This is guix.pt_BR.info, produced by makeinfo version 6.8 from
guix.pt_BR.texi.

Copyright © 2012–2025 Ludovic Courtès
Copyright © 2013, 2014, 2016, 2024 Andreas Enge
Copyright © 2013 Nikita Karetnikov
Copyright © 2014, 2015, 2016 Alex Kost
Copyright © 2015, 2016 Mathieu Lirzin
Copyright © 2014 Pierre-Antoine Rault
Copyright © 2015 Taylan Ulrich Bayırlı/Kammer
Copyright © 2015, 2016, 2017, 2019, 2020, 2021, 2023, 2025 Leo Famulari
Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Ricardo
Wurmus
Copyright © 2016 Ben Woodcroft
Copyright © 2016, 2017, 2018, 2021 Chris Marusich
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2025 Efraim
Flashner
Copyright © 2016 John Darrington
Copyright © 2016, 2017 Nikita Gillmann
Copyright © 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025
Janneke Nieuwenhuizen
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Julien Lepiller
Copyright © 2016 Alex ter Weele
Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Christopher Baines
Copyright © 2017, 2018, 2019 Clément Lassieur
Copyright © 2017, 2018, 2020, 2021, 2022 Mathieu Othacehe
Copyright © 2017 Federico Beffa
Copyright © 2017, 2018, 2024, 2025 Carlo Zancanaro
Copyright © 2017 Thomas Danckaert
Copyright © 2017 humanitiesNerd
Copyright © 2017, 2021 Christine Lemmer-Webber
Copyright © 2017, 2018, 2019, 2020, 2021, 2022 Marius Bakke
Copyright © 2017, 2019, 2020, 2022 Hartmut Goebel
Copyright © 2017, 2019–2025 Maxim Cournoyer
Copyright © 2017–2022 Tobias Geerinckx-Rice
Copyright © 2017 George Clemmer
Copyright © 2017 Andy Wingo
Copyright © 2017, 2018, 2019, 2020, 2023, 2024, 2025 Arun Isaac
Copyright © 2017 nee
Copyright © 2018 Rutger Helling
Copyright © 2018, 2021, 2023, 2025 Oleg Pykhalov
Copyright © 2018 Mike Gerwitz
Copyright © 2018 Pierre-Antoine Rouby
Copyright © 2018, 2019 Gábor Boskovits
Copyright © 2018, 2019, 2020, 2022, 2023, 2024 Florian Pelz
Copyright © 2018 Laura Lazzati
Copyright © 2018 Alex Vong
Copyright © 2019 Josh Holland
Copyright © 2019, 2020 Diego Nicola Barbato
Copyright © 2019 Ivan Petkov
Copyright © 2019 Jakob L. Kreuze
Copyright © 2019 Kyle Andrews
Copyright © 2019 Alex Griffin
Copyright © 2019, 2020, 2021, 2022 Guillaume Le Vaillant
Copyright © 2020 Liliana Marie Prikler
Copyright © 2019, 2020, 2021, 2022, 2023 Simon Tournier
Copyright © 2020 Wiktor Żelazny
Copyright © 2020 Damien Cassou
Copyright © 2020 Jakub Kądziołka
Copyright © 2020 Jack Hill
Copyright © 2020 Naga Malleswari
Copyright © 2020, 2021 Brice Waegeneire
Copyright © 2020 R Veera Kumar
Copyright © 2020, 2021, 2022 Pierre Langlois
Copyright © 2020 pinoaffe
Copyright © 2020, 2023 André Batista
Copyright © 2020, 2021 Alexandru-Sergiu Marton
Copyright © 2020 raingloom
Copyright © 2020 Daniel Brooks
Copyright © 2020 John Soo
Copyright © 2020 Jonathan Brielmaier
Copyright © 2020 Edgar Vincent
Copyright © 2021, 2022 Maxime Devos
Copyright © 2021 B. Wilson
Copyright © 2021 Xinglu Chen
Copyright © 2021 Raghav Gururajan
Copyright © 2021 Domagoj Stolfa
Copyright © 2021 Hui Lu
Copyright © 2021 pukkamustard
Copyright © 2021 Alice Brenon
Copyright © 2021-2023 Josselin Poiret
Copyright © 2021, 2023 muradm
Copyright © 2021, 2022 Andrew Tropin
Copyright © 2021 Sarah Morgensen
Copyright © 2022 Remco van ’t Veer
Copyright © 2022 Aleksandr Vityazev
Copyright © 2022 Philip M^{c}Grath
Copyright © 2022 Karl Hallsby
Copyright © 2022 Justin Veilleux
Copyright © 2022 Reily Siegel
Copyright © 2022 Simon Streit
Copyright © 2022 (
Copyright © 2022 John Kehayias
Copyright © 2022⁠–⁠2023 Bruno Victal
Copyright © 2022 Ivan Vilata-i-Balaguer
Copyright © 2023-2025 Giacomo Leidi
Copyright © 2022 Antero Mejr
Copyright © 2023 Karl Hallsby
Copyright © 2023 Nathaniel Nicandro
Copyright © 2023 Tanguy Le Carrour
Copyright © 2023-2024 Zheng Junjie
Copyright © 2023 Brian Cully
Copyright © 2023 Felix Lechner
Copyright © 2023 Foundation Devices, Inc.
Copyright © 2023 Thomas Ieong
Copyright © 2023 Saku Laesvuori
Copyright © 2023 Graham James Addis
Copyright © 2023-2025 Tomas Volf
Copyright © 2024, 2025 Herman Rimm
Copyright © 2024 Matthew Trzcinski
Copyright © 2024 Richard Sent
Copyright © 2024 Dariqq
Copyright © 2024 Denis ’GNUtoo’ Carikli
Copyright © 2024 Fabio Natali
Copyright © 2024 Arnaud Daby-Seesaram
Copyright © 2024-2025 Nigko Yerden
Copyright © 2024 Troy Figiel
Copyright © 2024 Sharlatan Hellseher
Copyright © 2024 45mg
Copyright © 2024 Greg Hogan
Copyright © 2025 Sören Tempel
Copyright © 2025 Rostislav Svoboda
Copyright © 2025 Zacchaeus
Copyright © 2025 Sergio Pastor Pérez
Copyright © 2024 Evgeny Pisemsky
Copyright © 2025 jgart
Copyright © 2025 Artur Wroblewski
Copyright © 2025 Edouard Klein
Copyright © 2025 Rodion Goritskov
Copyright © 2025 dan
Copyright © 2025 Noé Lopez

   Permissão concedida para copiar, distribuir e/ou modificar este
documento sob os termos da Licença de Documentação Livre GNU, Versão 1.3
ou qualquer versão mais recente publicada pela Free Software Foundation;
sem Seções Invariantes, Textos de Capa Frontal, e sem Textos de
Contracapa. Uma cópia da licença está incluída na seção intitulada “GNU
Free Documentation License”.
INFO-DIR-SECTION Administração do sistema
START-INFO-DIR-ENTRY
* Guix.pt_BR: (guix.pt_BR).  Gerencie softwares instalados e configuração do
                               sistema.
* guix package: (guix.pt_BR)Invocando guix package.  Instalando, removendo e
                                                       atualizando pacotes.
* guix gc: (guix.pt_BR)Invocando guix gc.  Recuperando espaço em disco não
                                             utilizado.
* guix pull: (guix.pt_BR)Invocando guix pull.  Atualize a lista de pacotes
                                                 disponíveis.
* guix system: (guix.pt_BR)Invocando guix system.  Gerencie a configuração
                                                     do sistema operacional.
* guix deploy: (guix.pt_BR)Invocando guix deploy.  Gerenciar configurações
                                                     do sistema operacional
                                                     para hosts remotos.
END-INFO-DIR-ENTRY

INFO-DIR-SECTION Desenvolvimento de software
START-INFO-DIR-ENTRY
* guix shell: (guix.pt_BR)Invocando guix shell.  Creating software
                                                   environments.
* guix environment: (guix.pt_BR)Invocando guix environment.  Compilando
                                                               ambientes de
                                                               desenvolvimento
                                                               com Guix.
* guix build: (guix.pt_BR)Invocando guix build.  Compilando pacotes.
* guix pack: (guix.pt_BR)Invocando guix pack.  Criando embalagens de
                                                 binários.
END-INFO-DIR-ENTRY


File: guix.pt_BR.info,  Node: Rotação de log,  Next: Networking Setup,  Prev: Execução de trabalho agendado,  Up: Serviços

11.10.3 Rotação de log
----------------------

Log files such as those found in ‘/var/log’ tend to grow endlessly, so
it’s a good idea to “rotate” them once in a while—i.e., archive their
contents in separate files, possibly compressed. The ‘(gnu services
admin)’ module provides an interface to the log rotation service
provided by the Shepherd (*note (shepherd)Log Rotation Service::).

   This log rotation service is made available through
‘log-rotation-service-type’, which takes a ‘log-rotation-configuration’
record as its value. By default, this provides ‘log-rotation’, a
Shepherd “timed service” that runs periodically—once a week by default.
It automatically knows about the log files produced by Shepherd services
and can be taught about external log files. You can inspect the service
and see when it’s going to run the usual way:

     $ sudo herd status log-rotation
     Status of log-rotation:
       It is running since Mon 09 Dec 2024 03:27:47 PM CET (2 days ago).
       ...

     Upcoming timer alarms:
       Sun 15 Dec 2024 10:00:00 PM CET (in 4 days)
       Sun 22 Dec 2024 10:00:00 PM CET (in 11 days)
       Sun 29 Dec 2024 10:00:00 PM CET (in 18 days)

   You can also list files subject to rotation with ‘herd files
log-rotation’ and trigger rotation manually with ‘herd trigger
log-rotation’.

   This service is part of ‘%base-services’, and thus enabled by
default, with the default settings.

 -- Variável: log-rotation-service-type
     This is the type of the log rotation service. Its associated value
     must be a ‘log-rotation-configuration’ record, as discussed below.

 -- Data Type: log-rotation-configuration
     Available ‘log-rotation-configuration’ fields are:

     ‘provision’ (default: ‘(log-rotation)’) (type: list-of-symbols)
          The name(s) of the log rotation Shepherd service.

     ‘requirement’ (default: ‘(user-processes)’) (type: list-of-symbols)
          Dependencies of the log rotation Shepherd service.

     ‘calendar-event’ (type: gexp)
          Gexp containing the “calendar event” when log rotation occurs.
          *Note (shepherd)Timers::, for more information on calendar
          events.

     ‘external-log-files’ (default: ‘()’) (type: list-of-strings)
          List of file names, external log files that should also be
          rotated.

     ‘compression’ (default: ‘zstd’) (type: gexp-or-symbol)
          The compression method used for rotated log files, one of
          ‘'none’, ‘'gzip’, and ‘'zstd’. Alternatively, it can be a gexp
          that evaluates to a procedure; that procedure gets called with
          the file to be rotated.

     ‘expiry’ (type: gexp-or-integer)
          Age in seconds after which a log file is deleted.

     ‘size-threshold’ (type: gexp-or-integer)
          Size in bytes below which a log file is _not_ rotated.

   Some log files just need to be deleted periodically once they are
old, without any other criterion and without any archival step. This is
the case of build logs stored by ‘guix-daemon’ under
‘/var/log/guix/drvs’ (*note Invocando guix-daemon::). The ‘log-cleanup’
service addresses this use case. For example, ‘%base-services’ (*note
Serviços básicos::) includes the following:

     ;; Periodically delete old build logs.
     (service log-cleanup-service-type
              (log-cleanup-configuration
               (directory "/var/log/guix/drvs")))

   That ensures build logs do not accumulate endlessly.

 -- Variável: log-cleanup-service-type
     This is the type of the service to delete old logs. Its value must
     be a ‘log-cleanup-configuration’ record as described below.

 -- Tipo de dados: log-cleanup-configuration
     Data type representing the log cleanup configuration

     ‘directory’
          Name of the directory containing log files.

     ‘expiry’ (default: ‘(* 6 30 24 3600)’)
          Age in seconds after which a file is subject to deletion (six
          months by default).

     ‘schedule’ (default: ‘"30 12 01,08,15,22 * *"’)
          Schedule of the log cleanup job written either as a string in
          traditional cron syntax or as a gexp representing a Shepherd
          calendar event (*note (shepherd)Timers::).

Anonip Service
--------------

Anonip is a privacy filter that removes IP address from web server logs.
This service creates a FIFO and filters any written lines with anonip
before writing the filtered log to a target file.

   The following example sets up the FIFO
‘/var/run/anonip/https.access.log’ and writes the filtered log file
‘/var/log/anonip/https.access.log’.

     (service anonip-service-type
              (anonip-configuration
                (input  "/var/run/anonip/https.access.log")
                (output "/var/log/anonip/https.access.log")))

   Configure your web server to write its logs to the FIFO at
‘/var/run/anonip/https.access.log’ and collect the anonymized log file
at ‘/var/web-logs/https.access.log’.

 -- Tipo de dados: anonip-configuration
     Este tipo de dado representa a configuração do anonip. Ele possui
     os seguintes parâmetros:

     ‘anonip’ (default: ‘anonip’)
          The anonip package to use.

     ‘input’
          The file name of the input log file to process. The service
          creates a FIFO of this name. The web server should write its
          logs to this FIFO.

     ‘output’
          The file name of the processed log file. This file is subject
          to log rotation via the Shepherd’s log rotation service (*note
          Rotação de log::).

     The following optional settings may be provided:

     ‘debug?’
          Print debug messages when ‘#true’.

     ‘skip-private?’
          When ‘#true’ do not mask addresses in private ranges.

     ‘column’
          A 1-based indexed column number. Assume IP address is in the
          specified column (default is 1).

     ‘replacement’
          Replacement string in case address parsing fails, e.g.
          ‘"0.0.0.0"’.

     ‘ipv4mask’
          Number of bits to mask in IPv4 addresses.

     ‘ipv6mask’
          Number of bits to mask in IPv6 addresses.

     ‘increment’
          Increment the IP address by the given number. By default this
          is zero.

     ‘delimiter’
          Log delimiter string.

     ‘regex’
          Regular expression for detecting IP addresses. Use this
          instead of ‘column’.


File: guix.pt_BR.info,  Node: Networking Setup,  Next: Serviços de Rede,  Prev: Rotação de log,  Up: Serviços

11.10.4 Networking Setup
------------------------

The ‘(gnu services networking)’ module provides services to configure
network interfaces and set up networking on your machine. Those services
provide different ways for you to set up your machine: by declaring a
static network configuration, by running a Dynamic Host Configuration
Protocol (DHCP) client, or by running daemons such as NetworkManager and
Connman that automate the whole process, automatically adapt to
connectivity changes, and provide a high-level user interface.

   On a laptop, NetworkManager and Connman are by far the most
convenient options, which is why the default desktop services include
NetworkManager (*note ‘%desktop-services’: Serviços de desktop.). For a
server, or for a virtual machine or a container, static network
configuration or a simple DHCP client are often more appropriate.

   This section describes the various network setup services available,
starting with static network configuration.

 -- Variável: static-networking-service-type
     This is the type for statically-configured network interfaces. Its
     value must be a list of ‘static-networking’ records. Each of them
     declares a set of “addresses”, “routes”, and “links”, as shown
     below.

     Here is the simplest configuration, with only one network interface
     controller (NIC) and only IPv4 connectivity:

          ;; Static networking for one NIC, IPv4-only.
          (service static-networking-service-type
                   (list (static-networking
                          (addresses
                           (list (network-address
                                  (device "eno1")
                                  (value "10.0.2.15/24"))))
                          (routes
                           (list (network-route
                                  (destination "default")
                                  (gateway "10.0.2.2"))))
                          (name-servers '("10.0.2.3")))))

     The snippet above can be added to the ‘services’ field of your
     operating system configuration (*note Usando o sistema de
     configuração::). It will configure your machine to have 10.0.2.15
     as its IP address, with a 24-bit netmask for the local
     network—meaning that any 10.0.2.X address is on the local area
     network (LAN). Traffic to addresses outside the local network is
     routed via 10.0.2.2. Host names are resolved by sending domain name
     system (DNS) queries to 10.0.2.3.

 -- Tipo de dados: static-networking
     This is the data type representing a static network configuration.

     As an example, here is how you would declare the configuration of a
     machine with a single network interface controller (NIC) available
     as ‘eno1’, and with one IPv4 and one IPv6 address:

          ;; Network configuration for one NIC, IPv4 + IPv6.
          (static-networking
           (addresses (list (network-address
                             (device "eno1")
                             (value "10.0.2.15/24"))
                            (network-address
                             (device "eno1")
                             (value "2001:123:4567:101::1/64"))))
           (routes (list (network-route
                          (destination "default")
                          (gateway "10.0.2.2"))
                         (network-route
                          (destination "default")
                          (gateway "2020:321:4567:42::1"))))
           (name-servers '("10.0.2.3")))

     If you are familiar with the ‘ip’ command of the ‘iproute2’ package
     (https://wiki.linuxfoundation.org/networking/iproute2) found on
     Linux-based systems, the declaration above is equivalent to typing:

          ip address add 10.0.2.15/24 dev eno1
          ip address add 2001:123:4567:101::1/64 dev eno1
          ip route add default via inet 10.0.2.2
          ip route add default via inet6 2020:321:4567:42::1

     Run ‘man 8 ip’ for more info. Venerable GNU/Linux users will
     certainly know how to do it with ‘ifconfig’ and ‘route’, but we’ll
     spare you that.

     The available fields of this data type are as follows:

     ‘addresses’
     ‘links’ (default: ‘'()’)
     ‘routes’ (default: ‘'()’)
          The list of ‘network-address’, ‘network-link’, and
          ‘network-route’ records for this network (see below).

     ‘name-servers’ (default: ‘'()’)
          The list of IP addresses (strings) of domain name servers.
          These IP addresses go to ‘/etc/resolv.conf’.

     ‘provision’ (default: ‘'(networking)’)
          If true, this should be a list of symbols for the Shepherd
          service corresponding to this network configuration.

     ‘requirement’ (default ‘'()’)
          The list of Shepherd services depended on.

 -- Tipo de dados: network-address
     This is the data type representing the IP address of a network
     interface.

     ‘device’
          The name of the network interface for this address—e.g.,
          ‘"eno1"’.

     ‘value’
          The actual IP address and network mask, in CIDR (Classless
          Inter-Domain Routing) notation
          (https://en.wikipedia.org/wiki/CIDR#CIDR_notation), as a
          string.

          For example, ‘"10.0.2.15/24"’ denotes IPv4 address 10.0.2.15
          on a 24-bit sub-network—all 10.0.2.X addresses are on the same
          local network.

     ‘ipv6?’
          Whether ‘value’ denotes an IPv6 address. By default this is
          automatically determined.

 -- Tipo de dados: network-route
     This is the data type representing a network route.

     ‘destination’
          The route destination (a string), either an IP address and
          network mask or ‘"default"’ to denote the default route.

     ‘source’ (default: ‘#f’)
          The route source.

     ‘device’ (default: ‘#f’)
          The device used for this route—e.g., ‘"eno2"’.

     ‘ipv6?’ (default: auto)
          Whether this is an IPv6 route. By default this is
          automatically determined based on ‘destination’ or ‘gateway’.

     ‘gateway’ (default: ‘#f’)
          IP address (a string) through which traffic is routed.

 -- Tipo de dados: network-link
     Data type for a network link (*note (guile-netlink)Link::). During
     startup, network links are employed to construct or modify existing
     or virtual ethernet links. These ethernet links can be identified
     by their NAME or MAC-ADDRESS. If there is a need to create virtual
     interface, NAME and TYPE fields are required.

     ‘name’
          The name of the link—e.g., ‘"v0p0"’ (default: ‘#f’).

     ‘tipo’
          A symbol denoting the type of the link—e.g., ‘'veth’ (default:
          ‘#f’).

     ‘mac-address’
          The mac-address of the link—e.g., ‘"98:11:22:33:44:55"’
          (default: ‘#f’).

     ‘arguments’
          List of arguments for this type of link.

   Consider a scenario where a server equipped with a network interface
which has multiple ports. These ports are connected to a switch, which
supports link aggregation
(https://en.wikipedia.org/wiki/Link_aggregation) (also known as bonding
or NIC teaming). The switch uses port channels to consolidate multiple
physical interfaces into one logical interface to provide higher
bandwidth, load balancing, and link redundancy. When a port is added to
a LAG (or link aggregation group), it inherits the properties of the
port-channel. Some of these properties are VLAN membership, trunk
status, and so on.

   VLAN (https://en.wikipedia.org/wiki/Virtual_LAN) (or virtual local
area network) is a logical network that is isolated from other VLANs on
the same physical network. This can be used to segregate traffic,
improve security, and simplify network management.

   With all that in mind let’s configure our static network for the
server. We will bond two existing interfaces together using 802.3ad
schema and on top of it, build a VLAN interface with id 1055. We assign
a static ip to our new VLAN interface.

     (static-networking
      (links (list (network-link
                    (name "bond0")
                    (type 'bond)
                    (arguments '((mode . "802.3ad")
                                 (miimon . 100)
                                 (lacp-active . "on")
                                 (lacp-rate . "fast"))))

                   (network-link
                    (mac-address "98:11:22:33:44:55")
                    (arguments '((master . "bond0"))))

                   (network-link
                    (mac-address "98:11:22:33:44:56")
                    (arguments '((master . "bond0"))))

                   (network-link
                    (name "bond0.1055")
                    (type 'vlan)
                    (arguments '((id . 1055)
                                 (link . "bond0"))))))
      (addresses (list (network-address
                        (value "192.168.1.4/24")
                        (device "bond0.1055")))))

 -- Variável: %loopback-static-networking
     This is the ‘static-networking’ record representing the “loopback
     device”, ‘lo’, for IP addresses 127.0.0.1 and ::1, and providing
     the ‘loopback’ Shepherd service.

 -- Variável: %qemu-static-networking
     This is the ‘static-networking’ record representing network setup
     when using QEMU’s user-mode network stack on ‘eth0’ (*note
     (qemu)Using the user mode network stack::).

 -- Variável: dhcp-client-service-type
     This is the type of services that run DHCLIENT, the ISC Dynamic
     Host Configuration Protocol (DHCP) client.

 -- Tipo de dados: dhcp-client-configuration
     Data type representing the configuration of the ISC DHCP client
     service.

     ‘package’ (default: ‘isc-dhcp’)
          The ISC DHCP client package to use.

     ‘interfaces’ (default: ‘'all’)
          Either ‘'all’ or the list of interface names that the ISC DHCP
          client should listen on—e.g., ‘'("eno1")’.

          When set to ‘'all’, the ISC DHCP client listens on all the
          available non-loopback interfaces that can be activated.
          Otherwise the ISC DHCP client listens only on the specified
          interfaces.

     ‘config-file’ (default: ‘#f’)
          The configuration file for the ISC DHCP client.

     ‘version’ (default: ‘"4"’)
          The DHCP protocol version to use, as a string. Accepted values
          are ‘"4"’ or ‘"6"’ for DHCPv4 or DHCPv6, respectively, as well
          as ‘"4o6"’, for DHCPv4 over DHCPv6 (as specified by RFC 7341).

     ‘shepherd-requirement’ (default: ‘'()’)
     ‘shepherd-provision’ (default: ‘'(networking)’)
          This option can be used to provide a list of symbols naming
          Shepherd services that this service will depend on, such as
          ‘'wpa-supplicant’ or ‘'iwd’ if you require authenticated
          access for encrypted WiFi or Ethernet networks.

          Likewise, ‘shepherd-provision’ is a list of Shepherd service
          names (symbols) provided by this service. You might want to
          change the default value if you intend to run several ISC DHCP
          clients, only one of which provides the ‘networking’ Shepherd
          service.

 -- Variável: dhcpcd-service-type
     This the type for a service running ‘dhcpcd’, a DHCP (Dynamic Host
     Configuration Protocol) client that can be used as a replacement
     for the historical ISC client supported by
     ‘dhcp-client-service-type’.

     Its value must be a ‘dhcpcd-configuration’ record, as described
     below. As an example, consider the following setup which runs
     ‘dhcpcd’ with a local DNS (Domain Name System) resolver:

          (service dhcpcd-service-type
            (dhcpcd-configuration
              (option '("rapid_commit" "interface_mtu"))
              (no-option '("nd_rdnss"
                           "dhcp6_name_servers"
                           "domain_name_servers"
                           "domain_name"
                           "domain_search"))
              (static '("domain_name_servers=127.0.0.1"))
              (no-hook '("hostname"))))

 -- Data Type: dhcpcd-configuration
     Available ‘dhcpcd-configuration’ fields are:

     ‘interfaces’ (default: ‘()’) (type: list)
          List of networking interfaces—e.g., ‘"eth0"’—to start a DHCP
          client for. If no interface is specified (i.e., the list is
          empty) then ‘dhcpcd’ discovers available Ethernet interfaces,
          that can be configured, automatically.

     ‘command-arguments’ (default: ‘("-q" "-q")’) (type: list)
          List of additional command-line options.

     ‘host-name’ (default: ‘""’) (type: maybe-string)
          Host name to send via DHCP, defaults to the current system
          host name.

     ‘duid’ (default: ‘""’) (type: maybe-string)
          DHCPv4 clients require a unique client identifier, this option
          uses the DHCPv6 Unique Identifier as a DHCPv4 client
          identifier as well. For more information, refer to RFC 4361
          (https://www.rfc-editor.org/rfc/rfc4361) and ‘dhcpcd.conf(5)’.

     ‘persistent?’ (default: ‘#t’) (type: boolean)
          When true, automatically de-configure the interface when
          ‘dhcpcd’ exits.

     ‘option’ (default: ‘("rapid_commit" "domain_name_servers" "domain_name" "domain_search" "host_name" "classless_static_routes" "interface_mtu")’) (type: list-of-strings)
          List of options to request from the server.

     ‘require’ (default: ‘("dhcp_server_identifier")’) (type: list-of-strings)
          List of options to require in responses.

     ‘slaac’ (default: ‘"private"’) (type: maybe-string)
          Interface identifier used for SLAAC generated IPv6 addresses.

     ‘no-option’ (default: ‘()’) (type: list-of-strings)
          List of options to remove from the message before it’s
          processed.

     ‘no-hook’ (default: ‘()’) (type: list-of-strings)
          List of hook script which should not be invoked.

     ‘static’ (default: ‘()’) (type: list-of-strings)
          DHCP client can request different options from a DHCP server,
          through ‘static’ it is possible to configure static values for
          selected options. For example,
          ‘"domain_name_servers=127.0.0.1"’.

     ‘vendor-class-id’ (type: maybe-string)
          Set the DHCP Vendor Class (e.g., ‘MSFT’). For more
          information, refer to RFC 2132
          (https://www.rfc-editor.org/rfc/rfc2132#section-9.13).

     ‘client-id’ (type: maybe-string)
          Use the interface hardware address or the given string as a
          client identifier, this is mutually exclusive with the ‘duid’
          option.

     ‘extra-content’ (type: maybe-string)
          Extra content to append to the configuration as-is.

     ‘shepherd-provision’ (default: ‘(networking)’) (type: list-of-symbols)
          This is a list of symbols naming Shepherd services provided by
          this service.

     ‘shepherd-requirement’ (default: ‘()’) (type: list-of-symbols)
          This is a list of symbols naming Shepherd services that this
          service will depend on.

 -- Variável: network-manager-service-type
     This is the service type for the NetworkManager
     (https://wiki.gnome.org/Projects/NetworkManager) service. The value
     for this service type is a ‘network-manager-configuration’ record.

     This service is part of ‘%desktop-services’ (*note Serviços de
     desktop::).

 -- Tipo de dados: network-manager-configuration
     Data type representing the configuration of NetworkManager.

     ‘network-manager’ (default: ‘network-manager’)
          The NetworkManager package to use.

     ‘shepherd-requirement’ (default: ‘'(wireless-daemon)’)
          This option can be used to provide a list of symbols naming
          Shepherd services that this service will depend on. The
          default ‘'wireless-daemon’ is provided by
          ‘'wpa-supplicant-service-type’ and ‘'iwd-service-type’. Make
          sure you have one of these configured. Note, that
          ‘%desktop-services’ already include
          ‘wpa-supplicant-service-type’.

     ‘dns’ (default: ‘"default"’)
          Processing mode for DNS, which affects how NetworkManager uses
          the ‘resolv.conf’ configuration file.

          ‘default’
               NetworkManager will update ‘resolv.conf’ to reflect the
               nameservers provided by currently active connections.

          ‘dnsmasq’
               NetworkManager will run ‘dnsmasq’ as a local caching
               nameserver, using a “conditional forwarding”
               configuration if you are connected to a VPN, and then
               update ‘resolv.conf’ to point to the local nameserver.

               With this setting, you can share your network connection.
               For example when you want to share your network
               connection to another laptop via an Ethernet cable, you
               can open ‘nm-connection-editor’ and configure the Wired
               connection’s method for IPv4 and IPv6 to be “Shared to
               other computers” and reestablish the connection (or
               reboot).

               You can also set up a “host-to-guest connection” to QEMU
               VMs (*note Instalando Guix em uma VM::). With a
               host-to-guest connection, you can e.g. access a Web
               server running on the VM (*note Serviços web::) from a
               Web browser on your host system, or connect to the VM via
               SSH (*note ‘openssh-service-type’: Serviços de Rede.). To
               set up a host-to-guest connection, run this command once:

                    nmcli connection add type tun \
                     connection.interface-name tap0 \
                     tun.mode tap tun.owner $(id -u) \
                     ipv4.method shared \
                     ipv4.addresses 172.28.112.1/24

               Then each time you launch your QEMU VM (*note Executando
               Guix em uma VM::), pass ‘-nic
               tap,ifname=tap0,script=no,downscript=no’ to
               ‘qemu-system-...’.

          ‘none’
               NetworkManager will not modify ‘resolv.conf’.

     ‘vpn-plugins’ (default: ‘'()’)
          This is the list of available plugins for virtual private
          networks (VPNs). An example of this is the
          ‘network-manager-openvpn’ package, which allows NetworkManager
          to manage VPNs via OpenVPN.

     ‘extra-configuration-files’ (default: ‘'()’)
          A list of two-element lists; the first element of each list is
          a file name (as a string), and the second is a file-like
          object. Used to specify configuration files which will be
          added to the ‘/etc/NetworkManager/conf.d’. NetworkManager will
          read additional configuration from this directory. For details
          on configuration file precedence and the configuration file
          format, see ‘man 5 NetworkManager.conf’.

          For example, to add two files named ‘001-basic.conf’ and
          ‘002-unmanaged.conf’:

               (service network-manager-service-type
                        (network-manager-configuration
                         (extra-configuration-files
                          `(("001-basic.conf" ,(local-file "basic.conf"))
                            ("002-unmanaged.conf" ,(plain-file "constructed-unmanaged.conf"
                                                               "\
               [keyfile]
               unmanaged-devices=interface-name:wlo1_ap\n"))))))

 -- Variável: connman-service-type
     This is the service type to run Connman (https://01.org/connman), a
     network connection manager.

     Its value must be a ‘connman-configuration’ record as in this
     example:

          (service connman-service-type
                   (connman-configuration
                     (disable-vpn? #t)))

     See below for details about ‘connman-configuration’.

 -- Tipo de dados: connman-configuration
     Data Type representing the configuration of connman.

     ‘connman’ (default: CONNMAN)
          The connman package to use.

     ‘shepherd-requirement’ (default: ‘'()’)
          This option can be used to provide a list of symbols naming
          Shepherd services that this service will depend on, such as
          ‘'wpa-supplicant’ or ‘'iwd’ if you require authenticated
          access for encrypted WiFi or Ethernet networks.

     ‘disable-vpn?’ (default: ‘#f’)
          When true, disable connman’s vpn plugin.

     ‘general-configuration’ (default: ‘(connman-general-configuration)’)
          Configuration serialized to ‘main.conf’ and passed as
          ‘--config’ to ‘connmand’.

 -- Tipo de dados: connman-general-configuration
     Available ‘connman-general-configuration’ fields are:

     ‘input-request-timeout’ (type: maybe-number)
          Set input request timeout. Default is 120 seconds. The request
          for inputs like passphrase will timeout after certain amount
          of time. Use this setting to increase the value in case of
          different user interface designs.

     ‘browser-launch-timeout’ (type: maybe-number)
          Set browser launch timeout. Default is 300 seconds. The
          request for launching a browser for portal pages will timeout
          after certain amount of time. Use this setting to increase the
          value in case of different user interface designs.

     ‘background-scanning?’ (type: maybe-boolean)
          Enable background scanning. Default is true. If wifi is
          disconnected, the background scanning will follow a simple
          back off mechanism from 3s up to 5 minutes. Then, it will stay
          in 5 minutes unless user specifically asks for scanning
          through a D-Bus call. If so, the mechanism will start again
          from 3s. This feature activates also the background scanning
          while being connected, which is required for roaming on wifi.
          When ‘background-scanning?’ is false, ConnMan will not perform
          any scan regardless of wifi is connected or not, unless it is
          requested by the user through a D-Bus call.

     ‘use-gateways-as-timeservers?’ (type: maybe-boolean)
          Assume that service gateways also function as timeservers.
          Default is false.

     ‘fallback-timeservers’ (type: maybe-list)
          List of Fallback timeservers. These timeservers are used for
          NTP sync when there are no timeservers set by the user or by
          the service, and when ‘use-gateways-as-timeservers?’ is ‘#f’.
          These can contain a mixed combination of fully qualified
          domain names, IPv4 and IPv6 addresses.

     ‘fallback-nameservers’ (type: maybe-list)
          List of fallback nameservers appended to the list of
          nameservers given by the service. The nameserver entries must
          be in numeric format, host names are ignored.

     ‘default-auto-connect-technologies’ (type: maybe-list)
          List of technologies that are marked autoconnectable by
          default. The default value for this entry when empty is
          ‘"ethernet"’, ‘"wifi"’, ‘"cellular"’. Services that are
          automatically connected must have been set up and saved to
          storage beforehand.

     ‘default-favourite-technologies’ (type: maybe-list)
          List of technologies that are marked favorite by default. The
          default value for this entry when empty is ‘"ethernet"’.
          Connects to services from this technology even if not setup
          and saved to storage.

     ‘always-connected-technologies’ (type: maybe-list)
          List of technologies which are always connected regardless of
          preferred-technologies setting (‘auto-connect?’ ‘#t’). The
          default value is empty and this feature is disabled unless
          explicitly enabled.

     ‘preferred-technologies’ (type: maybe-list)
          List of preferred technologies from the most preferred one to
          the least preferred one. Services of the listed technology
          type will be tried one by one in the order given, until one of
          them gets connected or they are all tried. A service of a
          preferred technology type in state ’ready’ will get the
          default route when compared to another preferred type further
          down the list with state ’ready’ or with a non-preferred type;
          a service of a preferred technology type in state ’online’
          will get the default route when compared to either a
          non-preferred type or a preferred type further down in the
          list.

     ‘network-interface-blacklist’ (type: maybe-list)
          List of blacklisted network interfaces. Found interfaces will
          be compared to the list and will not be handled by ConnMan, if
          their first characters match any of the list entries. Default
          value is ‘"vmnet"’, ‘"vboxnet"’, ‘"virbr"’, ‘"ifb"’.

     ‘allow-hostname-updates?’ (type: maybe-boolean)
          Allow ConnMan to change the system hostname. This can happen
          for example if we receive DHCP hostname option. Default value
          is ‘#t’.

     ‘allow-domainname-updates?’ (type: maybe-boolean)
          Allow connman to change the system domainname. This can happen
          for example if we receive DHCP domainname option. Default
          value is ‘#t’.

     ‘single-connected-technology?’ (type: maybe-boolean)
          Keep only a single connected technology at any time. When a
          new service is connected by the user or a better one is found
          according to preferred-technologies, the new service is kept
          connected and all the other previously connected services are
          disconnected. With this setting it does not matter whether the
          previously connected services are in ’online’ or ’ready’
          states, the newly connected service is the only one that will
          be kept connected. A service connected by the user will be
          used until going out of network coverage. With this setting
          enabled applications will notice more network breaks than
          normal. Note this options can’t be used with VPNs. Default
          value is ‘#f’.

     ‘tethering-technologies’ (type: maybe-list)
          List of technologies that are allowed to enable tethering. The
          default value is ‘"wifi"’, ‘"bluetooth"’, ‘"gadget"’. Only
          those technologies listed here are used for tethering. If one
          wants to tether ethernet, then add ‘"ethernet"’ in the list.
          Note that if ethernet tethering is enabled, then a DHCP server
          is started on all ethernet interfaces. Tethered ethernet
          should never be connected to corporate or home network as it
          will disrupt normal operation of these networks. Due to this
          ethernet is not tethered by default. Do not activate ethernet
          tethering unless you really know what you are doing.

     ‘persistent-tethering-mode?’ (type: maybe-boolean)
          Restore earlier tethering status when returning from offline
          mode, re-enabling a technology, and after restarts and
          reboots. Default value is ‘#f’.

