nginx: Add forge-nginx service.

* guix/forge/nginx.scm, doc/snippets/acme-restart-nginx-sudoers.scm:
New files.
* doc/forge.skb (Services)[forge nginx service]: Document the
forge-nginx service.

3 files changed, 203 insertions, 0 deletions

diff --git a/doc/forge.skb b/doc/forge.skb
index c1c43c7..f230d2c 100644
--- a/doc/forge.skb
+++ b/doc/forge.skb
@@ -189,6 +189,49 @@ repeated below for your reference.])
                   :file "doc/snippets/tutorial.scm")))
   (chapter :title [Services]
            :ident "chapter-services"
+    (section :title [forge nginx service]
+             :ident "section-forge-nginx-service"
+      (p [The forge nginx service is a wrapper around the nginx web
+service in Guix upstream. It features]
+         (itemize
+          (item [automatic HTTPS for all sites through the ,(ref :ident
+"section-acme-service" :text "ACME service")])
+          (item [HTTP endpoint that redirects to HTTPS and responds to
+ACME HTTP-01 challenges])
+          (item [automatic provision of ,(ref :url
+"https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" :text
+(abbr :short "HSTS" :long "HTTP Strict Transport Security"))
+headers])))
+      (p [When using this service, you must allow the ,(samp [acme])
+user to restart nginx using ,(command [sudo]). This is so that newly
+obtained certificates can be deployed to nginx. You may achieve this
+with the following in the ,(code [sudoers-file]) field of your ,(code
+[operating-system]) definition.]
+         (prog (source :language scheme
+                       :file "doc/snippets/acme-restart-nginx-sudoers.scm")
+               :line #f))
+      (description
+       (record-documentation "guix/forge/nginx.scm" '<forge-nginx-configuration>
+         (record-field "http-listen"
+           [Socket to listen on for HTTP requests. Socket may be a
+,(record-ref "<forge-host-socket>"), ,(record-ref
+"<forge-ip-socket>"), or ,(record-ref "<forge-unix-socket>") object.])
+         (record-field "https-listen"
+           [Socket to listen on for HTTPS requests. Socket may be a
+,(record-ref "<forge-host-socket>"), ,(record-ref
+"<forge-ip-socket>"), or ,(record-ref "<forge-unix-socket>") object.])
+         (record-field "acme-state-directory"
+           [State directory of the ,(ref :ident "section-acme-service"
+:text "ACME service")])
+         (record-field "acme-challenge-directory"
+           [Directory to serve on ,(samp
+[/.well-known/acme-challenge/]) in response to ACME HTTP-01
+challenges])
+         (record-field "server-blocks"
+           [List of ,(ref :url
+"https://guix.gnu.org/manual/en/html_node/Web-Services.html#index-nginx_002dserver_002dconfiguration"
+:text "<nginx-server-configuration>") objects describing server blocks
+to add to the nginx configuration]))))
     (section :title [ACME service]
              :ident "section-acme-service"
       (p [,(abbr :short "ACME" :long "Automatic Certificate Management
diff --git a/doc/snippets/acme-restart-nginx-sudoers.scm b/doc/snippets/acme-restart-nginx-sudoers.scm
new file mode 100644
index 0000000..7f705b9
--- /dev/null
+++ b/doc/snippets/acme-restart-nginx-sudoers.scm
@@ -0,0 +1,7 @@
+(operating-system
+  …
+  (sudoers-file
+   (mixed-text-file "sudoers"
+     "@include " %sudoers-specification
+     "\nacme ALL = NOPASSWD: " (file-append shepherd "/bin/herd") " restart nginx\n"))
+  …)
diff --git a/guix/forge/nginx.scm b/guix/forge/nginx.scm
new file mode 100644
index 0000000..a1f99c2
--- /dev/null
+++ b/guix/forge/nginx.scm
@@ -0,0 +1,153 @@
+;;; guix-forge --- Guix software forge meta-service
+;;; Copyright © 2023 Arun Isaac <arunisaac@systemreboot.net>
+;;;
+;;; This file is part of guix-forge.
+;;;
+;;; guix-forge is free software: you can redistribute it and/or modify
+;;; it under the terms of the GNU General Public License as published
+;;; by the Free Software Foundation, either version 3 of the License,
+;;; or (at your option) any later version.
+;;;
+;;; guix-forge is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;;; General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with guix-forge.  If not, see
+;;; <https://www.gnu.org/licenses/>.
+
+(define-module (forge nginx)
+  #:use-module (forge acme)
+  #:use-module (forge socket)
+  #:use-module ((gnu packages admin) #:select (shepherd))
+  #:use-module (gnu services)
+  #:use-module (gnu services web)
+  #:use-module (guix gexp)
+  #:use-module (guix records)
+  #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1)
+  #:export (<forge-nginx-configuration>
+            forge-nginx-configuration
+            forge-nginx-configuration?
+            forge-nginx-configuration-http-listen
+            forge-nginx-configuration-https-listen
+            forge-nginx-configuration-acme-state-directory
+            forge-nginx-configuration-acme-challenge-directory
+            forge-nginx-configuration-server-blocks
+            nginx-socket->string
+            forge-nginx-service-type))
+
+(define-record-type* <forge-nginx-configuration>
+  forge-nginx-configuration make-forge-nginx-configuration
+  forge-nginx-configuration?
+  (http-listen forge-nginx-configuration-http-listen
+               (default (forge-ip-socket
