (not-found => return))))

                     ;; Then fall back to DNS.
                     (name-service
                       (name "dns"))

                     ;; Finally, try with the "full" 'mdns'.
                     (name-service
                       (name "mdns")))))

   Do not worry: the ‘%mdns-host-lookup-nss’ variable (see below)
contains this configuration, so you will not have to type it if all you
want is to have ‘.local’ host lookup working.

   Note that, in this case, in addition to setting the
‘name-service-switch’ of the ‘operating-system’ declaration, you also
need to use ‘avahi-service-type’ (*note ‘avahi-service-type’: Сервисы
сети.), or ‘%desktop-services’, which includes it (*note Сервисы
рабочего стола::).  Doing this makes ‘nss-mdns’ accessible to the name
service cache daemon (*note ‘nscd-service’: Базовые службы.).

   For convenience, the following variables provide typical NSS
configurations.

 -- Variable: %default-nss
     This is the default name service switch configuration, a
     ‘name-service-switch’ object.

 -- Variable: %mdns-host-lookup-nss
     This is the name service switch configuration with support for host
     name lookup over multicast DNS (mDNS) for host names ending in
     ‘.local’.

   Furthermore, mDNS lookups could be restricted to IPv4 or IPv6
protocols using the procedure ‘mdns-host-lookup-nss’.

 -- Procedure: mdns-host-lookup-nss [#:ipv6? #t] [#:ipv4? #t] Return a
          name-service-switch object with
     mDNS lookup restricted to specified protocols.

   The reference for name service switch configuration is given below.
It is a direct mapping of the configuration file format of the C library
, so please refer to the C library manual for more information (*note
(libc)NSS Configuration File::).  Compared to the configuration file
format of libc NSS, it has the advantage not only of adding this warm
parenthetic feel that we like, but also static checks: you will know
about syntax errors and typos as soon as you run ‘guix system’.

 -- Data Type: name-service-switch

     This is the data type representation the configuration of libc’s
     name service switch (NSS). Each field below represents one of the
     supported system databases.

     ‘aliases’
     ‘ethers’
     ‘group’
     ‘gshadow’
     ‘hosts’
     ‘initgroups’
     ‘netgroup’
     ‘networks’
     ‘password’
     ‘public-key’
     ‘rpc’
     ‘services’
     ‘shadow’
          The system databases handled by the NSS.  Each of these fields
          must be a list of ‘<name-service>’ objects (see below).

 -- Data Type: name-service

     This is the data type representing an actual name service and the
     associated lookup action.

     ‘name’
          A string denoting the name service (*note (libc)Services in
          the NSS configuration::).

          Note that name services listed here must be visible to nscd.
          This is achieved by passing the ‘#:name-services’ argument to
          ‘nscd-service’ the list of packages providing the needed name
          services (*note ‘nscd-service’: Базовые службы.).

     ‘reaction’
          An action specified using the ‘lookup-specification’ macro
          (*note (libc)Actions in the NSS configuration::).  For
          example:

               (lookup-specification (unavailable => continue)
                                     (success => return))


File: guix.ru.info,  Node: Начальный RAM-диск,  Next: Настройка загрузчика,  Prev: Переключатель службы имен,  Up: Настройка системы

11.14 Начальный RAM-диск
========================

For bootstrapping purposes, the Linux-Libre kernel is passed an “initial
RAM disk”, or “initrd”.  An initrd contains a temporary root file system
as well as an initialization script.  The latter is responsible for
mounting the real root file system, and for loading any kernel modules
that may be needed to achieve that.

   The ‘initrd-modules’ field of an ‘operating-system’ declaration
allows you to specify Linux-libre kernel modules that must be available
in the initrd.  In particular, this is where you would list modules
needed to actually drive the hard disk where your root partition
is—although the default value of ‘initrd-modules’ should cover most use
cases.  For example, assuming you need the ‘megaraid_sas’ module in
addition to the default modules to be able to access your root file
system, you would write:

     (operating-system
       ;; ...
       (initrd-modules (cons "megaraid_sas" %base-initrd-modules)))

 -- Variable: %base-initrd-modules
     This is the list of kernel modules included in the initrd by
     default.

   Furthermore, if you need lower-level customization, the ‘initrd’
field of an ‘operating-system’ declaration allows you to specify which
initrd you would like to use.  The ‘(gnu system linux-initrd)’ module
provides three ways to build an initrd: the high-level ‘base-initrd’
procedure and the low-level ‘raw-initrd’ and ‘expression->initrd’
procedures.

   The ‘base-initrd’ procedure is intended to cover most common uses.
For example, if you want to add a bunch of kernel modules to be loaded
at boot time, you can define the ‘initrd’ field of the operating system
declaration like this:

     (initrd (lambda (file-systems . rest)
               ;; Create a standard initrd but set up networking
               ;; with the parameters QEMU expects by default.
               (apply base-initrd file-systems
                      #:qemu-networking? #t
                      rest)))

   The ‘base-initrd’ procedure also handles common use cases that
involves using the system as a QEMU guest, or as a “live” system with
volatile root file system.

   The ‘base-initrd’ procedure is built from ‘raw-initrd’ procedure.
Unlike ‘base-initrd’, ‘raw-initrd’ doesn’t do anything high-level, such
as trying to guess which kernel modules and packages should be included
to the initrd.  An example use of ‘raw-initrd’ is when a user has a
custom Linux kernel configuration and default kernel modules included by
‘base-initrd’ are not available.

   The initial RAM disk produced by ‘base-initrd’ or ‘raw-initrd’ honors
several options passed on the Linux kernel command line (that is,
arguments passed via the ‘linux’ command of GRUB, or the ‘-append’
option of QEMU), notably:

‘gnu.load=BOOT’
     Tell the initial RAM disk to load BOOT, a file containing a Scheme
     program, once it has mounted the root file system.

     Guix uses this option to yield control to a boot program that runs
     the service activation programs and then spawns the GNU Shepherd,
     the initialization system.

‘root=ROOT’
     Mount ROOT as the root file system.  ROOT can be a device name like
     ‘/dev/sda1’, a file system label, or a file system UUID. When
     unspecified, the device name from the root file system of the
     operating system declaration is used.

‘rootfstype=TYPE’
     Set the type of the root file system.  It overrides the ‘type’
     field of the root file system specified via the ‘operating-system’
     declaration, if any.

