This is guix.ru.info, produced by makeinfo version 6.8 from
guix.ru.texi.

Copyright © 2012–2025 Ludovic Courtès
Copyright © 2013, 2014, 2016, 2024 Andreas Enge
Copyright © 2013 Nikita Karetnikov
Copyright © 2014, 2015, 2016 Alex Kost
Copyright © 2015, 2016 Mathieu Lirzin
Copyright © 2014 Pierre-Antoine Rault
Copyright © 2015 Taylan Ulrich Bayırlı/Kammer
Copyright © 2015, 2016, 2017, 2019, 2020, 2021, 2023, 2025 Leo Famulari
Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Ricardo
Wurmus
Copyright © 2016 Ben Woodcroft
Copyright © 2016, 2017, 2018, 2021 Chris Marusich
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2025 Efraim
Flashner
Copyright © 2016 John Darrington
Copyright © 2016, 2017 Nikita Gillmann
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025
Janneke Nieuwenhuizen
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Julien Lepiller
Copyright © 2016 Alex ter Weele
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Christopher Baines
Copyright © 2017, 2018, 2019 Clément Lassieur
Copyright © 2017, 2018, 2020, 2021, 2022 Mathieu Othacehe
Copyright © 2017 Federico Beffa
Copyright © 2017, 2018, 2024, 2025 Carlo Zancanaro
Copyright © 2017 Thomas Danckaert
Copyright © 2017 humanitiesNerd
Copyright © 2017, 2021 Christine Lemmer-Webber
Copyright © 2017, 2018, 2019, 2020, 2021, 2022 Marius Bakke
Copyright © 2017, 2019, 2020, 2022 Hartmut Goebel
Copyright © 2017, 2019–2025 Maxim Cournoyer
Copyright © 2017–2022 Tobias Geerinckx-Rice
Copyright © 2017 George Clemmer
Copyright © 2017 Andy Wingo
Copyright © 2017, 2018, 2019, 2020, 2023, 2024, 2025 Arun Isaac
Copyright © 2017 nee
Copyright © 2018 Rutger Helling
Copyright © 2018, 2021, 2023, 2025 Oleg Pykhalov
Copyright © 2018 Mike Gerwitz
Copyright © 2018 Pierre-Antoine Rouby
Copyright © 2018, 2019 Gábor Boskovits
Copyright © 2018, 2019, 2020, 2022, 2023, 2024 Florian Pelz
Copyright © 2018 Laura Lazzati
Copyright © 2018 Alex Vong
Copyright © 2019 Josh Holland
Copyright © 2019, 2020 Diego Nicola Barbato
Copyright © 2019 Ivan Petkov
Copyright © 2019 Jakob L. Kreuze
Copyright © 2019 Kyle Andrews
Copyright © 2019 Alex Griffin
Copyright © 2019, 2020, 2021, 2022 Guillaume Le Vaillant
Copyright © 2020 Liliana Marie Prikler
Copyright © 2019, 2020, 2021, 2022, 2023 Simon Tournier
Copyright © 2020 Wiktor Żelazny
Copyright © 2020 Damien Cassou
Copyright © 2020 Jakub Kądziołka
Copyright © 2020 Jack Hill
Copyright © 2020 Naga Malleswari
Copyright © 2020, 2021 Brice Waegeneire
Copyright © 2020 R Veera Kumar
Copyright © 2020, 2021, 2022 Pierre Langlois
Copyright © 2020 pinoaffe
Copyright © 2020, 2023 André Batista
Copyright © 2020, 2021 Alexandru-Sergiu Marton
Copyright © 2020 raingloom
Copyright © 2020 Daniel Brooks
Copyright © 2020 John Soo
Copyright © 2020 Jonathan Brielmaier
Copyright © 2020 Edgar Vincent
Copyright © 2021, 2022 Maxime Devos
Copyright © 2021 B. Wilson
Copyright © 2021 Xinglu Chen
Copyright © 2021 Raghav Gururajan
Copyright © 2021 Domagoj Stolfa
Copyright © 2021 Hui Lu
Copyright © 2021 pukkamustard
Copyright © 2021 Alice Brenon
Copyright © 2021-2023 Josselin Poiret
Copyright © 2021, 2023 muradm
Copyright © 2021, 2022 Andrew Tropin
Copyright © 2021 Sarah Morgensen
Copyright © 2022 Remco van ’t Veer
Copyright © 2022 Aleksandr Vityazev
Copyright © 2022 Philip M^{c}Grath
Copyright © 2022 Karl Hallsby
Copyright © 2022 Justin Veilleux
Copyright © 2022 Reily Siegel
Copyright © 2022 Simon Streit
Copyright © 2022 (
Copyright © 2022 John Kehayias
Copyright © 2022⁠–⁠2023 Bruno Victal
Copyright © 2022 Ivan Vilata-i-Balaguer
Copyright © 2023-2025 Giacomo Leidi
Copyright © 2022 Antero Mejr
Copyright © 2023 Karl Hallsby
Copyright © 2023 Nathaniel Nicandro
Copyright © 2023 Tanguy Le Carrour
Copyright © 2023-2024 Zheng Junjie
Copyright © 2023 Brian Cully
Copyright © 2023 Felix Lechner
Copyright © 2023 Foundation Devices, Inc.
Copyright © 2023 Thomas Ieong
Copyright © 2023 Saku Laesvuori
Copyright © 2023 Graham James Addis
Copyright © 2023-2025 Tomas Volf
Copyright © 2024, 2025 Herman Rimm
Copyright © 2024 Matthew Trzcinski
Copyright © 2024 Richard Sent
Copyright © 2024 Dariqq
Copyright © 2024 Denis ’GNUtoo’ Carikli
Copyright © 2024 Fabio Natali
Copyright © 2024 Arnaud Daby-Seesaram
Copyright © 2024-2025 Nigko Yerden
Copyright © 2024 Troy Figiel
Copyright © 2024 Sharlatan Hellseher
Copyright © 2024 45mg
Copyright © 2024 Greg Hogan
Copyright © 2025 Sören Tempel
Copyright © 2025 Rostislav Svoboda
Copyright © 2025 Zacchaeus
Copyright © 2025 Sergio Pastor Pérez
Copyright © 2024 Evgeny Pisemsky
Copyright © 2025 jgart
Copyright © 2025 Artur Wroblewski
Copyright © 2025 Edouard Klein
Copyright © 2025 Rodion Goritskov
Copyright © 2025 dan
Copyright © 2025 Noé Lopez

   Разрешено копирование, распространение и/или модификация этого
документа на условиях лицензии свободной документации GNU (GNU FDL)
версии 1.3 или любой более поздней версии, опубликованной Фондом
свободного программного обеспечения (FSF), исключая неизменяемые секции,
исключая тексты, размещенные на переплёте и задней стороне обложки.
Копия лицензии включена в документ в разделе под названием "GNU Free
Documentation Licens".
INFO-DIR-SECTION Администрирование системы
START-INFO-DIR-ENTRY
* Guix.ru: (guix.ru).        Управление установленным ПО и настройка
                               системы.
* guix package: (guix.ru)Запуск guix package.  Установка, удаление и
                                                 обновление пакетов.
* guix gc: (guix.ru)Запуск guix gc.  Освобождение неиспользуемого места на
                                       диске.
* guix pull: (guix.ru)Запуск guix pull.  Обновление списка доступных
                                           пакетов.
* guix system: (guix.ru)Запуск guix system.  Управление конфигурацией ОС.
* guix deploy: (guix.ru)Запуск guix deploy.  Управление конфигурациями ОС на
                                               удалённых машинах.
END-INFO-DIR-ENTRY

INFO-DIR-SECTION Разработка программного обеспечения
START-INFO-DIR-ENTRY
* guix shell: (guix.ru)Запуск guix shell.  Creating software environments.
* guix environment: (guix.ru)Запуск guix environment.  Сборка среды
                                                         разработки с помощью
                                                         Guix.
* guix build: (guix.ru)Запуск guix build.  Сборка пакетов.
* guix pack: (guix.ru)Запуск guix pack.  Создание бинарных пакетов.
END-INFO-DIR-ENTRY


File: guix.ru.info,  Node: Сервисы мониторинга,  Next: Сервисы Kerberos,  Prev: File-Sharing Services,  Up: Сервисы

11.10.17 Сервисы мониторинга
----------------------------

Darkstat Service
................

Darkstat is a packet sniffer that captures network traffic, calculates
statistics about usage, and serves reports over HTTP.

 -- Variable: darkstat-service-type
     This is the service type for the darkstat
     (https://unix4lyfe.org/darkstat/) service, its value must be a
     ‘darkstat-configuration’ record as in this example:

          (service darkstat-service-type
                   (darkstat-configuration
                     (interface "eno1")))

 -- Data Type: darkstat-configuration
     Data type representing the configuration of ‘darkstat’.

     ‘package’ (default: ‘darkstat’)
          The darkstat package to use.

     ‘interface’
          Capture traffic on the specified network interface.

     ‘port’ (default: ‘"667"’)
          Bind the web interface to the specified port.

     ‘bind-address’ (default: ‘"127.0.0.1"’)
          Bind the web interface to the specified address.

     ‘base’ (default: ‘"/"’)
          Specify the path of the base URL.  This can be useful if
          ‘darkstat’ is accessed via a reverse proxy.

Prometheus Node Exporter Service
................................

The Prometheus “node exporter” makes hardware and operating system
statistics provided by the Linux kernel available for the Prometheus
monitoring system.  This service should be deployed on all physical
nodes and virtual machines, where monitoring these statistics is
desirable.

 -- Variable: prometheus-node-exporter-service-type
     This is the service type for the prometheus-node-exporter
     (https://github.com/prometheus/node_exporter/) service, its value
     must be a ‘prometheus-node-exporter-configuration’.

          (service openssh-service-type)

 -- Data Type: prometheus-node-exporter-configuration
     Data type representing the configuration of ‘node_exporter’.

     ‘package’ (default: ‘go-github-com-prometheus-node-exporter’)
          The prometheus-node-exporter package to use.

     ‘web-listen-address’ (default: ‘":9100"’)
          Bind the web interface to the specified address.

     ‘port’ (default: ‘22’)
          This directory can be used to export metrics specific to this
          machine.  Files containing metrics in the text format, with
          the filename ending in ‘.prom’ should be placed in this
          directory.

     ‘extra-options’ (default: ‘'()’)
          Extra options to pass to the Prometheus node exporter.

vnStat Network Traffic Monitor
..............................

vnStat is a network traffic monitor that uses interface statistics
provided by the kernel rather than traffic sniffing.  This makes it a
light resource monitor, regardless of network traffic rate.

 -- Variable: vnstat-service-type
     This is the service type for the vnStat (https://humdi.net/vnstat/)
     daemon and accepts a ‘vnstat-configuration’ value.

     The following example will configure the service with default
     values:

          (service vnstat-service-type)

 -- Data Type: vnstat-configuration
     Доступными полями ‘vnstat-configuration’ являются:

     ‘package’ (default: ‘vnstat’) (type: file-like)
          The vnstat package.

     ‘database-directory’ (default: ‘"/var/lib/vnstat"’) (type: string)
          Specifies the directory where the database is to be stored.  A
          full path must be given and a leading ’/’ isn’t required.

     ‘5-minute-hours’ (default: ‘48’) (type: maybe-integer)
          Data retention duration for the 5 minute resolution entries.
          The configuration defines for how many past hours entries will
          be stored.  Set to ‘-1’ for unlimited entries or to ‘0’ to
          disable the data collection of this resolution.

     ‘64bit-interface-counters’ (default: ‘-2’) (type: maybe-integer)
          Select interface counter handling.  Set to ‘1’ for defining
          that all interfaces use 64-bit counters on the kernel side and
          ‘0’ for defining 32-bit counter.  Set to ‘-1’ for using the
          old style logic used in earlier versions where counter values
          within 32-bits are assumed to be 32-bit and anything larger is
          assumed to be a 64-bit counter.  This may produce false
          results if a 64-bit counter is reset within the 32-bits.  Set
          to ‘-2’ for using automatic detection based on available
          kernel datastructures.

     ‘always-add-new-interfaces?’ (default: ‘#t’) (type: maybe-boolean)
          Enable or disable automatic creation of new database entries
          for interfaces not currently in the database even if the
          database file already exists when the daemon is started.  New
          database entries will also get created for new interfaces seen
          while the daemon is running.  Pseudo interfaces ‘lo’, ‘lo0’
          and ‘sit0’ are always excluded from getting added.

     ‘bandwidth-detection?’ (default: ‘#t’) (type: maybe-boolean)
          Try to automatically detect MAX-BANDWIDTH value for each
          monitored interface.  Mostly only ethernet interfaces support
          this feature.  MAX-BANDWIDTH will be used as fallback value if
          detection fails.  Any interface specific MAX-BW configuration
          will disable the detection for the specified interface.  In
          Linux, the detection is disabled for tun interfaces due to the
          Linux kernel always reporting 10 Mbit regardless of the used
          real interface.

     ‘bandwidth-detection-interval’ (default: ‘5’) (type: maybe-integer)
          How often in minutes interface specific detection of
          MAX-BANDWIDTH is done for detecting possible changes when
          BANDWIDTH-DETECTION is enabled.  Can be disabled by setting to
          ‘0’.  Value range: ‘0’..‘30’

     ‘boot-variation’ (default: ‘15’) (type: maybe-integer)
          Time in seconds how much the boot time reported by system
          kernel can variate between updates.  Value range: ‘0’..‘300’

     ‘check-disk-space?’ (default: ‘#t’) (type: maybe-boolean)
          Enable or disable the availability check of at least some free
          disk space before a database write.

     ‘create-directories?’ (default: ‘#t’) (type: maybe-boolean)
          Enable or disable the creation of directories when a
          configured path doesn’t exist.  This includes
          DATABASE-DIRECTORY.

     ‘daemon-group’ (type: maybe-user-group)
          Specify the group to which the daemon process should switch
          during startup.  Set to ‘%unset-value’ to disable group
          switching.

     ‘daemon-user’ (type: maybe-user-account)
          Specify the user to which the daemon process should switch
          during startup.  Set to ‘%unset-value’ to disable user
          switching.

     ‘daily-days’ (default: ‘62’) (type: maybe-integer)
          Data retention duration for the one day resolution entries.
          The configuration defines for how many past days entries will
          be stored.  Set to ‘-1’ for unlimited entries or to ‘0’ to
          disable the data collection of this resolution.

     ‘database-synchronous’ (default: ‘-1’) (type: maybe-integer)
          Change the setting of the SQLite "synchronous" flag which
          controls how much care is taken to ensure disk writes have
          fully completed when writing data to the database before
          continuing other actions.  Higher values take extra steps to
          ensure data safety at the cost of slower performance.  A value
          of ‘0’ will result in all handling being left to the
          filesystem itself.  Set to ‘-1’ to select the default value
          according to database mode controlled by
          DATABASE-WRITE-AHEAD-LOGGING setting.  See SQLite
          documentation for more details regarding values from ‘1’ to
          ‘3’.  Value range: ‘-1’..‘3’

     ‘database-write-ahead-logging?’ (default: ‘#f’) (type: maybe-boolean)
          Enable or disable SQLite Write-Ahead Logging mode for the
          database.  See SQLite documentation for more details and note
          that support for read-only operations isn’t available in older
          SQLite versions.

     ‘hourly-days’ (default: ‘4’) (type: maybe-integer)
          Data retention duration for the one hour resolution entries.
          The configuration defines for how many past days entries will
          be stored.  Set to ‘-1’ for unlimited entries or to ‘0’ to
          disable the data collection of this resolution.

     ‘log-file’ (type: maybe-string)
          Specify log file path and name to be used if USE-LOGGING is
          set to ‘1’.

     ‘max-bandwidth’ (type: maybe-integer)
          Maximum bandwidth for all interfaces.  If the interface
          specific traffic exceeds the given value then the data is
          assumed to be invalid and rejected.  Set to 0 in order to
          disable the feature.  Value range: ‘0’..‘50000’

     ‘max-bw’ (type: maybe-alist)
          Same as MAX-BANDWIDTH but can be used for setting individual
          limits for selected interfaces.  This is an association list
          of interfaces as strings to integer values.  For example,
               (max-bw `(("eth0" .  15000)
                         ("ppp0" .  10000)))
          BANDWIDTH-DETECTION is disabled on an interface specific level
          for each MAX-BW configuration.  Value range: ‘0’..‘50000’

     ‘monthly-months’ (default: ‘25’) (type: maybe-integer)
          Data retention duration for the one month resolution entries.
          The configuration defines for how many past months entries
          will be stored.  Set to ‘-1’ for unlimited entries or to ‘0’
          to disable the data collection of this resolution.

     ‘month-rotate’ (default: ‘1’) (type: maybe-integer)
          Day of month that months are expected to change.  Usually set
          to 1 but can be set to alternative values for example for
          tracking monthly billed traffic where the billing period
          doesn’t start on the first day.  For example, if set to 7,
          days of February up to and including the 6th will count for
          January.  Changing this option will not cause existing data to
          be recalculated.  Value range: ‘1’..‘28’

     ‘month-rotate-affects-years?’ (default: ‘#f’) (type: maybe-boolean)
          Enable or disable MONTH-ROTATE also affecting yearly data.
          Applicable only when MONTH-ROTATE has a value greater than
          one.

     ‘offline-save-interval’ (default: ‘30’) (type: maybe-integer)
          How often in minutes cached interface data is saved to file
          when all monitored interfaces are offline.  Value range:
          SAVE-INTERVAL..‘60’

     ‘pid-file’ (default: ‘"/var/run/vnstatd.pid"’) (type: maybe-string)
          Specify pid file path and name to be used.

     ‘poll-interval’ (default: ‘5’) (type: maybe-integer)
          How often in seconds interfaces are checked for status
          changes.  Value range: ‘2’..‘60’

     ‘rescan-database-on-save?’ (type: maybe-boolean)
          Automatically discover added interfaces from the database and
          start monitoring.  The rescan is done every SAVE-INTERVAL or
          OFFLINE-SAVE-INTERVAL minutes depending on the current
          activity state.

     ‘save-interval’ (default: ‘5’) (type: maybe-integer)
          How often in minutes cached interface data is saved to file.
          Value range: ( UPDATE-INTERVAL / 60 )..‘60’

     ‘save-on-status-change?’ (default: ‘#t’) (type: maybe-boolean)
          Enable or disable the additional saving to file of cached
          interface data when the availability of an interface changes,
          i.e., when an interface goes offline or comes online.

     ‘time-sync-wait’ (default: ‘5’) (type: maybe-integer)
          How many minutes to wait during daemon startup for system
          clock to sync if most recent database update appears to be in
          the future.  This may be needed in systems without a real-time
          clock (RTC) which require some time after boot to query and
          set the correct time.  ‘0’ = wait disabled.  Value range:
          ‘0’..‘60’

     ‘top-day-entries’ (default: ‘20’) (type: maybe-integer)
          Data retention duration for the top day entries.  The
          configuration defines how many of the past top day entries
          will be stored.  Set to ‘-1’ for unlimited entries or to ‘0’
          to disable the data collection of this resolution.

     ‘trafficless-entries?’ (default: ‘#t’) (type: maybe-boolean)
          Create database entries even when there is no traffic during
          the entry’s time period.

     ‘update-file-owner?’ (default: ‘#t’) (type: maybe-boolean)
          Enable or disable the update of file ownership during daemon
          process startup.  During daemon startup, only database, log
          and pid files will be modified if the user or group change
          feature ( DAEMON-USER or DAEMON-GROUP ) is enabled and the
          files don’t match the requested user or group.  During manual
          database creation, this option will cause file ownership to be
          inherited from the database directory if the directory already
          exists.  This option only has effect when the process is
          started as root or via sudo.

     ‘update-interval’ (default: ‘20’) (type: maybe-integer)
          How often in seconds the interface data is updated.  Value
          range: POLL-INTERVAL..‘300’

     ‘use-logging’ (default: ‘2’) (type: maybe-integer)
          Enable or disable logging.  Accepted values are: ‘0’ =
          disabled, ‘1’ = logfile and ‘2’ = syslog.

     ‘use-utc?’ (type: maybe-boolean)
          Enable or disable using UTC as timezone in the database for
          all entries.  When enabled, all entries added to the database
          will use UTC regardless of the configured system timezone.
          When disabled, the configured system timezone will be used.
          Changing this setting will not result in already existing data
          to be modified.

     ‘yearly-years’ (default: ‘-1’) (type: maybe-integer)
          Data retention duration for the one year resolution entries.
          The configuration defines for how many past years entries will
          be stored.  Set to ‘-1’ for unlimited entries or to ‘0’ to
          disable the data collection of this resolution.

Zabbix server
.............

Zabbix is a high performance monitoring system that can collect data
from a variety of sources and provide the results in a web-based
interface.  Alerting and reporting is built-in, as well as “templates”
for common operating system metrics such as network utilization, CPU
load, and disk space consumption.

   This service provides the central Zabbix monitoring service; you also
need *note ‘zabbix-front-end-service-type’: zabbix-front-end. to
configure Zabbix and display results, and optionally *note
‘zabbix-agent-service-type’: zabbix-agent. on machines that should be
monitored (other data sources are supported, such as *note Prometheus
Node Exporter: prometheus-node-exporter.).

 -- Variable: zabbix-server-service-type
     This is the service type for the Zabbix server service.  Its value
     must be a ‘zabbix-server-configuration’ record, shown below.

 -- Data Type: zabbix-server-configuration
     Available ‘zabbix-server-configuration’ fields are:

     ‘zabbix-server’ (default: ‘zabbix-server’) (type: file-like)
          The zabbix-server package.

     ‘user’ (default: ‘"zabbix"’) (type: string)
          User who will run the Zabbix server.

     ‘group’ (default: ‘"zabbix"’) (type: string)
          Group who will run the Zabbix server.

     ‘db-host’ (default: ‘"127.0.0.1"’) (type: string)
          Database host name.

     ‘db-name’ (default: ‘"zabbix"’) (type: string)
          Database name.

     ‘db-user’ (default: ‘"zabbix"’) (type: string)
          Database user.

     ‘db-password’ (default: ‘""’) (type: string)
          Database password.  Please, use ‘include-files’ with
          ‘DBPassword=SECRET’ inside a specified file instead.

     ‘db-port’ (default: ‘5432’) (type: number)
          Database port.

     ‘log-type’ (default: ‘""’) (type: string)
          Specifies where log messages are written to:

             • ‘system’ - syslog.

             • ‘file’ - file specified with ‘log-file’ parameter.

             • ‘console’ - standard output.

     ‘log-file’ (default: ‘"/var/log/zabbix/server.log"’) (type: string)
          Log file name for ‘log-type’ ‘file’ parameter.

     ‘pid-file’ (default: ‘"/var/run/zabbix/zabbix_server.pid"’) (type: string)
          Name of PID file.

     ‘ssl-ca-location’ (default: ‘"/etc/ssl/certs/ca-certificates.crt"’) (type: string)
          The location of certificate authority (CA) files for SSL
          server certificate verification.

     ‘ssl-cert-location’ (default: ‘"/etc/ssl/certs"’) (type: string)
          Location of SSL client certificates.

     ‘extra-options’ (default: ‘""’) (type: extra-options)
          Extra options will be appended to Zabbix server configuration
          file.

     ‘include-files’ (default: ‘'()’) (type: include-files)
          You may include individual files or all files in a directory
          in the configuration file.

Zabbix agent
............

The Zabbix agent gathers information about the running system for the
Zabbix monitoring server.  It has a variety of built-in checks, and can
be extended with custom “user parameters”
(https://www.zabbix.com/documentation/current/en/manual/config/items/userparameters).

 -- Variable: zabbix-agent-service-type
     This is the service type for the Zabbix agent service.  Its value
     must be a ‘zabbix-agent-configuration’ record, shown below.

 -- Data Type: zabbix-agent-configuration
     Available ‘zabbix-agent-configuration’ fields are:

     ‘zabbix-agent’ (default: ‘zabbix-agentd’) (type: file-like)
          The zabbix-agent package.

     ‘user’ (default: ‘"zabbix"’) (type: string)
          User who will run the Zabbix agent.

     ‘group’ (default: ‘"zabbix"’) (type: string)
          Group who will run the Zabbix agent.

     ‘hostname’ (default: ‘""’) (type: string)
          Unique, case sensitive hostname which is required for active
          checks and must match hostname as configured on the server.

     ‘log-type’ (default: ‘""’) (type: string)
          Specifies where log messages are written to:

             • ‘system’ - syslog.

             • ‘file’ - file specified with ‘log-file’ parameter.

             • ‘console’ - standard output.

     ‘log-file’ (default: ‘"/var/log/zabbix/agent.log"’) (type: string)
          Log file name for ‘log-type’ ‘file’ parameter.

     ‘pid-file’ (default: ‘"/var/run/zabbix/zabbix_agent.pid"’) (type: string)
          Name of PID file.

     ‘server’ (default: ‘'("127.0.0.1")’) (type: list)
          List of IP addresses, optionally in CIDR notation, or
          hostnames of Zabbix servers and Zabbix proxies.  Incoming
          connections will be accepted only from the hosts listed here.

     ‘server-active’ (default: ‘'("127.0.0.1")’) (type: list)
          List of IP:port (or hostname:port) pairs of Zabbix servers and
          Zabbix proxies for active checks.  If port is not specified,
          default port is used.  If this parameter is not specified,
          active checks are disabled.

     ‘extra-options’ (default: ‘""’) (type: extra-options)
          Extra options will be appended to Zabbix server configuration
          file.

     ‘include-files’ (default: ‘'()’) (type: include-files)
          You may include individual files or all files in a directory
          in the configuration file.

Zabbix front-end
................

The Zabbix front-end provides a web interface to Zabbix.  It does not
need to run on the same machine as the Zabbix server.  This service
works by extending the *note PHP-FPM:: and *note NGINX:: services with
the configuration necessary for loading the Zabbix user interface.

 -- Variable: zabbix-front-end-service-type
     This is the service type for the Zabbix web frontend.  Its value
     must be a ‘zabbix-front-end-configuration’ record, shown below.

 -- Data Type: zabbix-front-end-configuration
     Available ‘zabbix-front-end-configuration’ fields are:

     ‘zabbix-server’ (default: ‘zabbix-server’) (type: file-like)
          The Zabbix server package to use.

     ‘nginx’ (default: ‘'()’) (type: list)
          List of *note ‘nginx-server-configuration’:
          nginx-server-configuration. blocks for the Zabbix front-end.
          When empty, a default that listens on port 80 is used.

     ‘db-host’ (default: ‘"localhost"’) (type: string)
          Database host name.

     ‘db-port’ (default: ‘5432’) (type: number)
          Database port.

     ‘db-name’ (default: ‘"zabbix"’) (type: string)
          Database name.

     ‘db-user’ (default: ‘"zabbix"’) (type: string)
          Database user.

     ‘db-password’ (default: ‘""’) (type: string)
          Database password.  Please, use ‘db-secret-file’ instead.

     ‘db-secret-file’ (default: ‘""’) (type: string)
          Secret file which will be appended to ‘zabbix.conf.php’ file.
          This file contains credentials for use by Zabbix front-end.
          You are expected to create it manually.

     ‘zabbix-host’ (default: ‘"localhost"’) (type: string)
          Zabbix server hostname.

     ‘zabbix-port’ (default: ‘10051’) (type: number)
          Zabbix server port.


File: guix.ru.info,  Node: Сервисы Kerberos,  Next: LDAP Сервисы,  Prev: Сервисы мониторинга,  Up: Сервисы

11.10.18 Сервисы Kerberos
-------------------------

The ‘(gnu services kerberos)’ module provides services relating to the
authentication protocol “Kerberos”.

Krb5 Service
............

Programs using a Kerberos client library normally expect a configuration
file in ‘/etc/krb5.conf’.  This service generates such a file from a
definition provided in the operating system declaration.  It does not
cause any daemon to be started.

   No “keytab” files are provided by this service—you must explicitly
create them.  This service is known to work with the MIT client library,
‘mit-krb5’.  Other implementations have not been tested.

 -- Variable: krb5-service-type
     A service type for Kerberos 5 clients.

Here is an example of its use:
     (service krb5-service-type
              (krb5-configuration
               (default-realm "EXAMPLE.COM")
               (allow-weak-crypto? #t)
               (realms (list
                        (krb5-realm
                         (name "EXAMPLE.COM")
                         (admin-server "groucho.example.com")
                         (kdc "karl.example.com"))
                        (krb5-realm
                         (name "ARGRX.EDU")
                         (admin-server "kerb-admin.argrx.edu")
                         (kdc "keys.argrx.edu"))))))

This example provides a Kerberos 5 client configuration which:
   • Recognizes two realms, viz: “EXAMPLE.COM” and “ARGRX.EDU”, both of
     which have distinct administration servers and key distribution
     centers;
   • Will default to the realm “EXAMPLE.COM” if the realm is not
     explicitly specified by clients;
   • Accepts services which only support encryption types known to be
     weak.

   The ‘krb5-realm’ and ‘krb5-configuration’ types have many fields.
Only the most commonly used ones are described here.  For a full list,
and more detailed explanation of each, see the MIT krb5.conf
documentation.

 -- Data Type: krb5-realm
     ‘name’
          This field is a string identifying the name of the realm.  A
          common convention is to use the fully qualified DNS name of
          your organization, converted to upper case.

     ‘admin-server’
          This field is a string identifying the host where the
          administration server is running.

     ‘kdc’
          This field is a string identifying the key distribution center
          for the realm.

 -- Data Type: krb5-configuration

     ‘allow-weak-crypto?’ (default: ‘#f’)
          If this flag is ‘#t’ then services which only offer encryption
          algorithms known to be weak will be accepted.

     ‘default-realm’ (default: ‘#f’)
          This field should be a string identifying the default Kerberos
          realm for the client.  You should set this field to the name
          of your Kerberos realm.  If this value is ‘#f’ then a realm
          must be specified with every Kerberos principal when invoking
          programs such as ‘kinit’.

     ‘realms’
          This should be a non-empty list of ‘krb5-realm’ objects, which
          clients may access.  Normally, one of them will have a ‘name’
          field matching the ‘default-realm’ field.

PAM krb5 Service
................

The ‘pam-krb5’ service allows for login authentication and password
management via Kerberos.  You will need this service if you want PAM
enabled applications to authenticate users using Kerberos.

 -- Variable: pam-krb5-service-type
     A service type for the Kerberos 5 PAM module.

 -- Data Type: pam-krb5-configuration
     Data type representing the configuration of the Kerberos 5 PAM
     module.  This type has the following parameters:
     ‘pam-krb5’ (default: ‘pam-krb5’)
          The pam-krb5 package to use.

     ‘minimum-uid’ (default: ‘1000’)
          The smallest user ID for which Kerberos authentications should
          be attempted.  Local accounts with lower values will silently
          fail to authenticate.


File: guix.ru.info,  Node: LDAP Сервисы,  Next: Веб-сервисы,  Prev: Сервисы Kerberos,  Up: Сервисы

11.10.19 LDAP Сервисы
---------------------

Authentication against LDAP with nslcd
......................................

The ‘(gnu services authentication)’ module provides the
‘nslcd-service-type’, which can be used to authenticate against an LDAP
server.  In addition to configuring the service itself, you may want to
add ‘ldap’ as a name service to the Name Service Switch.  *Note
Переключатель службы имен:: for detailed information.

   Here is a simple operating system declaration with a default
configuration of the ‘nslcd-service-type’ and a Name Service Switch
configuration that consults the ‘ldap’ name service last:

     (use-service-modules authentication)
     (use-modules (gnu system nss))
     ...
     (operating-system
       ...
       (services
         (cons*
           (service nslcd-service-type)
           (service dhcp-client-service-type)
           %base-services))
       (name-service-switch
        (let ((services (list (name-service (name "db"))
                              (name-service (name "files"))
                              (name-service (name "ldap")))))
          (name-service-switch
           (inherit %mdns-host-lookup-nss)
           (password services)
           (shadow   services)
           (group    services)
           (netgroup services)
           (gshadow  services)))))

   Available ‘nslcd-configuration’ fields are:

 -- nslcd-configuration parameter: package nss-pam-ldapd
     The ‘nss-pam-ldapd’ package to use.

 -- nslcd-configuration parameter: maybe-number threads
     The number of threads to start that can handle requests and perform
     LDAP queries.  Each thread opens a separate connection to the LDAP
     server.  The default is to start 5 threads.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: string uid
     This specifies the user id with which the daemon should be run.

     Defaults to ‘"nslcd"’.

 -- nslcd-configuration parameter: string gid
     This specifies the group id with which the daemon should be run.

     Defaults to ‘"nslcd"’.

 -- nslcd-configuration parameter: log-option log
     This option controls the way logging is done via a list containing
     SCHEME and LEVEL.  The SCHEME argument may either be the symbols
     ‘none’ or ‘syslog’, or an absolute file name.  The LEVEL argument
     is optional and specifies the log level.  The log level may be one
     of the following symbols: ‘crit’, ‘error’, ‘warning’, ‘notice’,
     ‘info’ or ‘debug’.  All messages with the specified log level or
     higher are logged.

     Defaults to ‘'("/var/log/nslcd" info)’.

 -- nslcd-configuration parameter: list uri
     The list of LDAP server URIs.  Normally, only the first server will
     be used with the following servers as fall-back.

     Defaults to ‘'("ldap://localhost:389/")’.

 -- nslcd-configuration parameter: maybe-string ldap-version
     The version of the LDAP protocol to use.  The default is to use the
     maximum version supported by the LDAP library.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string binddn
     Specifies the distinguished name with which to bind to the
     directory server for lookups.  The default is to bind anonymously.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string bindpw
     Specifies the credentials with which to bind.  This option is only
     applicable when used with binddn.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string rootpwmoddn
     Specifies the distinguished name to use when the root user tries to
     modify a user’s password using the PAM module.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string rootpwmodpw
     Specifies the credentials with which to bind if the root user tries
     to change a user’s password.  This option is only applicable when
     used with rootpwmoddn

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string sasl-mech
     Specifies the SASL mechanism to be used when performing SASL
     authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string sasl-realm
     Specifies the SASL realm to be used when performing SASL
     authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string sasl-authcid
     Specifies the authentication identity to be used when performing
     SASL authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string sasl-authzid
     Specifies the authorization identity to be used when performing
     SASL authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean sasl-canonicalize?
     Determines whether the LDAP server host name should be
     canonicalised.  If this is enabled the LDAP library will do a
     reverse host name lookup.  By default, it is left up to the LDAP
     library whether this check is performed or not.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string krb5-ccname
     Set the name for the GSS-API Kerberos credentials cache.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: string base
     The directory search base.