+                         (ip "0.0.0.0")
+                         (port 80))))
+  (https-listen forge-nginx-configuration-https-listen
+                (default (forge-ip-socket
+                          (ip "0.0.0.0")
+                          (port 443))))
+  (acme-state-directory forge-nginx-configuration-acme-state-directory
+                        (default "/var/lib/acme"))
+  (acme-challenge-directory forge-nginx-configuration-acme-challenge-directory
+                            (default "/var/run/acme/acme-challenge"))
+  (server-blocks forge-nginx-configuration-server-blocks
+                 (default '())))
+
+(define (nginx-socket->string socket)
+  "Serialize @var{socket} to a string as expected by nginx
+configuration (for example, in the @code{listen} and
+@code{fastcgi_pass} directives)."
+  (match socket
+    (($ <forge-host-socket> hostname port)
+     (string-append hostname ":" (number->string port)))
+    (($ <forge-ip-socket> (or "0.0.0.0" "::") port)
+     (number->string port))
+    (($ <forge-ip-socket> (? ipv4-address? ip) port)
+     (string-append ip ":" port))
+    (($ <forge-ip-socket> (? ipv6-address? ip) port)
+     (string-append "[" ip "]" ":" port))
+    (($ <forge-unix-socket> path)
+     (string-append "unix:" path))))
+
+(define (forge-nginx-server-blocks config)
+  "Return list of nginx server blocks to provision for forge-web service
+specified by @var{config}."
+  (match-record config <forge-nginx-configuration>
+    (http-listen https-listen acme-state-directory acme-challenge-directory server-blocks)
+    (cons (nginx-server-configuration
+           (listen (list (nginx-socket->string http-listen)))
+           (locations
+            (list (nginx-location-configuration
+                   (uri "/.well-known/acme-challenge/")
+                   ;; Without a trailing slash, a alias of /var/foo
+                   ;; would lookup /bar at /var/foobar, not
+                   ;; /var/foo/bar. So, a trailing slash is
+                   ;; significant. Append it if not already
+                   ;; present. Likewise, the trailing slash in
+                   ;; "/.well-known/acme-challenge/" is also
+                   ;; significant.
+                   (body (list (string-append "alias "
+                                              (string-trim-right acme-challenge-directory #\/)
+                                              "/;"))))
+                  (nginx-location-configuration
+                   (uri "/")
+                   ;; HTTP Strict Transport Security (HSTS) header as
+                   ;; recommended by https://hstspreload.org
+                   (body (list "add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";"
+                               "return 301 https://$host$request_uri;"))))))
+          (map (lambda (server)
+                 (match (nginx-server-configuration-server-name server)
+                   ((name _ ...)
+                    (nginx-server-configuration
+                     (inherit server)
+                     (listen (list (string-append (nginx-socket->string https-listen)
+                                                  " ssl")))
+                     (ssl-certificate (string-append acme-state-directory
+                                                     "/" name "/cert.pem"))
+                     (ssl-certificate-key (string-append acme-state-directory
+                                                         "/private/" name "/key.pem"))))))
+               server-blocks))))
+
+(define %deploy-hook-gexp
+  (with-imported-modules '((guix build utils))
+    #~(begin
+        (use-modules (guix build utils))
+
+        ;; Restart nginx.
+        ;; We cannot refer to sudo in the store since that sudo does
+        ;; not have the setuid bit set. See "(guix) Setuid Programs".
+        (invoke "/run/setuid-programs/sudo"
+                #$(file-append shepherd "/bin/herd")
+                "restart"
+                "nginx"))))
+
+(define (forge-nginx-acme-certificates config)
+  "Return list of @code{<acme-certificate>} blocks to provision for
+forge-nginx service specified by @var{config}."
+  (match-record config <forge-nginx-configuration>
+    (server-blocks)
+    (map (lambda (server)
+           (acme-certificate
+            (domains (nginx-server-configuration-server-name server))
+            (deploy-hook (program-file "forge-nginx-acme-deploy-hook"
+                                       %deploy-hook-gexp))))
+         server-blocks)))
+
+(define forge-nginx-service-type
+  (service-type
+   (name 'forge-nginx)
+   (description "Run the forge-nginx web server.")
+   (extensions (list (service-extension nginx-service-type
+                                        forge-nginx-server-blocks)
+                     (service-extension acme-service-type
+                                        forge-nginx-acme-certificates)))
+   (compose concatenate)
+   (extend (lambda (config server-blocks)
+             (forge-nginx-configuration
+              (inherit config)
+              (server-blocks (append (forge-nginx-configuration-server-blocks config)
+                                     server-blocks)))))
+   (default-value (forge-nginx-configuration))))