‘rootflags=OPTIONS’
     Set the mount _options_ of the root file system.  It overrides the
     ‘options’ field of the root file system specified via the
     ‘operating-system’ declaration, if any.

‘fsck.mode=MODE’
     Whether to check the ROOT file system for errors before mounting
     it.  MODE is one of ‘skip’ (never check), ‘force’ (always check),
     or ‘auto’ to respect the root ‘<file-system>’ object’s ‘check?’
     setting (*note Файловые системы::) and run a full scan only if the
     file system was not cleanly shut down.

     ‘auto’ is the default if this option is not present or if MODE is
     not one of the above.

‘fsck.repair=LEVEL’
     The level of repairs to perform automatically if errors are found
     in the ROOT file system.  LEVEL is one of ‘no’ (do not write to
     ROOT at all if possible), ‘yes’ (repair as much as possible), or
     ‘preen’ to repair problems considered safe to repair automatically.

     ‘preen’ is the default if this option is not present or if LEVEL is
     not one of the above.

‘gnu.system=SYSTEM’
     Have ‘/run/booted-system’ and ‘/run/current-system’ point to
     SYSTEM.

‘modprobe.blacklist=MODULES...’
     Instruct the initial RAM disk as well as the ‘modprobe’ command
     (from the kmod package) to refuse to load MODULES.  MODULES must be
     a comma-separated list of module names—e.g., ‘usbkbd,9pnet’.

‘gnu.repl’
     Start a read-eval-print loop (REPL) from the initial RAM disk
     before it tries to load kernel modules and to mount the root file
     system.  Our marketing team calls it “boot-to-Guile”.  The Schemer
     in you will love it.  *Note (guile)Using Guile Interactively::, for
     more information on Guile’s REPL.

   Now that you know all the features that initial RAM disks produced by
‘base-initrd’ and ‘raw-initrd’ provide, here is how to use it and
customize it further.

 -- Procedure: raw-initrd file-systems [#:linux-modules '()]
          [#:pre-mount #t] [#:mapped-devices '()] [#:keyboard-layout #f]
          [#:helper-packages '()]  [#:qemu-networking? #f]
     [#:volatile-root?  #f] Return a derivation that builds a raw
     initrd.  FILE-SYSTEMS is a list of file systems to be mounted by
     the initrd, possibly in addition to the root file system specified
     on the kernel command line via ‘root’.  LINUX-MODULES is a list of
     kernel modules to be loaded at boot time.  MAPPED-DEVICES is a list
     of device mappings to realize before FILE-SYSTEMS are mounted
     (*note Размеченные устройства::).  PRE-MOUNT is a G-expression to
     evaluate before realizing MAPPED-DEVICES.  HELPER-PACKAGES is a
     list of packages to be copied in the initrd.  It may include
     ‘e2fsck/static’ or other packages needed by the initrd to check the
     root file system.

     When true, KEYBOARD-LAYOUT is a ‘<keyboard-layout>’ record denoting
     the desired console keyboard layout.  This is done before
     MAPPED-DEVICES are set up and before FILE-SYSTEMS are mounted such
     that, should the user need to enter a passphrase or use the REPL,
     this happens using the intended keyboard layout.

     When QEMU-NETWORKING? is true, set up networking with the standard
     QEMU parameters.

     When VOLATILE-ROOT? is true, the root file system is writable but
     any changes to it are lost.

 -- Procedure: base-initrd file-systems [#:mapped-devices '()]
          [#:keyboard-layout #f]  [#:qemu-networking? #f]
     [#:volatile-root?  #f]  [#:linux-modules ’()] Return as a file-like
     object a generic initrd, with kernel modules taken from LINUX.
     FILE-SYSTEMS is a list of file-systems to be mounted by the initrd,
     possibly in addition to the root file system specified on the
     kernel command line via ‘root’.  MAPPED-DEVICES is a list of device
     mappings to realize before FILE-SYSTEMS are mounted.

     When true, KEYBOARD-LAYOUT is a ‘<keyboard-layout>’ record denoting
     the desired console keyboard layout.  This is done before
     MAPPED-DEVICES are set up and before FILE-SYSTEMS are mounted such
     that, should the user need to enter a passphrase or use the REPL,
     this happens using the intended keyboard layout.

     QEMU-NETWORKING? and VOLATILE-ROOT? behaves as in ‘raw-initrd’.

     The initrd is automatically populated with all the kernel modules
     necessary for FILE-SYSTEMS and for the given options.  Additional
     kernel modules can be listed in LINUX-MODULES.  They will be added
     to the initrd, and loaded at boot time in the order in which they
     appear.

   Needless to say, the initrds we produce and use embed a
statically-linked Guile, and the initialization program is a Guile
program.  That gives a lot of flexibility.  The ‘expression->initrd’
procedure builds such an initrd, given the program to run in that
initrd.

 -- Procedure: expression->initrd exp [#:guile %guile-static-initrd]
          [#:name "guile-initrd"] Return as a file-like
     object a Linux initrd (a gzipped cpio archive) containing GUILE and
     that evaluates EXP, a G-expression, upon booting.  All the
     derivations referenced by EXP are automatically copied to the
     initrd.


File: guix.ru.info,  Node: Настройка загрузчика,  Next: Вызов guix system,  Prev: Начальный RAM-диск,  Up: Настройка системы

11.15 Настройка загрузчика
==========================

The operating system supports multiple bootloaders.  The bootloader is
configured using ‘bootloader-configuration’ declaration.  All the fields
of this structure are bootloader agnostic except for one field,
‘bootloader’ that indicates the bootloader to be configured and
installed.

   Some of the bootloaders do not honor every field of
‘bootloader-configuration’.  For instance, the extlinux bootloader does
not support themes and thus ignores the ‘theme’ field.

 -- Data Type: bootloader-configuration
     The type of a bootloader configuration declaration.

     ‘bootloader’
          The bootloader to use, as a ‘bootloader’ object.  For now
          ‘grub-bootloader’, ‘grub-efi-bootloader’,
          ‘grub-efi-removable-bootloader’,
          ‘grub-efi-netboot-bootloader’,
          ‘grub-efi-netboot-removable-bootloader’, ‘extlinux-bootloader’
          and ‘u-boot-bootloader’ are supported.

