diff options
Diffstat (limited to 'doc/guix.zh_CN.texi')
| -rw-r--r-- | doc/guix.zh_CN.texi | 25352 |
1 files changed, 25352 insertions, 0 deletions
diff --git a/doc/guix.zh_CN.texi b/doc/guix.zh_CN.texi new file mode 100644 index 0000000000..45aabe1d67 --- /dev/null +++ b/doc/guix.zh_CN.texi @@ -0,0 +1,25352 @@ +\input texinfo +@c =========================================================================== +@c +@c This file was generated with po4a. Translate the source file. +@c +@c =========================================================================== +@c -*-texinfo-*- + +@c %**start of header +@setfilename guix.zh_CN.info +@documentencoding UTF-8 +@settitle GNU Guix参考手册 +@c %**end of header + +@include version.texi + +@c Identifier of the OpenPGP key used to sign tarballs and such. +@set OPENPGP-SIGNING-KEY-ID 3CE464558A84FDC69DB40CFB090B11993D9AEBB5 +@set KEY-SERVER pool.sks-keyservers.net + +@c The official substitute server used by default. +@set SUBSTITUTE-SERVER ci.guix.zh_CN.info + +@copying +Copyright @copyright{} 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019 +Ludovic Courtès@* Copyright @copyright{} 2013, 2014, 2016 Andreas Enge@* +Copyright @copyright{} 2013 Nikita Karetnikov@* Copyright @copyright{} 2014, +2015, 2016 Alex Kost@* Copyright @copyright{} 2015, 2016 Mathieu Lirzin@* +Copyright @copyright{} 2014 Pierre-Antoine Rault@* Copyright @copyright{} +2015 Taylan Ulrich Bayırlı/Kammer@* Copyright @copyright{} 2015, 2016, 2017 +Leo Famulari@* Copyright @copyright{} 2015, 2016, 2017, 2018, 2019 Ricardo +Wurmus@* Copyright @copyright{} 2016 Ben Woodcroft@* Copyright @copyright{} +2016, 2017, 2018 Chris Marusich@* Copyright @copyright{} 2016, 2017, 2018, +2019 Efraim Flashner@* Copyright @copyright{} 2016 John Darrington@* +Copyright @copyright{} 2016, 2017 ng0@* Copyright @copyright{} 2016, 2017, +2018, 2019 Jan Nieuwenhuizen@* Copyright @copyright{} 2016 Julien Lepiller@* +Copyright @copyright{} 2016 Alex ter Weele@* Copyright @copyright{} 2016, +2017, 2018, 2019 Christopher Baines@* Copyright @copyright{} 2017, 2018 +Clément Lassieur@* Copyright @copyright{} 2017, 2018 Mathieu Othacehe@* +Copyright @copyright{} 2017 Federico Beffa@* Copyright @copyright{} 2017, +2018 Carlo Zancanaro@* Copyright @copyright{} 2017 Thomas Danckaert@* +Copyright @copyright{} 2017 humanitiesNerd@* Copyright @copyright{} 2017 +Christopher Allan Webber@* Copyright @copyright{} 2017, 2018 Marius Bakke@* +Copyright @copyright{} 2017 Hartmut Goebel@* Copyright @copyright{} 2017 +Maxim Cournoyer@* Copyright @copyright{} 2017, 2018 Tobias Geerinckx-Rice@* +Copyright @copyright{} 2017 George Clemmer@* Copyright @copyright{} 2017 +Andy Wingo@* Copyright @copyright{} 2017, 2018, 2019 Arun Isaac@* Copyright +@copyright{} 2017 nee@* Copyright @copyright{} 2018 Rutger Helling@* +Copyright @copyright{} 2018 Oleg Pykhalov@* Copyright @copyright{} 2018 Mike +Gerwitz@* Copyright @copyright{} 2018 Pierre-Antoine Rouby@* Copyright +@copyright{} 2018 Gábor Boskovits@* Copyright @copyright{} 2018 Florian +Pelz@* Copyright @copyright{} 2018 Laura Lazzati@* Copyright @copyright{} +2018 Alex Vong@* + +Permission is granted to copy, distribute and/or modify this document under +the terms of the GNU Free Documentation License, Version 1.3 or any later +version published by the Free Software Foundation; with no Invariant +Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the +license is included in the section entitled ``GNU Free Documentation +License''. +@end copying + +@dircategory System administration +@direntry +* Guix: (guix). Manage installed software and system + configuration. +* guix package: (guix)Invoking guix package. Installing, removing, and + upgrading packages. +* guix gc: (guix)Invoking guix gc. Reclaiming unused disk space. +* guix pull: (guix)Invoking guix pull. Update the list of available + packages. +* guix system: (guix)Invoking guix system. Manage the operating system + configuration. +@end direntry + +@dircategory Software development +@direntry +* guix environment: (guix)Invoking guix environment. Building development + environments with + Guix. +* guix build: (guix)Invoking guix build. Building packages. +* guix pack: (guix)Invoking guix pack. Creating binary bundles. +@end direntry + +@titlepage +@title GNU Guix参考手册 +@subtitle Using the GNU Guix Functional Package Manager +@author The GNU Guix Developers + +@page +@vskip 0pt plus 1filll +Edition @value{EDITION} @* @value{UPDATED} @* + +@insertcopying +@end titlepage + +@contents + +@c ********************************************************************* +@node Top +@top GNU Guix + +This document describes GNU Guix version @value{VERSION}, a functional +package management tool written for the GNU system. + +@c TRANSLATORS: You can replace the following paragraph with information on +@c how to join your own translation team and how to report issues with the +@c translation. +This manual is also available in French (@pxref{Top,,, guix.fr, Manuel de +référence de GNU Guix}) and German (@pxref{Top,,, guix.de, Referenzhandbuch +zu GNU Guix}). If you would like to translate it in your native language, +consider joining the +@uref{https://translationproject.org/domain/guix-manual.html, Translation +Project}. + +@menu +* Introduction:: What is Guix about? +* Installation:: Installing Guix. +* System Installation:: Installing the whole operating system. +* Package Management:: Package installation, upgrade, etc. +* Development:: Guix-aided software development. +* Programming Interface:: Using Guix in Scheme. +* Utilities:: Package management commands. +* System Configuration:: Configuring the operating system. +* Documentation:: Browsing software user manuals. +* Installing Debugging Files:: Feeding the debugger. +* Security Updates:: Deploying security fixes quickly. +* Bootstrapping:: GNU/Linux built from scratch. +* Porting:: Targeting another platform or kernel. +* 贡献:: Your help needed! + +* Acknowledgments:: Thanks! +* GNU Free Documentation License:: The license of this manual. +* Concept Index:: Concepts. +* Programming Index:: Data types, functions, and variables. + +@detailmenu + --- The Detailed Node Listing --- + + + +Introduction + + + +* Managing Software the Guix Way:: What's special. +* GNU Distribution:: The packages and tools. + +Installation + + + +* Binary Installation:: Getting Guix running in no time! +* Requirements:: Software needed to build and run Guix. +* Running the Test Suite:: Testing Guix. +* Setting Up the Daemon:: Preparing the build daemon's environment. +* Invoking guix-daemon:: Running the build daemon. +* Application Setup:: Application-specific setup. + +Setting Up the Daemon + + + +* Build Environment Setup:: Preparing the isolated build environment. +* Daemon Offload Setup:: Offloading builds to remote machines. +* SELinux Support:: Using an SELinux policy for the daemon. + +System Installation + + + +* Limitations:: What you can expect. +* Hardware Considerations:: Supported hardware. +* USB Stick and DVD Installation:: Preparing the installation medium. +* Preparing for Installation:: Networking, partitioning, etc. +* Guided Graphical Installation:: Easy graphical installation. +* Manual Installation:: Manual installation for wizards. +* After System Installation:: When installation succeeded. +* Installing Guix in a VM:: Guix System playground. +* Building the Installation Image:: How this comes to be. + +Manual Installation + + + +* Keyboard Layout and Networking and Partitioning:: Initial setup. +* Proceeding with the Installation:: Installing. + +Package Management + + + +* Features:: How Guix will make your life brighter. +* Invoking guix package:: Package installation, removal, etc. +* Substitutes:: Downloading pre-built binaries. +* Packages with Multiple Outputs:: Single source package, multiple outputs. +* Invoking guix gc:: Running the garbage collector. +* Invoking guix pull:: Fetching the latest Guix and distribution. +* Channels:: Customizing the package collection. +* Inferiors:: Interacting with another revision of Guix. +* Invoking guix describe:: Display information about your Guix revision. +* Invoking guix archive:: Exporting and importing store files. + +Substitutes + + + +* Official Substitute Server:: One particular source of substitutes. +* Substitute Server Authorization:: How to enable or disable substitutes. +* Substitute Authentication:: How Guix verifies substitutes. +* Proxy Settings:: How to get substitutes via proxy. +* Substitution Failure:: What happens when substitution fails. +* On Trusting Binaries:: How can you trust that binary blob? + +Development + + + +* Invoking guix environment:: Setting up development environments. +* Invoking guix pack:: Creating software bundles. + +Programming Interface + + + +* Package Modules:: Packages from the programmer's viewpoint. +* Defining Packages:: Defining new packages. +* Build Systems:: Specifying how packages are built. +* The Store:: Manipulating the package store. +* Derivations:: Low-level interface to package derivations. +* The Store Monad:: Purely functional interface to the store. +* G-Expressions:: Manipulating build expressions. +* Invoking guix repl:: Fiddling with Guix interactively. + +Defining Packages + + + +* package Reference:: The package data type. +* origin Reference:: The origin data type. + +Utilities + + + +* Invoking guix build:: Building packages from the command line. +* Invoking guix edit:: Editing package definitions. +* Invoking guix download:: Downloading a file and printing its hash. +* Invoking guix hash:: Computing the cryptographic hash of a file. +* Invoking guix import:: Importing package definitions. +* Invoking guix refresh:: Updating package definitions. +* Invoking guix lint:: Finding errors in package definitions. +* Invoking guix size:: Profiling disk usage. +* Invoking guix graph:: Visualizing the graph of packages. +* Invoking guix publish:: Sharing substitutes. +* Invoking guix challenge:: Challenging substitute servers. +* Invoking guix copy:: Copying to and from a remote store. +* Invoking guix container:: Process isolation. +* Invoking guix weather:: Assessing substitute availability. +* Invoking guix processes:: Listing client processes. + +Invoking @command{guix build} + + + +* Common Build Options:: Build options for most commands. +* Package Transformation Options:: Creating variants of packages. +* Additional Build Options:: Options specific to 'guix build'. +* Debugging Build Failures:: Real life packaging experience. + +System Configuration + + + +* Using the Configuration System:: Customizing your GNU system. +* operating-system Reference:: Detail of operating-system declarations. +* File Systems:: Configuring file system mounts. +* Mapped Devices:: Block device extra processing. +* User Accounts:: Specifying user accounts. +* Keyboard Layout:: How the system interprets key strokes. +* Locales:: Language and cultural convention settings. +* Services:: Specifying system services. +* Setuid Programs:: Programs running with root privileges. +* X.509 Certificates:: Authenticating HTTPS servers. +* Name Service Switch:: Configuring libc's name service switch. +* Initial RAM Disk:: Linux-Libre bootstrapping. +* Bootloader Configuration:: Configuring the boot loader. +* Invoking guix system:: Instantiating a system configuration. +* Running Guix in a VM:: How to run Guix System in a virtual machine. +* Defining Services:: Adding new service definitions. + +Services + + + +* Base Services:: Essential system services. +* Scheduled Job Execution:: The mcron service. +* Log Rotation:: The rottlog service. +* Networking Services:: Network setup, SSH daemon, etc. +* X Window:: Graphical display. +* Printing Services:: Local and remote printer support. +* Desktop Services:: D-Bus and desktop services. +* Sound Services:: ALSA and Pulseaudio services. +* Database Services:: SQL databases, key-value stores, etc. +* Mail Services:: IMAP, POP3, SMTP, and all that. +* Messaging Services:: Messaging services. +* Telephony Services:: Telephony services. +* Monitoring Services:: Monitoring services. +* Kerberos Services:: Kerberos services. +* Web Services:: Web servers. +* Certificate Services:: TLS certificates via Let's Encrypt. +* DNS Services:: DNS daemons. +* VPN Services:: VPN daemons. +* Network File System:: NFS related services. +* Continuous Integration:: The Cuirass service. +* Power Management Services:: Extending battery life. +* Audio Services:: The MPD. +* Virtualization Services:: Virtualization services. +* Version Control Services:: Providing remote access to Git repositories. +* Game Services:: Game servers. +* Miscellaneous Services:: Other services. + +Defining Services + + + +* Service Composition:: The model for composing services. +* Service Types and Services:: Types and services. +* Service Reference:: API reference. +* Shepherd Services:: A particular type of service. + +@end detailmenu +@end menu + +@c ********************************************************************* +@node Introduction +@chapter Introduction + +@cindex purpose +GNU Guix@footnote{``Guix'' is pronounced like ``geeks'', or ``ɡiːks'' using +the international phonetic alphabet (IPA).} is a package management tool for +and distribution of the GNU system. Guix makes it easy for unprivileged +users to install, upgrade, or remove software packages, to roll back to a +previous package set, to build packages from source, and generally assists +with the creation and maintenance of software environments. + +@cindex Guix System +@cindex GuixSD, now Guix System +@cindex Guix System Distribution, now Guix System +You can install GNU@tie{}Guix on top of an existing GNU/Linux system where +it complements the available tools without interference +(@pxref{Installation}), or you can use it as a standalone operating system +distribution, @dfn{Guix@tie{}System}@footnote{We used to refer to Guix +System as ``Guix System Distribution'' or ``GuixSD''. We now consider it +makes more sense to group everything under the ``Guix'' banner since, after +all, Guix System is readily available through the @command{guix system} +command, even if you're using a different distro underneath!