     ‘enable-6to4?’ (type: maybe-boolean)
          Automatically enable anycast 6to4 if possible. This is not
          recommended, as the use of 6to4 will generally lead to a
          severe degradation of connection quality. See RFC6343. Default
          value is ‘#f’ (as recommended by RFC6343 section 4.1).

     ‘vendor-class-id’ (type: maybe-string)
          Set DHCP option 60 (Vendor Class ID) to the given string. This
          option can be used by DHCP servers to identify specific
          clients without having to rely on MAC address ranges, etc.

     ‘enable-online-check?’ (type: maybe-boolean)
          Enable or disable use of HTTP GET as an online status check.
          When a service is in a READY state, and is selected as
          default, ConnMan will issue an HTTP GET request to verify that
          end-to-end connectivity is successful. Only then the service
          will be transitioned to ONLINE state. If this setting is
          false, the default service will remain in READY state. Default
          value is ‘#t’.

     ‘online-check-ipv4-url’ (type: maybe-string)
          IPv4 URL used during the online status check. Please refer to
          the README for more detailed information. Default value is
          <http://ipv4.connman.net/online/status.html>.

     ‘online-check-ipv6-url’ (type: maybe-string)
          IPv6 URL used during the online status check. Please refer to
          the README for more detailed information. Default value is
          <http://ipv6.connman.net/online/status.html>.

     ‘online-check-initial-interval’ (type: maybe-number)
          Range of intervals between two online check requests. Please
          refer to the README for more detailed information. Default
          value is ‘1’.

     ‘online-check-max-interval’ (type: maybe-number)
          Range of intervals between two online check requests. Please
          refer to the README for more detailed information. Default
          value is ‘1’.

     ‘enable-online-to-ready-transition?’ (type: maybe-boolean)
          WARNING: This is an experimental feature. In addition to
          ‘enable-online-check’ setting, enable or disable use of HTTP
          GET to detect the loss of end-to-end connectivity. If this
          setting is ‘#f’, when the default service transitions to
          ONLINE state, the HTTP GET request is no more called until
          next cycle, initiated by a transition of the default service
          to DISCONNECT state. If this setting is ‘#t’, the HTTP GET
          request keeps being called to guarantee that end-to-end
          connectivity is still successful. If not, the default service
          will transition to READY state, enabling another service to
          become the default one, in replacement. Default value is ‘#f’.

     ‘auto-connect-roaming-services?’ (type: maybe-boolean)
          Automatically connect roaming services. This is not
          recommended unless you know you won’t have any billing
          problem. Default value is ‘#f’.

     ‘address-conflict-detection?’ (type: maybe-boolean)
          Enable or disable the implementation of IPv4 address conflict
          detection according to RFC5227. ConnMan will send probe ARP
          packets to see if an IPv4 address is already in use before
          assigning the address to an interface. If an address conflict
          occurs for a statically configured address, an IPv4LL address
          will be chosen instead (according to RFC3927). If an address
          conflict occurs for an address offered via DHCP, ConnMan sends
          a DHCP DECLINE once and for the second conflict resorts to
          finding an IPv4LL address. Default value is ‘#f’.

     ‘localtime’ (type: maybe-string)
          Path to localtime file. Defaults to ‘/etc/localtime’.

     ‘regulatory-domain-follows-timezone?’ (type: maybe-boolean)
          Enable regulatory domain to be changed along timezone changes.
          With this option set to true each time the timezone changes
          the first present ISO3166 country code is read from
          ‘/usr/share/zoneinfo/zone1970.tab’ and set as regulatory
          domain value. Default value is ‘#f’.

     ‘resolv-conf’ (type: maybe-string)
          Path to resolv.conf file. If the file does not exist, but
          intermediate directories exist, it will be created. If this
          option is not set, it tries to write into
          ‘/var/run/connman/resolv.conf’ if it fails (‘/var/run/connman’
          does not exist or is not writeable). If you do not want to
          update resolv.conf, you can set ‘/dev/null’.

 -- Variável: wpa-supplicant-service-type
     This is the service type to run WPA supplicant
     (https://w1.fi/wpa_supplicant/), an authentication daemon required
     to authenticate against encrypted WiFi or ethernet networks.

 -- Tipo de dados: wpa-supplicant-configuration
     Data type representing the configuration of WPA Supplicant.

     It takes the following parameters:

     ‘wpa-supplicant’ (default: ‘wpa-supplicant’)
          The WPA Supplicant package to use.

     ‘shepherd-requirement’ (default: ‘(user-processes loopback syslogd)’
          List of services that should be started before WPA Supplicant
          starts.

     ‘shepherd-provision’ (default: ‘(wpa-supplicant wireless-daemon)’) (type: list-of-symbols)
          The name(s) of the service.

     ‘dbus?’ (padrão: ‘#t’)
          Whether to listen for requests on D-Bus.

     ‘pid-file’ (default: ‘"/var/run/wpa_supplicant.pid"’)
          Where to store the PID file.

     ‘interface’ (default: ‘#f’)
          If this is set, it must specify the name of a network
          interface that WPA supplicant will control.

     ‘config-file’ (default: ‘#f’)
          Optional configuration file to use.

     ‘extra-options’ (default: ‘'()’)
          List of additional command-line arguments to pass to the
          daemon.

 -- Variável: iwd-service-type
     This is the service type to run iwd, the iNet Wireless Daemon
     (https://iwd.wiki.kernel.org/), a daemon required to authenticate
     against encrypted WiFi networks.

     Aviso: By default ‘iwd’ removes and re-creates interfaces it
     manages. It doesn’t play nicely with ‘dhcp-client-service-type’
     that enumerates wireless interfaces before starting the Shepherd
     service. Use either ‘dhcpcd-service-type’ or the ‘iwd’’s built-in
     DHCP client (see ‘enable-network-configuration’ option below).

     Aviso: ‘iwd-service-type’ conflicts with
     ‘wpa-supplicant-service-type’. Make sure only one is configured.

 -- Data Type: iwd-configuration
     Available ‘iwd-configuration’ fields are:

     ‘iwd’ (default: ‘iwd’) (type: file-like)
          The IWD package to use.

     ‘interfaces’ (default: ‘()’) (type: list-of-strings)
          If this is set, it must specify “glob patterns” matching
          network interfaces that IWD will control.

     ‘ignored-interfaces’ (default: ‘()’) (type: list-of-strings)
          If this is set, it must specify “glob patterns” matching
          network interfaces that IWD will not manage.

     ‘phys’ (default: ‘()’) (type: list-of-strings)
          If this is set, it must specify “glob patterns” matching
          network PHYs names that IWD will control.

     ‘ignored-phys’ (default: ‘()’) (type: list-of-strings)
          If this is set, it must specify “glob patterns” matching
          network PHYs names that IWD will not manage.

     ‘shepherd-requirement’ (default: ‘()’) (type: list-of-symbols)
          Shepherd requirements the service should depend on.

     ‘shepherd-provision’ (default: ‘(iwd wireless-daemon)’) (type: list-of-symbols)
          The name(s) of the service.

     ‘config’ (type: iwd-settings)
          Configuration settings.

 -- Data Type: iwd-settings
     Available ‘iwd-settings’ fields are:

     ‘general’ (type: iwd-general-settings)
          General settings.

     ‘network’ (default: ‘(iwd-network-settings)’) (type: maybe-iwd-network-settings)
          Network settings.

     ‘scan’ (type: maybe-iwd-scan-settings)
          Scan settings.

     ‘extra-config’ (default: ‘()’) (type: list-of-strings)
          Extra configuration values to append to the IWD configuration
          file.

 -- Data Type: iwd-general-settings
     Available ‘iwd-general-settings’ fields are:

     ‘enable-network-configuration?’ (default: ‘#f’) (type: boolean)
          Setting this option to true enables ‘iwd’ to configure the
          network interfaces with the IP addresses.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the General settings group.

 -- Data Type: iwd-network-settings
     Available ‘iwd-network-settings’ fields are:

     ‘enable-ipv6?’ (default: ‘#t’) (type: boolean)
          Sets the global default that tells ‘iwd’ whether it should
          configure IPv6 addresses and routes

     ‘name-resolving-service’ (default: ‘none’) (type: resolving-service)
          Configures a DNS resolution method used by the system.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the Network settings group.

 -- Data Type: iwd-scan-settings
     Available ‘iwd-scan-settings’ fields are:

     ‘disable-periodic-scan?’ (default: ‘#f’) (type: boolean)
          Setting this option to ‘#t’ will prevent ‘iwd’ from issuing
          the periodic scans for the available networks while
          disconnected.

     ‘initial-periodic-scan-interval’ (default: ‘10’) (type: number)
          The initial periodic scan interval upon disconnect (in
          seconds).

     ‘maximum-periodic-scan-interval’ (default: ‘300’) (type: number)
          The maximum periodic scan interval (in seconds).

     ‘disable-roaming-scan?’ (default: ‘#f’) (type: boolean)
          Setting this option to ‘#t’ will prevent ‘iwd’ from trying to
          scan when roaming decisions are activated.

     ‘extra-options’ (default: ‘()’) (type: alist)
          An association list of option symbols/strings to string values
          to be appended to the Scan settings group.

   Some networking devices such as modems require special care, and this
is what the services below focus on.

 -- Variável: modem-manager-service-type
     This is the service type for the ModemManager
     (https://wiki.gnome.org/Projects/ModemManager) service. The value
     for this service type is a ‘modem-manager-configuration’ record.

     This service is part of ‘%desktop-services’ (*note Serviços de
     desktop::).

 -- Tipo de dados: modem-manager-configuration
     Data type representing the configuration of ModemManager.

     ‘modem-manager’ (default: ‘modem-manager’)
          The ModemManager package to use.

 -- Variável: usb-modeswitch-service-type
     This is the service type for the USB_ModeSwitch
     (https://www.draisberghof.de/usb_modeswitch/) service. The value
     for this service type is a ‘usb-modeswitch-configuration’ record.

     When plugged in, some USB modems (and other USB devices) initially
     present themselves as a read-only storage medium and not as a
     modem. They need to be “modeswitched” before they are usable. The
     USB_ModeSwitch service type installs udev rules to automatically
     modeswitch these devices when they are plugged in.

     This service is part of ‘%desktop-services’ (*note Serviços de
     desktop::).

 -- Tipo de dados: usb-modeswitch-configuration
     Data type representing the configuration of USB_ModeSwitch.

     ‘usb-modeswitch’ (default: ‘usb-modeswitch’)
          The USB_ModeSwitch package providing the binaries for
          modeswitching.

     ‘usb-modeswitch-data’ (default: ‘usb-modeswitch-data’)
          The package providing the device data and udev rules file used
          by USB_ModeSwitch.

     ‘config-file’ (default: ‘#~(string-append #$usb-modeswitch:dispatcher "/etc/usb_modeswitch.conf")’)
          Which config file to use for the USB_ModeSwitch dispatcher. By
          default the config file shipped with USB_ModeSwitch is used
          which disables logging to ‘/var/log’ among other default
          settings. If set to ‘#f’, no config file is used.


File: guix.pt_BR.info,  Node: Serviços de Rede,  Next: Atualizações sem supervisão,  Prev: Networking Setup,  Up: Serviços

11.10.5 Serviços de Rede
------------------------

The ‘(gnu services networking)’ module discussed in the previous section
provides services for more advanced setups: providing a DHCP service for
others to use, filtering packets with iptables or nftables, running a
WiFi access point with ‘hostapd’, running the ‘inetd’ “superdaemon”, and
more. This section describes those.

 -- Variável: dhcpd-service-type
     This type defines a service that runs a DHCP daemon. To create a
     service of this type, you must supply a ‘<dhcpd-configuration>’.
     For example:

          (service dhcpd-service-type
                   (dhcpd-configuration
                    (config-file (local-file "my-dhcpd.conf"))
                    (interfaces '("enp0s25"))))

 -- Tipo de dados: dhcpd-configuration
     ‘package’ (default: ‘isc-dhcp’)
          The package that provides the DHCP daemon. This package is
          expected to provide the daemon at ‘sbin/dhcpd’ relative to its
          output directory. The default package is the ISC’s DHCP server
          (https://www.isc.org/dhcp/).
     ‘config-file’ (default: ‘#f’)
          The configuration file to use. This is required. It will be
          passed to ‘dhcpd’ via its ‘-cf’ option. This may be any
          “file-like” object (*note file-like objects: Expressões-G.).
          See ‘man dhcpd.conf’ for details on the configuration file
          syntax.
     ‘version’ (default: ‘"4"’)
          The DHCP version to use. The ISC DHCP server supports the
          values “4”, “6”, and “4o6”. These correspond to the ‘dhcpd’
          program options ‘-4’, ‘-6’, and ‘-4o6’. See ‘man dhcpd’ for
          details.
     ‘run-directory’ (default: ‘"/run/dhcpd"’)
          The run directory to use. At service activation time, this
          directory will be created if it does not exist.
     ‘pid-file’ (default: ‘"/run/dhcpd/dhcpd.pid"’)
          The PID file to use. This corresponds to the ‘-pf’ option of
          ‘dhcpd’. See ‘man dhcpd’ for details.
     ‘interfaces’ (default: ‘'()’)
          The names of the network interfaces on which dhcpd should
          listen for broadcasts. If this list is not empty, then its
          elements (which must be strings) will be appended to the
          ‘dhcpd’ invocation when starting the daemon. It may not be
          necessary to explicitly specify any interfaces here; see ‘man
          dhcpd’ for details.

 -- Variável: hostapd-service-type
     This is the service type to run the hostapd
     (https://w1.fi/hostapd/) daemon to set up WiFi (IEEE 802.11) access
     points and authentication servers. Its associated value must be a
     ‘hostapd-configuration’ as shown below:

          ;; Use wlan1 to run the access point for "My Network".
          (service hostapd-service-type
                   (hostapd-configuration
                    (interface "wlan1")
                    (ssid "My Network")
                    (channel 12)))

 -- Tipo de dados: hostapd-configuration
     This data type represents the configuration of the hostapd service,
     with the following fields:

     ‘package’ (default: ‘hostapd’)
          The hostapd package to use.

     ‘interface’ (default: ‘"wlan0"’)
          The network interface to run the WiFi access point.

     ‘ssid’
          The SSID (“service set identifier”), a string that identifies
          this network.

     ‘broadcast-ssid?’ (default: ‘#t’)
          Whether to broadcast this SSID.

     ‘channel’ (default: ‘1’)
          The WiFi channel to use.

     ‘driver’ (default: ‘"nl80211"’)
          The driver interface type. ‘"nl80211"’ is used with all Linux
          mac80211 drivers. Use ‘"none"’ if building hostapd as a
          standalone RADIUS server that does not control any
          wireless/wired driver.

     ‘extra-settings’ (default: ‘""’)
          Extra settings to append as-is to the hostapd configuration
          file. See
          <https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf> for the
          configuration file reference.

 -- Variável: simulated-wifi-service-type
     This is the type of a service to simulate WiFi networking, which
     can be useful in virtual machines for testing purposes. The service
     loads the Linux kernel ‘mac80211_hwsim’ module
     (https://www.kernel.org/doc/html/latest/networking/mac80211_hwsim/mac80211_hwsim.html)
     and starts hostapd to create a pseudo WiFi network that can be seen
     on ‘wlan0’, by default.

     The service’s value is a ‘hostapd-configuration’ record.

 -- Variável: iptables-service-type
     This is the service type to set up an iptables configuration.
     iptables is a packet filtering framework supported by the Linux
     kernel. This service supports configuring iptables for both IPv4
     and IPv6. A simple example configuration rejecting all incoming
     connections except those to the ssh port 22 is shown below.

          (service iptables-service-type
                   (iptables-configuration
                    (ipv4-rules (plain-file "iptables.rules" "*filter
          :INPUT ACCEPT
          :FORWARD ACCEPT
          :OUTPUT ACCEPT
          -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
          -A INPUT -p tcp --dport 22 -j ACCEPT
          -A INPUT -j REJECT --reject-with icmp-port-unreachable
          COMMIT
          "))
                    (ipv6-rules (plain-file "ip6tables.rules" "*filter
          :INPUT ACCEPT
          :FORWARD ACCEPT
          :OUTPUT ACCEPT
          -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
          -A INPUT -p tcp --dport 22 -j ACCEPT
          -A INPUT -j REJECT --reject-with icmp6-port-unreachable
          COMMIT
          "))))

 -- Tipo de dados: iptables-configuration
     The data type representing the configuration of iptables.

     ‘iptables’ (default: ‘iptables’)
          The iptables package that provides ‘iptables-restore’ and
          ‘ip6tables-restore’.
     ‘ipv4-rules’ (default: ‘%iptables-accept-all-rules’)
          The iptables rules to use. It will be passed to
          ‘iptables-restore’. This may be any “file-like” object (*note
          file-like objects: Expressões-G.).
     ‘ipv6-rules’ (default: ‘%iptables-accept-all-rules’)
          The ip6tables rules to use. It will be passed to
          ‘ip6tables-restore’. This may be any “file-like” object (*note
          file-like objects: Expressões-G.).

 -- Variável: nftables-service-type
     This is the service type to set up a nftables configuration.
     nftables is a netfilter project that aims to replace the iptables,
     ip6tables, arptables and ebtables framework. It provides a new
     packet filtering framework, a new user-space utility ‘nft’, and a
     compatibility layer for iptables. This service comes with a default
     ruleset, ‘%default-nftables-ruleset’, that rejects all incoming
     connections except those to the SSH port 22 (TCP). To use it,
     simply write:

          (service nftables-service-type)

 -- Tipo de dados: nftables-configuration
     Available ‘nftables-configuration’ fields are:

     ‘package’ (default: ‘nftables’) (type: file-like)
          The ‘nftables’ package to use.

     ‘debug-levels’ (type: maybe-list-of-debug-levels)
          A list of debug levels, for enabling debugging output. Valid
          debug level values are the ‘scanner’, ‘parser’, ‘eval’,
          ‘netlink’, ‘mnl’, ‘proto-ctx’, ‘segtree’ or ‘all’ symbols.

     ‘ruleset’ (type: file-like)
          A file-like object containing the complete nftables ruleset.
          The default ruleset rejects all incoming connections except
          those to TCP port 22, with connections from the loopback
          interface are allowed.

 -- Variável: ntp-service-type
     This is the type of the service running the Network Time Protocol
     (NTP) (https://www.ntp.org) daemon, ‘ntpd’. The daemon will keep
     the system clock synchronized with that of the specified NTP
     servers.

     The value of this service is an ‘ntpd-configuration’ object, as
     described below.

 -- Tipo de dados: ntp-configuration
     This is the data type for the NTP service configuration.

     ‘servers’ (default: ‘%ntp-servers’)
          This is the list of servers (‘<ntp-server>’ records) with
          which ‘ntpd’ will be synchronized. See the ‘ntp-server’ data
          type definition below.

     ‘allow-large-adjustment?’ (default: ‘#t’)
          This determines whether ‘ntpd’ is allowed to make an initial
          adjustment of more than 1,000 seconds.

     ‘ntp’ (default: ‘ntp’)
          The NTP package to use.

 -- Variável: %ntp-servers
     List of host names used as the default NTP servers. These are
     servers of the NTP Pool Project (https://www.ntppool.org/en/).

 -- Tipo de dados: ntp-server
     The data type representing the configuration of a NTP server.

     ‘type’ (default: ‘'server’)
          The type of the NTP server, given as a symbol. One of ‘'pool’,
          ‘'server’, ‘'peer’, ‘'broadcast’ or ‘'manycastclient’.

     ‘address’
          The address of the server, as a string.

     ‘options’
          NTPD options to use with that specific server, given as a list
          of option names and/or of option names and values tuples. The
          following example define a server to use with the options
          ‘iburst’ and ‘prefer’, as well as ‘version’ 3 and a ‘maxpoll’
          time of 16 seconds.

               (ntp-server
                (type 'server)
                (address "some.ntp.server.org")
                (options `(iburst (version 3) (maxpoll 16) prefer))))

 -- Variável: openntpd-service-type
     Run the ‘ntpd’, the Network Time Protocol (NTP) daemon, as
     implemented by OpenNTPD (http://www.openntpd.org). The daemon will
     keep the system clock synchronized with that of the given servers.

          (service
           openntpd-service-type
           (openntpd-configuration
            (listen-on '("127.0.0.1" "::1"))
            (sensor '("udcf0 correction 70000"))
            (constraint-from '("www.gnu.org"))
            (constraints-from '("https://www.google.com/"))))


 -- Variável: %openntpd-servers
     This variable is a list of the server addresses defined in
     ‘%ntp-servers’.

 -- Tipo de dados: openntpd-configuration
     ‘openntpd’ (default: ‘openntpd’)
          The openntpd package to use.
     ‘listen-on’ (default: ‘'("127.0.0.1" "::1")’)
          A list of local IP addresses or hostnames the ntpd daemon
          should listen on.
     ‘query-from’ (default: ‘'()’)
          A list of local IP address the ntpd daemon should use for
          outgoing queries.
     ‘sensor’ (default: ‘'()’)
          Specify a list of timedelta sensor devices ntpd should use.
          ‘ntpd’ will listen to each sensor that actually exists and
          ignore non-existent ones. See upstream documentation
          (https://man.openbsd.org/ntpd.conf) for more information.
     ‘server’ (default: ‘'()’)
          Specify a list of IP addresses or hostnames of NTP servers to
          synchronize to.
     ‘servers’ (default: ‘%openntp-servers’)
          Specify a list of IP addresses or hostnames of NTP pools to
          synchronize to.
     ‘constraint-from’ (default: ‘'()’)
          ‘ntpd’ can be configured to query the ‘Date’ from trusted
          HTTPS servers via TLS. This time information is not used for
          precision but acts as an authenticated constraint, thereby
          reducing the impact of unauthenticated NTP man-in-the-middle
          attacks. Specify a list of URLs, IP addresses or hostnames of
          HTTPS servers to provide a constraint.
     ‘constraints-from’ (default: ‘'()’)
          As with constraint from, specify a list of URLs, IP addresses
          or hostnames of HTTPS servers to provide a constraint. Should
          the hostname resolve to multiple IP addresses, ‘ntpd’ will
          calculate a median constraint from all of them.

 -- Variável: inetd-service-type
     This service runs the ‘inetd’ (*note (inetutils)inetd invocation::)
     daemon. ‘inetd’ listens for connections on internet sockets, and
     lazily starts the specified server program when a connection is
     made on one of these sockets.

     The value of this service is an ‘inetd-configuration’ object. The
     following example configures the ‘inetd’ daemon to provide the
     built-in ‘echo’ service, as well as an smtp service which forwards
     smtp traffic over ssh to a server ‘smtp-server’ behind a gateway
     ‘hostname’:

          (service
           inetd-service-type
           (inetd-configuration
            (entries (list
                      (inetd-entry
                       (name "echo")
                       (socket-type 'stream)
                       (protocol "tcp")
                       (wait? #f)
                       (user "root"))
                      (inetd-entry
                       (node "127.0.0.1")
                       (name "smtp")
                       (socket-type 'stream)
                       (protocol "tcp")
                       (wait? #f)
                       (user "root")
                       (program (file-append openssh "/bin/ssh"))
                       (arguments
                        '("ssh" "-qT" "-i" "/path/to/ssh_key"
                          "-W" "smtp-server:25" "user@hostname")))))))

     See below for more details about ‘inetd-configuration’.

 -- Tipo de dados: inetd-configuration
     Data type representing the configuration of ‘inetd’.

     ‘program’ (default: ‘(file-append inetutils "/libexec/inetd")’)
          The ‘inetd’ executable to use.

     ‘entries’ (default: ‘'()’)
          A list of ‘inetd’ service entries. Each entry should be
          created by the ‘inetd-entry’ constructor.

 -- Tipo de dados: inetd-entry
     Data type representing an entry in the ‘inetd’ configuration. Each
     entry corresponds to a socket where ‘inetd’ will listen for
     requests.

     ‘node’ (default: ‘#f’)
          Optional string, a comma-separated list of local addresses
          ‘inetd’ should use when listening for this service. *Note
          (inetutils)Configuration file:: for a complete description of
          all options.
     ‘name’
          A string, the name must correspond to an entry in
          ‘/etc/services’.
     ‘socket-type’
          One of ‘'stream’, ‘'dgram’, ‘'raw’, ‘'rdm’ or ‘'seqpacket’.
     ‘protocol’
          A string, must correspond to an entry in ‘/etc/protocols’.
     ‘wait?’ (padrão: ‘#t’)
          Whether ‘inetd’ should wait for the server to exit before
          listening to new service requests.
     ‘user’
          A string containing the user (and, optionally, group) name of
          the user as whom the server should run. The group name can be
          specified in a suffix, separated by a colon or period, i.e.
          ‘"user"’, ‘"user:group"’ or ‘"user.group"’.
     ‘program’ (default: ‘"internal"’)
          The server program which will serve the requests, or
          ‘"internal"’ if ‘inetd’ should use a built-in service.
     ‘arguments’ (padrão: ‘'()’)
          A list strings or file-like objects, which are the server
          program’s arguments, starting with the zeroth argument, i.e.
          the name of the program itself. For ‘inetd’’s internal
          services, this entry must be ‘'()’ or ‘'("internal")’.

     *Note (inetutils)Configuration file:: for a more detailed
     discussion of each configuration field.

 -- Variável: opendht-service-type
     This is the type of the service running a OpenDHT
     (https://opendht.net) node, ‘dhtnode’. The daemon can be used to
     host your own proxy service to the distributed hash table (DHT),
     for example to connect to with Jami, among other applications.

          Importante: When using the OpenDHT proxy server, the IP
          addresses it “sees” from the clients should be addresses
          reachable from other peers. In practice this means that a
          publicly reachable address is best suited for a proxy server,
          outside of your private network. For example, hosting the
          proxy server on a IPv4 private local network and exposing it
          via port forwarding could work for external peers, but peers
          local to the proxy would have their private addresses shared
          with the external peers, leading to connectivity problems.

     The value of this service is a ‘opendht-configuration’ object, as
     described below.

 -- Tipo de dados: opendht-configuration
     Available ‘opendht-configuration’ fields are:

     ‘opendht’ (default: ‘opendht’) (type: file-like)
          The ‘opendht’ package to use.

     ‘peer-discovery?’ (default: ‘#f’) (type: boolean)
          Whether to enable the multicast local peer discovery
          mechanism.

     ‘enable-logging?’ (default: ‘#f’) (type: boolean)
          Whether to enable logging messages to syslog. It is disabled
          by default as it is rather verbose.

     ‘debug?’ (default: ‘#f’) (type: boolean)
          Whether to enable debug-level logging messages. This has no
          effect if logging is disabled.

     ‘bootstrap-host’ (default: ‘"bootstrap.jami.net:4222"’) (type: maybe-string)
          The node host name that is used to make the first connection
          to the network. A specific port value can be provided by
          appending the ‘:PORT’ suffix. By default, it uses the Jami
          bootstrap nodes, but any host can be specified here. It’s also
          possible to disable bootstrapping by explicitly setting this
          field to the ‘%unset-value’ value.

     ‘port’ (default: ‘4222’) (type: maybe-number)
          The UDP port to bind to. When left unspecified, an available
          port is automatically selected.

     ‘proxy-server-port’ (type: maybe-number)
          Spawn a proxy server listening on the specified port.

     ‘proxy-server-port-tls’ (type: maybe-number)
          Spawn a proxy server listening to TLS connections on the
          specified port.

 -- Variável: tor-service-type
     Type for a service that runs the Tor (https://torproject.org)
     anonymous networking daemon. The service is configured using a
     ‘<tor-configuration>’ record. By default, the Tor daemon runs as
     the ‘tor’ unprivileged user, which is a member of the ‘tor’ group.

     Services of this type can be extended by other services to specify
     “onion services” (in addition to those already specified in
     ‘tor-configuration’) as in this example:

          (simple-service 'my-extra-onion-service tor-service-type
                          (list (tor-onion-service-configuration
                                  (name "extra-onion-service")
                                  (mapping '((80 "127.0.0.1:8080"))))))

 -- Tipo de dados: tor-configuration
     ‘tor’ (default: ‘tor’)
          The package that provides the Tor daemon. This package is
          expected to provide the daemon at ‘bin/tor’ relative to its
          output directory. The default package is the Tor Project’s
          (https://www.torproject.org) implementation.

     ‘config-file’ (default: ‘(plain-file "empty" "")’)
          The configuration file to use. It will be appended to a
          default configuration file, and the final configuration file
          will be passed to ‘tor’ via its ‘-f’ option. This may be any
          “file-like” object (*note file-like objects: Expressões-G.).
          See ‘man tor’ for details on the configuration file syntax.

     ‘hidden-services’ (default: ‘'()’)
          The list of ‘<tor-onion-service-configuration>’ records to
          use. For any onion service you include in this list,
          appropriate configuration to enable the onion service will be
          automatically added to the default configuration file.

     ‘socks-socket-type’ (default: ‘'tcp’)
          The default socket type that Tor should use for its SOCKS
          socket. This must be either ‘'tcp’ or ‘'unix’. If it is
          ‘'tcp’, then by default Tor will listen on TCP port 9050 on
          the loopback interface (i.e., localhost). If it is ‘'unix’,
          then Tor will listen on the UNIX domain socket
          ‘/var/run/tor/socks-sock’, which will be made writable by
          members of the ‘tor’ group.

          If you want to customize the SOCKS socket in more detail,
          leave ‘socks-socket-type’ at its default value of ‘'tcp’ and
          use ‘config-file’ to override the default by providing your
          own ‘SocksPort’ option.

     ‘control-socket?’ (default: ‘#f’)
          Whether or not to provide a “control socket” by which Tor can
          be controlled to, for instance, dynamically instantiate tor
          onion services. If ‘#t’, Tor will listen for control commands
          on the UNIX domain socket ‘/var/run/tor/control-sock’, which
          will be made writable by members of the ‘tor’ group.

     ‘transport-plugins’ (default: ‘'()’)
          The list of ‘<tor-transport-plugin>’ records to use. For any
          transport plugin you include in this list, appropriate
          configuration line to enable transport plugin will be
          automatically added to the default configuration file.

     ‘auto-start?’ (default: ‘#t’)
          Whether or not to start the Tor daemon on boot.

 -- Tipo de dados: tor-onion-service-configuration
     Data Type representing a Tor “Onion Service” configuration. See the
     Tor project’s documentation
     (https://community.torproject.org/onion-services/) for more
     information. Available ‘tor-onion-service-configuration’ fields
     are:

     ‘name’ (type: string)
          Name for this Onion Service. This creates a
          ‘/var/lib/tor/hidden-services/NAME’ directory, where the
          ‘hostname’ file contains the ‘.onion’ host name for this Onion
          Service.

     ‘mapping’ (type: alist)
          Association list of port to address mappings. The following
          example:
               '((22 "127.0.0.1:22")
                 (80 "127.0.0.1:8080"))
          maps ports 22 and 80 of the Onion Service to the local ports
          22 and 8080.

 -- Tipo de dados: tor-transport-plugin
     Data type representing a Tor pluggable transport plugin in
     ‘tor-configuration’. Plugguble transports are programs that
     disguise Tor traffic, which can be useful in case Tor is censored.
     See the the Tor project’s documentation
     (https://tb-manual.torproject.org/circumvention/) and specification
     (https://spec.torproject.org/pt-spec/index.html) for more
     information.

     Each transport plugin corresponds either to ‘ClientTransportPlugin
     ...’ or to ‘ServerTransportPlugin ...’ line in the default
     configuration file, see ‘man tor’. Available ‘tor-transport-plugin’
     fields are:

     ‘role’ (default: ‘'client’)
          This must be either ‘'client’ or ‘'server’. Otherwise, an
          error is raised. Set the ‘'server’ value if you want to run a
          bridge to help censored users connect to the Tor network, see
          the Tor project’s bridge guide
          (https://community.torproject.org/relay/setup/bridge/). Set
          the ‘'client’ value if you want to connect to somebody else’s
          bridge, see the Tor project’s “Get Bridges” page
          (https://bridges.torproject.org/). In both cases the required
          additional configuration should be provided via
          ‘#:config-file’ option of ‘tor-configuration’.
     ‘protocol’ (default: ‘"obfs4"’)
          A string that specifies a pluggable transport protocol.
     ‘program’
          This must be a “file-like” object or a string pointing to the
          pluggable transport plugin executable. This option allows the
          Tor daemon run inside the container to access the executable
          and all the references (e.g. package dependencies) attached to
          it.

     Suppose you would like Tor daemon to use obfs4 type obfuscation and
     to connect to Tor network via obfs4 bridge (a nonpublic Tor relay
     with support for obfs4 type obfuscation). Then you may go to
     https://bridges.torproject.org/ (https://bridges.torproject.org/)
     and get there a couple of bridge lines (each starts with ‘obfs4
     ...’) and use these lines in tor-service-type configuration as
     follows:
          (service tor-service-type
          	 (tor-configuration
          	  (config-file (plain-file "torrc"
          				   "\
          UseBridges 1
          Bridge obfs4 ...
          Bridge obfs4 ..."))
          	  (transport-plugins
          	   (list (tor-transport-plugin
          		  (program (file-append lyrebird "/bin/lyrebird")))))))

   The ‘(gnu services rsync)’ module provides the following services:

   You might want an rsync daemon if you have files that you want
available so anyone (or just yourself) can download existing files or
upload new files.

 -- Variável: rsync-service-type
     This is the service type for the rsync (https://rsync.samba.org)
     daemon, The value for this service type is a ‘rsync-configuration’
     record as in this example:

          ;; Export two directories over rsync.  By default rsync listens on
          ;; all the network interfaces.
          (service rsync-service-type
                   (rsync-configuration
                     (modules (list (rsync-module
                                      (name "music")
                                      (file-name "/srv/zik")
                                      (read-only? #f))
                                    (rsync-module
                                      (name "movies")
                                      (file-name "/home/charlie/movies"))))))

     See below for details about ‘rsync-configuration’.

 -- Tipo de dados: rsync-configuration
     Data type representing the configuration for ‘rsync-service’.

     ‘package’ (default: RSYNC)
          ‘rsync’ package to use.

     ‘address’ (default: ‘#f’)
          IP address on which ‘rsync’ listens for incoming connections.
          If unspecified, it defaults to listening on all available
          addresses.

     ‘port-number’ (default: ‘873’)
          TCP port on which ‘rsync’ listens for incoming connections. If
          port is less than ‘1024’ ‘rsync’ needs to be started as the
          ‘root’ user and group.

     ‘pid-file’ (default: ‘"/var/run/rsyncd/rsyncd.pid"’)
          Name of the file where ‘rsync’ writes its PID.

     ‘lock-file’ (default: ‘"/var/run/rsyncd/rsyncd.lock"’)
          Name of the file where ‘rsync’ writes its lock file.

     ‘log-file’ (default: ‘"/var/log/rsyncd.log"’)
          Name of the file where ‘rsync’ writes its log file.

     ‘user’ (default: ‘"root"’)
          Owner of the ‘rsync’ process.

     ‘group’ (default: ‘"root"’)
          Group of the ‘rsync’ process.

     ‘uid’ (default: ‘"rsyncd"’)
          User name or user ID that file transfers to and from that
          module should take place as when the daemon was run as ‘root’.

     ‘gid’ (default: ‘"rsyncd"’)
          Group name or group ID that will be used when accessing the
          module.

     ‘modules’ (default: ‘%default-modules’)
          List of “modules”—i.e., directories exported over rsync. Each
          element must be a ‘rsync-module’ record, as described below.

 -- Tipo de dados: rsync-module
     This is the data type for rsync “modules”. A module is a directory
     exported over the rsync protocol. The available fields are as
     follows:

     ‘name’
          The module name. This is the name that shows up in URLs. For
          example, if the module is called ‘music’, the corresponding
          URL will be ‘rsync://host.example.org/music’.

     ‘file-name’
          Name of the directory being exported.

     ‘comment’ (default: ‘""’)
          Comment associated with the module. Client user interfaces may
          display it when they obtain the list of available modules.

     ‘read-only?’ (default: ‘#t’)
          Whether or not client will be able to upload files. If this is
          false, the uploads will be authorized if permissions on the
          daemon side permit it.

     ‘chroot?’ (default: ‘#t’)
          When this is true, the rsync daemon changes root to the
          module’s directory before starting file transfers with the
          client. This improves security, but requires rsync to run as
          root.

     ‘timeout’ (default: ‘300’)
          Idle time in seconds after which the daemon closes a
          connection with the client.

   The ‘(gnu services syncthing)’ module provides the following
services:

   You might want a Syncthing daemon if you have files between two or
more computers and want to sync them in real time, safely protected from
prying eyes.

 -- Variável: syncthing-service-type
     This is the service type for the syncthing (https://syncthing.net/)
     daemon, The value for this service type is a
     ‘syncthing-configuration’ record as in this example:

          (service syncthing-service-type
                   (syncthing-configuration (user "alice")))

          Nota: This service is also available for Guix Home, where it
          runs directly with your user privileges (*note
          ‘home-syncthing-service-type’: Networking Home Services.).