          Available bootloaders are described in ‘(gnu bootloader ...)’
          modules.  In particular, ‘(gnu bootloader u-boot)’ contains
          definitions of bootloaders for a wide range of ARM and AArch64
          systems, using the U-Boot bootloader
          (https://www.denx.de/wiki/U-Boot/).

          ‘grub-bootloader’ allows you to boot in particular Intel-based
          machines in “legacy” BIOS mode.

          ‘grub-efi-bootloader’ allows to boot on modern systems using
          the “Unified Extensible Firmware Interface” (UEFI). This is
          what you should use if the installation image contains a
          ‘/sys/firmware/efi’ directory when you boot it on your system.

          ‘grub-efi-removable-bootloader’ allows you to boot your system
          from removable media by writing the GRUB file to the
          UEFI-specification location of ‘/EFI/BOOT/BOOTX64.efi’ of the
          boot directory, usually ‘/boot/efi’.  This is also useful for
          some UEFI firmwares that “forget” their configuration from
          their non-volatile storage.  Like ‘grub-efi-bootloader’, this
          can only be used if the ‘/sys/firmware/efi’ directory is
          available.

               Примечание: This _will_ overwrite the GRUB file from any
               other operating systems that also place their GRUB file
               in the UEFI-specification location; making them
               unbootable.

          ‘grub-efi-netboot-bootloader’ allows you to boot your system
          over network through TFTP.  In combination with an NFS root
          file system this allows you to build a diskless Guix system.

          The installation of the ‘grub-efi-netboot-bootloader’
          generates the content of the TFTP root directory at ‘targets’
          (*note ‘targets’: Настройка загрузчика.) below the
          sub-directory ‘efi/Guix’, to be served by a TFTP server.  You
          may want to mount your TFTP server directories onto the
          ‘targets’ to move the required files to the TFTP server
          automatically during installation.

          If you plan to use an NFS root file system as well (actually
          if you mount the store from an NFS share), then the TFTP
          server needs to serve the file ‘/boot/grub/grub.cfg’ and other
          files from the store (like GRUBs background image, the kernel
          (*note ‘kernel’: Интерфейс operating-system.) and the initrd
          (*note ‘initrd’: Интерфейс operating-system.)), too.  All
          these files from the store will be accessed by GRUB through
          TFTP with their normal store path, for example as
          ‘tftp://tftp-server/gnu/store/…-initrd/initrd.cpio.gz’.

          Two symlinks are created to make this possible.  For each
          target in the ‘targets’ field, the first symlink is
          ‘target’‘/efi/Guix/boot/grub/grub.cfg’ pointing to
          ‘../../../boot/grub/grub.cfg’, where ‘target’ may be ‘/boot’.
          In this case the link is not leaving the served TFTP root
          directory, but otherwise it does.  The second link is
          ‘target’‘/gnu/store’ and points to ‘../gnu/store’.  This link
          is leaving the served TFTP root directory.

          The assumption behind all this is that you have an NFS server
          exporting the root file system for your Guix system, and
          additionally a TFTP server exporting your ‘targets’
          directories—usually a single ‘/boot’—from that same root file
          system for your Guix system.  In this constellation the
          symlinks will work.

          For other constellations you will have to program your own
          bootloader installer, which then takes care to make necessary
          files from the store accessible through TFTP, for example by
          copying them into the TFTP root directory for your ‘targets’.

          It is important to note that symlinks pointing outside the
          TFTP root directory may need to be allowed in the
          configuration of your TFTP server.  Further the store link
          exposes the whole store through TFTP.  Both points need to be
          considered carefully for security aspects.  It is advised to
          disable any TFTP write access!

          Please note, that this bootloader will not modify the ‘UEFI
          Boot Manager’ of the system.

          Beside the ‘grub-efi-netboot-bootloader’, the already
          mentioned TFTP and NFS servers, you also need a properly
          configured DHCP server to make the booting over netboot
          possible.  For all this we can currently only recommend you to
          look for instructions about PXE (Preboot eXecution
          Environment).

          If a local EFI System Partition (ESP) or a similar partition
          with a FAT file system is mounted in ‘targets’, then symlinks
          cannot be created.  In this case everything will be prepared
          for booting from local storage, matching the behavior of
          ‘grub-efi-bootloader’, with the difference that all GRUB
          binaries are copied to ‘targets’, necessary for booting over
          the network.

          ‘grub-efi-netboot-removable-bootloader’ is identical to
          ‘grub-efi-netboot-bootloader’ with the exception that the
          sub-directory ‘efi/boot’ will be used instead of ‘efi/Guix’ to
          comply with the UEFI specification for removable media.

               Примечание: This _will_ overwrite the GRUB file from any
               other operating systems that also place their GRUB file
               in the UEFI-specification location; making them
               unbootable.

     ‘targets’
          This is a list of strings denoting the targets onto which to
          install the bootloader.

          The interpretation of targets depends on the bootloader in
          question.  For ‘grub-bootloader’, for example, they should be
          device names understood by the bootloader ‘installer’ command,
          such as ‘/dev/sda’ or ‘(hd0)’ (*note (grub)Invoking
          grub-install::).  For ‘grub-efi-bootloader’ and
          ‘grub-efi-removable-bootloader’ they should be mount points of
          the EFI file system, usually ‘/boot/efi’.  For
          ‘grub-efi-netboot-bootloader’, ‘targets’ should be the mount
          points corresponding to TFTP root directories served by your
          TFTP server.

     ‘menu-entries’ (default: ‘'()’)
          A possibly empty list of ‘menu-entry’ objects (see below),
          denoting entries to appear in the bootloader menu, in addition
          to the current system entry and the entry pointing to previous
          system generations.

     ‘default-entry’ (default: ‘0’)
          The index of the default boot menu entry.  Index 0 is for the
          entry of the current system.

     ‘timeout’ (default: ‘5’)
          The number of seconds to wait for keyboard input before
          booting.  Set to 0 to boot immediately, and to -1 to wait
          indefinitely.

     ‘keyboard-layout’ (default: ‘#f’)
          If this is ‘#f’, the bootloader’s menu (if any) uses the
          default keyboard layout, usually US English (“qwerty”).

          Otherwise, this must be a ‘keyboard-layout’ object (*note
          Раскладка клавиатуры::).

