| Message ID | 20210530200527.23041-1-arunisaac@systemreboot.net |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [bug#48751] services: laminar: Create parent directory for unix socket. | expand |
Arun Isaac <arunisaac@systemreboot.net> writes: > * gnu/services/ci.scm (laminar-activation): New function. > (laminar-service-type): Extend activation-service-type with > laminar-activation. > --- > gnu/services/ci.scm | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) This looks good to me. I don't think I've played around too much with different bind options, so I haven't come across this issue.
Hi Chris, > This looks good to me. Pushed to master, thanks for the review! > I don't think I've played around too much with different bind options, > so I haven't come across this issue. One problem still remains even after this patch. If the laminar web UI is behind an nginx reverse proxy, the nginx user needs to have read/write permissions to the unix socket. For this, it should be a member of the laminar group. But, short of modifying the nginx service, I don't know of any way to achieve this. Something more composable would be nice. The nginx service being aware of laminar doesn't sound right. Any ideas? Regards, Arun
Arun Isaac <arunisaac@systemreboot.net> writes: > Hi Chris, > >> This looks good to me. > > Pushed to master, thanks for the review! > >> I don't think I've played around too much with different bind options, >> so I haven't come across this issue. > > One problem still remains even after this patch. If the laminar web UI > is behind an nginx reverse proxy, the nginx user needs to have > read/write permissions to the unix socket. For this, it should be a > member of the laminar group. But, short of modifying the nginx service, > I don't know of any way to achieve this. Something more composable would > be nice. The nginx service being aware of laminar doesn't sound > right. Any ideas? Nothing comes to mind unfortunately.
diff --git a/gnu/services/ci.scm b/gnu/services/ci.scm index 0b18521e76..0c3566bcaf 100644 --- a/gnu/services/ci.scm +++ b/gnu/services/ci.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2018, 2019, 2020, 2021 Christopher Baines <mail@cbaines.net> +;;; Copyright © 2021 Arun Isaac <arunisaac@systemreboot.net> ;;; ;;; This file is part of GNU Guix. ;;; @@ -115,13 +116,25 @@ (home-directory (laminar-configuration-home-directory config)) (shell #~(string-append #$shadow "/sbin/nologin"))))) +(define (laminar-activation config) + (let ((bind-http (laminar-configuration-bind-http config))) + #~(begin + ;; If listen is a unix socket, create its parent directory. + (when (string-prefix? "unix:" #$bind-http) + (let ((run-directory + (dirname (substring #$bind-http (string-length "unix:")))) + (user (getpw "laminar"))) + (mkdir-p run-directory) + (chown run-directory (passwd:uid user) (passwd:gid user))))))) + (define laminar-service-type (service-type (name 'laminar) (extensions (list (service-extension shepherd-root-service-type laminar-shepherd-service) - (service-extension account-service-type laminar-account))) + (service-extension account-service-type laminar-account) + (service-extension activation-service-type laminar-activation))) (default-value (laminar-configuration)) (description "Run the Laminar continuous integration service.")))