;;; guix-forge --- Guix software forge meta-service
;;; Copyright © 2023, 2025–2026 Arun Isaac <arunisaac@systemreboot.net>
;;;
;;; This file is part of guix-forge.
;;;
;;; guix-forge is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published
;;; by the Free Software Foundation, either version 3 of the License,
;;; or (at your option) any later version.
;;;
;;; guix-forge is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
;;; General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with guix-forge. If not, see
;;; <https://www.gnu.org/licenses/>.
(define-module (forge nginx)
#:use-module (forge acme)
#:use-module (forge anubis)
#:use-module (forge socket)
#:use-module ((gnu packages admin) #:select (shepherd))
#:use-module ((gnu packages web) #:select (nginx))
#:use-module (gnu services)
#:use-module (gnu services web)
#:use-module (guix packages)
#:use-module (guix gexp)
#:use-module (guix records)
#:use-module (guix utils)
#:use-module (ice-9 match)
#:use-module (srfi srfi-1)
#:export (<forge-nginx-configuration>
forge-nginx-configuration
forge-nginx-configuration?
forge-nginx-configuration-http-listen
forge-nginx-configuration-https-listen
forge-nginx-configuration-proxy-protocol-listen
forge-nginx-configuration-acme-state-directory
forge-nginx-configuration-acme-challenge-directory
forge-nginx-configuration-server-blocks
<forge-nginx-server-configuration>
forge-nginx-server-configuration
forge-nginx-server-configuration?
forge-nginx-server-configuration-server-name
forge-nginx-server-configuration-root
forge-nginx-server-configuration-locations
forge-nginx-server-configuration-index
forge-nginx-server-configuration-try-files
forge-nginx-server-configuration-anubis?
forge-nginx-server-configuration-raw-content
nginx-socket->string
socket->nginx-proxy-pass
forge-nginx-service-type))
(define-public nginx-with-auth-request
(package
(inherit nginx)
(arguments
(substitute-keyword-arguments (package-arguments nginx)
((#:configure-flags flags '())
#~(cons "--with-http_auth_request_module"
#$flags))))))
(define-record-type* <forge-nginx-configuration>
forge-nginx-configuration make-forge-nginx-configuration
forge-nginx-configuration?
(http-listen forge-nginx-configuration-http-listen
(default (forge-ip-socket
(ip "0.0.0.0")
(port 80))))
(https-listen forge-nginx-configuration-https-listen
(default (forge-ip-socket
(ip "0.0.0.0")
(port 443))))
(proxy-protocol-listen forge-nginx-configuration-proxy-protocol-listen
(default #f))
(acme-state-directory forge-nginx-configuration-acme-state-directory
(default "/var/lib/acme"))
(acme-challenge-directory forge-nginx-configuration-acme-challenge-directory
(default "/var/run/acme/acme-challenge"))
(server-blocks forge-nginx-configuration-server-blocks
(default '())))
(define-record-type* <forge-nginx-server-configuration>
forge-nginx-server-configuration make-forge-nginx-server-configuration
forge-nginx-server-configuration?
(server-name forge-nginx-server-configuration-server-name
(default (list 'default)))
(root forge-nginx-server-configuration-root
(default "/srv/http"))
(locations forge-nginx-server-configuration-locations
(default '()))
(index forge-nginx-server-configuration-index
(default (list "index.html")))
(try-files forge-nginx-server-configuration-try-files
(default '()))
(anubis? forge-nginx-server-configuration-anubis?
(default #f))
(raw-content forge-nginx-server-configuration-raw-content
(default '())))
(define (nginx-socket->string socket)
"Serialize @var{socket} to a string as expected by nginx
configuration (for example, in the @code{listen} and
@code{fastcgi_pass} directives)."
(match socket
(($ <forge-host-socket> hostname port)
(string-append hostname ":" (number->string port)))
(($ <forge-ip-socket> (or "0.0.0.0" "::") port)
(number->string port))
(($ <forge-ip-socket> (? ipv4-address? ip) port)
(string-append ip ":" (number->string port)))
(($ <forge-ip-socket> (? ipv6-address? ip) port)
(string-append "[" ip "]" ":" (number->string port)))
(($ <forge-unix-socket> path)
(string-append "unix:" path))))
(define (socket->nginx-proxy-pass socket)
"Serialize @var{socket}, a forge socket, to an nginx @code{proxy_pass}
directive."
(string-append
"proxy_pass "
(match socket
(($ <forge-host-socket> hostname port)
(string-append "http://" hostname ":" (number->string port)))
(($ <forge-ip-socket> (? ipv4-address? ip) port)
(string-append "http://" ip ":" (number->string port)))
(($ <forge-ip-socket> (? ipv6-address? ip) port)
(string-append "http://[" ip "]:" (number->string port)))
(($ <forge-unix-socket> path)
(string-append "http://unix:" path ":")))
";"))
(define (forge-nginx-configuration-coerced-server-blocks config)
"Return server blocks in @code{forge-nginx-configuration} @var{config}, all
coerced into @code{<forge-nginx-server-configuration>} objects."