}. @xref{GNU +Distribution}. + +@menu +* Managing Software the Guix Way:: What's special. +* GNU Distribution:: The packages and tools. +@end menu + +@node Managing Software the Guix Way +@section Managing Software the Guix Way + +@cindex user interfaces +Guix provides a command-line package management interface (@pxref{Package +Management}), tools to help with software development (@pxref{Development}), +command-line utilities for more advanced usage, (@pxref{Utilities}), as well +as Scheme programming interfaces (@pxref{Programming Interface}). +@cindex build daemon +Its @dfn{build daemon} is responsible for building packages on behalf of +users (@pxref{Setting Up the Daemon}) and for downloading pre-built binaries +from authorized sources (@pxref{Substitutes}). + +@cindex extensibility of the distribution +@cindex customization, of packages +Guix includes package definitions for many GNU and non-GNU packages, all of +which @uref{https://www.gnu.org/philosophy/free-sw.html, respect the user's +computing freedom}. It is @emph{extensible}: users can write their own +package definitions (@pxref{Defining Packages}) and make them available as +independent package modules (@pxref{Package Modules}). It is also +@emph{customizable}: users can @emph{derive} specialized package definitions +from existing ones, including from the command line (@pxref{Package +Transformation Options}). + +@cindex functional package management +@cindex isolation +Under the hood, Guix implements the @dfn{functional package management} +discipline pioneered by Nix (@pxref{Acknowledgments}). In Guix, the package +build and installation process is seen as a @emph{function}, in the +mathematical sense. That function takes inputs, such as build scripts, a +compiler, and libraries, and returns an installed package. As a pure +function, its result depends solely on its inputs---for instance, it cannot +refer to software or scripts that were not explicitly passed as inputs. A +build function always produces the same result when passed a given set of +inputs. It cannot alter the environment of the running system in any way; +for instance, it cannot create, modify, or delete files outside of its build +and installation directories. This is achieved by running build processes +in isolated environments (or @dfn{containers}), where only their explicit +inputs are visible. + +@cindex store +The result of package build functions is @dfn{cached} in the file system, in +a special directory called @dfn{the store} (@pxref{The Store}). Each +package is installed in a directory of its own in the store---by default +under @file{/gnu/store}. The directory name contains a hash of all the +inputs used to build that package; thus, changing an input yields a +different directory name. + +This approach is the foundation for the salient features of Guix: support +for transactional package upgrade and rollback, per-user installation, and +garbage collection of packages (@pxref{Features}). + + +@node GNU Distribution +@section GNU Distribution + +@cindex Guix System +Guix comes with a distribution of the GNU system consisting entirely of free +software@footnote{The term ``free'' here refers to the +@url{http://www.gnu.org/philosophy/free-sw.html,freedom provided to users of +that software}.}. The distribution can be installed on its own +(@pxref{System Installation}), but it is also possible to install Guix as a +package manager on top of an installed GNU/Linux system +(@pxref{Installation}). When we need to distinguish between the two, we +refer to the standalone distribution as Guix@tie{}System. + +The distribution provides core GNU packages such as GNU libc, GCC, and +Binutils, as well as many GNU and non-GNU applications. The complete list +of available packages can be browsed +@url{http://www.gnu.org/software/guix/packages,on-line} or by running +@command{guix package} (@pxref{Invoking guix package}): + +@example +guix package --list-available +@end example + +Our goal is to provide a practical 100% free software distribution of +Linux-based and other variants of GNU, with a focus on the promotion and +tight integration of GNU components, and an emphasis on programs and tools +that help users exert that freedom. + +Packages are currently available on the following platforms: + +@table @code + +@item x86_64-linux +Intel/AMD @code{x86_64} architecture, Linux-Libre kernel; + +@item i686-linux +Intel 32-bit architecture (IA32), Linux-Libre kernel; + +@item armhf-linux +ARMv7-A architecture with hard float, Thumb-2 and NEON, using the EABI +hard-float application binary interface (ABI), and Linux-Libre kernel. + +@item aarch64-linux +little-endian 64-bit ARMv8-A processors, Linux-Libre kernel. This is +currently in an experimental stage, with limited support. +@xref{贡献}, for how to help! + +@item mips64el-linux +little-endian 64-bit MIPS processors, specifically the Loongson series, n32 +ABI, and Linux-Libre kernel. + +@end table + +With Guix@tie{}System, you @emph{declare} all aspects of the operating +system configuration and Guix takes care of instantiating the configuration +in a transactional, reproducible, and stateless fashion (@pxref{System +Configuration}). Guix System uses the Linux-libre kernel, the Shepherd +initialization system (@pxref{Introduction,,, shepherd, The GNU Shepherd +Manual}), the well-known GNU utilities and tool chain, as well as the +graphical environment or system services of your choice. + +Guix System is available on all the above platforms except +@code{mips64el-linux}. + +@noindent +For information on porting to other architectures or kernels, +@pxref{Porting}. + +Building this distribution is a cooperative effort, and you are invited to +join! @xref{贡献}, for information about how you can help. + + +@c ********************************************************************* +@node Installation +@chapter Installation + +@cindex installing Guix + +@quotation Note +We recommend the use of this +@uref{https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh, +shell installer script} to install Guix on top of a running GNU/Linux +system, thereafter called a @dfn{foreign distro}.@footnote{This section is +concerned with the installation of the package manager, which can be done on +top of a running GNU/Linux system. If, instead, you want to install the +complete GNU operating system, @pxref{System Installation}.} The script +automates the download, installation, and initial configuration of Guix. It +should be run as the root user. +@end quotation + +@cindex foreign distro +@cindex directories related to foreign distro +When installed on a foreign distro, GNU@tie{}Guix complements the available +tools without interference. Its data lives exclusively in two directories, +usually @file{/gnu/store} and @file{/var/guix}; other files on your system, +such as @file{/etc}, are left untouched. + +Once installed, Guix can be updated by running @command{guix pull} +(@pxref{Invoking guix pull}). + +If you prefer to perform the installation steps manually or want to tweak +them, you may find the following subsections useful. They describe the +software requirements of Guix, as well as how to install it manually and get +ready to use it. + +@menu +* Binary Installation:: Getting Guix running in no time! +* Requirements:: Software needed to build and run Guix. +* Running the Test Suite:: Testing Guix. +* Setting Up the Daemon:: Preparing the build daemon's environment. +* Invoking guix-daemon:: Running the build daemon. +* Application Setup:: Application-specific setup. +@end menu + +@node Binary Installation +@section Binary Installation + +@cindex installing Guix from binaries +@cindex installer script +This section describes how to install Guix on an arbitrary system from a +self-contained tarball providing binaries for Guix and for all its +dependencies. This is often quicker than installing from source, which is +described in the next sections. The only requirement is to have +GNU@tie{}tar and Xz. + +Installing goes along these lines: + +@enumerate +@item +@cindex downloading Guix binary +Download the binary tarball from +@indicateurl{https://alpha.gnu.org/gnu/guix/guix-binary-@value{VERSION}.@var{system}.tar.xz}, +where @var{system} is @code{x86_64-linux} for an @code{x86_64} machine +already running the kernel Linux, and so on. + +@c The following is somewhat duplicated in ``System Installation''. +Make sure to download the associated @file{.sig} file and to verify the +authenticity of the tarball against it, along these lines: + +@example +$ wget https://alpha.gnu.org/gnu/guix/guix-binary-@value{VERSION}.@var{system}.tar.xz.sig +$ gpg --verify guix-binary-@value{VERSION}.@var{system}.tar.xz.sig +@end example + +If that command fails because you do not have the required public key, then +run this command to import it: + +@example +$ gpg --keyserver @value{KEY-SERVER} \ + --recv-keys @value{OPENPGP-SIGNING-KEY-ID} +@end example + +@noindent +@c end authentication part +and rerun the @code{gpg --verify} command. + +@item +Now, you need to become the @code{root} user. Depending on your +distribution, you may have to run @code{su -} or @code{sudo -i}. As +@code{root}, run: + +@example +# cd /tmp +# tar --warning=no-timestamp -xf \ + guix-binary-@value{VERSION}.@var{system}.tar.xz +# mv var/guix /var/ && mv gnu / +@end example + +This creates @file{/gnu/store} (@pxref{The Store}) and @file{/var/guix}. +The latter contains a ready-to-use profile for @code{root} (see next step.) + +Do @emph{not} unpack the tarball on a working Guix system since that would +overwrite its own essential files. + +The @code{--warning=no-timestamp} option makes sure GNU@tie{}tar does not +emit warnings about ``implausibly old time stamps'' (such warnings were +triggered by GNU@tie{}tar 1.26 and older; recent versions are fine.) They +stem from the fact that all the files in the archive have their modification +time set to zero (which means January 1st, 1970.) This is done on purpose +to make sure the archive content is independent of its creation time, thus +making it reproducible. + +@item +Make the profile available under @file{~root/.config/guix/current}, which is +where @command{guix pull} will install updates (@pxref{Invoking guix pull}): + +@example +# mkdir -p ~root/.config/guix +# ln -sf /var/guix/profiles/per-user/root/current-guix \ + ~root/.config/guix/current +@end example + +Source @file{etc/profile} to augment @code{PATH} and other relevant +environment variables: + +@example +# GUIX_PROFILE="`echo ~root`/.config/guix/current" ; \ + source $GUIX_PROFILE/etc/profile +@end example + +@item +Create the group and user accounts for build users as explained below +(@pxref{Build Environment Setup}). + +@item +Run the daemon, and set it to automatically start on boot. + +If your host distro uses the systemd init system, this can be achieved with +these commands: + +@c Versions of systemd that supported symlinked service files are not +@c yet widely deployed, so we should suggest that users copy the service +@c files into place. +@c +@c See this thread for more information: +@c http://lists.gnu.org/archive/html/guix-devel/2017-01/msg01199.html + +@example +# cp ~root/.config/guix/current/lib/systemd/system/guix-daemon.service \ + /etc/systemd/system/ +# systemctl start guix-daemon && systemctl enable guix-daemon +@end example + +If your host distro uses the Upstart init system: + +@example +# initctl reload-configuration +# cp ~root/.config/guix/current/lib/upstart/system/guix-daemon.conf \ + /etc/init/ +# start guix-daemon +@end example + +Otherwise, you can still start the daemon manually with: + +@example +# ~root/.config/guix/current/bin/guix-daemon \ + --build-users-group=guixbuild +@end example + +@item +Make the @command{guix} command available to other users on the machine, for +instance with: + +@example +# mkdir -p /usr/local/bin +# cd /usr/local/bin +# ln -s /var/guix/profiles/per-user/root/current-guix/bin/guix +@end example + +It is also a good idea to make the Info version of this manual available +there: + +@example +# mkdir -p /usr/local/share/info +# cd /usr/local/share/info +# for i in /var/guix/profiles/per-user/root/current-guix/share/info/* ; + do ln -s $i ; done +@end example + +That way, assuming @file{/usr/local/share/info} is in the search path, +running @command{info guix} will open this manual (@pxref{Other Info +Directories,,, texinfo, GNU Texinfo}, for more details on changing the Info +search path.) + +@item +@cindex substitutes, authorization thereof +To use substitutes from @code{@value{SUBSTITUTE-SERVER}} or one of its +mirrors (@pxref{Substitutes}), authorize them: + +@example +# guix archive --authorize < \ + ~root/.config/guix/current/share/guix/@value{SUBSTITUTE-SERVER}.pub +@end example + +@item +Each user may need to perform a few additional steps to make their Guix +environment ready for use, @pxref{Application Setup}. +@end enumerate + +Voilà, the installation is complete! + +You can confirm that Guix is working by installing a sample package into the +root profile: + +@example +# guix package -i hello +@end example + +The @code{guix} package must remain available in @code{root}'s profile, or +it would become subject to garbage collection---in which case you would find +yourself badly handicapped by the lack of the @command{guix} command. In +other words, do not remove @code{guix} by running @code{guix package -r +guix}. + +The binary installation tarball can be (re)produced and verified simply by +running the following command in the Guix source tree: + +@example +make guix-binary.@var{system}.tar.xz +@end example + +@noindent +...@: which, in turn, runs: + +@example +guix pack -s @var{system} --localstatedir \ + --profile-name=current-guix guix +@end example + +@xref{Invoking guix pack}, for more info on this handy tool. + +@node Requirements +@section Requirements + +This section lists requirements when building Guix from source. The build +procedure for Guix is the same as for other GNU software, and is not covered +here. Please see the files @file{README} and @file{INSTALL} in the Guix +source tree for additional details. + +@cindex official website +GNU Guix is available for download from its website at +@url{https://www.gnu.org/software/guix/}. + +GNU Guix depends on the following packages: + +@itemize +@item @url{http://gnu.org/software/guile/, GNU Guile}, version 2.2.x; +@item @url{https://notabug.org/cwebber/guile-gcrypt, Guile-Gcrypt}, version +0.1.0 or later; +@item +@uref{http://gnutls.org/, GnuTLS}, specifically its Guile bindings +(@pxref{Guile Preparations, how to install the GnuTLS bindings for Guile,, +gnutls-guile, GnuTLS-Guile}); +@item +@uref{https://notabug.org/guile-sqlite3/guile-sqlite3, Guile-SQLite3}, +version 0.1.0 or later; +@item +@c FIXME: Specify a version number once a release has been made. +@uref{https://gitlab.com/guile-git/guile-git, Guile-Git}, from August 2017 +or later; +@item @uref{https://savannah.nongnu.org/projects/guile-json/, Guile-JSON}; +@item @url{http://zlib.net, zlib}; +@item @url{http://www.gnu.org/software/make/, GNU Make}. +@end itemize + +The following dependencies are optional: + +@itemize +@item +@c Note: We need at least 0.10.2 for 'channel-send-eof'. +Support for build offloading (@pxref{Daemon Offload Setup}) and +@command{guix copy} (@pxref{Invoking guix copy}) depends on +@uref{https://github.com/artyom-poptsov/guile-ssh, Guile-SSH}, version +0.10.2 or later. + +@item +When @url{http://www.bzip.org, libbz2} is available, @command{guix-daemon} +can use it to compress build logs. +@end itemize + +Unless @code{--disable-daemon} was passed to @command{configure}, the +following packages are also needed: + +@itemize +@item @url{http://gnupg.org/, GNU libgcrypt}; +@item @url{http://sqlite.org, SQLite 3}; +@item @url{http://gcc.gnu.org, GCC's g++}, with support for the +C++11 standard. +@end itemize + +@cindex state directory +When configuring Guix on a system that already has a Guix installation, be +sure to specify