     See below for details about ‘syncthing-configuration’.

 -- Tipo de dados: syncthing-configuration
     Data type representing the configuration for
     ‘syncthing-service-type’.

     ‘syncthing’ (default: SYNCTHING)
          ‘syncthing’ package to use.

     ‘arguments’ (default: ’())
          List of command-line arguments passing to ‘syncthing’ binary.

     ‘logflags’ (default: 0)
          Sum of logging flags, see Syncthing documentation logflags
          (https://docs.syncthing.net/users/syncthing.html#cmdoption-logflags).

     ‘user’ (default: #F)
          The user as which the Syncthing service is to be run. This
          assumes that the specified user exists.

     ‘group’ (default: "USERS")
          The group as which the Syncthing service is to be run. This
          assumes that the specified group exists.

     ‘home’ (default: #F)
          Sets the ‘HOME’ variable for the Syncthing daemon. The default
          is ‘$HOME’ of the specified Syncthing ‘user’.

     ‘config-file’ (default: #F)
          Either a file-like object that resolves to a Syncthing
          configuration XML file, or a ‘syncthing-config-file’ record
          (see below). If set to ‘#f’, Guix will not try to generate a
          config file, and Syncthing will generate a default
          configuration which will not be touched on reconfigure.
          Specifying this in a system service moves Syncthing’s common
          configuration and data directory (‘--home’ in
          <https://docs.syncthing.net/users/syncthing.html>) to
          ‘/var/lib/syncthing-<user>’.

          When used as a home service, syncthing configuration will be
          populated in ‘~/.local/state/syncthing/’. Old Syncthing
          installs may have files in ‘$XDG_CONFIG_HOME/syncthing/’
          (usually ‘~/.config/syncthing/’), which will override
          configuration in ‘~/.local/state/syncthing’ managed by this
          service. In such cases, you should move the contents of
          ‘$XDG_CONFIG_HOME/syncthing/’ into
          ‘~/.local/state/syncthing/’.

   This section documents a subset of the Syncthing configuration
options—specifically those related to Guix or those affecting how your
computer will connect to other computers over the network (such as
Syncthing relays or discovery servers). The configuration is fully
documented in the upstream Syncthing config documentation
(https://docs.syncthing.net/users/config.html); camelCase there is
converted to kebab-case here. If you are migrating from a
Syncthing-managed configuration to one managed by Guix, you can check
what changes were introduced by ‘diff’ing the respective ‘config.xml’
files. Note that you will need to add whitespace with 4-space
indentation to the file generated by Guix, using the ‘xmllint’ program
from the ‘libxml2’ package like so:

     XMLLINT_INDENT="    " xmllint --format /path/to/new/config.xml | diff /path/to/old/config.xml -

   When generating a configuration file through Guix, you can still
temporarily modify Syncthing from the GUI or through ‘introducer’ and
‘autoAcceptFolders’ mechanisms, but such changes will be reset on
reconfigure.

 -- Data Type: syncthing-config-file
     Data type representing the configuration file read by the Syncthing
     daemon.

     ‘folders’ (default: ‘(list (syncthing-folder (id "default") (label "Default Folder") (path "~/Sync")))’
          The default here is the same as Syncthing’s default. The value
          should be a list of ‘syncthing-folder’s.

     ‘devices’ (default: ‘'()’
          This should be a list of ‘syncthing-device’s. Guix will
          automatically add any devices specified in any ‘folders’ to
          this list. There are instances when you want to connect to a
          device despite not (initially) sharing any folders (such as a
          device with autoAcceptFolders). In such instances, you should
          specify those devices here. If multiple versions of the same
          device (as determined by comparing device ID) are discovered,
          the one in this list is prioritized. Otherwise, the first
          instance in the first folder is used.

     ‘gui-enabled?’ (default: ‘#t’)
          By default, any user on the computer can access the GUI and
          make changes to Syncthing. If you leave this enabled, you
          should probably set ‘gui-user’ and ‘gui-password’ (see below).

     ‘gui-tls?’ (default: ‘#f’)
     ‘gui-debugging?’ (default: ‘#f’)
     ‘gui-send-basic-authorization-prompt?’ (default: ‘#f’)
     ‘gui-address’ (default: ‘"127.0.0.1:8384"’)
     ‘gui-user’ (default: ‘#f’)
     ‘gui-password’ (default: ‘#f’)
          A bcrypt hash of the GUI password. Remember that this will be
          globally exposed in ‘/gnu/store’.

     ‘gui-apikey’ (default: ‘#f’)
          You must specify this to use the Syncthing REST interface.
          This key is kept in ‘/gnu/store’ and is accessible to all
          users of the system.

     ‘gui-theme’ (default: ‘"default"’)
     ‘ldap-enabled?’ (default: ‘#f’)
     ‘ldap-address’ (default: ‘""’)
     ‘ldap-bind-dn’ (default: ‘""’)
     ‘ldap-transport’ (default: ‘""’)
     ‘ldap-insecure-skip-verify’ (default: ‘""’)
     ‘ldap-search-base-dn’ (default: ‘""’)
     ‘ldap-search-filter’ (default: ‘""’)
     ‘listen-address’ (default: ‘"default"’)
     ‘global-announce-server’ (default: ‘"default"’)
     ‘global-announce-enabled?’ (default: ‘#t’)
          Global discovery servers can be used to help connect devices
          at unknown IP addresses by storing the last known IP address.

     ‘local-announce-enabled?’ (default: ‘#t’)
          This makes devices find each other very easily on the same
          LAN. Often, this will allow you to just plug an Ethernet
          between two devices, or connect one device to the other’s
          hotspot and start syncing.

     ‘local-announce-port’ (default: ‘21027’)
     ‘local-announce-mac-address’ (default: ‘"[ff12::8384]:21027"’)
     ‘max-send-kbps’ (default: ‘0’)
     ‘max-receive-kbps’ (default: ‘0’)
     ‘reconnection-interval-seconds’ (default: ‘60’)
     ‘relays-enabled?’ (default: ‘#t’)
          This option allows your Syncthing instance to use a global
          network of relays
          (https://docs.syncthing.net/users/relaying.html) to enable
          syncing between devices when all other methods fail. As
          always, Syncthing traffic is encrypted in transport and the
          relays are unable to decrypt it.

     ‘relay-reconnect-interval-minutes’ (default: ‘10’)
     ‘start-browser?’ (default: ‘#t’)
     ‘nat-enabled?’ (default: ‘#t’)
     ‘nat-lease-minutes’ (default: ‘60’)
     ‘nat-renewal-minutes’ (default: ‘30’)
     ‘nat-timeout-seconds’ (default: ‘10’)
     ‘usage-reporting-accepted’ (default: ‘0’)
          Options whose names begin with ‘usage-reporting-’ control
          usage reporting. Set to -1 to disable, or to a positive value
          to enable. The default (0) disables reporting, but causes a
          usage reporting consent prompt to be displayed in the
          Syncthing GUI.

     ‘usage-reporting-seen’ (default: ‘0’)
     ‘usage-reporting-unique-id’ (default: ‘""’)
     ‘usage-reporting-url’ (default: ‘"https://data.syncthing.net/newdata"’)
     ‘usage-reporting-post-insecurely?’ (default: ‘#f’)
     ‘usage-reporting-initial-delay-seconds’ (default: ‘1800’)
     ‘auto-upgrade-interval-hours’ (default: ‘12’)
     ‘upgrade-to-pre-releases?’ (default: ‘#f’)
     ‘keep-temporaries-hours’ (default: ‘24’)
     ‘cache-ignored-files?’ (default: ‘#f’)
     ‘progress-update-interval-seconds’ (default: ‘5’)
     ‘limit-bandwidth-in-lan?’ (default: ‘#f’)
     ‘min-home-disk-free-unit’ (default: ‘"%"’)
     ‘min-home-disk-free’ (default: ‘1’)
     ‘releases-url’ (default: ‘"https://upgrades.syncthing.net/meta.json"’)
     ‘overwrite-remote-device-names-on-connect?’ (default: ‘#f’)
     ‘temp-index-min-blocks’ (default: ‘10’)
     ‘unacked-notification-id’ (default: ‘"authenticationUserAndPassword"’)
     ‘traffic-class’ (default: ‘0’)
     ‘set-low-priority?’ (default: ‘#t’)
     ‘max-folder-concurrency’ (default: ‘0’)
     ‘crash-reporting-url’ (default: ‘"https://crash.syncthing.net/newcrash"’)
     ‘crash-reporting-enabled?’ (default: ‘#t’)
     ‘stun-keepalive-start-seconds’ (default: ‘180’)
     ‘stun-keepalive-min-seconds’ (default: ‘20’)
     ‘stun-server’ (default: ‘"default"’)
     ‘database-tuning’ (default: ‘"auto"’)
     ‘max-concurrent-incoming-request-kib’ (default: ‘0’)
     ‘announce-lan-addresses?’ (default: ‘#t’)
     ‘send-full-index-on-upgrade?’ (default: ‘#f’)
     ‘connection-limit-enough’ (default: ‘0’)
     ‘connection-limit-max’ (default: ‘0’)
     ‘insecure-allow-old-tls-versions?’ (default: ‘#f’)
     ‘connection-priority-tcp-lan’ (default: ‘10’)
     ‘connection-priority-quic-lan’ (default: ‘20’)
     ‘connection-priority-tcp-wan’ (default: ‘30’)
     ‘connection-priority-quic-wan’ (default: ‘40’)
     ‘connection-priority-relay’ (default: ‘50’)
     ‘connection-priority-upgrade-threshold’ (default: ‘0’)
     ‘default-folder’ (default: ‘(syncthing-folder (label ""))’)
     ‘default-device’ (default: ‘(syncthing-device (id ""))’)
     ‘default-ignores’ (default: ‘"")’)
          Options whose names begin with ‘default-’ above do not affect
          folders and devices added through the Guix configuration
          interface. They will, however, affect folders and devices that
          are added through the Syncthing GUI, by an ‘introducer’, or a
          device with ‘auto-accept-folders’.

 -- Data Type: syncthing-folder
     Data type representing a folder to be synchronized.

     ‘id’ (default: ‘#f’)
          This ID cannot match the ID of any other folder on this
          device. If left unspecified, it will default to the label (see
          below).

     ‘label’
          A human readable label for the folder.

     ‘path’
          The path at which to store this folder.

     ‘type’ (default: ‘"sendreceive"’)
     ‘rescan-interval-seconds’ (default: ‘3600’)
     ‘file-system-watcher-enabled?’ (default: ‘#t’)
     ‘file-system-watcher-delay-seconds’ (default: ‘10’)
     ‘file-system-watcher-timeout-seconds’ (default: ‘0’)
     ‘ignore-permissions?’ (default: ‘#f’)
     ‘auto-normalize?’ (default: ‘#t’)
     ‘devices’ (default: ‘'()’)
          This should be a list of other Syncthing devices. You do not
          need to specify the current device. Each device can be listed
          as a a ‘syncthing-device’ record or a
          ‘syncthing-folder-device’ record if you want files to be
          encrypted on disk. See below.

     ‘filesystem-type’ (default: ‘"basic"’)
     ‘min-disk-free-unit’ (default: ‘"%"’)
     ‘min-disk-free’ (default: ‘1’)
     ‘versioning-type’ (default: ‘#f’)
     ‘versioning-file-system-path’ (default: ‘""’)
     ‘versioning-file-system-type’ (default: ‘"basic"’)
     ‘versioning-cleanup-interval-seconds’ (default: ‘3600’)
     ‘versioning-cleanout-days’ (default: ‘#f’)
     ‘versioning-keep’ (default: ‘#f’)
     ‘versioning-max-age’ (default: ‘#f’)
     ‘versioning-command’ (default: ‘#f’)
     ‘copiers’ (default: ‘0’)
     ‘puller-max-pending-kib’ (default: ‘0’)
     ‘hashers’ (default: ‘0’)
     ‘order’ (default: ‘"random"’)
     ‘ignore-delete?’ (default: ‘#f’)
     ‘scan-progress-interval-seconds’ (default: ‘0’)
     ‘puller-pause-seconds’ (default: ‘0’)
     ‘max-conflicts’ (default: ‘10’)
     ‘disable-sparse-files?’ (default: ‘#f’)
     ‘disable-temp-indexes?’ (default: ‘#f’)
     ‘paused?’ (default: ‘#f’)
     ‘weak-hash-threshold-percentage’ (default: ‘25’)
     ‘marker-name’ (default: ‘".stfolder"’)
     ‘copy-ownership-from-parent?’ (default: ‘#f’)
     ‘mod-time-window-seconds’ (default: ‘0’)
     ‘max-concurrent-writes’ (default: ‘2’)
     ‘disable-fsync?’ (default: ‘#f’)
     ‘block-pull-order’ (default: ‘"standard"’)
     ‘copy-range-method’ (default: ‘"standard"’)
     ‘case-sensitive-file-system?’ (default: ‘#f’)
     ‘junctions-as-dirs?’ (default: ‘#f’)
     ‘sync-ownership?’ (default: ‘#f’)
     ‘send-ownership?’ (default: ‘#f’)
     ‘sync-xattrs?’ (default: ‘#f’)
     ‘send-xattrs?’ (default: ‘#f’)
     ‘xattr-filter-max-single-entry-size’ (default: ‘1024’)
     ‘xattr-filter-max-total-size’ (default: ‘4096’)

 -- Data Type: syncthing-device
     Data type representing a device to synchronize folders with.

     ‘id’
          A long hash representing the keys generated by Syncthing on
          the first launch. You can obtain this from the Syncthing GUI
          or by inspecting an existing Syncthing configuration file.

     ‘name’ (default: ‘""’)
          A human readable device name for viewing in the GUI or in
          Scheme.

     ‘compression’ (default: ‘"metadata"’)
     ‘introducer?’ (default: ‘#f’)
     ‘skip-introduction-removals?’ (default: ‘#f’)
     ‘introduced-by’ (default: ‘""’)
     ‘addresses’ (default: ‘'("dynamic")’)
          List of addresses at which to search for this device. When the
          special value “dynamic” is included, Syncthing will search for
          the device locally as well as via the Syncthing project’s
          global discovery
          (https://docs.syncthing.net/users/security.html#global-discovery)
          servers.

     ‘paused?’ (default: ‘#f’)
     ‘auto-accept-folders?’ (default: ‘#f’)
     ‘max-send-kbps’ (default: ‘0’)
     ‘max-receive-kbps’ (default: ‘0’)
     ‘max-request-kib’ (default: ‘0’)
     ‘untrusted?’ (default: ‘#f’)
     ‘remote-gui-port’ (default: ‘0’)
     ‘num-connections’ (default: ‘0’)

 -- Data Type: syncthing-folder-device
     This data type offers two folder-specific device options:
     ‘introduced-by’ and ‘encryption-password’.

     ‘syncthing-folder-device’ corresponds to the ‘device’
     (https://docs.syncthing.net/users/config.html#config-option-folder.device)
     option in the upstream ‘folder’ element.

     If you don’t need to use these options, then you can just use
     ‘syncthing-device’ instead of ‘syncthing-folder-device’ in the
     ‘devices’ field of a ‘syncthing-folder’ instance.

     ‘device’
          The ‘syncthing-device’ for which this configuration applies.

     ‘introduced-by’ (default: ‘""’)
          The name of the device that "introduced" our device to the
          device sharing this folder. This is only used when
          "introduced" devices are removed by the introducer. See
          Syncthing introductions
          (https://docs.syncthing.net/users/introducer.html).

     ‘encryption-password’ (default: ‘""’)
          The password used to encrypt data that is synchronized to
          untrusted devices.

          Beware: specifying this field will include this password as
          plain text (not encrypted) and globally visible in
          ‘/gnu/store/’. If the encryption-password is non-empty, then
          it will be used as a password to encrypt file chunks as they
          are synchronized to untrusted devices. For more information on
          syncing to devices you don’t totally trust, see Syncthing’s
          documentation on Untrusted (Encrypted) Devices
          (https://docs.syncthing.net/users/untrusted.html). Note that
          data transfer is always encrypted while in transport
          ("end-to-end encryption"), regardless of this setting.

   Here is a more complex example configuration for illustrative
purposes:

     (service syncthing-service-type
              (let ((laptop (syncthing-device (id "VHOD2D6-...-7XRMDEN")))
                    (desktop (syncthing-device (id "64SAZ37-...-FZJ5GUA")
                                               (addresses '("tcp://example.com"))))
                    (bob-desktop (syncthing-device (id "KYIMEGO-...-FT77EAO"))))
                (syncthing-configuration
                 (user "alice")
                 (config-file
                  (syncthing-config-file
                    (folders (list (syncthing-folder
                                    (label "some-files")
                                    (path "~/data")
                                    (devices (list desktop laptop)))
                                   (syncthing-folder
                                    (label "critical-files")
                                    (path "~/secrets")
                                    (devices
                                     (list desktop
                                           laptop
                                           (syncthing-folder-device
                                            (device bob-desktop)
                                            (encryption-password "mypassword"))))))))))))

   Furthermore, ‘(gnu services ssh)’ provides the following services.
 -- Variável: openssh-service-type
     This is the type for the OpenSSH (http://www.openssh.org) secure
     shell daemon, ‘sshd’. Its value must be an ‘openssh-configuration’
     record as in this example:

          (service openssh-service-type
                   (openssh-configuration
                     (x11-forwarding? #t)
                     (permit-root-login 'prohibit-password)
                     (authorized-keys
                       `(("alice" ,(local-file "alice.pub"))
                         ("bob" ,(local-file "bob.pub"))))))

     See below for details about ‘openssh-configuration’.

     This service can be extended with extra authorized keys, as in this
     example:

          (service-extension openssh-service-type
                             (const `(("charlie"
                                       ,(local-file "charlie.pub")))))

 -- Tipo de dados: openssh-configuration
     This is the configuration record for OpenSSH’s ‘sshd’.

     ‘openssh’ (default OPENSSH)
          The OpenSSH package to use.

     ‘pid-file’ (default: ‘"/var/run/sshd.pid"’)
          Name of the file where ‘sshd’ writes its PID.

     ‘port-number’ (default: ‘22’)
          TCP port on which ‘sshd’ listens for incoming connections.

     ‘max-connections’ (default: ‘200’)
          Hard limit on the maximum number of simultaneous client
          connections, enforced by the inetd-style Shepherd service
          (*note ‘make-inetd-constructor’: (shepherd)Service De- and
          Constructors.).

     ‘permit-root-login’ (default: ‘#f’)
          This field determines whether and when to allow logins as
          root. If ‘#f’, root logins are disallowed; if ‘#t’, they are
          allowed. If it’s the symbol ‘'prohibit-password’, then root
          logins are permitted but not with password-based
          authentication.

     ‘allow-empty-passwords?’ (default: ‘#f’)
          When true, users with empty passwords may log in. When false,
          they may not.

     ‘password-authentication?’ (default: ‘#t’)
          When true, users may log in with their password. When false,
          they have other authentication methods.

     ‘public-key-authentication?’ (default: ‘#t’)
          When true, users may log in using public key authentication.
          When false, users have to use other authentication method.

          Authorized public keys are stored in ‘~/.ssh/authorized_keys’.
          This is used only by protocol version 2.

     ‘x11-forwarding?’ (padrão: ‘#f’)
          When true, forwarding of X11 graphical client connections is
          enabled—in other words, ‘ssh’ options ‘-X’ and ‘-Y’ will work.

     ‘allow-agent-forwarding?’ (padrão: ‘#t’)
          Whether to allow agent forwarding.

     ‘allow-tcp-forwarding?’ (padrão: ‘#t’)
          Whether to allow TCP forwarding.

     ‘gateway-ports?’ (padrão: ‘#f’)
          Whether to allow gateway ports.

     ‘challenge-response-authentication?’ (default: ‘#f’)
          Specifies whether challenge response authentication is allowed
          (e.g. via PAM).

     ‘use-pam?’ (default: ‘#t’)
          Enables the Pluggable Authentication Module interface. If set
          to ‘#t’, this will enable PAM authentication using
          ‘challenge-response-authentication?’ and
          ‘password-authentication?’, in addition to PAM account and
          session module processing for all authentication types.

          Because PAM challenge response authentication usually serves
          an equivalent role to password authentication, you should
          disable either ‘challenge-response-authentication?’ or
          ‘password-authentication?’.

     ‘print-last-log?’ (default: ‘#t’)
          Specifies whether ‘sshd’ should print the date and time of the
          last user login when a user logs in interactively.

     ‘subsystems’ (default: ‘'(("sftp" "internal-sftp"))’)
          Configures external subsystems (e.g. file transfer daemon).

          This is a list of two-element lists, each of which containing
          the subsystem name and a command (with optional arguments) to
          execute upon subsystem request.

          The command ‘internal-sftp’ implements an in-process SFTP
          server. Alternatively, one can specify the ‘sftp-server’
          command:
               (service openssh-service-type
                        (openssh-configuration
                         (subsystems
                          `(("sftp" ,(file-append openssh "/libexec/sftp-server"))))))

     ‘accepted-environment’ (default: ‘'()’)
          List of strings describing which environment variables may be
          exported.

          Each string gets on its own line. See the ‘AcceptEnv’ option
          in ‘man sshd_config’.

          This example allows ssh-clients to export the ‘COLORTERM’
          variable. It is set by terminal emulators, which support
          colors. You can use it in your shell’s resource file to enable
          colors for the prompt and commands if this variable is set.

               (service openssh-service-type
                        (openssh-configuration
                          (accepted-environment '("COLORTERM"))))

     ‘authorized-keys’ (default: ‘'()’)
          This is the list of authorized keys. Each element of the list
          is a user name followed by one or more file-like objects that
          represent SSH public keys. For example:

               (openssh-configuration
                 (authorized-keys
                   `(("rekado" ,(local-file "rekado.pub"))
                     ("chris" ,(local-file "chris.pub"))
                     ("root" ,(local-file "rekado.pub") ,(local-file "chris.pub")))))

          registers the specified public keys for user accounts
          ‘rekado’, ‘chris’, and ‘root’.

          Additional authorized keys can be specified via
          ‘service-extension’.

          Note that this does _not_ interfere with the use of
          ‘~/.ssh/authorized_keys’.

     ‘generate-host-keys?’ (default: ‘#t’)
          Whether to generate host key pairs with ‘ssh-keygen -A’ under
          ‘/etc/ssh’ if there are none.

          Generating key pairs takes a few seconds when enough entropy
          is available and is only done once. You might want to turn it
          off for instance in a virtual machine that does not need it
          because host keys are provided in some other way, and where
          the extra boot time is a problem.

     ‘log-level’ (default: ‘'info’)
          This is a symbol specifying the logging level: ‘quiet’,
          ‘fatal’, ‘error’, ‘info’, ‘verbose’, ‘debug’, etc. See the man
          page for ‘sshd_config’ for the full list of level names.

     ‘extra-content’ (default: ‘""’)
          This field can be used to append arbitrary text to the
          configuration file. It is especially useful for elaborate
          configurations that cannot be expressed otherwise. This
          configuration, for example, would generally disable root
          logins, but permit them from one specific IP address:

               (openssh-configuration
                 (extra-content "\
               Match Address 192.168.0.1
                 PermitRootLogin yes"))

 -- Variável: dropbear-service-type
     Type of the service that runs the Dropbear SSH daemon
     (https://matt.ucc.asn.au/dropbear/dropbear.html), whose value is a
     ‘<dropbear-configuration>’ object.

     For example, to specify a Dropbear service listening on port 1234:

          (service dropbear-service-type (dropbear-configuration
                                           (port-number 1234)))

 -- Tipo de dados: dropbear-configuration
     This data type represents the configuration of a Dropbear SSH
     daemon.

     ‘dropbear’ (default: DROPBEAR)
          The Dropbear package to use.

     ‘port-number’ (default: 22)
          The TCP port where the daemon waits for incoming connections.

     ‘syslog-output?’ (padrão: ‘#t’)
          Whether to enable syslog output.

     ‘pid-file’ (default: ‘"/var/run/dropbear.pid"’)
          File name of the daemon’s PID file.

     ‘root-login?’ (default: ‘#f’)
          Whether to allow ‘root’ logins.

     ‘allow-empty-passwords?’ (default: ‘#f’)
          Whether to allow empty passwords.

     ‘password-authentication?’ (default: ‘#t’)
          Whether to enable password-based authentication.

 -- Variável: autossh-service-type
     This is the type for the AutoSSH
     (https://www.harding.motd.ca/autossh) program that runs a copy of
     ‘ssh’ and monitors it, restarting it as necessary should it die or
     stop passing traffic. AutoSSH can be run manually from the
     command-line by passing arguments to the binary ‘autossh’ from the
     package ‘autossh’, but it can also be run as a Guix service. This
     latter use case is documented here.

     AutoSSH can be used to forward local traffic to a remote machine
     using an SSH tunnel, and it respects the ‘~/.ssh/config’ of the
     user it is run as.

     For example, to specify a service running autossh as the user
     ‘pino’ and forwarding all local connections to port ‘8081’ to
     ‘remote:8081’ using an SSH tunnel, add this call to the operating
     system’s ‘services’ field:

          (service autossh-service-type
                   (autossh-configuration
                    (user "pino")
                    (ssh-options (list "-T" "-N" "-L" "8081:localhost:8081" "remote.net"))))

 -- Tipo de dados: autossh-configuration
     This data type represents the configuration of an AutoSSH service.

     ‘user’ (default ‘"autossh"’)
          The user as which the AutoSSH service is to be run. This
          assumes that the specified user exists.

     ‘poll’ (default ‘600’)
          Specifies the connection poll time in seconds.

     ‘first-poll’ (default ‘#f’)
          Specifies how many seconds AutoSSH waits before the first
          connection test. After this first test, polling is resumed at
          the pace defined in ‘poll’. When set to ‘#f’, the first poll
          is not treated specially and will also use the connection poll
          specified in ‘poll’.

     ‘gate-time’ (default ‘30’)
          Specifies how many seconds an SSH connection must be active
          before it is considered successful.

     ‘log-level’ (default ‘1’)
          The log level, corresponding to the levels used by syslog—so
          ‘0’ is the most silent while ‘7’ is the chattiest.

     ‘max-start’ (default ‘#f’)
          The maximum number of times SSH may be (re)started before
          AutoSSH exits. When set to ‘#f’, no maximum is configured and
          AutoSSH may restart indefinitely.

     ‘message’ (default ‘""’)
          The message to append to the echo message sent when testing
          connections.

     ‘port’ (padrão ‘"0"’)
          The ports used for monitoring the connection. When set to
          ‘"0"’, monitoring is disabled. When set to ‘"N"’ where N is a
          positive integer, ports N and N+1 are used for monitoring the
          connection, such that port N is the base monitoring port and
          ‘n+1’ is the echo port. When set to ‘"N:M"’ where N and M are
          positive integers, the ports N and M are used for monitoring
          the connection, such that port N is the base monitoring port
          and M is the echo port.

     ‘ssh-options’ (default ‘'()’)
          The list of command-line arguments to pass to ‘ssh’ when it is
          run. Options ‘-f’ and ‘-M’ are reserved for AutoSSH and may
          cause undefined behaviour.

 -- Variável: webssh-service-type
     This is the type for the WebSSH (https://webssh.huashengdun.org/)
     program that runs a web SSH client. WebSSH can be run manually from
     the command-line by passing arguments to the binary ‘wssh’ from the
     package ‘webssh’, but it can also be run as a Guix service. This
     latter use case is documented here.

     For example, to specify a service running WebSSH on loopback
     interface on port ‘8888’ with reject policy with a list of allowed
     to connection hosts, and NGINX as a reverse-proxy to this service
     listening for HTTPS connection, add this call to the operating
     system’s ‘services’ field:

          (service webssh-service-type
            (webssh-configuration (address "127.0.0.1")
                                  (port 8888)
                                  (policy 'reject)
                                  (known-hosts '("localhost ecdsa-sha2-nistp256 AAAA…"
                                                 "127.0.0.1 ecdsa-sha2-nistp256 AAAA…"))))

          (service nginx-service-type
                   (nginx-configuration
                    (server-blocks
                     (list
                      (nginx-server-configuration
                       (inherit %webssh-configuration-nginx)
                       (server-name '("webssh.example.com"))
                       (listen '("443 ssl"))
                       (ssl-certificate (letsencrypt-certificate "webssh.example.com"))
                       (ssl-certificate-key (letsencrypt-key "webssh.example.com"))
                       (locations
                        (cons (nginx-location-configuration
                               (uri "/.well-known")
                               (body '("root /var/www;")))
                              (nginx-server-configuration-locations %webssh-configuration-nginx))))))))

 -- Tipo de dados: webssh-configuration
     Data type representing the configuration for ‘webssh-service’.

     ‘package’ (default: WEBSSH)
          ‘webssh’ package to use.

     ‘user-name’ (default: "WEBSSH")
          User name or user ID that file transfers to and from that
          module should take place.

     ‘group-name’ (default: "WEBSSH")
          Group name or group ID that will be used when accessing the
          module.

     ‘address’ (default: #F)
          IP address on which ‘webssh’ listens for incoming connections.

     ‘port’ (padrão: 8888)
          TCP port on which ‘webssh’ listens for incoming connections.

     ‘policy’ (default: #F)
          Connection policy. REJECT policy requires to specify
          KNOWN-HOSTS.

     ‘known-hosts’ (default: ’())
          List of hosts which allowed for SSH connection from ‘webssh’.

     ‘log-file’ (default: ‘"/var/log/webssh.log"’)
          Name of the file where ‘webssh’ writes its log file.

     ‘log-level’ (default: #F)
          Logging level.

 -- Variável: block-facebook-hosts-service-type
     This service type adds a list of known Facebook hosts to the
     ‘/etc/hosts’ file. (*note (libc)Host Names::) Each line contains an
     entry that maps a known server name of the Facebook on-line
     service—e.g., ‘www.facebook.com’—to unroutable IPv4 and IPv6
     addresses.

     This mechanism can prevent programs running locally, such as Web
     browsers, from accessing Facebook.

   The ‘(gnu services avahi)’ provides the following definition.

 -- Variável: avahi-service-type
     This is the service that runs ‘avahi-daemon’, a system-wide
     mDNS/DNS-SD responder that allows for service discovery and
     “zero-configuration” host name lookups (see <https://avahi.org/>).
     Its value must be an ‘avahi-configuration’ record—see below.

     This service extends the name service cache daemon (nscd) so that
     it can resolve ‘.local’ host names using nss-mdns
     (https://0pointer.de/lennart/projects/nss-mdns/). *Note Name
     Service Switch::, for information on host name resolution.

     Additionally, add the AVAHI package to the system profile so that
     commands such as ‘avahi-browse’ are directly usable.

 -- Tipo de dados: avahi-configuration
     Data type representation the configuration for Avahi.

     ‘host-name’ (padrão: ‘#f’)
          If different from ‘#f’, use that as the host name to publish
          for this machine; otherwise, use the machine’s actual host
          name.

     ‘publish?’ (padrão: ‘#t’)
          When true, allow host names and services to be published
          (broadcast) over the network.

     ‘publish-workstation?’ (padrão: ‘#t’)
          When true, ‘avahi-daemon’ publishes the machine’s host name
          and IP address via mDNS on the local network. To view the host
          names published on your local network, you can run:

               avahi-browse _workstation._tcp

     ‘wide-area?’ (padrão: ‘#f’)
          When true, DNS-SD over unicast DNS is enabled.

     ‘ipv4?’ (default: ‘#t’)
     ‘ipv6?’ (default: ‘#t’)
          These fields determine whether to use IPv4/IPv6 sockets.

     ‘domains-to-browse’ (default: ‘'()’)
          This is a list of domains to browse.

 -- Variável: openvswitch-service-type
     This is the type of the Open vSwitch (https://www.openvswitch.org)
     service, whose value should be an ‘openvswitch-configuration’
     object.

 -- Tipo de dados: openvswitch-configuration
     Data type representing the configuration of Open vSwitch, a
     multilayer virtual switch which is designed to enable massive
     network automation through programmatic extension.

     ‘package’ (default: OPENVSWITCH)
          Package object of the Open vSwitch.

 -- Variável: pagekite-service-type
     This is the service type for the PageKite (https://pagekite.net)
     service, a tunneling solution for making localhost servers publicly
     visible, even from behind restrictive firewalls or NAT without
     forwarded ports. The value for this service type is a
     ‘pagekite-configuration’ record.

     Here’s an example exposing the local HTTP and SSH daemons:

          (service pagekite-service-type
                   (pagekite-configuration
                     (kites '("http:@kitename:localhost:80:@kitesecret"
                              "raw/22:@kitename:localhost:22:@kitesecret"))
                     (extra-file "/etc/pagekite.rc")))

 -- Tipo de dados: pagekite-configuration
     Data type representing the configuration of PageKite.

     ‘package’ (default: PAGEKITE)
          Package object of PageKite.

     ‘kitename’ (default: ‘#f’)
          PageKite name for authenticating to the frontend server.

     ‘kitesecret’ (default: ‘#f’)
          Shared secret for authenticating to the frontend server. You
          should probably put this inside ‘extra-file’ instead.

     ‘frontend’ (default: ‘#f’)
          Connect to the named PageKite frontend server instead of the
          pagekite.net service.

     ‘kites’ (default: ‘'("http:@kitename:localhost:80:@kitesecret")’)
          List of service kites to use. Exposes HTTP on port 80 by
          default. The format is ‘proto:kitename:host:port:secret’.

     ‘extra-file’ (default: ‘#f’)
          Extra configuration file to read, which you are expected to
          create manually. Use this to add additional options and manage
          shared secrets out-of-band.

 -- Variável: yggdrasil-service-type
     The service type for connecting to the Yggdrasil network
     (https://yggdrasil-network.github.io/), an early-stage
     implementation of a fully end-to-end encrypted IPv6 network.

          Yggdrasil provides name-independent routing with
          cryptographically generated addresses. Static addressing means
          you can keep the same address as long as you want, even if you
          move to a new location, or generate a new address (by
          generating new keys) whenever you want.
          <https://yggdrasil-network.github.io/2018/07/28/addressing.html>

     Pass it a value of ‘yggdrasil-configuration’ to connect it to
     public peers and/or local peers.

     Here is an example using public peers and a static address. The
     static signing and encryption keys are defined in
     ‘/etc/yggdrasil-private.conf’ (the default value for
     ‘config-file’).

          ;; part of the operating-system declaration
          (service yggdrasil-service-type
                        (yggdrasil-configuration
                         (autoconf? #f) ;; use only the public peers
                         (json-config
                         ;; choose one from
                         ;; https://github.com/yggdrasil-network/public-peers
                          '((peers . #("tcp://1.2.3.4:1337"))))
                         ;; /etc/yggdrasil-private.conf is the default value for config-file
                         ))
          # sample content for /etc/yggdrasil-private.conf
          {
            # Your private key. DO NOT share this with anyone!
            PrivateKey: 5c750...
          }

 -- Tipo de dados: yggdrasil-configuration
     Data type representing the configuration of Yggdrasil.

     ‘package’ (default: ‘yggdrasil’)
          Package object of Yggdrasil.

     ‘json-config’ (default: ‘'()’)
          Contents of ‘/etc/yggdrasil.conf’. Will be merged with
          ‘/etc/yggdrasil-private.conf’. Note that these settings are
          stored in the Guix store, which is readable to all users. *Do
          not store your private keys in it*. See the output of
          ‘yggdrasil -genconf’ for a quick overview of valid keys and
          their default values.

     ‘autoconf?’ (default: ‘#f’)
          Whether to use automatic mode. Enabling it makes Yggdrasil use
          a dynamic IP and peer with IPv6 neighbors.

     ‘log-level’ (default: ‘'info’)
          How much detail to include in logs. Use ‘'debug’ for more
          detail.

     ‘log-to’ (default: ‘'stdout’)
          Where to send logs. By default, the service logs standard
          output to ‘/var/log/yggdrasil.log’. The alternative is
          ‘'syslog’, which sends output to the running syslog service.

     ‘config-file’ (default: ‘"/etc/yggdrasil-private.conf"’)
          What HJSON file to load sensitive data from. This is where
          private keys should be stored, which are necessary to specify
          if you don’t want a randomized address after each restart. Use
          ‘#f’ to disable. Options defined in this file take precedence
          over ‘json-config’. Use the output of ‘yggdrasil -genconf’ as
          a starting point. To configure a static address, delete
          everything except PrivateKey option.

 -- Variável: ipfs-service-type
     The service type for connecting to the IPFS network
     (https://ipfs.io), a global, versioned, peer-to-peer file system.
     Pass it a ‘ipfs-configuration’ to change the ports used for the
     gateway and API.

     Here’s an example configuration, using some non-standard ports:

          (service ipfs-service-type
                   (ipfs-configuration
                    (gateway "/ip4/127.0.0.1/tcp/8880")
                    (api "/ip4/127.0.0.1/tcp/8881")))

 -- Tipo de dados: ipfs-configuration
     Data type representing the configuration of IPFS.

     ‘package’ (default: ‘go-ipfs’)
          Package object of IPFS.