               Примечание: This option is currently ignored by
               bootloaders other than ‘grub’ and ‘grub-efi’.

     ‘theme’ (default: #F)
          The bootloader theme object describing the theme to use.  If
          no theme is provided, some bootloaders might use a default
          theme, that’s true for GRUB.

     ‘features’ (default: ‘'()’)
          The output terminals used for the bootloader boot menu, as a
          list of symbols.  GRUB accepts the values: ‘console’,
          ‘serial’, ‘serial_{0-3}’, ‘gfxterm’, ‘vga_text’, ‘mda_text’,
          ‘morse’, and ‘pkmodem’.  This field corresponds to the GRUB
          variable ‘GRUB_TERMINAL_OUTPUT’ (*note (grub)Simple
          configuration::).

     ‘terminal-inputs’ (default: ‘'()’)
          The input terminals used for the bootloader boot menu, as a
          list of symbols.  For GRUB, the default is the native platform
          terminal as determined at run-time.  GRUB accepts the values:
          ‘console’, ‘serial’, ‘serial_{0-3}’, ‘at_keyboard’, and
          ‘usb_keyboard’.  This field corresponds to the GRUB variable
          ‘GRUB_TERMINAL_INPUT’ (*note (grub)Simple configuration::).

     ‘serial-unit’ (default: ‘#f’)
          The serial unit used by the bootloader, as an integer from 0
          to 3.  For GRUB, it is chosen at run-time; currently GRUB
          chooses 0, which corresponds to COM1 (*note (grub)Serial
          terminal::).

     ‘serial-speed’ (default: ‘#f’)
          The speed of the serial interface, as an integer.  For GRUB,
          the default value is chosen at run-time; currently GRUB
          chooses 9600 bps (*note (grub)Serial terminal::).

     ‘device-tree-support?’ (default: ‘#t’)
          Whether to support Linux device tree
          (https://en.wikipedia.org/wiki/Devicetree) files loading.

          This option in enabled by default.  In some cases involving
          the ‘u-boot’ bootloader, where the device tree has already
          been loaded in RAM, it can be handy to disable the option by
          setting it to ‘#f’.

     ‘extra-initrd’ (default: ‘#f’)
          File name of an additional initrd to load during the boot.  It
          may or may not point to a file in the store, but the main use
          case is for out-of-store files containing secrets.

          In order to be able to provide decryption keys for LUKS
          devices, they need to be available in the initial RAM disk.
          However they cannot be stored inside the usual initrd, since
          it is stored in the store and being world-readable (as files
          in the store are) is not a desired property for an initrd
          containing decryption keys.  You can therefore use this field
          to instruct GRUB to also load a manually created initrd not
          stored in the store.

          For any use case not involving secrets, you should use regular
          initrd (*note ‘initrd’: Интерфейс operating-system.) instead.

          Suitable image can be created for example like this:

               echo /key-file.bin | cpio -oH newc >/key-file.cpio
               chmod 0000 /key-file.cpio

          After it is created, you can use it in this manner:

               ;; Operating system with encrypted boot partition
               (operating-system
                 ...
                 (bootloader (bootloader-configuration
                              (bootloader grub-efi-bootloader)
                              (targets '("/boot/efi"))
                              ;; Load the initrd with a key file...
                              (extra-initrd "/key-file.cpio")))
                 (mapped-devices
                  (list (mapped-device
                         (source (uuid "12345678-1234-1234-1234-123456789abc"))
                         (target "my-root")
                         (type luks-device-mapping)
                         ;; ... and use it to unlock the root device.
                         (arguments '(#:key-file "/key-file.bin"))))))

          Be careful when using this option, since pointing to a file
          that is not readable by the grub while booting will cause the
          boot to fail and require a manual edit of the initrd line in
          the grub menu.

          Currently only supported by GRUB.

   Should you want to list additional boot menu entries via the
‘menu-entries’ field above, you will need to create them with the
‘menu-entry’ form.  For example, imagine you want to be able to boot
another distro (hard to imagine!), you can define a menu entry along
these lines:

     (menu-entry
       (label "The Other Distro")
       (linux "/boot/old/vmlinux-2.6.32")
       (linux-arguments '("root=/dev/sda2"))
       (initrd "/boot/old/initrd"))

   Details below.

 -- Data Type: menu-entry
     The type of an entry in the bootloader menu.

     ‘label’
          The label to show in the menu—e.g., ‘"GNU"’.

     ‘port’ (default: ‘22’)
          The Linux kernel image to boot, for example:

               (file-append linux-libre "/bzImage")

          For GRUB, it is also possible to specify a device explicitly
          in the file path using GRUB’s device naming convention (*note
          (grub)Naming convention::), for example:

               "(hd0,msdos1)/boot/vmlinuz"

          If the device is specified explicitly as above, then the
          ‘device’ field is ignored entirely.

     ‘linux-arguments’ (default: ‘'()’)
          The list of extra Linux kernel command-line arguments—e.g.,
          ‘'("console=ttyS0")’.

     ‘speed’ (default: ‘1.0’)
          A G-Expression or string denoting the file name of the initial
          RAM disk to use (*note G-Expressions::).

     ‘device’ (default: ‘#f’)
          The device where the kernel and initrd are to be found—i.e.,
          for GRUB, “root” for this menu entry (*note (grub)root::).

          This may be a file system label (a string), a file system UUID
          (a bytevector, *note Файловые системы::), or ‘#f’, in which
          case the bootloader will search the device containing the file
          specified by the ‘linux’ field (*note (grub)search::).  It
          must _not_ be an OS device name such as ‘/dev/sda1’.

     ‘port’ (default: ‘22’)
          The kernel to boot in Multiboot-mode (*note
          (grub)multiboot::).  When this field is set, a Multiboot
          menu-entry is generated.  For example:

               (file-append mach "/boot/gnumach")

     ‘multiboot-arguments’ (default: ‘'()’)
          The list of extra command-line arguments for the
          multiboot-kernel.