     Defaults to ‘"dc=example,dc=com"’.

 -- nslcd-configuration parameter: scope-option scope
     Specifies the search scope (subtree, onelevel, base or children).
     The default scope is subtree; base scope is almost never useful for
     name service lookups; children scope is not supported on all
     servers.

     Defaults to ‘'(subtree)’.

 -- nslcd-configuration parameter: maybe-deref-option deref
     Specifies the policy for dereferencing aliases.  The default policy
     is to never dereference aliases.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean referrals
     Specifies whether automatic referral chasing should be enabled.
     The default behaviour is to chase referrals.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: list-of-map-entries maps
     This option allows for custom attributes to be looked up instead of
     the default RFC 2307 attributes.  It is a list of maps, each
     consisting of the name of a map, the RFC 2307 attribute to match
     and the query expression for the attribute as it is available in
     the directory.

     Defaults to ‘'()’.

 -- nslcd-configuration parameter: list-of-filter-entries filters
     A list of filters consisting of the name of a map to which the
     filter applies and an LDAP search filter expression.

     Defaults to ‘'()’.

 -- nslcd-configuration parameter: maybe-number bind-timelimit
     Specifies the time limit in seconds to use when connecting to the
     directory server.  The default value is 10 seconds.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number timelimit
     Specifies the time limit (in seconds) to wait for a response from
     the LDAP server.  A value of zero, which is the default, is to wait
     indefinitely for searches to be completed.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number idle-timelimit
     Specifies the period if inactivity (in seconds) after which the
     con‐ nection to the LDAP server will be closed.  The default is not
     to time out connections.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number reconnect-sleeptime
     Specifies the number of seconds to sleep when connecting to all
     LDAP servers fails.  By default one second is waited between the
     first failure and the first retry.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number reconnect-retrytime
     Specifies the time after which the LDAP server is considered to be
     permanently unavailable.  Once this time is reached retries will be
     done only once per this time period.  The default value is 10
     seconds.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-ssl-option ssl
     Specifies whether to use SSL/TLS or not (the default is not to).
     If ’start-tls is specified then StartTLS is used rather than raw
     LDAP over SSL.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-tls-reqcert-option tls-reqcert
     Specifies what checks to perform on a server-supplied certificate.
     The meaning of the values is described in the ldap.conf(5) manual
     page.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-cacertdir
     Specifies the directory containing X.509 certificates for peer
     authen‐ tication.  This parameter is ignored when using GnuTLS.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-cacertfile
     Specifies the path to the X.509 certificate for peer
     authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-randfile
     Specifies the path to an entropy source.  This parameter is ignored
     when using GnuTLS.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-ciphers
     Specifies the ciphers to use for TLS as a string.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-cert
     Specifies the path to the file containing the local certificate for
     client TLS authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string tls-key
     Specifies the path to the file containing the private key for
     client TLS authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number pagesize
     Set this to a number greater than 0 to request paged results from
     the LDAP server in accordance with RFC2696.  The default (0) is to
     not request paged results.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-ignore-users-option
          nss-initgroups-ignoreusers
     This option prevents group membership lookups through LDAP for the
     specified users.  Alternatively, the value ’all-local may be used.
     With that value nslcd builds a full list of non-LDAP users on
     startup.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number nss-min-uid
     This option ensures that LDAP users with a numeric user id lower
     than the specified value are ignored.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number nss-uid-offset
     This option specifies an offset that is added to all LDAP numeric
     user ids.  This can be used to avoid user id collisions with local
     users.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-number nss-gid-offset
     This option specifies an offset that is added to all LDAP numeric
     group ids.  This can be used to avoid user id collisions with local
     groups.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean nss-nested-groups
     If this option is set, the member attribute of a group may point to
     another group.  Members of nested groups are also returned in the
     higher level group and parent groups are returned when finding
     groups for a specific user.  The default is not to perform extra
     searches for nested groups.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean
          nss-getgrent-skipmembers
     If this option is set, the group member list is not retrieved when
     looking up groups.  Lookups for finding which groups a user belongs
     to will remain functional so the user will likely still get the
     correct groups assigned on login.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean nss-disable-enumeration
     If this option is set, functions which cause all user/group entries
     to be loaded from the directory will not succeed in doing so.  This
     can dramatically reduce LDAP server load in situations where there
     are a great number of users and/or groups.  This option is not
     recommended for most configurations.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string validnames
     This option can be used to specify how user and group names are
     verified within the system.  This pattern is used to check all user
     and group names that are requested and returned from LDAP.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean ignorecase
     This specifies whether or not to perform searches using
     case-insensitive matching.  Enabling this could open up the system
     to authorization bypass vulnerabilities and introduce nscd cache
     poisoning vulnerabilities which allow denial of service.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-boolean pam-authc-ppolicy
     This option specifies whether password policy controls are
     requested and handled from the LDAP server when performing user
     authentication.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string pam-authc-search
     By default nslcd performs an LDAP search with the user’s
     credentials after BIND (authentication) to ensure that the BIND
     operation was successful.  The default search is a simple check to
     see if the user’s DN exists.  A search filter can be specified that
     will be used instead.  It should return at least one entry.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string pam-authz-search
     This option allows flexible fine tuning of the authorisation check
     that should be performed.  The search filter specified is executed
     and if any entries match, access is granted, otherwise access is
     denied.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: maybe-string
          pam-password-prohibit-message
     If this option is set password modification using pam_ldap will be
     denied and the specified message will be presented to the user
     instead.  The message can be used to direct the user to an
     alternative means of changing their password.

     Defaults to ‘disabled’.

 -- nslcd-configuration parameter: list pam-services
     List of pam service names for which LDAP authentication should
     suffice.

     Defaults to ‘'()’.

LDAP Directory Server
.....................

The ‘(gnu services ldap)’ module provides the
‘directory-server-service-type’, which can be used to create and launch
an LDAP server instance.

   Вот пример конфигурации ‘directory-server-service-type’:

     (use-service-modules ldap)

     ...
     (operating-system
       ...
       (services
         (cons
           (service directory-server-service-type
                    (directory-server-instance-configuration
                     (slapd
                      (slapd-configuration
                       (root-password "{PBKDF2_SHA256}AAAgAG...ABSOLUTELYSECRET")))))
           %base-services)))

   The root password should be generated with the ‘pwdhash’ utility that
is provided by the ‘389-ds-base’ package.

   Note that changes to the directory server configuration will not be
applied to existing instances.  You will need to back up and restore
server data manually.  Only new directory server instances will be
created upon system reconfiguration.

 -- Data Type: directory-server-instance-configuration
     Доступными полями ‘directory-server-instance-configuration’
     являются:

     ‘package’ (default: ‘389-ds-base’) (type: file-like)
          The ‘389-ds-base’ package.

     ‘config-version’ (default: ‘2’) (type: number)
          Sets the format version of the configuration file.  To use the
          INF file with ‘dscreate’, this parameter must be 2.

     ‘full-machine-name’ (default: ‘"localhost"’) (type: string)
          Sets the fully qualified hostname (FQDN) of this system.

     ‘selinux’ (default: ‘#false’) (type: boolean)
          Enables SELinux detection and integration during the
          installation of this instance.  If set to ‘#true’, ‘dscreate’
          auto-detects whether SELinux is enabled.

     ‘strict-host-checking’ (default: ‘#true’) (type: boolean)
          Sets whether the server verifies the forward and reverse
          record set in the ‘full-machine-name’ parameter.  When
          installing this instance with GSSAPI authentication behind a
          load balancer, set this parameter to ‘#false’.

     ‘systemd’ (default: ‘#false’) (type: boolean)
          Enables systemd platform features.  If set to ‘#true’,
          ‘dscreate’ auto-detects whether systemd is installed.

     ‘slapd’ (type: slapd-configuration)
          Configuration of slapd.

           -- Data Type: slapd-configuration
               Доступными полями ‘slapd-configuration’ являются:

               ‘instance-name’ (default: ‘"localhost"’) (type: string)
                    Sets the name of the instance.  You can refer to
                    this value in other parameters of this INF file
                    using the ‘{instance_name}’ variable.  Note that
                    this name cannot be changed after the installation!

               ‘user’ (default: ‘"dirsrv"’) (type: string)
                    Sets the user name the ns-slapd process will use
                    after the service started.

               ‘group’ (default: ‘"dirsrv"’) (type: string)
                    Sets the group name the ns-slapd process will use
                    after the service started.

               ‘port’ (default: ‘389’) (type: number)
                    Sets the TCP port the instance uses for LDAP
                    connections.

               ‘secure-port’ (default: ‘636’) (type: number)
                    Sets the TCP port the instance uses for TLS-secured
                    LDAP connections (LDAPS).

               ‘root-dn’ (default: ‘"cn=Directory Manager"’) (type: string)
                    Sets the “Distinquished Name” (DN) of the
                    administrator account for this instance.

               ‘root-password’ (default: ‘"{invalid}YOU-SHOULD-CHANGE-THIS"’) (type: string)
                    Sets the password of the account specified in the
                    ‘root-dn’ parameter.  You can either set this
                    parameter to a plain text password ‘dscreate’ hashes
                    during the installation or to a "{algorithm}hash"
                    string generated by the ‘pwdhash’ utility.  Note
                    that setting a plain text password can be a security
                    risk if unprivileged users can read this INF file!

               ‘self-sign-cert’ (default: ‘#true’) (type: boolean)
                    Sets whether the setup creates a self-signed
                    certificate and enables TLS encryption during the
                    installation.  This is not suitable for production,
                    but it enables administrators to use TLS right after
                    the installation.  You can replace the self-signed
                    certificate with a certificate issued by a
                    certificate authority.

               ‘self-sign-cert-valid-months’ (default: ‘24’) (type: number)
                    Set the number of months the issued self-signed
                    certificate will be valid.

               ‘backup-dir’ (default: ‘"/var/lib/dirsrv/slapd-{instance_name}/bak"’) (type: string)
                    Set the backup directory of the instance.

               ‘cert-dir’ (default: ‘"/etc/dirsrv/slapd-{instance_name}"’) (type: string)
                    Sets the directory of the instance’s Network
                    Security Services (NSS) database.

               ‘config-dir’ (default: ‘"/etc/dirsrv/slapd-{instance_name}"’) (type: string)
                    Sets the configuration directory of the instance.

               ‘db-dir’ (default: ‘"/var/lib/dirsrv/slapd-{instance_name}/db"’) (type: string)
                    Sets the database directory of the instance.

               ‘initconfig-dir’ (default: ‘"/etc/dirsrv/registry"’) (type: string)
                    Sets the directory of the operating system’s rc
                    configuration directory.

               ‘ldif-dir’ (default: ‘"/var/lib/dirsrv/slapd-{instance_name}/ldif"’) (type: string)
                    Sets the LDIF export and import directory of the
                    instance.

               ‘lock-dir’ (default: ‘"/var/lock/dirsrv/slapd-{instance_name}"’) (type: string)
                    Sets the lock directory of the instance.

               ‘log-dir’ (default: ‘"/var/log/dirsrv/slapd-{instance_name}"’) (type: string)
                    Sets the log directory of the instance.

               ‘run-dir’ (default: ‘"/run/dirsrv"’) (type: string)
                    Sets PID directory of the instance.

               ‘schema-dir’ (default: ‘"/etc/dirsrv/slapd-{instance_name}/schema"’) (type: string)
                    Sets schema directory of the instance.

               ‘tmp-dir’ (default: ‘"/tmp"’) (type: string)
                    Sets the temporary directory of the instance.

     ‘backend-userroot’ (type: backend-userroot-configuration)
          Configuration of the userroot backend.

           -- Data Type: backend-userroot-configuration
               Доступными полями ‘backend-userroot-configuration’
               являются:

               ‘create-suffix-entry?’ (default: ‘#false’) (type: boolean)
                    Set this parameter to ‘#true’ to create a generic
                    root node entry for the suffix in the database.

               ‘require-index?’ (default: ‘#false’) (type: boolean)
                    Set this parameter to ‘#true’ to refuse unindexed
                    searches in this database.

               ‘sample-entries’ (default: ‘"no"’) (type: string)
                    Set this parameter to ‘"yes"’ to add latest version
                    of sample entries to this database.  Or, use
                    ‘"001003006"’ to use the 1.3.6 version sample
                    entries.  Use this option, for example, to create a
                    database for testing purposes.

               ‘suffix’ (type: maybe-string)
                    Sets the root suffix stored in this database.  If
                    you do not set the suffix attribute the install
                    process will not create the backend/suffix.  You can
                    also create multiple backends/suffixes by
                    duplicating this section.


File: guix.ru.info,  Node: Веб-сервисы,  Next: High Availability Services,  Prev: LDAP Сервисы,  Up: Сервисы

11.10.20 Веб-сервисы
--------------------

The ‘(gnu services web)’ module provides the Apache HTTP Server, the
nginx web server, and also a fastcgi wrapper daemon.

Apache HTTP Server
..................

 -- Variable: httpd-service-type
     Service type for the Apache HTTP (https://httpd.apache.org/) server
     (“httpd”).  The value for this service type is a
     ‘httpd-configuration’ record.

     A simple example configuration is given below.

          (service httpd-service-type
                   (httpd-configuration
                     (config
                       (httpd-config-file
                         (server-name "www.example.com")
                         (document-root "/srv/http/www.example.com")))))

     Other services can also extend the ‘httpd-service-type’ to add to
     the configuration.

          (simple-service 'www.example.com-server httpd-service-type
                          (list
                            (httpd-virtualhost
                              "*:80"
                              (list (string-join '("ServerName www.example.com"
                                                   "DocumentRoot /srv/http/www.example.com")
                                                 "\n")))))

   The details for the ‘httpd-configuration’, ‘httpd-module’,
‘httpd-config-file’ and ‘httpd-virtualhost’ record types are given
below.

 -- Data Type: httpd-configuration
     This data type represents the configuration for the httpd service.

     ‘package’ (default: ‘httpd’)
          The httpd package to use.

     ‘pid-file’ (default: ‘"/var/run/httpd"’)
          The pid file used by the shepherd-service.

     ‘config’ (default: ‘(httpd-config-file)’)
          The configuration file to use with the httpd service.  The
          default value is a ‘httpd-config-file’ record, but this can
          also be a different G-expression that generates a file, for
          example a ‘plain-file’.  A file outside of the store can also
          be specified through a string.

 -- Data Type: httpd-module
     This data type represents a module for the httpd service.

     ‘name’
          The name of the module.

     ‘file’
          The file for the module.  This can be relative to the httpd
          package being used, the absolute location of a file, or a
          G-expression for a file within the store, for example
          ‘(file-append mod-wsgi "/modules/mod_wsgi.so")’.

 -- Variable: %default-httpd-modules
     A default list of ‘httpd-module’ objects.

 -- Data Type: httpd-config-file
     This data type represents a configuration file for the httpd
     service.

     ‘modules’ (default: ‘%default-httpd-modules’)
          The modules to load.  Additional modules can be added here, or
          loaded by additional configuration.

          For example, in order to handle requests for PHP files, you
          can use Apache’s ‘mod_proxy_fcgi’ module along with
          ‘php-fpm-service-type’:

               (service httpd-service-type
                        (httpd-configuration
                         (config
                          (httpd-config-file
                           (modules (cons*
                                     (httpd-module
                                      (name "proxy_module")
                                      (file "modules/mod_proxy.so"))
                                     (httpd-module
                                      (name "proxy_fcgi_module")
                                      (file "modules/mod_proxy_fcgi.so"))
                                     %default-httpd-modules))
                           (extra-config (list "\
               <FilesMatch \\.php$>
                   SetHandler \"proxy:unix:/var/run/php-fpm.sock|fcgi://localhost/\"
               </FilesMatch>"))))))
               (service php-fpm-service-type
                        (php-fpm-configuration
                         (socket "/var/run/php-fpm.sock")
                         (socket-group "httpd")))

     ‘server-root’ (default: ‘httpd’)
          The ‘ServerRoot’ in the configuration file, defaults to the
          httpd package.  Directives including ‘Include’ and
          ‘LoadModule’ are taken as relative to the server root.

     ‘server-name’ (default: ‘#f’)
          The ‘ServerName’ in the configuration file, used to specify
          the request scheme, hostname and port that the server uses to
          identify itself.

          This doesn’t need to be set in the server config, and can be
          specified in virtual hosts.  The default is ‘#f’ to not
          specify a ‘ServerName’.

     ‘document-root’ (default: ‘"/srv/http"’)
          The ‘DocumentRoot’ from which files will be served.

     ‘listen’ (default: ‘'("80")’)
          The list of values for the ‘Listen’ directives in the config
          file.  The value should be a list of strings, when each string
          can specify the port number to listen on, and optionally the
          IP address and protocol to use.

     ‘pid-file’ (default: ‘"/var/run/httpd"’)
          The ‘PidFile’ to use.  This should match the ‘pid-file’ set in
          the ‘httpd-configuration’ so that the Shepherd service is
          configured correctly.

     ‘error-log’ (default: ‘"/var/log/httpd/error_log"’)
          The ‘ErrorLog’ to which the server will log errors.

     ‘user’ (default: ‘"httpd"’)
          The ‘User’ which the server will answer requests as.

     ‘group’ (default: ‘"httpd"’)
          The ‘Group’ which the server will answer requests as.

     ‘extra-config’ (default: ‘(list "TypesConfig etc/httpd/mime.types")’)
          A flat list of strings and G-expressions which will be added
          to the end of the configuration file.

          Any values which the service is extended with will be appended
          to this list.

 -- Data Type: httpd-virtualhost
     This data type represents a virtualhost configuration block for the
     httpd service.

     These should be added to the extra-config for the httpd-service.

          (simple-service 'www.example.com-server httpd-service-type
                          (list
                            (httpd-virtualhost
                              "*:80"
                              (list (string-join '("ServerName www.example.com"
                                                    "DocumentRoot /srv/http/www.example.com")
                                                 "\n")))))

     ‘addresses-and-ports’
          The addresses and ports for the ‘VirtualHost’ directive.

     ‘contents’
          The contents of the ‘VirtualHost’ directive, this should be a
          list of strings and G-expressions.

NGINX
.....

 -- Variable: nginx-service-type
     Service type for the NGinx (https://nginx.org/) web server.  The
     value for this service type is a ‘<nginx-configuration>’ record.

     A simple example configuration is given below.

          (service nginx-service-type
                   (nginx-configuration
                     (server-blocks
                       (list (nginx-server-configuration
                               (server-name '("www.example.com"))
                               (root "/srv/http/www.example.com"))))))

     In addition to adding server blocks to the service configuration
     directly, this service can be extended by other services to add
     server blocks, as in this example:

          (simple-service 'my-extra-server nginx-service-type
                          (list (nginx-server-configuration
                                  (root "/srv/http/extra-website")
                                  (try-files (list "$uri" "$uri/index.html")))))

   At startup, ‘nginx’ has not yet read its configuration file, so it
uses a default file to log error messages.  If it fails to load its
configuration file, that is where error messages are logged.  After the
configuration file is loaded, the default error log file changes as per
configuration.  In our case, startup error messages can be found in
‘/var/run/nginx/logs/error.log’, and after configuration in
‘/var/log/nginx/error.log’.  The second location can be changed with the
LOG-DIRECTORY configuration option.

 -- Data Type: nginx-configuration
     This data type represents the configuration for NGinx.  Some
     configuration can be done through this and the other provided
     record types, or alternatively, a config file can be provided.

     ‘nginx’ (default: ‘nginx’)
          The nginx package to use.

     ‘shepherd-requirement’ (default: ‘'()’)
          This is a list of symbols naming Shepherd services the nginx
          service will depend on.

          This is useful if you would like ‘nginx’ to be started after a
          back-end web server or a logging service such as Anonip has
          been started.

     ‘log-directory’ (default: ‘"/var/log/nginx"’)
          The directory to which NGinx will write log files.

     ‘log-format’ (default: ‘'combined’) (type: symbol)
          Logging format for the access log.  Nginx defaults to the
          httpd-like format named ‘'combined’.  Other formats can be
          defined using ‘log-formats’.

     ‘log-formats’ (default: ‘'()’)
          A list of additional “log formats” to define, the elements
          should be of type ‘<nginx-log-format-configuration>’.

     ‘log-level’ (default: ‘'error’) (type: symbol)
          Logging level for the error log, which can be any of the
          following values: ‘'debug’, ‘'info’, ‘'notice’, ‘'warn’,
          ‘'error’, ‘'crit’, ‘'alert’, or ‘'emerg’.

     ‘run-directory’ (default: ‘"/var/run/nginx"’)
          The directory in which NGinx will create a pid file, and write
          temporary files.

     ‘server-blocks’ (default: ‘'()’)
          A list of “server blocks” to create in the generated
          configuration file, the elements should be of type
          ‘<nginx-server-configuration>’.

          The following example would setup NGinx to serve
          ‘www.example.com’ from the ‘/srv/http/www.example.com’
          directory, without using HTTPS.
               (service nginx-service-type
                        (nginx-configuration
                          (server-blocks
                            (list (nginx-server-configuration
                                    (server-name '("www.example.com"))
                                    (root "/srv/http/www.example.com"))))))

     ‘upstream-blocks’ (default: ‘'()’)
          A list of “upstream blocks” to create in the generated
          configuration file, the elements should be of type
          ‘<nginx-upstream-configuration>’.

          Configuring upstreams through the ‘upstream-blocks’ can be
          useful when combined with ‘locations’ in the
          ‘<nginx-server-configuration>’ records.  The following example
          creates a server configuration with one location
          configuration, that will proxy requests to a upstream
          configuration, which will handle requests with two servers.

               (service
                 nginx-service-type
                 (nginx-configuration
                   (server-blocks
                     (list (nginx-server-configuration
                             (server-name '("www.example.com"))
                             (root "/srv/http/www.example.com")
                             (locations
                               (list
                                 (nginx-location-configuration
                                 (uri "/path1")
                                 (body '("proxy_pass http://server-proxy;"))))))))
                   (upstream-blocks
                     (list (nginx-upstream-configuration
                             (name "server-proxy")
                             (servers (list "server1.example.com"
                                            "server2.example.com")))))))

     ‘file’ (default: ‘#f’)
          If a configuration FILE is provided, this will be used, rather
          than generating a configuration file from the provided
          ‘log-directory’, ‘run-directory’, ‘server-blocks’ and
          ‘upstream-blocks’.  For proper operation, these arguments
          should match what is in FILE to ensure that the directories
          are created when the service is activated.

          This can be useful if you have an existing configuration file,
          or it’s not possible to do what is required through the other
          parts of the nginx-configuration record.

     ‘server-names-hash-bucket-size’ (default: ‘#f’)
          Bucket size for the server names hash tables, defaults to ‘#f’
          to use the size of the processors cache line.

     ‘server-names-hash-bucket-max-size’ (default: ‘#f’)
          Maximum bucket size for the server names hash tables.

     ‘stream’ (default: ‘#f’)
          ‘<nginx-stream-configuration>’ object describing stream server
          directives.

     ‘modules’ (по умолчанию: ‘'()’)
          List of nginx dynamic modules to load.  This should be a list
          of file names of loadable modules, as in this example:

               (modules
                (list
                 (file-append nginx-accept-language-module "\
               /etc/nginx/modules/ngx_http_accept_language_module.so")
                 (file-append nginx-lua-module "\
               /etc/nginx/modules/ngx_http_lua_module.so")))

     ‘native-search-paths’ (default: ‘'()’)
          List of nginx lua packages to load.  This should be a list of
          package names of loadable lua modules, as in this example:

               (lua-package-path (list lua-resty-core
                                       lua-resty-lrucache
                                       lua-resty-signal
                                       lua-tablepool
                                       lua-resty-shell))

     ‘native-search-paths’ (default: ‘'()’)
          List of nginx lua C packages to load.  This should be a list
          of package names of loadable lua C modules, as in this
          example:

               (lua-package-cpath (list lua-resty-signal))

     ‘features’ (default: ‘'()’)
          Association list of global directives for the top level of the
          nginx configuration.  Values may themselves be association
          lists.

               (global-directives
                `((worker_processes . 16)
                  (pcre_jit . on)
                  (events . ((worker_connections . 1024)))))

     ‘extra-content’ (default: ‘""’)
          Additional content to be appended to the ‘http’ block.  Can
          either be a value that can be lowered into a string or a list
          of such values.  In the former case, it is inserted directly.
          In the latter, it is prefixed with indentation and suffixed
          with a newline.  Nested lists are flattened into one line.

               (extra-content "include /etc/nginx/custom-config.conf;")
               (extra-content `("include /etc/nginx/custom-config.conf;"
                                ("include " ,%custom-config.conf ";")))

 -- Data Type: nginx-log-format-configuration
     Data type representing the configuration of a custom Nginx log
     format.  This type has the following parameters:

     ‘name’ (type: symbol)
          The name of the log format as a symbol.

     ‘escape’ (default: ‘'default’) (type: symbol)
          The mode used to escape values of variables in the format.
          The supported values are:

             • ‘'default’, to escape all characters outside of the ASCII
               printable range.
             • ‘'json’, to escape all characters invalid in JSON
               strings.
             • ‘'none’, to disable escaping.

     ‘format’ (type: string)
          The format as accepted by the ‘log_format’ directive.

 -- Data Type: nginx-server-configuration
     Data type representing the configuration of an nginx server block.
     This type has the following parameters:

     ‘listen’ (default: ‘'("80" "443 ssl")’)
          Each ‘listen’ directive sets the address and port for IP, or
          the path for a UNIX-domain socket on which the server will
          accept requests.  Both address and port, or only address or
          only port can be specified.  An address may also be a
          hostname, for example:

               '("127.0.0.1:8000" "127.0.0.1" "8000" "*:8000" "localhost:8000")

     ‘server-name’ (default: ‘(list 'default)’)
          A list of server names this server represents.  ‘'default’
          represents the default server for connections matching no
          other server.

     ‘root’ (default: ‘"/srv/http"’)
          Root of the website nginx will serve.

     ‘locations’ (default: ‘'()’)
          A list of “nginx-location-configuration” or
          “nginx-named-location-configuration” records to use within
          this server block.

     ‘index’ (default: ‘(list "index.html")’)
          Index files to look for when clients ask for a directory.  If
          it cannot be found, Nginx will send the list of files in the
          directory.

     ‘try-files’ (default: ‘'()’)
          A list of files whose existence is checked in the specified
          order.  ‘nginx’ will use the first file it finds to process
          the request.

     ‘ssl-certificate’ (default: ‘#f’)
          Where to find the certificate for secure connections.  Set it
          to ‘#f’ if you don’t have a certificate or you don’t want to
          use HTTPS.

     ‘ssl-certificate-key’ (default: ‘#f’)
          Where to find the private key for secure connections.  Set it
          to ‘#f’ if you don’t have a key or you don’t want to use
          HTTPS.

     ‘server-tokens?’ (default: ‘#f’)
          Whether the server should add its configuration to response.

     ‘raw-content’ (default: ‘'()’)
          A list of strings or file-like objects to be appended to the
          server block.  Each item is prefixed with indentation and
          suffixed with a new line.  Nested lists are flattened.

 -- Data Type: nginx-upstream-configuration
     Data type representing the configuration of an nginx ‘upstream’
     block.  This type has the following parameters:

     ‘name’
          Name for this group of servers.

     ‘servers’
          Specify the addresses of the servers in the group.  The
          address can be specified as a IP address (e.g. ‘127.0.0.1’),
          domain name (e.g. ‘backend1.example.com’) or a path to a UNIX
          socket using the prefix ‘unix:’.  For addresses using an IP
          address or domain name, the default port is 80, and a
          different port can be specified explicitly.

     ‘extra-content’
          Additional content to be appended to the upstream block.  Can
          be a string or file-like object or list of thereof.  In case
          of list, each item is prefixed with indentation and suffixed
          with a new line.  Nested lists are flattened.

               (extra-content "include /etc/nginx/custom-config.conf;")
               (extra-content `("include /etc/nginx/custom-config.conf;"
                                ("include " ,%custom-config.conf ";")))

 -- Data Type: nginx-location-configuration
     Data type representing the configuration of an nginx ‘location’
     block.  This type has the following parameters:

     ‘uri’
          URI which this location block matches.

     ‘body’
          Body of the location block, specified as a list of strings or
          file-like objects.  Each item is prefixed with indentation and
          suffixed with a new line.  Nested lists are flattened.

          For example, to pass requests to a upstream server group
          defined using an ‘nginx-upstream-configuration’ block, the
          following directive would be specified in the body ‘(list
          "proxy_pass http://upstream-name;")’.

 -- Data Type: nginx-named-location-configuration
     Data type representing the configuration of an nginx named location
     block.  Named location blocks are used for request redirection, and
     not used for regular request processing.  This type has the
     following parameters:

     ‘name’
          Name to identify this location block.

     ‘body’
          *Note nginx-location-configuration body::, as the body for
          named location blocks can be used in a similar way to the
          ‘nginx-location-configuration body’.  One restriction is that
          the body of a named location block cannot contain location
          blocks.

 -- Data Type: nginx-stream-configuration
     Data type representing the configuration file context in which
     stream directives are specified.  This type has the following
     parameters:

     ‘upstream-blocks’ (default: ‘'()’)
          A list of upstream blocks to create in the generated
          configuration file, the elements should be of type
          ‘<nginx-upstream-configuration>’.

     ‘server-blocks’ (default: ‘'()’)
          A list of server blocks to create in the generated
          configuration file, the elements should be of type
          ‘<nginx-server-configuration>’.

     ‘extra-content’ (default: ‘'()’)
          Additional content to be appended to the ‘stream’ block.  Can
          either be a value that can be lowered into a string or a list
          of such values.  In the former case, it is inserted directly.
          In the latter, it is prefixed with indentation and suffixed
          with a newline.  Nested lists are flattened into one line.

Varnish Cache
.............

Varnish is a fast cache server that sits in between web applications and
end users.  It proxies requests from clients and caches the accessed
URLs such that multiple requests for the same resource only creates one
request to the back-end.

 -- Variable: varnish-service-type
     Service type for the Varnish daemon.

 -- Data Type: varnish-configuration
     Data type representing the ‘varnish’ service configuration.  This
     type has the following parameters:

     ‘package’ (default: ‘varnish’)
          The Varnish package to use.

     ‘name’ (default: ‘"default"’)
          A name for this Varnish instance.  Varnish will create a
          directory in ‘/var/varnish/’ with this name and keep temporary
          files there.  If the name starts with a forward slash, it is
          interpreted as an absolute directory name.

          Pass the ‘-n’ argument to other Varnish programs to connect to
          the named instance, e.g. ‘varnishncsa -n default’.

     ‘backend’ (default: ‘"localhost:8080"’)
          The backend to use.  This option has no effect if ‘vcl’ is
          set.

     ‘vcl’ (default: #f)
          The “VCL” (Varnish Configuration Language) program to run.  If
          this is ‘#f’, Varnish will proxy ‘backend’ using the default
          configuration.  Otherwise this must be a file-like object with
          valid VCL syntax.

          For example, to mirror www.gnu.org (https://www.gnu.org) with
          VCL you can do something along these lines:

               (define %gnu-mirror
                 (plain-file "gnu.vcl"
                             "vcl 4.1;
               backend gnu { .host = \"www.gnu.org\"; }"))

               (operating-system
                 ;; ...
                 (services (cons (service varnish-service-type
                                          (varnish-configuration
                                           (listen '(":80"))
                                           (vcl %gnu-mirror)))
                                 %base-services)))

          The configuration of an already running Varnish instance can
          be inspected and changed using the ‘varnishadm’ program.

          Consult the Varnish User Guide
          (https://varnish-cache.org/docs/) and Varnish Book
          (https://book.varnish-software.com/4.0/) for comprehensive
          documentation on Varnish and its configuration language.

     ‘listen’ (default: ‘'("localhost:80")’)
          List of addresses Varnish will listen on.

     ‘storage’ (default: ‘'("malloc,128m")’)
          List of storage backends that will be available in VCL.

     ‘parameters’ (default: ‘'()’)
          List of run-time parameters in the form ‘'(("parameter" .
          "value"))’.

     ‘extra-options’ (default: ‘'()’)
          Additional arguments to pass to the ‘varnishd’ process.

Whoogle Search
--------------

Whoogle Search (https://github.com/benbusby/whoogle-search) is a
self-hosted, ad-free, privacy-respecting meta search engine that
collects and displays Google search results.  By default, you can
configure it by adding this line to the ‘services’ field of your
operating system declaration:

     (service whoogle-service-type)

   As a result, Whoogle Search runs as local Web server, which you can
access by opening ‘http://localhost:5000’ in your browser.  The
configuration reference is given below.

 -- Variable: whoogle-service-type
     Service type for Whoogle Search.  Its value must be a
     ‘whoogle-configuration’ record—see below.

 -- Data Type: whoogle-configuration
     Data type representing Whoogle Search service configuration.

     ‘package’ (default: ‘whoogle-search’)
          The Whoogle Search package to use.

     ‘speed’ (default: ‘1.0’)
          The host address to run Whoogle on.

     ‘port’ (default: ‘5000’)
          The port where Whoogle will be exposed.

     ‘environment-variables’ (default: ‘'()’)
          A list of strings with the environment variables to configure
          Whoogle.  You can consult its environment variables template
          (https://github.com/benbusby/whoogle-search/blob/main/whoogle.template.env)
          for the list of available options.

Patchwork
.........

Patchwork is a patch tracking system.  It can collect patches sent to a
mailing list, and display them in a web interface.