     ‘gateway’ (default: ‘"/ip4/127.0.0.1/tcp/8082"’)
          Address of the gateway, in ‘multiaddress’ format.

     ‘api’ (default: ‘"/ip4/127.0.0.1/tcp/5001"’)
          Address of the API endpoint, in ‘multiaddress’ format.

 -- Variável: keepalived-service-type
     This is the type for the Keepalived (https://www.keepalived.org/)
     routing software, ‘keepalived’. Its value must be an
     ‘keepalived-configuration’ record as in this example for master
     machine:

          (service keepalived-service-type
                   (keepalived-configuration
                     (config-file (local-file "keepalived-master.conf"))))

     where ‘keepalived-master.conf’:

          vrrp_instance my-group {
            state MASTER
            interface enp9s0
            virtual_router_id 100
            priority 100
            unicast_peer { 10.0.0.2 }
            virtual_ipaddress {
              10.0.0.4/24
            }
          }

     and for backup machine:

          (service keepalived-service-type
                   (keepalived-configuration
                    (config-file (local-file "keepalived-backup.conf"))))

     where ‘keepalived-backup.conf’:

          vrrp_instance my-group {
            state BACKUP
            interface enp9s0
            virtual_router_id 100
            priority 99
            unicast_peer { 10.0.0.3 }
            virtual_ipaddress {
              10.0.0.4/24
            }
          }


File: guix.pt_BR.info,  Node: Atualizações sem supervisão,  Next: X Window,  Prev: Serviços de Rede,  Up: Serviços

11.10.6 Atualizações sem supervisão
-----------------------------------

The ‘(gnu services admin)’ module provides a service to perform
_unattended upgrades_: periodically, the system automatically
reconfigures itself from the latest Guix. Guix System has several
properties that make unattended upgrades safe:

   • upgrades are transactional (either the upgrade succeeds or it
     fails, but you cannot end up with an “in-between” system state);
   • the upgrade log is kept—you can view it with ‘guix system
     list-generations’—and you can roll back to any previous generation,
     should the upgraded system fail to behave as intended;
   • channel code is authenticated so you know you can only run genuine
     code (*note Canais::);
   • ‘guix system reconfigure’ prevents downgrades, which makes it
     immune to “downgrade attacks”.

   To set up unattended upgrades, add an instance of
‘unattended-upgrade-service-type’ like the one below to the list of your
operating system services:

     (service unattended-upgrade-service-type)

   The defaults above set up weekly upgrades: every Sunday at midnight.
You do not need to provide the operating system configuration file: it
uses ‘/run/current-system/configuration.scm’, which ensures it always
uses your latest configuration—*note provenance-service-type::, for more
information about this file.

   There are several things that can be configured, in particular the
periodicity and services (daemons) to be restarted upon completion. When
the upgrade is successful, the service takes care of deleting system
generations older that some threshold, as per ‘guix system
delete-generations’. See the reference below for details.

   To ensure that upgrades are actually happening, you can run ‘guix
system describe’. To investigate upgrade failures, visit the unattended
upgrade log file (see below).

 -- Variável: unattended-upgrade-service-type
     This is the service type for unattended upgrades. It sets up a
     Shepherd Timer (*note Execução de trabalho agendado::) that runs
     ‘guix system reconfigure’ from the latest version of the specified
     channels.

     Its value must be a ‘unattended-upgrade-configuration’ record (see
     below).

 -- Tipo de dados: unattended-upgrade-configuration
     This data type represents the configuration of the unattended
     upgrade service. The following fields are available:

     ‘schedule’ (default: ‘"30 01 * * 0"’)
          This is the schedule of upgrades, expressed as a string in
          traditional cron syntax or as a gexp evaluating to a Shepherd
          calendar event (*note (shepherd)Timers::).

     ‘channels’ (default: ‘#~%default-channels’)
          This gexp specifies the channels to use for the upgrade (*note
          Canais::). By default, the tip of the official ‘guix’ channel
          is used.

     ‘operating-system-file’ (default: ‘"/run/current-system/configuration.scm"’)
          This field specifies the operating system configuration file
          to use. The default is to reuse the config file of the current
          configuration.

          There are cases, though, where referring to
          ‘/run/current-system/configuration.scm’ is not enough, for
          instance because that file refers to extra files (SSH public
          keys, extra configuration files, etc.) via ‘local-file’ and
          similar constructs. For those cases, we recommend something
          along these lines:

               (unattended-upgrade-configuration
                 (operating-system-file
                   (file-append (local-file "." "config-dir" #:recursive? #t)
                                "/config.scm")))

          The effect here is to import all of the current directory into
          the store, and to refer to ‘config.scm’ within that directory.
          Therefore, uses of ‘local-file’ within ‘config.scm’ will work
          as expected. *Note Expressões-G::, for information about
          ‘local-file’ and ‘file-append’.

     ‘operating-system-expression’ (default: ‘#f’)
          This field specifies an expression that evaluates to the
          operating system to use for the upgrade. If no value is
          provided the ‘operating-system-file’ field value is used.

               (unattended-upgrade-configuration
                 (operating-system-expression
                   #~(@ (guix system install) installation-os)))

     ‘reboot?’ (default: ‘#f’)
          This field specifies whether the system should reboot after
          completing an unattended upgrade.

          When ‘reboot?’ is ‘#t’, services are not restarted before
          rebooting. This means that the value for ‘services-to-restart’
          is ignored. The updated services will be started after the
          system reboots.

     ‘services-to-restart’ (default: ‘'(unattended-upgrade)’)
          This field specifies the Shepherd services to restart when the
          upgrade completes.

          Those services are restarted right away upon completion, as
          with ‘herd restart’, which ensures that the latest version is
          running—remember that by default ‘guix system reconfigure’
          only restarts services that are not currently running, which
          is conservative: it minimizes disruption but leaves outdated
          services running.

          Use ‘herd status’ to find out candidates for restarting. *Note
          Serviços::, for general information about services. Common
          services to restart would include ‘ntpd’ and ‘ssh-daemon’.

          By default, the ‘unattended-upgrade’ service is restarted.
          This ensures that the latest version of the unattended upgrade
          job will be used next time.

     ‘system-expiration’ (default: ‘(* 3 30 24 3600)’)
          This is the expiration time in seconds for system generations.
          System generations older that this amount of time are deleted
          with ‘guix system delete-generations’ when an upgrade
          completes.

               Nota: The unattended upgrade service does not run the
               garbage collector. You will probably want to set up your
               own mcron job to run ‘guix gc’ periodically.

     ‘maximum-duration’ (default: ‘3600’)
          Maximum duration in seconds for the upgrade; past that time,
          the upgrade aborts.

          This is primarily useful to ensure the upgrade does not end up
          rebuilding or re-downloading “the world”.

     ‘log-file’ (default: ‘"/var/log/unattended-upgrade.log"’)
          File where unattended upgrades are logged.


File: guix.pt_BR.info,  Node: X Window,  Next: Serviços de impressão,  Prev: Atualizações sem supervisão,  Up: Serviços

11.10.7 X Window
----------------

Support for the X Window graphical display system—specifically Xorg—is
provided by the ‘(gnu services xorg)’ module. Note that there is no
‘xorg-service’ procedure. Instead, the X server is started by the “login
manager”, by default the GNOME Display Manager (GDM).

   GDM of course allows users to log in into window managers and desktop
environments other than GNOME; for those using GNOME, GDM is required
for features such as automatic screen locking.

   To use X11, you must install at least one “window manager”—for
example the ‘windowmaker’ or ‘openbox’ packages—preferably by adding it
to the ‘packages’ field of your operating system definition (*note
system-wide packages: Referência do operating-system.).

   GDM also supports Wayland: it can itself use Wayland instead of X11
for its user interface, and it can also start Wayland sessions. Wayland
support is enabled by default. To disable it, set ‘wayland?’ to ‘#f’ in
‘gdm-configuration’.

 -- Variável: gdm-service-type
     This is the type for the GNOME Desktop Manager
     (https://wiki.gnome.org/Projects/GDM/) (GDM), a program that
     manages graphical display servers and handles graphical user
     logins. Its value must be a ‘gdm-configuration’ (see below).

     GDM looks for “session types” described by the ‘.desktop’ files in
     ‘/run/current-system/profile/share/xsessions’ (for X11 sessions)
     and ‘/run/current-system/profile/share/wayland-sessions’ (for
     Wayland sessions) and allows users to choose a session from the
     log-in screen. Packages such as ‘gnome’, ‘xfce’, ‘i3’ and ‘sway’
     provide ‘.desktop’ files; adding them to the system-wide set of
     packages automatically makes them available at the log-in screen.

     In addition, ‘~/.xsession’ files are honored. When available,
     ‘~/.xsession’ must be an executable that starts a window manager
     and/or other X clients.

 -- Tipo de dados: gdm-configuration
     ‘auto-login?’ (default: ‘#f’)
     ‘default-user’ (default: ‘#f’)
          When ‘auto-login?’ is false, GDM presents a log-in screen.

          When ‘auto-login?’ is true, GDM logs in directly as
          ‘default-user’.

     ‘auto-suspend?’ (default ‘#t’)
          When true, GDM will automatically suspend to RAM when nobody
          is physically connected. When a machine is used via remote
          desktop or SSH, this should be set to false to avoid GDM
          interrupting remote sessions or rendering the machine
          unavailable.

     ‘debug?’ (default: ‘#f’)
          When true, GDM writes debug messages to its log.

     ‘gnome-shell-assets’ (default: ...)
          List of GNOME Shell assets needed by GDM: icon theme, fonts,
          etc.

     ‘xorg-configuration’ (default: ‘(xorg-configuration)’)
          Configuration of the Xorg graphical server.

     ‘x-session’ (default: ‘(xinitrc)’)
          Script to run before starting a X session.

     ‘xdmcp?’ (default: ‘#f’)
          When true, enable the X Display Manager Control Protocol
          (XDMCP). This should only be enabled in trusted environments,
          as the protocol is not secure. When enabled, GDM listens for
          XDMCP queries on the UDP port 177.

     ‘dbus-daemon’ (default: ‘dbus-daemon-wrapper’)
          File name of the ‘dbus-daemon’ executable.

     ‘gdm’ (default: ‘gdm’)
          The GDM package to use.

     ‘wayland?’ (default: ‘#t’)
          When true, enables Wayland in GDM, necessary to use Wayland
          sessions.

     ‘wayland-session’ (default: ‘gdm-wayland-session-wrapper’)
          The Wayland session wrapper to use, needed to setup the
          environment.

 -- Variável: slim-service-type
     This is the type for the SLiM graphical login manager for X11.

     Like GDM, SLiM looks for session types described by ‘.desktop’
     files and allows users to choose a session from the log-in screen
     using ‘F1’. It also honors ‘~/.xsession’ files.

     Unlike GDM, SLiM does not spawn the user session on a different VT
     after logging in, which means that you can only start one graphical
     session. If you want to be able to run multiple graphical sessions
     at the same time you have to add multiple SLiM services to your
     system services. The following example shows how to replace the
     default GDM service with two SLiM services on tty7 and tty8.

          (use-modules (gnu services)
                       (gnu services desktop)
                       (gnu services xorg))

          (operating-system
            ;; ...
            (services (cons* (service slim-service-type (slim-configuration
                                                         (display ":0")
                                                         (vt "vt7")))
                             (service slim-service-type (slim-configuration
                                                         (display ":1")
                                                         (vt "vt8")))
                             (modify-services %desktop-services
                               (delete gdm-service-type)))))

 -- Tipo de dados: slim-configuration
     Data type representing the configuration of ‘slim-service-type’.

     ‘allow-empty-passwords?’ (default: ‘#t’)
          Whether to allow logins with empty passwords.

     ‘gnupg?’ (default: ‘#f’)
          If enabled, ‘pam-gnupg’ will attempt to automatically unlock
          the user’s GPG keys with the login password via ‘gpg-agent’.
          The keygrips of all keys to be unlocked should be written to
          ‘~/.pam-gnupg’, and can be queried with ‘gpg -K
          --with-keygrip’. Presetting passphrases must be enabled by
          adding ‘allow-preset-passphrase’ in ‘~/.gnupg/gpg-agent.conf’.

     ‘auto-login?’ (default: ‘#f’)
     ‘default-user’ (default: ‘""’)
          When ‘auto-login?’ is false, SLiM presents a log-in screen.

          When ‘auto-login?’ is true, SLiM logs in directly as
          ‘default-user’.

     ‘theme’ (default: ‘%default-slim-theme’)
     ‘theme-name’ (default: ‘%default-slim-theme-name’)
          The graphical theme to use and its name.

     ‘auto-login-session’ (default: ‘#f’)
          If true, this must be the name of the executable to start as
          the default session—e.g., ‘(file-append windowmaker
          "/bin/windowmaker")’.

          If false, a session described by one of the available
          ‘.desktop’ files in ‘/run/current-system/profile’ and
          ‘~/.guix-profile’ will be used.

               Nota: You must install at least one window manager in the
               system profile or in your user profile. Failing to do
               that, if ‘auto-login-session’ is false, you will be
               unable to log in.

     ‘xorg-configuration’ (default ‘(xorg-configuration)’)
          Configuration of the Xorg graphical server.

     ‘display’ (default ‘":0"’)
          The display on which to start the Xorg graphical server.

     ‘vt’ (default ‘"vt7"’)
          The VT on which to start the Xorg graphical server.

     ‘xauth’ (default: ‘xauth’)
          The XAuth package to use.

     ‘shepherd’ (default: ‘shepherd’)
          The Shepherd package used when invoking ‘halt’ and ‘reboot’.

     ‘sessreg’ (default: ‘sessreg’)
          The sessreg package used in order to register the session.

     ‘slim’ (default: ‘slim’)
          The SLiM package to use.

 -- Variável: %default-theme
 -- Variável: %default-theme-name
     The default SLiM theme and its name.

 -- Variável: sddm-service-type
     This is the type of the service to run the SDDM display manager
     (https://github.com/sddm/sddm). Its value must be a
     ‘sddm-configuration’ record (see below).

     Here’s an example use:

          (service sddm-service-type
                   (sddm-configuration
                     (auto-login-user "alice")
                     (auto-login-session "xfce.desktop")))

 -- Tipo de dados: sddm-configuration
     This data type represents the configuration of the SDDM login
     manager. The available fields are:

     ‘sddm’ (default: ‘sddm’)
          The SDDM package to use.

               Nota: sddm has Qt6 enabled by default. If you want to
               still use a Qt5 theme, you need to set it to ‘sddm-qt5’.

     ‘display-server’ (default: "x11")
          Select display server to use for the greeter. Valid values are
          ‘"x11"’ or ‘"wayland"’.

     ‘numlock’ (default: "on")
          Valid values are ‘"on"’, ‘"off"’ or ‘"none"’.

     ‘halt-command’ (default ‘#~(string-append #$shepherd "/sbin/halt")’)
          Command to run when halting.

     ‘reboot-command’ (default ‘#~(string-append #$shepherd "/sbin/reboot")’)
          Command to run when rebooting.

     ‘theme’ (default "maldives")
          Theme to use. Default themes provided by SDDM are ‘"elarun"’,
          ‘"maldives"’ or ‘"maya"’.

     ‘themes-directory’ (default "/run/current-system/profile/share/sddm/themes")
          Directory to look for themes.

     ‘faces-directory’ (default "/run/current-system/profile/share/sddm/faces")
          Directory to look for faces.

     ‘default-path’ (default "/run/current-system/profile/bin")
          Default PATH to use.

     ‘minimum-uid’ (default: 1000)
          Minimum UID displayed in SDDM and allowed for log-in.

     ‘maximum-uid’ (default: 2000)
          Maximum UID to display in SDDM.

     ‘remember-last-user?’ (default #t)
          Remember last user.

     ‘remember-last-session?’ (default #t)
          Remember last session.

     ‘hide-users’ (default "")
          Usernames to hide from SDDM greeter.

     ‘hide-shells’ (default ‘#~(string-append #$shadow "/sbin/nologin")’)
          Users with shells listed will be hidden from the SDDM greeter.

     ‘session-command’ (default ‘#~(string-append #$sddm "/share/sddm/scripts/wayland-session")’)
          Script to run before starting a wayland session.

     ‘sessions-directory’ (default "/run/current-system/profile/share/wayland-sessions")
          Directory to look for desktop files starting wayland sessions.

     ‘xorg-configuration’ (default ‘(xorg-configuration)’)
          Configuration of the Xorg graphical server.

     ‘xauth-path’ (default ‘#~(string-append #$xauth "/bin/xauth")’)
          Path to xauth.

     ‘xephyr-path’ (default ‘#~(string-append #$xorg-server "/bin/Xephyr")’)
          Path to Xephyr.

     ‘xdisplay-start’ (default ‘#~(string-append #$sddm "/share/sddm/scripts/Xsetup")’)
          Script to run after starting xorg-server.

     ‘xdisplay-stop’ (default ‘#~(string-append #$sddm "/share/sddm/scripts/Xstop")’)
          Script to run before stopping xorg-server.

     ‘xsession-command’ (default: ‘xinitrc’)
          Script to run before starting a X session.

     ‘xsessions-directory’ (default: "/run/current-system/profile/share/xsessions")
          Directory to look for desktop files starting X sessions.

     ‘minimum-vt’ (default: 7)
          Minimum VT to use.

     ‘auto-login-user’ (default "")
          User account that will be automatically logged in. Setting
          this to the empty string disables auto-login.

     ‘auto-login-session’ (default "")
          The ‘.desktop’ file name to use as the auto-login session, or
          the empty string.

     ‘relogin?’ (default #f)
          Relogin after logout.

 -- Variável: lightdm-service-type
     This is the type of the service to run the LightDM display manager
     (https://github.com/canonical/lightdm). Its value must be a
     ‘lightdm-configuration’ record, which is documented below. Among
     its distinguishing features are TigerVNC integration for easily
     remoting your desktop as well as support for the XDMCP protocol,
     which can be used by remote clients to start a session from the
     login manager.

     In its most basic form, it can be used simply as:

          (service lightdm-service-type)

     A more elaborate example making use of the VNC capabilities and
     enabling more features and verbose logs could look like:

          (service lightdm-service-type
                   (lightdm-configuration
                    (allow-empty-passwords? #t)
                    (xdmcp? #t)
                    (vnc-server? #t)
                    (vnc-server-command
                     (file-append tigervnc-server "/bin/Xvnc"
                                  "  -SecurityTypes None"))
                    (seats
                     (list (lightdm-seat-configuration
                            (name "*")
                            (user-session "ratpoison"))))))

 -- Tipo de dados: lightdm-configuration
     Available ‘lightdm-configuration’ fields are:

     ‘lightdm’ (default: ‘lightdm’) (type: file-like)
          The lightdm package to use.

     ‘allow-empty-passwords?’ (default: ‘#f’) (type: boolean)
          Whether users not having a password set can login.

     ‘debug?’ (default: ‘#f’) (type: boolean)
          Enable verbose output.

     ‘xorg-configuration’ (type: xorg-configuration)
          The default Xorg server configuration to use to generate the
          Xorg server start script. It can be refined per seat via the
          ‘xserver-command’ of the ‘<lightdm-seat-configuration>’
          record, if desired.

     ‘greeters’ (type: list-of-greeter-configurations)
          The LightDM greeter configurations specifying the greeters to
          use.

     ‘seats’ (type: list-of-seat-configurations)
          The seat configurations to use. A LightDM seat is akin to a
          user.

     ‘xdmcp?’ (default: ‘#f’) (type: boolean)
          Whether a XDMCP server should listen on port UDP 177.

     ‘xdmcp-listen-address’ (type: maybe-string)
          The host or IP address the XDMCP server listens for incoming
          connections. When unspecified, listen on for any hosts/IP
          addresses.

     ‘vnc-server?’ (default: ‘#f’) (type: boolean)
          Whether a VNC server is started.

     ‘vnc-server-command’ (type: file-like)
          The Xvnc command to use for the VNC server, it’s possible to
          provide extra options not otherwise exposed along the command,
          for example to disable security:

               (vnc-server-command (file-append tigervnc-server "/bin/Xvnc"
                                                " -SecurityTypes None" ))

          Or to set a PasswordFile for the classic (unsecure) VncAuth
          mechanism:

               (vnc-server-command (file-append tigervnc-server "/bin/Xvnc"
                                                " -PasswordFile /var/lib/lightdm/.vnc/passwd"))

          The password file should be manually created using the
          ‘vncpasswd’ command. Note that LightDM will create new
          sessions for VNC users, which means they need to authenticate
          in the same way as local users would.

     ‘vnc-server-listen-address’ (type: maybe-string)
          The host or IP address the VNC server listens for incoming
          connections. When unspecified, listen for any hosts/IP
          addresses.

     ‘vnc-server-port’ (default: ‘5900’) (type: number)
          The TCP port the VNC server should listen to.

     ‘extra-config’ (default: ‘'()’) (type: list-of-strings)
          Extra configuration values to append to the LightDM
          configuration file.

 -- Tipo de dados: lightdm-gtk-greeter-configuration
     Available ‘lightdm-gtk-greeter-configuration’ fields are:

     ‘lightdm-gtk-greeter’ (default: ‘lightdm-gtk-greeter’) (type: file-like)
          The lightdm-gtk-greeter package to use.

     ‘assets’ (default: ‘(adwaita-icon-theme gnome-themes-extra hicolor-icon-theme)’) (type: list-of-file-likes)
          The list of packages complementing the greeter, such as
          package providing icon themes.

     ‘theme-name’ (default: ‘"Adwaita"’) (type: string)
          The name of the theme to use.

     ‘icon-theme-name’ (default: ‘"Adwaita"’) (type: string)
          The name of the icon theme to use.

     ‘cursor-theme-name’ (default: ‘"Adwaita"’) (type: string)
          The name of the cursor theme to use.

     ‘cursor-theme-size’ (default: ‘16’) (type: number)
          The size to use for the cursor theme.

     ‘allow-debugging?’ (type: maybe-boolean)
          Set to #t to enable debug log level.

     ‘background’ (type: file-like)
          The background image to use.

     ‘at-spi-enabled?’ (default: ‘#f’) (type: boolean)
          Enable accessibility support through the Assistive Technology
          Service Provider Interface (AT-SPI).

     ‘a11y-states’ (default: ‘(contrast font keyboard reader)’) (type: list-of-a11y-states)
          The accessibility features to enable, given as list of
          symbols.

     ‘reader’ (type: maybe-file-like)
          The command to use to launch a screen reader.

     ‘extra-config’ (default: ‘'()’) (type: list-of-strings)
          Extra configuration values to append to the LightDM GTK
          Greeter configuration file.

 -- Tipo de dados: lightdm-seat-configuration
     Available ‘lightdm-seat-configuration’ fields are:

     ‘name’ (type: seat-name)
          The name of the seat. An asterisk (*) can be used in the name
          to apply the seat configuration to all the seat names it
          matches.

     ‘user-session’ (type: maybe-string)
          The session to use by default. The session name must be
          provided as a lowercase string, such as ‘"gnome"’,
          ‘"ratpoison"’, etc.

     ‘type’ (default: ‘local’) (type: seat-type)
          The type of the seat, either the ‘local’ or ‘xremote’ symbol.

     ‘autologin-user’ (type: maybe-string)
          The username to automatically log in with by default.

     ‘greeter-session’ (default: ‘lightdm-gtk-greeter’) (type: greeter-session)
          The greeter session to use, specified as a symbol. Currently,
          only ‘lightdm-gtk-greeter’ is supported.

     ‘xserver-command’ (type: maybe-file-like)
          The Xorg server command to run.

     ‘session-wrapper’ (type: file-like)
          The xinitrc session wrapper to use.

     ‘extra-config’ (default: ‘'()’) (type: list-of-strings)
          Extra configuration values to append to the seat configuration
          section.

 -- Tipo de dados: xorg-configuration
     This data type represents the configuration of the Xorg graphical
     display server. Note that there is no Xorg service; instead, the X
     server is started by a “display manager” such as GDM, SDDM, LightDM
     or SLiM. Thus, the configuration of these display managers
     aggregates an ‘xorg-configuration’ record.

     ‘modules’ (default: ‘%default-xorg-modules’)
          This is a list of “module packages” loaded by the Xorg
          server—e.g., ‘xf86-video-vesa’, ‘xf86-input-libinput’, and so
          on.

     ‘fonts’ (default: ‘%default-xorg-fonts’)
          This is a list of font directories to add to the server’s
          “font path”.

     ‘drivers’ (default: ‘'()’)
          This must be either the empty list, in which case Xorg chooses
          a graphics driver automatically, or a list of driver names
          that will be tried in this order—e.g., ‘'("modesetting"
          "vesa")’.

     ‘resolutions’ (default: ‘'()’)
          When ‘resolutions’ is the empty list, Xorg chooses an
          appropriate screen resolution. Otherwise, it must be a list of
          resolutions—e.g., ‘'((1024 768) (640 480))’.

     ‘keyboard-layout’ (padrão: ‘#f’)
          If this is ‘#f’, Xorg uses the default keyboard layout—usually
          US English (“qwerty”) for a 105-key PC keyboard.

          Otherwise this must be a ‘keyboard-layout’ object specifying
          the keyboard layout in use when Xorg is running. *Note
          Disposição do teclado::, for more information on how to
          specify the keyboard layout.

     ‘extra-config’ (default: ‘'()’)
          This is a list of strings or objects appended to the
          configuration file. It is used to pass extra text to be added
          verbatim to the configuration file.

     ‘server’ (default: ‘xorg-server’)
          This is the package providing the Xorg server.

     ‘server-arguments’ (default: ‘%default-xorg-server-arguments’)
          This is the list of command-line arguments to pass to the X
          server. The default is ‘-nolisten tcp’.

 -- Procedure: set-xorg-configuration config
          [login-manager-service-type]
     Tell the log-in manager (of type LOGIN-MANAGER-SERVICE-TYPE) to use
     CONFIG, an ‘<xorg-configuration>’ record.

     Since the Xorg configuration is embedded in the log-in manager’s
     configuration—e.g., ‘gdm-configuration’—this procedure provides a
     shorthand to set the Xorg configuration.

 -- Procedure: xorg-start-command [config]
     Return a ‘startx’ script in which the modules, fonts, etc.
     specified in CONFIG, are available. The result should be used in
     place of ‘startx’.

     Usually the X server is started by a login manager.

 -- Procedure: xorg-start-command-xinit [config]
     Return a ‘startx’ script in which the modules, fonts, etc.
     specified in CONFIG are available. The result should be used in
     place of ‘startx’ and should be invoked by the user from a tty
     after login. Unlike ‘xorg-start-command’, this script calls xinit.
     Therefore it works well when executed from a tty. This script can
     be set up as ‘startx’ using ‘startx-command-service-type’ or
     ‘home-startx-command-service-type’. If you are using a desktop
     environment, you are unlikely to need this procedure.

 -- Variável: screen-locker-service-type
     Type for a service that adds a package for a screen locker or
     screen saver to the set of privileged programs and/or add a PAM
     entry for it. The value for this service is a
     ‘<screen-locker-configuration>’ object.

     While the default behavior is to setup both a privileged program
     and PAM entry, these two methods are redundant. Screen locker
     programs may not execute when PAM is configured and ‘setuid’ is set
     on their executable. In this case, ‘using-setuid?’ can be set to
     ‘#f’.

     For example, to make XlockMore usable:

          (service screen-locker-service-type
                   (screen-locker-configuration
                     (name "xlock")
                     (program (file-append xlockmore "/bin/xlock"))))

     makes the good ol’ XlockMore usable.

     For example, swaylock fails to execute when compiled with PAM
     support and setuid enabled. One can thus disable setuid:

          (service screen-locker-service-type
                   (screen-locker-configuration
                     (name "swaylock")
                     (program (file-append swaylock "/bin/swaylock"))
                     (using-pam? #t)
                     (using-setuid? #f)))

 -- Tipo de dados: screen-locker-configuration
     Available ‘screen-locker-configuration’ fields are:

     ‘name’ (type: string)
          Name of the screen locker.

     ‘program’ (type: file-like)
          Path to the executable for the screen locker as a
          G-Expression.

     ‘allow-empty-password?’ (default: ‘#f’) (type: boolean)
          Whether to allow empty passwords.

     ‘using-pam?’ (default: ‘#t’) (type: boolean)
          Whether to setup PAM entry.

     ‘using-setuid?’ (default: ‘#t’) (type: boolean)
          Whether to setup program as setuid binary.

 -- Variável: startx-command-service-type
     Add ‘startx’ to the system profile putting it onto ‘PATH’.

     The value for this service is a ‘<xorg-configuration>’ object which
     is passed to the ‘xorg-start-command-xinit’ procedure producing the
     ‘startx’ used. Default value is ‘(xorg-configuration)’.


File: guix.pt_BR.info,  Node: Serviços de impressão,  Next: Serviços de desktop,  Prev: X Window,  Up: Serviços

11.10.8 Serviços de impressão
-----------------------------

The ‘(gnu services cups)’ module provides a Guix service definition for
the CUPS printing service. To add printer support to a Guix system, add
a ‘cups-service’ to the operating system definition:

 -- Variável: cups-service-type
     The service type for the CUPS print server. Its value should be a
     valid CUPS configuration (see below). To use the default settings,
     simply write:
          (service cups-service-type)

   The CUPS configuration controls the basic things about your CUPS
installation: what interfaces it listens on, what to do if a print job
fails, how much logging to do, and so on. To actually add a printer, you
have to visit the <http://localhost:631> URL, or use a tool such as
GNOME’s printer configuration services. By default, configuring a CUPS
service will generate a self-signed certificate if needed, for secure
connections to the print server.

   Suppose you want to enable the Web interface of CUPS and also add
support for Epson printers via the ‘epson-inkjet-printer-escpr’ package
and for HP printers via the ‘hplip-minimal’ package. You can do that
directly, like this (you need to use the ‘(gnu packages cups)’ module):

     (service cups-service-type
              (cups-configuration
                (web-interface? #t)
                (extensions
                  (list cups-filters epson-inkjet-printer-escpr hplip-minimal))))

     Nota: If you wish to use the Qt5 based GUI which comes with the
     hplip package then it is suggested that you install the ‘hplip’
     package, either in your OS configuration file or as your user.

   The available configuration parameters follow. Each parameter
definition is preceded by its type; for example, ‘string-list foo’
indicates that the ‘foo’ parameter should be specified as a list of
strings. There is also a way to specify the configuration as a string,
if you have an old ‘cupsd.conf’ file that you want to port over from
some other system; see the end for more details.

   Available ‘cups-configuration’ fields are:

 -- cups-configuration parameter: package cups
     The CUPS package.

 -- cups-configuration parameter: package-list extensions (default:
          (list brlaser cups-filters epson-inkjet-printer-escpr
          foomatic-filters hplip-minimal splix))
     Drivers and other extensions to the CUPS package.

 -- cups-configuration parameter: files-configuration
          files-configuration
     Configuration of where to write logs, what directories to use for
     print spools, and related privileged configuration parameters.

     Available ‘files-configuration’ fields are:

      -- files-configuration parameter: log-location access-log
          Defines the access log filename. Specifying a blank filename
          disables access log generation. The value ‘stderr’ causes log
          entries to be sent to the standard error file when the
          scheduler is running in the foreground, or to the system log
          daemon when run in the background. The value ‘syslog’ causes
          log entries to be sent to the system log daemon. The server
          name may be included in filenames using the string ‘%s’, as in
          ‘/var/log/cups/%s-access_log’.

          Defaults to ‘"/var/log/cups/access_log"’.

      -- files-configuration parameter: file-name cache-dir
          Where CUPS should cache data.

          Defaults to ‘"/var/cache/cups"’.

      -- files-configuration parameter: string config-file-perm
          Specifies the permissions for all configuration files that the
          scheduler writes.

          Note that the permissions for the printers.conf file are
          currently masked to only allow access from the scheduler user
          (typically root). This is done because printer device URIs
          sometimes contain sensitive authentication information that
          should not be generally known on the system. There is no way
          to disable this security feature.

          Defaults to ‘"0640"’.

      -- files-configuration parameter: log-location error-log
          Defines the error log filename. Specifying a blank filename
          disables error log generation. The value ‘stderr’ causes log
          entries to be sent to the standard error file when the
          scheduler is running in the foreground, or to the system log
          daemon when run in the background. The value ‘syslog’ causes
          log entries to be sent to the system log daemon. The server
          name may be included in filenames using the string ‘%s’, as in
          ‘/var/log/cups/%s-error_log’.

          Defaults to ‘"/var/log/cups/error_log"’.

      -- files-configuration parameter: string fatal-errors
          Specifies which errors are fatal, causing the scheduler to
          exit. The kind strings are:

          ‘none’
               No errors are fatal.

          ‘all’
               All of the errors below are fatal.

          ‘browse’
               Browsing initialization errors are fatal, for example
               failed connections to the DNS-SD daemon.

          ‘config’
               Configuration file syntax errors are fatal.

          ‘listen’
               Listen or Port errors are fatal, except for IPv6 failures
               on the loopback or ‘any’ addresses.

          ‘log’
               Log file creation or write errors are fatal.

          ‘permissions’
               Bad startup file permissions are fatal, for example
               shared TLS certificate and key files with world-read
               permissions.

          Defaults to ‘"all -browse"’.

      -- files-configuration parameter: boolean file-device?
          Specifies whether the file pseudo-device can be used for new
          printer queues. The URI <file:///dev/null> is always allowed.

          Defaults to ‘#f’.

      -- files-configuration parameter: string group
          Specifies the group name or ID that will be used when
          executing external programs.

          Defaults to ‘"lp"’.

      -- files-configuration parameter: string log-file-group
          Specifies the group name or ID that will be used for log
          files.

          Defaults to ‘"lpadmin"’.

      -- files-configuration parameter: string log-file-perm
          Specifies the permissions for all log files that the scheduler
          writes.

          Defaults to ‘"0644"’.

      -- files-configuration parameter: log-location page-log
          Defines the page log filename. Specifying a blank filename
          disables page log generation. The value ‘stderr’ causes log
          entries to be sent to the standard error file when the
          scheduler is running in the foreground, or to the system log
          daemon when run in the background. The value ‘syslog’ causes
          log entries to be sent to the system log daemon. The server
          name may be included in filenames using the string ‘%s’, as in
          ‘/var/log/cups/%s-page_log’.

          Defaults to ‘"/var/log/cups/page_log"’.

      -- files-configuration parameter: string remote-root
          Specifies the username that is associated with unauthenticated
          accesses by clients claiming to be the root user. The default
          is ‘remroot’.

          Defaults to ‘"remroot"’.

      -- files-configuration parameter: file-name request-root
          Specifies the directory that contains print jobs and other
          HTTP request data.

          Defaults to ‘"/var/spool/cups"’.

      -- files-configuration parameter: sandboxing sandboxing
          Specifies the level of security sandboxing that is applied to
          print filters, backends, and other child processes of the
          scheduler; either ‘relaxed’ or ‘strict’. This directive is
          currently only used/supported on macOS.

          Defaults to ‘strict’.

      -- files-configuration parameter: file-name server-keychain
          Specifies the location of TLS certificates and private keys.
          CUPS will look for public and private keys in this directory:
          ‘.crt’ files for PEM-encoded certificates and corresponding
          ‘.key’ files for PEM-encoded private keys.

          Defaults to ‘"/etc/cups/ssl"’.

      -- files-configuration parameter: file-name server-root
          Specifies the directory containing the server configuration
          files.

          Defaults to ‘"/etc/cups"’.

      -- files-configuration parameter: boolean sync-on-close?
          Specifies whether the scheduler calls fsync(2) after writing
          configuration or state files.

          Defaults to ‘#f’.

      -- files-configuration parameter: space-separated-string-list
               system-group
          Specifies the group(s) to use for ‘@SYSTEM’ group
          authentication.

      -- files-configuration parameter: file-name temp-dir
          Specifies the directory where temporary files are stored.

          Defaults to ‘"/var/spool/cups/tmp"’.

      -- files-configuration parameter: string user
          Specifies the user name or ID that is used when running
          external programs.

          Defaults to ‘"lp"’.

      -- files-configuration parameter: string set-env
          Set the specified environment variable to be passed to child
          processes.

          Defaults to ‘"variable value"’.

 -- cups-configuration parameter: access-log-level access-log-level
     Specifies the logging level for the AccessLog file. The ‘config’
     level logs when printers and classes are added, deleted, or
     modified and when configuration files are accessed or updated. The
     ‘actions’ level logs when print jobs are submitted, held, released,
     modified, or canceled, and any of the conditions for ‘config’. The
     ‘all’ level logs all requests.

     Defaults to ‘actions’.

 -- cups-configuration parameter: boolean auto-purge-jobs?
     Specifies whether to purge job history data automatically when it
     is no longer required for quotas.

     Defaults to ‘#f’.

 -- cups-configuration parameter: comma-separated-string-list
          browse-dns-sd-sub-types
     Specifies a list of DNS-SD sub-types to advertise for each shared
     printer.