          For example, when running in QEMU it can be useful to use a
          text-based console (use options ‘--nographic’ ‘--serial
          mon:stdio’):

               '("console=com0")

          To use the new and still experimental rumpdisk user-level disk
          driver (https://darnassus.sceen.net/~hurd-web/rump_kernel/)
          instead of GNU Mach’s in-kernel IDE driver, set
          ‘kernel-arguments’ to:

               '("noide")

          Of course, these options can be combined:

               '("console=com0" "noide")

     ‘multiboot-modules’ (default: ‘'()’)
          The list of commands for loading Multiboot modules.  For
          example:

               (list (list (file-append hurd "/hurd/ext2fs.static") "ext2fs"
                            ...)
                     (list (file-append libc "/lib/ld.so.1") "exec"
                            ...))

     ‘chain-loader’ (default: ‘#f’)
          A string that can be accepted by ‘grub’’s ‘chainloader’
          directive.  This has no effect if either ‘linux’ or
          ‘multiboot-kernel’ fields are specified.  The following is an
          example of chainloading a different GNU/Linux system.

               (bootloader
                (bootloader-configuration
                 ;; ...
                 (menu-entries
                  (list
                   (menu-entry
                    (label "GNU/Linux")
                    (device (uuid "1C31-A17C" 'fat))
                    (chain-loader "/EFI/GNULinux/grubx64.efi"))))))

   For now only GRUB has theme support.  GRUB themes are created using
the ‘grub-theme’ form, which is not fully documented yet.

 -- Тип данных: build-machine
     Data type representing the configuration of the GRUB theme.

     ‘port’ (default: ‘22’)
          The GRUB ‘gfxmode’ to set (a list of screen resolution
          strings, *note (grub)gfxmode::).

 -- Procedure: grub-theme
     Return the default GRUB theme used by the operating system if no
     ‘theme’ field is specified in ‘bootloader-configuration’ record.

     It comes with a fancy background image displaying the GNU and Guix
     logos.

   For example, to override the default resolution, you may use
something like

     (bootloader
      (bootloader-configuration
      ;; ...
      (theme (grub-theme
              (inherit (grub-theme))
              (gfxmode '("1024x786x32" "auto"))))))


File: guix.ru.info,  Node: Вызов guix system,  Next: Запуск guix deploy,  Prev: Настройка загрузчика,  Up: Настройка системы

11.16 Invoking ‘guix system’
============================

Однажды объявленное описание операционной системы, описанное в
предыдущих разделах, может быть “применено” с помощью команды ‘guix
system’.  Синопсис:

     guix system OPTIONS... ACTION FILE

   FILE должно быть именем файла, содержащего определение
‘operating-system’.  ACTION указывает, как воспроизводится операционная
система.  В настоящее время поддерживаются следующие значения:

‘search’
     Показывает доступные определения типов служб, в соответствии с
     указанным регулярным выражениям, отсортированные по релевантности:

          $ guix system search console
          name: console-fonts
          location: gnu/services/base.scm:806:2
          extends: shepherd-root
          description: Install the given fonts on the specified ttys (fonts are per
          + virtual console on GNU/Linux).  The value of this service is a list of
          + tty/font pairs.  The font can be the name of a font provided by the `kbd'
          + package or any valid argument to `setfont', as in this example:
          +
          +      '(("tty1" . "LatGrkCyr-8x16")
          +        ("tty2" . (file-append
          +                      font-tamzen
          +                      "/share/kbd/consolefonts/TamzenForPowerline10x20.psf"))
          +        ("tty3" . (file-append
          +                      font-terminus
          +                      "/share/consolefonts/ter-132n"))) ; for HDPI
          relevance: 9

          name: mingetty
          location: gnu/services/base.scm:1190:2
          extends: shepherd-root
          description: Provide console login using the `mingetty' program.
          relevance: 2

          name: login
          location: gnu/services/base.scm:860:2
          extends: pam
          description: Provide a console log-in service as specified by its
          + configuration value, a `login-configuration' object.
          relevance: 2

          ...

     Так же как для ‘guix package --search’, результат будет выведен в
     ‘recutils’ формате, что делает его простым для фильтрации и вывода
     (*note GNU recutils databases: (GNU recutils manual)Top.).

‘edit’
     Edit or view the definition of the given service types.

     For example, the command below opens your editor, as specified by
     the ‘EDITOR’ environment variable, on the definition of the
     ‘openssh’ service type:

          guix system edit openssh

‘reconfigure’
     Собирает операционную систему описанную в FILE, активирует её и
     переключается на неё(1).

          Примечание: Настоятельно рекомендуется запустить команду ‘guix
          pull’ перед первым запуском ‘guix system reconfigure’ (*note
          Запуск guix pull::).  В противном случае вы можете получить
          старую версию Guix после завершения ‘reconfigure’

     This effects all the configuration specified in FILE: user
     accounts, system services, global package list, privileged
     programs, etc.  The command starts system services specified in
     FILE that are not currently running; if a service is currently
     running this command will arrange for it to be upgraded the next
     time it is stopped (e.g. by ‘herd stop X’ or ‘herd restart X’).

     Эта команда создает новое поколение, число которого на единицу
     больше, чем у текущего поколения (как описано ‘guix system
     list-generations’).  Если это поколение уже существует, оно будет
     перезаписано.  Это поведение описано в ‘guix package’ (*note Вызов
     guix package::).

     Она добавляет пункты меню загрузчика для новой конфигурации ОС,
     если не передана опция ‘--no-bootloader’.  Для GRUB она перемещает
     записи для более старых конфигураций вподменю, позволяя вам выбрать
     более старое поколение системы во время загрузки, если вам это
     понадобится.

     On Linux, ‘guix system reconfigure’ also loads the new system for
     fast reboot via kexec: running ‘reboot --kexec’ will boot the new
     system by directly executing its kernel, thus bypassing the BIOS
     initialization phase and bootloader (*note (shepherd)Invoking
     reboot::).  You can avoid this behavior by passing the ‘--no-kexec’
     option.

     По завершении новая система развертывается в ‘/run/current-system’.
     Этот каталог содержит “метаданные о происхождении”: список
     используемых каналов (*note Каналы::) и сам FILE, если он доступен.
     Вы можете просмотреть его, запустив:

          guix system describe

     Эта информация пригодится, если позже вы захотите проверить, как
     было собрано это конкретное поколение.  Фактически, предполагая,
     что FILE содержит всё необходимое, вы можете позже пересобрать
     поколение N в вашей операционной системы с помощью:

          guix time-machine \
            -C /var/guix/profiles/system-N-link/channels.scm -- \
            system reconfigure \
            /var/guix/profiles/system-N-link/configuration.scm

     Вы можете думать об этом как о чем-то вроде встроенного контроля
     версий!  Ваша система теперь не просто набор двоичных файлов: _она
     содержит свой собственный источник_.  *Note
     ‘provenance-service-type’: Интерфейс сервиса, для получения
     дополнительной информации об отслеживании происхождения.