the same state directory as the existing installation using +the @code{--localstatedir} option of the @command{configure} script +(@pxref{Directory Variables, @code{localstatedir},, standards, GNU Coding +Standards}). The @command{configure} script protects against unintended +misconfiguration of @var{localstatedir} so you do not inadvertently corrupt +your store (@pxref{The Store}). + +@cindex Nix, compatibility +When a working installation of @url{http://nixos.org/nix/, the Nix package +manager} is available, you can instead configure Guix with +@code{--disable-daemon}. In that case, Nix replaces the three dependencies +above. + +Guix is compatible with Nix, so it is possible to share the same store +between both. To do so, you must pass @command{configure} not only the same +@code{--with-store-dir} value, but also the same @code{--localstatedir} +value. The latter is essential because it specifies where the database that +stores metadata about the store is located, among other things. The default +values for Nix are @code{--with-store-dir=/nix/store} and +@code{--localstatedir=/nix/var}. Note that @code{--disable-daemon} is not +required if your goal is to share the store with Nix. + +@node Running the Test Suite +@section Running the Test Suite + +@cindex test suite +After a successful @command{configure} and @code{make} run, it is a good +idea to run the test suite. It can help catch issues with the setup or +environment, or bugs in Guix itself---and really, reporting test failures is +a good way to help improve the software. To run the test suite, type: + +@example +make check +@end example + +Test cases can run in parallel: you can use the @code{-j} option of +GNU@tie{}make to speed things up. The first run may take a few minutes on a +recent machine; subsequent runs will be faster because the store that is +created for test purposes will already have various things in cache. + +It is also possible to run a subset of the tests by defining the +@code{TESTS} makefile variable as in this example: + +@example +make check TESTS="tests/store.scm tests/cpio.scm" +@end example + +By default, tests results are displayed at a file level. In order to see +the details of every individual test cases, it is possible to define the +@code{SCM_LOG_DRIVER_FLAGS} makefile variable as in this example: + +@example +make check TESTS="tests/base64.scm" SCM_LOG_DRIVER_FLAGS="--brief=no" +@end example + +Upon failure, please email @email{bug-guix@@gnu.org} and attach the +@file{test-suite.log} file. Please specify the Guix version being used as +well as version numbers of the dependencies (@pxref{Requirements}) in your +message. + +Guix also comes with a whole-system test suite that tests complete Guix +System instances. It can only run on systems where Guix is already +installed, using: + +@example +make check-system +@end example + +@noindent +or, again, by defining @code{TESTS} to select a subset of tests to run: + +@example +make check-system TESTS="basic mcron" +@end example + +These system tests are defined in the @code{(gnu tests @dots{})} modules. +They work by running the operating systems under test with lightweight +instrumentation in a virtual machine (VM). They can be computationally +intensive or rather cheap, depending on whether substitutes are available +for their dependencies (@pxref{Substitutes}). Some of them require a lot of +storage space to hold VM images. + +Again in case of test failures, please send @email{bug-guix@@gnu.org} all +the details. + +@node Setting Up the Daemon +@section Setting Up the Daemon + +@cindex daemon +Operations such as building a package or running the garbage collector are +all performed by a specialized process, the @dfn{build daemon}, on behalf of +clients. Only the daemon may access the store and its associated database. +Thus, any operation that manipulates the store goes through the daemon. For +instance, command-line tools such as @command{guix package} and +@command{guix build} communicate with the daemon (@i{via} remote procedure +calls) to instruct it what to do. + +The following sections explain how to prepare the build daemon's +environment. See also @ref{Substitutes}, for information on how to allow +the daemon to download pre-built binaries. + +@menu +* Build Environment Setup:: Preparing the isolated build environment. +* Daemon Offload Setup:: Offloading builds to remote machines. +* SELinux Support:: Using an SELinux policy for the daemon. +@end menu + +@node Build Environment Setup +@subsection Build Environment Setup + +@cindex build environment +In a standard multi-user setup, Guix and its daemon---the +@command{guix-daemon} program---are installed by the system administrator; +@file{/gnu/store} is owned by @code{root} and @command{guix-daemon} runs as +@code{root}. Unprivileged users may use Guix tools to build packages or +otherwise access the store, and the daemon will do it on their behalf, +ensuring that the store is kept in a consistent state, and allowing built +packages to be shared among users. + +@cindex build users +When @command{guix-daemon} runs as @code{root}, you may not want package +build processes themselves to run as @code{root} too, for obvious security +reasons. To avoid that, a special pool of @dfn{build users} should be +created for use by build processes started by the daemon. These build users +need not have a shell and a home directory: they will just be used when the +daemon drops @code{root} privileges in build processes. Having several such +users allows the daemon to launch distinct build processes under separate +UIDs, which guarantees that they do not interfere with each other---an +essential feature since builds are regarded as pure functions +(@pxref{Introduction}). + +On a GNU/Linux system, a build user pool may be created like this (using +Bash syntax and the @code{shadow} commands): + +@c See http://lists.gnu.org/archive/html/bug-guix/2013-01/msg00239.html +@c for why `-G' is needed. +@example +# groupadd --system guixbuild +# for i in `seq -w 1 10`; + do + useradd -g guixbuild -G guixbuild \ + -d /var/empty -s `which nologin` \ + -c "Guix build user $i" --system \ + guixbuilder$i; + done +@end example + +@noindent +The number of build users determines how many build jobs may run in +parallel, as specified by the @option{--max-jobs} option (@pxref{Invoking +guix-daemon, @option{--max-jobs}}). To use @command{guix system vm} and +related commands, you may need to add the build users to the @code{kvm} +group so they can access @file{/dev/kvm}, using @code{-G guixbuild,kvm} +instead of @code{-G guixbuild} (@pxref{Invoking guix system}). + +The @code{guix-daemon} program may then be run as @code{root} with the +following command@footnote{If your machine uses the systemd init system, +dropping the @file{@var{prefix}/lib/systemd/system/guix-daemon.service} file +in @file{/etc/systemd/system} will ensure that @command{guix-daemon} is +automatically started. Similarly, if your machine uses the Upstart init +system, drop the @file{@var{prefix}/lib/upstart/system/guix-daemon.conf} +file in @file{/etc/init}.}: + +@example +# guix-daemon --build-users-group=guixbuild +@end example + +@cindex chroot +@noindent +This way, the daemon starts build processes in a chroot, under one of the +@code{guixbuilder} users. On GNU/Linux, by default, the chroot environment +contains nothing but: + +@c Keep this list in sync with libstore/build.cc! ----------------------- +@itemize +@item +a minimal @code{/dev} directory, created mostly independently from the host +@code{/dev}@footnote{``Mostly'', because while the set of files that appear +in the chroot's @code{/dev} is fixed, most of these files can only be +created if the host has them.}; + +@item +the @code{/proc} directory; it only shows the processes of the container +since a separate PID name space is used; + +@item +@file{/etc/passwd} with an entry for the current user and an entry for user +@file{nobody}; + +@item +@file{/etc/group} with an entry for the user's group; + +@item +@file{/etc/hosts} with an entry that maps @code{localhost} to +@code{127.0.0.1}; + +@item +a writable @file{/tmp} directory. +@end itemize + +You can influence the directory where the daemon stores build trees @i{via} +the @code{TMPDIR} environment variable. However, the build tree within the +chroot is always called @file{/tmp/guix-build-@var{name}.drv-0}, where +@var{name} is the derivation name---e.g., @code{coreutils-8.24}. This way, +the value of @code{TMPDIR} does not leak inside build environments, which +avoids discrepancies in cases where build processes capture the name of +their build tree. + +@vindex http_proxy +The daemon also honors the @code{http_proxy} environment variable for HTTP +downloads it performs, be it for fixed-output derivations +(@pxref{Derivations}) or for substitutes (@pxref{Substitutes}). + +If you are installing Guix as an unprivileged user, it is still possible to +run @command{guix-daemon} provided you pass @code{--disable-chroot}. +However, build processes will not be isolated from one another, and not from +the rest of the system. Thus, build processes may interfere with each +other, and may access programs, libraries, and other files available on the +system---making it much harder to view them as @emph{pure} functions. + + +@node Daemon Offload Setup +@subsection Using the Offload Facility + +@cindex offloading +@cindex build hook +When desired, the build daemon can @dfn{offload} derivation builds to other +machines running Guix, using the @code{offload} @dfn{build +hook}@footnote{This feature is available only when +@uref{https://github.com/artyom-poptsov/guile-ssh, Guile-SSH} is present.}. +When that feature is enabled, a list of user-specified build machines is +read from @file{/etc/guix/machines.scm}; every time a build is requested, +for instance via @code{guix build}, the daemon attempts to offload it to one +of the machines that satisfy the constraints of the derivation, in +particular its system type---e.g., @file{x86_64-linux}. Missing +prerequisites for the build are copied over SSH to the target machine, which +then proceeds with the build; upon success the output(s) of the build are +copied back to the initial machine. + +The @file{/etc/guix/machines.scm} file typically looks like this: + +@example +(list (build-machine + (name "eightysix.example.org") + (system "x86_64-linux") + (host-key "ssh-ed25519 AAAAC3Nza@dots{}") + (user "bob") + (speed 2.)) ;incredibly fast! + + (build-machine + (name "meeps.example.org") + (system "mips64el-linux") + (host-key "ssh-rsa AAAAB3Nza@dots{}") + (user "alice") + (private-key + (string-append (getenv "HOME") + "/.ssh/identity-for-guix")))) +@end example + +@noindent +In the example above we specify a list of two build machines, one for the +@code{x86_64} architecture and one for the @code{mips64el} architecture. + +In fact, this file is---not surprisingly!---a Scheme file that is evaluated +when the @code{offload} hook is started. Its return value must be a list of +@code{build-machine} objects. While this example shows a fixed list of +build machines, one could imagine, say, using DNS-SD to return a list of +potential build machines discovered in the local network +(@pxref{Introduction, Guile-Avahi,, guile-avahi, Using Avahi in Guile Scheme +Programs}). The @code{build-machine} data type is detailed below. + +@deftp {Data Type} build-machine +This data type represents build machines to which the daemon may offload +builds. The important fields are: + +@table @code + +@item name +The host name of the remote machine. + +@item system +The system type of the remote machine---e.g., @code{"x86_64-linux"}. + +@item user +The user account to use when connecting to the remote machine over SSH. +Note that the SSH key pair must @emph{not} be passphrase-protected, to allow +non-interactive logins. + +@item host-key +This must be the machine's SSH @dfn{public host key} in OpenSSH format. +This is used to authenticate the machine when we connect to it. It is a +long string that looks like this: + +@example +ssh-ed25519 AAAAC3NzaC@dots{}mde+UhL hint@@example.org +@end example + +If the machine is running the OpenSSH daemon, @command{sshd}, the host key +can be found in a file such as @file{/etc/ssh/ssh_host_ed25519_key.pub}. + +If the machine is running the SSH daemon of GNU@tie{}lsh, @command{lshd}, +the host key is in @file{/etc/lsh/host-key.pub} or a similar file. It can +be converted to the OpenSSH format using @command{lsh-export-key} +(@pxref{Converting keys,,, lsh, LSH Manual}): + +@example +$ lsh-export-key --openssh < /etc/lsh/host-key.pub +ssh-rsa AAAAB3NzaC1yc2EAAAAEOp8FoQAAAQEAs1eB46LV@dots{} +@end example + +@end table + +A number of optional fields may be specified: + +@table @asis + +@item @code{port} (default: @code{22}) +Port number of SSH server on the machine. + +@item @code{private-key} (default: @file{~root/.ssh/id_rsa}) +The SSH private key file to use when connecting to the machine, in OpenSSH +format. This key must not be protected with a passphrase. + +Note that the default value is the private key @emph{of the root account}. +Make sure it exists if you use the default. + +@item @code{compression} (default: @code{"zlib@@openssh.com,zlib"}) +@itemx @code{compression-level} (default: @code{3}) +The SSH-level compression methods and compression level requested. + +Note that offloading relies on SSH compression to reduce bandwidth usage +when transferring files to and from build machines. + +@item @code{daemon-socket} (default: @code{"/var/guix/daemon-socket/socket"}) +File name of the Unix-domain socket @command{guix-daemon} is listening to on +that machine. + +@item @code{parallel-builds} (default: @code{1}) +The number of builds that may run in parallel on the machine. + +@item @code{speed} (default: @code{1.0}) +A ``relative speed factor''. The offload scheduler will tend to prefer +machines with a higher speed factor. + +@item @code{features} (default: @code{'()}) +A list of strings denoting specific features supported by the machine. An +example is @code{"kvm"} for machines that have the KVM Linux modules and +corresponding hardware support. Derivations can request features by name, +and they will be scheduled on matching build machines. + +@end table +@end deftp + +The @command{guix} command must be in the search path on the build +machines. You can check whether this is the case by running: + +@example +ssh build-machine guix repl --version +@end example + +There is one last thing to do once @file{machines.scm} is in place. As +explained above, when offloading, files are transferred back and forth +between the machine stores. For this to work, you first need to generate a +key pair on each machine to allow the daemon to export signed archives of +files from the store (@pxref{Invoking guix archive}): + +@example +# guix archive --generate-key +@end example + +@noindent +Each build machine must authorize the key of the master machine so that it +accepts store items it receives from the master: + +@example +# guix archive --authorize < master-public-key.txt +@end example + +@noindent +Likewise, the master machine must authorize the key of each build machine. + +All the fuss with keys is here to express pairwise mutual trust relations +between the master and the build machines. Concretely, when the master +receives files from a build machine (and @i{vice versa}), its build daemon +can make sure they are genuine, have not been tampered with, and that they +are signed by an authorized key. + +@cindex offload test +To test whether your setup is operational, run this command on the master +node: + +@example +# guix offload test +@end example + +This will attempt to connect to each of the build machines specified in +@file{/etc/guix/machines.scm}, make sure Guile and the Guix modules are +available on each machine, attempt to export to the machine and import from +it, and report any error in the process. + +If you want to test a different machine file, just specify it on the command +line: + +@example +# guix offload test machines-qualif.scm +@end example + +Last, you can test the subset of the machines whose name matches a regular +expression like this: + +@example +# guix offload test machines.scm '\.gnu\.org$' +@end example + +@cindex offload status +To display the current load of all build hosts, run this command on the main +node: + +@example +# guix offload status +@end example + + +@node SELinux Support +@subsection SELinux Support + +@cindex SELinux, daemon policy +@cindex mandatory access control, SELinux +@cindex security, guix-daemon +Guix includes an SELinux policy file at @file{etc/guix-daemon.cil} that can +be installed on a system where SELinux is enabled, in order to label Guix +files and to specify the expected behavior of the daemon. Since Guix System +does not provide an SELinux base policy, the daemon policy cannot be used on +Guix System. + +@subsubsection Installing the SELinux policy +@cindex SELinux, policy installation +To install the policy run this command as root: + +@example +semodule -i etc/guix-daemon.cil +@end example + +Then relabel the file system with @code{restorecon} or by a different +mechanism provided by your system. + +Once the policy is installed, the file system has been relabeled, and the +daemon has been restarted, it should be running in the @code{guix_daemon_t} +context. You can confirm this with the following command: + +@example +ps -Zax | grep guix-daemon +@end example + +Monitor the SELinux log files as you run a command like @code{guix build +hello} to convince yourself that SELinux permits all necessary operations. + +@subsubsection Limitations +@cindex SELinux, limitations + +This policy is not perfect. Here is a list of limitations or quirks that +should be considered when deploying the provided SELinux policy for the Guix +daemon. + +@enumerate +@item +@code{guix_daemon_socket_t} isn’t actually used. None of the socket +operations involve contexts that have anything to do with +@code{guix_daemon_socket_t}. It doesn’t hurt to have this unused label, but +it would be preferrable to define socket rules for only this label. + +@item +@code{guix gc} cannot access arbitrary links to profiles. By design, the +file label of the destination of a symlink is independent of the file label +of the link itself. Although all profiles under $localstatedir are +labelled, the links to these profiles inherit the label of the directory +they are in. For links in the user’s home directory this will be +@code{user_home_t}. But for links from the root user’s home directory, or +@file{/tmp}, or the HTTP server’s working directory, etc, this won’t work. +@code{guix gc} would be prevented from reading and following these links. + +@item +The daemon’s feature to listen for TCP connections might no longer work. +This might require extra rules, because SELinux treats network sockets +differently from files. + +@item +Currently all files with a name matching the regular expression +@code{/gnu/store/.+-(guix-.+|profile)/bin/guix-daemon} are assigned the +label @code{guix_daemon_exec_t}; this means that @emph{any} file with that +name in any profile would be permitted to run in the @code{guix_daemon_t} +domain. This is not ideal. An attacker could build a package that provides +this executable and convince a user to install and run it, which lifts it +into the @code{guix_daemon_t} domain. At that point SELinux could not +prevent it from accessing files that are allowed for processes in that +domain. + +We could generate a much more restrictive policy at installation time, so +that only the @emph{exact} file name of the currently installed +@code{guix-daemon} executable would be labelled with +@code{guix_daemon_exec_t}, instead of using a broad regular expression. The +downside is that root would have to install or upgrade the policy at +installation time whenever the Guix package that provides the effectively +running @code{guix-daemon} executable is upgraded. +@end enumerate + +@node Invoking guix-daemon +@section Invoking @command{guix-daemon} + +The @command{guix-daemon} program implements all the functionality to access +the store. This includes launching build processes, running the garbage +collector, querying the availability of a build result, etc. It is normally +run as @code{root} like this: + +@example +# guix-daemon --build-users-group=guixbuild +@end example + +@noindent +For details on how to set it up, @pxref{Setting Up the Daemon}. + +@cindex chroot +@cindex container, build environment +@cindex build environment +@cindex reproducible builds +By default, @command{guix-daemon} launches build processes under different +UIDs, taken from the build group specified with @code{--build-users-group}. +In addition, each build process is run in a chroot environment that only +contains the subset of the store that the build process depends on, as +specified by its derivation (@pxref{Programming Interface, derivation}), +plus a set of specific system directories. By default, the latter contains +@file{/dev} and @file{/dev/pts}. Furthermore, on GNU/Linux, the build +environment is a @dfn{container}: in addition to having its own file system +tree, it has a separate mount name space, its own PID name space, network +name space, etc. This helps achieve reproducible builds (@pxref{Features}). + +When the daemon performs a build on behalf of the user, it creates a build +directory under @file{/tmp} or under the directory specified by its +@code{TMPDIR} environment variable. This directory is shared with the +container for the duration of the build, though within the container, the +build tree is always called @file{/tmp/guix-build-@var{name}.drv-0}. + +The build directory is automatically deleted upon completion, unless the +build failed and the client specified @option{--keep-failed} +(@pxref{Invoking guix build, @option{--keep-failed}}). + +The daemon listens for connections and spawns one sub-process for each +session started by a client (one of the @command{guix} sub-commands.) The +@command{guix processes} command allows you to get an overview of the +activity on your system by viewing each of the active sessions and clients. +@xref{Invoking guix processes}, for more information. + +The following command-line options are supported: + +@table @code +@item --build-users-group=@var{group} +Take users from @var{group} to run build processes (@pxref{Setting Up the +Daemon, build users}). + +@item --no-substitutes +@cindex substitutes +Do not use substitutes for build products. That is, always build things +locally instead of allowing downloads of pre-built binaries +(@pxref{Substitutes}). + +When the daemon runs with @code{--no-substitutes}, clients can still +explicitly enable substitution @i{via} the @code{set-build-options} remote +procedure call (@pxref{The Store}). + +@item --substitute-urls=@var{urls} +@anchor{daemon-substitute-urls} +Consider @var{urls} the default whitespace-separated list of substitute +source URLs. When this option is omitted, +@indicateurl{https://@value{SUBSTITUTE-SERVER}} is used. + +This means that substitutes may be downloaded from @var{urls}, as long as +they are signed by a trusted signature (@pxref{Substitutes}). + +@cindex build hook +@item --no-build-hook +Do not use the @dfn{build hook}. + +The build hook is a helper program that the daemon can start and to which it +submits build requests. This mechanism is used to offload builds to other +machines (@pxref{Daemon Offload Setup}). + +@item --cache-failures +Cache build failures. By default, only successful builds are cached. + +When this option is used, @command{guix gc --list-failures} can be used to +query the set of store items marked as failed; @command{guix gc +--clear-failures} removes store items from the set of cached failures. +@xref{Invoking guix gc}. + +@item --cores=@var{n} +@itemx -c @var{n} +Use @var{n} CPU cores to build each derivation; @code{0} means as many as +available. + +The default value is @code{0}, but it may be overridden by clients, such as +the @code{--cores} option of @command{guix build} (@pxref{Invoking guix +build}). + +The effect is to define the @code{NIX_BUILD_CORES} environment variable in +the build process, which can then use it to exploit internal +parallelism---for instance, by running @code{make -j$NIX_BUILD_CORES}. + +@item --max-jobs=@var{n} +@itemx -M @var{n} +Allow at most @var{n} build jobs in parallel. The default value is +@code{1}. Setting it to @code{0} means that no builds will be performed +locally; instead, the daemon will offload builds (@pxref{Daemon Offload +Setup}), or simply fail. + +@item --max-silent-time=@var{seconds} +When the build or substitution process remains silent for more than +@var{seconds}, terminate it and report a build failure. + +The default value is @code{0}, which disables the timeout. + +The value specified here can be overridden by clients (@pxref{Common Build +Options, @code{--max-silent-time}}). + +@item --timeout=@var{seconds} +Likewise, when the build or substitution process lasts for more than +@var{seconds}, terminate it and report a build failure. + +The default value is @code{0}, which disables the timeout. + +The value specified here can be overridden by clients (@pxref{Common Build +Options, @code{--timeout}}). + +@item --rounds=@var{N} +Build each derivation @var{n} times in a row, and raise an error if +consecutive build results are not bit-for-bit identical. Note that this +setting can be overridden by clients such as @command{guix build} +(@pxref{Invoking guix build}). + +When used in conjunction with @option{--keep-failed}, the differing output +is kept in the store, under @file{/gnu/store/@dots{}-check}. This makes it +easy to look for differences between the two results. + +@item --debug +Produce debugging output. + +This is useful to debug daemon start-up issues, but then it may be +overridden by clients, for example the @code{--verbosity} option of +@command{guix build} (@pxref{Invoking guix build}). + +@item --chroot-directory=@var{dir} +Add @var{dir} to the build chroot. + +Doing this may change the result of build processes---for instance if they +use optional dependencies found in @var{dir} when it is available, and not +otherwise. For that reason, it is not recommended to do so. Instead, make +sure that each derivation declares all the inputs that it needs. + +@item --disable-chroot +Disable chroot builds. + +Using this option is not recommended since, again, it would allow build +processes to gain access to undeclared dependencies. It is necessary, +though, when @command{guix-daemon} is running under an unprivileged user +account. + +@item --log-compression=@var{type} +Compress build logs according to @var{type}, one of @code{gzip}, +@code{bzip2}, or @code{none}. + +Unless @code{--lose-logs} is used, all the build logs are kept in the +@var{localstatedir}. To save space, the daemon automatically compresses +them with bzip2 by default. + +@item --disable-deduplication +@cindex deduplication +Disable automatic file ``deduplication'' in the store. + +By default, files added to the store are automatically ``deduplicated'': if +a newly added file is identical to another one found in the store, the +daemon makes the new file a hard link to the other file. This can +noticeably reduce disk usage, at the expense of slightly increased +input/output load at the end of a build process. This option disables this +optimization. + +@item --gc-keep-outputs[=yes|no] +Tell whether the garbage collector (GC) must keep outputs of live +derivations. + +@cindex GC roots +@cindex garbage collector roots +When set to ``yes'', the GC will keep the outputs of any live derivation +available in the store---the @code{.drv} files. The default is ``no'', +meaning that derivation outputs are kept only if they are reachable from a +GC root. @xref{Invoking guix gc}, for more on GC roots. + +@item --gc-keep-derivations[=yes|no] +Tell whether the garbage collector (GC) must keep derivations corresponding +to live outputs. + +When set to ``yes'', as is the case by default, the GC keeps +derivations---i.e., @code{.drv} files---as long as at least one of their +outputs is live. This allows users to keep track of the origins of items in +their store. Setting it to ``no'' saves a bit of disk space. + +In this way, setting @code{--gc-keep-derivations} to ``yes'' causes liveness +to flow from outputs to derivations, and setting @code{--gc-keep-outputs} to +``yes'' causes liveness to flow from derivations to outputs. When both are +set to ``yes'', the effect is to keep all the build prerequisites (the +sources, compiler, libraries, and other build-time tools) of live objects in +the store, regardless of whether these prerequisites are reachable from a GC +root. This is convenient for developers since it saves rebuilds or +downloads. + +@item --impersonate-linux-2.6 +On Linux-based systems, impersonate Linux 2.6. This means that the kernel's +@code{uname} system call will report 2.6 as the release number. + +This might be helpful to build programs that (usually wrongfully) depend on +the kernel version number. + +@item --lose-logs +Do not keep build logs. By default they are kept under +@code{@var{localstatedir}/guix/log}. + +@item --system=@var{system} +Assume @var{system} as the current system type. By default it is the +architecture/kernel pair found at configure time, such as +@code{x86_64-linux}. + +@item --listen=@var{endpoint} +Listen for connections on @var{endpoint}. @var{endpoint} is interpreted as +the file name of a Unix-domain socket if it starts with @code{/} (slash +sign). Otherwise, @var{endpoint} is interpreted as a host name or host name +and port to listen to. Here are a few examples: + +@table @code +@item --listen=/gnu/var/daemon +Listen for connections on the @file{/gnu/var/daemon} Unix-domain socket, +creating it if needed. + +@item --listen=localhost +@cindex daemon, remote access +@cindex remote access to the daemon +@cindex daemon, cluster setup +@cindex clusters, daemon setup +Listen for TCP connections on the network interface corresponding to +@code{localhost}, on port 44146. + +@item --listen=128.0.0.42:1234 +Listen for TCP