 -- Variable: patchwork-service-type
     Поделитесь своей работой.

   The following example is an example of a minimal service for
Patchwork, for the ‘patchwork.example.com’ domain.

     (service patchwork-service-type
              (patchwork-configuration
               (domain "patchwork.example.com")
               (settings-module
                (patchwork-settings-module
                 (allowed-hosts (list domain))
                 (default-from-email "patchwork@patchwork.example.com")))
               (getmail-retriever-config
                (getmail-retriever-configuration
                 (type "SimpleIMAPSSLRetriever")
                 (server "imap.example.com")
                 (port 993)
                 (username "patchwork")
                 (password-command
                  (list (file-append coreutils "/bin/cat")
                        "/etc/getmail-patchwork-imap-password"))
                 (extra-parameters
                 '((mailboxes . ("Patches"))))))))


   There are three records for configuring the Patchwork service.  The
‘<patchwork-configuration>’ relates to the configuration for Patchwork
within the HTTPD service.

   The ‘settings-module’ field within the ‘<patchwork-configuration>’
record can be populated with the ‘<patchwork-settings-module>’ record,
which describes a settings module that is generated within the Guix
store.

   For the ‘database-configuration’ field within the
‘<patchwork-settings-module>’, the ‘<patchwork-database-configuration>’
must be used.

 -- Data Type: patchwork-configuration
     Data type representing the Patchwork service configuration.  This
     type has the following parameters:

     ‘port’ (default: ‘22’)
          Используемый пакет Patchwork.

     ‘domain’
          The domain to use for Patchwork, this is used in the HTTPD
          service virtual host.

     ‘settings-module’
          The settings module to use for Patchwork.  As a Django
          application, Patchwork is configured with a Python module
          containing the settings.  This can either be an instance of
          the ‘<patchwork-settings-module>’ record, any other record
          that represents the settings in the store, or a directory
          outside of the store.

     ‘port’ (default: ‘22’)
          The path under which the HTTPD service should serve the static
          files.

     ‘getmail-retriever-config’
          The getmail-retriever-configuration record value to use with
          Patchwork.  Getmail will be configured with this value, the
          messages will be delivered to Patchwork.

 -- Data Type: patchwork-settings-module
     Data type representing a settings module for Patchwork.  Some of
     these settings relate directly to Patchwork, but others relate to
     Django, the web framework used by Patchwork, or the Django Rest
     Framework library.  This type has the following parameters:

     ‘database-configuration’ (default: ‘(patchwork-database-configuration)’)
          The database connection settings used for Patchwork.  See the
          ‘<patchwork-database-configuration>’ record type for more
          information.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          Patchwork, as a Django web application uses a secret key for
          cryptographically signing values.  This file should contain a
          unique unpredictable value.

          If this file does not exist, it will be created and populated
          with a random value by the patchwork-setup shepherd service.

          This setting relates to Django.

     ‘allowed-hosts’
          A list of valid hosts for this Patchwork service.  This should
          at least include the domain specified in the
          ‘<patchwork-configuration>’ record.

          This is a Django setting.

     ‘default-from-email’
          The email address from which Patchwork should send email by
          default.

          This is a Patchwork setting.

     ‘features’ (default: ‘'()’)
          The URL to use when serving static assets.  It can be part of
          a URL, or a full URL, but must end in a ‘/’.

          If the default value is used, the ‘static-path’ value from the
          ‘<patchwork-configuration>’ record will be used.

          This is a Django setting.

     ‘features’ (default: ‘'()’)
          Email addresses to send the details of errors that occur.
          Each value should be a list containing two elements, the name
          and then the email address.

          This is a Django setting.

     ‘debug?’ (default: ‘#f’)
          Whether to run Patchwork in debug mode.  If set to ‘#t’,
          detailed error messages will be shown.

          This is a Django setting.

     ‘features’ (default: ‘'()’)
          Whether to enable the Patchwork REST API.

          This is a Patchwork setting.

     ‘port’ (default: ‘22’)
          Whether to enable the XML RPC API.

          This is a Patchwork setting.

     ‘port’ (default: ‘22’)
          Whether to use HTTPS links on Patchwork pages.

          This is a Patchwork setting.

     ‘extra-settings’ (default: ‘""’)
          Extra code to place at the end of the Patchwork settings
          module.

 -- Data Type: patchwork-database-configuration
     Data type representing the database configuration for Patchwork.

     ‘port’ (default: ‘22’)
          The database engine to use.

     ‘port’ (default: ‘22’)
          Имя используемой базы данных.

     ‘user’ (default: ‘"httpd"’)
          The user to connect to the database as.

     ‘port’ (default: ‘22’)
          The password to use when connecting to the database.

     ‘port’ (default: ‘22’)
          The host to make the database connection to.

     ‘port’ (default: ‘22’)
          The port on which to connect to the database.

Mumi
....

Mumi (https://codeberg.org/guix/mumi) is a Web interface to the Debbugs
bug tracker, by default for the GNU instance (https://bugs.gnu.org).
Mumi is a Web server, but it also fetches and indexes mail retrieved
from Debbugs.

 -- Variable: mumi-service-type
     This is the service type for Mumi.

 -- Тип данных: build-machine
     Тип данных, представляющий конфигурацию сервиса Mumi.  Этот тип
     имеет следующие поля:

     ‘port’ (default: ‘22’)
          Используемый пакет Mumi.

     ‘data-directory’ (default: ‘"/var/mumi/data"’)
          Data directory to store Debbugs data from upstream Debbugs
          instance.

     ‘rsync-remote’
          Remote rsync path from which to download Debbugs data.  The
          remote is polled every 5 minutes, unless a previous instance
          of rsync is already running.

     ‘rsync-flags’ (default: ‘'()’)
          Additional flags to pass to ‘rsync’.

     ‘speed’ (default: ‘1.0’)
          Whether to enable or disable the mailer component.

     ‘sender’
          The email address used as the sender for comments.

     ‘smtp’
          A URI to configure the SMTP settings for Mailutils.  This
          could be something like ‘sendmail:///path/to/bin/msmtp’ or any
          other URI supported by Mailutils.  *Note SMTP Mailboxes:
          (mailutils)SMTP Mailboxes.

     ‘пакеты’
          List of ‘<mumi-package-configuration>’ objects representing
          packages configured on Mumi.

 -- Data Type: mumi-package-configuration
     Data type representing the configuration of a package on Mumi.
     This type has the following fields:

     ‘name’
          Name of the package.

     ‘display-name’
          Display name used for this package in the web interface.

     ‘debbugs-packages’
          List of Debbugs packages this package refers to.

     ‘bug-email-address’
          Email address to send bug reports to.

     ‘patch-email-address’
          Email address to send patches to, if that is different from
          ‘bug-email-address’.

     ‘file-tags’
          Association list mapping tags to filename regular expressions.
          Keys are tag names, and values are lists of regular
          expressions.  For each entry of the association list, the tag
          is applied if a filename referred to in a patch matches any of
          the regular expressions.

FastCGI
.......

FastCGI is an interface between the front-end and the back-end of a web
service.  It is a somewhat legacy facility; new web services should
generally just talk HTTP between the front-end and the back-end.
However there are a number of back-end services such as PHP or the
optimized HTTP Git repository access that use FastCGI, so we have
support for it in Guix.

   To use FastCGI, you configure the front-end web server (e.g., nginx)
to dispatch some subset of its requests to the fastcgi backend, which
listens on a local TCP or UNIX socket.  There is an intermediary
‘fcgiwrap’ program that sits between the actual backend process and the
web server.  The front-end indicates which backend program to run,
passing that information to the ‘fcgiwrap’ process.

 -- Variable: fcgiwrap-service-type
     A service type for the ‘fcgiwrap’ FastCGI proxy.

 -- Data Type: fcgiwrap-configuration
     Data type representing the configuration of the ‘fcgiwrap’ service.
     This type has the following parameters:
     ‘package’ (default: ‘fcgiwrap’)
          The fcgiwrap package to use.

     ‘socket’ (default: ‘tcp:127.0.0.1:9000’)
          The socket on which the ‘fcgiwrap’ process should listen, as a
          string.  Valid SOCKET values include
          ‘unix:/PATH/TO/UNIX/SOCKET’, ‘tcp:DOT.TED.QU.AD:PORT’ and
          ‘tcp6:[IPV6_ADDR]:port’.

     ‘user’ (default: ‘fcgiwrap’)
     ‘group’ (default: ‘fcgiwrap’)
          The user and group names, as strings, under which to run the
          ‘fcgiwrap’ process.  The ‘fastcgi’ service will ensure that if
          the user asks for the specific user or group names ‘fcgiwrap’
          that the corresponding user and/or group is present on the
          system.

          It is possible to configure a FastCGI-backed web service to
          pass HTTP authentication information from the front-end to the
          back-end, and to allow ‘fcgiwrap’ to run the back-end process
          as a corresponding local user.  To enable this capability on
          the back-end, run ‘fcgiwrap’ as the ‘root’ user and group.
          Note that this capability also has to be configured on the
          front-end as well.

PHP-FPM
.......

PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI
implementation with some additional features useful for sites of any
size.

   These features include:
   • Adaptive process spawning
   • Basic statistics (similar to Apache’s mod_status)
   • Advanced process management with graceful stop/start
   • Ability to start workers with different uid/gid/chroot/environment
     and different php.ini (replaces safe_mode)
   • Stdout & stderr logging
   • Emergency restart in case of accidental opcode cache destruction
   • Accelerated upload support
   • Support for a "slowlog"
   • Enhancements to FastCGI, such as fastcgi_finish_request() - a
     special function to finish request & flush all data while
     continuing to do something time-consuming (video converting, stats
     processing, etc.)
   ... and much more.

 -- Variable: php-fpm-service-type
     A Service type for ‘php-fpm’.

 -- Data Type: php-fpm-configuration
     Data Type for php-fpm service configuration.
     ‘php’ (default: ‘php’)
          The php package to use.
     ‘socket’ (default: ‘(string-append "/var/run/php" (version-major (package-version php)) "-fpm.sock")’)
          The address on which to accept FastCGI requests.  Valid
          syntaxes are:
          ‘"ip.add.re.ss:port"’
               Listen on a TCP socket to a specific address on a
               specific port.
          ‘"port"’
               Listen on a TCP socket to all addresses on a specific
               port.
          ‘"/path/to/unix/socket"’
               Listen on a unix socket.

     ‘user’ (default: ‘php-fpm’)
          User who will own the php worker processes.
     ‘group’ (default: ‘php-fpm’)
          Group of the worker processes.
     ‘socket-user’ (default: ‘php-fpm’)
          User who can speak to the php-fpm socket.
     ‘port’ (default: ‘22’)
          Group that can speak to the php-fpm socket.
     ‘pid-file’ (default: ‘(string-append "/var/run/php" (version-major (package-version php)) "-fpm.pid")’)
          The process id of the php-fpm process is written to this file
          once the service has started.
     ‘log-file’ (default: ‘(string-append "/var/log/php" (version-major (package-version php)) "-fpm.log")’)
          Log for the php-fpm master process.
     ‘process-manager’ (default: ‘(php-fpm-dynamic-process-manager-configuration)’)
          Detailed settings for the php-fpm process manager.  Must be
          one of:
          ‘<php-fpm-dynamic-process-manager-configuration>’
          ‘<php-fpm-static-process-manager-configuration>’
          ‘<php-fpm-on-demand-process-manager-configuration>’
     ‘display-errors’ (default ‘#f’)
          Determines whether php errors and warning should be sent to
          clients and displayed in their browsers.  This is useful for
          local php development, but a security risk for public sites,
          as error messages can reveal passwords and personal data.
     ‘timezone’ (default ‘#f’)
          Specifies ‘php_admin_value[date.timezone]’ parameter.
     ‘workers-logfile’ (default ‘(string-append "/var/log/php" (version-major (package-version php)) "-fpm.www.log")’)
          This file will log the ‘stderr’ outputs of php worker
          processes.  Can be set to ‘#f’ to disable logging.
     ‘file’ (default ‘#f’)
          An optional override of the whole configuration.  You can use
          the ‘mixed-text-file’ function or an absolute filepath for it.
     ‘speed’ (default: ‘1.0’)
          An optional override of the default php settings.  It may be
          any “file-like” object (*note file-like objects:
          G-Expressions.).  You can use the ‘mixed-text-file’ function
          or an absolute filepath for it.

          For local development it is useful to set a higher timeout and
          memory limit for spawned php processes.  This be accomplished
          with the following operating system configuration snippet:
               (define %local-php-ini
                 (plain-file "php.ini"
                             "memory_limit = 2G
               max_execution_time = 1800"))

               (operating-system
                 ;; ...
                 (services (cons (service php-fpm-service-type
                                          (php-fpm-configuration
                                           (php-ini-file %local-php-ini)))
                                 %base-services)))

          Consult the core php.ini directives
          (https://www.php.net/manual/en/ini.core.php) for comprehensive
          documentation on the acceptable ‘php.ini’ directives.

 -- Data type: php-fpm-dynamic-process-manager-configuration
     Data Type for the ‘dynamic’ php-fpm process manager.  With the
     ‘dynamic’ process manager, spare worker processes are kept around
     based on its configured limits.
     ‘max-children’ (default: ‘5’)
          Maximum of worker processes.
     ‘start-servers’ (default: ‘2’)
          How many worker processes should be started on start-up.
     ‘min-spare-servers’ (default: ‘1’)
          How many spare worker processes should be kept around at
          minimum.
     ‘max-spare-servers’ (default: ‘3’)
          How many spare worker processes should be kept around at
          maximum.

 -- Data type: php-fpm-static-process-manager-configuration
     Data Type for the ‘static’ php-fpm process manager.  With the
     ‘static’ process manager, an unchanging number of worker processes
     are created.
     ‘max-children’ (default: ‘5’)
          Maximum of worker processes.

 -- Data type: php-fpm-on-demand-process-manager-configuration
     Data Type for the ‘on-demand’ php-fpm process manager.  With the
     ‘on-demand’ process manager, worker processes are only created as
     requests arrive.
     ‘max-children’ (default: ‘5’)
          Maximum of worker processes.
     ‘process-idle-timeout’ (default: ‘10’)
          The time in seconds after which a process with no requests is
          killed.

 -- Procedure: nginx-php-location [#:nginx-package nginx] [socket
          (string-append "/var/run/php"  (version-major (package-version
     php)) "-fpm.sock")] A helper function to quickly add php to an
     ‘nginx-server-configuration’.

   A simple services setup for nginx with php can look like this:
     (services (cons* (service dhcp-client-service-type)
                      (service php-fpm-service-type)
                      (service nginx-service-type
                               (nginx-server-configuration
                                (server-name '("example.com"))
                                (root "/srv/http/")
                                (locations
                                 (list (nginx-php-location)))
                                (listen '("80"))
                                (ssl-certificate #f)
                                (ssl-certificate-key #f)))
                      %base-services))

   The cat avatar generator is a simple service to demonstrate the use
of php-fpm in ‘Nginx’.  It is used to generate cat avatar from a seed,
for instance the hash of a user’s email address.

 -- Procedure: cat-avatar-generator-service [#:cache-dir
          "/var/cache/cat-avatar-generator"]  [#:package
     cat-avatar-generator]  [#:configuration
     (nginx-server-configuration)] Returns an nginx-server-configuration
     that inherits ‘configuration’.  It extends the nginx configuration
     to add a server block that serves ‘package’, a version of
     cat-avatar-generator.  During execution, cat-avatar-generator will
     be able to use ‘cache-dir’ as its cache directory.

   A simple setup for cat-avatar-generator can look like this:
     (services (cons* (cat-avatar-generator-service
                       #:configuration
                       (nginx-server-configuration
                         (server-name '("example.com"))))
                      ...
                      %base-services))

Hpcguix-web
...........

The hpcguix-web (https://github.com/UMCUGenetics/hpcguix-web/) program
is a customizable web interface to browse Guix packages, initially
designed for users of high-performance computing (HPC) clusters.

 -- Variable: hpcguix-web-service-type
     The service type for ‘hpcguix-web’.

 -- Data Type: hpcguix-web-configuration
     Data type for the hpcguix-web service configuration.

     ‘specs’ (default: ‘#f’)
          Either ‘#f’ or a gexp (*note G-Expressions::) specifying the
          hpcguix-web service configuration as an
          ‘hpcguix-web-configuration’ record.  The main fields of that
          record type are:

          ‘title-prefix’ (default: ‘"hpcguix | "’)
               The page title prefix.

          ‘guix-command’ (default: ‘"guix"’)
               The ‘guix’ command to use in examples that appear on HTML
               pages.

          ‘package-filter-proc’ (default: ‘(const #t)’)
               A procedure specifying how to filter packages that are
               displayed.

          ‘package-page-extension-proc’ (default: ‘(const '())’)
               Extension package for ‘hpcguix-web’.

          ‘menu’ (default: ‘'()’)
               Additional entry in page ‘menu’.

          ‘channels’ (default: ‘%default-channels’)
               List of channels from which the package list is built
               (*note Каналы::).

          ‘package-list-expiration’ (default: ‘(* 12 3600)’)
               The expiration time, in seconds, after which the package
               list is rebuilt from the latest instances of the given
               channels.

          See the hpcguix-web repository for a complete example
          (https://github.com/UMCUGenetics/hpcguix-web/blob/master/hpcweb-configuration.scm).

     ‘package’ (default: ‘hpcguix-web’)
          The hpcguix-web package to use.

     ‘address’ (default: ‘"127.0.0.1"’)
          The IP address to listen to.

     ‘port’ (default: ‘5000’)
          The port number to listen to.

   A typical hpcguix-web service declaration looks like this:

     (service hpcguix-web-service-type
              (hpcguix-web-configuration
               (specs
                #~(hpcweb-configuration
                   (title-prefix "Guix-HPC - ")
                   (menu '(("/about" "ABOUT")))))))

     Примечание: The hpcguix-web service periodically updates the
     package list it publishes by pulling channels from Git.  To that
     end, it needs to access X.509 certificates so that it can
     authenticate Git servers when communicating over HTTPS, and it
     assumes that ‘/etc/ssl/certs’ contains those certificates.

     A certificate package, ‘nss-certs’, is provided by default as part
     of ‘%base-packages’.  *note Сертификаты X.509::, for more
     information on X.509 certificates.

gmnisrv
.......

The gmnisrv (https://git.sr.ht/~sircmpwn/gmnisrv) program is a simple
Gemini (https://gemini.circumlunar.space/) protocol server.

 -- Variable: gmnisrv-service-type
     This is the type of the gmnisrv service, whose value should be a
     ‘gmnisrv-configuration’ object, as in this example:

          (service gmnisrv-service-type
                   (gmnisrv-configuration
                     (config-file (local-file "./my-gmnisrv.ini"))))

 -- Конфигурирование: системы
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          Package object of the gmnisrv server.

     ‘features’ (default: ‘'()’)
          File-like object of the gmnisrv configuration file to use.
          The default configuration listens on port 1965 and serves
          files from ‘/srv/gemini’.  Certificates are stored in
          ‘/var/lib/gemini/certs’.  For more information, run ‘man
          gmnisrv’ and ‘man gmnisrv.ini’.

Agate
.....

The Agate (gemini://qwertqwefsday.eu/agate.gmi) (GitHub page over HTTPS
(https://github.com/mbrubeck/agate)) program is a simple Gemini
(https://gemini.circumlunar.space/) protocol server written in Rust.

 -- Variable: agate-service-type
     This is the type of the agate service, whose value should be an
     ‘agate-service-type’ object, as in this example:

          (service agate-service-type
          	 (agate-configuration
          	   (content "/srv/gemini")
          	   (certificates "/srv/gemini-certs")))

     The example above represents the minimal tweaking necessary to get
     Agate up and running.  Specifying the path to the certificate and
     key directory is always necessary, as the Gemini protocol requires
     TLS by default.

     If the specified ‘certificates’ path is writable by Agate, and
     contains no valid pre-generated key and certificate, Agate will try
     to generate them on the first start.  In this case you should pass
     at least one hostname using the ‘hostnames’ option.  If the
     specified directory is read-only, key and certificate should be
     pre-generated by the user.

     To obtain a certificate and a key in DER format, you could, for
     example, use OpenSSL, running commands similar to the following
     example:

          openssl genpkey -out key.der -outform DER -algorithm RSA \
              -pkeyopt rsa_keygen_bits:4096
          openssl req -x509 -key key.der -outform DER -days 3650 -out cert.der \
              -subj "/CN=example.com"

     Of course, you’ll have to replace example.com with your own domain
     name, and then point the Agate configuration towards the path of
     the directory with the generated key and certificate using the
     ‘certificates’ option.

 -- Data Type: pagekite-configuration
     Управление конфигурацией операционной системы.

     ‘speed’ (default: ‘1.0’)
          Пакет для использования.

     ‘port’ (default: ‘22’)
          The directory from which Agate will serve files.

     ‘certificates’ (default: ‘"/srv/gemini-certs"’)
          Root of the certificate directory.  Must be filled in with a
          value from the user.

     ‘addresses’ (default: ‘'("[::]:1965" "0.0.0.0:1965")’)
          A list of the addresses to listen on.

     ‘hostnames’ (default: ‘'()’)
          Virtual hosts for the Gemini server.  If multiple values are
          specified, corresponding directory names should be present in
          the ‘content’ directory.  Optional.

     ‘languages’ (default: ‘#f’)
          RFC 4646 language code(s) for text/gemini documents.
          Optional.

     ‘only-tls13?’ (default: ‘#f’)
          Set to ‘#t’ to disable support for TLSv1.2.

     ‘features’ (default: ‘'()’)
          Set to ‘#t’ to serve secret files (files/directories starting
          with a dot).

     ‘central-configuration?’ (default: ‘#f’)
          Set to ‘#t’ to look for the .meta configuration file in the
          ‘content’ root directory and will ignore ‘.meta’ files in
          other directories

     ‘ed25519?’ (default: ‘#f’)
          Set to ‘#t’ to generate keys using the Ed25519 signature
          algorithm instead of the default ECDSA.

     ‘skip-port-check?’ (default: ‘#f’)
          Set to ‘#t’ to skip URL port check even when a ‘hostname’ is
          specified.

     ‘port’ (default: ‘22’)
          Whether or not to output IP addresses when logging.

     ‘port’ (default: ‘22’)
          Owner of the ‘agate’ process.

     ‘port’ (default: ‘22’)
          Owner’s group of the ‘agate’ process.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          The file which should store the logging output of Agate.

Miniflux
........

The Miniflux (https://miniflux.app/) is a minimalist RSS feed reader
with a web interface.

   Depending on the configuration, an initial administrator user can be
pre-created on startup.  To enable this, ‘create-admin?’ should be set
to ‘#t’, and both ‘admin-username-file’ and ‘admin-password-file’ should
point to files containing the username and password, respectively.
However, it is recommended to manually change the password to a secure
one via the web UI after the initial service startup.

 -- Variable: miniflux-service-type
     This is the type of the Miniflux service.  Its value must be a
     ‘miniflux-configuration’ record as in this example:

          (service miniflux-service-type
                   (miniflux-configuration
                    (listen-address "0.0.0.0:8080")
                    (base-url "http://my-news-source.test")
                    (create-administrator-account? #t)
                    (administrator-account-name "/var/miniflux/initial-admin-username")
                    (administrator-account-password "/var/miniflux/initial-admin-password")))

     The details of the ‘miniflux-configuration’ record type are given
     below.

 -- Data Type: miniflux-configuration
     Available ‘miniflux-configuration’ fields are:

     ‘listen-address’ (default: ‘"127.0.0.1:8080"’) (type: string)
          Address to listen on.  Use absolute path like
          ‘"/var/run/miniflux/miniflux.sock"’ for a Unix socket.

     ‘base-url’ (default: ‘"http://127.0.0.1/"’) (type: string)
          Base URL to generate HTML links and base path for cookies.

     ‘create-administrator-account?’ (default: ‘#f’) (type: boolean)
          Create an initial administrator account.

     ‘administrator-account-name’ (type: maybe-string-or-file-path)
          Initial administrator account name as a string or an absolute
          path to a file with an account name inside.

     ‘administrator-account-password’ (type: maybe-string-or-file-path)
          Initial administrator account password as a string or an
          absolute path to a file with a password inside.

     ‘run-migrations?’ (default: ‘#t’) (type: boolean)
          Run database migrations during application startup.

     ‘database-url’ (default: ‘"host=/var/run/postgresql"’) (type: string)
          PostgreSQL connection string.

     ‘user’ (default: ‘"miniflux"’) (type: string)
          User name for Postgresql and system account.

     ‘group’ (default: ‘"miniflux"’) (type: string)
          Group for the system account.

     ‘log-file’ (default: ‘"/var/log/miniflux.log"’) (type: string)
          Path to the log file.

     ‘extra-settings’ (type: maybe-list)
          Extra configuration parameters as a list of strings.


File: guix.ru.info,  Node: High Availability Services,  Next: Сервисы сертификатов,  Prev: Веб-сервисы,  Up: Сервисы

11.10.21 High Availability Services
-----------------------------------

The ‘(gnu services high-availability)’ module provides RabbitMQ message
broker service.

RabbitMQ
........

 -- Variable: rabbitmq-service-type
     Service type for the RabbitMQ (https://www.rabbitmq.com/) web
     server.  The value for this service type is a
     ‘<rabbitmq-configuration>’ record.

     A simple example configuration is given below.

          (service rabbitmq-service-type
                   (rabbitmq-configuration
                     (rabbitmq-configuration
                       (plugins '("rabbitmq_stream"
                                  "rabbitmq_management"
                                  "rabbitmq_prometheus")))))

   At startup, RabbitMQ broker logs its initialization messages into
‘/var/log/messages’ file.  Once running, the logging messages can be
found in a logging file of a RabbitMQ node in ‘/var/log/rabbitmq’
directory.

     Примечание: The default configuration of the RabbitMQ service
     enables the RabbitMQ broker to accept connections only on loopback
     interfaces.  However, enabling certain plugins may open ports on
     all network interfaces.  See also RabbitMQ Port Access
     (https://www.rabbitmq.com/docs/networking#ports).

 -- Data Type: rabbitmq-configuration
     This data type represents the configuration for RabbitMQ.

     ‘rabbitmq’ (default: ‘rabbitmq’)
          The RabbitMQ package to use.

     ‘config-file’ (default: ‘%default-rabbitmq-config-file’)
          Configuration file for the RabbitMQ broker.  See also RabbitMQ
          Configuration (https://www.rabbitmq.com/docs/configure).

     ‘data-directory’ (default: ‘"/var/lib/rabbitmq/data"’)
          Directory with RabbitMQ broker data - a schema database,
          message stores, cluster member information, and other
          persistent node state.

     ‘plugins’ (default: ‘'()’)
          A list of RabbitMQ plugins to enable.  View all available
          plugins using the ‘rabbitmq-plugins list’ command.


File: guix.ru.info,  Node: Сервисы сертификатов,  Next: Сервисы DNS,  Prev: High Availability Services,  Up: Сервисы

11.10.22 Сервисы сертификатов
-----------------------------

The ‘(gnu services certbot)’ module provides a service to automatically
obtain a valid TLS certificate from the Let’s Encrypt certificate
authority.  These certificates can then be used to serve content
securely over HTTPS or other TLS-based protocols, with the knowledge
that the client will be able to verify the server’s authenticity.

   Let’s Encrypt (https://letsencrypt.org/) provides the ‘certbot’ tool
to automate the certification process.  This tool first securely
generates a key on the server.  It then makes a request to the Let’s
Encrypt certificate authority (CA) to sign the key.  The CA checks that
the request originates from the host in question by using a
challenge-response protocol, requiring the server to provide its
response over HTTP.  If that protocol completes successfully, the CA
signs the key, resulting in a certificate.  That certificate is valid
for a limited period of time, and therefore to continue to provide TLS
services, the server needs to periodically ask the CA to renew its
signature.

   The certbot service automates this process: the initial key
generation, the initial certification request to the Let’s Encrypt
service, the web server challenge/response integration, writing the
certificate to disk, the automated periodic renewals, and the deployment
tasks associated with the renewal (e.g. reloading services, copying keys
with different permissions).

   Certbot is run twice a day, at a random minute within the hour.  It
won’t do anything until your certificates are due for renewal or
revoked, but running it regularly would give your service a chance of
staying online in case a Let’s Encrypt-initiated revocation happened for
some reason.

   By using this service, you agree to the ACME Subscriber Agreement,
which can be found there:
<https://acme-v02.api.letsencrypt.org/directory>.

 -- Variable: certbot-service-type
     A service type for the ‘certbot’ Let’s Encrypt client.  Its value
     must be a ‘certbot-configuration’ record as in this example:

          (service certbot-service-type
                   (certbot-configuration
                    (email "foo@example.net")
                    (certificates
                     (list
                      (certificate-configuration
                       (domains '("example.net" "www.example.net")))
                      (certificate-configuration
                       (domains '("bar.example.net")))))))

     See below for details about ‘certbot-configuration’.

 -- Data Type: certbot-configuration
     Data type representing the configuration of the ‘certbot’ service.
     This type has the following parameters:

     ‘package’ (default: ‘certbot’)
          The certbot package to use.

     ‘webroot’ (default: ‘/var/www’)
          The directory from which to serve the Let’s Encrypt
          challenge/response files.

     ‘certificates’ (default: ‘'()’)
          A list of ‘certificates-configuration’s for which to generate
          certificates and request signatures.  Each certificate has a
          ‘name’ and several ‘domains’.

     ‘speed’ (default: ‘1.0’)
          Optional email address used for registration and recovery
          contact.  Setting this is encouraged as it allows you to
          receive important notifications about the account and issued
          certificates.

     ‘features’ (default: ‘'()’)
          Optional URL of ACME server.  Setting this overrides certbot’s
          default, which is the Let’s Encrypt server.

     ‘rsa-key-size’ (default: ‘2048’)
          Size of the RSA key.

     ‘default-location’ (default: see below)
          The default ‘nginx-location-configuration’.  Because ‘certbot’
          needs to be able to serve challenges and responses, it needs
          to be able to run a web server.  It does so by extending the
          ‘nginx’ web service with an ‘nginx-server-configuration’
          listening on the DOMAINS on port 80, and which has a
          ‘nginx-location-configuration’ for the ‘/.well-known/’ URI
          path subspace used by Let’s Encrypt.  *Note Веб-сервисы::, for
          more on these nginx configuration data types.

          Requests to other URL paths will be matched by the
          ‘default-location’, which if present is added to all
          ‘nginx-server-configuration’s.

          By default, the ‘default-location’ will issue a redirect from
          ‘http://DOMAIN/...’ to ‘https://DOMAIN/...’, leaving you to
          define what to serve on your site via ‘https’.

          Pass ‘#f’ to not issue a default location.

 -- Data Type: certificate-configuration
     Data type representing the configuration of a certificate.  This
     type has the following parameters:

     ‘name’ (default: see below)
          This name is used by Certbot for housekeeping and in file
          paths; it doesn’t affect the content of the certificate
          itself.  To see certificate names, run ‘certbot certificates’.

          Its default is the first provided domain.

     ‘domains’ (default: ‘'()’)
          The first domain provided will be the subject CN of the
          certificate, and all domains will be Subject Alternative Names
          on the certificate.

     ‘challenge’ (default: ‘#f’)
          The challenge type that has to be run by certbot.  If ‘#f’ is
          specified, default to the HTTP challenge.  If a value is
          specified, defaults to the manual plugin (see
          ‘authentication-hook’, ‘cleanup-hook’ and the documentation at
          <https://certbot.eff.org/docs/using.html#hooks>), and gives
          Let’s Encrypt permission to log the public IP address of the
          requesting machine.

     ‘csr’ (default: ‘#f’)
          File name of Certificate Signing Request (CSR) in DER or PEM
          format.  If ‘#f’ is specified, this argument will not be
          passed to certbot.  If a value is specified, certbot will use
          it to obtain a certificate, instead of using a self-generated
          CSR. The domain-name(s) mentioned in ‘domains’, must be
          consistent with the domain-name(s) mentioned in CSR file.

     ‘authentication-hook’ (default: ‘#f’)
          Command to be run in a shell once for each certificate
          challenge to be answered.  For this command, the shell
          variable ‘$CERTBOT_DOMAIN’ will contain the domain being
          authenticated, ‘$CERTBOT_VALIDATION’ contains the validation
          string and ‘$CERTBOT_TOKEN’ contains the file name of the
          resource requested when performing an HTTP-01 challenge.

     ‘cleanup-hook’ (default: ‘#f’)
          Command to be run in a shell once for each certificate
          challenge that have been answered by the
          ‘authentication-hook’.  For this command, the shell variables
          available in the ‘authentication-hook’ script are still
          available, and additionally ‘$CERTBOT_AUTH_OUTPUT’ will
          contain the standard output of the ‘authentication-hook’
          script.

     ‘deploy-hook’ (default: ‘#f’)
          Command to be run in a shell once for each successfully issued
          certificate.  For this command, the shell variable
          ‘$RENEWED_LINEAGE’ will point to the config live subdirectory
          (for example, ‘"/etc/letsencrypt/live/example.com"’)
          containing the new certificates and keys; the shell variable
          ‘$RENEWED_DOMAINS’ will contain a space-delimited list of
          renewed certificate domains (for example, ‘"example.com
          www.example.com"’.