(map (lambda (server)
(if (nginx-server-configuration? server)
(forge-nginx-server-configuration
(server-name (nginx-server-configuration-server-name server))
(root (nginx-server-configuration-root server))
(locations (nginx-server-configuration-locations server))
(index (nginx-server-configuration-index server))
(try-files (nginx-server-configuration-try-files server))
(raw-content (nginx-server-configuration-raw-content server)))
server))
(forge-nginx-configuration-server-blocks config)))
(define (anubis-locations anubis-socket)
;; This configuration is based on
;; https://anubis.techaro.lol/docs/admin/configuration/subrequest-auth
(list (nginx-location-configuration
;; Reverse proxy to Anubis for authorization and challenges. This
;; location cannot be internal because clients need to request
;; challenge pages.
(uri "/.within.website/")
(body (list (socket->nginx-proxy-pass anubis-socket)
"proxy_set_header X-Real-IP $remote_addr;"
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;"
"proxy_set_header Host $http_host;"
"proxy_pass_request_body off;"
"proxy_set_header Content-Length \"\";")))
;; Redirect to Anubis challenge if authorization failed. We may be
;; listening locally on a non-standard port; do not expose that to the
;; end user.
(nginx-named-location-configuration
(name "redirectToAnubis")
(body (list "port_in_redirect off;"
"return 307 /.within.website/?redir=$scheme://$host$request_uri;")))))
(define (forge-nginx-server-blocks config)
"Return list of nginx server blocks to provision for forge-web service
specified by @var{config}."
(match-record config <forge-nginx-configuration>
(http-listen https-listen proxy-protocol-listen acme-state-directory acme-challenge-directory)
(cons (nginx-server-configuration
(listen (list (nginx-socket->string http-listen)))
(locations
(list (nginx-location-configuration
(uri "/.well-known/acme-challenge/")
;; Without a trailing slash, an alias of /var/foo would
;; lookup /bar at /var/foobar, not /var/foo/bar. So, a
;; trailing slash is significant. Append it if not already
;; present. Likewise, the trailing slash in
;; "/.well-known/acme-challenge/" is also significant.
(body (list (string-append "alias "
(string-trim-right acme-challenge-directory #\/)
"/;"))))
(nginx-location-configuration
(uri "/")
;; HTTP Strict Transport Security (HSTS) header as
;; recommended by https://hstspreload.org
(body (list "add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";"
"return 301 https://$host$request_uri;"))))))
(map (match-record-lambda <forge-nginx-server-configuration>
(server-name root locations index try-files anubis? raw-content)
(match server-name
((name _ ...)
(nginx-server-configuration
(listen (cons (string-append (nginx-socket->string https-listen)
" ssl")
(if proxy-protocol-listen
(list (string-append (nginx-socket->string proxy-protocol-listen)
" ssl proxy_protocol"))
(list))))
(server-name server-name)
(root root)
(locations
(if anubis?
(append (anubis-locations (forge-unix-socket
(path %anubis-unix-socket)))
locations)
locations))
(index index)
(try-files try-files)
(ssl-certificate (string-append acme-state-directory
"/" name "/cert.pem"))
(ssl-certificate-key (string-append acme-state-directory
"/private/" name "/key.pem"))
(raw-content raw-content)))))
(forge-nginx-configuration-coerced-server-blocks config)))))
(define %deploy-hook-gexp
(with-imported-modules '((guix build utils))
#~(begin
(use-modules (guix build utils))
;; Restart nginx.
;; We cannot refer to sudo in the store since that sudo does
;; not have the setuid bit set. See "(guix) Setuid Programs".
(invoke "/run/setuid-programs/sudo"
#$(file-append shepherd "/bin/herd")
"restart"
"nginx"))))
(define (forge-nginx-acme-certificates config)
"Return list of @code{<acme-certificate>} blocks to provision for
forge-nginx service specified by @var{config}."
(map (lambda (server)
(acme-certificate
(domains (forge-nginx-server-configuration-server-name server))
(deploy-hook (program-file "forge-nginx-acme-deploy-hook"
%deploy-hook-gexp))))
(forge-nginx-configuration-coerced-server-blocks config)))
(define forge-nginx-service-type
(service-type
(name 'forge-nginx)
(description "Run the forge-nginx web server.")
(extensions (list (service-extension nginx-service-type
forge-nginx-server-blocks)
(service-extension acme-service-type
forge-nginx-acme-certificates)
(service-extension anubis-service-type
(const #t))))
(compose concatenate)
(extend (lambda (config server-blocks)
(forge-nginx-configuration
(inherit config)
(server-blocks (append (forge-nginx-configuration-server-blocks config)
server-blocks)))))
(default-value (forge-nginx-configuration))))