connections on the network interface corresponding to +@code{128.0.0.42}, on port 1234. +@end table + +This option can be repeated multiple times, in which case +@command{guix-daemon} accepts connections on all the specified endpoints. +Users can tell client commands what endpoint to connect to by setting the +@code{GUIX_DAEMON_SOCKET} environment variable (@pxref{The Store, +@code{GUIX_DAEMON_SOCKET}}). + +@quotation Note +The daemon protocol is @emph{unauthenticated and unencrypted}. Using +@code{--listen=@var{host}} is suitable on local networks, such as clusters, +where only trusted nodes may connect to the build daemon. In other cases +where remote access to the daemon is needed, we recommend using Unix-domain +sockets along with SSH. +@end quotation + +When @code{--listen} is omitted, @command{guix-daemon} listens for +connections on the Unix-domain socket located at +@file{@var{localstatedir}/guix/daemon-socket/socket}. +@end table + + +@node Application Setup +@section Application Setup + +@cindex foreign distro +When using Guix on top of GNU/Linux distribution other than Guix System---a +so-called @dfn{foreign distro}---a few additional steps are needed to get +everything in place. Here are some of them. + +@subsection Locales + +@anchor{locales-and-locpath} +@cindex locales, when not on Guix System +@vindex LOCPATH +@vindex GUIX_LOCPATH +Packages installed @i{via} Guix will not use the locale data of the host +system. Instead, you must first install one of the locale packages +available with Guix and then define the @code{GUIX_LOCPATH} environment +variable: + +@example +$ guix package -i glibc-locales +$ export GUIX_LOCPATH=$HOME/.guix-profile/lib/locale +@end example + +Note that the @code{glibc-locales} package contains data for all the locales +supported by the GNU@tie{}libc and weighs in at around 110@tie{}MiB. +Alternatively, the @code{glibc-utf8-locales} is smaller but limited to a few +UTF-8 locales. + +The @code{GUIX_LOCPATH} variable plays a role similar to @code{LOCPATH} +(@pxref{Locale Names, @code{LOCPATH},, libc, The GNU C Library Reference +Manual}). There are two important differences though: + +@enumerate +@item +@code{GUIX_LOCPATH} is honored only by the libc in Guix, and not by the libc +provided by foreign distros. Thus, using @code{GUIX_LOCPATH} allows you to +make sure the programs of the foreign distro will not end up loading +incompatible locale data. + +@item +libc suffixes each entry of @code{GUIX_LOCPATH} with @code{/X.Y}, where +@code{X.Y} is the libc version---e.g., @code{2.22}. This means that, should +your Guix profile contain a mixture of programs linked against different +libc version, each libc version will only try to load locale data in the +right format. +@end enumerate + +This is important because the locale data format used by different libc +versions may be incompatible. + +@subsection Name Service Switch + +@cindex name service switch, glibc +@cindex NSS (name service switch), glibc +@cindex nscd (name service caching daemon) +@cindex name service caching daemon (nscd) +When using Guix on a foreign distro, we @emph{strongly recommend} that the +system run the GNU C library's @dfn{name service cache daemon}, +@command{nscd}, which should be listening on the @file{/var/run/nscd/socket} +socket. Failing to do that, applications installed with Guix may fail to +look up host names or user accounts, or may even crash. The next paragraphs +explain why. + +@cindex @file{nsswitch.conf} +The GNU C library implements a @dfn{name service switch} (NSS), which is an +extensible mechanism for ``name lookups'' in general: host name resolution, +user accounts, and more (@pxref{Name Service Switch,,, libc, The GNU C +Library Reference Manual}). + +@cindex Network information service (NIS) +@cindex NIS (Network information service) +Being extensible, the NSS supports @dfn{plugins}, which provide new name +lookup implementations: for example, the @code{nss-mdns} plugin allow +resolution of @code{.local} host names, the @code{nis} plugin allows user +account lookup using the Network information service (NIS), and so on. +These extra ``lookup services'' are configured system-wide in +@file{/etc/nsswitch.conf}, and all the programs running on the system honor +those settings (@pxref{NSS Configuration File,,, libc, The GNU C Reference +Manual}). + +When they perform a name lookup---for instance by calling the +@code{getaddrinfo} function in C---applications first try to connect to the +nscd; on success, nscd performs name lookups on their behalf. If the nscd +is not running, then they perform the name lookup by themselves, by loading +the name lookup services into their own address space and running it. These +name lookup services---the @file{libnss_*.so} files---are @code{dlopen}'d, +but they may come from the host system's C library, rather than from the C +library the application is linked against (the C library coming from Guix). + +And this is where the problem is: if your application is linked against +Guix's C library (say, glibc 2.24) and tries to load NSS plugins from +another C library (say, @code{libnss_mdns.so} for glibc 2.22), it will +likely crash or have its name lookups fail unexpectedly. + +Running @command{nscd} on the system, among other advantages, eliminates +this binary incompatibility problem because those @code{libnss_*.so} files +are loaded in the @command{nscd} process, not in applications themselves. + +@subsection X11 Fonts + +@cindex fonts +The majority of graphical applications use Fontconfig to locate and load +fonts and perform X11-client-side rendering. The @code{fontconfig} package +in Guix looks for fonts in @file{$HOME/.guix-profile} by default. Thus, to +allow graphical applications installed with Guix to display fonts, you have +to install fonts with Guix as well. Essential font packages include +@code{gs-fonts}, @code{font-dejavu}, and @code{font-gnu-freefont-ttf}. + +To display text written in Chinese languages, Japanese, or Korean in +graphical applications, consider installing +@code{font-adobe-source-han-sans} or @code{font-wqy-zenhei}. The former has +multiple outputs, one per language family (@pxref{Packages with Multiple +Outputs}). For instance, the following command installs fonts for Chinese +languages: + +@example +guix package -i font-adobe-source-han-sans:cn +@end example + +@cindex @code{xterm} +Older programs such as @command{xterm} do not use Fontconfig and instead +rely on server-side font rendering. Such programs require to specify a full +name of a font using XLFD (X Logical Font Description), like this: + +@example +-*-dejavu sans-medium-r-normal-*-*-100-*-*-*-*-*-1 +@end example + +To be able to use such full names for the TrueType fonts installed in your +Guix profile, you need to extend the font path of the X server: + +@c Note: 'xset' does not accept symlinks so the trick below arranges to +@c get at the real directory. See <https://bugs.gnu.org/30655>. +@example +xset +fp $(dirname $(readlink -f ~/.guix-profile/share/fonts/truetype/fonts.dir)) +@end example + +@cindex @code{xlsfonts} +After that, you can run @code{xlsfonts} (from @code{xlsfonts} package) to +make sure your TrueType fonts are listed there. + +@cindex @code{fc-cache} +@cindex font cache +After installing fonts you may have to refresh the font cache to use them in +applications. The same applies when applications installed via Guix do not +seem to find fonts. To force rebuilding of the font cache run +@code{fc-cache -f}. The @code{fc-cache} command is provided by the +@code{fontconfig} package. + +@subsection X.509 Certificates + +@cindex @code{nss-certs} +The @code{nss-certs} package provides X.509 certificates, which allow +programs to authenticate Web servers accessed over HTTPS. + +When using Guix on a foreign distro, you can install this package and define +the relevant environment variables so that packages know where to look for +certificates. @xref{X.509 Certificates}, for detailed information. + +@subsection Emacs Packages + +@cindex @code{emacs} +When you install Emacs packages with Guix, the elisp files may be placed +either in @file{$HOME/.guix-profile/share/emacs/site-lisp/} or in +sub-directories of +@file{$HOME/.guix-profile/share/emacs/site-lisp/guix.d/}. The latter +directory exists because potentially there may exist thousands of Emacs +packages and storing all their files in a single directory may not be +reliable (because of name conflicts). So we think using a separate +directory for each package is a good idea. It is very similar to how the +Emacs package system organizes the file structure (@pxref{Package Files,,, +emacs, The GNU Emacs Manual}). + +By default, Emacs (installed with Guix) ``knows'' where these packages are +placed, so you do not need to perform any configuration. If, for some +reason, you want to avoid auto-loading Emacs packages installed with Guix, +you can do so by running Emacs with @code{--no-site-file} option +(@pxref{Init File,,, emacs, The GNU Emacs Manual}). + +@subsection The GCC toolchain + +@cindex GCC +@cindex ld-wrapper + +Guix offers individual compiler packages such as @code{gcc} but if you are +in need of a complete toolchain for compiling and linking source code what +you really want is the @code{gcc-toolchain} package. This package provides +a complete GCC toolchain for C/C++ development, including GCC itself, the +GNU C Library (headers and binaries, plus debugging symbols in the +@code{debug} output), Binutils, and a linker wrapper. + +The wrapper's purpose is to inspect the @code{-L} and @code{-l} switches +passed to the linker, add corresponding @code{-rpath} arguments, and invoke +the actual linker with this new set of arguments. You can instruct the +wrapper to refuse to link against libraries not in the store by setting the +@code{GUIX_LD_WRAPPER_ALLOW_IMPURITIES} environment variable to @code{no}. + +@c TODO What else? + +@c ********************************************************************* +@node System Installation +@chapter System Installation + +@cindex installing Guix System +@cindex Guix System, installation +This section explains how to install Guix System on a machine. Guix, as a +package manager, can also be installed on top of a running GNU/Linux system, +@pxref{Installation}. + +@ifinfo +@quotation Note +@c This paragraph is for people reading this from tty2 of the +@c installation image. +You are reading this documentation with an Info reader. For details on how +to use it, hit the @key{RET} key (``return'' or ``enter'') on the link that +follows: @pxref{Top, Info reader,, info-stnd, Stand-alone GNU Info}. Hit +@kbd{l} afterwards to come back here. + +Alternately, run @command{info info} in another tty to keep the manual +available. +@end quotation +@end ifinfo + +@menu +* Limitations:: What you can expect. +* Hardware Considerations:: Supported hardware. +* USB Stick and DVD Installation:: Preparing the installation medium. +* Preparing for Installation:: Networking, partitioning, etc. +* Guided Graphical Installation:: Easy graphical installation. +* Manual Installation:: Manual installation for wizards. +* After System Installation:: When installation succeeded. +* Installing Guix in a VM:: Guix System playground. +* Building the Installation Image:: How this comes to be. +@end menu + +@node Limitations +@section Limitations + +We consider Guix System to be ready for a wide range of ``desktop'' and +server use cases. The reliability guarantees it provides---transactional +upgrades and rollbacks, reproducibility---make it a solid foundation. + +Nevertheless, before you proceed with the installation, be aware of the +following noteworthy limitations applicable to version @value{VERSION}: + +@itemize +@item +Support for the Logical Volume Manager (LVM) is missing. + +@item +More and more system services are provided (@pxref{Services}), but some may +be missing. + +@item +GNOME, Xfce, LXDE, and Enlightenment are available (@pxref{Desktop +Services}), as well as a number of X11 window managers. However, KDE is +currently missing. +@end itemize + +More than a disclaimer, this is an invitation to report issues (and success +stories!), and to join us in improving it. @xref{贡献}, for more +info. + + +@node Hardware Considerations +@section Hardware Considerations + +@cindex hardware support on Guix System +GNU@tie{}Guix focuses on respecting the user's computing freedom. It builds +around the kernel Linux-libre, which means that only hardware for which free +software drivers and firmware exist is supported. Nowadays, a wide range of +off-the-shelf hardware is supported on GNU/Linux-libre---from keyboards to +graphics cards to scanners and Ethernet controllers. Unfortunately, there +are still areas where hardware vendors deny users control over their own +computing, and such hardware is not supported on Guix System. + +@cindex WiFi, hardware support +One of the main areas where free drivers or firmware are lacking is WiFi +devices. WiFi devices known to work include those using Atheros chips +(AR9271 and AR7010), which corresponds to the @code{ath9k} Linux-libre +driver, and those using Broadcom/AirForce chips (BCM43xx with Wireless-Core +Revision 5), which corresponds to the @code{b43-open} Linux-libre driver. +Free firmware exists for both and is available out-of-the-box on Guix +System, as part of @code{%base-firmware} (@pxref{operating-system Reference, +@code{firmware}}). + +@cindex RYF, Respects Your Freedom +The @uref{https://www.fsf.org/, Free Software Foundation} runs +@uref{https://www.fsf.org/ryf, @dfn{Respects Your Freedom}} (RYF), a +certification program for hardware products that respect your freedom and +your privacy and ensure that you have control over your device. We +encourage you to check the list of RYF-certified devices. + +Another useful resource is the @uref{https://www.h-node.org/, H-Node} web +site. It contains a catalog of hardware devices with information about +their support in GNU/Linux. + + +@node USB Stick and DVD Installation +@section USB Stick and DVD Installation + +An ISO-9660 installation image that can be written to a USB stick or burnt +to a DVD can be downloaded from +@indicateurl{https://alpha.gnu.org/gnu/guix/guix-system-install-@value{VERSION}.@var{system}.iso.xz}, +where @var{system} is one of: + +@table @code +@item x86_64-linux +for a GNU/Linux system on Intel/AMD-compatible 64-bit CPUs; + +@item i686-linux +for a 32-bit GNU/Linux system on Intel-compatible CPUs. +@end table + +@c start duplication of authentication part from ``Binary Installation'' +Make sure to download the associated @file{.sig} file and to verify the +authenticity of the image against it, along these lines: + +@example +$ wget https://alpha.gnu.org/gnu/guix/guix-system-install-@value{VERSION}.@var{system}.iso.xz.sig +$ gpg --verify guix-system-install-@value{VERSION}.