     По умолчанию ‘reconfigure’ _препятствует откату вашей системы_, что
     может (пере)внести уязвимости безопасности, а также вызвать
     проблемы со службами "отслеживающими состояние", такими как системы
     управления базами данных.  Вы можете переопределить это поведение,
     передав ‘--allow-downgrades’.

‘switch-generation’
     Переключает на существующее поколение системы.  Эта команда
     атомарной операцией переключает системный профиль на указанное
     поколение системы.  Она также изменяет порядок существующих
     элементов меню загрузчика системы.  Она устанавливает в загрузчике
     запуск по умолчанию указанного поколения и перемещает другие
     поколения в подменю, если это поддерживается используемым
     загрузчиком.  При следующей загрузке системы она будет использовать
     указанное поколение системы.

     Сам загрузчик не переустанавливается при использовании этой
     команды.  Таким образом, установленный загрузчик используется с
     обновленным файлом конфигурации.

     Нужное поколение может быть явно указано по его номеру.  Например,
     следующий вызов переключится на поколение 7:

          guix system switch-generation 7

     Нужное поколение также может быть указано относительно текущего
     поколения ‘+N’ или ‘-N’, где ‘+3’ означает "на 3 поколения старше
     текущего", а ‘-1’ означает "на 1 поколение младше текущего".  При
     задании отрицательного значения ‘-1’, перед ним нужно поставить
     ‘--’ чтобы не воспринимать его в качестве опции.  Например:

          guix system switch-generation -- -1

     В настоящее время результатом вызова этого действия является
     _только_ переключение профиля на существующее поколение и изменение
     элементов меню загрузчика.  Чтобы начать использовать указанное
     поколение, вы должны перезагрузиться.  В будущем поведение будет
     аналогично ‘reconfigure’, например, запуск и остановка служб.

     Это действие завершится ошибкой, если указанное поколение не
     существует.

‘откат’
     Переключает на предыдущее поколение системы.  При следующей
     загрузке система будет использовать предыдущее.  Команда отменяет
     ‘reconfigure’, и делает то же самое, что ‘switch-generation’ с
     аргументом ‘-1’.

     В настоящее время, как и в случае с ‘switch-generation’, вы должны
     перезагрузиться после выполнения этого действия, чтобы фактически
     начать использовать предыдущее поколение системы.

‘delete-generations’
     Удаляет поколение, делая их кандидатами на для сборщика мусора
     (*note Вызов guix gc::, для получения информации о том, как
     запустить "сборщик мусора").

     Работает так же, как и ‘guix package --delete-generations’ (*note
     ‘--delete-generations’: Вызов guix package.).  Без аргументов
     удаляются все системные поколения, кроме текущего:

          guix system delete-generations

     You can also select the generations you want to delete.  The
     example below deletes all the system generations that are more than
     two months old:

          guix system delete-generations 2m

     Выполнение этой команды автоматически переустановит загрузчик с
     обновлением меню—например, подменю "old generations" в GRUB не
     будет содержать удаленные поколения.

‘build’
     Собирает деривацию операционной системы, которая включает в себя
     все файлы конфигурации и программы, необходимые для загрузки и
     запуска системы.  Это действие на самом деле ничего не
     устанавливает.

‘init’
     Наполняет указанную директорию всем необходимым для запуска
     операционной системы, указанным в ФАЙЛЕ.  Это полезно при первой
     установке системы Guix.  В качестве примера:

          guix system init my-os-config.scm /mnt

     копирует в ‘/mnt’ все элементы хранилища, необходимые для
     конфигурации, указанной в ‘my-os-config.scm’.  Включая файлы
     конфигурации, пакеты и так далее.  Он также создает другие важные
     файлы, необходимые для правильной работы системы, такие как
     каталоги ‘/etc’, ‘/var’ и ‘/run’ и файл ‘/bin/sh’.

     This command also installs bootloader on the targets specified in
     ‘my-os-config’, unless the ‘--no-bootloader’ option was passed.

‘installer’
     Run the installer.  Usually the installer is built as an ‘iso’
     image, copied to a USB Stick or DVD, and booted from (*note
     Установочная флеш и DVD::).  If your machine already runs Guix and
     you still want to run the installer, e.g., for testing purposes,
     you can skip the step of creating an ‘iso’ and run for instance:

          guix system installer --dry-run

          Примечание: If you do not use ‘--dry-run’ then you need to run
          as root.  Be _very careful_ when running the installer as
          root, it can cause data loss or render your system unbootable!

‘vm’
     Build a virtual machine (VM) that contains the operating system
     declared in FILE, and return a script to run that VM.

          Примечание: Параметры ‘vm’ и другие, приведенные ниже, могут
          использовать поддержку KVM ядра Linux-libre.  В частности,
          если машина поддерживает аппаратную виртуализацию,следует
          загрузить соответствующий модуль ядра KVM а файл устройства
          ‘/dev/kvm’ должен существовать и быть доступен для чтения и
          записи пользователю и процессамсборки демона (*note Установка
          окружения сборки::).

     Аргументы, переданные скрипту, передаются в QEMU, как в приведенном
     ниже примере,который включает сеть и запрашивает 1 GiB оперативной
     памяти для эмулируемоймашины:

          $ /gnu/store/...-run-vm.sh -m 1024 -smp 2 -nic user,model=virtio-net-pci

     It’s possible to combine the two steps into one:

          $ $(guix system vm my-config.scm) -m 1024 -smp 2 -nic user,model=virtio-net-pci

     Виртуальная машина использует свое хранилище совместно с
     хост-системой.

     By default, the root file system of the VM is mounted volatile; the
     ‘--persistent’ option can be provided to make it persistent
     instead.  In that case, the VM disk-image file will be copied from
     the store to the ‘TMPDIR’ directory to make it writable.

