diff options
| -rw-r--r-- | doc/forge.skb | 43 | ||||
| -rw-r--r-- | doc/snippets/acme-restart-nginx-sudoers.scm | 7 | ||||
| -rw-r--r-- | guix/forge/nginx.scm | 153 |
3 files changed, 203 insertions, 0 deletions
diff --git a/doc/forge.skb b/doc/forge.skb index c1c43c7..f230d2c 100644 --- a/doc/forge.skb +++ b/doc/forge.skb @@ -189,6 +189,49 @@ repeated below for your reference.]) :file "doc/snippets/tutorial.scm"))) (chapter :title [Services] :ident "chapter-services" + (section :title [forge nginx service] + :ident "section-forge-nginx-service" + (p [The forge nginx service is a wrapper around the nginx web +service in Guix upstream. It features] + (itemize + (item [automatic HTTPS for all sites through the ,(ref :ident +"section-acme-service" :text "ACME service")]) + (item [HTTP endpoint that redirects to HTTPS and responds to +ACME HTTP-01 challenges]) + (item [automatic provision of ,(ref :url +"https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" :text +(abbr :short "HSTS" :long "HTTP Strict Transport Security")) +headers]))) + (p [When using this service, you must allow the ,(samp [acme]) +user to restart nginx using ,(command [sudo]). This is so that newly +obtained certificates can be deployed to nginx. You may achieve this +with the following in the ,(code [sudoers-file]) field of your ,(code +[operating-system]) definition.] + (prog (source :language scheme + :file "doc/snippets/acme-restart-nginx-sudoers.scm") + :line #f)) + (description + (record-documentation "guix/forge/nginx.scm" '<forge-nginx-configuration> + (record-field "http-listen" + [Socket to listen on for HTTP requests. Socket may be a +,(record-ref "<forge-host-socket>"), ,(record-ref +"<forge-ip-socket>"), or ,(record-ref "<forge-unix-socket>") object.]) + (record-field "https-listen" + [Socket to listen on for HTTPS requests. Socket may be a +,(record-ref "<forge-host-socket>"), ,(record-ref +"<forge-ip-socket>"), or ,(record-ref "<forge-unix-socket>") object.]) + (record-field "acme-state-directory" + [State directory of the ,(ref :ident "section-acme-service" +:text "ACME service")]) + (record-field "acme-challenge-directory" + [Directory to serve on ,(samp +[/.well-known/acme-challenge/]) in response to ACME HTTP-01 +challenges]) + (record-field "server-blocks" + [List of ,(ref :url +"https://guix.gnu.org/manual/en/html_node/Web-Services.html#index-nginx_002dserver_002dconfiguration" +:text "<nginx-server-configuration>") objects describing server blocks +to add to the nginx configuration])))) (section :title [ACME service] :ident "section-acme-service" (p [,(abbr :short "ACME" :long "Automatic Certificate Management diff --git a/doc/snippets/acme-restart-nginx-sudoers.scm b/doc/snippets/acme-restart-nginx-sudoers.scm new file mode 100644 index 0000000..7f705b9 --- /dev/null +++ b/doc/snippets/acme-restart-nginx-sudoers.scm @@ -0,0 +1,7 @@ +(operating-system + … + (sudoers-file + (mixed-text-file "sudoers" + "@include " %sudoers-specification + "\nacme ALL = NOPASSWD: " (file-append shepherd "/bin/herd") " restart nginx\n")) + …) diff --git a/guix/forge/nginx.scm b/guix/forge/nginx.scm new file mode 100644 index 0000000..a1f99c2 --- /dev/null +++ b/guix/forge/nginx.scm @@ -0,0 +1,153 @@ +;;; guix-forge --- Guix software forge meta-service +;;; Copyright © 2023 Arun Isaac <arunisaac@systemreboot.net> +;;; +;;; This file is part of guix-forge. +;;; +;;; guix-forge is free software: you can redistribute it and/or modify +;;; it under the terms of the GNU General Public License as published +;;; by the Free Software Foundation, either version 3 of the License, +;;; or (at your option) any later version. +;;; +;;; guix-forge is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +;;; General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with guix-forge. If not, see +;;; <https://www.gnu.org/licenses/>. + +(define-module (forge nginx) + #:use-module (forge acme) + #:use-module (forge socket) + #:use-module ((gnu packages admin) #:select (shepherd)) + #:use-module (gnu services) + #:use-module (gnu services web) + #:use-module (guix gexp) + #:use-module (guix records) + #:use-module (ice-9 match) + #:use-module (srfi srfi-1) + #:export (<forge-nginx-configuration> + forge-nginx-configuration + forge-nginx-configuration? + forge-nginx-configuration-http-listen + forge-nginx-configuration-https-listen + forge-nginx-configuration-acme-state-directory + forge-nginx-configuration-acme-challenge-directory + forge-nginx-configuration-server-blocks + nginx-socket->string + forge-nginx-service-type)) + +(define-record-type* <forge-nginx-configuration> + forge-nginx-configuration make-forge-nginx-configuration + forge-nginx-configuration? + (http-listen forge-nginx-configuration-http-listen + (default (forge-ip-socket + (ip "0.0.0.0") + (port 80)))) + (https-listen forge-nginx-configuration-https-listen + (default (forge-ip-socket + (ip "0.0.0.0") + (port 443)))) + (acme-state-directory forge-nginx-configuration-acme-state-directory + (default "/var/lib/acme")) + (acme-challenge-directory forge-nginx-configuration-acme-challenge-directory + (default "/var/run/acme/acme-challenge")) + (server-blocks forge-nginx-configuration-server-blocks + (default '()))) + +(define (nginx-socket->string socket) + "Serialize @var{socket} to a string as expected by nginx +configuration (for example, in the @code{listen} and +@code{fastcgi_pass} directives)." + (match socket + (($ <forge-host-socket> hostname port) + (string-append hostname ":" (number->string port))) + (($ <forge-ip-socket> (or "0.0.0.0" "::") port) + (number->string port)) + (($ <forge-ip-socket> (? ipv4-address? ip) port) + (string-append ip ":" port)) + (($ <forge-ip-socket> (? ipv6-address? ip) port) + (string-append "[" ip "]" ":" port)) + (($ <forge-unix-socket> path) + (string-append "unix:" path)))) + +(define (forge-nginx-server-blocks config) + "Return list of nginx server blocks to provision for forge-web service +specified by @var{config}." + (match-record config <forge-nginx-configuration> + (http-listen https-listen acme-state-directory acme-challenge-directory server-blocks) + (cons (nginx-server-configuration + (listen (list (nginx-socket->string http-listen))) + (locations + (list (nginx-location-configuration + (uri "/.well-known/acme-challenge/") + ;; Without a trailing slash, a alias of /var/foo + ;; would lookup /bar at /var/foobar, not + ;; /var/foo/bar. So, a trailing slash is + ;; significant. Append it if not already + ;; present. Likewise, the trailing slash in + ;; "/.well-known/acme-challenge/" is also + ;; significant. + (body (list (string-append "alias " + (string-trim-right acme-challenge-directory #\/) + "/;")))) + (nginx-location-configuration + (uri "/") + ;; HTTP Strict Transport Security (HSTS) header as + ;; recommended by https://hstspreload.org + (body (list "add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";" + "return 301 https://$host$request_uri;")))))) + (map (lambda (server) + (match (nginx-server-configuration-server-name server) + ((name _ ...) + (nginx-server-configuration + (inherit server) + (listen (list (string-append (nginx-socket->string https-listen) + " ssl"))) + (ssl-certificate (string-append acme-state-directory + "/" name "/cert.pem")) + (ssl-certificate-key (string-append acme-state-directory + "/private/" name "/key.pem")))))) + server-blocks)))) + +(define %deploy-hook-gexp + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + + ;; Restart nginx. + ;; We cannot refer to sudo in the store since that sudo does + ;; not have the setuid bit set. See "(guix) Setuid Programs". + (invoke "/run/setuid-programs/sudo" + #$(file-append shepherd "/bin/herd") + "restart" + "nginx")))) + +(define (forge-nginx-acme-certificates config) + "Return list of @code{<acme-certificate>} blocks to provision for +forge-nginx service specified by @var{config}." + (match-record config <forge-nginx-configuration> + (server-blocks) + (map (lambda (server) + (acme-certificate + (domains (nginx-server-configuration-server-name server)) + (deploy-hook (program-file "forge-nginx-acme-deploy-hook" + %deploy-hook-gexp)))) + server-blocks))) + +(define forge-nginx-service-type + (service-type + (name 'forge-nginx) + (description "Run the forge-nginx web server.") + (extensions (list (service-extension nginx-service-type + forge-nginx-server-blocks) + (service-extension acme-service-type + forge-nginx-acme-certificates))) + (compose concatenate) + (extend (lambda (config server-blocks) + (forge-nginx-configuration + (inherit config) + (server-blocks (append (forge-nginx-configuration-server-blocks config) + server-blocks))))) + (default-value (forge-nginx-configuration)))) |