@var{system}.iso.xz.sig +@end example + +If that command fails because you do not have the required public key, then +run this command to import it: + +@example +$ gpg --keyserver @value{KEY-SERVER} \ + --recv-keys @value{OPENPGP-SIGNING-KEY-ID} +@end example + +@noindent +@c end duplication +and rerun the @code{gpg --verify} command. + +This image contains the tools necessary for an installation. It is meant to +be copied @emph{as is} to a large-enough USB stick or DVD. + +@unnumberedsubsec Copying to a USB Stick + +To copy the image to a USB stick, follow these steps: + +@enumerate +@item +Decompress the image using the @command{xz} command: + +@example +xz -d guix-system-install-@value{VERSION}.@var{system}.iso.xz +@end example + +@item +Insert a USB stick of 1@tie{}GiB or more into your machine, and determine +its device name. Assuming that the USB stick is known as @file{/dev/sdX}, +copy the image with: + +@example +dd if=guix-system-install-@value{VERSION}.@var{system}.iso of=/dev/sdX +sync +@end example + +Access to @file{/dev/sdX} usually requires root privileges. +@end enumerate + +@unnumberedsubsec Burning on a DVD + +To copy the image to a DVD, follow these steps: + +@enumerate +@item +Decompress the image using the @command{xz} command: + +@example +xz -d guix-system-install-@value{VERSION}.@var{system}.iso.xz +@end example + +@item +Insert a blank DVD into your machine, and determine its device name. +Assuming that the DVD drive is known as @file{/dev/srX}, copy the image +with: + +@example +growisofs -dvd-compat -Z /dev/srX=guix-system-install-@value{VERSION}.@var{system}.iso +@end example + +Access to @file{/dev/srX} usually requires root privileges. +@end enumerate + +@unnumberedsubsec Booting + +Once this is done, you should be able to reboot the system and boot from the +USB stick or DVD. The latter usually requires you to get in the BIOS or +UEFI boot menu, where you can choose to boot from the USB stick. + +@xref{Installing Guix in a VM}, if, instead, you would like to install Guix +System in a virtual machine (VM). + + +@node Preparing for Installation +@section Preparing for Installation + +Once you have booted, you can use the guided graphical installer, which +makes it easy to get started (@pxref{Guided Graphical Installation}). +Alternately, if you are already familiar with GNU/Linux and if you want more +control than what the graphical installer provides, you can choose the +``manual'' installation process (@pxref{Manual Installation}). + +The graphical installer is available on TTY1. You can obtain root shells on +TTYs 3 to 6 by hitting @kbd{ctrl-alt-f3}, @kbd{ctrl-alt-f4}, etc. TTY2 +shows this documentation and you can reach it with @kbd{ctrl-alt-f2}. +Documentation is browsable using the Info reader commands (@pxref{Top,,, +info-stnd, Stand-alone GNU Info}). The installation system runs the GPM +mouse daemon, which allows you to select text with the left mouse button and +to paste it with the middle button. + +@quotation Note +Installation requires access to the Internet so that any missing +dependencies of your system configuration can be downloaded. See the +``Networking'' section below. +@end quotation + +@node Guided Graphical Installation +@section Guided Graphical Installation + +The graphical installer is a text-based user interface. It will guide you, +with dialog boxes, through the steps needed to install GNU@tie{}Guix System. + +The first dialog boxes allow you to set up the system as you use it during +the installation: you can choose the language, keyboard layout, and set up +networking, which will be used during the installation. The image below +shows the networking dialog. + +@image{images/installer-network,5in,, networking setup with the graphical +installer} + +Later steps allow you to partition your hard disk, as shown in the image +below, to choose whether or not to use encrypted file systems, to enter the +host name and root password, and to create an additional account, among +other things. + +@image{images/installer-partitions,5in,, partitioning with the graphical +installer} + +Note that, at any time, the installer allows you to exit the current +installation step and resume at a previous step, as show in the image below. + +@image{images/installer-resume,5in,, resuming the installation process} + +Once you're done, the installer produces an operating system configuration +and displays it (@pxref{Using the Configuration System}). At that point you +can hit ``OK'' and installation will proceed. On success, you can reboot +into the new system and enjoy. @xref{After System Installation}, for what's +next! + + +@node Manual Installation +@section Manual Installation + +This section describes how you would ``manually'' install GNU@tie{}Guix +System on your machine. This option requires familiarity with GNU/Linux, +with the shell, and with common administration tools. If you think this is +not for you, consider using the guided graphical installer (@pxref{Guided +Graphical Installation}). + +The installation system provides root shells on TTYs 3 to 6; press +@kbd{ctrl-alt-f3}, @kbd{ctrl-alt-f4}, and so on to reach them. It includes +many common tools needed to install the system. But it is also a full-blown +Guix System, which means that you can install additional packages, should +you need it, using @command{guix package} (@pxref{Invoking guix package}). + +@menu +* Keyboard Layout and Networking and Partitioning:: Initial setup. +* Proceeding with the Installation:: Installing. +@end menu + +@node Keyboard Layout and Networking and Partitioning +@subsection Keyboard Layout, Networking, and Partitioning + +Before you can install the system, you may want to adjust the keyboard +layout, set up networking, and partition your target hard disk. This +section will guide you through this. + +@subsubsection Keyboard Layout + +@cindex keyboard layout +The installation image uses the US qwerty keyboard layout. If you want to +change it, you can use the @command{loadkeys} command. For example, the +following command selects the Dvorak keyboard layout: + +@example +loadkeys dvorak +@end example + +See the files under @file{/run/current-system/profile/share/keymaps} for a +list of available keyboard layouts. Run @command{man loadkeys} for more +information. + +@subsubsection Networking + +Run the following command to see what your network interfaces are called: + +@example +ifconfig -a +@end example + +@noindent +@dots{} or, using the GNU/Linux-specific @command{ip} command: + +@example +ip a +@end example + +@c http://cgit.freedesktop.org/systemd/systemd/tree/src/udev/udev-builtin-net_id.c#n20 +Wired interfaces have a name starting with @samp{e}; for example, the +interface corresponding to the first on-board Ethernet controller is called +@samp{eno1}. Wireless interfaces have a name starting with @samp{w}, like +@samp{w1p2s0}. + +@table @asis +@item Wired connection +To configure a wired network run the following command, substituting +@var{interface} with the name of the wired interface you want to use. + +@example +ifconfig @var{interface} up +@end example + +@item Wireless connection +@cindex wireless +@cindex WiFi +To configure wireless networking, you can create a configuration file for +the @command{wpa_supplicant} configuration tool (its location is not +important) using one of the available text editors such as @command{nano}: + +@example +nano wpa_supplicant.conf +@end example + +As an example, the following stanza can go to this file and will work for +many wireless networks, provided you give the actual SSID and passphrase for +the network you are connecting to: + +@example +network=@{ + ssid="@var{my-ssid}" + key_mgmt=WPA-PSK + psk="the network's secret passphrase" +@} +@end example + +Start the wireless service and run it in the background with the following +command (substitute @var{interface} with the name of the network interface +you want to use): + +@example +wpa_supplicant -c wpa_supplicant.conf -i @var{interface} -B +@end example + +Run @command{man wpa_supplicant} for more information. +@end table + +@cindex DHCP +At this point, you need to acquire an IP address. On a network where IP +addresses are automatically assigned @i{via} DHCP, you can run: + +@example +dhclient -v @var{interface} +@end example + +Try to ping a server to see if networking is up and running: + +@example +ping -c 3 gnu.org +@end example + +Setting up network access is almost always a requirement because the image +does not contain all the software and tools that may be needed. + +@cindex installing over SSH +If you want to, you can continue the installation remotely by starting an +SSH server: + +@example +herd start ssh-daemon +@end example + +Make sure to either set a password with @command{passwd}, or configure +OpenSSH public key authentication before logging in. + +@subsubsection Disk Partitioning + +Unless this has already been done, the next step is to partition, and then +format the target partition(s). + +The installation image includes several partitioning tools, including Parted +(@pxref{Overview,,, parted, GNU Parted User Manual}), @command{fdisk}, and +@command{cfdisk}. Run it and set up your disk with the partition layout you +want: + +@example +cfdisk +@end example + +If your disk uses the GUID Partition Table (GPT) format and you plan to +install BIOS-based GRUB (which is the default), make sure a BIOS Boot +Partition is available (@pxref{BIOS installation,,, grub, GNU GRUB manual}). + +@cindex EFI, installation +@cindex UEFI, installation +@cindex ESP, EFI system partition +If you instead wish to use EFI-based GRUB, a FAT32 @dfn{EFI System +Partition} (ESP) is required. This partition can be mounted at +@file{/boot/efi} for instance and must have the @code{esp} flag set. E.g., +for @command{parted}: + +@example +parted /dev/sda set 1 esp on +@end example + +@quotation Note +@vindex grub-bootloader +@vindex grub-efi-bootloader +Unsure whether to use EFI- or BIOS-based GRUB? If the directory +@file{/sys/firmware/efi} exists in the installation image, then you should +probably perform an EFI installation, using @code{grub-efi-bootloader}. +Otherwise you should use the BIOS-based GRUB, known as +@code{grub-bootloader}. @xref{Bootloader Configuration}, for more info on +bootloaders. +@end quotation + +Once you are done partitioning the target hard disk drive, you have to +create a file system on the relevant partition(s)@footnote{Currently Guix +System only supports ext4 and btrfs file systems. In particular, code that +reads file system UUIDs and labels only works for these file system +types.}. For the ESP, if you have one and assuming it is @file{/dev/sda1}, +run: + +@example +mkfs.fat -F32 /dev/sda1 +@end example + +Preferably, assign file systems a label so that you can easily and reliably +refer to them in @code{file-system} declarations (@pxref{File Systems}). +This is typically done using the @code{-L} option of @command{mkfs.ext4} and +related commands. So, assuming the target root partition lives at +@file{/dev/sda2}, a file system with the label @code{my-root} can be created +with: + +@example +mkfs.ext4 -L my-root /dev/sda2 +@end example + +@cindex encrypted disk +If you are instead planning to encrypt the root partition, you can use the +Cryptsetup/LUKS utilities to do that (see @inlinefmtifelse{html, +@uref{https://linux.die.net/man/8/cryptsetup, @code{man cryptsetup}}, +@code{man cryptsetup}} for more information.) Assuming you want to store +the root partition on @file{/dev/sda2}, the command sequence would be along +these lines: + +@example +cryptsetup luksFormat /dev/sda2 +cryptsetup open --type luks /dev/sda2 my-partition +mkfs.ext4 -L my-root /dev/mapper/my-partition +@end example + +Once that is done, mount the target file system under @file{/mnt} with a +command like (again, assuming @code{my-root} is the label of the root file +system): + +@example +mount LABEL=my-root /mnt +@end example + +Also mount any other file systems you would like to use on the target system +relative to this path. If you have opted for @file{/boot/efi} as an EFI +mount point for example, mount it at @file{/mnt/boot/efi} now so it is found +by @code{guix system init} afterwards. + +Finally, if you plan to use one or more swap partitions (@pxref{Memory +Concepts, swap space,, libc, The GNU C Library Reference Manual}), make sure +to initialize them with @command{mkswap}. Assuming you have one swap +partition on @file{/dev/sda3}, you would run: + +@example +mkswap /dev/sda3 +swapon /dev/sda3 +@end example + +Alternatively, you may use a swap file. For example, assuming that in the +new system you want to use the file @file{/swapfile} as a swap file, you +would run@footnote{This example will work for many types of file systems +(e.g., ext4). However, for copy-on-write file systems (e.g., btrfs), the +required steps may be different. For details, see the manual pages for +@command{mkswap} and @command{swapon}.}: + +@example +# This is 10 GiB of swap space. Adjust "count" to change the size. +dd if=/dev/zero of=/mnt/swapfile bs=1MiB count=10240 +# For security, make the file readable and writable only by root. +chmod 600 /mnt/swapfile +mkswap /mnt/swapfile +swapon /mnt/swapfile +@end example + +Note that if you have encrypted the root partition and created a swap file +in its file system as described above, then the encryption also protects the +swap file, just like any other file in that file system. + +@node Proceeding with the Installation +@subsection Proceeding with the Installation + +With the target partitions ready and the target root mounted on @file{/mnt}, +we're ready to go. First, run: + +@example +herd start cow-store /mnt +@end example + +This makes @file{/gnu/store} copy-on-write, such that packages added to it +during the installation phase are written to the target disk on @file{/mnt} +rather than kept in memory. This is necessary because the first phase of +the @command{guix system init} command (see below) entails downloads or +builds to @file{/gnu/store} which, initially, is an in-memory file system. + +Next, you have to edit a file and provide the declaration of the operating +system to be installed. To that end, the installation system comes with +three text editors. We recommend GNU nano (@pxref{Top,,, nano, GNU nano +Manual}), which supports syntax highlighting and parentheses matching; other +editors include GNU Zile (an Emacs clone), and nvi (a clone of the original +BSD @command{vi} editor). We strongly recommend storing that file on the +target root file system, say, as @file{/mnt/etc/config.scm}. Failing to do +that, you will have lost your configuration file once you have rebooted into +the newly-installed system. + +@xref{Using the Configuration System}, for an overview of the configuration +file. The example configurations discussed in that section are available +under @file{/etc/configuration} in the installation image. Thus, to get +started with a system configuration providing a graphical display server (a +``desktop'' system), you can run something along these lines: + +@example +# mkdir /mnt/etc +# cp /etc/configuration/desktop.scm /mnt/etc/config.scm +# nano /mnt/etc/config.scm +@end example + +You should pay attention to what your configuration file contains, and in +particular: + +@itemize +@item +Make sure the @code{bootloader-configuration} form refers to the target you +want to install GRUB on. It should mention @code{grub-bootloader} if you +are installing GRUB in the legacy way, or @code{grub-efi-bootloader} for +newer UEFI systems. For legacy systems, the @code{target} field names a +device, like @code{/dev/sda}; for UEFI systems it names a path to a mounted +EFI partition, like @code{/boot/efi}; do make sure the path is currently +mounted and a @code{file-system} entry is specified in your configuration. + +@item +Be sure that your file system labels match the value of their respective +@code{device} fields in your @code{file-system} configuration, assuming your +@code{file-system} configuration uses the @code{file-system-label} procedure +in its @code{device} field. + +@item +If there are encrypted or RAID partitions, make sure to add a +@code{mapped-devices} field to describe them (@pxref{Mapped Devices}). +@end itemize + +Once you are done preparing the configuration file, the new system must be +initialized (remember that the target root file system is mounted under +@file{/mnt}): + +@example +guix system init /mnt/etc/config.scm /mnt +@end example + +@noindent +This copies all the necessary files and installs GRUB on @file{/dev/sdX}, +unless you pass the @option{--no-bootloader} option. For more information, +@pxref{Invoking guix system}. This command may trigger downloads or builds +of missing packages, which can take some time. + +Once that command has completed---and hopefully succeeded!