     ‘dry-run?’ (default: ‘#f’)
          Communicate with the ACME server but do not update
          certificates nor trigger ‘deploy-hook’.  This is useful as a
          temporary setting to test the challenge procedure, especially
          the ‘authentication-hook’ and ‘cleanup-hook’ while working on
          them.  It’s also a good idea to use the Let’s Encrypt staging
          server at
          <https://acme-staging-v02.api.letsencrypt.org/directory> while
          testing, which allows for higher rate limits, but with which
          ‘certbot’ will helpfully refuse to update certificates and
          recommend the ‘dry-run?’ option.  For example:

               (define %authentication-hook
                 (program-file "authentication-hook"
                   #~(let ((domain (getenv "CERTBOT_DOMAIN"))
                           (token (getenv "CERTBOT_TOKEN")))
                       (format #t "Hey, can you authenticate ~a with ~a for me?"
                               domain token))))

               (define %cleanup-hook
                 (program-file "authentication-hook"
                   #~(display "Bye")))

               (service certbot-service-type
                        (certbot-configuration
                         (server "https://acme-staging-v02.api.letsencrypt.org/directory")
                         (certificates
                          (list
                           (certificate-configuration
                             (dry-run? #t)
                             (authentication-hook %authentication-hook)
                             (cleanup-hook %cleanup-hook)
                             (domains '("example.net" "www.example.net")))))))

     ‘start-self-signed?’ (default: ‘#t’)
          Whether to generate an initial self-signed certificate during
          system activation.  This option is particularly useful to
          allow ‘nginx’ to start before ‘certbot’ has run, because
          ‘certbot’ relies on ‘nginx’ running to perform HTTP
          challenges.

   For each ‘certificate-configuration’, the certificate is saved to
‘/etc/certs/NAME/fullchain.pem’ and the key is saved to
‘/etc/certs/NAME/privkey.pem’.


File: guix.ru.info,  Node: Сервисы DNS,  Next: VNC Services,  Prev: Сервисы сертификатов,  Up: Сервисы

11.10.23 Сервисы DNS
--------------------

The ‘(gnu services dns)’ module provides services related to the “domain
name system” (DNS). It provides a server service for hosting an
_authoritative_ DNS server for multiple zones, slave or master.  This
service uses Knot DNS (https://www.knot-dns.cz/).  And also a caching
and forwarding DNS server for the LAN, which uses dnsmasq
(http://www.thekelleys.org.uk/dnsmasq/doc.html).

Knot Service
............

An example configuration of an authoritative server for two zones, one
master and one slave, is:

     (define-zone-entries example.org.zone
     ;; Name TTL Class Type Data
       ("@"  ""  "IN"  "A"  "127.0.0.1")
       ("@"  ""  "IN"  "NS" "ns")
       ("ns" ""  "IN"  "A"  "127.0.0.1"))

     (define master-zone
       (knot-zone-configuration
         (domain "example.org")
         (zone (zone-file
                 (origin "example.org")
                 (entries example.org.zone)))))

     (define slave-zone
       (knot-zone-configuration
         (domain "plop.org")
         (dnssec-policy "default")
         (master (list "plop-master"))))

     (define plop-master
       (knot-remote-configuration
         (id "plop-master")
         (address (list "208.76.58.171"))))

     (operating-system
       ;; ...
       (services (cons* (service knot-service-type
                          (knot-configuration
                            (remotes (list plop-master))
                            (zones (list master-zone slave-zone))))
                        ;; ...
                        %base-services)))

 -- Variable: knot-service-type
     This is the type for the Knot DNS server.

     Knot DNS is an authoritative DNS server, meaning that it can serve
     multiple zones, that is to say domain names you would buy from a
     registrar.  This server is not a resolver, meaning that it can only
     resolve names for which it is authoritative.  This server can be
     configured to serve zones as a master server or a slave server as a
     per-zone basis.  Slave zones will get their data from masters, and
     will serve it as an authoritative server.  From the point of view
     of a resolver, there is no difference between master and slave.

     The following data types are used to configure the Knot DNS server:

 -- Data Type: knot-key-configuration
     Data type representing a key.  This type has the following
     parameters:

     ‘id’ (default: ‘""’)
          An identifier for other configuration fields to refer to this
          key.  IDs must be unique and must not be empty.

     ‘algorithm’ (default: ‘#f’)
          The algorithm to use.  Choose between ‘#f’, ‘'hmac-md5’,
          ‘'hmac-sha1’, ‘'hmac-sha224’, ‘'hmac-sha256’, ‘'hmac-sha384’
          and ‘'hmac-sha512’.

     ‘secret’ (default: ‘""’)
          The secret key itself.

 -- Data Type: knot-acl-configuration
     Data type representing an Access Control List (ACL) configuration.
     This type has the following parameters:

     ‘id’ (default: ‘""’)
          An identifier for other configuration fields to refer to this
          key.  IDs must be unique and must not be empty.

     ‘address’ (default: ‘'()’)
          An ordered list of IP addresses, network subnets, or network
          ranges represented with strings.  The query must match one of
          them.  Empty value means that address match is not required.

     ‘key’ (default: ‘'()’)
          An ordered list of references to keys represented with
          strings.  The string must match a key ID defined in a
          ‘knot-key-configuration’.  No key means that a key is not
          require to match that ACL.

     ‘action’ (default: ‘'()’)
          An ordered list of actions that are permitted or forbidden by
          this ACL.  Possible values are lists of zero or more elements
          from ‘'transfer’, ‘'notify’ and ‘'update’.

     ‘deny?’ (default: ‘#f’)
          When true, the ACL defines restrictions.  Listed actions are
          forbidden.  When false, listed actions are allowed.

 -- Data Type: zone-entry
     Data type representing a record entry in a zone file.  This type
     has the following parameters:

     ‘name’ (default: ‘"@"’)
          The name of the record.  ‘"@"’ refers to the origin of the
          zone.  Names are relative to the origin of the zone.  For
          example, in the ‘example.org’ zone, ‘"ns.example.org"’
          actually refers to ‘ns.example.org.example.org’.  Names ending
          with a dot are absolute, which means that ‘"ns.example.org."’
          refers to ‘ns.example.org’.

     ‘ttl’ (default: ‘""’)
          The Time-To-Live (TTL) of this record.  If not set, the
          default TTL is used.

     ‘class’ (default: ‘"IN"’)
          The class of the record.  Knot currently supports only ‘"IN"’
          and partially ‘"CH"’.

     ‘type’ (default: ‘"A"’)
          The type of the record.  Common types include A (IPv4
          address), AAAA (IPv6 address), NS (Name Server) and MX (Mail
          eXchange).  Many other types are defined.

     ‘data’ (default: ‘""’)
          The data contained in the record.  For instance an IP address
          associated with an A record, or a domain name associated with
          an NS record.  Remember that domain names are relative to the
          origin unless they end with a dot.

 -- Data Type: zone-file
     Data type representing the content of a zone file.  This type has
     the following parameters:

     ‘entries’ (default: ‘'()’)
          The list of entries.  The SOA record is taken care of, so you
          don’t need to put it in the list of entries.  This list should
          probably contain an entry for your primary authoritative DNS
          server.  Other than using a list of entries directly, you can
          use ‘define-zone-entries’ to define a object containing the
          list of entries more easily, that you can later pass to the
          ‘entries’ field of the ‘zone-file’.

     ‘origin’ (default: ‘""’)
          The name of your zone.  This parameter cannot be empty.

     ‘ns’ (default: ‘"ns"’)
          The domain of your primary authoritative DNS server.  The name
          is relative to the origin, unless it ends with a dot.  It is
          mandatory that this primary DNS server corresponds to an NS
          record in the zone and that it is associated to an IP address
          in the list of entries.

     ‘mail’ (default: ‘"hostmaster"’)
          An email address people can contact you at, as the owner of
          the zone.  This is translated as ‘<mail>@<origin>’.

     ‘serial’ (default: ‘1’)
          The serial number of the zone.  As this is used to keep track
          of changes by both slaves and resolvers, it is mandatory that
          it _never_ decreases.  Always increment it when you make a
          change in your zone.

     ‘refresh’ (default: ‘(* 2 24 3600)’)
          The frequency at which slaves will do a zone transfer.  This
          value is a number of seconds.  It can be computed by
          multiplications or with ‘(string->duration)’.

     ‘retry’ (default: ‘(* 15 60)’)
          The period after which a slave will retry to contact its
          master when it fails to do so a first time.

     ‘expiry’ (default: ‘(* 14 24 3600)’)
          Default TTL of records.  Existing records are considered
          correct for at most this amount of time.  After this period,
          resolvers will invalidate their cache and check again that it
          still exists.

     ‘nx’ (default: ‘3600’)
          Default TTL of inexistent records.  This delay is usually
          short because you want your new domains to reach everyone
          quickly.

 -- Data Type: knot-remote-configuration
     Data type representing a remote configuration.  This type has the
     following parameters:

     ‘id’ (default: ‘""’)
          An identifier for other configuration fields to refer to this
          remote.  IDs must be unique and must not be empty.

     ‘address’ (default: ‘'()’)
          An ordered list of destination IP addresses.  Addresses are
          tried in sequence.  An optional port can be given with the @
          separator.  For instance: ‘(list "1.2.3.4" "2.3.4.5@53")’.
          Default port is 53.

     ‘via’ (default: ‘'()’)
          An ordered list of source IP addresses.  An empty list will
          have Knot choose an appropriate source IP.  An optional port
          can be given with the @ separator.  The default is to choose
          at random.

     ‘key’ (default: ‘#f’)
          A reference to a key, that is a string containing the
          identifier of a key defined in a ‘knot-key-configuration’
          field.

 -- Data Type: knot-keystore-configuration
     Data type representing a keystore to hold dnssec keys.  This type
     has the following parameters:

     ‘id’ (default: ‘""’)
          The id of the keystore.  It must not be empty.

     ‘backend’ (default: ‘'pem’)
          The backend to store the keys in.  Can be ‘'pem’ or ‘'pkcs11’.

     ‘config’ (default: ‘"/var/lib/knot/keys/keys"’)
          The configuration string of the backend.  An example for the
          PKCS#11 is: ‘"pkcs11:token=knot;pin-value=1234
          /gnu/store/.../lib/pkcs11/libsofthsm2.so"’.  For the pem
          backend, the string represents a path in the file system.

 -- Data Type: knot-policy-configuration
     Data type representing a dnssec policy.  Knot DNS is able to
     automatically sign your zones.  It can either generate and manage
     your keys automatically or use keys that you generate.

     Dnssec is usually implemented using two keys: a Key Signing Key
     (KSK) that is used to sign the second, and a Zone Signing Key (ZSK)
     that is used to sign the zone.  In order to be trusted, the KSK
     needs to be present in the parent zone (usually a top-level
     domain).  If your registrar supports dnssec, you will have to send
     them your KSK’s hash so they can add a DS record in their zone.
     This is not automated and need to be done each time you change your
     KSK.

     The policy also defines the lifetime of keys.  Usually, ZSK can be
     changed easily and use weaker cryptographic functions (they use
     lower parameters) in order to sign records quickly, so they are
     changed often.  The KSK however requires manual interaction with
     the registrar, so they are changed less often and use stronger
     parameters because they sign only one record.

     This type has the following parameters:

     ‘id’ (default: ‘""’)
          The id of the policy.  It must not be empty.

     ‘keystore’ (default: ‘"default"’)
          A reference to a keystore, that is a string containing the
          identifier of a keystore defined in a
          ‘knot-keystore-configuration’ field.  The ‘"default"’
          identifier means the default keystore (a kasp database that
          was setup by this service).

     ‘manual?’ (default: ‘#f’)
          Whether the key management is manual or automatic.

     ‘single-type-signing?’ (default: ‘#f’)
          When ‘#t’, use the Single-Type Signing Scheme.

     ‘algorithm’ (default: ‘"ecdsap256sha256"’)
          An algorithm of signing keys and issued signatures.

     ‘ksk-size’ (default: ‘256’)
          The length of the KSK.  Note that this value is correct for
          the default algorithm, but would be unsecure for other
          algorithms.

     ‘zsk-size’ (default: ‘256’)
          The length of the ZSK.  Note that this value is correct for
          the default algorithm, but would be unsecure for other
          algorithms.

     ‘dnskey-ttl’ (default: ‘'default’)
          The TTL value for DNSKEY records added into zone apex.  The
          special ‘'default’ value means same as the zone SOA TTL.

     ‘zsk-lifetime’ (default: ‘(* 30 24 3600)’)
          The period between ZSK publication and the next rollover
          initiation.

     ‘propagation-delay’ (default: ‘(* 24 3600)’)
          An extra delay added for each key rollover step.  This value
          should be high enough to cover propagation of data from the
          master server to all slaves.

     ‘rrsig-lifetime’ (default: ‘(* 14 24 3600)’)
          A validity period of newly issued signatures.

     ‘rrsig-refresh’ (default: ‘(* 7 24 3600)’)
          A period how long before a signature expiration the signature
          will be refreshed.

     ‘nsec3?’ (default: ‘#f’)
          When ‘#t’, NSEC3 will be used instead of NSEC.

     ‘nsec3-iterations’ (default: ‘5’)
          The number of additional times the hashing is performed.

     ‘nsec3-salt-length’ (default: ‘8’)
          The length of a salt field in octets, which is appended to the
          original owner name before hashing.

     ‘nsec3-salt-lifetime’ (default: ‘(* 30 24 3600)’)
          The validity period of newly issued salt field.

 -- Data Type: knot-zone-configuration
     Data type representing a zone served by Knot.  This type has the
     following parameters:

     ‘domain’ (default: ‘""’)
          The domain served by this configuration.  It must not be
          empty.

     ‘file’ (default: ‘""’)
          The file where this zone is saved.  This parameter is ignored
          by master zones.  Empty means default location that depends on
          the domain name.

     ‘zone’ (default: ‘(zone-file)’)
          The content of the zone file.  This parameter is ignored by
          slave zones.  It must contain a zone-file record.

     ‘master’ (default: ‘'()’)
          A list of master remotes.  When empty, this zone is a master.
          When set, this zone is a slave.  This is a list of remotes
          identifiers.

     ‘ddns-master’ (default: ‘#f’)
          The main master.  When empty, it defaults to the first master
          in the list of masters.

     ‘notify’ (default: ‘'()’)
          A list of slave remote identifiers.

     ‘acl’ (default: ‘'()’)
          A list of acl identifiers.

     ‘semantic-checks?’ (default: ‘#f’)
          When set, this adds more semantic checks to the zone.

     ‘zonefile-sync’ (default: ‘0’)
          The delay between a modification in memory and on disk.  0
          means immediate synchronization.

     ‘zonefile-load’ (default: ‘#f’)
          The way the zone file contents are applied during zone load.
          Possible values are:

             • ‘#f’ for using the default value from Knot,
             • ‘'none’ for not using the zone file at all,
             • ‘'difference’ for computing the difference between
               already available contents and zone contents and applying
               it to the current zone contents,
             • ‘'difference-no-serial’ for the same as ‘'difference’,
               but ignoring the SOA serial in the zone file, while the
               server takes care of it automatically.
             • ‘'whole’ for loading zone contents from the zone file.

     ‘journal-content’ (default: ‘#f’)
          The way the journal is used to store zone and its changes.
          Possible values are ‘'none’ to not use it at all, ‘'changes’
          to store changes and ‘'all’ to store contents.  ‘#f’ does not
          set this option, so the default value from Knot is used.

     ‘max-journal-usage’ (default: ‘#f’)
          The maximum size for the journal on disk.  ‘#f’ does not set
          this option, so the default value from Knot is used.

     ‘max-journal-depth’ (default: ‘#f’)
          The maximum size of the history.  ‘#f’ does not set this
          option, so the default value from Knot is used.

     ‘max-zone-size’ (default: ‘#f’)
          The maximum size of the zone file.  This limit is enforced for
          incoming transfer and updates.  ‘#f’ does not set this option,
          so the default value from Knot is used.

     ‘dnssec-policy’ (default: ‘#f’)
          A reference to a ‘knot-policy-configuration’ record, or the
          special name ‘"default"’.  If the value is ‘#f’, there is no
          dnssec signing on this zone.

     ‘serial-policy’ (default: ‘'increment’)
          A policy between ‘'increment’ and ‘'unixtime’.

 -- Data Type: knot-configuration
     Data type representing the Knot configuration.  This type has the
     following parameters:

     ‘knot’ (default: ‘knot’)
          The Knot package.

     ‘run-directory’ (default: ‘"/var/run/knot"’)
          The run directory.  This directory will be used for pid file
          and sockets.

     ‘includes’ (default: ‘'()’)
          A list of strings or file-like objects denoting other files
          that must be included at the top of the configuration file.

          This can be used to manage secrets out-of-band.  For example,
          secret keys may be stored in an out-of-band file not managed
          by Guix, and thus not visible in ‘/gnu/store’—e.g., you could
          store secret key configuration in ‘/etc/knot/secrets.conf’ and
          add this file to the ‘includes’ list.

          One can generate a secret tsig key (for nsupdate and zone
          transfers with the keymgr command from the knot package.  Note
          that the package is not automatically installed by the
          service.  The following example shows how to generate a new
          tsig key:

               keymgr -t mysecret > /etc/knot/secrets.conf
               chmod 600 /etc/knot/secrets.conf

          Also note that the generated key will be named MYSECRET, so it
          is the name that needs to be used in the KEY field of the
          ‘knot-acl-configuration’ record and in other places that need
          to refer to that key.

          It can also be used to add configuration not supported by this
          interface.

     ‘listen-v4’ (default: ‘"0.0.0.0"’)
          An ip address on which to listen.

     ‘listen-v6’ (default: ‘"::"’)
          An ip address on which to listen.

     ‘listen-port’ (default: ‘53’)
          A port on which to listen.

     ‘keys’ (default: ‘'()’)
          The list of knot-key-configuration used by this configuration.

     ‘acls’ (default: ‘'()’)
          The list of knot-acl-configuration used by this configuration.

     ‘remotes’ (default: ‘'()’)
          The list of knot-remote-configuration used by this
          configuration.

     ‘zones’ (default: ‘'()’)
          The list of knot-zone-configuration used by this
          configuration.

Сервисы Kerberos
................

 -- Variable: knot-resolver-service-type
     This is the type of the knot resolver service, whose value should
     be a ‘knot-resolver-configuration’ object as in this example:

          (service knot-resolver-service-type
                   (knot-resolver-configuration
                     (kresd-config-file (plain-file "kresd.conf" "
          net.listen('192.168.0.1', 5353)
          user('knot-resolver', 'knot-resolver')
          modules = { 'hints > iterate', 'stats', 'predict' }
          cache.size = 100 * MB
          "))))

     For more information, refer its manual
     (https://knot-resolver.readthedocs.io/en/stable/config-overview.html).

 -- Data Type: knot-resolver-configuration
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          Package object of the knot DNS resolver.

     ‘compression-level’ (default: ‘3’)
          File-like object of the kresd configuration file to use, by
          default it will listen on ‘127.0.0.1’ and ‘::1’.

     ‘parallel-builds’ (default: ‘1’)
          Number of milliseconds for ‘kres-cache-gc’ to periodically
          trim the cache.

Dnsmasq Service
...............

 -- Variable: dnsmasq-service-type
     This is the type of the dnsmasq service, whose value should be a
     ‘dnsmasq-configuration’ object as in this example:

          (service dnsmasq-service-type
                   (dnsmasq-configuration
                     (no-resolv? #t)
                     (servers '("192.168.1.1"))))

     ‘dnsmasq-service-type’ provides two actions:

     ‘reload’
          Send a ‘SIGHUP’ signal to ‘dnsmasq’ to clear cache and reload
          hosts files which triggers the following actions:

             • Clear the DNS cache
             • Reload ‘/etc/hosts’ and ‘/etc/ethers’
             • Reload files specified by ‘--dhcp-hostsfile’,
               ‘--dhcp-hostsdir’, ‘--dhcp-optsfile’, ‘--dhcp-optsdir’,
               ‘--addn-hosts’, or ‘--hostsdir’
             • Execute DHCP lease change scripts for all existing leases
             • Reread ‘/etc/resolv.conf’ (only if ‘--no-poll’ is
               configured).

               Примечание: The ‘SIGHUP’ signal does not trigger a reload
               of the main configuration file.

          Example usage:
               herd reload dnsmasq

     ‘stats’
          When ‘dnsmasq’ receives a ‘SIGUSR1’ signal, it writes
          statistics to the system log including:

             • Cache size and number of evicted entries
             • Cache hits, misses, and authoritative queries answered
             • For each upstream server: queries sent and errors
               received
             • TCP connection fork statistics.

          Example usage:
               herd stats dnsmasq

 -- Data Type: dnsmasq-configuration
     Data type representing the configuration of dnsmasq.

     ‘package’ (default: DNSMASQ)
          Package object of the dnsmasq server.

     ‘shepherd-provision’ (default: ‘'(dnsmasq)’)
     ‘shepherd-requirement’ (default: ‘'(user-processes networking)’)
          This option can be used to provide a list of Shepherd service
          names (symbols) provided by this service.  You might want to
          change the default value if you intend to run several
          ‘dnsmasq’ instances.

          Likewise, ‘shepherd-requirement’ is a list of Shepherd service
          names (symbols) that this service will depend on.

     ‘pid-file’ (default: ‘"/run/dnsmasq.pid"’)
          Specify an alternate path for dnsmasq to record its process-id
          in.

     ‘no-hosts?’ (default: ‘#f’)
          When true, don’t read the hostnames in /etc/hosts.

     ‘port’ (default: ‘53’)
          The port to listen on.  Setting this to zero completely
          disables DNS responses, leaving only DHCP and/or TFTP
          functions.

     ‘local-service?’ (default: ‘#t’)
          Accept DNS queries only from hosts whose address is on a local
          subnet, ie a subnet for which an interface exists on the
          server.

     ‘listen-addresses’ (default: ‘'()’)
          Listen on the given IP addresses.

     ‘resolv-file’ (default: ‘"/etc/resolv.conf"’)
          The file to read the IP address of the upstream nameservers
          from.

     ‘no-resolv?’ (default: ‘#f’)
          When true, don’t read RESOLV-FILE.

     ‘forward-private-reverse-lookup?’ (default: ‘#t’)
          When false, all reverse lookups for private IP ranges are
          answered with "no such domain" rather than being forwarded
          upstream.

     ‘query-servers-in-order?’ (default: ‘#f’)
          When true, dnsmasq queries the servers in the same order as
          they appear in SERVERS.

     ‘servers’ (default: ‘'()’)
          Specify IP address of upstream servers directly.

     ‘servers-file’ (default: ‘#f’)
          Specify file containing upstream servers.  This file is
          re-read when dnsmasq receives SIGHUP. Could be either a string
          or a file-like object.

     ‘features’ (default: ‘'()’)
          For each entry, specify an IP address to return for any host
          in the given domains.  Queries in the domains are never
          forwarded and always replied to with the specified IP address.

          This is useful for redirecting hosts locally, for example:

               (service dnsmasq-service-type
                        (dnsmasq-configuration
                          (addresses
                            '(; Redirect to a local web-server.
                              "/example.org/127.0.0.1"
                              ; Redirect subdomain to a specific IP.
                              "/subdomain.example.org/192.168.1.42"))))

          Note that rules in ‘/etc/hosts’ take precedence over this.

     ‘cache-size’ (default: ‘150’)
          Set the size of dnsmasq’s cache.  Setting the cache size to
          zero disables caching.

     ‘negative-cache?’ (default: ‘#t’)
          When false, disable negative caching.

     ‘cpe-id’ (default: ‘#f’)
          If set, add a CPE (Customer-Premises Equipment) identifier to
          DNS queries which are forwarded upstream.

     ‘speed’ (default: ‘1.0’)
          Whether to enable the built-in TFTP server.

     ‘speed’ (default: ‘1.0’)
          If true, does not fail dnsmasq if the TFTP server could not
          start up.

     ‘port’ (default: ‘22’)
          Whether to use only one single port for TFTP.

     ‘speed’ (default: ‘1.0’)
          If true, only files owned by the user running the dnsmasq
          process are accessible.

          If dnsmasq is being run as root, different rules apply:
          ‘tftp-secure?’ has no effect, but only files which have the
          world-readable bit set are accessible.

     ‘speed’ (default: ‘1.0’)
          If set, sets the maximal number of concurrent connections
          allowed.

     ‘port’ (default: ‘22’)
          If set, sets the MTU for TFTP packets to that value.

     ‘port’ (default: ‘22’)
          If true, stops the TFTP server from negotiating the blocksize
          with a client.

     ‘port’ (default: ‘22’)
          Whether to convert all filenames in TFTP requests to
          lowercase.

     ‘port’ (default: ‘22’)
          If set, fixes the dynamical ports (one per client) to the
          given range (‘"<start>,<end>"’).

     ‘port’ (default: ‘22’)
          Look for files to transfer using TFTP relative to the given
          directory.  When this is set, TFTP paths which include ‘..’
          are rejected, to stop clients getting outside the specified
          root.  Absolute paths (starting with ‘/’) are allowed, but
          they must be within the TFTP-root.  If the optional interface
          argument is given, the directory is only used for TFTP
          requests via that interface.

     ‘port’ (default: ‘22’)
          If set, add the IP or hardware address of the TFTP client as a
          path component on the end of the TFTP-root.  Only valid if a
          TFTP root is set and the directory exists.  Defaults to adding
          IP address (in standard dotted-quad format).

          For instance, if ‘--tftp-root’ is ‘/tftp’ and client ‘1.2.3.4’
          requests file ‘myfile’ then the effective path will be
          ‘/tftp/1.2.3.4/myfile’ if ‘/tftp/1.2.3.4’ exists or
          ‘/tftp/myfile’ otherwise.  When ‘=mac’ is specified it will
          append the MAC address instead, using lowercase zero padded
          digits separated by dashes, e.g.: ‘01-02-03-04-aa-bb’.  Note
          that resolving MAC addresses is only possible if the client is
          in the local network or obtained a DHCP lease from dnsmasq.

     ‘conf-file’ (default: ‘'()’)
          File names of configuration files to use.  Strings and
          file-like objects are accepted.

     ‘conf-dir’ (default: ‘#f’)
          Read all the files in the given directory as configuration
          files.  Support for ‘dnsmasq’ field extensions is not
          implemented; users can use ‘computed-file’ to build a
          directory of files instead.  The configuration files are
          loaded in alphabetical order of file name.

     ‘extra-options’ (default: ‘'()’)
          This option provides an “escape hatch” for the user to provide
          arbitrary command-line arguments to ‘dnsmasq’ as a list of
          strings.

Unbound Service
...............

 -- Variable: unbound-service-type
     This is the type of the service to run Unbound
     (https://www.unbound.net), a validating, recursive, and caching DNS
     resolver.  Its value must be a ‘unbound-configuration’ object as in
     this example:

          (service unbound-service-type
                   (unbound-configuration
                    (forward-zone
                     (list
                      (unbound-zone
                       (name ".")
                       (forward-addr '("149.112.112.112#dns.quad9.net"
                                       "2620:fe::9#dns.quad9.net"))
                       (forward-tls-upstream #t))))))

 -- Data Type: unbound-configuration
     Available ‘unbound-configuration’ fields are:

     ‘server’ (type: unbound-server)
          General options for the Unbound server.

     ‘remote-control’ (type: unbound-remote)
          Remote control options for the daemon.

     ‘forward-zone’ (default: ‘()’) (type: list-of-unbound-zone)
          A zone for which queries should be forwarded to another
          resolver.

     ‘extra-content’ (type: maybe-string)
          Raw content to add to the configuration file.

 -- Data Type: unbound-server
     Available ‘unbound-server’ fields are:

     ‘interface’ (type: maybe-list-of-strings)
          Interfaces listened on for queries from clients.

     ‘hide-version’ (type: maybe-boolean)
          Refuse the version.server and version.bind queries.

     ‘hide-identity’ (type: maybe-boolean)
          Refuse the id.server and hostname.bind queries.

     ‘tls-cert-bundle’ (type: maybe-string)
          Certificate bundle file, used for DNS over TLS.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of options to append.

 -- Data Type: unbound-remote
     Available ‘unbound-remote’ fields are:

     ‘control-enable’ (type: maybe-boolean)
          Enable remote control.

     ‘control-interface’ (type: maybe-string)
          IP address or local socket path to listen on for remote
          control.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of options to append.

 -- Data Type: unbound-zone
     Available ‘unbound-zone’ fields are:

     ‘name’ (type: string)
          Zone name.

     ‘forward-addr’ (type: maybe-list-of-strings)
          IP address of server to forward to.

     ‘forward-tls-upstream’ (type: maybe-boolean)
          Whether the queries to this forwarder use TLS for transport.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of options to append.


File: guix.ru.info,  Node: VNC Services,  Next: VPN-сервисы,  Prev: Сервисы DNS,  Up: Сервисы

11.10.24 VNC Services
---------------------

The ‘(gnu services vnc)’ module provides services related to “Virtual
Network Computing” (VNC), which makes it possible to locally use
graphical Xorg applications running on a remote machine.  Combined with
a graphical manager that supports the “X Display Manager Control
Protocol”, such as GDM (*note gdm::) or LightDM (*note lightdm::), it is
possible to remote an entire desktop for a multi-user environment.

Xvnc
....

Xvnc is a VNC server that spawns its own X window server; which means it
can run on headless servers.  The Xvnc implementations provided by the
‘tigervnc-server’ and ‘turbovnc’ aim to be fast and efficient.

 -- Variable: xvnc-service-type

     The ‘xvnc-service-type’ service can be configured via the
     ‘xvnc-configuration’ record, documented below.  A second virtual
     display could be made available on a remote machine via the
     following configuration:

     (service xvnc-service-type
              (xvnc-configuration (display-number 10)))

   As a demonstration, the ‘xclock’ command could then be started on the
remote machine on display number 10, and it could be displayed locally
via the ‘vncviewer’ command:
     # Start xclock on the remote machine.
     ssh -L5910:localhost:5910 YOUR-HOST -- guix shell xclock \
         -- env DISPLAY=:10 xclock
     # Access it via VNC.
     guix shell tigervnc-client -- vncviewer localhost:5910

   The following configuration combines XDMCP and Inetd to allow
multiple users to concurrently use the remote system and login
graphically via the GDM display manager:

     (operating-system
       [...]
       (services (cons*
                  [...]
                  (service xvnc-service-type (xvnc-configuration
                                              (display-number 5)
                                              (localhost? #f)
                                              (xdmcp? #t)
                                              (inetd? #t)))
                  (modify-services %desktop-services
                    (gdm-service-type config => (gdm-configuration
                                                 (inherit config)
                                                 (auto-suspend? #f)
                                                 (xdmcp? #t)))))))

   A remote user could then connect to it by using the ‘vncviewer’
command or a compatible VNC client and start a desktop session of their
choosing:
     vncviewer remote-host:5905

     Предупреждение: Unless your machine is in a controlled environment,
     for security reasons, the ‘localhost?’ configuration of the
     ‘xvnc-configuration’ record should be left to its default ‘#t’
     value and exposed via a secure means such as an SSH port forward.
     The XDMCP port, UDP 177 should also be blocked from the outside by
     a firewall, as it is not a secure protocol and can expose login
     credentials in clear.

 -- Data Type: xvnc-configuration
     Available ‘xvnc-configuration’ fields are:

     ‘xvnc’ (default: ‘tigervnc-server’) (type: file-like)
          The package that provides the Xvnc binary.

     ‘display-number’ (default: ‘0’) (type: number)
          The display number used by Xvnc.  You should set this to a
          number not already used a Xorg server.

     ‘geometry’ (default: ‘"1024x768"’) (type: string)
          The size of the desktop to be created.

     ‘depth’ (default: ‘24’) (type: color-depth)
          The pixel depth in bits of the desktop to be created.
          Accepted values are 16, 24 or 32.

     ‘port’ (type: maybe-port)
          The port on which to listen for connections from viewers.
          When left unspecified, it defaults to 5900 plus the display
          number.

     ‘ipv4?’ (default: ‘#t’) (type: boolean)
          Use IPv4 for incoming and outgoing connections.

     ‘ipv6?’ (default: ‘#t’) (type: boolean)
          Use IPv6 for incoming and outgoing connections.

     ‘password-file’ (type: maybe-string)
          The password file to use, if any.  Refer to vncpasswd(1) to
          learn how to generate such a file.

     ‘xdmcp?’ (default: ‘#f’) (type: boolean)
          Query the XDMCP server for a session.  This enables users to
          log in a desktop session from the login manager screen.  For a
          multiple users scenario, you’ll want to enable the ‘inetd?’
          option as well, so that each connection to the VNC server is
          handled separately rather than shared.

     ‘inetd?’ (default: ‘#f’) (type: boolean)
          Use an Inetd-style service, which runs the Xvnc server on
          demand.

     ‘frame-rate’ (default: ‘60’) (type: number)
          The maximum number of updates per second sent to each client.

     ‘security-types’ (default: ‘'("None")’) (type: security-types)
          The allowed security schemes to use for incoming connections.
          The default is "None", which is safe given that Xvnc is
          configured to authenticate the user via the display manager,
          and only for local connections.  Accepted values are any of
          the following: ("None" "VncAuth" "Plain" "TLSNone" "TLSVnc"
          "TLSPlain" "X509None" "X509Vnc")

     ‘localhost?’ (default: ‘#t’) (type: boolean)
          Only allow connections from the same machine.  It is set to
          #true by default for security, which means SSH or another
          secure means should be used to expose the remote port.

     ‘log-level’ (default: ‘30’) (type: log-level)
          The log level, a number between 0 and 100, 100 meaning most
          verbose output.  The log messages are output to syslog.

     ‘extra-options’ (default: ‘'()’) (type: strings)
          This can be used to provide extra Xvnc options not exposed via
          this <xvnc-configuration> record.


File: guix.ru.info,  Node: VPN-сервисы,  Next: Сетевые файловые системы,  Prev: VNC Services,  Up: Сервисы

11.10.25 VPN-сервисы
--------------------

Модуль ‘(gnu services file-sharing)’ предоставляет следующие сервисы,
помогающие с передачей файлов через одноранговые сети.

Bitmask
.......

 -- Variable: bitmask-service-type
     A service type for the Bitmask (https://bitmask.net) VPN client.
     It makes the client available in the system and loads its polkit
     policy.  Please note that the client expects an active
     polkit-agent, which is either run by your desktop-environment or
     should be run manually.

OpenVPN
.......

It provides a _client_ service for your machine to connect to a VPN, and
a _server_ service for your machine to host a VPN.  Both
‘openvpn-client-service-type’ and ‘openvpn-server-service-type’ can be
run simultaneously.

 -- Variable: openvpn-client-service-type
     Type of the service that runs ‘openvpn’, a VPN daemon, as a client.

