From 78fab4cf716278000eae0884c98ee81b5c2c06c5 Mon Sep 17 00:00:00 2001
From: Arun Isaac
Date: Mon, 17 Oct 2022 16:47:10 +0530
Subject: tissue: Use least-authority-wrapper.

* guix/forge/tissue.scm: Import (gnu build linux-container), (gnu
system file-systems) and (guix least-authority).
(tissue-shepherd-service): Deprecate
make-forkexec-constructor/container in favor of
least-authority-wrapper.
---
 guix/forge/tissue.scm | 48 ++++++++++++++++++++++++++----------------------
 1 file changed, 26 insertions(+), 22 deletions(-)

diff --git a/guix/forge/tissue.scm b/guix/forge/tissue.scm
index ab86a11..e34e656 100644
--- a/guix/forge/tissue.scm
+++ b/guix/forge/tissue.scm
@@ -20,6 +20,7 @@
 (define-module (forge tissue)
   #:use-module (srfi srfi-1)
   #:use-module (forge socket)
+  #:use-module (gnu build linux-container)
   #:use-module ((gnu packages admin) #:select (shadow))
   #:use-module ((gnu packages autotools) #:select (autoconf automake))
   #:use-module ((gnu packages gettext) #:select (gnu-gettext))
@@ -28,9 +29,11 @@
   #:use-module ((gnu packages skribilo) #:select (skribilo) #:prefix guix:)
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
+  #:use-module (gnu system file-systems)
   #:use-module (gnu system shadow)
   #:use-module (guix build-system gnu)
   #:use-module (guix gexp)
+  #:use-module (guix least-authority)
   #:use-module (guix modules)
   #:use-module (guix git-download)
   #:use-module ((guix licenses) #:prefix license:)
@@ -245,32 +248,33 @@ available both as a command-line program and as a web server.")
      (documentation "Run tissue web server.")
      (provision '(tissue))
      (requirement '(networking))
-     (modules '((gnu build shepherd)
-                (gnu system file-systems)))
      (start
-      (with-imported-modules (source-module-closure '((gnu build shepherd)
-                                                      (gnu system file-systems)))
-        #~(make-forkexec-constructor/container
-           (list #$(file-append (tissue-configuration-package config)
-                                "/bin/tissue")
+      (let ((tissue-conf (computed-file "tissue.conf" (tissue-conf-gexp config))))
+        #~(make-forkexec-constructor
+           (list #$(least-authority-wrapper
+                    (file-append (tissue-configuration-package config)
+                                 "/bin/tissue")
+                    #:name "tissue"
+                    #:mappings (cons* (file-system-mapping
+                                       (source tissue-conf)
+                                       (target source))
+                                      (file-system-mapping
+                                       (source state-directory)
+                                       (target source))
+                                      (if (forge-unix-socket? socket)
+                                          (list (file-system-mapping
+                                                 (source (dirname (forge-unix-socket-path socket)))
+                                                 (target source)
+                                                 (writable? #t)))
+                                          (list)))
+                    ;; TODO: If socket is a Unix socket, run in a
+                    ;; network namespace. We can't do this yet due to
+                    ;; https://yhetil.org/guix/m1ilknoi5r.fsf@fastmail.net/
+                    #:namespaces (delq 'net %namespaces))
                  "web"
-                 (string-append "--config=" #$(computed-file "tissue.conf"
-                                                             (tissue-conf-gexp config))))
+                 (string-append "--config=" #$tissue-conf))
            #:user "tissue"
            #:group "tissue"
-           #:mappings (append (list (file-system-mapping
-                                     (source #$state-directory)
-                                     (target source))
-                                    (file-system-mapping
-                                     (source "/var/log/tissue.log")
-                                     (target source)
-                                     (writable? #t)))
-                              (if #$(forge-unix-socket? socket)
-                                  (list (file-system-mapping
-                                         (source #$(dirname (forge-unix-socket-path socket)))
-                                         (target source)
-                                         (writable? #t)))
-                                  (list)))
            #:log-file "/var/log/tissue.log")))
      (stop #~(make-kill-destructor)))))
 
-- 
cgit v1.2.3