---you can run +@command{reboot} and boot into the new system. The @code{root} password in +the new system is initially empty; other users' passwords need to be +initialized by running the @command{passwd} command as @code{root}, unless +your configuration specifies otherwise (@pxref{user-account-password, user +account passwords}). @xref{After System Installation}, for what's next! + + +@node After System Installation +@section After System Installation + +Success, you've now booted into Guix System! From then on, you can update +the system whenever you want by running, say: + +@example +guix pull +sudo guix system reconfigure /etc/config.scm +@end example + +@noindent +This builds a new system generation with the latest packages and services +(@pxref{Invoking guix system}). We recommend doing that regularly so that +your system includes the latest security updates (@pxref{Security Updates}). + +@c See <https://lists.gnu.org/archive/html/guix-devel/2019-01/msg00268.html>. +@quotation Note +@cindex sudo vs. @command{guix pull} +Note that @command{sudo guix} runs your user's @command{guix} command and +@emph{not} root's, because @command{sudo} leaves @code{PATH} unchanged. To +explicitly run root's @command{guix}, type @command{sudo -i guix @dots{}}. +@end quotation + +Join us on @code{#guix} on the Freenode IRC network or on +@email{guix-devel@@gnu.org} to share your experience! + + +@node Installing Guix in a VM +@section Installing Guix in a Virtual Machine + +@cindex virtual machine, Guix System installation +@cindex virtual private server (VPS) +@cindex VPS (virtual private server) +If you'd like to install Guix System in a virtual machine (VM) or on a +virtual private server (VPS) rather than on your beloved machine, this +section is for you. + +To boot a @uref{http://qemu.org/,QEMU} VM for installing Guix System in a +disk image, follow these steps: + +@enumerate +@item +First, retrieve and decompress the Guix system installation image as +described previously (@pxref{USB Stick and DVD Installation}). + +@item +Create a disk image that will hold the installed system. To make a +qcow2-formatted disk image, use the @command{qemu-img} command: + +@example +qemu-img create -f qcow2 guixsd.img 50G +@end example + +The resulting file will be much smaller than 50 GB (typically less than 1 +MB), but it will grow as the virtualized storage device is filled up. + +@item +Boot the USB installation image in an VM: + +@example +qemu-system-x86_64 -m 1024 -smp 1 \ + -net user -net nic,model=virtio -boot menu=on \ + -drive file=guix-system-install-@value{VERSION}.@var{system}.iso \ + -drive file=guixsd.img +@end example + +The ordering of the drives matters. + +In the VM console, quickly press the @kbd{F12} key to enter the boot menu. +Then press the @kbd{2} key and the @kbd{RET} key to validate your selection. + +@item +You're now root in the VM, proceed with the installation process. +@xref{Preparing for Installation}, and follow the instructions. +@end enumerate + +Once installation is complete, you can boot the system that's on your +@file{guixsd.img} image. @xref{Running Guix in a VM}, for how to do that. + +@node Building the Installation Image +@section Building the Installation Image + +@cindex installation image +The installation image described above was built using the @command{guix +system} command, specifically: + +@example +guix system disk-image --file-system-type=iso9660 \ + gnu/system/install.scm +@end example + +Have a look at @file{gnu/system/install.scm} in the source tree, and see +also @ref{Invoking guix system} for more information about the installation +image. + +@section Building the Installation Image for ARM Boards + +Many ARM boards require a specific variant of the +@uref{http://www.denx.de/wiki/U-Boot/, U-Boot} bootloader. + +If you build a disk image and the bootloader is not available otherwise (on +another boot drive etc), it's advisable to build an image that includes the +bootloader, specifically: + +@example +guix system disk-image --system=armhf-linux -e '((@@ (gnu system install) os-with-u-boot) (@@ (gnu system install) installation-os) "A20-OLinuXino-Lime2")' +@end example + +@code{A20-OLinuXino-Lime2} is the name of the board. If you specify an +invalid board, a list of possible boards will be printed. + +@c ********************************************************************* +@node Package Management +@chapter Package Management + +@cindex packages +The purpose of GNU Guix is to allow users to easily install, upgrade, and +remove software packages, without having to know about their build +procedures or dependencies. Guix also goes beyond this obvious set of +features. + +This chapter describes the main features of Guix, as well as the package +management tools it provides. Along with the command-line interface +described below (@pxref{Invoking guix package, @code{guix package}}), you +may also use the Emacs-Guix interface (@pxref{Top,,, emacs-guix, The +Emacs-Guix Reference Manual}), after installing @code{emacs-guix} package +(run @kbd{M-x guix-help} command to start with it): + +@example +guix package -i emacs-guix +@end example + +@menu +* Features:: How Guix will make your life brighter. +* Invoking guix package:: Package installation, removal, etc. +* Substitutes:: Downloading pre-built binaries. +* Packages with Multiple Outputs:: Single source package, multiple outputs. +* Invoking guix gc:: Running the garbage collector. +* Invoking guix pull:: Fetching the latest Guix and distribution. +* Channels:: Customizing the package collection. +* Inferiors:: Interacting with another revision of Guix. +* Invoking guix describe:: Display information about your Guix revision. +* Invoking guix archive:: Exporting and importing store files. +@end menu + +@node Features +@section Features + +When using Guix, each package ends up in the @dfn{package store}, in its own +directory---something that resembles @file{/gnu/store/xxx-package-1.2}, +where @code{xxx} is a base32 string. + +Instead of referring to these directories, users have their own +@dfn{profile}, which points to the packages that they actually want to use. +These profiles are stored within each user's home directory, at +@code{$HOME/.guix-profile}. + +For example, @code{alice} installs GCC 4.7.2. As a result, +@file{/home/alice/.guix-profile/bin/gcc} points to +@file{/gnu/store/@dots{}-gcc-4.7.2/bin/gcc}. Now, on the same machine, +@code{bob} had already installed GCC 4.8.0. The profile of @code{bob} +simply continues to point to +@file{/gnu/store/@dots{}-gcc-4.8.0/bin/gcc}---i.e., both versions of GCC +coexist on the same system without any interference. + +The @command{guix package} command is the central tool to manage packages +(@pxref{Invoking guix package}). It operates on the per-user profiles, and +can be used @emph{with normal user privileges}. + +@cindex transactions +The command provides the obvious install, remove, and upgrade operations. +Each invocation is actually a @emph{transaction}: either the specified +operation succeeds, or nothing happens. Thus, if the @command{guix package} +process is terminated during the transaction, or if a power outage occurs +during the transaction, then the user's profile remains in its previous +state, and remains usable. + +In addition, any package transaction may be @emph{rolled back}. So, if, for +example, an upgrade installs a new version of a package that turns out to +have a serious bug, users may roll back to the previous instance of their +profile, which was known to work well. Similarly, the global system +configuration on Guix is subject to transactional upgrades and roll-back +(@pxref{Using the Configuration System}). + +All packages in the package store may be @emph{garbage-collected}. Guix can +determine which packages are still referenced by user profiles, and remove +those that are provably no longer referenced (@pxref{Invoking guix gc}). +Users may also explicitly remove old generations of their profile so that +the packages they refer to can be collected. + +@cindex reproducibility +@cindex reproducible builds +Guix takes a @dfn{purely functional} approach to package management, as +described in the introduction (@pxref{Introduction}). Each +@file{/gnu/store} package directory name contains a hash of all the inputs +that were used to build that package---compiler, libraries, build scripts, +etc. This direct correspondence allows users to make sure a given package +installation matches the current state of their distribution. It also helps +maximize @dfn{build reproducibility}: thanks to the isolated build +environments that are used, a given build is likely to yield bit-identical +files when performed on different machines (@pxref{Invoking guix-daemon, +container}). + +@cindex substitutes +This foundation allows Guix to support @dfn{transparent binary/source +deployment}. When a pre-built binary for a @file{/gnu/store} item is +available from an external source---a @dfn{substitute}, Guix just downloads +it and unpacks it; otherwise, it builds the package from source, locally +(@pxref{Substitutes}). Because build results are usually bit-for-bit +reproducible, users do not have to trust servers that provide substitutes: +they can force a local build and @emph{challenge} providers (@pxref{Invoking +guix challenge}). + +Control over the build environment is a feature that is also useful for +developers. The @command{guix environment} command allows developers of a +package to quickly set up the right development environment for their +package, without having to manually install the dependencies of the package +into their profile (@pxref{Invoking guix environment}). + +@cindex replication, of software environments +@cindex provenance tracking, of software artifacts +All of Guix and its package definitions is version-controlled, and +@command{guix pull} allows you to ``travel in time'' on the history of Guix +itself (@pxref{Invoking guix pull}). This makes it possible to replicate a +Guix instance on a different machine or at a later point in time, which in +turn allows you to @emph{replicate complete software environments}, while +retaining precise @dfn{provenance tracking} of the software. + +@node Invoking guix package +@section Invoking @command{guix package} + +@cindex installing packages +@cindex removing packages +@cindex package installation +@cindex package removal +The @command{guix package} command is the tool that allows users to install, +upgrade, and remove packages, as well as rolling back to previous +configurations. It operates only on the user's own profile, and works with +normal user privileges (@pxref{Features}). Its syntax is: + +@example +guix package @var{options} +@end example +@cindex transactions +Primarily, @var{options} specifies the operations to be performed during the +transaction. Upon completion, a new profile is created, but previous +@dfn{generations} of the profile remain available, should the user want to +roll back. + +For example, to remove @code{lua} and install @code{guile} and +@code{guile-cairo} in a single transaction: + +@example +guix package -r lua -i guile guile-cairo +@end example + +@command{guix package} also supports a @dfn{declarative approach} whereby +the user specifies the exact set of packages to be available and passes it +@i{via} the @option{--manifest} option (@pxref{profile-manifest, +@option{--manifest}}). + +@cindex profile +For each user, a symlink to the user's default profile is automatically +created in @file{$HOME/.guix-profile}. This symlink always points to the +current generation of the user's default profile. Thus, users can add +@file{$HOME/.guix-profile/bin} to their @code{PATH} environment variable, +and so on. +@cindex search paths +If you are not using the Guix System Distribution, consider adding the +following lines to your @file{~/.bash_profile} (@pxref{Bash Startup Files,,, +bash, The GNU Bash Reference Manual}) so that newly-spawned shells get all +the right environment variable definitions: + +@example +GUIX_PROFILE="$HOME/.guix-profile" ; \ +source "$HOME/.guix-profile/etc/profile" +@end example + +In a multi-user setup, user profiles are stored in a place registered as a +@dfn{garbage-collector root}, which @file{$HOME/.guix-profile} points to +(@pxref{Invoking guix gc}). That directory is normally +@code{@var{localstatedir}/guix/profiles/per-user/@var{user}}, where +@var{localstatedir} is the value passed to @code{configure} as +@code{--localstatedir}, and @var{user} is the user name. The +@file{per-user} directory is created when @command{guix-daemon} is started, +and the @var{user} sub-directory is created by @command{guix package}. + +The @var{options} can be among the following: + +@table @code + +@item --install=@var{package} @dots{} +@itemx -i @var{package} @dots{} +Install the specified @var{package}s. + +Each @var{package} may specify either a simple package name, such as +@code{guile}, or a package name followed by an at-sign and version number, +such as @code{guile@@1.8.8} or simply @code{guile@@1.8} (in the latter case, +the newest version prefixed by @code{1.8} is selected.) + +If no version number is specified, the newest available version will be +selected. In addition, @var{package} may contain a colon, followed by the +name of one of the outputs of the package, as in @code{gcc:doc} or +@code{binutils@@2.22:lib} (@pxref{Packages with Multiple Outputs}). +Packages with a corresponding name (and optionally version) are searched for +among the GNU distribution modules (@pxref{Package Modules}). + +@cindex propagated inputs +Sometimes