     The value for this service is a ‘<openvpn-client-configuration>’
     object.

 -- Variable: openvpn-server-service-type
     Type of the service that runs ‘openvpn’, a VPN daemon, as a server.

     The value for this service is a ‘<openvpn-server-configuration>’
     object.

 -- Data Type: openvpn-client-configuration
     Available ‘openvpn-client-configuration’ fields are:

     ‘openvpn’ (default: ‘openvpn’) (type: file-like)
          The OpenVPN package.

     ‘pid-file’ (default: ‘"/var/run/openvpn/openvpn.pid"’) (type: string)
          The OpenVPN pid file.

     ‘proto’ (default: ‘udp’) (type: proto)
          The protocol (UDP or TCP) used to open a channel between
          clients and servers.

     ‘dev’ (default: ‘tun’) (type: dev)
          The device type used to represent the VPN connection.

     ‘ca’ (default: ‘"/etc/openvpn/ca.crt"’) (type: maybe-string)
          The certificate authority to check connections against.

     ‘cert’ (default: ‘"/etc/openvpn/client.crt"’) (type: maybe-string)
          The certificate of the machine the daemon is running on.  It
          should be signed by the authority given in ‘ca’.

     ‘key’ (default: ‘"/etc/openvpn/client.key"’) (type: maybe-string)
          The key of the machine the daemon is running on.  It must be
          the key whose certificate is ‘cert’.

     ‘comp-lzo?’ (default: ‘#t’) (type: boolean)
          Whether to use the lzo compression algorithm.

     ‘persist-key?’ (default: ‘#t’) (type: boolean)
          Don’t re-read key files across SIGUSR1 or –ping-restart.

     ‘persist-tun?’ (default: ‘#t’) (type: boolean)
          Don’t close and reopen TUN/TAP device or run up/down scripts
          across SIGUSR1 or –ping-restart restarts.

     ‘fast-io?’ (default: ‘#f’) (type: boolean)
          (Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a
          call to poll/epoll/select prior to the write operation.

     ‘verbosity’ (default: ‘3’) (type: number)
          Verbosity level.

     ‘tls-auth’ (default: ‘#f’) (type: tls-auth-client)
          Add an additional layer of HMAC authentication on top of the
          TLS control channel to protect against DoS attacks.

     ‘auth-user-pass’ (type: maybe-string)
          Authenticate with server using username/password.  The option
          is a file containing username/password on 2 lines.  Do not use
          a file-like object as it would be added to the store and
          readable by any user.

     ‘verify-key-usage?’ (default: ‘#t’) (type: key-usage)
          Whether to check the server certificate has server usage
          extension.

     ‘bind?’ (default: ‘#f’) (type: bind)
          Bind to a specific local port number.

     ‘resolv-retry?’ (default: ‘#t’) (type: resolv-retry)
          Retry resolving server address.

     ‘remote’ (default: ‘'()’) (type: openvpn-remote-list)
          A list of remote servers to connect to.

           -- Data Type: openvpn-remote-configuration
               Available ‘openvpn-remote-configuration’ fields are:

               ‘name’ (default: ‘"my-server"’) (type: string)
                    Server name.

               ‘port’ (default: ‘1194’) (type: number)
                    Port number the server listens to.

 -- Data Type: openvpn-server-configuration
     Available ‘openvpn-server-configuration’ fields are:

     ‘openvpn’ (default: ‘openvpn’) (type: file-like)
          The OpenVPN package.

     ‘pid-file’ (default: ‘"/var/run/openvpn/openvpn.pid"’) (type: string)
          The OpenVPN pid file.

     ‘proto’ (default: ‘udp’) (type: proto)
          The protocol (UDP or TCP) used to open a channel between
          clients and servers.

     ‘dev’ (default: ‘tun’) (type: dev)
          The device type used to represent the VPN connection.

     ‘ca’ (default: ‘"/etc/openvpn/ca.crt"’) (type: maybe-string)
          The certificate authority to check connections against.

     ‘cert’ (default: ‘"/etc/openvpn/client.crt"’) (type: maybe-string)
          The certificate of the machine the daemon is running on.  It
          should be signed by the authority given in ‘ca’.

     ‘key’ (default: ‘"/etc/openvpn/client.key"’) (type: maybe-string)
          The key of the machine the daemon is running on.  It must be
          the key whose certificate is ‘cert’.

     ‘comp-lzo?’ (default: ‘#t’) (type: boolean)
          Whether to use the lzo compression algorithm.

     ‘persist-key?’ (default: ‘#t’) (type: boolean)
          Don’t re-read key files across SIGUSR1 or –ping-restart.

     ‘persist-tun?’ (default: ‘#t’) (type: boolean)
          Don’t close and reopen TUN/TAP device or run up/down scripts
          across SIGUSR1 or –ping-restart restarts.

     ‘fast-io?’ (default: ‘#f’) (type: boolean)
          (Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a
          call to poll/epoll/select prior to the write operation.

     ‘verbosity’ (default: ‘3’) (type: number)
          Verbosity level.

     ‘tls-auth’ (default: ‘#f’) (type: tls-auth-server)
          Add an additional layer of HMAC authentication on top of the
          TLS control channel to protect against DoS attacks.

     ‘port’ (default: ‘1194’) (type: number)
          Specifies the port number on which the server listens.

     ‘server’ (default: ‘"10.8.0.0 255.255.255.0"’) (type: ip-mask)
          An ip and mask specifying the subnet inside the virtual
          network.

     ‘server-ipv6’ (default: ‘#f’) (type: cidr6)
          A CIDR notation specifying the IPv6 subnet inside the virtual
          network.

     ‘dh’ (default: ‘"/etc/openvpn/dh2048.pem"’) (type: string)
          The Diffie-Hellman parameters file.

     ‘ifconfig-pool-persist’ (default: ‘"/etc/openvpn/ipp.txt"’) (type: string)
          The file that records client IPs.

     ‘redirect-gateway?’ (default: ‘#f’) (type: gateway)
          When true, the server will act as a gateway for its clients.

     ‘client-to-client?’ (default: ‘#f’) (type: boolean)
          When true, clients are allowed to talk to each other inside
          the VPN.

     ‘keepalive’ (default: ‘(10 120)’) (type: keepalive)
          Causes ping-like messages to be sent back and forth over the
          link so that each side knows when the other side has gone
          down.  ‘keepalive’ requires a pair.  The first element is the
          period of the ping sending, and the second element is the
          timeout before considering the other side down.

     ‘max-clients’ (default: ‘100’) (type: number)
          The maximum number of clients.

     ‘status’ (default: ‘"/var/run/openvpn/status"’) (type: string)
          The status file.  This file shows a small report on current
          connection.  It is truncated and rewritten every minute.

     ‘client-config-dir’ (default: ‘'()’) (type: openvpn-ccd-list)
          The list of configuration for some clients.

strongSwan
----------

Currently, the strongSwan service only provides legacy-style
configuration with ‘ipsec.conf’ and ‘ipsec.secrets’ files.

 -- Variable: strongswan-service-type
     A service type for configuring strongSwan for IPsec VPN (Virtual
     Private Networking).  Its value must be a
     ‘strongswan-configuration’ record as in this example:

          (service strongswan-service-type
                   (strongswan-configuration
                    (ipsec-conf "/etc/ipsec.conf")
                    (ipsec-secrets "/etc/ipsec.secrets")))

 -- Data Type: strongswan-configuration
     Data type representing the configuration of the StrongSwan service.

     ‘strongswan’
          The strongSwan package to use for this service.

     ‘ipsec-conf’ (default: ‘#f’)
          The file name of your ‘ipsec.conf’.  If not ‘#f’, then this
          and ‘ipsec-secrets’ must both be strings.

     ‘ipsec-secrets’ (default ‘#f’)
          The file name of your ‘ipsec.secrets’.  If not ‘#f’, then this
          and ‘ipsec-conf’ must both be strings.

Wireguard
.........

 -- Variable: wireguard-service-type
     A service type for a Wireguard tunnel interface.  Its value must be
     a ‘wireguard-configuration’ record as in this example:

          (service wireguard-service-type
                   (wireguard-configuration
                    (peers
                     (list
                      (wireguard-peer
                       (name "my-peer")
                       (endpoint "my.wireguard.com:51820")
                       (public-key "hzpKg9X1yqu1axN6iJp0mWf6BZGo8m1wteKwtTmDGF4=")
                       (allowed-ips '("10.0.0.2/32")))))))

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘wireguard’
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The interface name for the VPN.

     ‘speed’ (default: ‘1.0’)
          List of strings or G-expressions which represent the IP
          addresses to be assigned to the above interface.

     ‘port’ (default: ‘51820’)
          The port on which to listen for incoming connections.

     ‘dns’ (default: ‘'())’)
          List of strings or G-expressions which represent the DNS
          server(s) to announce to VPN clients via DHCP.

     ‘monitor-ips?’ (default: ‘#f’)
          Whether to monitor the resolved Internet addresses (IPs) of
          the endpoints of the configured peers, resetting the peer
          endpoints using an IP address that no longer correspond to
          their freshly resolved host name.  Set this to ‘#t’ if one or
          more endpoints use host names provided by a dynamic DNS
          service to keep the sessions alive.

     ‘monitor-ips-interval’ (default: ‘"*/5 * * * *"’)
          This is the monitoring schedule, expressed as a string in
          traditional cron syntax or as a gexp evaluating to a Shepherd
          calendar event (*note (shepherd)Timers::).

     ‘features’ (default: ‘'()’)
          The private key file for the interface.  It is automatically
          generated if the file does not exist.  If this field is ‘#f’,
          a private key is not automatically created and the path is not
          serialized to the configuration file.

     ‘bootstrap-private-key?’ (default: ‘#t’)
          Whether or not the private key should be generated
          automatically if it does not exist.

          Setting this to ‘#f’ allows one to set the private key using
          command substitution.  One example shown in the ‘wg-quick(8)’
          manual is retrieving a private key using ‘password-store’.
          This can be achieved with the following code:

               (wireguard-configuration
                (private-key
                 #~(string-append "<("
                                  #$(file-append password-store "/bin/pass")
                                  ;; Wireguard replaces %i with the interface name.
                                  " WireGuard/private-keys/%i)")))

     ‘features’ (default: ‘'()’)
          The authorized peers on this interface.  This is a list of
          WIREGUARD-PEER records.

     ‘pre-up’ (default: ‘'()’)
          List of strings or G-expressions.  These are script snippets
          which will be executed before setting up the interface.

     ‘post-up’ (default: ‘'()’)
          List of strings or G-expressions.  These are script snippets
          which will be executed after setting up the interface.

     ‘pre-down’ (default: ‘'()’)
          List of strings or G-expressions.  These are script snippets
          which will be executed before tearing down the interface.

     ‘post-down’ (default: ‘'()’)
          List of strings or G-expressions.  These are script snippets
          which will be executed after tearing down the interface.

     ‘shepherd-requirement’ (default: ‘'()’) (type: list-of-symbols)
          A list of symbols naming Shepherd services that this service
          will depend on.

     ‘table’ (default: ‘"auto"’)
          The routing table to which routes are added, as a string.
          There are two special values: ‘"off"’ that disables the
          creation of routes altogether, and ‘"auto"’ (the default) that
          adds routes to the default table and enables special handling
          of default routes.

     ‘auto-start?’ (default: ‘#t"’)
          Whether the Wireguard network should be started automatically
          by the Shepherd.  If it is ‘#f’ the service has to be started
          manually with ‘herd start wireguard-$interface’ (for example:
          ‘herd start wireguard-wg0’).

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘name’
          Имя роли.

     ‘port’ (default: ‘22’)
          The optional endpoint for the peer, such as
          ‘"demo.wireguard.com:51820"’.

     ‘public-key’
          The peer public-key represented as a base64 string.

     ‘preshared-key’ (default: ‘#f’)
          An optional pre-shared key file for this peer that can be
          either a string or a G-expression.  The given file will not be
          autogenerated.

     ‘allowed-ips’
          A list of IP addresses from which incoming traffic for this
          peer is allowed and to which incoming traffic for this peer is
          directed.

     ‘speed’ (default: ‘1.0’)
          An optional time interval in seconds.  A packet will be sent
          to the server endpoint once per time interval.  This helps
          receiving incoming connections from this peer when you are
          behind a NAT or a firewall.


File: guix.ru.info,  Node: Сетевые файловые системы,  Next: Samba Services,  Prev: VPN-сервисы,  Up: Сервисы

11.10.26 Сетевые файловые системы
---------------------------------

The ‘(gnu services nfs)’ module provides the following services, which
are most commonly used in relation to mounting or exporting directory
trees as “network file systems” (NFS).

   While it is possible to use the individual components that together
make up a Network File System service, we recommended to configure an
NFS server with the ‘nfs-service-type’.

Сервисы DNS
...........

The NFS service takes care of setting up all NFS component services,
kernel configuration file systems, and installs configuration files in
the locations that NFS expects.

 -- Variable: nfs-service-type
     A service type for a complete NFS server.

 -- Конфигурирование: системы
     This data type represents the configuration of the NFS service and
     all of its subsystems.

     GNU Guix зависит от следующих пакетов:
     ‘nfs-utils’ (default: ‘nfs-utils’)
          Используемый пакет nfs-utils.

     ‘speed’ (default: ‘1.0’)
          If a list of string values is provided, the ‘rpc.nfsd’ daemon
          will be limited to supporting the given versions of the NFS
          protocol.

     ‘port’ (default: ‘22’)
          This is a list of directories the NFS server should export.
          Each entry is a list consisting of two elements: a directory
          name and a string containing all options.  This is an example
          in which the directory ‘/export’ is served to all NFS clients
          as a read-only share:

               (nfs-configuration
                (exports
                 '(("/export"
                    "*(ro,insecure,no_subtree_check,crossmnt,fsid=0)"))))

     ‘port’ (default: ‘22’)
          The network port that the ‘rpc.mountd’ daemon should use.

     ‘port’ (default: ‘22’)
          The network port that the ‘rpc.statd’ daemon should use.

     ‘rpcbind’ (default: ‘rpcbind’)
          The rpcbind package to use.

     ‘port’ (default: ‘22’)
          The local NFSv4 domain name.

     ‘port’ (default: ‘22’)
          The network port that the ‘nfsd’ daemon should use.

     ‘features’ (default: ‘'()’)
          The number of threads used by the ‘nfsd’ daemon.

     ‘port’ (default: ‘22’)
          Whether the ‘nfsd’ daemon should listen on a TCP socket.

     ‘port’ (default: ‘22’)
          Whether the ‘nfsd’ daemon should listen on a UDP socket.

     ‘pipefs-directory’ (default: ‘"/var/lib/nfs/rpc_pipefs"’)
          The directory where the pipefs file system is mounted.

     ‘features’ (default: ‘'()’)
          A list of subsystems for which debugging output should be
          enabled.  This is a list of symbols.  Any of these symbols are
          valid: ‘nfsd’, ‘nfs’, ‘rpc’, ‘idmap’, ‘statd’, or ‘mountd’.

   If you don’t need a complete NFS service or prefer to build it
yourself you can use the individual component services that are
documented below.

RPC Bind Service
................

The RPC Bind service provides a facility to map program numbers into
universal addresses.  Many NFS related services use this facility.
Hence it is automatically started when a dependent service starts.

 -- Variable: rpcbind-service-type
     A service type for the RPC portmapper daemon.

 -- Data Type: rpcbind-configuration
     Data type representing the configuration of the RPC Bind Service.
     This type has the following parameters:
     ‘rpcbind’ (default: ‘rpcbind’)
          The rpcbind package to use.

     ‘warm-start?’ (default: ‘#t’)
          If this parameter is ‘#t’, then the daemon will read a state
          file on startup thus reloading state information saved by a
          previous instance.

Pipefs Pseudo File System
.........................

The pipefs file system is used to transfer NFS related data between the
kernel and user space programs.

 -- Variable: pipefs-service-type
     A service type for the pipefs pseudo file system.

 -- Data Type: pipefs-configuration
     Data type representing the configuration of the pipefs pseudo file
     system service.  This type has the following parameters:
     ‘mount-point’ (default: ‘"/var/lib/nfs/rpc_pipefs"’)
          The directory to which the file system is to be attached.

GSS Daemon Service
..................

The “global security system” (GSS) daemon provides strong security for
RPC based protocols.  Before exchanging RPC requests an RPC client must
establish a security context.  Typically this is done using the Kerberos
command ‘kinit’ or automatically at login time using PAM services (*note
Сервисы Kerberos::).

 -- Variable: gss-service-type
     A service type for the Global Security System (GSS) daemon.

 -- Data Type: gss-configuration
     Data type representing the configuration of the GSS daemon service.
     This type has the following parameters:
     ‘nfs-utils’ (default: ‘nfs-utils’)
          The package in which the ‘rpc.gssd’ command is to be found.

     ‘pipefs-directory’ (default: ‘"/var/lib/nfs/rpc_pipefs"’)
          The directory where the pipefs file system is mounted.

IDMAP Daemon Service
....................

The idmap daemon service provides mapping between user IDs and user
names.  Typically it is required in order to access file systems mounted
via NFSv4.

 -- Variable: idmap-service-type
     A service type for the Identity Mapper (IDMAP) daemon.

 -- Data Type: idmap-configuration
     Data type representing the configuration of the IDMAP daemon
     service.  This type has the following parameters:
     ‘nfs-utils’ (default: ‘nfs-utils’)
          The package in which the ‘rpc.idmapd’ command is to be found.

     ‘pipefs-directory’ (default: ‘"/var/lib/nfs/rpc_pipefs"’)
          The directory where the pipefs file system is mounted.

     ‘domain’ (default: ‘#f’)
          The local NFSv4 domain name.  This must be a string or ‘#f’.
          If it is ‘#f’ then the daemon will use the host’s fully
          qualified domain name.

     ‘port’ (default: ‘22’)
          Уровень детализации демона.

Autofs Service
..............

The autofs service automatically mounts and unmounts filesystems.  It
can mount both network and local storage, but is most often used to
manage NFS mounts.

   A typical configuration might look like:

     (operating-system
       (services
        (append
         (list
          (service nfs-service-type (nfs-configuration))
          (service autofs-service-type
                   (autofs-configuration
                    (mounts
                     (list
                      (autofs-indirect-map
                       (mount-point "/net/home")
                       (entries
                        (list
                         ;; Accessing /net/home/foo will mount
                         ;; big.network.server:/home/foo.
                         (autofs-map-entry
                          (type "nfs")
                          (device "big.network.server:/home/&")
                          (mount-point "*"))))))))))
         %base-services)))

 -- Data Type: autofs-indirect-map
     Available ‘autofs-indirect-map’ fields are:

     ‘mount-point’ (type: string)
          Where to mount the indirect map.

     ‘entries’ (default: ‘()’) (type: autofs-map-entries)
          Entries in this map.

 -- Data Type: autofs-map-entry
     Available ‘autofs-map-entry’ fields are:

     ‘type’ (default: ‘"auto"’) (type: string)
          The type of the filesystem.

     ‘device’ (type: string)
          Device or remote host to mount.  May contain special character
          ‘&’, which can be referenced in the MOUNT-POINT field.

     ‘mount-point’ (type: string)
          Directory to mount this device on.  Map entries come in two
          flavors: direct and indirect.  Direct entries map a single
          device to a single mountpoint, while indirect entries can map
          multiple devices to multiple mountpoints.  A direct entry has
          a MOUNT-POINT beginning with ‘/’, representing the absolute
          path of the directory to mount the device on.  For example:

               (autofs-map-entry
                (type "ext4")
                (device "/dev/sdb1")
                (mount-point "/mnt/external-disk"))

          An indirect entry has a MOUNT-POINT not beginning with ‘/’,
          representing the subdirectory within the parent indirect map
          for this entry.  Indirect maps may also use the special
          character ‘*’, which will be replaced with the value of
          special character ‘&’ in the DEVICE field of this entry.  For
          example:

               (autofs-indirect-map
                (mount-point "/devices")
                (entries
                 (list
                  ;; Automount any block device r/o by ID.
                  (autofs-map-entry
                   (type "auto")
                   (mount-point "ro/uuid/*")
                   (device "/dev/disk/by-id/&")
                   (options '(ro)))
                  ;; Automount any block device by UUID.
                  (autofs-map-entry
                   (type "auto")
                   (mount-point "rw/uuid/*")
                   (device "/dev/disk/by-uuid/&")))))

     ‘options’ (default: ‘()’) (type: file-system-options)
          List of mount options.  Some options are simple flags, such as
          ro, noexec, nosuid, etc.  These may be expressed as strings or
          symbols.  Other options also accept a value.  These are
          expressed as pairs of ‘(option . value)’.  ‘option’ may be a
          string or symbol, as with flags.  ‘value’ may be a string,
          symbol, or number.  Example: ‘(ro (errors . remount-ro)
          noexec)’

 -- Data Type: autofs-configuration
     Available ‘autofs-configuration’ fields are:

     ‘autofs’ (default: ‘autofs’) (type: package)
          The autofs package to use.

     ‘mounts’ (default: ‘()’) (type: autofs-mount-maps)
          Mount maps to manage.  This is a list of either direct map
          entries or indirect mount maps.

     ‘timeout’ (default: ‘300’) (type: conf-integer)
          Sets the default mount timeout in seconds.

     ‘master-wait’ (default: ‘10’) (type: conf-integer)
          Sets the default maximum number of retries (actual iterations
          is half this, each is delayed by 2 seconds before retrying)
          waiting for the master map to become available if it cannot be
          read at program start.  This can be longer if the map source
          itself waits for availability (such as sss).

     ‘negative-timeout’ (default: ‘60’) (type: conf-integer)
          Set the default timeout for caching failed key lookups.

     ‘mount-verbose?’ (default: ‘#f’) (type: conf-boolean)
          Use the verbose flag when spawning mount(8), and log some
          process info about the requestor and its parent.

     ‘mount-wait’ (default: ‘-1’) (type: conf-integer)
          Set the default time to wait for a response from a spawned
          mount(8) before sending it a SIGTERM. Note that we still need
          to wait for the RPC layer to timeout before the sub-process
          exits so this isn’t ideal but it is the best we can do.  The
          default is to wait until mount(8) returns without
          intervention.

     ‘umount-wait’ (default: ‘12’) (type: conf-integer)
          Set the default time to wait for a response from a spawned
          umount(8) before sending it a SIGTERM. Note that we still need
          to wait for the RPC layer to timeout before the sub-process
          exits so this isn’t ideal but it is the best we can do.

     ‘browse-mode?’ (default: ‘#t’) (type: conf-boolean)
          Should maps be browsable by default?

     ‘mount-nfs-default-protocol’ (default: ‘3’) (type: conf-integer)
          Set the default protocol that mount.nfs(8) uses when
          performing a mount.  Autofs needs to know the default NFS
          protocol that mount.nfs(8) uses so it can do special case
          handling for its availability probe for different NFS
          protocols.  Since we can’t identify this default automatically
          we need to set it in the autofs configuration.

     ‘append-options?’ (default: ‘#t’) (type: conf-boolean)
          When #t, global options are appended to map entry options.
          When #f, map entry options replace the global options.

     ‘logging’ (type: conf-log-level)
          Default log level.  May be #:none, #:verbose, or #:debug.

     ‘force-standard-program-map-env?’ (default: ‘#f’) (type: conf-boolean)
          Override the use of a prefix with standard environment
          variables when a program map is executed.  Since program maps
          are run as the privileged user setting these standard
          environment variables opens automount(8) to potential user
          privilege escalation when the program map is written in a
          language that can load components from, for example, a user
          home directory.

     ‘map-hash-table-size’ (default: ‘1024’) (type: conf-integer)
          This configuration option may be used to change the number of
          hash table slots.  This configuration option affects the
          overhead of searching the map entry cache for map entries when
          there are a large number of entries.  It affects the number of
          entries that must be looked at to locate a map entry in the
          map entry cache.  For example, the default of 1024 and a
          direct map with 8000 entries would result in each slot
          containing an average of 8 entries, which should be
          acceptable.  However, if excessive CPU usage is observed
          during automount lookups increasing this option can reduce the
          CPU overhead considerably because it reduces the length of the
          search chains.  Note that the number of entries in a map
          doesn’t necessarily relate to the number of entries used in
          the map entry cache.  There are two distinct cases where the
          map hash table can make a significant difference, direct maps
          and indirect maps that use the "browse" option.  For indirect
          maps that do not use the "browse" option entries are added to
          the map entry cache at lookup so the number of active cache
          entries, in this case, is usually much less than the number of
          entries in the map.  In this last case it would be unusual for
          the map entry cache to grow large enough to warrant increasing
          the default before an event that cleans stale entries, a map
          re-read for example.

     ‘use-hostname-for-mounts?’ (default: ‘#f’) (type: conf-boolean)
          NFS mounts where the host name resolves to more than one IP
          address are probed for availability and to establish the order
          in which mounts to them should be tried.  To ensure that mount
          attempts are made only to hosts that are responding and are
          tried in the order of hosts with the quickest response the IP
          address of the host needs to be used for the mount.  If it is
          necessary to use the hostname given in the map entry for the
          mount regardless, then set this option to #t.  Be aware that
          if this is done there is no defense against the host name
          resolving to one that isn’t responding and while the number of
          attempts at a successful mount will correspond to the number
          of addresses the host name resolves to the order will also not
          correspond to fastest responding hosts.

     ‘disable-not-found-message?’ (default: ‘#f’) (type: conf-boolean)
          The original request to add this log message needed it to be
          unconditional.  That produces, IMHO, unnecessary noise in the
          log so a configuration option has been added to provide the
          ability to turn it off.

     ‘use-ignore-mount-option?’ (default: ‘#f’) (type: conf-boolean)
          An option to enable the use of autofs pseudo option "disable".
          This option is used as a hint to user space that the mount
          entry should be omitted from mount table listings.  The
          default is #f to avoid unexpected changes in behaviour and so
          is an opt-in setting.

     ‘sss-master-map-wait’ (default: ‘0’) (type: conf-integer)
          Set the time to wait and retry if sssd is unable to read the
          master map at program start.  Default is 0 (don’t wait) or 10
          if sss supports returning EHSTDOWN when the provider isn’t
          available.  If the sss library upports returning EHOSTDOWN
          when the provider is down then this value is how long to wait
          between re‐ tries reading the master map.  When reading
          dependent maps or looking up a map key this value is
          multiplied by the number of retries that would be used when
          reading the master map.

     ‘use-mount-request-log-id?’ (default: ‘#f’) (type: conf-boolean)
          Set whether to use a mount request log id so that log entries
          for specific mount requests can be easily identified in logs
          that have multiple concurrent requests.


File: guix.ru.info,  Node: Samba Services,  Next: Длительная интеграция,  Prev: Сетевые файловые системы,  Up: Сервисы

11.10.27 Samba Services
-----------------------

Модуль ‘(gnu services samba)’ предоставляет определения служб для Samba,
а также дополнительные вспомогательные службы.  В настоящее время он
предоставляет следующие сервисы.

Samba
.....

Samba (https://www.samba.org) provides network shares for folders and
printers using the SMB/CIFS protocol commonly used on Windows.  It can
also act as an Active Directory Domain Controller (AD DC) for other
hosts in an heterougenious network with different types of Computer
systems.

 -- Variable: samba-service-type

     The service type to enable the samba services ‘samba’, ‘nmbd’,
     ‘smbd’ and ‘winbindd’.  By default this service type does not run
     any of the Samba daemons; they must be enabled individually.

     Below is a basic example that configures a simple, anonymous
     (unauthenticated) Samba file share exposing the ‘/public’
     directory.

          Tip: The ‘/public’ directory and its contents must be world
          readable/writable, so you’ll want to run ‘chmod -R 777
          /public’ on it.

          Caution: Such a Samba configuration should only be used in
          controlled environments, and you should not share any private
          files using it, as anyone connecting to your network would be
          able to access them.

          (service samba-service-type (samba-configuration
                                       (enable-smbd? #t)
                                       (config-file (plain-file "smb.conf" "\
          [global]
          map to guest = Bad User
          logging = syslog@1

          [public]
          browsable = yes
          path = /public
          read only = no
          guest ok = yes
          guest only = yes\n"))))

 -- Data Type: samba-service-configuration
     Configuration record for the Samba suite.

     ‘package’ (default: ‘samba’)
          The samba package to use.

     ‘config-file’ (default: ‘#f’)
          The config file to use.  To learn about its syntax, run ‘man
          smb.conf’.

     ‘enable-samba?’ (default: ‘#f’)
          Enable the ‘samba’ daemon.

     ‘enable-smbd?’ (default: ‘#f’)
          Enable the ‘smbd’ daemon.

     ‘enable-nmbd?’ (default: ‘#f’)
          Enable the ‘nmbd’ daemon.

     ‘enable-winbindd?’ (default: ‘#f’)
          Enable the ‘winbindd’ daemon.

Демон выявлення веб-сервисов
............................

The WSDD (Web Service Discovery daemon) implements the Web Services
Dynamic Discovery
(http://docs.oasis-open.org/ws-dd/discovery/1.1/os/wsdd-discovery-1.1-spec-os.html)
protocol that enables host discovery over Multicast DNS, similar to what
Avahi does.  It is a drop-in replacement for SMB hosts that have had
SMBv1 disabled for security reasons.

 -- Variable: wsdd-service-type
     Service type for the WSD host daemon.  The value for this service
     type is a ‘wsdd-configuration’ record.  The details for the
     ‘wsdd-configuration’ record type are given below.

 -- Data Type: wsdd-configuration
     This data type represents the configuration for the wsdd service.

     ‘package’ (default: ‘wsdd’)
          The wsdd package to use.

     ‘ipv4only?’ (default: ‘#f’)
          Only listen to IPv4 addresses.

     ‘ipv6only’ (default: ‘#f’)
          Only listen to IPv6 addresses.  Please note: Activating both
          options is not possible, since there would be no IP versions
          to listen to.

     ‘chroot’ (default: ‘#f’)
          Chroot into a separate directory to prevent access to other
          directories.  This is to increase security in case there is a
          vulnerability in ‘wsdd’.

     ‘hop-limit’ (default: ‘1’)
          Limit to the level of hops for multicast packets.  The default
          is 1 which should prevent packets from leaving the local
          network.

     ‘interface’ (default: ‘'()’)
          Limit to the given list of interfaces to listen to.  By
          default wsdd will listen to all interfaces.  Except the
          loopback interface is never used.

     ‘uuid-device’ (default: ‘#f’)
          The WSD protocol requires a device to have a UUID. Set this to
          manually assign the service a UUID.

     ‘domain’ (default: ‘#f’)
          Notify this host is a member of an Active Directory.

     ‘host-name’ (default: ‘#f’)
          Manually set the hostname rather than letting ‘wsdd’ inherit
          this host’s hostname.  Only the host name part of a possible
          FQDN will be used in the default case.

     ‘preserve-case?’ (default: ‘#f’)
          By default ‘wsdd’ will convert the hostname in workgroup to
          all uppercase.  The opposite is true for hostnames in domains.
          Setting this parameter will preserve case.

     ‘workgroup’ (default: "WORKGROUP")
          Change the name of the workgroup.  By default ‘wsdd’ reports
          this host being member of a workgroup.


File: guix.ru.info,  Node: Длительная интеграция,  Next: Сервисы управления питанием,  Prev: Samba Services,  Up: Сервисы

11.10.28 Длительная интеграция
------------------------------

Cuirass (https://guix.gnu.org/cuirass/) is a continuous integration tool
for Guix.  It can be used both for development and for providing
substitutes to others (*note Подстановки::).

   The ‘(gnu services cuirass)’ module provides the following service.

 -- Procedure: cuirass-service-type
     The type of the Cuirass service.  Its value must be a
     ‘cuirass-configuration’ object, as described below.

   To add build jobs, you have to set the ‘specifications’ field of the
configuration.  For instance, the following example will build all the
packages provided by the ‘my-channel’ channel.

     (define %cuirass-specs
       #~(list (specification
                (name 'my-channel)
                (build '(channels my-channel))
                (channels
                 (cons (channel
                        (name 'my-channel)
                        (url "https://my-channel.git"))
                       %default-channels)))))

     (service cuirass-service-type
              (cuirass-configuration
               (specifications %cuirass-specs)))

   To build the ‘linux-libre’ package defined by the default Guix
channel, one can use the following configuration.

     (define %cuirass-specs
       #~(list (specification
                (name 'my-linux)
                (build '(packages "linux-libre")))))

     (service cuirass-service-type
              (cuirass-configuration
               (specifications %cuirass-specs)))

   The other configuration possibilities, as well as the specification
record itself are described in the Cuirass manual (*note
(cuirass)Specifications::).

   While information related to build jobs is located directly in the
specifications, global settings for the ‘cuirass’ process are accessible
in other ‘cuirass-configuration’ fields.

 -- Data Type: cuirass-configuration
     Data type representing the configuration of Cuirass.

     ‘cuirass’ (default: ‘cuirass’)
          The Cuirass package to use.

     ‘log-file’ (default: ‘"/var/log/cuirass.log"’)
          Location of the log file.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          Location of the log file used by the web interface.

     ‘cache-directory’ (default: ‘"/var/cache/cuirass"’)
          Location of the repository cache.

     ‘user’ (default: ‘"cuirass"’)
          Owner of the ‘cuirass’ process.

     ‘group’ (default: ‘"cuirass"’)
          Owner’s group of the ‘cuirass’ process.

     ‘interval’ (default: ‘300’)
          Number of seconds between the poll of the repositories
          followed by the Cuirass jobs, by default.

          Note that individual jobset specifications may override this
          in their ‘period’ field; the value specified here is only used
          for specifications that use the default ‘period’ value, which
          is zero.

     ‘parallel-evaluations’ (default: ‘#f’)
          Maximum number of jobset evaluations that may run
          concurrently.  If ‘#f’, that number is determined based on a
          number of CPU cores, with an upper bound of 8.

     ‘ttl’ (default: ‘2592000’)
          Duration to keep build results’ GC roots alive, in seconds.

