diff options
| -rw-r--r-- | doc/forge.skb | 30 | ||||
| -rw-r--r-- | guix/forge/nginx.scm | 92 |
2 files changed, 96 insertions, 26 deletions
diff --git a/doc/forge.skb b/doc/forge.skb index f63b469..c628fde 100644 --- a/doc/forge.skb +++ b/doc/forge.skb @@ -394,10 +394,34 @@ be a ,(record-ref "<forge-host-socket>"), ,(record-ref "<forge-ip-socket>"), or [/.well-known/acme-challenge/]) in response to ACME HTTP-01 challenges]) (record-field "server-blocks" - [List of ,(ref :url + [List of ,(ref :ident "<forge-nginx-server-configuration>" :text +"<forge-nginx-server-configuration>") or ,(ref :url "https://guix.gnu.org/manual/en/html_node/Web-Services.html#index-nginx_002dserver_002dconfiguration" -:text "<nginx-server-configuration>") objects describing server blocks -to add to the nginx configuration])))) +:text "<nginx-server-configuration>") objects describing server blocks to add to +the nginx configuration])) + (record-documentation "guix/forge/nginx.scm" '<forge-nginx-server-configuration> + (record-field "server-name" + [List of server names this server represents. ,(code ['default]) +represents the default server for connections matching no other server.]) + (record-field "root" + [Root of the website nginx will serve]) + (record-field "locations" + [List of ,(ref :url +"https://guix.gnu.org/manual/devel/en/html_node/Web-Services.html#index-nginx_002dlocation_002dconfiguration" +:text (code [nginx-location-configuration])) or ,(ref :url +"https://guix.gnu.org/manual/devel/en/html_node/Web-Services.html#index-nginx_002dnamed_002dlocation_002dconfiguration" +:text (code [nginx-named-location-configuration])) records to use within this +server block.]) + (record-field "index" + [List of index files to look for when clients ask for a directory. If it +cannot be found, nginx will send the list of files in the directory.]) + (record-field "try-files" + [List of files whose existence is checked in the specified order. +nginx will use the first file it finds to process the request.]) + (record-field "raw-content" + [List of strings or file-like objects to be appended to the server +block. Each item is prefixed with indentation and suffixed with a new line. +Nested lists are flattened.])))) (section :title [ACME service] :ident "section-acme-service" (p [,(abbr :short "ACME" :long "Automatic Certificate Management diff --git a/guix/forge/nginx.scm b/guix/forge/nginx.scm index 69bcb31..518969c 100644 --- a/guix/forge/nginx.scm +++ b/guix/forge/nginx.scm @@ -36,6 +36,17 @@ forge-nginx-configuration-acme-state-directory forge-nginx-configuration-acme-challenge-directory forge-nginx-configuration-server-blocks + + <forge-nginx-server-configuration> + forge-nginx-server-configuration + forge-nginx-server-configuration? + forge-nginx-server-configuration-server-name + forge-nginx-server-configuration-root + forge-nginx-server-configuration-locations + forge-nginx-server-configuration-index + forge-nginx-server-configuration-try-files + forge-nginx-server-configuration-raw-content + nginx-socket->string socket->nginx-proxy-pass forge-nginx-service-type)) @@ -60,6 +71,22 @@ (server-blocks forge-nginx-configuration-server-blocks (default '()))) +(define-record-type* <forge-nginx-server-configuration> + forge-nginx-server-configuration make-forge-nginx-server-configuration + forge-nginx-server-configuration? + (server-name forge-nginx-server-configuration-server-name + (default (list 'default))) + (root forge-nginx-server-configuration-root + (default "/srv/http")) + (locations forge-nginx-server-configuration-locations + (default '())) + (index forge-nginx-server-configuration-index + (default (list "index.html"))) + (try-files forge-nginx-server-configuration-try-files + (default '())) + (raw-content forge-nginx-server-configuration-raw-content + (default '()))) + (define (nginx-socket->string socket) "Serialize @var{socket} to a string as expected by nginx configuration (for example, in the @code{listen} and @@ -92,11 +119,26 @@ directive." (string-append "http://unix:" path ":"))) ";")) +(define (forge-nginx-configuration-coerced-server-blocks config) + "Return server blocks in @code{forge-nginx-configuration} @var{config}, all +coerced into @code{<forge-nginx-server-configuration>} objects." + (map (lambda (server) + (if (nginx-server-configuration? server) + (forge-nginx-server-configuration + (server-name (nginx-server-configuration-server-name server)) + (root (nginx-server-configuration-root server)) + (locations (nginx-server-configuration-locations server)) + (index (nginx-server-configuration-index server)) + (try-files (nginx-server-configuration-try-files server)) + (raw-content (nginx-server-configuration-raw-content server))) + server)) + (forge-nginx-configuration-server-blocks config))) + (define (forge-nginx-server-blocks config) "Return list of nginx server blocks to provision for forge-web service specified by @var{config}." (match-record config <forge-nginx-configuration> - (http-listen https-listen proxy-protocol-listen acme-state-directory acme-challenge-directory server-blocks) + (http-listen https-listen proxy-protocol-listen acme-state-directory acme-challenge-directory) (cons (nginx-server-configuration (listen (list (nginx-socket->string http-listen))) (locations @@ -118,22 +160,28 @@ specified by @var{config}." ;; recommended by https://hstspreload.org (body (list "add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";" "return 301 https://$host$request_uri;")))))) - (map (lambda (server) - (match (nginx-server-configuration-server-name server) + (map (match-record-lambda <forge-nginx-server-configuration> + (server-name root locations index try-files anubis-uri-prefix raw-content) + (match server-name ((name _ ...) (nginx-server-configuration - (inherit server) - (listen (cons (string-append (nginx-socket->string https-listen) - " ssl") - (if proxy-protocol-listen - (list (string-append (nginx-socket->string proxy-protocol-listen) - " ssl proxy_protocol")) - (list)))) - (ssl-certificate (string-append acme-state-directory - "/" name "/cert.pem")) - (ssl-certificate-key (string-append acme-state-directory - "/private/" name "/key.pem")))))) - server-blocks)))) + (listen (cons (string-append (nginx-socket->string https-listen) + " ssl") + (if proxy-protocol-listen + (list (string-append (nginx-socket->string proxy-protocol-listen) + " ssl proxy_protocol")) + (list)))) + (server-name server-name) + (root root) + (locations locations) + (index index) + (try-files try-files) + (ssl-certificate (string-append acme-state-directory + "/" name "/cert.pem")) + (ssl-certificate-key (string-append acme-state-directory + "/private/" name "/key.pem")) + (raw-content raw-content))))) + (forge-nginx-configuration-coerced-server-blocks config))))) (define %deploy-hook-gexp (with-imported-modules '((guix build utils)) @@ -151,14 +199,12 @@ specified by @var{config}." (define (forge-nginx-acme-certificates config) "Return list of @code{<acme-certificate>} blocks to provision for forge-nginx service specified by @var{config}." - (match-record config <forge-nginx-configuration> - (server-blocks) - (map (lambda (server) - (acme-certificate - (domains (nginx-server-configuration-server-name server)) - (deploy-hook (program-file "forge-nginx-acme-deploy-hook" - %deploy-hook-gexp)))) - server-blocks))) + (map (lambda (server) + (acme-certificate + (domains (forge-nginx-server-configuration-server-name server)) + (deploy-hook (program-file "forge-nginx-acme-deploy-hook" + %deploy-hook-gexp)))) + (forge-nginx-configuration-coerced-server-blocks config))) (define forge-nginx-service-type (service-type |