     The default ‘(list "_cups" "_print" "_universal")’ tells clients
     that CUPS sharing, IPP Everywhere, AirPrint, and Mopria are
     supported.

 -- cups-configuration parameter: browse-local-protocols
          browse-local-protocols
     Specifies which protocols to use for local printer sharing.

     Defaults to ‘dnssd’.

 -- cups-configuration parameter: boolean browse-web-if?
     Specifies whether the CUPS web interface is advertised.

     Defaults to ‘#f’.

 -- cups-configuration parameter: boolean browsing?
     Specifies whether shared printers are advertised.

     Defaults to ‘#f’.

 -- cups-configuration parameter: default-auth-type default-auth-type
     Specifies the default type of authentication to use.

     Defaults to ‘Basic’.

 -- cups-configuration parameter: default-encryption default-encryption
     Specifies whether encryption will be used for authenticated
     requests.

     Defaults to ‘Required’.

 -- cups-configuration parameter: string default-language
     Specifies the default language to use for text and web content.

     Defaults to ‘"en"’.

 -- cups-configuration parameter: string default-paper-size
     Specifies the default paper size for new print queues. ‘"Auto"’
     uses a locale-specific default, while ‘"None"’ specifies there is
     no default paper size. Specific size names are typically ‘"Letter"’
     or ‘"A4"’.

     Defaults to ‘"Auto"’.

 -- cups-configuration parameter: string default-policy
     Specifies the default access policy to use.

     Defaults to ‘"default"’.

 -- cups-configuration parameter: boolean default-shared?
     Specifies whether local printers are shared by default.

     Defaults to ‘#t’.

 -- cups-configuration parameter: non-negative-integer
          dirty-clean-interval
     Specifies the delay for updating of configuration and state files,
     in seconds. A value of 0 causes the update to happen as soon as
     possible, typically within a few milliseconds.

     Defaults to ‘30’.

 -- cups-configuration parameter: error-policy error-policy
     Specifies what to do when an error occurs. Possible values are
     ‘abort-job’, which will discard the failed print job; ‘retry-job’,
     which will retry the job at a later time; ‘retry-current-job’,
     which retries the failed job immediately; and ‘stop-printer’, which
     stops the printer.

     Defaults to ‘stop-printer’.

 -- cups-configuration parameter: non-negative-integer filter-limit
     Specifies the maximum cost of filters that are run concurrently,
     which can be used to minimize disk, memory, and CPU resource
     problems. A limit of 0 disables filter limiting. An average print
     to a non-PostScript printer needs a filter limit of about 200. A
     PostScript printer needs about half that (100). Setting the limit
     below these thresholds will effectively limit the scheduler to
     printing a single job at any time.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer filter-nice
     Specifies the scheduling priority of filters that are run to print
     a job. The nice value ranges from 0, the highest priority, to 19,
     the lowest priority.

     Defaults to ‘0’.

 -- cups-configuration parameter: host-name-lookups host-name-lookups
     Specifies whether to do reverse lookups on connecting clients. The
     ‘double’ setting causes ‘cupsd’ to verify that the hostname
     resolved from the address matches one of the addresses returned for
     that hostname. Double lookups also prevent clients with
     unregistered addresses from connecting to your server. Only set
     this option to ‘#t’ or ‘double’ if absolutely required.

     Defaults to ‘#f’.

 -- cups-configuration parameter: non-negative-integer job-kill-delay
     Specifies the number of seconds to wait before killing the filters
     and backend associated with a canceled or held job.

     Defaults to ‘30’.

 -- cups-configuration parameter: non-negative-integer
          job-retry-interval
     Specifies the interval between retries of jobs in seconds. This is
     typically used for fax queues but can also be used with normal
     print queues whose error policy is ‘retry-job’ or
     ‘retry-current-job’.

     Defaults to ‘30’.

 -- cups-configuration parameter: non-negative-integer job-retry-limit
     Specifies the number of retries that are done for jobs. This is
     typically used for fax queues but can also be used with normal
     print queues whose error policy is ‘retry-job’ or
     ‘retry-current-job’.

     Defaults to ‘5’.

 -- cups-configuration parameter: boolean keep-alive?
     Specifies whether to support HTTP keep-alive connections.

     Defaults to ‘#t’.

 -- cups-configuration parameter: non-negative-integer
          limit-request-body
     Specifies the maximum size of print files, IPP requests, and HTML
     form data. A limit of 0 disables the limit check.

     Defaults to ‘0’.

 -- cups-configuration parameter: multiline-string-list listen
     Listens on the specified interfaces for connections. Valid values
     are of the form ADDRESS:PORT, where ADDRESS is either an IPv6
     address enclosed in brackets, an IPv4 address, or ‘*’ to indicate
     all addresses. Values can also be file names of local UNIX domain
     sockets. The Listen directive is similar to the Port directive but
     allows you to restrict access to specific interfaces or networks.

 -- cups-configuration parameter: location-access-control-list
          location-access-controls
     Specifies a set of additional access controls.

     Available ‘location-access-controls’ fields are:

      -- location-access-controls parameter: file-name path
          Specifies the URI path to which the access control applies.

      -- location-access-controls parameter: access-control-list
               access-controls
          Access controls for all access to this path, in the same
          format as the ‘access-controls’ of ‘operation-access-control’.

          Defaults to ‘'()’.

      -- location-access-controls parameter: method-access-control-list
               method-access-controls
          Access controls for method-specific access to this path.

          Defaults to ‘'()’.

          Available ‘method-access-controls’ fields are:

           -- method-access-controls parameter: boolean reverse?
               If ‘#t’, apply access controls to all methods except the
               listed methods. Otherwise apply to only the listed
               methods.

               Defaults to ‘#f’.

           -- method-access-controls parameter: method-list methods
               Methods to which this access control applies.

               Defaults to ‘'()’.

           -- method-access-controls parameter: access-control-list
                    access-controls
               Access control directives, as a list of strings. Each
               string should be one directive, such as ‘"Order
               allow,deny"’.

               Defaults to ‘'()’.

 -- cups-configuration parameter: non-negative-integer log-debug-history
     Specifies the number of debugging messages that are retained for
     logging if an error occurs in a print job. Debug messages are
     logged regardless of the LogLevel setting.

     Defaults to ‘100’.

 -- cups-configuration parameter: log-level log-level
     Specifies the level of logging for the ErrorLog file. The value
     ‘none’ stops all logging while ‘debug2’ logs everything.

     Defaults to ‘info’.

 -- cups-configuration parameter: log-time-format log-time-format
     Specifies the format of the date and time in the log files. The
     value ‘standard’ logs whole seconds while ‘usecs’ logs
     microseconds.

     Defaults to ‘standard’.

 -- cups-configuration parameter: non-negative-integer max-clients
     Specifies the maximum number of simultaneous clients that are
     allowed by the scheduler.

     Defaults to ‘100’.

 -- cups-configuration parameter: non-negative-integer
          max-clients-per-host
     Specifies the maximum number of simultaneous clients that are
     allowed from a single address.

     Defaults to ‘100’.

 -- cups-configuration parameter: non-negative-integer max-copies
     Specifies the maximum number of copies that a user can print of
     each job.

     Defaults to ‘9999’.

 -- cups-configuration parameter: non-negative-integer max-hold-time
     Specifies the maximum time a job may remain in the ‘indefinite’
     hold state before it is canceled. A value of 0 disables
     cancellation of held jobs.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer max-jobs
     Specifies the maximum number of simultaneous jobs that are allowed.
     Set to 0 to allow an unlimited number of jobs.

     Defaults to ‘500’.

 -- cups-configuration parameter: non-negative-integer
          max-jobs-per-printer
     Specifies the maximum number of simultaneous jobs that are allowed
     per printer. A value of 0 allows up to ‘max-jobs’ per printer.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer max-jobs-per-user
     Specifies the maximum number of simultaneous jobs that are allowed
     per user. A value of 0 allows up to ‘max-jobs’ per user.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer max-job-time
     Specifies the maximum time a job may take to print before it is
     canceled, in seconds. Set to 0 to disable cancellation of “stuck”
     jobs.

     Defaults to ‘10800’.

 -- cups-configuration parameter: non-negative-integer max-log-size
     Specifies the maximum size of the log files before they are
     rotated, in bytes. The value 0 disables log rotation.

     Defaults to ‘1048576’.

 -- cups-configuration parameter: non-negative-integer max-subscriptions
     Specifies the maximum number of simultaneous event subscriptions
     that are allowed. Set to ‘0’ to allow an unlimited number of
     subscriptions.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer
          max-subscriptions-per-job
     Specifies the maximum number of simultaneous event subscriptions
     that are allowed per job. A value of ‘0’ allows up to
     ‘max-subscriptions’ per job.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer
          max-subscriptions-per-printer
     Specifies the maximum number of simultaneous event subscriptions
     that are allowed per printer. A value of ‘0’ allows up to
     ‘max-subscriptions’ per printer.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer
          max-subscriptions-per-user
     Specifies the maximum number of simultaneous event subscriptions
     that are allowed per user. A value of ‘0’ allows up to
     ‘max-subscriptions’ per user.

     Defaults to ‘0’.

 -- cups-configuration parameter: non-negative-integer
          multiple-operation-timeout
     Specifies the maximum amount of time to allow between files in a
     multiple file print job, in seconds.

     Defaults to ‘900’.

 -- cups-configuration parameter: environment-variables
          environment-variables
     Passes the specified environment variable(s) to child processes; a
     list of strings.

     Defaults to ‘'()’.

 -- cups-configuration parameter: policy-configuration-list policies
     Specifies named access control policies.

     Available ‘policy-configuration’ fields are:

      -- policy-configuration parameter: string name
          Name of the policy.

      -- policy-configuration parameter: string job-private-access
          Specifies an access list for a job’s private values. ‘@ACL’
          maps to the printer’s requesting-user-name-allowed or
          requesting-user-name-denied values. ‘@OWNER’ maps to the job’s
          owner. ‘@SYSTEM’ maps to the groups listed for the
          ‘system-group’ field of the ‘files-configuration’, which is
          reified into the ‘cups-files.conf(5)’ file. Other possible
          elements of the access list include specific user names, and
          ‘@GROUP’ to indicate members of a specific group. The access
          list may also be simply ‘all’ or ‘default’.

          Defaults to ‘"@OWNER @SYSTEM"’.

      -- policy-configuration parameter: string job-private-values
          Specifies the list of job values to make private, or ‘all’,
          ‘default’, or ‘none’.

          Defaults to ‘"job-name job-originating-host-name
          job-originating-user-name phone"’.

      -- policy-configuration parameter: string
               subscription-private-access
          Specifies an access list for a subscription’s private values.
          ‘@ACL’ maps to the printer’s requesting-user-name-allowed or
          requesting-user-name-denied values. ‘@OWNER’ maps to the job’s
          owner. ‘@SYSTEM’ maps to the groups listed for the
          ‘system-group’ field of the ‘files-configuration’, which is
          reified into the ‘cups-files.conf(5)’ file. Other possible
          elements of the access list include specific user names, and
          ‘@GROUP’ to indicate members of a specific group. The access
          list may also be simply ‘all’ or ‘default’.

          Defaults to ‘"@OWNER @SYSTEM"’.

      -- policy-configuration parameter: string
               subscription-private-values
          Specifies the list of job values to make private, or ‘all’,
          ‘default’, or ‘none’.

          Defaults to ‘"notify-events notify-pull-method
          notify-recipient-uri notify-subscriber-user-name
          notify-user-data"’.

      -- policy-configuration parameter: operation-access-control-list
               access-controls
          Access control by IPP operation.

          Defaults to ‘'()’.

 -- cups-configuration parameter: boolean-or-non-negative-integer
          preserve-job-files
     Specifies whether job files (documents) are preserved after a job
     is printed. If a numeric value is specified, job files are
     preserved for the indicated number of seconds after printing.
     Otherwise a boolean value applies indefinitely.

     Defaults to ‘86400’.

 -- cups-configuration parameter: boolean-or-non-negative-integer
          preserve-job-history
     Specifies whether the job history is preserved after a job is
     printed. If a numeric value is specified, the job history is
     preserved for the indicated number of seconds after printing. If
     ‘#t’, the job history is preserved until the MaxJobs limit is
     reached.

     Defaults to ‘#t’.

 -- cups-configuration parameter: comma-separated-string-list-or-#f
          ready-paper-sizes
     Specifies a list of potential paper sizes that are reported as
     ready, that is: loaded. The actual list will contain only the sizes
     that each printer supports.

     The default value of ‘#f’ is a special case: CUPS will use ‘(list
     \"Letter\" \"Legal\" \"Tabloid\" \"4x6\" \"Env10\")’ if the default
     paper size is \"Letter\", and ‘(list \"A3\" \"A4\" \"A5\" \"A6\"
     \"EnvDL\")’ otherwise.

 -- cups-configuration parameter: non-negative-integer reload-timeout
     Specifies the amount of time to wait for job completion before
     restarting the scheduler.

     Defaults to ‘30’.

 -- cups-configuration parameter: string server-admin
     Specifies the email address of the server administrator.

     Defaults to ‘"root@localhost.localdomain"’.

 -- cups-configuration parameter: host-name-list-or-* server-alias
     The ServerAlias directive is used for HTTP Host header validation
     when clients connect to the scheduler from external interfaces.
     Using the special name ‘*’ can expose your system to known
     browser-based DNS rebinding attacks, even when accessing sites
     through a firewall. If the auto-discovery of alternate names does
     not work, we recommend listing each alternate name with a
     ServerAlias directive instead of using ‘*’.

     Defaults to ‘*’.

 -- cups-configuration parameter: string server-name
     Specifies the fully-qualified host name of the server.

     Defaults to ‘"localhost"’.

 -- cups-configuration parameter: server-tokens server-tokens
     Specifies what information is included in the Server header of HTTP
     responses. ‘None’ disables the Server header. ‘ProductOnly’ reports
     ‘CUPS’. ‘Major’ reports ‘CUPS 2’. ‘Minor’ reports ‘CUPS 2.0’.
     ‘Minimal’ reports ‘CUPS 2.0.0’. ‘OS’ reports ‘CUPS 2.0.0 (UNAME)’
     where UNAME is the output of the ‘uname’ command. ‘Full’ reports
     ‘CUPS 2.0.0 (UNAME) IPP/2.0’.

     Defaults to ‘Minimal’.

 -- cups-configuration parameter: multiline-string-list ssl-listen
     Listens on the specified interfaces for encrypted connections.
     Valid values are of the form ADDRESS:PORT, where ADDRESS is either
     an IPv6 address enclosed in brackets, an IPv4 address, or ‘*’ to
     indicate all addresses.

     Defaults to ‘'()’.

 -- cups-configuration parameter: ssl-options ssl-options
     Sets encryption options. By default, CUPS only supports encryption
     using TLS v1.0 or higher using known secure cipher suites. Security
     is reduced when ‘Allow’ options are used, and enhanced when ‘Deny’
     options are used. The ‘AllowRC4’ option enables the 128-bit RC4
     cipher suites, which are required for some older clients. The
     ‘AllowSSL3’ option enables SSL v3.0, which is required for some
     older clients that do not support TLS v1.0. The ‘DenyCBC’ option
     disables all CBC cipher suites. The ‘DenyTLS1.0’ option disables
     TLS v1.0 support - this sets the minimum protocol version to TLS
     v1.1.

     Defaults to ‘'()’.

 -- cups-configuration parameter: boolean strict-conformance?
     Specifies whether the scheduler requires clients to strictly adhere
     to the IPP specifications.

     Defaults to ‘#f’.

 -- cups-configuration parameter: non-negative-integer timeout
     Specifies the HTTP request timeout, in seconds.

     Defaults to ‘900’.

 -- cups-configuration parameter: boolean web-interface?
     Specifies whether the web interface is enabled.

     Defaults to ‘#f’.

   At this point you’re probably thinking “oh dear, Guix manual, I like
you but you can stop already with the configuration options”. Indeed.
However, one more point: it could be that you have an existing
‘cupsd.conf’ that you want to use. In that case, you can pass an
‘opaque-cups-configuration’ as the configuration of a
‘cups-service-type’.

   Available ‘opaque-cups-configuration’ fields are:

 -- opaque-cups-configuration parameter: package cups
     The CUPS package.

 -- opaque-cups-configuration parameter: string cupsd.conf
     The contents of the ‘cupsd.conf’, as a string.

 -- opaque-cups-configuration parameter: string cups-files.conf
     The contents of the ‘cups-files.conf’ file, as a string.

   For example, if your ‘cupsd.conf’ and ‘cups-files.conf’ are in
strings of the same name, you could instantiate a CUPS service like
this:

     (service cups-service-type
              (opaque-cups-configuration
                (cupsd.conf cupsd.conf)
                (cups-files.conf cups-files.conf)))


File: guix.pt_BR.info,  Node: Serviços de desktop,  Next: Serviços de som,  Prev: Serviços de impressão,  Up: Serviços

11.10.9 Serviços de desktop
---------------------------

The ‘(gnu services desktop)’ module provides services that are usually
useful in the context of a “desktop” setup—that is, on a machine running
a graphical display server, possibly with graphical user interfaces,
etc. It also defines services that provide specific desktop environments
like GNOME, Xfce or MATE.

   To simplify things, the module defines a variable containing the set
of services that users typically expect on a machine with a graphical
environment and networking:

 -- Variável: %desktop-services
     This is a list of services that builds upon ‘%base-services’ and
     adds or adjusts services for a typical “desktop” setup.

     In particular, it adds a graphical login manager (*note
     ‘gdm-service-type’: X Window.), screen lockers, a network
     management tool (*note ‘network-manager-service-type’: Serviços de
     Rede.) with modem support (*note ‘modem-manager-service-type’:
     Serviços de Rede.), energy and color management services, the
     ‘elogind’ login and seat manager, the Polkit privilege service, the
     GeoClue location service, the AccountsService daemon that allows
     authorized users change system passwords, a NTP client (*note
     Serviços de Rede::) and the Avahi daemon.

   The ‘%desktop-services’ variable can be used as the ‘services’ field
of an ‘operating-system’ declaration (*note ‘services’: Referência do
operating-system.).

   Additionally, the following procedures add one (or more!) desktop
environments to a system.

   • ‘gnome-desktop-service-type’ adds GNOME,
   • ‘plasma-desktop-service-type’ adds KDE Plasma,
   • ‘enlightenment-desktop-service-type’ adds Enlightenment,
   • ‘lxqt-desktop-service-type’ adds LXQt,
   • ‘mate-desktop-service-type’ adds MATE, and
   • ‘xfce-desktop-service-type’ adds Xfce.

   These service types add “metapackages” such as ‘gnome’ or ‘plasma’ to
the system profile, but most of them also set up other useful services
that mere packages can’t do.

   For example, they may elevate privileges on a limited number of
special-purpose system interfaces and programs. This allows backlight
adjustment helpers, power management utilities, screen lockers, and
other integrated functionality to work as expected.

 -- Variável: gnome-desktop-service-type
     This is the type of the service that adds the GNOME
     (https://www.gnome.org) desktop environment. Its value is a
     ‘gnome-desktop-configuration’ object (see below).

     This service adds the ‘gnome’ package to the system profile, and
     extends polkit with the actions from ‘gnome-settings-daemon’.

 -- Tipo de dados: gnome-desktop-configuration
     Configuration record for the GNOME desktop environment. Available
     ‘gnome-desktop-configuration’ fields are:

     ‘core-services’ (type: list-of-packages)
          A list of packages that the GNOME Shell and applications may
          rely on.

     ‘shell’ (type: list-of-packages)
          A list of packages that constitute the GNOME Shell, without
          applications.

     ‘utilities’ (type: list-of-packages)
          A list of packages that serve as applications to use on top of
          the GNOME Shell.

     ‘gnome’ (type: maybe-package)
          This field used to be the only configuration point and
          specified a GNOME meta-package to install system-wide. Since
          the meta-package itself provides neither sources nor the
          actual packages and is only used to propagate them, this field
          is deprecated.

     ‘extra-packages’ (type: list-of-packages)
          A list of GNOME-adjacent packages to also include. This field
          is intended for users to add their own packages to their GNOME
          experience. Note, that it already includes some packages that
          are considered essential by some (most?) GNOME users.

     ‘udev-ignorelist’ (default: ‘()’) (type: list-of-strings)
          A list of regular expressions denoting udev rules or hardware
          file names provided by any package that should not be
          installed. By default, every udev rule and hardware file
          specified by any package referenced in the other fields are
          installed.

     ‘polkit-ignorelist’ (default: ‘()’) (type: list-of-strings)
          A list of regular expressions denoting polkit rules provided
          by any package that should not be installed. By default, every
          polkit rule added by any package referenced in the other
          fields are installed.

     ‘keyring’ (type: gnome-keyring-configuration-or-#f)
          A <gnome-keyring-configuration> record used to better
          integrate the GNOME keyring with the system. Refer to the
          documentation of the ‘gnome-keyring-service-type’ for more
          information. If you’d rather avoid integrating the GNOME
          keyring, you can set this to ‘#f’.

 -- Variável: plasma-desktop-service-type
     This is the type of the service that adds the Plasma
     (https://kde.org/plasma-desktop/) desktop environment. Its value is
     a ‘plasma-desktop-configuration’ object (see below).

     This service adds the ‘plasma’ package to the system profile.

 -- Tipo de dados: plasma-desktop-configuration
     Configuration record for the Plasma desktop environment.

     ‘plasma’ (default: ‘plasma’)
          The Plasma package to use.

 -- Variável: xfce-desktop-service-type
     This is the type of a service to run the https://xfce.org/ (Xfce)
     desktop environment. Its value is an ‘xfce-desktop-configuration’
     object (see below).

     This service adds the ‘xfce’ package to the system profile, and
     extends polkit with the ability for ‘thunar’ to manipulate the file
     system as root from within a user session, after the user has
     authenticated with the administrator’s password.

     Note that ‘xfce4-panel’ and its plugin packages should be installed
     in the same profile to ensure compatibility. When using this
     service, you should add extra plugins (‘xfce4-whiskermenu-plugin’,
     ‘xfce4-weather-plugin’, etc.) to the ‘packages’ field of your
     ‘operating-system’.

 -- Tipo de dados: xfce-desktop-configuration
     Configuration record for the Xfce desktop environment.

     ‘xfce’ (default: ‘xfce’)
          The Xfce package to use.

 -- Variável: mate-desktop-service-type
     This is the type of the service that runs the MATE desktop
     environment (https://mate-desktop.org/). Its value is a
     ‘mate-desktop-configuration’ object (see below).

     This service adds the ‘mate’ package to the system profile, and
     extends polkit with the actions from ‘mate-settings-daemon’.

 -- Tipo de dados: mate-desktop-configuration
     Configuration record for the MATE desktop environment.

     ‘mate’ (default: ‘mate’)
          The MATE package to use.

 -- Variável: lxqt-desktop-service-type
     This is the type of the service that runs the LXQt desktop
     environment (https://lxqt-project.org). Its value is a
     ‘lxqt-desktop-configuration’ object (see below).

     This service adds the ‘lxqt’ package to the system profile.

 -- Tipo de dados: lxqt-desktop-configuration
     Configuration record for the LXQt desktop environment.

     ‘lxqt’ (default: ‘lxqt’)
          The LXQT package to use.

 -- Variável: sugar-desktop-service-type
     This is the type of the service that runs the Sugar desktop
     environment (https://www.sugarlabs.org). Its value is a
     ‘sugar-desktop-configuration’ object (see below).

     This service adds the ‘sugar’ package to the system profile, as
     well as any selected Sugar activities. By default it only includes
     a minimal set of activities.

 -- Tipo de dados: sugar-desktop-configuration
     Configuration record for the Sugar desktop environment.

     ‘sugar’ (default: ‘sugar’)
          The Sugar package to use.
     ‘gobject-introspection’ (default: ‘gobject-introspection’)
          The ‘gobject-introspection’ package to use. This package is
          used to access libraries installed as dependencies of Sugar
          activities.
     ‘activities’ (default: ‘(list sugar-help-activity)’)
          A list of Sugar activities to install.

   The following example configures the Sugar desktop environment with a
number of useful activities:

     (use-modules (gnu))
     (use-package-modules sugar)
     (use-service-modules desktop)
     (operating-system
       ...
       (services (cons* (service sugar-desktop-service-type
                                 (sugar-desktop-configuration
                                   (activities (list sugar-browse-activity
                                                     sugar-help-activity
                                                     sugar-jukebox-activity
                                                     sugar-typing-turtle-activity))))
                        %desktop-services))
       ...)

 -- Variável: enlightenment-desktop-service-type
     Return a service that adds the ‘enlightenment’ package to the
     system profile, and extends dbus with actions from ‘efl’.

 -- Tipo de dados: enlightenment-desktop-service-configuration
     ‘enlightenment’ (default: ‘enlightenment’)
          The enlightenment package to use.

   Because the GNOME, Xfce and MATE desktop services pull in so many
packages, the default ‘%desktop-services’ variable doesn’t include any
of them by default. To add GNOME, Xfce or MATE, just ‘cons’ them onto
‘%desktop-services’ in the ‘services’ field of your ‘operating-system’:

     (use-modules (gnu))
     (use-service-modules desktop)
     (operating-system
       ...
       ;; cons* adds items to the list given as its last argument.
       (services (cons* (service gnome-desktop-service-type)
                        (service xfce-desktop-service-type)
                        %desktop-services))
       ...)

   These desktop environments will then be available as options in the
graphical login window.

   The actual service definitions included in ‘%desktop-services’ and
provided by ‘(gnu services dbus)’ and ‘(gnu services desktop)’ are
described below.

 -- Variável: dbus-root-service-type
     Type for a service that runs the D-Bus “system bus”. (1)

     The value for this service type is a ‘<dbus-configuration>’ record.

 -- Tipo de dados: dbus-configuration
     Data type representing the configuration for
     ‘dbus-root-service-type’.

     ‘dbus’ (default: ‘dbus’) (type: file-like)
          Package object for dbus.

     ‘services’ (default: ‘'()’) (type: list)
          List of packages that provide an ‘etc/dbus-1/system.d’
          directory containing additional D-Bus configuration and policy
          files. For example, to allow avahi-daemon to use the system
          bus, SERVICES must be equal to ‘(list avahi)’.

     ‘verbose?’ (default: ‘#f’) (type: boolean)
          When ‘#t’, D-Bus is launched with environment variable
          ‘DBUS_VERBOSE’ set to ‘1’. A verbose-enabled D-Bus package
          such as ‘dbus-verbose’ should be provided to DBUS in this
          scenario. The verbose output is logged to
          ‘/var/log/dbus-daemon.log’.

Elogind
.......

Elogind (https://github.com/elogind/elogind) is a login and seat
management daemon that also handles most system-level power events for a
computer, for example suspending the system when a lid is closed, or
shutting it down when the power button is pressed.

   It also provides a D-Bus interface that can be used to know which
users are logged in, know what kind of sessions they have open, suspend
the system, inhibit system suspend, reboot the system, and other tasks.

 -- Variável: elogind-service-type
     Type of the service that runs ‘elogind’, a login and seat
     management daemon. The value for this service is a
     ‘<elogind-configuration>’ object.

 -- Tipo de dados: elogind-configuration
     Available ‘elogind-configuration’ fields are:

     ‘elogind’ (default: ‘elogind’) (type: file-like)
          The elogind package to use.

     ‘system-sleep-hook-files’ (default: ‘()’) (type: list-of-file-likes)
          A list of executables (file-like objects) that will be
          installed into the ‘/etc/elogind/system-sleep’ hook directory.
          See ‘Hook directories’ in the ‘loginctl(1)’ man page for more
          information.

     ‘system-shutdown-hook-files’ (default: ‘()’) (type: list-of-file-likes)
          A list of executables (file-like objects) that will be
          installed into the ‘/etc/elogind/system-shutdown/’ hook
          directory.

     ‘allow-power-off-interrupts?’ (default: ‘#f’) (type: maybe-boolean)
          Whether the executables in elogind’s hook directories (see
          above) can cause a power-off action to be cancelled
          (interrupted) by printing an appropriate error message to
          stdout.

     ‘allow-suspend-interrupts?’ (default: ‘#f’) (type: maybe-boolean)
          Likewise as the ‘allow-power-off-interrupts?’ option, but for
          the suspend action.

     ‘broadcast-power-off-interrupts?’ (default: ‘#f’) (type: maybe-boolean)
          Whether an interrupt of a power-off action is broadcasted.

     ‘broadcast-suspend-interrupts?’ (default: ‘#f’) (type: maybe-boolean)
          Whether an interrupt of a suspend action is broadcasted.

     ‘kill-user-processes?’ (default: ‘#f’) (type: maybe-boolean)
          Whether the processes of a user should be killed when the user
          logs out.

     ‘kill-only-users’ (type: maybe-list-of-user-names)
          Usernames whose processes should be killed, regardless the
          value of ‘kill-user-processes?’.

     ‘kill-exclude-users’ (default: ‘("root")’) (type: maybe-list-of-user-names)
          Usernames whose processes should _not_ be killed, regardless
          the value of ‘kill-user-processes?’.

     ‘inhibit-delay-max-seconds’ (default: ‘5’) (type: maybe-non-negative-integer)
          The maximum time a system shutdown or sleep request is delayed
          due to an inhibitor lock of type delay being active before the
          inhibitor is ignored and the operation executes anyway.

     ‘handle-power-key’ (default: ‘poweroff’) (type: maybe-action)
          The action done when the power key is pressed. The compiled
          default is ‘'poweroff’.

     ‘handle-suspend-key’ (default: ‘suspend’) (type: maybe-action)
          The action done when the suspend key is pressed. The

     ‘handle-hibernate-key’ (default: ‘hibernate’) (type: maybe-action)
          The action done when the hibernate key is pressed.

     ‘handle-lid-switch’ (default: ‘suspend’) (type: maybe-action)
          The action done when the lid is closed.

     ‘handle-lid-switch-docked’ (default: ‘ignore’) (type: maybe-action)
          The action done when the lid is closed and the device docked.

     ‘handle-lid-switch-external-power’ (default: ‘suspend’) (type: maybe-action)
          The action done when the lid is closed and the device is
          externally powered.

     ‘power-key-ignore-inhibited?’ (default: ‘#f’) (type: maybe-boolean)
          Whether to ignore high-level inhibitor locks (shutdown,
          reboot, sleep or idle) when the power key is pressed.

     ‘suspend-key-ignore-inhibited?’ (default: ‘#f’) (type: maybe-boolean)
          Whether to ignore high-level inhibitor locks (shutdown,
          reboot, sleep or idle) when the suspend key is pressed.

     ‘hibernate-key-ignore-inhibited?’ (default: ‘#f’) (type: maybe-boolean)
          Whether to ignore high-level inhibitor locks (shutdown,
          reboot, sleep or idle) when the hibernate key is pressed.

     ‘lid-switch-ignore-inhibited?’ (default: ‘#f’) (type: maybe-boolean)
          Whether to ignore high-level inhibitor locks (shutdown,
          reboot, sleep or idle) when the lid is closed.

     ‘holdoff-timeout-seconds’ (default: ‘30’) (type: maybe-non-negative-integer)
          Specifies the number of seconds after system startup or system
          resume during which elogind will hold off on reacting to lid
          events.

     ‘idle-action’ (default: ‘ignore’) (type: maybe-action)
          Action to take when the system is idle.

     ‘idle-action-seconds’ (type: maybe-non-negative-integer)
          The delay after which the action configured in ‘idle-action’
          is taken after the system is idle.

     ‘runtime-directory-size-percent’ (type: maybe-percent)
          Set the size limit, in percent, on the ‘XDG_RUNTIME_DIR’
          runtime directory for each user who logs in. This specifies
          the per-user size limit relative to the amount of physical RAM
          (read access memory). This value takes precedence over that
          specified via ‘runtime-directory-size’.

     ‘runtime-directory-size’ (type: maybe-non-negative-integer)
          Set the size limit, in bytes, on the ‘XDG_RUNTIME_DIR’ runtime
          directory for each user who logs in.

     ‘remove-ipc?’ (default: ‘#t’) (type: maybe-boolean)
          Whether IPC (inter-process communication) objects belonging to
          the user shall be removed when the user fully logs out.

     ‘suspend-state’ (default: ‘(mem standby freeze)’) (type: maybe-list-of-suspend-states)
          The suspend state values to be write to ‘/sys/power/state’ by
          elogind when suspending the system. They will be tried in
          turn, until one is written without error.

     ‘suspend-mode’ (type: maybe-list-of-suspend-modes)
          The suspend mode values to write to ‘/sys/power/mem_sleep’ by
          elogind when suspending the system.

     ‘suspend-estimation-seconds’ (default: ‘3600’) (type: maybe-non-negative-integer)
          Cause the RTC alarm to wake the system after the specified
          time span to measure the system battery capacity level and
          estimate the battery discharging rate, which is used for
          estimating the time span until the system battery charge level
          goes down to 5%. This option is only used by elogind when
          using the ‘'suspend-then-hibernate’ action.

     ‘hibernate-mode’ (default: ‘(platform shutdown)’) (type: maybe-list-of-hibernation-modes)
          The hibernation mode values to write to ‘/sys/power/disk’ by
          elogind when hibernating the system.

     ‘hibernate-delay-seconds’ (type: maybe-non-negative-integer)
          The amount of time the system spends in suspend mode before
          the system is automatically put into hibernate mode.

     ‘hibernate-state’ (type: maybe-list-of-strings)
          Deprecated option.

     ‘hybrid-sleep-state’ (type: maybe-list-of-strings)
          Deprecated option.

     ‘hybrid-sleep-mode’ (type: maybe-list-of-strings)
          Deprecated option.

 -- Variável: accountsservice-service-type
     Type for the service that runs AccountsService, a system service
     that can list available accounts, change their passwords, and so
     on. AccountsService integrates with PolicyKit to enable
     unprivileged users to acquire the capability to modify their system
     configuration. See AccountsService
     (https://www.freedesktop.org/wiki/Software/AccountsService/) for
     more information.

     The value for this service is a file-like object, by default it is
     set to ‘accountsservice’ (the package object for AccountsService).

 -- Variável: polkit-service-type
     Type for the service that runs the Polkit privilege management
     service (https://www.freedesktop.org/wiki/Software/polkit/), which
     allows system administrators to grant access to privileged
     operations in a structured way. By querying the Polkit service, a
     privileged system component can know when it should grant
     additional capabilities to ordinary users. For example, an ordinary
     user can be granted the capability to suspend the system if the
     user is logged in locally.

     The value for this service is a ‘<polkit-configuration>’ object.

 -- Variável: polkit-wheel-service
     Service that adds the ‘wheel’ group as admins to the Polkit
     service. This makes it so that users in the ‘wheel’ group are
     queried for their own passwords when performing administrative
     actions instead of ‘root’’s, similar to the behaviour used by
     ‘sudo’.

 -- Variável: upower-service-type
     Service that runs ‘upowerd’ (https://upower.freedesktop.org/), a
     system-wide monitor for power consumption and battery levels, with
     the given configuration settings.

     It implements the ‘org.freedesktop.UPower’ D-Bus interface, and is
     notably used by GNOME.

 -- Tipo de dados: upower-configuration
     Data type representation the configuration for UPower.

     ‘upower’ (default: UPOWER)
          Package to use for ‘upower’.

     ‘watts-up-pro?’ (padrão: ‘#f’)
          Enable the Watts Up Pro device.

     ‘poll-batteries?’ (padrão: ‘#t’)
          Enable polling the kernel for battery level changes.

     ‘ignore-lid?’ (padrão: ‘#f’)
          Ignore the lid state, this can be useful if it’s incorrect on
          a device.

     ‘use-percentage-for-policy?’ (default: ‘#t’)
          Whether to use a policy based on battery percentage rather
          than on estimated time left. A policy based on battery
          percentage is usually more reliable.

     ‘percentage-low’ (default: ‘20’)
          When ‘use-percentage-for-policy?’ is ‘#t’, this sets the
          percentage at which the battery is considered low.

     ‘percentage-critical’ (default: ‘5’)
          When ‘use-percentage-for-policy?’ is ‘#t’, this sets the
          percentage at which the battery is considered critical.

     ‘percentage-action’ (default: ‘2’)
          When ‘use-percentage-for-policy?’ is ‘#t’, this sets the
          percentage at which action will be taken.

     ‘time-low’ (default: ‘1200’)
          When ‘use-time-for-policy?’ is ‘#f’, this sets the time
          remaining in seconds at which the battery is considered low.

     ‘time-critical’ (default: ‘300’)
          When ‘use-time-for-policy?’ is ‘#f’, this sets the time
          remaining in seconds at which the battery is considered
          critical.

     ‘time-action’ (default: ‘120’)
          When ‘use-time-for-policy?’ is ‘#f’, this sets the time
          remaining in seconds at which action will be taken.

     ‘critical-power-action’ (default: ‘'hybrid-sleep’)
          The action taken when ‘percentage-action’ or ‘time-action’ is
          reached (depending on the configuration of
          ‘use-percentage-for-policy?’).

          Possible values are:

             • ‘'power-off’

             • ‘'hibernate’

             • ‘'hybrid-sleep’.