     ‘evaluation-ttl’ (default: 24 months)
          Number of seconds after which an evaluation may be deleted
          from the database.

     ‘build-expiry’ (default: 4 months)
          Duration in seconds after which pending builds are canceled.
          This helps ensure that the backlog does not grow indefinitely.

     ‘threads’ (default: ‘#f’)
     ‘web-threads’ (default: ‘#f’)
          Number of kernel threads to use for Cuirass (main process) and
          for the web interface (the ‘cuirass web’ program).  The
          default value should be appropriate for most cases.

     ‘port’ (default: ‘22’)
          Read parameters from the given PARAMETERS file.  The supported
          parameters are described here (*note (cuirass)Parameters::).

     ‘features’ (default: ‘'()’)
          A ‘cuirass-remote-server-configuration’ record to use the
          build remote mechanism or ‘#f’ to use the default build
          mechanism.

     ‘port’ (default: ‘22’)
          Use DATABASE as the database containing the jobs and the past
          build results.  Since Cuirass uses PostgreSQL as a database
          engine, DATABASE must be a string such as ‘"dbname=cuirass
          host=localhost"’.

     ‘port’ (default: ‘8081’)
          Port number used by the HTTP server.

     ‘host’ (default: ‘"localhost"’)
          Listen on the network interface for HOST.  The default is to
          accept connections from localhost.

     ‘specifications’ (default: ‘#~'()’)
          A gexp (*note G-Expressions::) that evaluates to a list of
          specifications records.  The specification record is described
          in the Cuirass manual (*note (cuirass)Specifications::).

     ‘one-shot?’ (default: ‘#f’)
          Only evaluate specifications and build derivations once.

     ‘fallback?’ (default: ‘#f’)
          When substituting a pre-built binary fails, fall back to
          building packages locally.

     ‘extra-options’ (default: ‘'()’)
          Extra options to pass when running the ‘cuirass register’
          process.

     ‘web-extra-options’ (default: ‘'()’)
          Extra options to pass when running the ‘cuirass web’ process.

последний коммит, сборка
........................

Cuirass supports two mechanisms to build derivations.

   • Запуск демона сборки.  This is the default build mechanism.  Once
     the build jobs are evaluated, they are sent to the local Guix
     daemon.  Cuirass then listens to the Guix daemon output to detect
     the various build events.

   • Подготовка отдельного окружения сборки.  The build jobs are not
     submitted to the local Guix daemon.  Instead, a remote server
     dispatches build requests to the connect remote workers, according
     to the build priorities.

   To enable this build mode a ‘cuirass-remote-server-configuration’
record must be passed as ‘remote-server’ argument of the
‘cuirass-configuration’ record.  The
‘cuirass-remote-server-configuration’ record is described below.

   This build mode scales way better than the default build mode.  This
is the build mode that is used on the GNU Guix build farm at
<https://ci.guix.gnu.org>.  It should be preferred when using Cuirass to
build large amount of packages.

 -- Data Type: pagekite-configuration
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          The TCP port for communicating with ‘remote-worker’ processes
          using ZMQ. It defaults to ‘5555’.

     ‘port’ (default: ‘22’)
          The TCP port of the log server.  It defaults to ‘5556’.

     ‘port’ (default: ‘22’)
          The TCP port of the publish server.  It defaults to ‘5557’.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          Location of the log file.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          Use CACHE directory to cache build log files.

     ‘log-expiry’ (default: 6 months)
          The duration in seconds after which build logs collected by
          ‘cuirass remote-worker’ may be deleted.

     ‘features’ (default: ‘'()’)
          Once a substitute is successfully fetched, trigger substitute
          baking at TRIGGER-URL.

     ‘publish?’ (default: ‘#t’)
          If set to false, do not start a publish server and ignore the
          ‘publish-port’ argument.  This can be useful if there is
          already a standalone publish server standing next to the
          remote server.

     ‘public-key’
     ‘private-key’
          Use the specific FILEs as the public/private key pair used to
          sign the store items being published.

   At least one remote worker must also be started on any machine of the
local network to actually perform the builds and report their status.

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘cuirass’ (default: ‘cuirass’)
          The Cuirass package to use.

     ‘features’ (default: ‘'()’)
          Start WORKERS parallel workers.

     ‘features’ (default: ‘'()’)
          Do not use Avahi discovery and connect to the given ‘server’
          IP address instead.

     ‘port’ (default: ‘22’)
          Only request builds for the given SYSTEMS.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          Location of the log file.

     ‘port’ (default: ‘22’)
          The TCP port of the publish server.  It defaults to ‘5558’.

     ‘port’ (default: ‘22’)
          The list of URLs where to look for substitutes by default.

     ‘public-key’
     ‘private-key’
          Use the specific FILEs as the public/private key pair used to
          sign the store items being published.

Laminar
.......

Laminar (https://laminar.ohwg.net/) is a lightweight and modular
Continuous Integration service.  It doesn’t have a configuration web UI
instead uses version-controllable configuration files and scripts.

   Laminar encourages the use of existing tools such as bash and cron
instead of reinventing them.

 -- Variable: laminar-service-type
     The type of the Laminar service.  Its value must be a
     ‘laminar-configuration’ object, as described below.

     All configuration values have defaults, a minimal configuration to
     get Laminar running is shown below.  By default, the web interface
     is available on port 8080.

          (service openssh-service-type)

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘port’ (default: ‘22’)
          Используемый пакет Mumi.

     ‘port’ (default: ‘22’)
          The directory for job configurations and run directories.

     ‘supplementary-groups’ (default: ‘()’)
          Supplementary groups for the Laminar user account.

     ‘port’ (default: ‘22’)
          The interface/port or unix socket on which laminard should
          listen for incoming connections to the web frontend.

     ‘port’ (default: ‘22’)
          The interface/port or unix socket on which laminard should
          listen for incoming commands such as build triggers.

     ‘port’ (default: ‘22’)
          Сервис rottlog.

     ‘features’ (default: ‘'()’)
          Set to an integer defining how many rundirs to keep per job.
          The lowest-numbered ones will be deleted.  The default is 0,
          meaning all run dirs will be immediately deleted.

     ‘features’ (default: ‘'()’)
          The web frontend served by laminard will use this URL to form
          links to artefacts archived jobs.

     ‘features’ (default: ‘'()’)
          URI для использования в базе данных.

Forgejo Runner
..............

The ‘(gnu services ci)’ also provides a service for Forgejo Runner
(https://code.forgejo.org/forgejo/runner), a daemon that connects to an
instance of the Forgejo code collaboration tool (https://forgejo.org)
and runs jobs for continuous integration.

   A minimal configuration mostly with default values that can be added
to the ‘services’ field of your operating system looks like this:

     (service forgejo-runner-service-type
              (forgejo-runner-configuration
               (name "my-runner")
               (labels '("guix" "linux"))))

   This provides a ‘forgejo-runner’ Shepherd service.  That service will
initially fail to start; you will have to manually “register” the runner
against the Forgejo server by running a command like:

     herd register forgejo-runner URL TOKEN

...  where the arguments are as follows:

URL
     the URL of the Forgejo server—e.g., ‘https://codeberg.org’;
TOKEN
     an access token provided by the Forgejo server
     (https://forgejo.org/docs/latest/admin/runner-installation/#standard-registration).

   Once registration has succeeded, you can start the runner:

     herd enable forgejo-runner
     herd start forgejo-runner

   The runner then receives orders from the Forgejo server to execute
“actions”.  Actions are commands and workflows specified by YAML files
in the ‘.forgejo/workflows’ directory of source code repositories—see
the Forgejo Action documentation
(https://forgejo.org/docs/v7.0/user/actions/) for more info.

   Note that at the moment ‘forgejo-runner-service-type’ lets you run
only one runner.  Details about the configuration of this service
follow.

 -- Variable: forgejo-runner-service-type
     This is the service type for Forgejo Runner.  Its value must be a
     ‘forgejo-runner-configuration’ record, documented below.

 -- Data Type: forgejo-runner-configuration
     This data type represents the configuration of an instance of
     ‘forgejo-runner-service-type’.  It contains the following fields:

     ‘package’ (default: ‘forgejo-runner’)
          The Forgejo Runner package to use.

     ‘name’ (default: ‘#~(gethostname)’)
          Name of the runner as will be shown in the runner management
          interface of Forgejo.

     ‘labels’ (default: ‘'("guix")’)
          List of labels
          (https://forgejo.org/docs/latest/admin/actions/#choosing-labels)
          representing the type of environment the runner provides and
          that actions may refer to.

     ‘capacity’ (default: ‘1’)
          Number of tasks to be executed concurrently.

     ‘timeout’ (default: ‘(* 3 3600)’)
          Maximum duration of a job, in seconds.

     ‘fetch-timeout’ (default: ‘5’)
          Maximum duration for fetching the job from the Forgejo server,
          in seconds.

     ‘fetch-interval’ (default: ‘2’)
          Interval (in seconds) for fetching the job from the Forgejo
          server.

     ‘report-interval’ (default: ‘1’)
          Interval (in seconds) for reporting the job status and log to
          the Forgejo server.

     ‘data-directory’ (default: ‘"/var/lib/forgejo-runner"’)
          Directory where ‘forgejo-runner’ will store persistent data
          such as its configuration and access token.

     ‘run-directory’ (default: ‘"/var/run/forgejo-runner"’)
          Directory where ‘forgejo-runner’ stores cached data.

     ‘log-file’ (default: ‘"/var/log/forgejo-runner.log"’)
          Name of the ‘forgejo-runner’ log file.


File: guix.ru.info,  Node: Сервисы управления питанием,  Next: Сервисы аудио,  Prev: Длительная интеграция,  Up: Сервисы

11.10.29 Сервисы управления питанием
------------------------------------

Power Profiles Daemon
.....................

The ‘(gnu services pm)’ module provides a Guix service definition for
the Linux Power Profiles Daemon, which makes power profiles handling
available over D-Bus.

   The available profiles consist of the default ‘balanced’ mode, a
‘power-saver’ mode and on supported systems a ‘performance’ mode.

     Важно: The ‘power-profiles-daemon’ conflicts with other power
     management tools like ‘tlp’.  Using both together is not
     recommended.

 -- Variable: power-profiles-daemon-service-type
     This is the service type for the Power Profiles Daemon
     (https://gitlab.freedesktop.org/upower/power-profiles-daemon/).
     The value for this service is a
     ‘power-profiles-daemon-configuration’.

     To enable the Power Profiles Daemon with default configuration add
     this line to your services:

          (service power-profiles-daemon-service-type)

 -- Data Type: power-profiles-daemon-configuration
     Data type representing the configuration of
     ‘power-profiles-daemon-service-type’.

     ‘power-profiles-daemon’ (default: ‘power-profiles-daemon’) (type: file-like)
          Package object of power-profiles-daemon.

TLP daemon
..........

The ‘(gnu services pm)’ module provides a Guix service definition for
the Linux power management tool TLP.

   TLP enables various powersaving modes in userspace and kernel.
Contrary to ‘upower-service’, it is not a passive, monitoring tool, as
it will apply custom settings each time a new power source is detected.
More information can be found at TLP home page
(https://linrunner.de/en/tlp/tlp.html).

 -- Variable: tlp-service-type
     The service type for the TLP tool.  The default settings are
     optimised for battery life on most systems, but you can tweak them
     to your heart’s content by adding a valid ‘tlp-configuration’:
          (service tlp-service-type
                   (tlp-configuration
                    (cpu-scaling-governor-on-ac (list "performance"))
                    (sched-powersave-on-bat? #t)))

   Each parameter definition is preceded by its type; for example,
‘boolean foo’ indicates that the ‘foo’ parameter should be specified as
a boolean.  Types starting with ‘maybe-’ denote parameters that won’t
show up in TLP config file when their value is left unset, or is
explicitly set to the ‘%unset-value’ value.

   Available ‘tlp-configuration’ fields are:

 -- tlp-configuration parameter: package tlp
     The TLP package.

 -- tlp-configuration parameter: boolean tlp-enable?
     Set to true if you wish to enable TLP.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: string tlp-default-mode
     Default mode when no power supply can be detected.  Alternatives
     are AC and BAT.

     Defaults to ‘"AC"’.

 -- tlp-configuration parameter: non-negative-integer
          disk-idle-secs-on-ac
     Number of seconds Linux kernel has to wait after the disk goes
     idle, before syncing on AC.

     Defaults to ‘0’.

 -- tlp-configuration parameter: non-negative-integer
          disk-idle-secs-on-bat
     Same as ‘disk-idle-ac’ but on BAT mode.

     Defaults to ‘2’.

 -- tlp-configuration parameter: non-negative-integer
          max-lost-work-secs-on-ac
     Dirty pages flushing periodicity, expressed in seconds.

     Defaults to ‘15’.

 -- tlp-configuration parameter: non-negative-integer
          max-lost-work-secs-on-bat
     Same as ‘max-lost-work-secs-on-ac’ but on BAT mode.

     Defaults to ‘60’.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          cpu-scaling-governor-on-ac
     CPU frequency scaling governor on AC mode.  With intel_pstate
     driver, alternatives are powersave and performance.  With
     acpi-cpufreq driver, alternatives are ondemand, powersave,
     performance and conservative.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          cpu-scaling-governor-on-bat
     Same as ‘cpu-scaling-governor-on-ac’ but on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-scaling-min-freq-on-ac
     Set the min available frequency for the scaling governor on AC.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-scaling-max-freq-on-ac
     Set the max available frequency for the scaling governor on AC.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-scaling-min-freq-on-bat
     Set the min available frequency for the scaling governor on BAT.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-scaling-max-freq-on-bat
     Set the max available frequency for the scaling governor on BAT.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-min-perf-on-ac
     Limit the min P-state to control the power dissipation of the CPU,
     in AC mode.  Values are stated as a percentage of the available
     performance.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-max-perf-on-ac
     Limit the max P-state to control the power dissipation of the CPU,
     in AC mode.  Values are stated as a percentage of the available
     performance.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-min-perf-on-bat
     Same as ‘cpu-min-perf-on-ac’ on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          cpu-max-perf-on-bat
     Same as ‘cpu-max-perf-on-ac’ on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-boolean cpu-boost-on-ac?
     Enable CPU turbo boost feature on AC mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-boolean cpu-boost-on-bat?
     Same as ‘cpu-boost-on-ac?’ on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: boolean sched-powersave-on-ac?
     Allow Linux kernel to minimize the number of CPU
     cores/hyper-threads used under light load conditions.

     Defaults to ‘#f’.

 -- tlp-configuration parameter: boolean sched-powersave-on-bat?
     Same as ‘sched-powersave-on-ac?’ but on BAT mode.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: boolean nmi-watchdog?
     Enable Linux kernel NMI watchdog.

     Defaults to ‘#f’.

 -- tlp-configuration parameter: maybe-string phc-controls
     For Linux kernels with PHC patch applied, change CPU voltages.  An
     example value would be ‘"F:V F:V F:V F:V"’.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: string energy-perf-policy-on-ac
     Set CPU performance versus energy saving policy on AC.
     Alternatives are performance, normal, powersave.

     Defaults to ‘"performance"’.

 -- tlp-configuration parameter: string energy-perf-policy-on-bat
     Same as ‘energy-perf-policy-ac’ but on BAT mode.

     Defaults to ‘"powersave"’.

 -- tlp-configuration parameter: space-separated-string-list
          disks-devices
     Hard disk devices.

 -- tlp-configuration parameter: space-separated-string-list
          disk-apm-level-on-ac
     Hard disk advanced power management level.

 -- tlp-configuration parameter: space-separated-string-list
          disk-apm-level-on-bat
     Same as ‘disk-apm-bat’ but on BAT mode.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          disk-spindown-timeout-on-ac
     Hard disk spin down timeout.  One value has to be specified for
     each declared hard disk.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          disk-spindown-timeout-on-bat
     Same as ‘disk-spindown-timeout-on-ac’ but on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          disk-iosched
     Select IO scheduler for disk devices.  One value has to be
     specified for each declared hard disk.  Example alternatives are
     cfq, deadline and noop.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: string sata-linkpwr-on-ac
     SATA aggressive link power management (ALPM) level.  Alternatives
     are min_power, medium_power, max_performance.

     Defaults to ‘"max_performance"’.

 -- tlp-configuration parameter: string sata-linkpwr-on-bat
     Same as ‘sata-linkpwr-ac’ but on BAT mode.

     Defaults to ‘"min_power"’.

 -- tlp-configuration parameter: maybe-string sata-linkpwr-blacklist
     Exclude specified SATA host devices for link power management.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-on-off-boolean
          ahci-runtime-pm-on-ac?
     Enable Runtime Power Management for AHCI controller and disks on AC
     mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-on-off-boolean
          ahci-runtime-pm-on-bat?
     Same as ‘ahci-runtime-pm-on-ac’ on BAT mode.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: non-negative-integer
          ahci-runtime-pm-timeout
     Seconds of inactivity before disk is suspended.

     Defaults to ‘15’.

 -- tlp-configuration parameter: string pcie-aspm-on-ac
     PCI Express Active State Power Management level.  Alternatives are
     default, performance, powersave.

     Defaults to ‘"performance"’.

 -- tlp-configuration parameter: string pcie-aspm-on-bat
     Same as ‘pcie-aspm-ac’ but on BAT mode.

     Defaults to ‘"powersave"’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          start-charge-thresh-bat0
     Percentage when battery 0 should begin charging.  Only supported on
     some laptops.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          stop-charge-thresh-bat0
     Percentage when battery 0 should stop charging.  Only supported on
     some laptops.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          start-charge-thresh-bat1
     Percentage when battery 1 should begin charging.  Only supported on
     some laptops.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-non-negative-integer
          stop-charge-thresh-bat1
     Percentage when battery 1 should stop charging.  Only supported on
     some laptops.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: string radeon-power-profile-on-ac
     Radeon graphics clock speed level.  Alternatives are low, mid,
     high, auto, default.

     Defaults to ‘"high"’.

 -- tlp-configuration parameter: string radeon-power-profile-on-bat
     Same as ‘radeon-power-ac’ but on BAT mode.

     Defaults to ‘"low"’.

 -- tlp-configuration parameter: string radeon-dpm-state-on-ac
     Radeon dynamic power management method (DPM). Alternatives are
     battery, performance.

     Defaults to ‘"performance"’.

 -- tlp-configuration parameter: string radeon-dpm-state-on-bat
     Same as ‘radeon-dpm-state-ac’ but on BAT mode.

     Defaults to ‘"battery"’.

 -- tlp-configuration parameter: string radeon-dpm-perf-level-on-ac
     Radeon DPM performance level.  Alternatives are auto, low, high.

     Defaults to ‘"auto"’.

 -- tlp-configuration parameter: string radeon-dpm-perf-level-on-bat
     Same as ‘radeon-dpm-perf-ac’ but on BAT mode.

     Defaults to ‘"auto"’.

 -- tlp-configuration parameter: on-off-boolean wifi-pwr-on-ac?
     Wifi power saving mode.

     Defaults to ‘#f’.

 -- tlp-configuration parameter: on-off-boolean wifi-pwr-on-bat?
     Same as ‘wifi-power-ac?’ but on BAT mode.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: y-n-boolean wol-disable?
     Disable wake on LAN.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: non-negative-integer
          sound-power-save-on-ac
     Timeout duration in seconds before activating audio power saving on
     Intel HDA and AC97 devices.  A value of 0 disables power saving.

     Defaults to ‘0’.

 -- tlp-configuration parameter: non-negative-integer
          sound-power-save-on-bat
     Same as ‘sound-powersave-ac’ but on BAT mode.

     Defaults to ‘1’.

 -- tlp-configuration parameter: y-n-boolean
          sound-power-save-controller?
     Disable controller in powersaving mode on Intel HDA devices.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: boolean bay-poweroff-on-bat?
     Enable optical drive in UltraBay/MediaBay on BAT mode.  Drive can
     be powered on again by releasing (and reinserting) the eject lever
     or by pressing the disc eject button on newer models.

     Defaults to ‘#f’.

 -- tlp-configuration parameter: string bay-device
     Name of the optical drive device to power off.

     Defaults to ‘"sr0"’.

 -- tlp-configuration parameter: string runtime-pm-on-ac
     Runtime Power Management for PCI(e) bus devices.  Alternatives are
     on and auto.

     Defaults to ‘"on"’.

 -- tlp-configuration parameter: string runtime-pm-on-bat
     Same as ‘runtime-pm-ac’ but on BAT mode.

     Defaults to ‘"auto"’.

 -- tlp-configuration parameter: boolean runtime-pm-all?
     Runtime Power Management for all PCI(e) bus devices, except
     blacklisted ones.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: maybe-space-separated-string-list
          runtime-pm-blacklist
     Exclude specified PCI(e) device addresses from Runtime Power
     Management.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: space-separated-string-list
          runtime-pm-driver-blacklist
     Exclude PCI(e) devices assigned to the specified drivers from
     Runtime Power Management.

 -- tlp-configuration parameter: boolean usb-autosuspend?
     Enable USB autosuspend feature.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: maybe-string usb-blacklist
     Exclude specified devices from USB autosuspend.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: boolean usb-blacklist-wwan?
     Exclude WWAN devices from USB autosuspend.

     Defaults to ‘#t’.

 -- tlp-configuration parameter: maybe-string usb-whitelist
     Include specified devices into USB autosuspend, even if they are
     already excluded by the driver or via ‘usb-blacklist-wwan?’.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: maybe-boolean
          usb-autosuspend-disable-on-shutdown?
     Enable USB autosuspend before shutdown.

     Defaults to ‘disabled’.

 -- tlp-configuration parameter: boolean
          restore-device-state-on-startup?
     Restore radio device state (bluetooth, wifi, wwan) from previous
     shutdown on system startup.

     Defaults to ‘#f’.

 -- tlp-configuration parameter: string cpu-energy-perf-policy-on-ac
     Set CPU energy/performance policy when on AC mode.  Possible
     values, in order of increasing power saving, are performance,
     balance_performance, default, balance_power and power.

 -- tlp-configuration parameter: string cpu-energy-perf-policy-on-bat
     Set CPU energy/performance policy when on BAT mode.  Possible
     values, in order of increasing power saving, are performance,
     balance_performance, default, balance_power and power.

Thermald daemon
...............

The ‘(gnu services pm)’ module provides an interface to thermald, a CPU
frequency scaling service which helps prevent overheating.

 -- Variable: thermald-service-type
     This is the service type for thermald
     (https://01.org/linux-thermal-daemon/), the Linux Thermal Daemon,
     which is responsible for controlling the thermal state of
     processors and preventing overheating.

 -- Data Type: thermald-configuration
     Data type representing the configuration of
     ‘thermald-service-type’.

     ‘adaptive?’ (default: ‘#f’)
          Use DPTF (Dynamic Power and Thermal Framework) adaptive tables
          when present.

     ‘ignore-cpuid-check?’ (default: ‘#f’)
          Ignore cpuid check for supported CPU models.

     ‘thermald’ (default: THERMALD)
          Package object of thermald.

          PowerTOP
          ........

          The ‘(gnu services pm)’ module also provides a service
          definition for PowerTOP (https://01.org/powertop/), a power
          consumption analysis and tuning tool.  When started, it tunes
          Linux kernel settings to reduce power consumption.

           -- Variable: powertop-service-type
               The service type for PowerTOP. No configuration is
               necessary.  When the service starts, it executes
               ‘powertop --auto-tune’.

                    (service powertop-service-type)

          Available ‘powertop-configuration’ fields are:

           -- powertop-configuration parameter: package powertop
               The PowerTOP package.  Defaults to ‘powertop’ in the
               ‘(gnu packages linux)’ module

   The ‘(gnu services power)’ module provides a service definition for
apcupsd (http://www.apcupsd.org/), a utility to interact with APC (APC
by Schneider Electric or formerly American Power Conversion Corporation)
UPS (Uninterruptible Power Supply) devices.  Apcupsd also works with
some OEM (Original Equipment Manufacturer)-branded products manufactured
by APC.

 -- Variable: apcupsd-service-type
     The service type for apcupsd.  For USB UPSes no configuration is
     necessary, however tweaking some fields to better suit your needs
     might be desirable.  The defaults are taken from the upstream
     configuration and they are not very conservative (for example, the
     default ‘battery-level’ of 5% may be considered too low by some).

     The default event handlers do send emails, read more in *note
     apcupsd-event-handlers::.

          (service apcupsd-service-type)

 -- Data Type: apcupsd-configuration

     Available ‘apcupsd-configuration’ fields are:

     ‘apcupsd’ (default: ‘apcupsd’) (type: package)
          The ‘apcupsd’ package to use.

     ‘shepherd-service-name’ (default: ‘apcupsd’) (type: symbol)
          The name of the shepherd service.  You can add the service
          multiple times with different names to manage multiple UPSes.

     ‘auto-start?’ (default: ‘#t’) (type: boolean)
          Should the shepherd service auto-start?

     ‘pid-file’ (default: ‘"/var/run/apcupsd.pid"’) (type: string)
          The file name of the pid file.

     ‘debug-level’ (default: ‘0’) (type: integer)
          The logging verbosity.  Bigger number means more logs.  The
          source code uses up to ‘300’ as debug level value, so a value
          of ‘999’ seems reasonable to enable all the logs.

     ‘run-dir’ (default: ‘"/var/run/apcupsd"’) (type: string)
          The directory containing runtime information.  You need to
          change this if you desire to run multiple instances of the
          daemon.

     ‘name’ (type: maybe-string)
          Use this to give your UPS a name in log files and such.  This
          is particularly useful if you have multiple UPSes.  This does
          not set the EEPROM. It should be 8 characters or less.

     ‘cable’ (default: ‘usb’) (type: enum-cable)
          The type of a cable connecting the UPS to your computer.
          Possible generic choices are ‘'simple’, ‘'smart’, ‘'ether’ and
          ‘'usb’.

          Alternatively, a specific cable model number may be used:
          ‘'940-0119A’, ‘'940-0127A’, ‘'940-0128A’, ‘'940-0020B’,
          ‘'940-0020C’, ‘'940-0023A’, ‘'940-0024B’, ‘'940-0024C’,
          ‘'940-1524C’, ‘'940-0024G’, ‘'940-0095A’, ‘'940-0095B’,
          ‘'940-0095C’, ‘'940-0625A’, ‘'M-04-02-2000’.

     ‘type’ (default: ‘usb’) (type: enum-type)
          The type of the UPS you have.

          ‘apcsmart’
               Newer serial character device, appropriate for SmartUPS
               models using a serial cable (not an USB).

          ‘usb’
               Most new UPSes are an USB.

          ‘net’
               Network link to a master apcupsd through apcupsd’s
               Network Information Server.  This is used if the UPS
               powering your computer is connected to a different
               computer for monitoring.

          ‘snmp’
               SNMP network link to an SNMP-enabled UPS device.

          ‘netsnmp’
               Same as the SNMP above but requires use of the net-snmp
               library.  Unless you have a specific need for this old
               driver, you should use the ‘'snmp’ instead.

          ‘dumb’
               An old serial character device for use with
               simple-signaling UPSes.

          ‘pcnet’
               A PowerChute Network Shutdown protocol which can be used
               as an alternative to an SNMP with the AP9617 family of
               smart slot cards.

          ‘modbus’
               A serial device for use with newest SmartUPS models
               supporting the MODBUS protocol.

     ‘device’ (default: ‘""’) (type: string)
          For USB UPSes, usually you want to set this to an empty string
          (the default).  For other UPS types, you must specify an
          appropriate port or address.

          ‘apcsmart’
               Set to the appropriate ‘/dev/tty**’ device.

          ‘usb’
               A null string setting enables auto-detection, which is
               the best choice for most installations.

          ‘net’
               Set to ‘HOSTNAME:PORT’.

          ‘snmp’
               Set to ‘HOSTNAME:PORT:VENDOR:COMMUNITY’.  The HOSTNAME is
               the ip address or hostname of the UPS on the network.
               The VENDOR can be can be "APC" or "APC_NOTRAP".
               "APC_NOTRAP" will disable SNMP trap catching; you usually
               want "APC". The PORT is usually 161.  The COMMUNITY is
               usually "private".

          ‘netsnmp’
               Same as the ‘'snmp’.

          ‘dumb’
               Set to the appropriate ‘/dev/tty**’ device.

          ‘pcnet’
               Set to ‘IPADDR:USERNAME:PASSPHRASE:PORT’.  The IPADDR is
               the IP address of the UPS management card.  The USERNAME
               and the PASSPHRASE are the credentials for which the card
               has been configured.  The PORT is the port number on
               which to listen for messages from the UPS, normally 3052.
               If this parameter is empty or missing, the default of
               3052 will be used.

          ‘modbus’
               Set to the appropriate ‘/dev/tty**’ device.  You can also
               leave it empty for MODBUS over USB or set to the serial
               number of the UPS.

     ‘poll-time’ (default: ‘60’) (type: integer)
          The interval (in seconds) at which apcupsd polls the UPS for
          status.  This setting applies both to directly-attached UPSes
          (apcsmart, usb, dumb) and networked UPSes (net, snmp).
          Lowering this setting will improve the apcupsd’s
          responsiveness to certain events at the cost of higher CPU
          utilization.

     ‘on-batery-delay’ (default: ‘6’) (type: integer)
          The time in seconds from when a power failure is detected
          until we react to it with an onbattery event.  The ‘'powerout’
          event will be triggered immediately when a power failure is
          detected.  However, the ‘'onbattery’ event will be trigger
          only after this delay.

     ‘battery-level’ (default: ‘5’) (type: integer)
          If during a power failure, the remaining battery percentage
          (as reported by the UPS) is below or equal to this value, the
          apcupsd will initiate a system shutdown.

               Примечание: ‘battery-level’, ‘remaining-minutes’, and
               ‘timeout’ work in a conjunction, so the first that occurs
               will cause the initiation of a shutdown.

     ‘remaining-minutes’ (default: ‘3’) (type: integer)
          If during a power failure, the remaining runtime in minutes
          (as calculated internally by the UPS) is below or equal to
          this value, apcupsd will initiate a system shutdown.

               Примечание: ‘battery-level’, ‘remaining-minutes’, and
               ‘timeout’ work in a conjunction, so the first that occurs
               will cause the initiation of a shutdown.

     ‘timeout’ (default: ‘0’) (type: integer)
          If during a power failure, the UPS has run on batteries for
          this many seconds or longer, apcupsd will initiate a system
          shutdown.  The value of 0 disables this timer.

               Примечание: ‘battery-level’, ‘remaining-minutes’, and
               ‘timeout’ work in a conjunction, so the first that occurs
               will cause the initiation of a shutdown.

     ‘annoy-interval’ (default: ‘300’) (type: integer)
          The time in seconds between annoying users (via the ‘'annoyme’
          event) to sign off prior to system shutdown.  0 disables.

     ‘annoy-delay’ (default: ‘60’) (type: integer)
          The initial delay in seconds after a power failure before
          warning users to get off the system.

     ‘no-logon’ (default: ‘disable’) (type: enum-no-logon)
          The condition which determines when users are prevented from
          logging in during a power failure.

     ‘kill-delay’ (default: ‘0’) (type: integer)
          If this is non-zero, the apcupsd will continue running after a
          shutdown has been requested, and after the specified time in
          seconds attempt to kill the power.  This is for use on systems
          where apcupsd cannot regain control after a shutdown.

     ‘net-server’ (default: ‘#f’) (type: boolean)
          If enabled, a network information server process will be
          started.

     ‘net-server-ip’ (default: ‘"127.0.0.1"’) (type: string)
          An IP address on which the NIS server will listen for incoming
          connections.

     ‘net-server-port’ (default: ‘3551’) (type: integer)
          An IP port on which the NIS server will listen for incoming
          connections.

     ‘net-server-events-file’ (type: maybe-string)
          If you want the last few EVENTS to be available over the
          network by the network information server, you must set this
          to a file name.

     ‘net-server-events-file-max-size’ (default: ‘10’) (type: integer)
          The maximum size of the events file in kilobytes.

     ‘class’ (default: ‘standalone’) (type: enum-class)
          Normally standalone unless you share an UPS using an APC
          ShareUPS card.

     ‘mode’ (default: ‘disable’) (type: enum-mode)
          Normally disable unless you share an UPS using an APC ShareUPS
          card.

     ‘stat-time’ (default: ‘0’) (type: integer)
          The time interval in seconds between writing the status file,
          0 disables.

     ‘log-stats’ (default: ‘#f’) (type: boolean)
          Also write the stats as a logs.  This generates a lot of
          output.

     ‘data-time’ (default: ‘0’) (type: integer)
          The time interval in seconds between writing the data records
          to the log file, 0 disables.

     ‘facility’ (type: maybe-string)
          The logging facility for the syslog.

     ‘event-handlers’ (type: apcupsd-event-handlers)
          Handlers for events produced by apcupsd.

 -- Data Type: apcupsd-event-handlers

     For a description of the events please refer to ‘man 8 apccontrol’.

     Each handler shall be a gexp.  It is spliced into the control
     script for the daemon.  In addition to the standard Guile
     programming environment, the following procedures and variables are
     also available:

     ‘conf’
          Variable containing the file name of the configuration file.

     ‘powerfail-file’
          Variable containing the file name of the powerfail file.

     ‘cmd’
          The event currently being handled.

     ‘name’
          The name of the UPS as specified in the configuration file.

     ‘connected?’
          Is ‘#t’ if ‘apcupsd’ is connected to the UPS via a serial port
          (or a USB port).  In most configurations, this will be the
          case.  In the case of a Slave machine where apcupsd is not
          directly connected to the UPS, this value will be ‘#f’.

     ‘powered?’
          Is ‘#t’ if the computer on which ‘apcupsd’ is running is
          powered by the UPS and ‘#f’ if not.  At the moment, this value
          is unimplemented and always ‘#f’.

     ‘(err FMT ARGS...)’
          Wrapper around ‘format’ outputting to ‘(current-error-port)’.

     ‘(wall FMT ARGS...)’
          Wrapper around ‘format’ outputting via ‘wall’.

     ‘(apcupsd ARGS...)’
          Call ‘apcupsd’ while passing the correct configuration file
          and all the arguments.