     Дополнительные файловые системы могут быть разделены между хостом и
     виртуальной машиной с помощью параметров ‘--share’ и ‘--expose’:
     первый указывает директорию, к которой должен быть предоставлен
     общий доступ с правом на запись, последний обеспечивает доступ
     только на чтение.

     Пример ниже создает виртуальную машину, которой доступна домашняя
     директория пользователя с правами на чтение, а директория
     ‘$HOME/tmp’ хоста размещена в ‘/exchange’ с правами на чтение и
     запись:

          guix system vm my-config.scm \
             --expose=$HOME --share=$HOME/tmp=/exchange

     В GNU / Linux по умолчанию загрузка выполняется непосредственно в
     ядро; это имеет преимущество в том, что требуется только очень
     крошечный образ корневого диска, так как затем можно смонтировать
     хранилище хоста.

     The ‘--full-boot’ option forces a complete boot sequence, starting
     with the bootloader.  This requires more disk space since a root
     image containing at least the kernel, initrd, and bootloader data
     files must be created.

     The ‘--image-size’ option can be used to specify the size of the
     image.

     The ‘--no-graphic’ option will instruct ‘guix system’ to spawn a
     headless VM that will use the invoking tty for IO. Among other
     things, this enables copy-pasting, and scrollback.  Use the
     ‘ctrl-a’ prefix to issue QEMU commands; e.g. ‘ctrl-a h’ prints a
     help, ‘ctrl-a x’ quits the VM, and ‘ctrl-a c’ switches between the
     QEMU monitor and the VM.

‘image’
     The ‘image’ command can produce various image types.  The image
     type can be selected using the ‘--image-type’ option.  It defaults
     to ‘mbr-hybrid-raw’.  When its value is ‘iso9660’, the ‘--label’
     option can be used to specify a volume ID with ‘image’.  By
     default, the root file system of a disk image is mounted
     non-volatile; the ‘--volatile’ option can be provided to make it
     volatile instead.  When using ‘image’, the bootloader installed on
     the generated image is taken from the provided ‘operating-system’
     definition.  The following example demonstrates how to generate an
     image that uses the ‘grub-efi-bootloader’ bootloader and boot it
     with QEMU:

          image=$(guix system image --image-type=qcow2 \
                  gnu/system/examples/lightweight-desktop.tmpl)
          cp $image /tmp/my-image.qcow2
          chmod +w /tmp/my-image.qcow2
          qemu-system-x86_64 -enable-kvm -hda /tmp/my-image.qcow2 -m 1000 \
                             -bios $(guix build ovmf-x86-64)/share/firmware/ovmf_x64.bin

     When using the ‘mbr-hybrid-raw’ image type, a raw disk image is
     produced; it can be copied as is to a USB stick, for instance.
     Assuming ‘/dev/sdc’ is the device corresponding to a USB stick, one
     can copy the image to it using the following command:

          # dd if=$(guix system image my-os.scm) of=/dev/sdc status=progress

     The ‘--list-image-types’ command lists all the available image
     types.

     When using the ‘qcow2’ image type, the returned image is in qcow2
     format, which the QEMU emulator can efficiently use.  *Note Запуск
     Guix на виртуальной машине::, for more information on how to run
     the image in a virtual machine.  The ‘grub-bootloader’ bootloader
     is always used independently of what is declared in the
     ‘operating-system’ file passed as argument.  This is to make it
     easier to work with QEMU, which uses the SeaBIOS BIOS by default,
     expecting a bootloader to be installed in the Master Boot Record
     (MBR). In case the virtual machine is going to be AArch64, you
     might want to take a look at ‘qcow2-gpt’ image type that installs
     bootloader only in EFI.

     When using the ‘docker’ image type, a Docker image is produced.
     Guix builds the image from scratch, not from a pre-existing Docker
     base image.  As a result, it contains _exactly_ what you define in
     the operating system configuration file.  You can then load the
     image and launch a Docker container using commands like the
     following:

          image_id="$(docker load < guix-system-docker-image.tar.gz)"
          container_id="$(docker create $image_id)"
          docker start $container_id

     This command starts a new Docker container from the specified
     image.  It will boot the Guix system in the usual manner, which
     means it will start any services you have defined in the operating
     system configuration.  You can get an interactive shell running in
     the container using ‘docker exec’:

          docker exec -ti $container_id /run/current-system/profile/bin/bash --login

     Depending on what you run in the Docker container, it may be
     necessary to give the container additional permissions.  For
     example, if you intend to build software using Guix inside of the
     Docker container, you may need to pass the ‘--privileged’ option to
     ‘docker create’.

     Last, the ‘--network’ option applies to ‘guix system docker-image’:
     it produces an image where network is supposedly shared with the
     host, and thus without services like nscd or NetworkManager.

‘container’
     Return a script to run the operating system declared in FILE within
     a container.  Containers are a set of lightweight isolation
     mechanisms provided by the kernel Linux-libre.  Containers are
     substantially less resource-demanding than full virtual machines
     since the kernel, shared objects, and other resources can be shared
     with the host system; this also means they provide thinner
     isolation.

     Currently, the script must be run as root in order to support more
     than a single user and group.  The container shares its store with
     the host system.

     As with the ‘vm’ action (*note guix system vm::), additional file
     systems to be shared between the host and container can be
     specified using the ‘--share’ and ‘--expose’ options:

          guix system container my-config.scm \
             --expose=$HOME --share=$HOME/tmp=/exchange

     The ‘--share’ and ‘--expose’ options can also be passed to the
     generated script to bind-mount additional directories into the
     container.

     The generated script also supports the ‘--pid-file’ option to write
     the container process ID to a file.  This can be used, along with
     ‘guix container exec’ to execute scripts within the container
     (*note Запуск guix container::).

          Примечание: The ‘container’ action requires Linux-libre 3.19
          or newer.

   OPTIONS can contain any of the common build options (*note
Стандартные параметры сборки::).  In addition, OPTIONS can contain one
of the following:

‘--expression=EXPR’
‘-e EXPR’
     Consider the operating-system EXPR evaluates to.  This is an
     alternative to specifying a file which evaluates to an operating
     system.  This is used to generate the Guix system installer *note
     Сборка установочного образа::).

‘--system=SYSTEM’
‘-s SYSTEM’
     Attempt to build for SYSTEM instead of the host system type.  This
     works as per ‘guix build’ (*note Запуск guix build::).