 -- Variável: udisks-service-type
     Type for the service that runs UDisks
     (https://udisks.freedesktop.org/docs/latest/), a “disk management”
     daemon that provides user interfaces with notifications and ways to
     mount/unmount disks. Programs that talk to UDisks include the
     ‘udisksctl’ command, part of UDisks, and GNOME Disks. Note that
     Udisks relies on the ‘mount’ command, so it will only be able to
     use the file-system utilities installed in the system profile. For
     example if you want to be able to mount NTFS file-systems in read
     and write fashion, you’ll need to have ‘ntfs-3g’ installed
     system-wide.

     The value for this service is a ‘<udisks-configuration>’ object.

 -- Tipo de dados: udisks-configuration
     Data type representing the configuration for ‘udisks-service-type’.

     ‘udisks’ (default: ‘udisks’) (type: file-like)
          Package object for UDisks.

 -- Variável: gvfs-service-type
     Type for the service that provides virtual file systems for GIO
     applications, which enables support for ‘trash://’, ‘ftp://’,
     ‘sftp://’ and many other location schemas in file managers like
     Nautilus (GNOME Files) and Thunar.

     The value for this service is a ‘<gvfs-configuration>’ object.

 -- Tipo de dados: gvfs-configuration
     Data type representing the configuration for ‘gvfs-service-type’.

     ‘gvfs’ (default: ‘gvfs’) (type: file-like)
          Package object for GVfs.

 -- Variável: colord-service-type
     This is the type of the service that runs ‘colord’, a system
     service with a D-Bus interface to manage the color profiles of
     input and output devices such as screens and scanners. It is
     notably used by the GNOME Color Manager graphical tool. See the
     colord web site (https://www.freedesktop.org/software/colord/) for
     more information.

 -- Variável: sane-service-type
     This service provides access to scanners via SANE
     (http://www.sane-project.org) by installing the necessary udev
     rules and pluggable backends. It is included in ‘%desktop-services’
     (*note Serviços de desktop::) and relies by default on
     ‘sane-backends’ package (see below) for hardware support.

 -- Data Type: sane-configuration
     Data type representing the configuration for SANE.

     ‘sane’ (default: ‘sane’)
          Package containing SANE library.

     ‘backends’ (default: ‘(sane-backends)’)
          List of packages with pluggable SANE backends:

             • ‘sane-backends’: The default backend collection which
               supports many recent scanners,

             • ‘sane-airscan’: A backend that enables network scanners
               supporting eSCL (Apple) or WSD, (Microsoft) protocols

             • ‘hplip’: A backend containing drivers for older
               Hewlett-Packard scanners,

             • ‘utsushi’: A backend containing drivers for older Epson
               devices.

   In order to use additional backends on a system which relies on
‘%desktop-services’, you may use ‘modify-services’ (*note
‘modify-services’: Referência de Service.) as illustrated below:

     (use-modules (gnu))
     (use-service-modules
       ...
       desktop)
     (use-package-modules
       ...
       scanner)

     (define %my-desktop-services
       ;; List of desktop services that supports a broader range of scanners.
       (modify-services %desktop-services
         (sane-service-type _ =>
           (sane-configuration
             (backends (list sane-backends sane-airscan))))))

     (operating-system
       ...
       (services %my-desktop-services))

 -- Procedure: geoclue-application name [#:allowed? #t] [#:system? #f]
          [#:users '()]
     Return a configuration allowing an application to access GeoClue
     location data. NAME is the Desktop ID of the application, without
     the ‘.desktop’ part. If ALLOWED? is true, the application will have
     access to location information by default. The boolean SYSTEM?
     value indicates whether an application is a system component or
     not. Finally USERS is a list of UIDs of all users for which this
     application is allowed location info access. An empty users list
     means that all users are allowed.

 -- Variável: %standard-geoclue-applications
     The standard list of well-known GeoClue application configurations,
     granting authority to the GNOME date-and-time utility to ask for
     the current location in order to set the time zone, and allowing
     the IceCat and Epiphany web browsers to request location
     information. IceCat and Epiphany both query the user before
     allowing a web page to know the user’s location.

 -- Variável: geoclue-service-type
     Type for the service that runs the GeoClue
     (https://wiki.freedesktop.org/www/Software/GeoClue/) location
     service. This service provides a D-Bus interface to allow
     applications to request access to a user’s physical location, and
     optionally to add information to online location databases.

     The value for this service is a ‘<geoclue-configuration>’ object.

 -- Variável: iio-sensor-proxy-service-type
     Type for the service that runs IIO sensor proxy
     (https://gitlab.freedesktop.org/hadess/iio-sensor-proxy), a daemon
     that proxies low-level sensor data from Industrial I/O (IIO)
     devices into a D-Bus interface. It enables user-space applications,
     such as desktop environments like GNOME and KDE, and services like
     GeoClue, to access data from various sensors commonly found in
     devices like ultrabooks and 2-in-1s. This allows for:

        • Automatic screen rotation based on accelerometer data.
        • Ambient brightness adjustment using light sensor data.
        • Compass/direction information for location services (via
          GeoClue).

     The value for this service is a ‘<iio-sensor-proxy-configuration>’
     object.

 -- Data Type: iio-sensor-proxy-configuration
     Data type representing the configuration for
     ‘iio-sensor-proxy-service-type’.

     ‘iio-sensor-proxy’ (default: ‘iio-sensor-proxy’) (type: file-like)
          Package object of iio-sensor-proxy.

 -- Variável: bluetooth-service-type
     This is the type for the Linux Bluetooth Protocol Stack
     (https://bluez.org/) (BlueZ) system, which generates the
     ‘/etc/bluetooth/main.conf’ configuration file. The value for this
     type is a ‘bluetooth-configuration’ record as in this example:

          (service bluetooth-service-type)

     See below for details about ‘bluetooth-configuration’.

 -- Tipo de dados: bluetooth-configuration
     Data type representing the configuration for ‘bluetooth-service’.

     ‘bluez’ (default: ‘bluez’)
          ‘bluez’ package to use.

     ‘name’ (default: ‘"BlueZ"’)
          Default adapter name.

     ‘class’ (default: ‘#x000000’)
          Default device class. Only the major and minor device class
          bits are considered.

     ‘discoverable-timeout’ (default: ‘180’)
          How long to stay in discoverable mode before going back to
          non-discoverable. The value is in seconds.

     ‘always-pairable?’ (default: ‘#f’)
          Always allow pairing even if there are no agents registered.

     ‘pairable-timeout’ (default: ‘0’)
          How long to stay in pairable mode before going back to
          non-discoverable. The value is in seconds.

     ‘device-id’ (default: ‘#f’)
          Use vendor id source (assigner), vendor, product and version
          information for DID profile support. The values are separated
          by ":" and ASSIGNER, VID, PID and VERSION.

          Possible values are:

             • ‘#f’ to disable it,

             • ‘"assigner:1234:5678:abcd"’, where ASSIGNER is either
               ‘usb’ (default) or ‘bluetooth’.

     ‘reverse-service-discovery?’ (default: ‘#t’)
          Do reverse service discovery for previously unknown devices
          that connect to us. For BR/EDR this option is really only
          needed for qualification since the BITE tester doesn’t like us
          doing reverse SDP for some test cases, for LE this disables
          the GATT client functionally so it can be used in system which
          can only operate as peripheral.

     ‘name-resolving?’ (default: ‘#t’)
          Enable name resolving after inquiry. Set it to ‘#f’ if you
          don’t need remote devices name and want shorter discovery
          cycle.

     ‘debug-keys?’ (default: ‘#f’)
          Enable runtime persistency of debug link keys. Default is
          false which makes debug link keys valid only for the duration
          of the connection that they were created for.

     ‘controller-mode’ (default: ‘'dual’)
          Restricts all controllers to the specified transport. ‘'dual’
          means both BR/EDR and LE are enabled (if supported by the
          hardware).

          Possible values are:

             • ‘'dual’

             • ‘'bredr’

             • ‘'le’

     ‘multi-profile’ (default: ‘'off’)
          Enables Multi Profile Specification support. This allows to
          specify if system supports only Multiple Profiles Single
          Device (MPSD) configuration or both Multiple Profiles Single
          Device (MPSD) and Multiple Profiles Multiple Devices (MPMD)
          configurations.

          Possible values are:

             • ‘'off’

             • ‘'single’

             • ‘'multiple’

     ‘fast-connectable?’ (padrão: ‘#f’)
          Permanently enables the Fast Connectable setting for adapters
          that support it. When enabled other devices can connect faster
          to us, however the tradeoff is increased power consumptions.
          This feature will fully work only on kernel version 4.1 and
          newer.

     ‘privacy’ (default: ‘'off’)
          Default privacy settings.

             • ‘'off’: Disable local privacy

             • ‘'network/on’: A device will only accept advertising
               packets from peer devices that contain private addresses.
               It may not be compatible with some legacy devices since
               it requires the use of RPA(s) all the time

             • ‘'device’: A device in device privacy mode is only
               concerned about the privacy of the device and will accept
               advertising packets from peer devices that contain their
               Identity Address as well as ones that contain a private
               address, even if the peer device has distributed its IRK
               in the past

          and additionally, if CONTROLLER-MODE is set to ‘'dual’:

             • ‘'limited-network’: Apply Limited Discoverable Mode to
               advertising, which follows the same policy as to BR/EDR
               that publishes the identity address when discoverable,
               and Network Privacy Mode for scanning

             • ‘'limited-device’: Apply Limited Discoverable Mode to
               advertising, which follows the same policy as to BR/EDR
               that publishes the identity address when discoverable,
               and Device Privacy Mode for scanning.

     ‘just-works-repairing’ (default: ‘'never’)
          Specify the policy to the JUST-WORKS repairing initiated by
          peer.

          Possible values:
             • ‘'never’

             • ‘'confirm’

             • ‘'always’

     ‘temporary-timeout’ (default: ‘30’)
          How long to keep temporary devices around. The value is in
          seconds. ‘0’ disables the timer completely.

     ‘refresh-discovery?’ (default: ‘#t’)
          Enables the device to issue an SDP request to update known
          services when profile is connected.

     ‘experimental’ (default: ‘#f’)
          Enables experimental features and interfaces, alternatively a
          list of UUIDs can be given.

          Possible values:

             • ‘#t’

             • ‘#f’

             • ‘(list (uuid <uuid-1>) (uuid <uuid-2>) ...)’.

          List of possible UUIDs:
             • ‘d4992530-b9ec-469f-ab01-6c481c47da1c’: BlueZ
               Experimental Debug,

             • ‘671b10b5-42c0-4696-9227-eb28d1b049d6’: BlueZ
               Experimental Simultaneous Central and Peripheral,

             • ‘15c0a148-c273-11ea-b3de-0242ac130004’: BlueZ
               Experimental LL privacy,

             • ‘330859bc-7506-492d-9370-9a6f0614037f’: BlueZ
               Experimental Bluetooth Quality Report,

             • ‘a6695ace-ee7f-4fb9-881a-5fac66c629af’: BlueZ
               Experimental Offload Codecs.

     ‘remote-name-request-retry-delay’ (default: ‘300’)
          The duration to avoid retrying to resolve a peer’s name, if
          the previous try failed.

     ‘page-scan-type’ (default: ‘#f’)
          BR/EDR Page scan activity type.

     ‘page-scan-interval’ (default: ‘#f’)
          BR/EDR Page scan activity interval.

     ‘page-scan-window’ (default: ‘#f’)
          BR/EDR Page scan activity window.

     ‘inquiry-scan-type’ (default: ‘#f’)
          BR/EDR Inquiry scan activity type.

     ‘inquiry-scan-interval’ (default: ‘#f’)
          BR/EDR Inquiry scan activity interval.

     ‘inquiry-scan-window’ (default: ‘#f’)
          BR/EDR Inquiry scan activity window.

     ‘link-supervision-timeout’ (default: ‘#f’)
          BR/EDR Link supervision timeout.

     ‘page-timeout’ (default: ‘#f’)
          BR/EDR Page timeout.

     ‘min-sniff-interval’ (default: ‘#f’)
          BR/EDR minimum sniff interval.

     ‘max-sniff-interval’ (default: ‘#f’)
          BR/EDR maximum sniff interval.

     ‘min-advertisement-interval’ (default: ‘#f’)
          LE minimum advertisement interval (used for legacy
          advertisement only).

     ‘max-advertisement-interval’ (default: ‘#f’)
          LE maximum advertisement interval (used for legacy
          advertisement only).

     ‘multi-advertisement-rotation-interval’ (default: ‘#f’)
          LE multiple advertisement rotation interval.

     ‘scan-interval-auto-connect’ (default: ‘#f’)
          LE scanning interval used for passive scanning supporting auto
          connect.

     ‘scan-window-auto-connect’ (default: ‘#f’)
          LE scanning window used for passive scanning supporting auto
          connect.

     ‘scan-interval-suspend’ (default: ‘#f’)
          LE scanning interval used for active scanning supporting wake
          from suspend.

     ‘scan-window-suspend’ (default: ‘#f’)
          LE scanning window used for active scanning supporting wake
          from suspend.

     ‘scan-interval-discovery’ (default: ‘#f’)
          LE scanning interval used for active scanning supporting
          discovery.

     ‘scan-window-discovery’ (default: ‘#f’)
          LE scanning window used for active scanning supporting
          discovery.

     ‘scan-interval-adv-monitor’ (default: ‘#f’)
          LE scanning interval used for passive scanning supporting the
          advertisement monitor APIs.

     ‘scan-window-adv-monitor’ (default: ‘#f’)
          LE scanning window used for passive scanning supporting the
          advertisement monitor APIs.

     ‘scan-interval-connect’ (default: ‘#f’)
          LE scanning interval used for connection establishment.

     ‘scan-window-connect’ (default: ‘#f’)
          LE scanning window used for connection establishment.

     ‘min-connection-interval’ (default: ‘#f’)
          LE default minimum connection interval. This value is
          superseded by any specific value provided via the Load
          Connection Parameters interface.

     ‘max-connection-interval’ (default: ‘#f’)
          LE default maximum connection interval. This value is
          superseded by any specific value provided via the Load
          Connection Parameters interface.

     ‘connection-latency’ (default: ‘#f’)
          LE default connection latency. This value is superseded by any
          specific value provided via the Load Connection Parameters
          interface.

     ‘connection-supervision-timeout’ (default: ‘#f’)
          LE default connection supervision timeout. This value is
          superseded by any specific value provided via the Load
          Connection Parameters interface.

     ‘autoconnect-timeout’ (default: ‘#f’)
          LE default autoconnect timeout. This value is superseded by
          any specific value provided via the Load Connection Parameters
          interface.

     ‘adv-mon-allowlist-scan-duration’ (default: ‘300’)
          Allowlist scan duration during interleaving scan. Only used
          when scanning for ADV monitors. The units are msec.

     ‘adv-mon-no-filter-scan-duration’ (default: ‘500’)
          No filter scan duration during interleaving scan. Only used
          when scanning for ADV monitors. The units are msec.

     ‘enable-adv-mon-interleave-scan?’ (default: ‘#t’)
          Enable/Disable Advertisement Monitor interleave scan for power
          saving.

     ‘cache’ (default: ‘'always’)
          GATT attribute cache.

          Possible values are:
             • ‘'always’: Always cache attributes even for devices not
               paired, this is recommended as it is best for
               interoperability, with more consistent reconnection times
               and enables proper tracking of notifications for all
               devices

             • ‘'yes’: Only cache attributes of paired devices

             • ‘'no’: Never cache attributes.

     ‘key-size’ (default: ‘0’)
          Minimum required Encryption Key Size for accessing secured
          characteristics.

          Possible values are:
             • ‘0’: Don’t care

             • ‘7 <= N <= 16’

     ‘exchange-mtu’ (default: ‘517’)
          Exchange MTU size. Possible values are:

             • ‘23 <= N <= 517’

     ‘att-channels’ (default: ‘3’)
          Number of ATT channels. Possible values are:

             • ‘1’: Disables EATT

             • ‘2 <= N <= 5’

     ‘session-mode’ (default: ‘'basic’)
          AVDTP L2CAP signalling channel mode.

          Possible values are:

             • ‘'basic’: Use L2CAP basic mode

             • ‘'ertm’: Use L2CAP enhanced retransmission mode.

     ‘stream-mode’ (default: ‘'basic’)
          AVDTP L2CAP transport channel mode.

          Possible values are:

             • ‘'basic’: Use L2CAP basic mode

             • ‘'streaming’: Use L2CAP streaming mode.

     ‘reconnect-uuids’ (default: ‘'()’)
          The ReconnectUUIDs defines the set of remote services that
          should try to be reconnected to in case of a link loss (link
          supervision timeout). The policy plugin should contain a sane
          set of values by default, but this list can be overridden
          here. By setting the list to empty the reconnection feature
          gets disabled.

          Possible values:

             • ‘'()’

             • ‘(list (uuid <uuid-1>) (uuid <uuid-2>) ...)’.

     ‘reconnect-attempts’ (default: ‘7’)
          Defines the number of attempts to reconnect after a link lost.
          Setting the value to 0 disables reconnecting feature.

     ‘reconnect-intervals’ (default: ‘'(1 2 4 8 16 32 64)’)
          Defines a list of intervals in seconds to use in between
          attempts. If the number of attempts defined in
          RECONNECT-ATTEMPTS is bigger than the list of intervals the
          last interval is repeated until the last attempt.

     ‘auto-enable?’ (default: ‘#f’)
          Defines option to enable all controllers when they are found.
          This includes adapters present on start as well as adapters
          that are plugged in later on.

     ‘resume-delay’ (default: ‘2’)
          Audio devices that were disconnected due to suspend will be
          reconnected on resume. RESUME-DELAY determines the delay
          between when the controller resumes from suspend and a
          connection attempt is made. A longer delay is better for
          better co-existence with Wi-Fi. The value is in seconds.

     ‘rssi-sampling-period’ (default: ‘#xFF’)
          Default RSSI Sampling Period. This is used when a client
          registers an advertisement monitor and leaves the
          RSSISamplingPeriod unset.

          Possible values are:
             • ‘#x0’: Report all advertisements

             • ‘N = #xXX’: Report advertisements every N x 100 msec
               (range: #x01 to #xFE)

             • ‘#xFF’: Report only one advertisement per device during
               monitoring period.

 -- Variável: gnome-keyring-service-type
     This is the type of the service that adds the GNOME Keyring
     (https://wiki.gnome.org/Projects/GnomeKeyring). Its value is a
     ‘gnome-keyring-configuration’ object (see below). Note that there
     is no need to use this service when using
     ‘gnome-desktop-service-type’, which includes it.

     This service adds the ‘gnome-keyring’ package to the system profile
     and extends PAM with entries using ‘pam_gnome_keyring.so’,
     unlocking a user’s login keyring when they log in or setting its
     password with passwd.

 -- Tipo de dados: gnome-keyring-configuration
     Configuration record for the GNOME Keyring service.

     ‘keyring’ (default: ‘gnome-keyring’)
          The GNOME keyring package to use.

     ‘pam-services’
          A list of ‘(SERVICE . KIND)’ pairs denoting PAM services to
          extend, where SERVICE is the name of an existing service to
          extend and KIND is one of ‘login’ or ‘passwd’.

          If ‘login’ is given, it adds an optional
          ‘pam_gnome_keyring.so’ to the auth block without arguments and
          to the session block with ‘auto_start’. If ‘passwd’ is given,
          it adds an optional ‘pam_gnome_keyring.so’ to the password
          block without arguments.

          By default, this field contains “gdm-password” with the value
          ‘login’ and “passwd” is with the value ‘passwd’.

 -- Variável: kwallet-service-type
     This is the type of the service that adds the KWallet keyring
     (https://invent.kde.org/plasma/kwallet-pam). Its value is a
     ‘kwallet-configuration’ object (see below). Note that, contrary to
     ‘gnome-desktop-service-type’, which includes the respective keyring
     for that service, ‘gnome-keyring-service-type’,
     ‘plasma-desktop-service-type’ does not include
     ‘kwallet-service-type’.

     This service adds the ‘kwallet-pam’ package to the system profile
     and extends PAM with entries using ‘pam_kwallet5.so’. It can unlock
     the user’s login keyring or set their password with ‘passwd’ at the
     time they log in.

 -- Data Type: kwallet-configuration
     Configuration record for the KWallet Keyring service.

     ‘keyring’ (default: ‘kwallet-pam’)
          The KWallet keyring package to use.

     ‘pam-services’
          A list of ‘(SERVICE . KIND)’ pairs denoting PAM services to
          extend, where SERVICE is the name of an existing service to
          extend and KIND is one of ‘login’ or ‘passwd’ symbols.

          If ‘login’ is given, it adds an optional ‘pam_kwallet5.so’ to
          the auth block without arguments and to the session block with
          ‘auto_start’. If ‘passwd’ is given, it adds an optional
          ‘pam_kwallet5.so’ to the password block without arguments.

          By default, it takes for value an alist associating the
          ‘"sddm"’ key with the ‘'login’ value, and the ‘"passwd"’ key
          with the ‘'passwd’ value.

 -- Variável: seatd-service-type
     seatd (https://sr.ht/~kennylevinsen/seatd/) is a minimal seat
     management daemon.

     Seat management takes care of mediating access to shared devices
     (graphics, input), without requiring the applications needing
     access to be root.

          (append
            (list
             ;; make sure seatd is running
             (service seatd-service-type))

            ;; normally one would want %base-services
            %base-services)


     ‘seatd’ operates over a UNIX domain socket, with ‘libseat’
     providing the client side of the protocol. Applications that
     acquire access to the shared resources via ‘seatd’ (e.g. ‘sway’)
     need to be able to talk to this socket. This can be achieved by
     adding the user they run under to the group owning ‘seatd’’s socket
     (usually “seat”), like so:

          (user-account
            (name "alice")
            (group "users")
            (supplementary-groups '("wheel"   ; allow use of sudo, etc.
                                    "seat"    ; seat management
                                    "audio"   ; sound card
                                    "video"   ; video devices such as webcams
                                    "cdrom")) ; the good ol' CD-ROM
            (comment "Bob's sister"))

     Depending on your setup, you will have to not only add regular
     users, but also system users to this group. For instance, some
     greetd greeters require graphics and therefore also need to
     negotiate with seatd.

 -- Tipo de dados: seatd-configuration
     Configuration record for the seatd daemon service.

     ‘seatd’ (default: ‘seatd’)
          The seatd package to use.

     ‘group’ (default: ‘"seat"’)
          Group to own the seatd socket.

     ‘socket’ (default: ‘"/run/seatd.sock"’)
          Where to create the seatd socket.

     ‘logfile’ (default: ‘"/var/log/seatd.log"’)
          Log file to write to.

     ‘loglevel’ (default: ‘"error"’)
          Log level to output logs. Possible values: ‘"silent"’,
          ‘"error"’, ‘"info"’ and ‘"debug"’.

   ---------- Footnotes ----------

   (1) D-Bus (https://dbus.freedesktop.org/) is an inter-process
communication facility. Its system bus is used to allow system services
to communicate and to be notified of system-wide events.


File: guix.pt_BR.info,  Node: Serviços de som,  Next: File Search Services,  Prev: Serviços de desktop,  Up: Serviços

11.10.10 Serviços de som
------------------------

The ‘(gnu services sound)’ module provides a service to configure the
Advanced Linux Sound Architecture (ALSA) system, which makes PulseAudio
the preferred ALSA output driver.

 -- Variável: alsa-service-type
     This is the type for the Advanced Linux Sound Architecture
     (https://alsa-project.org/) (ALSA) system, which generates the
     ‘/etc/asound.conf’ configuration file. The value for this type is a
     ‘alsa-configuration’ record as in this example:

          (service alsa-service-type)

     See below for details about ‘alsa-configuration’.

 -- Tipo de dados: alsa-configuration
     Data type representing the configuration for ‘alsa-service’.

     ‘alsa-plugins’ (default: ALSA-PLUGINS)
          ‘alsa-plugins’ package to use.

     ‘pulseaudio?’ (default: #T)
          Whether ALSA applications should transparently be made to use
          the PulseAudio (https://www.pulseaudio.org/) sound server.

          Using PulseAudio allows you to run several sound-producing
          applications at the same time and to individual control them
          via ‘pavucontrol’, among other things.

     ‘extra-options’ (default: "")
          String to append to the ‘/etc/asound.conf’ file.

   Individual users who want to override the system configuration of
ALSA can do it with the ‘~/.asoundrc’ file:

     # In guix, we have to specify the absolute path for plugins.
     pcm_type.jack {
       lib "/home/alice/.guix-profile/lib/alsa-lib/libasound_module_pcm_jack.so"
     }

     # Routing ALSA to jack:
     # <http://jackaudio.org/faq/routing_alsa.html>.
     pcm.rawjack {
       type jack
       playback_ports {
         0 system:playback_1
         1 system:playback_2
       }

       capture_ports {
         0 system:capture_1
         1 system:capture_2
       }
     }

     pcm.!default {
       type plug
       slave {
         pcm "rawjack"
       }
     }

   See <https://www.alsa-project.org/main/index.php/Asoundrc> for the
details.

 -- Variável: pulseaudio-service-type
     This is the type for the PulseAudio (https://www.pulseaudio.org/)
     sound server. It exists to allow system overrides of the default
     settings via ‘pulseaudio-configuration’, see below.

          Aviso: This service overrides per-user configuration files. If
          you want PulseAudio to honor configuration files in
          ‘~/.config/pulse’, you have to unset the environment variables
          ‘PULSE_CONFIG’ and ‘PULSE_CLIENTCONFIG’ in your
          ‘~/.bash_profile’.

          Aviso: This service on its own does not ensure, that the
          ‘pulseaudio’ package exists on your machine. It merely adds
          configuration files for it, as detailed below. In the
          (admittedly unlikely) case, that you find yourself without a
          ‘pulseaudio’ package, consider enabling it through the
          ‘alsa-service-type’ above.

 -- Tipo de dados: pulseaudio-configuration
     Data type representing the configuration for ‘pulseaudio-service’.

     ‘client-conf’ (default: ‘'()’)
          List of settings to set in ‘client.conf’. Accepts a list of
          strings or symbol-value pairs. A string will be inserted as-is
          with a newline added. A pair will be formatted as “key =
          value”, again with a newline added.

     ‘daemon-conf’ (default: ‘'((flat-volumes . no))’)
          List of settings to set in ‘daemon.conf’, formatted just like
          CLIENT-CONF.

     ‘script-file’ (default: ‘(file-append pulseaudio "/etc/pulse/default.pa")’)
          Script file to use as ‘default.pa’. In case the
          ‘extra-script-files’ field below is used, an ‘.include’
          directive pointing to ‘/etc/pulse/default.pa.d’ is appended to
          the provided script.

     ‘extra-script-files’ (default: ‘'()’)
          A list of file-like objects defining extra PulseAudio scripts
          to run at the initialization of the ‘pulseaudio’ daemon, after
          the main ‘script-file’. The scripts are deployed to the
          ‘/etc/pulse/default.pa.d’ directory; they should have the
          ‘.pa’ file name extension. For a reference of the available
          commands, refer to ‘man pulse-cli-syntax’.

     ‘system-script-file’ (default: ‘(file-append pulseaudio "/etc/pulse/system.pa")’)
          Script file to use as ‘system.pa’.

     The example below sets the default PulseAudio card profile, the
     default sink and the default source to use for a old SoundBlaster
     Audigy sound card:
          (pulseaudio-configuration
           (extra-script-files
            (list (plain-file "audigy.pa"
                              (string-append "\
          set-card-profile alsa_card.pci-0000_01_01.0 \
            output:analog-surround-40+input:analog-mono
          set-default-source alsa_input.pci-0000_01_01.0.analog-mono
          set-default-sink alsa_output.pci-0000_01_01.0.analog-surround-40\n")))))

     Note that ‘pulseaudio-service-type’ is part of ‘%desktop-services’;
     if your operating system declaration was derived from one of the
     desktop templates, you’ll want to adjust the above example to
     modify the existing ‘pulseaudio-service-type’ via ‘modify-services’
     (*note ‘modify-services’: Referência de Service.), instead of
     defining a new one.

 -- Variável: ladspa-service-type
     This service sets the LADSPA_PATH variable, so that programs, which
     respect it, e.g. PulseAudio, can load LADSPA plugins.

     The following example will setup the service to enable modules from
     the ‘swh-plugins’ package:

          (service ladspa-service-type
                   (ladspa-configuration (plugins (list swh-plugins))))

     See <http://plugin.org.uk/ladspa-swh/docs/ladspa-swh.html> for the
     details.

Speaker Safety Daemon System Service
....................................

Speaker Safety Daemon (https://github.com/AsahiLinux/speakersafetyd) is
a user-space daemon that implements an analogue of the Texas Instruments
Smart Amp speaker protection model. It can be used to protect the
speakers on Apple Silicon devices.

 -- Variável: speakersafetyd-service-type
     This is the type for the ‘speakersafetyd’ system service, whose
     value is a ‘speakersafetyd-configuration’ record.

          (service speakersafetyd-service-type)

     See below for details about ‘speakersafetyd-configuration’.

 -- Data Type: speakersafetyd-configuration
     Available ‘speakersafetyd-configuration’ fields are:

     ‘blackbox-directory’ (default: ‘"/var/lib/speakersafetyd/blackbox"’) (type: string)
          The directory to which blackbox files are written when the
          speakers are getting too hot. The blackbox files contain audio
          and debug information which the developers of ‘speakersafetyd’
          might ask for when reporting bugs.

     ‘configuration-directory’ (type: file-like)
          The base directory as a G-expression (*note Expressões-G::)
          that contains the configuration files of the speaker models.

     ‘group’ (default: ‘"speakersafetyd"’) (type: string)
          The group to run the Speaker Safety Daemon as.

     ‘log-file’ (default: ‘"/var/log/speakersafetyd.log"’) (type: string)
          The file name to the Speaker Safety Daemon log file.

     ‘maximum-gain-reduction’ (default: ‘7’) (type: integer)
          Maximum gain reduction before panicking, useful for debugging.

     ‘speakersafetyd’ (default: ‘speakersafetyd’) (type: file-like)
          The Speaker Safety Daemon package to use.

     ‘user’ (default: ‘"speakersafetyd"’) (type: string)
          The user to run the Speaker Safety Daemon as.


File: guix.pt_BR.info,  Node: File Search Services,  Next: Serviços de bancos de dados,  Prev: Serviços de som,  Up: Serviços

11.10.11 File Search Services
-----------------------------

The services in this section populate “file databases” that let you
search for files on your machine. These services are provided by the
‘(gnu services admin)’ module.

   The first one, ‘file-database-service-type’, periodically runs the
venerable ‘updatedb’ command (*note (find)Invoking updatedb::). That
command populates a database of file names that you can then search with
the ‘locate’ command (*note (find)Invoking locate::), as in this
example:

     locate important-notes.txt

   You can enable this service with its default settings by adding this
snippet to your operating system services:

     (service file-database-service-type)

   This updates the database once a week, excluding files from
‘/gnu/store’—these are more usefully handled by ‘guix locate’ (*note
Invocando guix locate::). You can of course provide a custom
configuration, as described below.

 -- Variável: file-database-service-type
     This is the type of the file database service, which runs
     ‘updatedb’ periodically. Its associated value must be a
     ‘file-database-configuration’ record, as described below.

 -- Tipo de dados: file-database-configuration
     Record type for the ‘file-database-service-type’ configuration,
     with the following fields:

     ‘package’ (default: ‘findutils’)
          The package from which the ‘updatedb’ command is taken.
          Examples of such packages are GNU Findutils and Plocate.

     ‘schedule’ (default: ‘%default-file-database-update-schedule’)
          This is the schedule of database updates, expressed as a
          string in traditional cron syntax or as a gexp evaluating to a
          Shepherd calendar event (*note (shepherd)Timers::).

     ‘excluded-directories’ (default ‘%default-file-database-excluded-directories’)
          List of regular expressions of directories to ignore when
          building the file database. By default, this includes ‘/tmp’
          and ‘/gnu/store’; the latter should instead be indexed by
          ‘guix locate’ (*note Invocando guix locate::). This list is
          passed to the ‘--prunepaths’ option of ‘updatedb’ (*note
          (find)Invoking updatedb::).

   The second service, ‘package-database-service-type’, builds the
database used by ‘guix locate’, which lets you search for packages that
contain a given file (*note Invocando guix locate::). The service
periodically updates a system-wide database, which will be readily
available to anyone running ‘guix locate’ on the system. To use this
service with its default settings, add this snippet to your service
list:

     (service package-database-service-type)

   This will run ‘guix locate --update’ once a week.

 -- Variável: package-database-service-type
     This is the service type for periodic ‘guix locate’ updates (*note
     Invocando guix locate::). Its value must be a
     ‘package-database-configuration’ record, as shown below.

 -- Tipo de dados: package-database-configuration
     Data type to configure periodic package database updates. It has
     the following fields:

     ‘package’ (default: ‘guix’)
          The Guix package to use.

     ‘schedule’ (default: ‘%default-package-database-update-schedule’)
          This is the schedule of the periodic ‘guix locate --update’
          job, expressed as a string in traditional cron syntax or as a
          gexp evaluating to a Shepherd calendar event (*note
          (shepherd)Timers::).

     ‘method’ (default: ‘'store’)
          Indexing method for ‘guix locate’. The default value,
          ‘'store’, yields a more complete database but is relatively
          expensive in terms of CPU and input/output.

     ‘channels’ (default: ‘#~%default-channels’)
          G-exp denoting the channels to use when updating the database
          (*note Canais::).


File: guix.pt_BR.info,  Node: Serviços de bancos de dados,  Next: Serviços de correio,  Prev: File Search Services,  Up: Serviços

11.10.12 Serviços de bancos de dados
------------------------------------

The ‘(gnu services databases)’ module provides the following services.

PostgreSQL
..........

 -- Variável: postgresql-service-type
     The service type for the PostgreSQL database server. Its value
     should be a valid ‘postgresql-configuration’ object, documented
     below. The following example describes a PostgreSQL service with
     the default configuration.

          (service postgresql-service-type
                   (postgresql-configuration
                    (postgresql postgresql)))

     If the services fails to start, it may be due to an incompatible
     cluster already present in DATA-DIRECTORY. Adjust it (or, if you
     don’t need the cluster anymore, delete DATA-DIRECTORY), then
     restart the service.

     Peer authentication is used by default and the ‘postgres’ user
     account has no shell (unless ‘allow-login?’ is ‘#t’), which
     prevents the direct execution of ‘psql’ commands as this user. To
     use ‘psql’, you can temporarily log in as ‘postgres’ using a shell,
     create a PostgreSQL superuser with the same name as one of the
     system users and then create the associated database.

          sudo -u postgres -s /bin/sh
          createuser --interactive
          createdb $MY_USER_LOGIN      # Replace appropriately.

 -- Tipo de dados: postgresql-configuration
     Data type representing the configuration for the
     ‘postgresql-service-type’.

     ‘postgresql’
          PostgreSQL package to use for the service.

     ‘port’ (padrão: ‘5432’)
          Port on which PostgreSQL should listen.

     ‘locale’ (default: ‘"en_US.utf8"’)
          Locale to use as the default when creating the database
          cluster.

     ‘config-file’ (default: ‘(postgresql-config-file)’)
          The configuration file to use when running PostgreSQL. The
          default behaviour uses the postgresql-config-file record with
          the default values for the fields.

     ‘log-directory’ (default: ‘"/var/log/postgresql"’)
          The directory where ‘pg_ctl’ output will be written in a file
          named ‘"pg_ctl.log"’. This file can be useful to debug
          PostgreSQL configuration errors for instance.

     ‘data-directory’ (default: ‘"/var/lib/postgresql/data"’)
          Directory in which to store the data.

     ‘extension-packages’ (default: ‘'()’)
          Additional extensions are loaded from packages listed in
          EXTENSION-PACKAGES. Extensions are available at runtime. For
          instance, to create a geographic database using the ‘postgis’
          extension, a user can configure the postgresql-service as in
          this example:

               (use-package-modules databases geo)

               (operating-system
                 ...
                 ;; postgresql is required to run `psql' but postgis is not required for
                 ;; proper operation.
                 (packages (cons* postgresql %base-packages))
                 (services
                   (cons*
                     (service postgresql-service-type
                              (postgresql-configuration
                               (postgresql postgresql)
                               (extension-packages (list postgis))))
                     %base-services)))

          Then the extension becomes visible and you can initialise an
          empty geographic database in this way:

               psql -U postgres
               > create database postgistest;
               > \connect postgistest;
               > create extension postgis;
               > create extension postgis_topology;

          There is no need to add this field for contrib extensions such
          as hstore or dblink as they are already loadable by
          postgresql. This field is only required to add extensions
          provided by other packages.

     ‘create-account?’ (default: ‘#t’)
          Whether or not the ‘postgres’ user and group should be
          created.

     ‘allow-login?’ (default: ‘#f’)
          Whether or not to allow login into the created account.