     ‘(mail-to-root SUBJECT BODY)’
          Send an email to the local administrator.  This procedure
          assumes the ‘sendmail’ is located at
          ‘/run/privileged/bin/sendmail’ (as would be the case with
          ‘opensmtpd-service-type’).

     Available ‘apcupsd-event-handlers’ fields are:

     ‘modules’ (type: gexp)
          Additional modules to import into the generated handler
          script.

     ‘killpower’ (type: gexp)
          The handler for the killpower event.

     ‘commfailure’ (type: gexp)
          The handler for the commfailure event.

     ‘commok’ (type: gexp)
          The handler for the commfailure event.

     ‘powerout’ (type: gexp)
          The handler for the powerout event.

     ‘onbattery’ (type: gexp)
          The handler for the onbattery event.

     ‘offbattery’ (type: gexp)
          The handler for the offbattery event.

     ‘mainsback’ (type: gexp)
          The handler for the mainsback event.

     ‘failing’ (type: gexp)
          The handler for the failing event.

     ‘timeout’ (type: gexp)
          The handler for the timeout event.

     ‘loadlimit’ (type: gexp)
          The handler for the loadlimit event.

     ‘runlimit’ (type: gexp)
          The handler for the runlimit event.

     ‘doreboot’ (type: gexp)
          The handler for the doreboot event.

     ‘doshutdown’ (type: gexp)
          The handler for the doshutdown event.

     ‘annoyme’ (type: gexp)
          The handler for the annoyme event.

     ‘emergency’ (type: gexp)
          The handler for the emergency event.

     ‘changeme’ (type: gexp)
          The handler for the changeme event.

     ‘remotedown’ (type: gexp)
          The handler for the remotedown event.

     ‘startselftest’ (type: gexp)
          The handler for the startselftest event.

     ‘endselftest’ (type: gexp)
          The handler for the endselftest event.

     ‘battdetach’ (type: gexp)
          The handler for the battdetach event.

     ‘battattach’ (type: gexp)
          The handler for the battattach event.


File: guix.ru.info,  Node: Сервисы аудио,  Next: Сервисы виртуализации,  Prev: Сервисы управления питанием,  Up: Сервисы

11.10.30 Сервисы аудио
----------------------

The ‘(gnu services audio)’ module provides a service to start MPD (the
Music Player Daemon).

Music Player Daemon
...................

The Music Player Daemon (MPD) is a service that can play music while
being controlled from the local machine or over the network by a variety
of clients.

   The following example shows the simplest configuration to locally
expose, via PulseAudio, a music collection kept at ‘/srv/music’, with
‘mpd’ running as the default ‘mpd’ user.  This user will spawn its own
PulseAudio daemon, which may compete for the sound card access with that
of your own user.  In this configuration, you may have to stop the
playback of your user audio applications to hear MPD’s output and
vice-versa.

     (service mpd-service-type
              (mpd-configuration
               (music-directory "/srv/music")))

     Важно: The music directory must be readable to the MPD user, by
     default, ‘mpd’.  Permission problems will be reported via
     ‘Permission denied’ errors in the MPD logs, which appear in
     ‘/var/log/messages’ by default.

   Most MPD clients will trigger a database update upon connecting, but
you can also use the ‘update’ action do to so:

     herd update mpd

   All the MPD configuration fields are documented below, and a more
complex example follows.

 -- Variable: mpd-service-type
     The service type for ‘mpd’

 -- Data Type: mpd-configuration
     Available ‘mpd-configuration’ fields are:

     ‘package’ (default: ‘mpd’) (type: file-like)
          The MPD package.

     ‘user’ (type: user-account)
          The user to run mpd as.

     ‘group’ (type: user-group)
          The group to run mpd as.

          The default ‘%mpd-group’ is a system group with name “mpd”.

     ‘shepherd-requirement’ (default: ‘'()’) (type: list-of-symbols)
          A list of symbols naming Shepherd services that this service
          will depend on.

     ‘environment-variables’ (default: ‘'("PULSE_CLIENTCONFIG=/etc/pulse/client.conf" "PULSE_CONFIG=/etc/pulse/daemon.conf")’) (type: list-of-strings)
          A list of strings specifying environment variables.

     ‘log-file’ (type: maybe-string)
          The location of the log file.  Unless specified, logs are sent
          to the local syslog daemon.  Alternatively, a log file name
          can be specified, for example ‘/var/log/mpd.log’.

     ‘log-level’ (type: maybe-string)
          Suppress any messages below this threshold.  The available
          values, in decreasing order of verbosity, are: ‘verbose’,
          ‘info’, ‘notice’, ‘warning’ and ‘error’.

     ‘music-directory’ (type: maybe-string)
          The directory to scan for music files.

     ‘music-dir’ (type: maybe-string)
          The directory to scan for music files.

     ‘playlist-directory’ (type: maybe-string)
          The directory to store playlists.

     ‘playlist-dir’ (type: maybe-string)
          The directory to store playlists.

     ‘db-file’ (type: maybe-string)
          The location of the music database.  When left unspecified,
          ‘~/.cache/db’ is used.

     ‘state-file’ (type: maybe-string)
          The location of the file that stores current MPD’s state.

     ‘sticker-file’ (type: maybe-string)
          The location of the sticker database.

     ‘default-port’ (default: ‘6600’) (type: maybe-port)
          The default port to run mpd on.

     ‘endpoints’ (type: maybe-list-of-strings)
          The addresses that mpd will bind to.  A port different from
          DEFAULT-PORT may be specified, e.g.  ‘localhost:6602’ and IPv6
          addresses must be enclosed in square brackets when a different
          port is used.  To use a Unix domain socket, an absolute path
          or a path starting with ‘~’ can be specified here.

     ‘address’ (type: maybe-string)
          The address that mpd will bind to.  To use a Unix domain
          socket, an absolute path can be specified here.

     ‘database’ (type: maybe-mpd-plugin)
          MPD database plugin configuration.

     ‘partitions’ (default: ‘'()’) (type: list-of-mpd-partition)
          List of MPD "partitions".

     ‘neighbors’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD neighbor plugin configurations.

     ‘inputs’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD input plugin configurations.

     ‘archive-plugins’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD archive plugin configurations.

     ‘auto-update?’ (type: maybe-boolean)
          Whether to automatically update the music database when files
          are changed in the MUSIC-DIRECTORY.

     ‘input-cache-size’ (type: maybe-string)
          MPD input cache size.

     ‘decoders’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD decoder plugin configurations.

     ‘resampler’ (type: maybe-mpd-plugin)
          MPD resampler plugin configuration.

     ‘filters’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD filter plugin configurations.

     ‘outputs’ (type: list-of-mpd-plugin-or-output)
          The audio outputs that MPD can use.  By default this is a
          single output using pulseaudio.

     ‘playlist-plugins’ (default: ‘'()’) (type: list-of-mpd-plugin)
          List of MPD playlist plugin configurations.

     ‘extra-options’ (default: ‘'()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the configuration.

 -- Data Type: mpd-plugin
     Data type representing a ‘mpd’ plugin.

     ‘plugin’ (type: maybe-string)
          Plugin name.

     ‘name’ (type: maybe-string)
          Name.

     ‘enabled?’ (type: maybe-boolean)
          Whether the plugin is enabled/disabled.

     ‘extra-options’ (default: ‘'()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the plugin configuration.  See MPD plugin
          reference (https://mpd.readthedocs.io/en/latest/plugins.html)
          for available options.

 -- Data Type: mpd-partition
     Data type representing a ‘mpd’ partition.

     ‘name’ (type: string)
          Partition name.

     ‘extra-options’ (default: ‘'()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the partition configuration.  See
          Configuring Partitions
          (https://mpd.readthedocs.io/en/latest/user.html#configuring-partitions)
          for available options.

 -- Data Type: mpd-output
     Available ‘mpd-output’ fields are:

     ‘name’ (default: ‘"MPD"’) (type: string)
          The name of the audio output.

     ‘type’ (default: ‘"pulse"’) (type: string)
          The type of audio output.

     ‘enabled?’ (default: ‘#t’) (type: boolean)
          Specifies whether this audio output is enabled when MPD is
          started.  By default, all audio outputs are enabled.  This is
          just the default setting when there is no state file; with a
          state file, the previous state is restored.

     ‘format’ (type: maybe-string)
          Force a specific audio format on output.  See Global Audio
          Format
          (https://mpd.readthedocs.io/en/latest/user.html#audio-output-format)
          for a more detailed description.

     ‘tags?’ (default: ‘#t’) (type: boolean)
          If set to ‘#f’, then MPD will not send tags to this output.
          This is only useful for output plugins that can receive tags,
          for example the ‘httpd’ output plugin.

     ‘always-on?’ (default: ‘#f’) (type: boolean)
          If set to ‘#t’, then MPD attempts to keep this audio output
          always open.  This may be useful for streaming servers, when
          you don’t want to disconnect all listeners even when playback
          is accidentally stopped.

     ‘mixer-type’ (type: maybe-string)
          This field accepts a string that specifies which mixer should
          be used for this audio output: the ‘hardware’ mixer, the
          ‘software’ mixer, the ‘null’ mixer (allows setting the volume,
          but with no effect; this can be used as a trick to implement
          an external mixer External Mixer) or no mixer (‘none’).  When
          left unspecified, a ‘hardware’ mixer is used for devices that
          support it.

     ‘replay-gain-handler’ (type: maybe-string)
          This field accepts a string that specifies how Replay Gain
          (https://mpd.readthedocs.io/en/latest/user.html#replay-gain)
          is to be applied.  ‘software’ uses an internal software volume
          control, ‘mixer’ uses the configured (hardware) mixer control
          and ‘none’ disables replay gain on this audio output.

     ‘extra-options’ (default: ‘'()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the audio output configuration.

   The following example shows a configuration of ‘mpd’ that configures
some of its plugins and provides a HTTP audio streaming output.

     (service mpd-service-type
              (mpd-configuration
                (outputs
                  (list (mpd-output
                          (name "streaming")
                          (type "httpd")
                          (mixer-type 'null)
                          (extra-options
                           `((encoder . "vorbis")
                             (port    . "8080"))))))
                (decoders
                  (list (mpd-plugin
                          (plugin "mikmod")
                          (enabled? #f))
                        (mpd-plugin
                          (plugin "openmpt")
                          (enabled? #t)
                          (extra-options `((repeat-count . -1)
                                           (interpolation-filter . 1))))))
                (resampler (mpd-plugin
                             (plugin "libsamplerate")
                             (extra-options `((type . 0)))))))

myMPD
.....

myMPD (https://jcorporation.github.io/myMPD/) is a web server frontend
for MPD that provides a mobile friendly web client for MPD.

   The following example shows a myMPD instance listening on port 80,
with album cover caching disabled.

     (service mympd-service-type
              (mympd-configuration
               (port 80)
               (covercache-ttl 0)))

 -- Variable: mympd-service-type
     The service type for ‘mympd’.

 -- Data Type: mympd-configuration
     Доступными полями ‘mympd-configuration’ являются:

     ‘package’ (default: ‘mympd’) (type: file-like)
          The package object of the myMPD server.

     ‘shepherd-requirement’ (default: ‘'()’) (type: list-of-symbols)
          This is a list of symbols naming Shepherd services that this
          service will depend on.

     ‘user’ (default: ‘%mympd-user’) (type: user-account)
          Owner of the ‘mympd’ process.

          The default ‘%mympd-user’ is a system user with the name
          “mympd”, who is a part of the group GROUP (see below).

     ‘group’ (default: ‘%mympd-group’) (type: user-group)
          Owner group of the ‘mympd’ process.

          The default ‘%mympd-group’ is a system group with name
          “mympd”.
     ‘work-directory’ (default: ‘"/var/lib/mympd"’) (type: string)
          Where myMPD will store its data.

     ‘cache-directory’ (default: ‘"/var/cache/mympd"’) (type: string)
          Where myMPD will store its cache.

     ‘acl’ (type: maybe-mympd-ip-acl)
          ACL to access the myMPD webserver.

     ‘covercache-ttl’ (default: ‘31’) (type: maybe-integer)
          How long to keep cached covers, ‘0’ disables cover caching.

     ‘http?’ (default: ‘#t’) (type: boolean)
          HTTP support.

     ‘host’ (default: ‘"[::]"’) (type: string)
          Host name to listen on.

     ‘port’ (default: ‘80’) (type: maybe-port)
          HTTP port to listen on.

     ‘log-level’ (default: ‘5’) (type: integer)
          How much detail to include in logs, possible values: ‘0’ to
          ‘7’.

     ‘log-to’ (type: maybe-string)
          Where to send logs.  Unless specified, the service logs to the
          local syslog service under the ‘daemon’ facility.
          Alternatively, a log file name can be specified, for example
          ‘/var/log/mympd.log’.

     ‘lualibs’ (default: ‘"all"’) (type: maybe-string)
          See
          <https://jcorporation.github.io/myMPD/scripting/#lua-standard-libraries>.

     ‘uri’ (type: maybe-string)
          Override URI to myMPD. See
          <https://github.com/jcorporation/myMPD/issues/950>.

     ‘script-acl’ (default: ‘(mympd-ip-acl (allow '("127.0.0.1")))’) (type: maybe-mympd-ip-acl)
          ACL to access the myMPD script backend.

     ‘ssl?’ (default: ‘#f’) (type: boolean)
          SSL/TLS support.

     ‘ssl-port’ (default: ‘443’) (type: maybe-port)
          Port to listen for HTTPS.

     ‘ssl-cert’ (type: maybe-string)
          Path to PEM encoded X.509 SSL/TLS certificate (public key).

     ‘ssl-key’ (type: maybe-string)
          Path to PEM encoded SSL/TLS private key.

     ‘pin-hash’ (type: maybe-string)
          SHA-256 hashed pin used by myMPD to control settings access by
          prompting a pin from the user.

     ‘save-caches?’ (type: maybe-boolean)
          Whether to preserve caches between service restarts.

 -- Data Type: mympd-ip-acl
     Доступными полями ‘mympd-ip-acl’ являются:

     ‘allow’ (default: ‘'()’) (type: list-of-strings)
          Allowed IP addresses.

     ‘deny’ (default: ‘'()’) (type: list-of-strings)
          Disallowed IP addresses.


File: guix.ru.info,  Node: Сервисы виртуализации,  Next: Сервисы упраления версиями,  Prev: Сервисы аудио,  Up: Сервисы

11.10.31 Сервисы виртуализации
------------------------------

The ‘(gnu services virtualization)’ module provides services for the
libvirt and virtlog daemons, as well as other virtualization-related
services.

Libvirt daemon
..............

‘libvirtd’ is the server side daemon component of the libvirt
virtualization management system.  This daemon runs on host servers and
performs required management tasks for virtualized guests.  To connect
to the libvirt daemon as an unprivileged user, it must be added to the
‘libvirt’ group, as shown in the example below.

 -- Variable: libvirt-service-type
     This is the type of the libvirt daemon (https://libvirt.org).  Its
     value must be a ‘libvirt-configuration’.

          (users (cons (user-account
                        (name "user")
                        (group "users")
                        (supplementary-groups '("libvirt"
                                                "audio" "video" "wheel")))
                       %base-user-accounts))
          (service libvirt-service-type
                   (libvirt-configuration
                    (tls-port "16555")))

 -- Data Type: libvirt-configuration
     Available ‘libvirt-configuration’ fields are:

     ‘libvirt’ (default: ‘libvirt’) (type: file-like)
          Libvirt package.

     ‘qemu’ (default: ‘qemu’) (type: file-like)
          The QEMU package to use.

     ‘dmidecode’ (default: ‘dmidecode’) (type: file-like)
          The Dmidecode package to use.

     ‘requirement’ (default: ‘'()’) (type: list-of-symbols)
          Shepherd services dependencies to the provisioned Shepherd
          service.

     ‘firmwares’ (default: ‘(ovmf-x86-64)’) (type: list-of-file-likes)
          List of UEFI/BIOS firmware packages to make available.  Each
          firmware package should contain a
          ‘share/qemu/firmware/NAME.json’ QEMU firmware metadata file.

     ‘listen-tls?’ (default: ‘#t’) (type: boolean)
          Flag listening for secure TLS connections on the public TCP/IP
          port.  must set ‘listen’ for this to have any effect.  It is
          necessary to setup a CA and issue server certificates before
          using this capability.

     ‘listen-tcp?’ (default: ‘#f’) (type: boolean)
          Listen for unencrypted TCP connections on the public TCP/IP
          port.  must set ‘listen’ for this to have any effect.  Using
          the TCP socket requires SASL authentication by default.  Only
          SASL mechanisms which support data encryption are allowed.
          This is DIGEST_MD5 and GSSAPI (Kerberos5).

     ‘tls-port’ (default: ‘"16514"’) (type: string)
          Port for accepting secure TLS connections This can be a port
          number, or service name.

     ‘tcp-port’ (default: ‘"16509"’) (type: string)
          Port for accepting insecure TCP connections This can be a port
          number, or service name.

     ‘listen-addr’ (default: ‘"0.0.0.0"’) (type: string)
          IP address or hostname used for client connections.

     ‘mdns-adv?’ (default: ‘#f’) (type: boolean)
          Flag toggling mDNS advertisement of the libvirt service.

     ‘mdns-name’ (default: ‘"Virtualization Host terra"’) (type: string)
          Default mDNS advertisement name.  This must be unique on the
          immediate broadcast network.

     ‘unix-sock-group’ (default: ‘"libvirt"’) (type: string)
          UNIX domain socket group ownership.  This can be used to allow
          a trusted set of users access to management capabilities
          without becoming root.

     ‘unix-sock-ro-perms’ (default: ‘"0777"’) (type: string)
          UNIX socket permissions for the R/O socket.  This is used for
          monitoring VM status only.

     ‘unix-sock-rw-perms’ (default: ‘"0770"’) (type: string)
          UNIX socket permissions for the R/W socket.  Default allows
          only root.  If PolicyKit is enabled on the socket, the default
          will change to allow everyone (e.g., ‘"0777"’).

     ‘unix-sock-admin-perms’ (default: ‘"0777"’) (type: string)
          UNIX socket permissions for the admin socket.  Default allows
          only owner (root), do not change it unless you are sure to
          whom you are exposing the access to.

     ‘unix-sock-dir’ (default: ‘"/var/run/libvirt"’) (type: string)
          The directory in which sockets will be found/created.

     ‘auth-unix-ro’ (default: ‘"polkit"’) (type: string)
          Authentication scheme for UNIX read-only sockets.  By default
          socket permissions allow anyone to connect.

     ‘auth-unix-rw’ (default: ‘"polkit"’) (type: string)
          Authentication scheme for UNIX read-write sockets.  By default
          socket permissions only allow root.  If PolicyKit support was
          compiled into libvirt, the default will be to use ’polkit’
          auth.

     ‘auth-tcp’ (default: ‘"sasl"’) (type: string)
          Authentication scheme for TCP sockets.  If you don’t enable
          SASL, then all TCP traffic is cleartext.  Don’t do this
          outside of a development/test scenario.

     ‘auth-tls’ (default: ‘"none"’) (type: string)
          Authentication scheme for TLS sockets.  TLS sockets already
          have encryption provided by the TLS layer, and limited
          authentication is done by certificates.  It is possible to
          make use of any SASL authentication mechanism as well, by
          using ‘"sasl"’ for this option

     ‘access-drivers’ (default: ‘()’) (type: optional-list)
          API access control scheme.  By default an authenticated user
          is allowed access to all APIs.  Access drivers can place
          restrictions on this.

     ‘key-file’ (default: ‘""’) (type: string)
          Server key file path.  If set to an empty string, then no
          private key is loaded.

     ‘cert-file’ (default: ‘""’) (type: string)
          Server key file path.  If set to an empty string, then no
          certificate is loaded.

     ‘ca-file’ (default: ‘""’) (type: string)
          Server key file path.  If set to an empty string, then no CA
          certificate is loaded.

     ‘crl-file’ (default: ‘""’) (type: string)
          Certificate revocation list path.  If set to an empty string,
          then no CRL is loaded.

     ‘tls-no-sanity-cert’ (default: ‘#f’) (type: boolean)
          Disable verification of our own server certificates.  When
          ‘libvirtd’ starts it performs some sanity checks against its
          own certificates.

     ‘tls-no-verify-cert’ (default: ‘#f’) (type: boolean)
          Disable verification of client certificates.  Client
          certificate verification is the primary authentication
          mechanism.  Any client which does not present a certificate
          signed by the CA will be rejected.

     ‘tls-allowed-dn-list’ (default: ‘()’) (type: optional-list)
          Whitelist of allowed x509 Distinguished Name.

     ‘sasl-allowed-usernames’ (default: ‘()’) (type: optional-list)
          Whitelist of allowed SASL usernames.  The format for username
          depends on the SASL authentication mechanism.

     ‘tls-priority’ (default: ‘"NORMAL"’) (type: string)
          Override the compile time default TLS priority string.  The
          default is usually "NORMAL" unless overridden at build time.
          Only set this if it is desired for libvirt to deviate from the
          global default settings.

     ‘max-clients’ (default: ‘5000’) (type: integer)
          Maximum number of concurrent client connections to allow over
          all sockets combined.

     ‘max-queued-clients’ (default: ‘1000’) (type: integer)
          Maximum length of queue of connections waiting to be accepted
          by the daemon.  Note, that some protocols supporting
          re-transmission may obey this so that a later reattempt at
          connection succeeds.

     ‘max-anonymous-clients’ (default: ‘20’) (type: integer)
          Maximum length of queue of accepted but not yet authenticated
          clients.  Set this to zero to turn this feature off.

     ‘min-workers’ (default: ‘5’) (type: integer)
          Number of workers to start up initially.

     ‘max-workers’ (default: ‘20’) (type: integer)
          Maximum number of worker threads.  If the number of active
          clients exceeds ‘min-workers’, then more threads are spawned,
          up to ‘max_workers’ limit.  Typically you’d want ‘max_workers’
          to equal maximum number of clients allowed.

     ‘prio-workers’ (default: ‘5’) (type: integer)
          Number of priority workers.  If all workers from above pool
          are stuck, some calls marked as high priority (notably
          domainDestroy) can be executed in this pool.

     ‘max-requests’ (default: ‘20’) (type: integer)
          Total global limit on concurrent RPC calls.

     ‘max-client-requests’ (default: ‘5’) (type: integer)
          Limit on concurrent requests from a single client connection.
          To avoid one client monopolizing the server this should be a
          small fraction of the global max_requests and max_workers
          parameter.

     ‘admin-min-workers’ (default: ‘1’) (type: integer)
          Same as ‘min-workers’ but for the admin interface.

     ‘admin-max-workers’ (default: ‘5’) (type: integer)
          Same as ‘max-workers’ but for the admin interface.

     ‘admin-max-clients’ (default: ‘5’) (type: integer)
          Same as ‘max-clients’ but for the admin interface.

     ‘admin-max-queued-clients’ (default: ‘5’) (type: integer)
          Same as ‘max-queued-clients’ but for the admin interface.

     ‘admin-max-client-requests’ (default: ‘5’) (type: integer)
          Same as ‘max-client-requests’ but for the admin interface.

     ‘log-level’ (default: ‘3’) (type: integer)
          Semi-deprecated option for the logging level: using the
          ‘log-filters’ option instead is recommend, as it provides
          finer control.  The log level can be set to ‘4’ for errors,
          ‘3’ for warnings, ‘2’ for information or ‘1’ for debug.  Note
          that since ‘log-filters’ and ‘log-outputs’ take precedence
          over this option, you will need to also adjust their logging
          levels to avoid filtering out messages.

     ‘log-filters’ (default: ‘"3:remote 4:event"’) (type: string)
          Logging filters.  A filter allows selecting a different
          logging level for a given category of logs.  The format for a
          filter is either ‘X:NAME’ or ‘X:+NAME’, where name is a string
          which is matched against the category given in the
          ‘VIR_LOG_INIT()’ at the top of each libvirt source file, e.g.,
          ‘"remote"’, ‘"qemu"’, or ‘"util.json"’.  NAME can be a
          substring of the full category name, in order to match
          multiple similar categories.  The optional ‘+’ prefix tells
          libvirt to log stack traces for each message matching NAME.  X
          is the log level value used to filter the associated message
          category.  X can be set to ‘4’ for errors, ‘3’ for warnings,
          ‘2’ for information, or ‘1’ for debug.  Multiple filters can
          be defined in a single filters statement, as space-separated
          values.  Since ‘log-outputs’ also include a level filter, you
          may need to also adjust its value to see all the filtered
          messages.

     ‘log-outputs’ (default: ‘"3:syslog:libvirtd"’) (type: string)
          Logging outputs.  An output is one of the places to save
          logging information.  The format for an output has the form
          ‘"X:var{output}"’, where OUTPUT can be ‘stderr’,
          ‘syslog:NAME’, where NAME is the syslog ‘ident’ value to use,
          or ‘file:FILE_NAME’, where FILE_NAME is the file name of the
          file to output to.  X is the minimal level, which acts as a
          filter.  X can be set to X can be set to ‘4’ for errors, ‘3’
          for warnings, ‘2’ for information, or ‘1’ for debug.  Multiple
          filters can be defined in a single filters statement, as
          space-separated values.

     ‘audit-level’ (default: ‘1’) (type: integer)
          Modify the behavior of the auditing subsystem.  ‘0’ disables
          all auditing, samp{1} enables auditing only if enabled on
          thehost and ‘2’ enables auditing but exits if it is disabled
          on the host.

     ‘audit-logging’ (default: ‘#f’) (type: boolean)
          Send audit messages via libvirt logging infrastructure.

     ‘host-uuid’ (default: ‘""’) (type: optional-string)
          Host UUID. UUID must not have all digits be the same.

     ‘host-uuid-source’ (default: ‘"smbios"’) (type: string)
          Source to read host UUID. Use ‘"smbios"’ to fetch the UUID via
          ‘dmidecode -s system-uuid’, or ‘"machine-id"’ to fetch the
          UUID from ‘/etc/machine-id’.  If ‘dmidecode’ does not provide
          a valid UUID a temporary UUID will be generated.

     ‘keepalive-interval’ (default: ‘5’) (type: integer)
          A keepalive message is sent to a client after
          ‘keepalive_interval’ seconds of inactivity to check if the
          client is still responding.  If set to ‘-1’, libvirtd won’t
          send keepalive requests; however clients can still send them
          and the daemon will send responses.

     ‘keepalive-count’ (default: ‘5’) (type: integer)
          Maximum number of keepalive messages that are allowed to be
          sent to the client without getting any response before the
          connection is considered broken.  In other words, the
          connection is automatically closed approximately after
          ‘keepalive_interval * (keepalive_count + 1)’ seconds since the
          last message received from the client.  When ‘keepalive-count’
          is set to ‘0’, connections will be automatically closed after
          ‘keepalive-interval’ seconds of inactivity without sending any
          keepalive messages.

     ‘admin-keepalive-interval’ (default: ‘5’) (type: integer)
          Same as above but for admin interface.

     ‘admin-keepalive-count’ (default: ‘5’) (type: integer)
          Same as above but for admin interface.

     ‘ovs-timeout’ (default: ‘5’) (type: integer)
          Timeout for Open vSwitch calls.  The ‘ovs-vsctl’ utility is
          used for the configuration and its timeout option is set by
          default to 5 seconds to avoid potential infinite waits
          blocking libvirt.

Virtlog daemon
..............

The virtlogd service is a server side daemon component of libvirt that
is used to manage logs from virtual machine consoles.

   This daemon is not used directly by libvirt client applications,
rather it is called on their behalf by ‘libvirtd’.  By maintaining the
logs in a standalone daemon, the main ‘libvirtd’ daemon can be restarted
without risk of losing logs.  The ‘virtlogd’ daemon has the ability to
re-exec() itself upon receiving ‘SIGUSR1’, to allow live upgrades
without downtime.

 -- Variable: virtlog-service-type
     This is the type of the virtlog daemon.  Its value must be a
     ‘virtlog-configuration’.

          (service virtlog-service-type
                   (virtlog-configuration
                    (max-clients 1000)))

 -- libvirt parameter: package libvirt
     Libvirt package.

 -- virtlog-configuration parameter: integer log-level
     Logging level.  4 errors, 3 warnings, 2 information, 1 debug.

     Defaults to ‘3’.

 -- virtlog-configuration parameter: string log-filters
     Logging filters.

     A filter allows to select a different logging level for a given
     category of logs The format for a filter is one of:

        • x:name

        • x:+name

     where ‘name’ is a string which is matched against the category
     given in the ‘VIR_LOG_INIT()’ at the top of each libvirt source
     file, e.g., "remote", "qemu", or "util.json" (the name in the
     filter can be a substring of the full category name, in order to
     match multiple similar categories), the optional "+" prefix tells
     libvirt to log stack trace for each message matching name, and ‘x’
     is the minimal level where matching messages should be logged:

        • 1: DEBUG

        • 2: INFO

        • 3: WARNING

        • 4: ERROR

     Multiple filters can be defined in a single filters statement, they
     just need to be separated by spaces.

     Defaults to ‘"3:remote 4:event"’.

 -- virtlog-configuration parameter: string log-outputs
     Logging outputs.

     An output is one of the places to save logging information The
     format for an output can be:

     ‘x:stderr’
          output goes to stderr

     ‘x:syslog:name’
          use syslog for the output and use the given name as the ident

     ‘x:file:file_path’
          output to a file, with the given filepath

     ‘x:journald’
          output to journald logging system

     In all case the x prefix is the minimal level, acting as a filter

        • 1: DEBUG

        • 2: INFO

        • 3: WARNING

        • 4: ERROR

     Multiple outputs can be defined, they just need to be separated by
     spaces.

     Defaults to ‘"3:stderr"’.

 -- virtlog-configuration parameter: integer max-clients
     Maximum number of concurrent client connections to allow over all
     sockets combined.

     Defaults to ‘1024’.

 -- virtlog-configuration parameter: integer max-size
     Maximum file size before rolling over.

     Defaults to ‘2MB’

 -- virtlog-configuration parameter: integer max-backups
     Maximum number of backup files to keep.

     Defaults to ‘3’

Transparent Emulation with QEMU
...............................

‘qemu-binfmt-service-type’ provides support for transparent emulation of
program binaries built for different architectures—e.g., it allows you
to transparently execute an ARMv7 program on an x86_64 machine.  It
achieves this by combining the QEMU (https://www.qemu.org) emulator and
the ‘binfmt_misc’ feature of the kernel Linux.  This feature only allows
you to emulate GNU/Linux on a different architecture, but see below for
GNU/Hurd support.

 -- Variable: qemu-binfmt-service-type
     This is the type of the QEMU/binfmt service for transparent
     emulation.  Its value must be a ‘qemu-binfmt-configuration’ object,
     which specifies the QEMU package to use as well as the architecture
     we want to emulated:

          (service qemu-binfmt-service-type
                   (qemu-binfmt-configuration
                     (platforms (lookup-qemu-platforms "arm" "aarch64"))))

     In this example, we enable transparent emulation for the ARM and
     aarch64 platforms.  Running ‘herd stop qemu-binfmt’ turns it off,
     and running ‘herd start qemu-binfmt’ turns it back on (*note the
     ‘herd’ command: (shepherd)Invoking herd.).

 -- Data Type: qemu-binfmt-configuration
     This is the configuration for the ‘qemu-binfmt’ service.

     ‘platforms’ (default: ‘'()’)
          The list of emulated QEMU platforms.  Each item must be a
          “platform object” as returned by ‘lookup-qemu-platforms’ (see
          below).

          For example, let’s suppose you’re on an x86_64 machine and you
          have this service:

               (service qemu-binfmt-service-type
                        (qemu-binfmt-configuration
                          (platforms (lookup-qemu-platforms "arm" "aarch64"))))

          You can run:

               guix build -s armhf-linux inkscape

          and it will build Inkscape for ARMv7 _as if it were a native
          build_, transparently using QEMU to emulate the ARMv7 CPU.
          Pretty handy if you’d like to test a package build for an
          architecture you don’t have access to!

     ‘qemu’ (default: ‘qemu’)
          The QEMU package to use.

 -- Procedure: lookup-qemu-platforms platforms...
     Return the list of QEMU platform objects corresponding to
     PLATFORMS....  PLATFORMS must be a list of strings corresponding to
     platform names, such as ‘"arm"’, ‘"sparc"’, ‘"mips64el"’, and so
     on.

 -- Procedure: qemu-platform? obj
     Return true if OBJ is a platform object.

 -- Procedure: qemu-platform-name platform
     Return the name of PLATFORM—a string such as ‘"arm"’.

QEMU Guest Agent
................

The QEMU guest agent provides control over the emulated system to the
host.  The ‘qemu-guest-agent’ service runs the agent on Guix guests.  To
control the agent from the host, open a socket by invoking QEMU with the
following arguments:

     qemu-system-x86_64 \
     	-chardev socket,path=/tmp/qga.sock,server=on,wait=off,id=qga0 \
     	-device virtio-serial \
     	-device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0 \
     	...

   This creates a socket at ‘/tmp/qga.sock’ on the host.  Once the guest
agent is running, you can issue commands with ‘socat’:

     $ guix shell socat -- socat unix-connect:/tmp/qga.sock stdio
     {"execute": "guest-get-host-name"}
     {"return": {"host-name": "guix"}}

   See QEMU guest agent documentation
(https://wiki.qemu.org/Features/GuestAgent) for more options and
commands.

 -- Variable: qemu-guest-agent-service-type
     Service type for the QEMU guest agent service.

 -- Data Type: qemu-guest-agent-configuration
     Configuration for the ‘qemu-guest-agent’ service.

     ‘port’ (default: ‘22’)
          The QEMU package to use.

     ‘device’ (default: ‘""’)
          File name of the device or socket the agent uses to
          communicate with the host.  If empty, QEMU uses a default file
          name.

Xen Guest Agent
...............

