1 files changed, 64 insertions, 1 deletions
diff --git a/guix/forge/anubis.scm b/guix/forge/anubis.scm
index 5f79f37..63f7a54 100644
--- a/guix/forge/anubis.scm
+++ b/guix/forge/anubis.scm
@@ -20,11 +20,22 @@
 
 (define-module (forge anubis)
   #:use-module ((gnu packages golang) #:select (go-1.26))
+  #:use-module (gnu services)
+  #:use-module (gnu services shepherd)
+  #:use-module (gnu system file-systems)
   #:use-module (guix build-system gnu)
   #:use-module (guix download)
   #:use-module (guix gexp)
+  #:use-module (guix least-authority)
   #:use-module ((guix licenses) #:prefix license:)
-  #:use-module (guix packages))
+  #:use-module (guix packages)
+  #:use-module (guix records)
+  #:use-module (ice-9 match)
+  #:export (anubis-configuration
+            anubis-configuration?
+            anubis-configuration-package
+            anubis-service-type
+            %anubis-unix-socket))
 
 ;; TODO: Unbundle vendored node and go dependencies. See work in progress at
 ;; https://codeberg.org/guix/guix/pulls/2572
@@ -77,3 +88,55 @@ and challenges to identify and block bots before they take your website down.
 Anubis is as lightweight as possible and is designed to help protect the small
 internet from the endless storm of requests that flood in from AI companies.")
     (license license:expat)))
+
+(define-record-type* <anubis-configuration>
+  anubis-configuration make-anubis-configuration
+  anubis-configuration?
+  (package anubis-configuration-package
+           (default anubis-ai-firewall)))
+
+;; TODO: Do not hard-code.
+(define %anubis-unix-socket
+  "/var/run/anubis/socket")
+
+(define (anubis-activation config)
+  #~(begin
+      (let ((user (getpw "nginx")))
+        (mkdir-p (dirname #$%anubis-unix-socket))
+        (chown (dirname #$%anubis-unix-socket)
+               (passwd:uid user)
+               (passwd:gid user)))))
+
+(define anubis-shepherd-service
+  (match-lambda
+    (($ <anubis-configuration> package)
+     (shepherd-service
+       (documentation "Run the Anubis AI firewall.")
+       (provision '(anubis))
+       (requirement '(networking))
+       (start #~(make-forkexec-constructor
+                 (list #$(least-authority-wrapper
+                          (file-append package "/bin/anubis")
+                          #:name "anubis-pola-wrapper"
+                          #:mappings (list (file-system-mapping
+                                             (source (dirname %anubis-unix-socket))
+                                             (target source)
+                                             (writable? #t))))
+                       "-bind" #$%anubis-unix-socket
+                       "-bind-network" "unix"
+                       "-target" " ")
+                 #:user "nginx"
+                 #:group "nginx"
+                 #:log-file "/var/log/anubis.log"))
+       (stop #~(make-kill-destructor))))))
+
+(define anubis-service-type
+  (service-type
+   (name 'anubis)
+   (description "Run the Anubis AI firewall.")
+   (extensions
+    (list (service-extension activation-service-type
+                             anubis-activation)
+          (service-extension shepherd-root-service-type
+                             (compose list anubis-shepherd-service))))
+   (default-value (anubis-configuration))))