     ‘home-directory’ (default: ‘"/var/empty"’)
          The home directory of the user. It is strongly advised to
          change this if you set ‘allow-login?’ to ‘#t’.

     ‘uid’ (padrão: ‘#f’)
          Explicitly specify the UID of the ‘postgres’ daemon account.
          You normally do not need to specify this, in which case a free
          UID will be automatically assigned.

          One situation where this option might be useful is if the
          DATA-DIRECTORY is located on a mounted network share.

     ‘gid’ (default: ‘#f’)
          Explicitly specify the GID of the ‘postgres’ group.

 -- Tipo de dados: postgresql-config-file
     Data type representing the PostgreSQL configuration file. As shown
     in the following example, this can be used to customize the
     configuration of PostgreSQL. Note that you can use any G-expression
     or filename in place of this record, if you already have a
     configuration file you’d like to use for example.

          (service postgresql-service-type
                   (postgresql-configuration
                    (config-file
                     (postgresql-config-file
                      (log-destination "stderr")
                      (hba-file
                       (plain-file "pg_hba.conf"
                                   "
          local	all	all			trust
          host	all	all	127.0.0.1/32 	md5
          host	all	all	::1/128 	md5"))
                      (extra-config
                       '(("session_preload_libraries"     "auto_explain")
                         ("random_page_cost"              2)
                         ("auto_explain.log_min_duration" "100 ms")
                         ("work_mem"                      "500 MB")
                         ("logging_collector"             #t)
                         ("log_directory"                 "/var/log/postgresql")))))))

     ‘log-destination’ (default: ‘"syslog"’)
          The logging method to use for PostgreSQL. Multiple values are
          accepted, separated by commas.

     ‘hba-file’ (default: ‘%default-postgres-hba’)
          Filename or G-expression for the host-based authentication
          configuration.

     ‘ident-file’ (default: ‘%default-postgres-ident’)
          Filename or G-expression for the user name mapping
          configuration.

     ‘socket-directory’ (default: ‘"/var/run/postgresql"’)
          Specifies the directory of the Unix-domain socket(s) on which
          PostgreSQL is to listen for connections from client
          applications. If set to ‘""’ PostgreSQL does not listen on any
          Unix-domain sockets, in which case only TCP/IP sockets can be
          used to connect to the server.

          By default, the ‘#false’ value means the PostgreSQL default
          value will be used, which is currently ‘/tmp’.

     ‘extra-config’ (default: ‘'()’)
          List of additional keys and values to include in the
          PostgreSQL config file. Each entry in the list should be a
          list where the first element is the key, and the remaining
          elements are the values.

          The values can be numbers, booleans or strings and will be
          mapped to PostgreSQL parameters types ‘Boolean’, ‘String’,
          ‘Numeric’, ‘Numeric with Unit’ and ‘Enumerated’ described here
          (https://www.postgresql.org/docs/current/config-setting.html).

 -- Variável: postgresql-role-service-type
     This service allows to create PostgreSQL roles and databases after
     PostgreSQL service start. Here is an example of its use.

          (service postgresql-role-service-type
                      (postgresql-role-configuration
                       (roles
                        (list (postgresql-role
                               (name "test")
                               (create-database? #t))))))

     This service can be extended with extra roles, as in this example:

          (service-extension postgresql-role-service-type
                             (const (list
                                     (postgresql-role
                                      (name "alice")
                                      (create-database? #t)))))

 -- Tipo de dados: postgresql-role
     PostgreSQL manages database access permissions using the concept of
     roles. A role can be thought of as either a database user, or a
     group of database users, depending on how the role is set up. Roles
     can own database objects (for example, tables) and can assign
     privileges on those objects to other roles to control who has
     access to which objects.

     ‘name’
          The role name.

     ‘permissions’ (default: ‘'(createdb login)’)
          The role permissions list. Supported permissions are
          ‘bypassrls’, ‘createdb’, ‘createrole’, ‘login’, ‘replication’
          and ‘superuser’.

     ‘create-database?’ (default: ‘#f’)
          whether to create a database with the same name as the role.

     ‘password-file’ (default: ‘#f’)
          A string representing the path of a file that contains the
          password to be set for the role.

     ‘encoding’ (default: ‘"UTF8"’)
          The character set to use for storing text in the database.

     ‘collation’ (default: ‘"en_US.utf8"’)
          The string sort order locale setting.

     ‘ctype’ (default: ‘"en_US.utf8"’)
          The character classification locale setting.

     ‘template’ (default: ‘"template1"’)
          The default template to copy the new database from when
          creating it. Use ‘"template0"’ for a pristine database with no
          system-local modifications.

 -- Tipo de dados: postgresql-role-configuration
     Data type representing the configuration of
     POSTGRESQL-ROLE-SERVICE-TYPE.

     ‘host’ (default: ‘"/var/run/postgresql"’)
          The PostgreSQL host to connect to.

     ‘log’ (default: ‘"/var/log/postgresql_roles.log"’)
          File name of the log file.

     ‘shepherd-requirement’ (default: ‘'(user-processes postgres)’)

          The Shepherd services dependencies to use. Add extra
          dependencies to
          ‘%default-postgresql-role-shepherd-requirement’ to extend its
          value.

     ‘roles’ (default: ‘'()’)
          The initial PostgreSQL roles to create.

MariaDB/MySQL
.............

 -- Variável: mysql-service-type
     This is the service type for a MySQL or MariaDB database server.
     Its value is a ‘mysql-configuration’ object that specifies which
     package to use, as well as various settings for the ‘mysqld’
     daemon.

 -- Tipo de dados: mysql-configuration
     Data type representing the configuration of MYSQL-SERVICE-TYPE.

     ‘mysql’ (default: MARIADB)
          Package object of the MySQL database server, can be either
          MARIADB or MYSQL.

          For MySQL, a temporary root password will be displayed at
          activation time. For MariaDB, the root password is empty.

     ‘bind-address’ (default: ‘"127.0.0.1"’)
          The IP on which to listen for network connections. Use
          ‘"0.0.0.0"’ to bind to all available network interfaces.

     ‘port’ (padrão: ‘3306’)
          TCP port on which the database server listens for incoming
          connections.

     ‘socket’ (default: ‘"/run/mysqld/mysqld.sock"’)
          Socket file to use for local (non-network) connections.

     ‘extra-content’ (default: ‘""’)
          Additional settings for the ‘my.cnf’ configuration file.

     ‘extra-environment’ (default: ‘#~'()’)
          List of environment variables passed to the ‘mysqld’ process.

     ‘auto-upgrade?’ (default: ‘#t’)
          Whether to automatically run ‘mysql_upgrade’ after starting
          the service. This is necessary to upgrade the “system schema”
          after “major” updates (such as switching from MariaDB 10.4 to
          10.5), but can be disabled if you would rather do that
          manually.

Memcached
.........

 -- Variável: memcached-service-type
     This is the service type for the Memcached (https://memcached.org/)
     service, which provides a distributed in memory cache. The value
     for the service type is a ‘memcached-configuration’ object.

     (service memcached-service-type)

 -- Tipo de dados: memcached-configuration
     Data type representing the configuration of memcached.

     ‘memcached’ (default: ‘memcached’)
          The Memcached package to use.

     ‘interfaces’ (default: ‘'("0.0.0.0")’)
          Network interfaces on which to listen.

     ‘tcp-port’ (default: ‘11211’)
          Port on which to accept connections.

     ‘udp-port’ (default: ‘11211’)
          Port on which to accept UDP connections on, a value of 0 will
          disable listening on a UDP socket.

     ‘additional-options’ (default: ‘'()’)
          Additional command line options to pass to ‘memcached’.

Redis
.....

Redis (https://redis.io/) is an in-memory data store used by millions of
developers as a cache, vector database, document database, streaming
engine, and message broker. Redis has built-in replication and different
levels of on-disk persistence. It supports complex data types (for
example, strings, hashes, lists, sets, sorted sets, and JSON), with
atomic operations defined on those data types.

 -- Variável: redis-service-type
     Type of the service that runs ‘redis’, an in-memory data store. The
     value for this service is a ‘<redis-configuration>’ object.

 -- Tipo de dados: redis-configuration
     Available ‘redis-configuration’ fields are:

     ‘redis’ (default: ‘redis’) (type: package)
          The Redis package to use.

     ‘bind’ (default: ‘"127.0.0.1"’) (type: string)
          Network interface on which to listen.

     ‘port’ (default: ‘6379’) (type: number)
          Port on which to accept connections on, a value of 0 will
          disable listening on a TCP socket.

     ‘working-directory’ (default: ‘"/var/lib/redis"’) (type: string)
          Directory in which to store the database and related files.

     ‘config-file’ (type: maybe-string)
          Default location for config file.


File: guix.pt_BR.info,  Node: Serviços de correio,  Next: Serviços de mensageria,  Prev: Serviços de bancos de dados,  Up: Serviços

11.10.13 Serviços de correio
----------------------------

The ‘(gnu services mail)’ module provides Guix service definitions for
email services: IMAP, POP3, and LMTP servers, as well as mail transport
agents (MTAs). Lots of acronyms! These services are detailed in the
subsections below.

Dovecot Service
...............

 -- Variável: dovecot-service-type
     Type for the service that runs the Dovecot IMAP/POP3/LMTP mail
     server, whose value is a ‘<dovecot-configuration>’ object.

   By default, Dovecot does not need much configuration; the default
configuration object created by ‘(dovecot-configuration)’ will suffice
if your mail is delivered to ‘~/Maildir’. A self-signed certificate will
be generated for TLS-protected connections, though Dovecot will also
listen on cleartext ports by default. There are a number of options,
though, which mail administrators might need to change, and as is the
case with other services, Guix allows the system administrator to
specify these parameters via a uniform Scheme interface.

   For example, to specify that mail is located at ‘maildir~/.mail’, one
would instantiate the Dovecot service like this:

     (service dovecot-service-type
              (dovecot-configuration
                (mail-location "maildir:~/.mail")))

   The available configuration parameters follow. Each parameter
definition is preceded by its type; for example, ‘string-list foo’
indicates that the ‘foo’ parameter should be specified as a list of
strings. There is also a way to specify the configuration as a string,
if you have an old ‘dovecot.conf’ file that you want to port over from
some other system; see the end for more details.

   Available ‘dovecot-configuration’ fields are:

 -- dovecot-configuration parameter: package dovecot
     The dovecot package.

 -- dovecot-configuration parameter: package-list extensions
     A list of additional Dovecot plugin packages to make available at
     runtime. During service activation, the ‘lib/dovecot’ directory
     from each specified package is combined with Dovecot’s core modules
     into a unified module directory.

     For example, to enable Sieve filtering:

          (extensions (list dovecot-pigeonhole))

     Each package in the list must provide its modules at ‘lib/dovecot’,
     as this is where ‘make-dovecot-moduledir’ expects to find its
     extensions. The service combines these directories to create a
     unified module structure.

     The default value is an empty list, providing only core Dovecot
     functionality.

 -- dovecot-configuration parameter: comma-separated-string-list listen
     A list of IPs or hosts where to listen for connections. ‘*’ listens
     on all IPv4 interfaces, ‘::’ listens on all IPv6 interfaces. If you
     want to specify non-default ports or anything more complex,
     customize the address and port fields of the ‘inet-listener’ of the
     specific services you are interested in.

 -- dovecot-configuration parameter: protocol-configuration-list
          protocols
     List of protocols we want to serve. Available protocols include
     ‘imap’, ‘pop3’, and ‘lmtp’.

     Available ‘protocol-configuration’ fields are:

      -- protocol-configuration parameter: string name
          The name of the protocol.

      -- protocol-configuration parameter: string auth-socket-path
          UNIX socket path to the master authentication server to find
          users. This is used by imap (for shared users) and lda. It
          defaults to ‘"/var/run/dovecot/auth-userdb"’.

      -- protocol-configuration parameter: boolean imap-metadata?
          Whether to enable the ‘IMAP METADATA’ extension as defined in
          RFC 5464 (https://tools.ietf.org/html/rfc5464), which provides
          a means for clients to set and retrieve per-mailbox, per-user
          metadata and annotations over IMAP.

          If this is ‘#t’, you must also specify a dictionary via the
          ‘mail-attribute-dict’ setting.

          Defaults to ‘#f’.

      -- protocol-configuration parameter: space-separated-string-list
               managesieve-notify-capabilities
          Which NOTIFY capabilities to report to clients that first
          connect to the ManageSieve service, before authentication.
          These may differ from the capabilities offered to
          authenticated users. If this field is left empty, report what
          the Sieve interpreter supports by default.

          Defaults to ‘'()’.

      -- protocol-configuration parameter: space-separated-string-list
               managesieve-sieve-capability
          Which SIEVE capabilities to report to clients that first
          connect to the ManageSieve service, before authentication.
          These may differ from the capabilities offered to
          authenticated users. If this field is left empty, report what
          the Sieve interpreter supports by default.

          Defaults to ‘'()’.

      -- protocol-configuration parameter: space-separated-string-list
               mail-plugins
          Space separated list of plugins to load.

      -- protocol-configuration parameter: non-negative-integer
               mail-max-userip-connections
          Maximum number of IMAP connections allowed for a user from
          each IP address. NOTE: The username is compared
          case-sensitively. Defaults to ‘10’.

 -- dovecot-configuration parameter: service-configuration-list services
     List of services to enable. Available services include ‘imap’,
     ‘imap-login’, ‘pop3’, ‘pop3-login’, ‘auth’, and ‘lmtp’.

     Available ‘service-configuration’ fields are:

      -- service-configuration parameter: string kind
          The service kind. Valid values include ‘director’,
          ‘imap-login’, ‘pop3-login’, ‘lmtp’, ‘imap’, ‘pop3’, ‘auth’,
          ‘auth-worker’, ‘dict’, ‘tcpwrap’, ‘quota-warning’, or anything
          else.

      -- service-configuration parameter: listener-configuration-list
               listeners
          Listeners for the service. A listener is either a
          ‘unix-listener-configuration’, a
          ‘fifo-listener-configuration’, or an
          ‘inet-listener-configuration’. Defaults to ‘'()’.

          Available ‘unix-listener-configuration’ fields are:

           -- unix-listener-configuration parameter: string path
               Path to the file, relative to ‘base-dir’ field. This is
               also used as the section name.

           -- unix-listener-configuration parameter: string mode
               The access mode for the socket. Defaults to ‘"0600"’.

           -- unix-listener-configuration parameter: string user
               The user to own the socket. Defaults to ‘""’.

           -- unix-listener-configuration parameter: string group
               The group to own the socket. Defaults to ‘""’.

          Available ‘fifo-listener-configuration’ fields are:

           -- fifo-listener-configuration parameter: string path
               Path to the file, relative to ‘base-dir’ field. This is
               also used as the section name.

           -- fifo-listener-configuration parameter: string mode
               The access mode for the socket. Defaults to ‘"0600"’.

           -- fifo-listener-configuration parameter: string user
               The user to own the socket. Defaults to ‘""’.

           -- fifo-listener-configuration parameter: string group
               The group to own the socket. Defaults to ‘""’.

          Available ‘inet-listener-configuration’ fields are:

           -- inet-listener-configuration parameter: string protocol
               The protocol to listen for.

           -- inet-listener-configuration parameter: string address
               The address on which to listen, or empty for all
               addresses. Defaults to ‘""’.

           -- inet-listener-configuration parameter:
                    non-negative-integer port
               The port on which to listen.

           -- inet-listener-configuration parameter: boolean ssl?
               Whether to use SSL for this service; ‘yes’, ‘no’, or
               ‘required’. Defaults to ‘#t’.

      -- service-configuration parameter: non-negative-integer
               client-limit
          Maximum number of simultaneous client connections per process.
          Once this number of connections is received, the next incoming
          connection will prompt Dovecot to spawn another process. If
          set to 0, ‘default-client-limit’ is used instead.

          Defaults to ‘0’.

      -- service-configuration parameter: non-negative-integer
               service-count
          Number of connections to handle before starting a new process.
          Typically the only useful values are 0 (unlimited) or 1. 1 is
          more secure, but 0 is faster. <doc/wiki/LoginProcess.txt>.
          Defaults to ‘1’.

      -- service-configuration parameter: non-negative-integer
               process-limit
          Maximum number of processes that can exist for this service.
          If set to 0, ‘default-process-limit’ is used instead.

          Defaults to ‘0’.

      -- service-configuration parameter: non-negative-integer
               process-min-avail
          Number of processes to always keep waiting for more
          connections. Defaults to ‘0’.

      -- service-configuration parameter: non-negative-integer vsz-limit
          If you set ‘service-count 0’, you probably need to grow this.
          Defaults to ‘256000000’.

 -- dovecot-configuration parameter: dict-configuration dict
     Dict configuration, as created by the ‘dict-configuration’
     constructor.

     Available ‘dict-configuration’ fields are:

      -- dict-configuration parameter: free-form-fields entries
          A list of key-value pairs that this dict should hold. Defaults
          to ‘'()’.

 -- dovecot-configuration parameter: passdb-configuration-list passdbs
     A list of passdb configurations, each one created by the
     ‘passdb-configuration’ constructor.

     Available ‘passdb-configuration’ fields are:

      -- passdb-configuration parameter: string driver
          The driver that the passdb should use. Valid values include
          ‘pam’, ‘passwd’, ‘shadow’, ‘bsdauth’, and ‘static’. Defaults
          to ‘"pam"’.

      -- passdb-configuration parameter: space-separated-string-list
               args
          Space separated list of arguments to the passdb driver.
          Defaults to ‘""’.

 -- dovecot-configuration parameter: userdb-configuration-list userdbs
     List of userdb configurations, each one created by the
     ‘userdb-configuration’ constructor.

     Available ‘userdb-configuration’ fields are:

      -- userdb-configuration parameter: string driver
          The driver that the userdb should use. Valid values include
          ‘passwd’ and ‘static’. Defaults to ‘"passwd"’.

      -- userdb-configuration parameter: space-separated-string-list
               args
          Space separated list of arguments to the userdb driver.
          Defaults to ‘""’.

      -- userdb-configuration parameter: free-form-args override-fields
          Override fields from passwd. Defaults to ‘'()’.

 -- dovecot-configuration parameter: plugin-configuration
          plugin-configuration
     Plug-in configuration, created by the ‘plugin-configuration’
     constructor.

 -- dovecot-configuration parameter: list-of-namespace-configuration
          namespaces
     List of namespaces. Each item in the list is created by the
     ‘namespace-configuration’ constructor.

     Available ‘namespace-configuration’ fields are:

      -- namespace-configuration parameter: string name
          Name for this namespace.

      -- namespace-configuration parameter: string type
          Namespace type: ‘private’, ‘shared’ or ‘public’. Defaults to
          ‘"private"’.

      -- namespace-configuration parameter: string separator
          Hierarchy separator to use. You should use the same separator
          for all namespaces or some clients get confused. ‘/’ is
          usually a good one. The default however depends on the
          underlying mail storage format. Defaults to ‘""’.

      -- namespace-configuration parameter: string prefix
          Prefix required to access this namespace. This needs to be
          different for all namespaces. For example ‘Public/’. Defaults
          to ‘""’.

      -- namespace-configuration parameter: string location
          Physical location of the mailbox. This is in the same format
          as mail_location, which is also the default for it. Defaults
          to ‘""’.

      -- namespace-configuration parameter: boolean inbox?
          There can be only one INBOX, and this setting defines which
          namespace has it. Defaults to ‘#f’.

      -- namespace-configuration parameter: boolean hidden?
          If namespace is hidden, it’s not advertised to clients via
          NAMESPACE extension. You’ll most likely also want to set
          ‘list? #f’. This is mostly useful when converting from another
          server with different namespaces which you want to deprecate
          but still keep working. For example you can create hidden
          namespaces with prefixes ‘~/mail/’, ‘~%u/mail/’ and ‘mail/’.
          Defaults to ‘#f’.

      -- namespace-configuration parameter: boolean list?
          Show the mailboxes under this namespace with the LIST command.
          This makes the namespace visible for clients that do not
          support the NAMESPACE extension. The special ‘children’ value
          lists child mailboxes, but hides the namespace prefix.
          Defaults to ‘#t’.

      -- namespace-configuration parameter: boolean subscriptions?
          Namespace handles its own subscriptions. If set to ‘#f’, the
          parent namespace handles them. The empty prefix should always
          have this as ‘#t’). Defaults to ‘#t’.

      -- namespace-configuration parameter: mailbox-configuration-list
               mailboxes
          List of predefined mailboxes in this namespace. Defaults to
          ‘'()’.

          Available ‘mailbox-configuration’ fields are:

           -- mailbox-configuration parameter: string name
               Name for this mailbox.

           -- mailbox-configuration parameter: string auto
               ‘create’ will automatically create this mailbox.
               ‘subscribe’ will both create and subscribe to the
               mailbox. Defaults to ‘"no"’.

           -- mailbox-configuration parameter:
                    space-separated-string-list special-use
               List of IMAP ‘SPECIAL-USE’ attributes as specified by RFC
               6154. Valid values are ‘\All’, ‘\Archive’, ‘\Drafts’,
               ‘\Flagged’, ‘\Junk’, ‘\Sent’, and ‘\Trash’. Defaults to
               ‘'()’.

 -- dovecot-configuration parameter: file-name base-dir
     Base directory where to store runtime data. Defaults to
     ‘"/var/run/dovecot/"’.

 -- dovecot-configuration parameter: string login-greeting
     Greeting message for clients. Defaults to ‘"Dovecot ready."’.

 -- dovecot-configuration parameter: space-separated-string-list
          login-trusted-networks
     List of trusted network ranges. Connections from these IPs are
     allowed to override their IP addresses and ports (for logging and
     for authentication checks). ‘disable-plaintext-auth’ is also
     ignored for these networks. Typically you would specify your IMAP
     proxy servers here. Defaults to ‘'()’.

 -- dovecot-configuration parameter: space-separated-string-list
          login-access-sockets
     List of login access check sockets (e.g. tcpwrap). Defaults to
     ‘'()’.

 -- dovecot-configuration parameter: boolean verbose-proctitle?
     Show more verbose process titles (in ps). Currently shows user name
     and IP address. Useful for seeing who is actually using the IMAP
     processes (e.g. shared mailboxes or if the same uid is used for
     multiple accounts). Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean shutdown-clients?
     Should all processes be killed when Dovecot master process shuts
     down. Setting this to ‘#f’ means that Dovecot can be upgraded
     without forcing existing client connections to close (although that
     could also be a problem if the upgrade is e.g. due to a security
     fix). Defaults to ‘#t’.

 -- dovecot-configuration parameter: non-negative-integer
          doveadm-worker-count
     If non-zero, run mail commands via this many connections to doveadm
     server, instead of running them directly in the same process.
     Defaults to ‘0’.

 -- dovecot-configuration parameter: string doveadm-socket-path
     UNIX socket or host:port used for connecting to doveadm server.
     Defaults to ‘"doveadm-server"’.

 -- dovecot-configuration parameter: space-separated-string-list
          import-environment
     List of environment variables that are preserved on Dovecot startup
     and passed down to all of its child processes. You can also give
     key=value pairs to always set specific settings.

 -- dovecot-configuration parameter: boolean disable-plaintext-auth?
     Disable LOGIN command and all other plaintext authentications
     unless SSL/TLS is used (LOGINDISABLED capability). Note that if the
     remote IP matches the local IP (i.e. you’re connecting from the
     same computer), the connection is considered secure and plaintext
     authentication is allowed. See also the ‘ssl=required’ setting.
     Defaults to ‘#t’.

 -- dovecot-configuration parameter: non-negative-integer
          auth-cache-size
     Authentication cache size (e.g. ‘#e10e6’). 0 means it’s disabled.
     Note that bsdauth, PAM and vpopmail require ‘cache-key’ to be set
     for caching to be used. Defaults to ‘0’.

 -- dovecot-configuration parameter: string auth-cache-ttl
     Time to live for cached data. After TTL expires the cached record
     is no longer used, *except* if the main database lookup returns
     internal failure. We also try to handle password changes
     automatically: If user’s previous authentication was successful,
     but this one wasn’t, the cache isn’t used. For now this works only
     with plaintext authentication. Defaults to ‘"1 hour"’.

 -- dovecot-configuration parameter: string auth-cache-negative-ttl
     TTL for negative hits (user not found, password mismatch). 0
     disables caching them completely. Defaults to ‘"1 hour"’.

 -- dovecot-configuration parameter: space-separated-string-list
          auth-realms
     List of realms for SASL authentication mechanisms that need them.
     You can leave it empty if you don’t want to support multiple
     realms. Many clients simply use the first one listed here, so keep
     the default realm first. Defaults to ‘'()’.

 -- dovecot-configuration parameter: string auth-default-realm
     Default realm/domain to use if none was specified. This is used for
     both SASL realms and appending @domain to username in plaintext
     logins. Defaults to ‘""’.

 -- dovecot-configuration parameter: string auth-username-chars
     List of allowed characters in username. If the user-given username
     contains a character not listed in here, the login automatically
     fails. This is just an extra check to make sure user can’t exploit
     any potential quote escaping vulnerabilities with SQL/LDAP
     databases. If you want to allow all characters, set this value to
     empty. Defaults to
     ‘"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@"’.

 -- dovecot-configuration parameter: string auth-username-translation
     Username character translations before it’s looked up from
     databases. The value contains series of from -> to characters. For
     example ‘#@/@’ means that ‘#’ and ‘/’ characters are translated to
     ‘@’. Defaults to ‘""’.

 -- dovecot-configuration parameter: string auth-username-format
     Username formatting before it’s looked up from databases. You can
     use the standard variables here, e.g. %Lu would lowercase the
     username, %n would drop away the domain if it was given, or
     ‘%n-AT-%d’ would change the ‘@’ into ‘-AT-’. This translation is
     done after ‘auth-username-translation’ changes. Defaults to
     ‘"%Lu"’.

 -- dovecot-configuration parameter: string auth-master-user-separator
     If you want to allow master users to log in by specifying the
     master username within the normal username string (i.e. not using
     SASL mechanism’s support for it), you can specify the separator
     character here. The format is then <username><separator><master
     username>. UW-IMAP uses ‘*’ as the separator, so that could be a
     good choice. Defaults to ‘""’.

 -- dovecot-configuration parameter: string auth-anonymous-username
     Username to use for users logging in with ANONYMOUS SASL mechanism.
     Defaults to ‘"anonymous"’.

 -- dovecot-configuration parameter: non-negative-integer
          auth-worker-max-count
     Maximum number of dovecot-auth worker processes. They’re used to
     execute blocking passdb and userdb queries (e.g. MySQL and PAM).
     They’re automatically created and destroyed as needed. Defaults to
     ‘30’.

 -- dovecot-configuration parameter: string auth-gssapi-hostname
     Host name to use in GSSAPI principal names. The default is to use
     the name returned by gethostname(). Use ‘$ALL’ (with quotes) to
     allow all keytab entries. Defaults to ‘""’.

 -- dovecot-configuration parameter: string auth-krb5-keytab
     Kerberos keytab to use for the GSSAPI mechanism. Will use the
     system default (usually ‘/etc/krb5.keytab’) if not specified. You
     may need to change the auth service to run as root to be able to
     read this file. Defaults to ‘""’.

 -- dovecot-configuration parameter: boolean auth-use-winbind?
     Do NTLM and GSS-SPNEGO authentication using Samba’s winbind daemon
     and ‘ntlm-auth’ helper.
     <doc/wiki/Authentication/Mechanisms/Winbind.txt>. Defaults to ‘#f’.

 -- dovecot-configuration parameter: file-name auth-winbind-helper-path
     Path for Samba’s ‘ntlm-auth’ helper binary. Defaults to
     ‘"/usr/bin/ntlm_auth"’.

 -- dovecot-configuration parameter: string auth-failure-delay
     Time to delay before replying to failed authentications. Defaults
     to ‘"2 secs"’.

 -- dovecot-configuration parameter: boolean
          auth-ssl-require-client-cert?
     Require a valid SSL client certificate or the authentication fails.
     Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean
          auth-ssl-username-from-cert?
     Take the username from client’s SSL certificate, using
     ‘X509_NAME_get_text_by_NID()’ which returns the subject’s DN’s
     CommonName. Defaults to ‘#f’.

 -- dovecot-configuration parameter: space-separated-string-list
          auth-mechanisms
     List of wanted authentication mechanisms. Supported mechanisms are:
     ‘plain’, ‘login’, ‘digest-md5’, ‘cram-md5’, ‘ntlm’, ‘rpa’, ‘apop’,
     ‘anonymous’, ‘gssapi’, ‘otp’, ‘skey’, and ‘gss-spnego’. See also
     the ‘disable-plaintext-auth’ setting.

 -- dovecot-configuration parameter: space-separated-string-list
          director-servers
     List of IPs or hostnames to all director servers, including
     ourself. Ports can be specified as ip:port. The default port is the
     same as what director service’s ‘inet-listener’ is using. Defaults
     to ‘'()’.

 -- dovecot-configuration parameter: space-separated-string-list
          director-mail-servers
     List of IPs or hostnames to all backend mail servers. Ranges are
     allowed too, like 10.0.0.10-10.0.0.30. Defaults to ‘'()’.

 -- dovecot-configuration parameter: string director-user-expire
     How long to redirect users to a specific server after it no longer
     has any connections. Defaults to ‘"15 min"’.

 -- dovecot-configuration parameter: string director-username-hash
     How the username is translated before being hashed. Useful values
     include %Ln if user can log in with or without @domain, %Ld if
     mailboxes are shared within domain. Defaults to ‘"%Lu"’.

 -- dovecot-configuration parameter: string log-path
     Log file to use for error messages. ‘syslog’ logs to syslog,
     ‘/dev/stderr’ logs to stderr. Defaults to ‘"syslog"’.

 -- dovecot-configuration parameter: string info-log-path
     Log file to use for informational messages. Defaults to ‘log-path’.
     Defaults to ‘""’.

 -- dovecot-configuration parameter: string debug-log-path
     Log file to use for debug messages. Defaults to ‘info-log-path’.
     Defaults to ‘""’.

 -- dovecot-configuration parameter: string syslog-facility
     Syslog facility to use if you’re logging to syslog. Usually if you
     don’t want to use ‘mail’, you’ll use local0..local7. Also other
     standard facilities are supported. Defaults to ‘"mail"’.

 -- dovecot-configuration parameter: boolean auth-verbose?
     Log unsuccessful authentication attempts and the reasons why they
     failed. Defaults to ‘#f’.

 -- dovecot-configuration parameter: string auth-verbose-passwords
     In case of password mismatches, log the attempted password. Valid
     values are no, plain and sha1. sha1 can be useful for detecting
     brute force password attempts vs. user simply trying the same
     password over and over again. You can also truncate the value to n
     chars by appending ":n" (e.g. sha1:6). Defaults to ‘"no"’.

 -- dovecot-configuration parameter: boolean auth-debug?
     Even more verbose logging for debugging purposes. Shows for example
     SQL queries. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean auth-debug-passwords?
     In case of password mismatches, log the passwords and used scheme
     so the problem can be debugged. Enabling this also enables
     ‘auth-debug’. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean mail-debug?
     Enable mail process debugging. This can help you figure out why
     Dovecot isn’t finding your mails. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean verbose-ssl?
     Show protocol level SSL errors. Defaults to ‘#f’.

 -- dovecot-configuration parameter: string log-timestamp
     Prefix for each line written to log file. % codes are in
     strftime(3) format. Defaults to ‘"\"%b %d %H:%M:%S \""’.

 -- dovecot-configuration parameter: space-separated-string-list
          login-log-format-elements
     List of elements we want to log. The elements which have a
     non-empty variable value are joined together to form a
     comma-separated string.

 -- dovecot-configuration parameter: string login-log-format
     Login log format. %s contains ‘login-log-format-elements’ string,
     %$ contains the data we want to log. Defaults to ‘"%$: %s"’.

 -- dovecot-configuration parameter: string mail-log-prefix
     Log prefix for mail processes. See doc/wiki/Variables.txt for list
     of possible variables you can use. Defaults to
     ‘"\"%s(%u)<%{pid}><%{session}>: \""’.

 -- dovecot-configuration parameter: string deliver-log-format
     Format to use for logging mail deliveries. You can use variables:
     ‘%$’
          Delivery status message (e.g. ‘saved to INBOX’)
     ‘%m’
          Mensagem-ID
     ‘%s’
          Assunto
     ‘%f’
          From address
     ‘%p’
          Physical size
     ‘%w’
          Virtual size.
     Defaults to ‘"msgid=%m: %$"’.

 -- dovecot-configuration parameter: string mail-location
     Location for users’ mailboxes. The default is empty, which means
     that Dovecot tries to find the mailboxes automatically. This won’t
     work if the user doesn’t yet have any mail, so you should
     explicitly tell Dovecot the full location.

     If you’re using mbox, giving a path to the INBOX file (e.g.
     ‘/var/mail/%u’) isn’t enough. You’ll also need to tell Dovecot
     where the other mailboxes are kept. This is called the _root mail
     directory_, and it must be the first path given in the
     ‘mail-location’ setting.

     There are a few special variables you can use, e.g.:

     ‘%u’
          nome de usuário
     ‘%n’
          user part in user@domain, same as %u if there’s no domain
     ‘%d’
          domain part in user@domain, empty if there’s no domain
     ‘%h’
          diretório pessoal

     See doc/wiki/Variables.txt for full list. Some examples:
     ‘maildir:~/Maildir’
     ‘mbox:~/mail:INBOX=/var/mail/%u’
     ‘mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%’
     Defaults to ‘""’.

 -- dovecot-configuration parameter: string mail-uid
     System user and group used to access mails. If you use multiple,
     userdb can override these by returning uid or gid fields. You can
     use either numbers or names. <doc/wiki/UserIds.txt>. Defaults to
     ‘""’.

 -- dovecot-configuration parameter: string mail-gid

     Defaults to ‘""’.

 -- dovecot-configuration parameter: string mail-privileged-group
     Group to enable temporarily for privileged operations. Currently
     this is used only with INBOX when either its initial creation or
     dotlocking fails. Typically this is set to ‘"mail"’ to give access
     to ‘/var/mail’. Defaults to ‘""’.

 -- dovecot-configuration parameter: string mail-access-groups
     Grant access to these supplementary groups for mail processes.
     Typically these are used to set up access to shared mailboxes. Note
     that it may be dangerous to set these if users can create symlinks
     (e.g. if ‘mail’ group is set here, ‘ln -s /var/mail ~/mail/var’
     could allow a user to delete others’ mailboxes, or ‘ln -s
     /secret/shared/box ~/mail/mybox’ would allow reading it). Defaults
     to ‘""’.

 -- dovecot-configuration parameter: string mail-attribute-dict
     The location of a dictionary used to store ‘IMAP METADATA’ as
     defined by RFC 5464 (https://tools.ietf.org/html/rfc5464).

     The IMAP METADATA commands are available only if the “imap”
     protocol configuration’s ‘imap-metadata?’ field is ‘#t’.

     Defaults to ‘""’.

 -- dovecot-configuration parameter: boolean
          mail-full-filesystem-access?
     Allow full file system access to clients. There’s no access checks
     other than what the operating system does for the active UID/GID.
     It works with both maildir and mboxes, allowing you to prefix
     mailboxes names with e.g. ‘/path/’ or ‘~user/’. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean mmap-disable?
     Don’t use ‘mmap()’ at all. This is required if you store indexes to
     shared file systems (NFS or clustered file system). Defaults to
     ‘#f’.

 -- dovecot-configuration parameter: boolean dotlock-use-excl?
     Rely on ‘O_EXCL’ to work when creating dotlock files. NFS supports
     ‘O_EXCL’ since version 3, so this should be safe to use nowadays by
     default. Defaults to ‘#t’.

 -- dovecot-configuration parameter: string mail-fsync
     When to use fsync() or fdatasync() calls:
     ‘optimized’
          Whenever necessary to avoid losing important data
     ‘always’
          Useful with e.g. NFS when ‘write()’s are delayed
     ‘never’
          Never use it (best performance, but crashes can lose data).
     Defaults to ‘"optimized"’.

 -- dovecot-configuration parameter: boolean mail-nfs-storage?
     Mail storage exists in NFS. Set this to yes to make Dovecot flush
     NFS caches whenever needed. If you’re using only a single mail
     server this isn’t needed. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean mail-nfs-index?
     Mail index files also exist in NFS. Setting this to yes requires
     ‘mmap-disable? #t’ and ‘fsync-disable? #f’. Defaults to ‘#f’.

 -- dovecot-configuration parameter: string lock-method
     Locking method for index files. Alternatives are fcntl, flock and
     dotlock. Dotlocking uses some tricks which may create more disk I/O
     than other locking methods. NFS users: flock doesn’t work, remember
     to change ‘mmap-disable’. Defaults to ‘"fcntl"’.

 -- dovecot-configuration parameter: file-name mail-temp-dir
     Directory in which LDA/LMTP temporarily stores incoming mails >128
     kB. Defaults to ‘"/tmp"’.