The Xen guest agent allows a Xen host to control the emulated system.
The ‘xe-guest-utilities’ service runs the agent on Guix guests.

   xe-guest-utilities (https://github.com/xenserver/xe-guest-utilities)
collects information about the running virtualized guest.  This
includes:
   • static information
        • The operating system running
        • The Linux kernel version

   • dynamic information
        • Network interfaces (devices) being added/removed
        • Network connections being unplugged/plugged-in
        • CPUs being added or removed
        • The guest migrating, being paused/resumed, etc.

   • ephemeral information
        • The amount of memory currently in-use and free
        • The amount of disk-space used

     Примечание: The default Linux-libre kernel that Guix ships already
     enables the necessary paravirtualization features for a guest.
     There is nothing you need to do for the guest to support Xen’s
     paravirtualization features.

     The guest utilities are used to have the guest report information
     _back_ to the virtualizing host and support tasks that require
     cooperation between host and guest, like CPU hotplugging.

 -- Variable: xe-guest-utilities-service-type
     Service type for the Xen guest utilities service.

 -- Data Type: xe-guest-utilities-configuration
     Configuration for the ‘xe-guest-utilities’ service.

     ‘package’ (default: ‘xe-guest-utilities’)
          The Xen guest utilities package to use.

     ‘pid-file’ (default: ‘"/var/run/xe-daemon.pid"’)
          Name of the file holding the PID of ‘xe-deamon’.

     ‘log-file’ (default: ‘"/var/log/xe-guest-utilities.log"’)
          Name of the ‘xe-guest-utilities’ log file.

   ‘xe-guest-utilities’ is the standard guest utilities used for Xen
guests.  More recently the Xen Project has been working to develop
‘xen-guest-agent’, a modern drop-in replacement for
‘xe-guest-utilities’.  While they nearly have feature-parity,
‘xen-guest-agent’ currently lacks some of the features of its
predecessor, namely disk metrics and “PV drivers version”.

 -- Variable: xen-guest-agent-service-type
     Service type for the Xen guest agent service.

 -- Data Type: xen-guest-agent-configuration
     Configuration for the ‘xen-guest-agent’ service.

     ‘package’ (default: ‘xen-guest-agent’)
          The Xen guest agent package to use.

     Предупреждение: ‘xe-guest-utilities’ and ‘xen-guest-agent’ are
     mutually exclusive.

Virtual Build Machines
......................

“Virtual build machines” or “build VMs” let you offload builds to a
fully controlled environment.  “How can it be more controlled than
regular builds?  And why would it be useful?”, you ask.  Good questions.

   Builds spawned by ‘guix-daemon’ indeed run in a controlled
environment; specifically the daemon spawns build processes in separate
namespaces and in a chroot, such as that build processes only see their
declared dependencies and a well-defined subset of the file system tree
(*note Установка окружения сборки::, for details).  A few aspects of the
environments are not controlled though: the operating system kernel, the
CPU model, and the date.  Most of the time, these aspects have no impact
on the build process: the level of isolation ‘guix-daemon’ provides is
“good enough”.

   However, there are occasionally cases where those aspects _do_
influence the build process.  A typical example is “time traps”: build
processes that stop working after a certain date(1).  Another one is
software that optimizes for the CPU microarchitecture it is built on or,
worse, bugs that manifest only on specific CPUs.

   To address that, ‘virtual-build-machine-service-type’ lets you add a
virtual build machine on your system, as in this example:

     (use-modules (gnu services virtualization))

     (operating-system
       ;; ...
       (services (append (list (service virtual-build-machine-service-type))
                         %base-services)))

   By default, you have to explicitly start the build machine when you
need it, at which point builds may be offloaded to it (*note Установка
демона разгрузки::):

     herd start build-vm

   With the default setting shown above, the build VM runs with its
clock set to a date several years in the past, and on a CPU model that
corresponds to that date—a model possibly older than that of your
machine.  This lets you rebuild today software from the past that would
otherwise fail to build due to a time trap or other issues in its build
process.  You can view the VM’s config like this:

     herd configuration build-vm

   You can configure the build VM, as in this example:

     (service virtual-build-machine-service-type
              (virtual-build-machine
               (cpu "Westmere")
               (cpu-count 8)
               (memory-size (* 1 1024))
               (auto-start? #t)))

   The available options are shown below.

 -- Variable: virtual-build-machine-service-type
     This is the service type to run “virtual build machines”.  Virtual
     build machines are configured so that builds are offloaded to them
     when they are running.

 -- Data Type: virtual-build-machine
     This is the data type specifying the configuration of a build
     machine.  It contains the fields below:

     ‘name’ (default: ‘'build-vm’)
          The name of this build VM. It is used to construct the name of
          its Shepherd service.

     ‘image’
          The image of the virtual machine (*note System Images::).
          This notably specifies the virtual disk size and the operating
          system running into it (*note Интерфейс operating-system::).
          The default value is a minimal operating system image.

     ‘port’ (default: ‘22’)
          The QEMU package to run the image.

     ‘cpu’
          The CPU model being emulated as a string denoting a model
          known to QEMU.

          The default value is a model that matches ‘date’ (see below).
          To see what CPU models are available, run, for example:

               qemu-system-x86_64 -cpu help

     ‘cpu-count’ (default: ‘4’)
          The number of CPUs emulated by the virtual machine.

     ‘memory-size’ (default: ‘2048’)
          Size in mebibytes (MiB) of the virtual machine’s main memory
          (RAM).

     ‘date’ (default: a few years ago)
          Date inside the virtual machine when it starts; this must be a
          SRFI-19 date object (*note (guile)SRFI-19 Date::).

     ‘port-forwardings’ (default: 11022 and 11004)
          TCP ports of the virtual machine forwarded to the host.  By
          default, the SSH and secrets ports are forwarded into the
          host.

     ‘port’ (default: ‘22’)
          List of system types supported by the build VM—e.g.,
          ‘"x86_64-linux"’.

     ‘auto-start?’ (default: ‘#f’)
          Whether to start the virtual machine when the system boots.

   In the next section, you’ll find a variant on this theme: GNU/Hurd
virtual machines!

Установка Guix на виртуальную машину (VM)
.........................................

Service ‘hurd-vm’ provides support for running GNU/Hurd in a virtual
machine (VM), a so-called “childhurd”.  This service is meant to be used
on GNU/Linux and the given GNU/Hurd operating system configuration is
cross-compiled.  The virtual machine is a Shepherd service that can be
referred to by the names ‘hurd-vm’ and ‘childhurd’ and be controlled
with commands such as:

     herd start hurd-vm
     herd stop childhurd

   When the service is running, you can view its console by connecting
to it with a VNC client, for example with:

     guix shell tigervnc-client -- vncviewer localhost:5900

   The default configuration (see ‘hurd-vm-configuration’ below) spawns
a secure shell (SSH) server in your GNU/Hurd system, which QEMU (the
virtual machine emulator) redirects to port 10022 on the host.  By
default, the service enables “offloading” such that the host
‘guix-daemon’ automatically offloads GNU/Hurd builds to the childhurd
(*note Установка демона разгрузки::).  This is what happens when running
a command like the following one, where ‘i586-gnu’ is the system type of
32-bit GNU/Hurd:

     guix build emacs-minimal -s i586-gnu

   The childhurd is volatile and stateless: it starts with a fresh root
file system every time you restart it.  By default though, all the files
under ‘/etc/childhurd’ on the host are copied as is to the root file
system of the childhurd when it boots.  This allows you to initialize
“secrets” inside the VM: SSH host keys, authorized substitute keys, and
so on—see the explanation of ‘secret-root’ below.

   You will probably find it useful to create an account for you in the
GNU/Hurd virtual machine and to authorize logins with your SSH key.  To
do that, you can define the GNU/Hurd system in the usual way (*note
Использование системы конфигурации::), and then pass that operating
system as the ‘os’ field of ‘hurd-vm-configuration’, as in this example:

     (define childhurd-os
       ;; Definition of my GNU/Hurd system, derived from the default one.
       (operating-system
         (inherit %hurd-vm-operating-system)

         ;; Add a user account.
         (users (cons (user-account
                       (name "charlie")
                       (comment "This is me!")
                       (group "users")
                       (supplementary-groups '("wheel"))) ;for 'sudo'
                      %base-user-accounts))

         (services
          ;; Modify the SSH configuration to allow login as "root"
          ;; and as "charlie" using public key authentication.
          (modify-services (operating-system-user-services
                            %hurd-vm-operating-system)
            (openssh-service-type
             config => (openssh-configuration
                        (inherit config)
                        (authorized-keys
                         `(("root"
                            ,(local-file
                              "/home/charlie/.ssh/id_rsa.pub"))
                           ("charlie"
                            ,(local-file
                              "/home/charlie/.ssh/id_rsa.pub"))))))))))

     (operating-system
       ;; ...
       (services
         ;; Add the 'hurd-vm' service, configured to use the
         ;; operating system configuration above.
         (append (list (service hurd-vm-service-type
                                (hurd-vm-configuration
                                  (os %childhurd-os))))
                 %base-services)))

   That’s it!  The remainder of this section provides the reference of
the service configuration.

 -- Variable: hurd-vm-service-type
     This is the type of the Hurd in a Virtual Machine service.  Its
     value must be a ‘hurd-vm-configuration’ object, which specifies the
     operating system (*note Интерфейс operating-system::) and the disk
     size for the Hurd Virtual Machine, the QEMU package to use as well
     as the options for running it.

     Например:

          (service hurd-vm-service-type
                   (hurd-vm-configuration
                    (disk-size (* 5000 (expt 2 20))) ;5G
                    (memory-size 1024)))             ;1024MiB

     would create a disk image big enough to build GNU Hello, with some
     extra memory.

 -- Тип данных: build-machine
     Управление конфигурацией операционной системы.

     ‘features’ (default: ‘'()’)
          The operating system to instantiate.  This default is
          bare-bones with a permissive OpenSSH secure shell daemon
          listening on port 2222 (*note ‘openssh-service-type’: Сервисы
          сети.).

     ‘port’ (default: ‘22’)
          The QEMU package to use.

     ‘type’ (default: ‘'hurd-qcow2’)
          The image type name.  Use ‘'hurd-qcow2’ for a 32-bit image or
          ‘'hurd64-qcow2’ for a 64-bit image.

     ‘port’ (default: ‘22’)
          The image object representing the disk image of this virtual
          machine (*note System Images::).

          Alternatively, this can be the file name (a string) of an
          image, which is useful if you want the image to persist across
          service restarts—see example below.

     ‘features’ (default: ‘'()’)
          Лицензия этого руководства.

     ‘port’ (default: ‘22’)
          The memory size of the Virtual Machine in mebibytes.

     ‘outputs’ (default: ‘'("out")’)
          The extra options for running QEMU.

     ‘id’ (default: ‘#f’)
          If set, a non-zero positive integer used to parameterize
          Childhurd instances.  It is appended to the service’s name,
          e.g.  ‘childhurd1’.

     ‘features’ (default: ‘'()’)
          The procedure used to produce the list of QEMU networking
          options.

          By default, it produces

               '("--device" "rtl8139,netdev=net0"
                 "--netdev" (string-append
                             "user,id=net0,"
                             "hostfwd=tcp:127.0.0.1:SECRETS-PORT-:1004,"
                             "hostfwd=tcp:127.0.0.1:SSH-PORT-:2222,"
                             "hostfwd=tcp:127.0.0.1:VNC-PORT-:5900"))

          with forwarded ports:

               SECRETS-PORT: (+ 11004 (* 1000 ID))
               SSH-PORT: (+ 10022 (* 1000 ID))
               VNC-PORT: (+ 15900 (* 1000 ID))

     ‘offloading?’ (default: ‘#t’)
          Whether to automatically set up offloading of builds to the
          childhurd.

          When enabled, this lets you run GNU/Hurd builds on the host
          and have them transparently offloaded to the VM, for instance
          when running a command like this:

               guix build coreutils -s i586-gnu

          This option automatically sets up offloading like so:

            1. Authorizing the childhurd’s key on the host so that the
               host accepts build results coming from the childhurd,
               which can be done like so (*note ‘guix archive
               --authorize’: Вызов guix archive, for more on that).

            2. Creating a user account called ‘offloading’ dedicated to
               offloading in the childhurd.

            3. Creating an SSH key pair on the host and making it an
               authorized key of the ‘offloading’ account in the
               childhurd.

            4. Adding the childhurd to ‘/etc/guix/machines.scm’ (*note
               Установка демона разгрузки::).

     ‘private-key’ (default: ‘~root/.ssh/id_rsa’)
          The root directory with out-of-band secrets to be installed
          into the childhurd once it runs.  Childhurds are volatile
          which means that on every startup, secrets such as the SSH
          host keys and Guix signing key are recreated.

          If the ‘/etc/childhurd’ directory does not exist, the
          ‘secret-service’ running in the Childhurd will be sent an
          empty list of secrets.

          By default, the service automatically populates
          ‘/etc/childhurd’ with the following non-volatile secrets,
          unless they already exist:

               /etc/childhurd/etc/guix/acl
               /etc/childhurd/etc/guix/signing-key.pub
               /etc/childhurd/etc/guix/signing-key.sec
               /etc/childhurd/etc/ssh/authorized_keys.d/offloading
               /etc/childhurd/etc/ssh/ssh_host_ed25519_key
               /etc/childhurd/etc/ssh/ssh_host_ecdsa_key
               /etc/childhurd/etc/ssh/ssh_host_ed25519_key.pub
               /etc/childhurd/etc/ssh/ssh_host_ecdsa_key.pub

   Note that by default the VM image is volatile—i.e., once the service
is stopped, the contents are lost.  If you want a persistent image
instead, override the configuration’s ‘image’ and ‘options’ without the
‘--snapshot’ flag using something along these lines:

     (service hurd-vm-service-type
              (hurd-vm-configuration
               ;; Specify an out-of-store, persistent image.
               (image "/out/of/store/writable/hurd.img")
               (options '())))

Ganeti
......

     Примечание: This service is considered experimental.  Configuration
     options may be changed in a backwards-incompatible manner, and not
     all features have been thorougly tested.  Users of this service are
     encouraged to share their experience at <guix-devel@gnu.org>.

   Ganeti is a virtual machine management system.  It is designed to
keep virtual machines running on a cluster of servers even in the event
of hardware failures, and to make maintenance and recovery tasks easy.
It consists of multiple services which are described later in this
section.  In addition to the Ganeti service, you will need the OpenSSH
service (*note ‘openssh-service-type’: Сервисы сети.), and update the
‘/etc/hosts’ file (*note ‘hosts-service-type’: Интерфейс сервиса.) with
the cluster name and address (or use a DNS server).

   All nodes participating in a Ganeti cluster should have the same
Ganeti and ‘/etc/hosts’ configuration.  Here is an example configuration
for a Ganeti cluster node that supports multiple storage backends, and
installs the ‘debootstrap’ and ‘guix’ “OS providers”:

     (use-package-modules virtualization)
     (use-service-modules base ganeti networking ssh)
     (operating-system
       ;; ...
       (host-name "node1")

       ;; Install QEMU so we can use KVM-based instances, and LVM, DRBD and Ceph
       ;; in order to use the "plain", "drbd" and "rbd" storage backends.
       (packages (append (map specification->package
                              '("qemu" "lvm2" "drbd-utils" "ceph"
                                ;; Add the debootstrap and guix OS providers.
                                "ganeti-instance-guix" "ganeti-instance-debootstrap"))
                         %base-packages))
       (services
        (append (list (service static-networking-service-type
                               (list (static-networking
                                      (addresses
                                       (list (network-address
                                              (device "eth0")
                                              (value "192.168.1.201/24"))))
                                      (routes
                                       (list (network-route
                                              (destination "default")
                                              (gateway "192.168.1.254"))))
                                      (name-servers '("192.168.1.252"
                                                      "192.168.1.253")))))

                      ;; Ganeti uses SSH to communicate between nodes.
                      (service openssh-service-type
                               (openssh-configuration
                                (permit-root-login 'prohibit-password)))

                      (simple-service 'ganeti-hosts-entries hosts-service-type
                                      (list
                                        (host "192.168.1.200" "ganeti.example.com")
                                        (host "192.168.1.201" "node1.example.com"
                                              '("node1"))
                                        (host "192.168.1.202" "node2.example.com"
                                              '("node2"))))

                      (service ganeti-service-type
                               (ganeti-configuration
                                ;; This list specifies allowed file system paths
                                ;; for storing virtual machine images.
                                (file-storage-paths '("/srv/ganeti/file-storage"))
                                ;; This variable configures a single "variant" for
                                ;; both Debootstrap and Guix that works with KVM.
                                (os %default-ganeti-os))))
                %base-services)))

   Users are advised to read the Ganeti administrators guide
(https://docs.ganeti.org/docs/ganeti/3.0/html/admin.html) to learn about
the various cluster options and day-to-day operations.  There is also a
blog post
(https://guix.gnu.org/blog/2020/running-a-ganeti-cluster-on-guix/)
describing how to configure and initialize a small cluster.

 -- Variable: ganeti-service-type
     This is a service type that includes all the various services that
     Ganeti nodes should run.

     Its value is a ‘ganeti-configuration’ object that defines the
     package to use for CLI operations, as well as configuration for the
     various daemons.  Allowed file storage paths and available guest
     operating systems are also configured through this data type.

 -- Конфигурирование: системы
     Модуль ‘(guix inferior)’ предоставляет следующие процедуры для
     работы с ранними версиями:

     ‘port’ (default: ‘22’)
          The ‘ganeti’ package to use.  It will be installed to the
          system profile and make ‘gnt-cluster’, ‘gnt-instance’, etc
          available.  Note that the value specified here does not affect
          the other services as each refer to a specific ‘ganeti’
          package (see below).

     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)
     ‘port’ (default: ‘22’)

          These options control the various daemons and cron jobs that
          are distributed with Ganeti.  The possible values for these
          are described in detail below.  To override a setting, you
          must use the configuration type for that service:

               (service ganeti-service-type
                        (ganeti-configuration
                         (rapi-configuration
                          (ganeti-rapi-configuration
                           (interface "eth1"))))
                         (watcher-configuration
                          (ganeti-watcher-configuration
                           (rapi-ip "10.0.0.1"))))

     ‘native-search-paths’ (default: ‘'()’)
          List of allowed directories for file storage backend.

     ‘hooks’ (default: ‘#f’)
          When set, this should be a file-like object containing a
          directory with cluster execution hooks
          (https://docs.ganeti.org/docs/ganeti/3.0/html/hooks.html).

     ‘port’ (default: ‘22’)
          List of ‘<ganeti-os>’ records.

     In essence ‘ganeti-service-type’ is shorthand for declaring each
     service individually:

          (service ganeti-noded-service-type)
          (service ganeti-confd-service-type)
          (service ganeti-wconfd-service-type)
          (service ganeti-luxid-service-type)
          (service ganeti-kvmd-service-type)
          (service ganeti-mond-service-type)
          (service ganeti-metad-service-type)
          (service ganeti-watcher-service-type)
          (service ganeti-cleaner-service-type)

     Plus a service extension for ‘etc-service-type’ that configures the
     file storage backend and OS variants.

 -- Тип данных: build-machine
     This data type is suitable for passing to the ‘os’ parameter of
     ‘ganeti-configuration’.  It takes the following parameters:

     ‘name’
          The name for this OS provider.  It is only used to specify
          where the configuration ends up.  Setting it to “debootstrap”
          will create ‘/etc/ganeti/instance-debootstrap’.

     ‘extension’ (default: ‘#f’)
          The file extension for variants of this OS type.  For example
          ‘.conf’ or ‘.scm’.  It will be appended to the variant file
          name if set.

     ‘inputs’ (default: ‘'()’)
          This must be either a list of ‘ganeti-os-variant’ objects for
          this OS, or a “file-like” object (*note file-like objects:
          G-Expressions.) representing the variants directory.

          To use the Guix OS provider with variant definitions residing
          in a local directory instead of declaring individual variants
          (see GUIX-VARIANTS below), you can do:

               (ganeti-os
                (name "guix")
                (variants (local-file "ganeti-guix-variants"
                                      #:recursive? #true)))

          Note that you will need to maintain the ‘variants.list’ file
          (see ‘ganeti-os-interface(7)
          (https://docs.ganeti.org/docs/ganeti/3.0/man/ganeti-os-interface.html)’)
          manually in this case.

 -- Тип данных: build-machine
     This is the data type for a Ganeti OS variant.  It takes the
     following parameters:

     ‘name’
          Лицензия этого руководства.

     ‘configuration’
          Файл конфигурации для этого варианта.

 -- Variable: %default-debootstrap-hooks
     This variable contains hooks to configure networking and the GRUB
     bootloader.

 -- Variable: %default-debootstrap-extra-pkgs
     This variable contains a list of packages suitable for a
     fully-virtualized guest.

 -- Конфигурирование: системы

     This data type creates configuration files suitable for the
     debootstrap OS provider.

     ‘port’ (default: ‘22’)
          When not ‘#f’, this must be a G-expression that specifies a
          directory with scripts that will run when the OS is installed.
          It can also be a list of ‘(name . file-like)’ pairs.  For
          example:

               `((99-hello-world . ,(plain-file "#!/bin/sh\necho Hello, World")))

          That will create a directory with one executable named
          ‘99-hello-world’ and run it every time this variant is
          installed.  If set to ‘#f’, hooks in
          ‘/etc/ganeti/instance-debootstrap/hooks’ will be used, if any.
     ‘port’ (default: ‘22’)
          Optional HTTP proxy to use.
     ‘features’ (default: ‘'()’)
          The Debian mirror.  Typically something like
          ‘http://ftp.no.debian.org/debian’.  The default varies
          depending on the distribution.
     ‘features’ (default: ‘'()’)
          The dpkg architecture.  Set to ‘armhf’ to debootstrap an ARMv7
          instance on an AArch64 host.  Default is to use the current
          system architecture.
     ‘port’ (default: ‘22’)
          When set, this must be a Debian distribution “suite” such as
          ‘buster’ or ‘focal’.  If set to ‘#f’, the default for the OS
          provider is used.
     ‘port’ (default: ‘22’)
          List of extra packages that will get installed by dpkg in
          addition to the minimal system.
     ‘speed’ (default: ‘1.0’)
          When set, must be a list of Debian repository “components”.
          For example ‘'("main" "contrib")’.
     ‘speed’ (default: ‘1.0’)
          Whether to automatically cache the generated debootstrap
          archive.
     ‘port’ (default: ‘22’)
          Discard the cache after this amount of days.  Use ‘#f’ to
          never clear the cache.
     ‘features’ (default: ‘'()’)
          The type of partition to create.  When set, it must be one of
          ‘'msdos’, ‘'none’ or a string.
     ‘arguments’ (default: ‘'()’)
          Alignment of the partition in sectors.

 -- Procedure: debootstrap-variant name configuration
     This is a helper procedure that creates a ‘ganeti-os-variant’
     record.  It takes two parameters: a name and a
     ‘debootstrap-configuration’ object.

 -- Procedure: debootstrap-os variants...
     This is a helper procedure that creates a ‘ganeti-os’ record.  It
     takes a list of variants created with ‘debootstrap-variant’.

 -- Procedure: guix-variant name configuration
     This is a helper procedure that creates a ‘ganeti-os-variant’
     record for use with the Guix OS provider.  It takes a name and a
     G-expression that returns a “file-like” (*note file-like objects:
     G-Expressions.) object containing a Guix System configuration.

 -- Procedure: guix-os variants...
     This is a helper procedure that creates a ‘ganeti-os’ record.  It
     takes a list of variants produced by ‘guix-variant’.

 -- Variable: %default-debootstrap-variants
     This is a convenience variable to make the debootstrap provider
     work “out of the box” without users having to declare variants
     manually.  It contains a single debootstrap variant with the
     default configuration:

          (list (debootstrap-variant
                 "default"
                 (debootstrap-configuration)))

 -- Variable: %default-guix-variants
     This is a convenience variable to make the Guix OS provider work
     without additional configuration.  It creates a virtual machine
     that has an SSH server, a serial console, and authorizes the Ganeti
     hosts SSH keys.

          (list (guix-variant
                 "default"
                 (file-append ganeti-instance-guix
                              "/share/doc/ganeti-instance-guix/examples/dynamic.scm")))

   Users can implement support for OS providers unbeknownst to Guix by
extending the ‘ganeti-os’ and ‘ganeti-os-variant’ records appropriately.
For example:

     (ganeti-os
      (name "custom")
      (extension ".conf")
      (variants
       (list (ganeti-os-variant
              (name "foo")
              (configuration (plain-file "bar" "this is fine"))))))

   That creates ‘/etc/ganeti/instance-custom/variants/foo.conf’ which
points to a file in the store with contents ‘this is fine’.  It also
creates ‘/etc/ganeti/instance-custom/variants/variants.list’ with
contents ‘foo’.

   Obviously this may not work for all OS providers out there.  If you
find the interface limiting, please reach out to <guix-devel@gnu.org>.

   The rest of this section documents the various services that are
included by ‘ganeti-service-type’.

 -- Variable: ganeti-noded-service-type
     ‘ganeti-noded’ is the daemon responsible for node-specific
     functions within the Ganeti system.  The value of this service must
     be a ‘ganeti-noded-configuration’ object.

 -- Data Type: pagekite-configuration
     This is the configuration for the ‘ganeti-noded’ service.

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The TCP port on which the node daemon listens for network
          requests.

     ‘speed’ (default: ‘1.0’)
          The network address that the daemon will bind to.  The default
          address means bind to all available addresses.

     ‘interface’ (default: ‘#f’)
          When this is set, it must be a specific network interface
          (e.g. ‘eth0’) that the daemon will bind to.

     ‘inputs’ (default: ‘'()’)
          This sets a limit on the maximum number of simultaneous client
          connections that the daemon will handle.  Connections above
          this count are accepted, but no responses will be sent until
          enough connections have closed.

     ‘port’ (default: ‘22’)
          Whether to use SSL/TLS to encrypt network communications.  The
          certificate is automatically provisioned by the cluster and
          can be rotated with ‘gnt-cluster renew-crypto’.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          This can be used to provide a specific encryption key for TLS
          communications.

     ‘speed’ (default: ‘1.0’)
          This can be used to provide a specific certificate for TLS
          communications.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.  Note that this will leak encryption
          details to the log files, use with caution.

 -- Variable: ganeti-confd-service-type
     ‘ganeti-confd’ answers queries related to the configuration of a
     Ganeti cluster.  The purpose of this daemon is to have a highly
     available and fast way to query cluster configuration values.  It
     is automatically active on all “master candidates”.  The value of
     this service must be a ‘ganeti-confd-configuration’ object.

 -- Конфигурирование: системы
     This is the configuration for the ‘ganeti-confd’ service.

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The UDP port on which to listen for network requests.

     ‘speed’ (default: ‘1.0’)
          Network address that the daemon will bind to.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-wconfd-service-type
     ‘ganeti-wconfd’ is the daemon that has authoritative knowledge
     about the cluster configuration and is the only entity that can
     accept changes to it.  All jobs that need to modify the
     configuration will do so by sending appropriate requests to this
     daemon.  It only runs on the “master node” and will automatically
     disable itself on other nodes.

     The value of this service must be a ‘ganeti-wconfd-configuration’
     object.

 -- Конфигурирование: системы
     This is the configuration for the ‘ganeti-wconfd’ service.

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The daemon will refuse to start if the majority of cluster
          nodes does not agree that it is running on the master node.
          Set to ‘#t’ to start even if a quorum can not be reached
          (dangerous, use with caution).

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-luxid-service-type
     ‘ganeti-luxid’ is a daemon used to answer queries related to the
     configuration and the current live state of a Ganeti cluster.
     Additionally, it is the authoritative daemon for the Ganeti job
     queue.  Jobs can be submitted via this daemon and it schedules and
     starts them.

     It takes a ‘ganeti-luxid-configuration’ object.

 -- Тип данных: build-machine
     This is the configuration for the ‘ganeti-luxid’ service.

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The daemon will refuse to start if it cannot verify that the
          majority of cluster nodes believes that it is running on the
          master node.  Set to ‘#t’ to ignore such checks and start
          anyway (this can be dangerous).

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-rapi-service-type
     ‘ganeti-rapi’ provides a remote API for Ganeti clusters.  It runs
     on the master node and can be used to perform cluster actions
     programmatically via a JSON-based RPC protocol.

     Most query operations are allowed without authentication (unless
     REQUIRE-AUTHENTICATION? is set), whereas write operations require
     explicit authorization via the ‘/var/lib/ganeti/rapi/users’ file.
     See the Ganeti Remote API documentation
     (https://docs.ganeti.org/docs/ganeti/3.0/html/rapi.html) for more
     information.

     The value of this service must be a ‘ganeti-rapi-configuration’
     object.

 -- Конфигурирование: системы
     This is the configuration for the ‘ganeti-rapi’ service.

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘features’ (default: ‘'()’)
          Whether to require authentication even for read-only
          operations.

     ‘port’ (default: ‘22’)
          The TCP port on which to listen to API requests.

     ‘speed’ (default: ‘1.0’)
          The network address that the service will bind to.  By default
          it listens on all configured addresses.

     ‘interface’ (default: ‘#f’)
          When set, it must specify a specific network interface such as
          ‘eth0’ that the daemon will bind to.

     ‘inputs’ (default: ‘'()’)
          The maximum number of simultaneous client requests to handle.
          Further connections are allowed, but no responses are sent
          until enough connections have closed.

     ‘port’ (default: ‘22’)
          Whether to use SSL/TLS encryption on the RAPI port.

     ‘daemon-socket’ (default: ‘"/var/guix/daemon-socket/socket"’)
          This can be used to provide a specific encryption key for TLS
          communications.

     ‘speed’ (default: ‘1.0’)
          This can be used to provide a specific certificate for TLS
          communications.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.  Note that this will leak encryption
          details to the log files, use with caution.

 -- Variable: ganeti-kvmd-service-type
     ‘ganeti-kvmd’ is responsible for determining whether a given KVM
     instance was shut down by an administrator or a user.  Normally
     Ganeti will restart an instance that was not stopped through Ganeti
     itself.  If the cluster option ‘user_shutdown’ is true, this daemon
     monitors the ‘QMP’ socket provided by QEMU and listens for shutdown
     events, and marks the instance as “USER_down” instead of
     “ERROR_down” when it shuts down gracefully by itself.

     It takes a ‘ganeti-kvmd-configuration’ object.

 -- Тип данных: build-machine

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-mond-service-type
     ‘ganeti-mond’ is an optional daemon that provides Ganeti monitoring
     functionality.  It is responsible for running data collectors and
     publish the collected information through a HTTP interface.

     It takes a ‘ganeti-mond-configuration’ object.

 -- Тип данных: build-machine

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘22’)
          The port on which the daemon will listen.

     ‘speed’ (default: ‘1.0’)
          The network address that the daemon will bind to.  By default
          it binds to all available interfaces.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-metad-service-type
     ‘ganeti-metad’ is an optional daemon that can be used to provide
     information about the cluster to instances or OS install scripts.

     It takes a ‘ganeti-metad-configuration’ object.

 -- Тип данных: build-machine

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘port’ (default: ‘80’)
          The port on which the daemon will listen.

     ‘features’ (default: ‘'()’)
          If set, the daemon will bind to this address only.  If left
          unset, the behavior depends on the cluster configuration.

     ‘debug?’ (default: ‘#f’)
          When true, the daemon performs additional logging for
          debugging purposes.

 -- Variable: ganeti-watcher-service-type
     ‘ganeti-watcher’ is a script designed to run periodically and
     ensure the health of a cluster.  It will automatically restart
     instances that have stopped without Ganeti’s consent, and repairs
     DRBD links in case a node has rebooted.  It also archives old
     cluster jobs and restarts Ganeti daemons that are not running.  If
     the cluster parameter ‘ensure_node_health’ is set, the watcher will
     also shutdown instances and DRBD devices if the node it is running
     on is declared offline by known master candidates.

     It can be paused on all nodes with ‘gnt-cluster watcher pause’.

     The service takes a ‘ganeti-watcher-configuration’ object.

 -- Data Type: pagekite-configuration

     ‘port’ (default: ‘22’)
          Пакет ‘ganeti’ для использования в этой службе.

     ‘schedule’ (default: ‘"*/5 * * * *"’)
          When to run the script, expressed either as a string in
          traditional cron syntax or as a gexp representing a Shepherd
          calendar event (*note (shepherd)Timers::).  The default is
          every five minutes.

     ‘speed’ (default: ‘1.0’)
          This option needs to be specified only if the RAPI daemon is
          configured to use a particular interface or address.  By
          default the cluster address is used.

     ‘features’ (default: ‘'()’)
          Archive cluster jobs older than this age, specified in
          seconds.  The default is 6 hours.  This keeps ‘gnt-job list’
          manageable.

     ‘port’ (default: ‘22’)
          If this is ‘#f’, the watcher will not try to repair broken
          DRBD links automatically.  Administrators will need to use
          ‘gnt-cluster verify-disks’ manually instead.

     ‘debug?’ (default: ‘#f’)
          When ‘#t’, the script performs additional logging for
          debugging purposes.

 -- Variable: ganeti-cleaner-service-type
     ‘ganeti-cleaner’ is a script designed to run periodically and
     remove old files from the cluster.  This service type controls two
     “cron jobs”: one intended for the master node that permanently
     purges old cluster jobs, and one intended for every node that
     removes expired X509 certificates, keys, and outdated
     ‘ganeti-watcher’ information.  Like all Ganeti services, it is safe
     to include even on non-master nodes as it will disable itself as
     necessary.

     It takes a ‘ganeti-cleaner-configuration’ object.

 -- Тип данных: build-machine

     ‘port’ (default: ‘22’)
          The ‘ganeti’ package to use for the ‘gnt-cleaner’ command.

     ‘port’ (default: ‘22’)
          How often to run the master cleaning job.  The default is once
          per day, at 01:45:00.

     ‘port’ (default: ‘22’)
          How often to run the node cleaning job.  The default is once
          per day, at 02:45:00.

   ---------- Footnotes ----------

   (1) The most widespread example of time traps is test suites that
involve checking the expiration date of a certificate.  Such tests
exists in TLS implementations such as OpenSSL and GnuTLS, but also in
high-level software such as Python.