‘--target=TRIPLET’
     Cross-сборка для TRIPLET, который должен быть допустимым GNU
     triplet, например ‘\ "aarch64-linux-gnu\"’ (*note GNU configuration
     triplets: (autoconf)Specifying target triplets.).

‘--derivation’
‘-d’
     Return the derivation file name of the given operating system
     without building anything.

‘--save-provenance’
     As discussed above, ‘guix system init’ and ‘guix system
     reconfigure’ always save provenance information via a dedicated
     service (*note ‘provenance-service-type’: Интерфейс сервиса.).
     However, other commands don’t do that by default.  If you wish to,
     say, create a virtual machine image that contains provenance
     information, you can run:

          guix system image -t qcow2 --save-provenance config.scm

     That way, the resulting image will effectively “embed its own
     source” in the form of meta-data in ‘/run/current-system’.  With
     that information, one can rebuild the image to make sure it really
     contains what it pretends to contain; or they could use that to
     derive a variant of the image.

‘--target=TRIPLET’
‘-t TYPE’
     For the ‘image’ action, create an image with given TYPE.

     When this option is omitted, ‘guix system’ uses the
     ‘mbr-hybrid-raw’ image type.

     ‘--image-type=iso9660’ produces an ISO-9660 image, suitable for
     burning on CDs and DVDs.

‘--image-size=SIZE’
     Если задана MIN, остановиться, когда MIN байт собрано.  MIN может
     быть числом байт или может содержать единицу измерения в суффиксе,
     как например, ‘MiB’ для мебибайт и ‘GB’ гигабайт (*note size
     specifications: (coreutils)Block size.).

     When this option is omitted, ‘guix system’ computes an estimate of
     the image size as a function of the size of the system declared in
     FILE.

‘--network’
‘-N’
     For the ‘container’ action, allow containers to access the host
     network, that is, do not create a network namespace.

‘--root=FILE’
‘-r FILE’
     Make FILE a symlink to the result, and register it as a garbage
     collector root.

‘--skip-checks’
     Skip pre-installation safety checks.

     By default, ‘guix system init’ and ‘guix system reconfigure’
     perform safety checks: they make sure the file systems that appear
     in the ‘operating-system’ declaration actually exist (*note
     Файловые системы::), and that any Linux kernel modules that may be
     needed at boot time are listed in ‘initrd-modules’ (*note Начальный
     RAM-диск::).  Passing this option skips these tests altogether.

‘--allow-downgrades’
     Instruct ‘guix system reconfigure’ to allow system downgrades.

     By default, ‘reconfigure’ prevents you from downgrading your
     system.  It achieves that by comparing the provenance info of your
     system (shown by ‘guix system describe’) with that of your ‘guix’
     command (shown by ‘guix describe’).  If the commits for ‘guix’ are
     not descendants of those used for your system, ‘guix system
     reconfigure’ errors out.  Passing ‘--allow-downgrades’ allows you
     to bypass these checks.

          Примечание: Прежде чем использовать ‘--allow-downgrades’,
          убедитесь, что вы понимаете его последствия для безопасности.

‘--on-error=STRATEGY’
     Apply STRATEGY when an error occurs when reading FILE.  STRATEGY
     may be one of the following:

     ‘nothing-special’
          Report the error concisely and exit.  This is the default
          strategy.

     ‘backtrace’
          Likewise, but also display a backtrace.

     ‘debug’
          Report the error and enter Guile’s debugger.  From there, you
          can run commands such as ‘,bt’ to get a backtrace, ‘,locals’
          to display local variable values, and more generally inspect
          the state of the program.  *Note (guile)Debug Commands::, for
          a list of available debugging commands.

   Once you have built, configured, re-configured, and re-re-configured
your Guix installation, you may find it useful to list the operating
system generations available on disk—and that you can choose from the
bootloader boot menu:

‘describe’
     Describe the running system generation: its file name, the kernel
     and bootloader used, etc., as well as provenance information when
     available.

     The ‘--list-installed’ flag is available, with the same syntax that
     is used in ‘guix package --list-installed’ (*note Вызов guix
     package::).  When the flag is used, the description will include a
     list of packages that are currently installed in the system
     profile, with optional filtering based on a regular expression.

          Примечание: The _running_ system generation—referred to by
          ‘/run/current-system’—is not necessarily the _current_ system
          generation—referred to by ‘/var/guix/profiles/system’: it
          differs when, for instance, you chose from the bootloader menu
          to boot an older generation.

          It can also differ from the _booted_ system
          generation—referred to by ‘/run/booted-system’—for instance
          because you reconfigured the system in the meantime.

‘list-generations’
     List a summary of each generation of the operating system available
     on disk, in a human-readable way.  This is similar to the
     ‘--list-generations’ option of ‘guix package’ (*note Вызов guix
     package::).

     Optionally, one can specify a pattern, with the same syntax that is
     used in ‘guix package --list-generations’, to restrict the list of
     generations displayed.  For instance, the following command
     displays generations that are up to 10 days old:

          $ guix system list-generations 10d

     The ‘--list-installed’ flag may also be specified, with the same
     syntax that is used in ‘guix package --list-installed’.  This may
     be helpful if trying to determine when a package was added to the
     system.

   The ‘guix system’ command has even more to offer!  The following
sub-commands allow you to visualize how your system services relate to
each other:

‘extension-graph’
     Emit to standard output the “service extension graph” of the
     operating system defined in FILE (*note Структура сервисов::, for
     more information on service extensions).  By default the output is
     in Dot/Graphviz format, but you can choose a different format with
     ‘--graph-backend’, as with ‘guix graph’ (*note ‘--backend’: Запуск
     guix graph.):

     The command:

          $ guix system extension-graph FILE | xdot -

     shows the extension relations among services.

          Примечание: The ‘dot’ program is provided by the ‘graphviz’
          package.

‘shepherd-graph’
     Emit to standard output the “dependency graph” of shepherd services
     of the operating system defined in FILE.  *Note Сервисы Shepherd::,
     for more information and for an example graph.

     Again, the default output format is Dot/Graphviz, but you can pass
     ‘--graph-backend’ to select a different one.

   ---------- Footnotes ----------

   (1) Это действие (и связанные с ним ‘switch-generation’ и
‘roll-back’) можно использовать только в системах, в которых уже
работает Guix System.