 -- dovecot-configuration parameter: non-negative-integer
          first-valid-uid
     Valid UID range for users. This is mostly to make sure that users
     can’t log in as daemons or other system users. Note that denying
     root logins is hardcoded to dovecot binary and can’t be done even
     if ‘first-valid-uid’ is set to 0. Defaults to ‘500’.

 -- dovecot-configuration parameter: non-negative-integer last-valid-uid

     Defaults to ‘0’.

 -- dovecot-configuration parameter: non-negative-integer
          first-valid-gid
     Valid GID range for users. Users having non-valid GID as primary
     group ID aren’t allowed to log in. If user belongs to supplementary
     groups with non-valid GIDs, those groups are not set. Defaults to
     ‘1’.

 -- dovecot-configuration parameter: non-negative-integer last-valid-gid

     Defaults to ‘0’.

 -- dovecot-configuration parameter: non-negative-integer
          mail-max-keyword-length
     Maximum allowed length for mail keyword name. It’s only forced when
     trying to create new keywords. Defaults to ‘50’.

 -- dovecot-configuration parameter: colon-separated-file-name-list
          valid-chroot-dirs
     List of directories under which chrooting is allowed for mail
     processes (i.e. ‘/var/mail’ will allow chrooting to
     ‘/var/mail/foo/bar’ too). This setting doesn’t affect
     ‘login-chroot’ ‘mail-chroot’ or auth chroot settings. If this
     setting is empty, ‘/./’ in home dirs are ignored. WARNING: Never
     add directories here which local users can modify, that may lead to
     root exploit. Usually this should be done only if you don’t allow
     shell access for users. <doc/wiki/Chrooting.txt>. Defaults to
     ‘'()’.

 -- dovecot-configuration parameter: string mail-chroot
     Default chroot directory for mail processes. This can be overridden
     for specific users in user database by giving ‘/./’ in user’s home
     directory (e.g. ‘/home/./user’ chroots into ‘/home’). Note that
     usually there is no real need to do chrooting, Dovecot doesn’t
     allow users to access files outside their mail directory anyway. If
     your home directories are prefixed with the chroot directory,
     append ‘/.’ to ‘mail-chroot’. <doc/wiki/Chrooting.txt>. Defaults to
     ‘""’.

 -- dovecot-configuration parameter: file-name auth-socket-path
     UNIX socket path to master authentication server to find users.
     This is used by imap (for shared users) and lda. Defaults to
     ‘"/var/run/dovecot/auth-userdb"’.

 -- dovecot-configuration parameter: file-name mail-plugin-dir
     Directory where to look up mail plugins. Defaults to
     ‘"/usr/lib/dovecot"’.

 -- dovecot-configuration parameter: space-separated-string-list
          mail-plugins
     List of plugins to load for all services. Plugins specific to IMAP,
     LDA, etc. are added to this list in their own .conf files. Defaults
     to ‘'()’.

 -- dovecot-configuration parameter: non-negative-integer
          mail-cache-min-mail-count
     The minimum number of mails in a mailbox before updates are done to
     cache file. This allows optimizing Dovecot’s behavior to do less
     disk writes at the cost of more disk reads. Defaults to ‘0’.

 -- dovecot-configuration parameter: string mailbox-idle-check-interval
     When IDLE command is running, mailbox is checked once in a while to
     see if there are any new mails or other changes. This setting
     defines the minimum time to wait between those checks. Dovecot can
     also use dnotify, inotify and kqueue to find out immediately when
     changes occur. Defaults to ‘"30 secs"’.

 -- dovecot-configuration parameter: boolean mail-save-crlf?
     Save mails with CR+LF instead of plain LF. This makes sending those
     mails take less CPU, especially with sendfile() syscall with Linux
     and FreeBSD. But it also creates a bit more disk I/O which may just
     make it slower. Also note that if other software reads the
     mboxes/maildirs, they may handle the extra CRs wrong and cause
     problems. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean maildir-stat-dirs?
     By default LIST command returns all entries in maildir beginning
     with a dot. Enabling this option makes Dovecot return only entries
     which are directories. This is done by stat()ing each entry, so it
     causes more disk I/O. (For systems setting struct ‘dirent->d_type’
     this check is free and it’s done always regardless of this
     setting). Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean
          maildir-copy-with-hardlinks?
     When copying a message, do it with hard links whenever possible.
     This makes the performance much better, and it’s unlikely to have
     any side effects. Defaults to ‘#t’.

 -- dovecot-configuration parameter: boolean maildir-very-dirty-syncs?
     Assume Dovecot is the only MUA accessing Maildir: Scan cur/
     directory only when its mtime changes unexpectedly or when we can’t
     find the mail otherwise. Defaults to ‘#f’.

 -- dovecot-configuration parameter: space-separated-string-list
          mbox-read-locks
     Which locking methods to use for locking mbox. There are four
     available:

     ‘dotlock’
          Create <mailbox>.lock file. This is the oldest and most
          NFS-safe solution. If you want to use /var/mail/ like
          directory, the users will need write access to that directory.
     ‘dotlock-try’
          Same as dotlock, but if it fails because of permissions or
          because there isn’t enough disk space, just skip it.
     ‘fcntl’
          Use this if possible. Works with NFS too if lockd is used.
     ‘flock’
          May not exist in all systems. Doesn’t work with NFS.
     ‘lockf’
          May not exist in all systems. Doesn’t work with NFS.

     You can use multiple locking methods; if you do the order they’re
     declared in is important to avoid deadlocks if other MTAs/MUAs are
     using multiple locking methods as well. Some operating systems
     don’t allow using some of them simultaneously.

 -- dovecot-configuration parameter: space-separated-string-list
          mbox-write-locks

 -- dovecot-configuration parameter: string mbox-lock-timeout
     Maximum time to wait for lock (all of them) before aborting.
     Defaults to ‘"5 mins"’.

 -- dovecot-configuration parameter: string mbox-dotlock-change-timeout
     If dotlock exists but the mailbox isn’t modified in any way,
     override the lock file after this much time. Defaults to ‘"2
     mins"’.

 -- dovecot-configuration parameter: boolean mbox-dirty-syncs?
     When mbox changes unexpectedly we have to fully read it to find out
     what changed. If the mbox is large this can take a long time. Since
     the change is usually just a newly appended mail, it’d be faster to
     simply read the new mails. If this setting is enabled, Dovecot does
     this but still safely fallbacks to re-reading the whole mbox file
     whenever something in mbox isn’t how it’s expected to be. The only
     real downside to this setting is that if some other MUA changes
     message flags, Dovecot doesn’t notice it immediately. Note that a
     full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK commands.
     Defaults to ‘#t’.

 -- dovecot-configuration parameter: boolean mbox-very-dirty-syncs?
     Like ‘mbox-dirty-syncs’, but don’t do full syncs even with SELECT,
     EXAMINE, EXPUNGE or CHECK commands. If this is set,
     ‘mbox-dirty-syncs’ is ignored. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean mbox-lazy-writes?
     Delay writing mbox headers until doing a full write sync (EXPUNGE
     and CHECK commands and when closing the mailbox). This is
     especially useful for POP3 where clients often delete all mails.
     The downside is that our changes aren’t immediately visible to
     other MUAs. Defaults to ‘#t’.

 -- dovecot-configuration parameter: non-negative-integer
          mbox-min-index-size
     If mbox size is smaller than this (e.g. 100k), don’t write index
     files. If an index file already exists it’s still read, just not
     updated. Defaults to ‘0’.

 -- dovecot-configuration parameter: non-negative-integer
          mdbox-rotate-size
     Maximum dbox file size until it’s rotated. Defaults to ‘10000000’.

 -- dovecot-configuration parameter: string mdbox-rotate-interval
     Maximum dbox file age until it’s rotated. Typically in days. Day
     begins from midnight, so 1d = today, 2d = yesterday, etc. 0 = check
     disabled. Defaults to ‘"1d"’.

 -- dovecot-configuration parameter: boolean mdbox-preallocate-space?
     When creating new mdbox files, immediately preallocate their size
     to ‘mdbox-rotate-size’. This setting currently works only in Linux
     with some file systems (ext4, xfs). Defaults to ‘#f’.

 -- dovecot-configuration parameter: string mail-attachment-dir
     sdbox and mdbox support saving mail attachments to external files,
     which also allows single instance storage for them. Other backends
     don’t support this for now.

     WARNING: This feature hasn’t been tested much yet. Use at your own
     risk.

     Directory root where to store mail attachments. Disabled, if empty.
     Defaults to ‘""’.

 -- dovecot-configuration parameter: non-negative-integer
          mail-attachment-min-size
     Attachments smaller than this aren’t saved externally. It’s also
     possible to write a plugin to disable saving specific attachments
     externally. Defaults to ‘128000’.

 -- dovecot-configuration parameter: string mail-attachment-fs
     File system backend to use for saving attachments:
     ‘posix’
          No SiS done by Dovecot (but this might help FS’s own
          deduplication)
     ‘sis posix’
          SiS with immediate byte-by-byte comparison during saving
     ‘sis-queue posix’
          SiS with delayed comparison and deduplication.
     Defaults to ‘"sis posix"’.

 -- dovecot-configuration parameter: string mail-attachment-hash
     Hash format to use in attachment filenames. You can add any text
     and variables: ‘%{md4}’, ‘%{md5}’, ‘%{sha1}’, ‘%{sha256}’,
     ‘%{sha512}’, ‘%{size}’. Variables can be truncated, e.g.
     ‘%{sha256:80}’ returns only first 80 bits. Defaults to ‘"%{sha1}"’.

 -- dovecot-configuration parameter: non-negative-integer
          default-process-limit

     Defaults to ‘100’.

 -- dovecot-configuration parameter: non-negative-integer
          default-client-limit

     Defaults to ‘1000’.

 -- dovecot-configuration parameter: non-negative-integer
          default-vsz-limit
     Default VSZ (virtual memory size) limit for service processes. This
     is mainly intended to catch and kill processes that leak memory
     before they eat up everything. Defaults to ‘256000000’.

 -- dovecot-configuration parameter: string default-login-user
     Login user is internally used by login processes. This is the most
     untrusted user in Dovecot system. It shouldn’t have access to
     anything at all. Defaults to ‘"dovenull"’.

 -- dovecot-configuration parameter: string default-internal-user
     Internal user is used by unprivileged processes. It should be
     separate from login user, so that login processes can’t disturb
     other processes. Defaults to ‘"dovecot"’.

 -- dovecot-configuration parameter: string ssl?
     SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>. Defaults to
     ‘"required"’.

 -- dovecot-configuration parameter: string ssl-cert
     PEM encoded X.509 SSL/TLS certificate (public key). Defaults to
     ‘"</etc/dovecot/default.pem"’.

 -- dovecot-configuration parameter: string ssl-key
     PEM encoded SSL/TLS private key. The key is opened before dropping
     root privileges, so keep the key file unreadable by anyone but
     root. Defaults to ‘"</etc/dovecot/private/default.pem"’.

 -- dovecot-configuration parameter: string ssl-key-password
     If key file is password protected, give the password here.
     Alternatively give it when starting dovecot with -p parameter.
     Since this file is often world-readable, you may want to place this
     setting instead to a different. Defaults to ‘""’.

 -- dovecot-configuration parameter: string ssl-ca
     PEM encoded trusted certificate authority. Set this only if you
     intend to use ‘ssl-verify-client-cert? #t’. The file should contain
     the CA certificate(s) followed by the matching CRL(s). (e.g.
     ‘ssl-ca </etc/ssl/certs/ca.pem’). Defaults to ‘""’.

 -- dovecot-configuration parameter: boolean ssl-require-crl?
     Require that CRL check succeeds for client certificates. Defaults
     to ‘#t’.

 -- dovecot-configuration parameter: boolean ssl-verify-client-cert?
     Request client to send a certificate. If you also want to require
     it, set ‘auth-ssl-require-client-cert? #t’ in auth section.
     Defaults to ‘#f’.

 -- dovecot-configuration parameter: string ssl-cert-username-field
     Which field from certificate to use for username. commonName and
     x500UniqueIdentifier are the usual choices. You’ll also need to set
     ‘auth-ssl-username-from-cert? #t’. Defaults to ‘"commonName"’.

 -- dovecot-configuration parameter: string ssl-min-protocol
     Minimum SSL protocol version to accept. Defaults to ‘"TLSv1"’.

 -- dovecot-configuration parameter: string ssl-cipher-list
     SSL ciphers to use. Defaults to
     ‘"ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH"’.

 -- dovecot-configuration parameter: string ssl-crypto-device
     SSL crypto device to use, for valid values run "openssl engine".
     Defaults to ‘""’.

 -- dovecot-configuration parameter: string postmaster-address
     Address to use when sending rejection mails. %d expands to
     recipient domain. Defaults to ‘"postmaster@%d"’.

 -- dovecot-configuration parameter: string hostname
     Hostname to use in various parts of sent mails (e.g. in Message-Id)
     and in LMTP replies. Default is the system’s real hostname@domain.
     Defaults to ‘""’.

 -- dovecot-configuration parameter: boolean quota-full-tempfail?
     If user is over quota, return with temporary failure instead of
     bouncing the mail. Defaults to ‘#f’.

 -- dovecot-configuration parameter: file-name sendmail-path
     Binary to use for sending mails. Defaults to
     ‘"/usr/sbin/sendmail"’.

 -- dovecot-configuration parameter: string submission-host
     If non-empty, send mails via this SMTP host[:port] instead of
     sendmail. Defaults to ‘""’.

 -- dovecot-configuration parameter: string rejection-subject
     Subject: header to use for rejection mails. You can use the same
     variables as for ‘rejection-reason’ below. Defaults to ‘"Rejected:
     %s"’.

 -- dovecot-configuration parameter: string rejection-reason
     Human readable error message for rejection mails. You can use
     variables:

     ‘%n’
          CRLF
     ‘%r’
          reason
     ‘%s’
          original subject
     ‘%t’
          destinatário
     Defaults to ‘"Your message to <%t> was automatically
     rejected:%n%r"’.

 -- dovecot-configuration parameter: string recipient-delimiter
     Delimiter character between local-part and detail in email address.
     Defaults to ‘"+"’.

 -- dovecot-configuration parameter: string
          lda-original-recipient-header
     Header where the original recipient address (SMTP’s RCPT TO:
     address) is taken from if not available elsewhere. With dovecot-lda
     -a parameter overrides this. A commonly used header for this is
     X-Original-To. Defaults to ‘""’.

 -- dovecot-configuration parameter: boolean lda-mailbox-autocreate?
     Should saving a mail to a nonexistent mailbox automatically create
     it?. Defaults to ‘#f’.

 -- dovecot-configuration parameter: boolean lda-mailbox-autosubscribe?
     Should automatically created mailboxes be also automatically
     subscribed?. Defaults to ‘#f’.

 -- dovecot-configuration parameter: non-negative-integer
          imap-max-line-length
     Maximum IMAP command line length. Some clients generate very long
     command lines with huge mailboxes, so you may need to raise this if
     you get "Too long argument" or "IMAP command line too large" errors
     often. Defaults to ‘64000’.

 -- dovecot-configuration parameter: string imap-logout-format
     IMAP logout format string:
     ‘%i’
          total number of bytes read from client
     ‘%o’
          total number of bytes sent to client.
     See ‘doc/wiki/Variables.txt’ for a list of all the variables you
     can use. Defaults to ‘"in=%i out=%o deleted=%{deleted}
     expunged=%{expunged} trashed=%{trashed}
     hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes}
     body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}"’.

 -- dovecot-configuration parameter: string imap-capability
     Override the IMAP CAPABILITY response. If the value begins with
     ’+’, add the given capabilities on top of the defaults (e.g. +XFOO
     XBAR). Defaults to ‘""’.

 -- dovecot-configuration parameter: string imap-idle-notify-interval
     How long to wait between "OK Still here" notifications when client
     is IDLEing. Defaults to ‘"2 mins"’.

 -- dovecot-configuration parameter: string imap-id-send
     ID field names and values to send to clients. Using * as the value
     makes Dovecot use the default value. The following fields have
     default values currently: name, version, os, os-version,
     support-url, support-email. Defaults to ‘""’.

 -- dovecot-configuration parameter: string imap-id-log
     ID fields sent by client to log. * means everything. Defaults to
     ‘""’.

 -- dovecot-configuration parameter: space-separated-string-list
          imap-client-workarounds
     Workarounds for various client bugs:

     ‘delay-newmail’
          Send EXISTS/RECENT new mail notifications only when replying
          to NOOP and CHECK commands. Some clients ignore them
          otherwise, for example OSX Mail (<v2.1). Outlook Express
          breaks more badly though, without this it may show user
          "Message no longer in server" errors. Note that OE6 still
          breaks even with this workaround if synchronization is set to
          "Headers Only".

     ‘tb-extra-mailbox-sep’
          Thunderbird gets somehow confused with LAYOUT=fs (mbox and
          dbox) and adds extra ‘/’ suffixes to mailbox names. This
          option causes Dovecot to ignore the extra ‘/’ instead of
          treating it as invalid mailbox name.

     ‘tb-lsub-flags’
          Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g.
          mbox). This makes Thunderbird realize they aren’t selectable
          and show them greyed out, instead of only later giving "not
          selectable" popup error.
     Defaults to ‘'()’.

 -- dovecot-configuration parameter: string imap-urlauth-host
     Host allowed in URLAUTH URLs sent by client. "*" allows all.
     Defaults to ‘""’.

   Whew! Lots of configuration options. The nice thing about it though
is that Guix has a complete interface to Dovecot’s configuration
language. This allows not only a nice way to declare configurations, but
also offers reflective capabilities as well: users can write code to
inspect and transform configurations from within Scheme.

   However, it could be that you just want to get a ‘dovecot.conf’ up
and running. In that case, you can pass an
‘opaque-dovecot-configuration’ as the ‘#:config’ parameter to
‘dovecot-service’. As its name indicates, an opaque configuration does
not have easy reflective capabilities.

   Available ‘opaque-dovecot-configuration’ fields are:

 -- opaque-dovecot-configuration parameter: package dovecot
     The dovecot package.

 -- opaque-dovecot-configuration parameter: string string
     The contents of the ‘dovecot.conf’, as a string.

   For example, if your ‘dovecot.conf’ is just the empty string, you
could instantiate a dovecot service like this:

     (dovecot-service #:config
                      (opaque-dovecot-configuration
                       (string "")))

OpenSMTPD Service
.................

 -- Variável: opensmtpd-service-type
     This is the type of the OpenSMTPD (https://www.opensmtpd.org)
     service, whose value should be an ‘opensmtpd-configuration’ object
     as in this example:

          (service opensmtpd-service-type
                   (opensmtpd-configuration
                     (config-file (local-file "./my-smtpd.conf"))))

 -- Tipo de dados: opensmtpd-configuration
     Data type representing the configuration of opensmtpd.

     ‘package’ (default: OPENSMTPD)
          Package object of the OpenSMTPD SMTP server.

     ‘shepherd-requirement’ (default: ‘'()’)
          This option can be used to provide a list of symbols naming
          Shepherd services that this service will depend on, such as
          ‘'networking’ if you want to configure OpenSMTPD to listen on
          non-loopback interfaces.

     ‘config-file’ (default: ‘%default-opensmtpd-config-file’)
          File-like object of the OpenSMTPD configuration file to use.
          By default it listens on the loopback network interface, and
          allows for mail from users and daemons on the local machine,
          as well as permitting email to remote servers. Run ‘man
          smtpd.conf’ for more information.

     ‘log-file’ (default: ‘"/var/log/mail.log"’)
          The file location for the OpenSMTPD log file. Logging occurs
          in the foreground via the Shepherd, i.e. OpenSMTPD does not
          detach. When set to ‘#f’ OpenSMTPD will instead detach and log
          to the syslog.

     ‘setgid-commands?’ (default: ‘#t’)
          Make the following commands setgid to ‘smtpq’ so they can be
          executed: ‘smtpctl’, ‘sendmail’, ‘send-mail’, ‘makemap’,
          ‘mailq’, and ‘newaliases’. *Note Privileged Programs::, for
          more information on setgid programs.

Exim Service
............

 -- Variável: exim-service-type
     This is the type of the Exim (https://exim.org) mail transfer agent
     (MTA), whose value should be an ‘exim-configuration’ object as in
     this example:

          (service exim-service-type
                   (exim-configuration
                     (config-file (local-file "./my-exim.conf"))))

   In order to use an ‘exim-service-type’ service you must also have a
‘mail-aliases-service-type’ service present in your ‘operating-system’
(even if it has no aliases).

 -- Tipo de dados: exim-configuration
     Data type representing the configuration of exim.

     ‘package’ (default: EXIM)
          Package object of the Exim server.

     ‘config-file’ (default: ‘#f’)
          File-like object of the Exim configuration file to use. If its
          value is ‘#f’ then use the default configuration file from the
          package provided in ‘package’. The resulting configuration
          file is loaded after setting the ‘exim_user’ and ‘exim_group’
          configuration variables.

Getmail service
...............

 -- Variável: getmail-service-type
     This is the type of the Getmail
     (http://pyropus.ca/software/getmail/) mail retriever, whose value
     should be a ‘getmail-configuration’.

   Available ‘getmail-configuration’ fields are:

 -- getmail-configuration parameter: symbol name
     A symbol to identify the getmail service.

     Defaults to ‘"unset"’.

 -- getmail-configuration parameter: package package
     The getmail package to use.

 -- getmail-configuration parameter: string user
     The user to run getmail as.

     Defaults to ‘"getmail"’.

 -- getmail-configuration parameter: string group
     The group to run getmail as.

     Defaults to ‘"getmail"’.

 -- getmail-configuration parameter: string directory
     The getmail directory to use.

     Defaults to ‘"/var/lib/getmail/default"’.

 -- getmail-configuration parameter: getmail-configuration-file rcfile
     The getmail configuration file to use.

     Available ‘getmail-configuration-file’ fields are:

      -- getmail-configuration-file parameter:
               getmail-retriever-configuration retriever
          What mail account to retrieve mail from, and how to access
          that account.

          Available ‘getmail-retriever-configuration’ fields are:

           -- getmail-retriever-configuration parameter: string type
               The type of mail retriever to use. Valid values include
               ‘passwd’ and ‘static’.

               Defaults to ‘"SimpleIMAPSSLRetriever"’.

           -- getmail-retriever-configuration parameter: string server
               Username to login to the mail server with.

               Defaults to ‘unset’.

           -- getmail-retriever-configuration parameter: string username
               Username to login to the mail server with.

               Defaults to ‘unset’.

           -- getmail-retriever-configuration parameter:
                    non-negative-integer port
               Port number to connect to.

               Defaults to ‘#f’.

           -- getmail-retriever-configuration parameter: string password
               Override fields from passwd.

               Defaults to ‘""’.

           -- getmail-retriever-configuration parameter: list
                    password-command
               Override fields from passwd.

               Defaults to ‘'()’.

           -- getmail-retriever-configuration parameter: string keyfile
               PEM-formatted key file to use for the TLS negotiation.

               Defaults to ‘""’.

           -- getmail-retriever-configuration parameter: string certfile
               PEM-formatted certificate file to use for the TLS
               negotiation.

               Defaults to ‘""’.

           -- getmail-retriever-configuration parameter: string ca-certs
               CA certificates to use.

               Defaults to ‘""’.

           -- getmail-retriever-configuration parameter: parameter-alist
                    extra-parameters
               Extra retriever parameters.

               Defaults to ‘'()’.

      -- getmail-configuration-file parameter:
               getmail-destination-configuration destination
          What to do with retrieved messages.

          Available ‘getmail-destination-configuration’ fields are:

           -- getmail-destination-configuration parameter: string type
               The type of mail destination. Valid values include
               ‘Maildir’, ‘Mboxrd’ and ‘MDA_external’.

               Defaults to ‘unset’.

           -- getmail-destination-configuration parameter:
                    string-or-filelike path
               The path option for the mail destination. The behaviour
               depends on the chosen type.

               Defaults to ‘""’.

           -- getmail-destination-configuration parameter:
                    parameter-alist extra-parameters
               Extra destination parameters

               Defaults to ‘'()’.

      -- getmail-configuration-file parameter:
               getmail-options-configuration options
          Configure getmail.

          Available ‘getmail-options-configuration’ fields are:

           -- getmail-options-configuration parameter:
                    non-negative-integer verbose
               If set to ‘0’, getmail will only print warnings and
               errors. A value of ‘1’ means that messages will be
               printed about retrieving and deleting messages. If set to
               ‘2’, getmail will print messages about each of its
               actions.

               Defaults to ‘1’.

           -- getmail-options-configuration parameter: boolean read-all
               If true, getmail will retrieve all available messages.
               Otherwise it will only retrieve messages it hasn’t seen
               previously.

               Defaults to ‘#t’.

           -- getmail-options-configuration parameter: boolean delete
               If set to true, messages will be deleted from the server
               after retrieving and successfully delivering them.
               Otherwise, messages will be left on the server.

               Defaults to ‘#f’.

           -- getmail-options-configuration parameter:
                    non-negative-integer delete-after
               Getmail will delete messages this number of days after
               seeing them, if they have been delivered. This means
               messages will be left on the server this number of days
               after delivering them. A value of ‘0’ disabled this
               feature.

               Defaults to ‘0’.

           -- getmail-options-configuration parameter:
                    non-negative-integer delete-bigger-than
               Delete messages larger than this of bytes after
               retrieving them, even if the delete and delete-after
               options are disabled. A value of ‘0’ disables this
               feature.

               Defaults to ‘0’.

           -- getmail-options-configuration parameter:
                    non-negative-integer max-bytes-per-session
               Retrieve messages totalling up to this number of bytes
               before closing the session with the server. A value of
               ‘0’ disables this feature.

               Defaults to ‘0’.

           -- getmail-options-configuration parameter:
                    non-negative-integer max-message-size
               Don’t retrieve messages larger than this number of bytes.
               A value of ‘0’ disables this feature.

               Defaults to ‘0’.

           -- getmail-options-configuration parameter: boolean
                    delivered-to
               If true, getmail will add a Delivered-To header to
               messages.

               Defaults to ‘#t’.

           -- getmail-options-configuration parameter: boolean received
               If set, getmail adds a Received header to the messages.

               Defaults to ‘#t’.

           -- getmail-options-configuration parameter: string
                    message-log
               Getmail will record a log of its actions to the named
               file. A value of ‘""’ disables this feature.

               Defaults to ‘""’.

           -- getmail-options-configuration parameter: boolean
                    message-log-syslog
               If true, getmail will record a log of its actions using
               the system logger.

               Defaults to ‘#f’.

           -- getmail-options-configuration parameter: boolean
                    message-log-verbose
               If true, getmail will log information about messages not
               retrieved and the reason for not retrieving them, as well
               as starting and ending information lines.

               Defaults to ‘#f’.

           -- getmail-options-configuration parameter: parameter-alist
                    extra-parameters
               Extra options to include.

               Defaults to ‘'()’.

 -- getmail-configuration parameter: list idle
     A list of mailboxes that getmail should wait on the server for new
     mail notifications. This depends on the server supporting the IDLE
     extension.

     Defaults to ‘'()’.

 -- getmail-configuration parameter: list environment-variables
     Environment variables to set for getmail.

     Defaults to ‘'()’.

Mail Aliases Service
....................

 -- Variável: mail-aliases-service-type
     This is the type of the service which provides ‘/etc/aliases’,
     specifying how to deliver mail to users on this system.

          (service mail-aliases-service-type
                   '(("postmaster" "bob")
                     ("bob" "bob@example.com" "bob@example2.com")))

   The configuration for a ‘mail-aliases-service-type’ service is an
association list denoting how to deliver mail that comes to this system.
Each entry is of the form ‘(alias addresses ...)’, with ‘alias’
specifying the local alias and ‘addresses’ specifying where to deliver
this user’s mail.

   The aliases aren’t required to exist as users on the local system. In
the above example, there doesn’t need to be a ‘postmaster’ entry in the
‘operating-system’’s ‘user-accounts’ in order to deliver the
‘postmaster’ mail to ‘bob’ (which subsequently would deliver mail to
‘bob@example.com’ and ‘bob@example2.com’).

GNU Mailutils IMAP4 Daemon
..........................

 -- Variável: imap4d-service-type
     This is the type of the GNU Mailutils IMAP4 Daemon (*note
     (mailutils)imap4d::), whose value should be an
     ‘imap4d-configuration’ object as in this example:

          (service imap4d-service-type
                   (imap4d-configuration
                     (config-file (local-file "imap4d.conf"))))

 -- Tipo de dados: imap4d-configuration
     Data type representing the configuration of ‘imap4d’.

     ‘package’ (default: ‘mailutils’)
          The package that provides ‘imap4d’.

     ‘config-file’ (default: ‘%default-imap4d-config-file’)
          File-like object of the configuration file to use, by default
          it will listen on TCP port 143 of ‘localhost’. *Note
          (mailutils)Conf-imap4d::, for details.

Radicale Service
................

 -- Variável: radicale-service-type
     This is the type of the Radicale (https://radicale.org)
     CalDAV/CardDAV server whose value should be a
     ‘radicale-configuration’. The default configuration matches the
     upstream documentation
     (https://radicale.org/v3.html#configuration).

 -- Tipo de dados: radicale-configuration
     Data type representing the configuration of ‘radicale’. Available
     ‘radicale-configuration’ fields are:

     ‘package’ (default: ‘radicale’) (type: package)
          Package that provides ‘radicale’.

     ‘auth’ (default: ‘'()’) (type: radicale-auth-configuration)
          Configuration for auth-related variables.

           -- Tipo de dados: radicale-auth-configuration
               Data type representing the ‘auth’ section of a ‘radicale’
               configuration file. Available
               ‘radicale-auth-configuration’ fields are:

               ‘type’ (default: ‘'none’) (type: symbol)
                    The method to verify usernames and passwords.
                    Options are ‘none’, ‘htpasswd’, ‘remote-user’, and
                    ‘http-x-remote-user’. This value is tied to
                    ‘htpasswd-filename’ and ‘htpasswd-encryption’.

               ‘htpasswd-filename’ (default: ‘"/etc/radicale/users"’) (type: file-name)
                    Path to the htpasswd file. Use htpasswd or similar
                    to generate this file.

               ‘htpasswd-encryption’ (default: ‘'md5’) (type: symbol)
                    Encryption method used in the htpasswd file. Options
                    are ‘plain’, ‘bcrypt’, and ‘md5’.

               ‘delay’ (default: ‘1’) (type: non-negative-integer)
                    Average delay after failed login attempts in
                    seconds.

               ‘realm’ (default: ‘"Radicale - Password Required"’) (type: string)
                    Message displayed in the client when a password is
                    needed.

     ‘encoding’ (default: ‘'()’) (type: radicale-encoding-configuration)
          Configuration for encoding-related variables.

           -- Tipo de dados: radicale-encoding-configuration
               Data type representing the ‘encoding’ section of a
               ‘radicale’ configuration file. Available
               ‘radicale-encoding-configuration’ fields are:

               ‘request’ (default: ‘'utf-8’) (type: symbol)
                    Encoding for responding requests.

               ‘stock’ (default: ‘'utf-8’) (type: symbol)
                    Encoding for storing local collections.

     ‘headers-file’ (default: none) (type: file-like)
          Custom HTTP headers.

     ‘logging’ (default: ‘'()’) (type: radicale-logging-configuration)
          Configuration for logging-related variables.

           -- Tipo de dados: radicale-logging-configuration
               Data type representing the ‘logging’ section of a
               ‘radicale’ configuration file. Available
               ‘radicale-logging-configuration’ fields are:

               ‘level’ (default: ‘'warning’) (type: symbol)
                    Set the logging level. One of ‘debug’, ‘info’,
                    ‘warning’, ‘error’, or ‘critical’.

               ‘mask-passwords?’ (default: ‘#t’) (type: boolean)
                    Whether to include passwords in logs.

     ‘rights’ (default: ‘'()’) (type: radicale-rights-configuration)
          Configuration for rights-related variables. This should be a
          ‘radicale-rights-configuration’.

           -- Tipo de dados: radicale-rights-configuration
               Data type representing the ‘rights’ section of a
               ‘radicale’ configuration file. Available
               ‘radicale-rights-configuration’ fields are:

               ‘type’ (default: ‘'owner-only’) (type: symbol)
                    Backend used to check collection access rights. The
                    recommended backend is ‘owner-only’. If access to
                    calendars and address books outside the home
                    directory of users is granted, clients won’t detect
                    these collections and will not show them to the
                    user. Choosing any other method is only useful if
                    you access calendars and address books directly via
                    URL. Options are ‘authenticate’, ‘owner-only’,
                    ‘owner-write’, and ‘from-file’.

               ‘file’ (default: ‘""’) (type: file-name)
                    File for the rights backend ‘from-file’.

     ‘server’ (default: ‘'()’) (type: radicale-server-configuration)
          Configuration for server-related variables. Ignored if WSGI is
          used.

           -- Tipo de dados: radicale-server-configuration
               Data type representing the ‘server’ section of a
               ‘radicale’ configuration file. Available
               ‘radicale-server-configuration’ fields are:

               ‘hosts’ (default: ‘(list "localhost:5232")’) (type: list-of-ip-addresses)
                    List of IP addresses that the server will bind to.

               ‘max-connections’ (default: ‘8’) (type: non-negative-integer)
                    Maximum number of parallel connections. Set to 0 to
                    disable the limit.

               ‘max-content-length’ (default: ‘100000000’) (type: non-negative-integer)
                    Maximum size of the request body in bytes.

               ‘timeout’ (default: ‘30’) (type: non-negative-integer)
                    Socket timeout in seconds.

               ‘ssl?’ (default: ‘#f’) (type: boolean)
                    Whether to enable transport layer encryption.

               ‘certificate’ (default: ‘"/etc/ssl/radicale.cert.pem"’) (type: file-name)
                    Path of the SSL certificate.

               ‘key’ (default: ‘"/etc/ssl/radicale.key.pem"’) (type: file-name)
                    Path to the private key for SSL. Only effective if
                    ‘ssl?’ is ‘#t’.

               ‘certificate-authority’ (default: ‘""’) (type: file-name)
                    Path to CA certificate for validating client
                    certificates. This can be used to secure TCP traffic
                    between Radicale and a reverse proxy. If you want to
                    authenticate users with client-side certificates,
                    you also have to write an authentication plugin that
                    extracts the username from the certificate.

     ‘storage’ (default: ‘'()’) (type: radicale-storage-configuration)
          Configuration for storage-related variables.

           -- Tipo de dados: radicale-storage-configuration
               Data type representing the ‘storage’ section of a
               ‘radicale’ configuration file. Available
               ‘radicale-storage-configuration’ fields are:

               ‘type’ (default: ‘'multifilesystem’) (type: symbol)
                    Backend used to store data. Options are
                    ‘multifilesystem’ and ‘multifilesystem-nolock’.

               ‘filesystem-folder’ (default: ‘"/var/lib/radicale/collections"’) (type: file-name)
                    Folder for storing local collections. Created if not
                    present.

               ‘max-sync-token-age’ (default: ‘2592000’) (type: non-negative-integer)
                    Delete sync-tokens that are older than the specified
                    time in seconds.

               ‘hook’ (default: ‘""’) (type: string)
                    Command run after changes to storage.

     ‘web-interface?’ (default: ‘#t’) (type: boolean)
          Whether to use Radicale’s built-in web interface.

Rspamd Service
..............

 -- Variável: rspamd-service-type
     This is the type of the Rspamd (https://rspamd.com/) filtering
     system whose value should be a ‘rspamd-configuration’.

 -- Tipo de dados: rspamd-configuration
     Available ‘rspamd-configuration’ fields are:

     ‘package’ (default: ‘rspamd’) (type: file-like)
          The package that provides rspamd.

     ‘config-file’ (default: ‘%default-rspamd-config-file’) (type: file-like)
          File-like object of the configuration file to use. By default
          all workers are enabled except fuzzy and they are bound to
          their usual ports, e.g localhost:11334, localhost:11333 and so
          on

     ‘local.d-files’ (default: ‘()’) (type: directory-tree)
          Configuration files in local.d, provided as a list of two
          element lists where the first element is the filename and the
          second one is a file-like object. Settings in these files will
          be merged with the defaults.

     ‘override.d-files’ (default: ‘()’) (type: directory-tree)
          Configuration files in override.d, provided as a list of two
          element lists where the first element is the filename and the
          second one is a file-like object. Settings in these files will
          override the defaults.

     ‘user’ (default: ‘%default-rspamd-account’) (type: user-account)
          The user to run rspamd as.

     ‘group’ (default: ‘%default-rspamd-group’) (type: user-group)
          The group to run rspamd as.

     ‘debug?’ (default: ‘#f’) (type: boolean)
          Force debug output.

     ‘insecure?’ (default: ‘#f’) (type: boolean)
          Ignore running workers as privileged users.

     ‘skip-template?’ (default: ‘#f’) (type: boolean)
          Do not apply Jinja templates.

     ‘shepherd-requirements’ (default: ‘(user-processes loopback)’) (type: list-of-symbols)
          This is a list of symbols naming Shepherd services that this
          service will depend on.