packages have @dfn{propagated inputs}: these are dependencies that +automatically get installed along with the required package +(@pxref{package-propagated-inputs, @code{propagated-inputs} in +@code{package} objects}, for information about propagated inputs in package +definitions). + +@anchor{package-cmd-propagated-inputs} +An example is the GNU MPC library: its C header files refer to those of the +GNU MPFR library, which in turn refer to those of the GMP library. Thus, +when installing MPC, the MPFR and GMP libraries also get installed in the +profile; removing MPC also removes MPFR and GMP---unless they had also been +explicitly installed by the user. + +Besides, packages sometimes rely on the definition of environment variables +for their search paths (see explanation of @code{--search-paths} below). +Any missing or possibly incorrect environment variable definitions are +reported here. + +@item --install-from-expression=@var{exp} +@itemx -e @var{exp} +Install the package @var{exp} evaluates to. + +@var{exp} must be a Scheme expression that evaluates to a @code{<package>} +object. This option is notably useful to disambiguate between same-named +variants of a package, with expressions such as @code{(@@ (gnu packages +base) guile-final)}. + +Note that this option installs the first output of the specified package, +which may be insufficient when needing a specific output of a +multiple-output package. + +@item --install-from-file=@var{file} +@itemx -f @var{file} +Install the package that the code within @var{file} evaluates to. + +As an example, @var{file} might contain a definition like this +(@pxref{Defining Packages}): + +@example +@verbatiminclude package-hello.scm +@end example + +Developers may find it useful to include such a @file{guix.scm} file in the +root of their project source tree that can be used to test development +snapshots and create reproducible development environments (@pxref{Invoking +guix environment}). + +@item --remove=@var{package} @dots{} +@itemx -r @var{package} @dots{} +Remove the specified @var{package}s. + +As for @code{--install}, each @var{package} may specify a version number +and/or output name in addition to the package name. For instance, @code{-r +glibc:debug} would remove the @code{debug} output of @code{glibc}. + +@item --upgrade[=@var{regexp} @dots{}] +@itemx -u [@var{regexp} @dots{}] +@cindex upgrading packages +Upgrade all the installed packages. If one or more @var{regexp}s are +specified, upgrade only installed packages whose name matches a +@var{regexp}. Also see the @code{--do-not-upgrade} option below. + +Note that this upgrades package to the latest version of packages found in +the distribution currently installed. To update your distribution, you +should regularly run @command{guix pull} (@pxref{Invoking guix pull}). + +@item --do-not-upgrade[=@var{regexp} @dots{}] +When used together with the @code{--upgrade} option, do @emph{not} upgrade +any packages whose name matches a @var{regexp}. For example, to upgrade all +packages in the current profile except those containing the substring +``emacs'': + +@example +$ guix package --upgrade . --do-not-upgrade emacs +@end example + +@item @anchor{profile-manifest}--manifest=@var{file} +@itemx -m @var{file} +@cindex profile declaration +@cindex profile manifest +Create a new generation of the profile from the manifest object returned by +the Scheme code in @var{file}. + +This allows you to @emph{declare} the profile's contents rather than +constructing it through a sequence of @code{--install} and similar +commands. The advantage is that @var{file} can be put under version +control, copied to different machines to reproduce the same profile, and so +on. + +@c FIXME: Add reference to (guix profile) documentation when available. +@var{file} must return a @dfn{manifest} object, which is roughly a list of +packages: + +@findex packages->manifest +@example +(use-package-modules guile emacs) + +(packages->manifest + (list emacs + guile-2.0 + ;; Use a specific package output. + (list guile-2.0 "debug"))) +@end example + +@findex specifications->manifest +In this example we have to know which modules define the @code{emacs} and +@code{guile-2.0} variables to provide the right @code{use-package-modules} +line, which can be cumbersome. We can instead provide regular package +specifications and let @code{specifications->manifest} look up the +corresponding package objects, like this: + +@example +(specifications->manifest + '("emacs" "guile@@2.2" "guile@@2.2:debug")) +@end example + +@item --roll-back +@cindex rolling back +@cindex undoing transactions +@cindex transactions, undoing +Roll back to the previous @dfn{generation} of the profile---i.e., undo the +last transaction. + +When combined with options such as @code{--install}, roll back occurs before +any other actions. + +When rolling back from the first generation that actually contains installed +packages, the profile is made to point to the @dfn{zeroth generation}, which +contains no files apart from its own metadata. + +After having rolled back, installing, removing, or upgrading packages +overwrites previous future generations. Thus, the history of the +generations in a profile is always linear. + +@item --switch-generation=@var{pattern} +@itemx -S @var{pattern} +@cindex generations +Switch to a particular generation defined by @var{pattern}. + +@var{pattern} may be either a generation number or a number prefixed with +``+'' or ``-''. The latter means: move forward/backward by a specified +number of generations. For example, if you want to return to the latest +generation after @code{--roll-back}, use @code{--switch-generation=+1}. + +The difference between @code{--roll-back} and @code{--switch-generation=-1} +is that @code{--switch-generation} will not make a zeroth generation, so if +a specified generation does not exist, the current generation will not be +changed. + +@item --search-paths[=@var{kind}] +@cindex search paths +Report environment variable definitions, in Bash syntax, that may be needed +in order to use the set of installed packages. These environment variables +are used to specify @dfn{search paths} for files used by some of the +installed packages. + +For example, GCC needs the @code{CPATH} and @code{LIBRARY_PATH} environment +variables to be defined so it can look for headers and libraries in the +user's profile (@pxref{Environment Variables,,, gcc, Using the GNU Compiler +Collection (GCC)}). If GCC and, say, the C library are installed in the +profile, then @code{--search-paths} will suggest setting these variables to +@code{@var{profile}/include} and @code{@var{profile}/lib}, respectively. + +The typical use case is to define these environment variables in the shell: + +@example +$ eval `guix package --search-paths` +@end example + +@var{kind} may be one of @code{exact}, @code{prefix}, or @code{suffix}, +meaning that the returned environment variable definitions will either be +exact settings, or prefixes or suffixes of the current value of these +variables. When omitted, @var{kind} defaults to @code{exact}. + +This option can also be used to compute the @emph{combined} search paths of +several profiles. Consider this example: + +@example +$ guix package -p foo -i guile +$ guix package -p bar -i guile-json +$ guix package -p foo -p bar --search-paths +@end example + +The last command above reports about the @code{GUILE_LOAD_PATH} variable, +even though, taken individually, neither @file{foo} nor @file{bar} would +lead to that recommendation. + + +@item --profile=@var{profile} +@itemx -p @var{profile} +Use @var{profile} instead of the user's default profile. + +@cindex collisions, in a profile +@cindex colliding packages in profiles +@cindex profile collisions +@item --allow-collisions +Allow colliding packages in the new profile. Use at your own risk! + +By default, @command{guix package} reports as an error @dfn{collisions} in +the profile. Collisions happen when two or more different versions or +variants of a given package end up in the profile. + +@item --bootstrap +Use the bootstrap Guile to build the profile. This option is only useful to +distribution developers. + +@end table + +In addition to these actions, @command{guix package} supports the following +options to query the current state of a profile, or the availability of +packages: + +@table @option + +@item --search=@var{regexp} +@itemx -s @var{regexp} +@cindex searching for packages +List the available packages whose name, synopsis, or description matches +@var{regexp} (in a case-insensitive fashion), sorted by relevance. Print +all the metadata of matching packages in @code{recutils} format (@pxref{Top, +GNU recutils databases,, recutils, GNU recutils manual}). + +This allows specific fields to be extracted using the @command{recsel} +command, for instance: + +@example +$ guix package -s malloc | recsel -p name,version,relevance +name: jemalloc +version: 4.5.0 +relevance: 6 + +name: glibc +version: 2.25 +relevance: 1 + +name: libgc +version: 7.6.0 +relevance: 1 +@end example + +Similarly, to show the name of all the packages available under the terms of +the GNU@tie{}LGPL version 3: + +@example +$ guix package -s "" | recsel -p name -e 'license ~ "LGPL 3"' +name: elfutils + +name: gmp +@dots{} +@end example + +It is also possible to refine search results using several @code{-s} flags. +For example, the following command returns a list of board games: + +@example +$ guix package -s '\<board\>' -s game | recsel -p name +name: gnubg +@dots{} +@end example + +If we were to omit @code{-s game}, we would also get software packages that +deal with printed circuit boards; removing the angle brackets around +@code{board} would further add packages that have to do with keyboards. + +And now for a more elaborate example. The following command searches for +cryptographic libraries, filters out Haskell, Perl, Python, and Ruby +libraries, and prints the name and synopsis of the matching packages: + +@example +$ guix package -s crypto -s library | \ + recsel -e '! (name ~ "^(ghc|perl|python|ruby)")' -p name,synopsis +@end example + +@noindent +@xref{Selection Expressions,,, recutils, GNU recutils manual}, for more +information on @dfn{selection expressions} for @code{recsel -e}. + +@item --show=@var{package} +Show details about @var{package}, taken from the list of available packages, +in @code{recutils} format (@pxref{Top, GNU recutils databases,, recutils, +GNU recutils manual}). + +@example +$ guix package --show=python | recsel -p name,version +name: python +version: 2.7.6 + +name: python +version: 3.3.5 +@end example + +You may also specify the full name of a package to only get details about a +specific version of it: +@example +$ guix package --show=python@@3.4 | recsel -p name,version +name: python +version: 3.4.3 +@end example + + + +@item --list-installed[=@var{regexp}] +@itemx -I [@var{regexp}] +List the currently installed packages in the specified profile, with the +most recently installed packages shown last. When @var{regexp} is +specified, list only installed packages whose name matches @var{regexp}. + +For each installed package, print the following items, separated by tabs: +the package name, its version string, the part of the package that is +installed (for instance, @code{out} for the default output, @code{include} +for its headers, etc.), and the path of this package in the store. + +@item --list-available[=@var{regexp}] +@itemx -A [@var{regexp}] +List packages currently available in the distribution for this system +(@pxref{GNU Distribution}). When @var{regexp} is specified, list only +installed packages whose name matches @var{regexp}. + +For each package, print the following items separated by tabs: its name, its +version string, the parts of the package (@pxref{Packages with Multiple +Outputs}), and the source location of its definition. + +@item --list-generations[=@var{pattern}] +@itemx -l [@var{pattern}] +@cindex generations +Return a list of generations along with their creation dates; for each +generation, show the installed packages, with the most recently installed +packages shown last. Note that the zeroth generation is never shown. + +For each installed package, print the following items, separated by tabs: +the name of a package, its version string, the part of the package that is +installed (@pxref{Packages with Multiple Outputs}), and the location of this +package in the store. + +When @var{pattern} is used, the command returns only matching generations. +Valid patterns include: + +@itemize +@item @emph{Integers and comma-separated integers}. Both patterns denote +generation numbers. For instance, @code{--list-generations=1} returns the +first one. + +And @code{--list-generations=1,8,2} outputs three generations in the +specified order. Neither spaces nor trailing commas are allowed. + +@item @emph{Ranges}. @code{--list-generations=2..9} prints the +specified generations and everything in between. Note that the start of a +range must be smaller than its end. + +It is also possible to omit the endpoint. For example, +@code{--list-generations=2..}, returns all generations starting from the +second one. + +@item @emph{Durations}. You can also get the last @emph{N}@tie{}days, weeks, +or months by passing an integer along with the first letter of the +duration. For example, @code{--list-generations=20d} lists generations that +are up to 20 days old. +@end itemize + +@item --delete-generations[=@var{pattern}] +@itemx -d [@var{pattern}] +When @var{pattern} is omitted, delete all generations except the current +one. + +This command accepts the same patterns as @option{--list-generations}. When +@var{pattern} is specified, delete the matching generations. When +@var{pattern} specifies a duration, generations @emph{older} than the +specified duration match. For instance, @code{--delete-generations=1m} +deletes generations that are more than one month old. + +If the current generation matches, it is @emph{not} deleted. Also, the +zeroth generation is never deleted. + +Note that deleting generations prevents rolling back to them. Consequently, +this command must be used with care. + +@end table + +Finally, since @command{guix package} may actually start build processes, it +supports all the common build options (@pxref{Common Build Options}). It +also supports package transformation options, such as @option{--with-source} +(@pxref{Package Transformation Options}). However, note that package +transformations are lost when upgrading; to preserve transformations across +upgrades, you should define your own package variant in a Guile module and +add it to @code{GUIX_PACKAGE_PATH} (@pxref{Defining Packages}). + +@node Substitutes +@section Substitutes + +@cindex substitutes +@cindex pre-built binaries +Guix supports transparent source/binary deployment, which means that it can +either build things locally, or download pre-built items from a server, or +both. We call these pre-built items @dfn{substitutes}---they are +substitutes for local build results. In many cases, downloading a +substitute is much faster than building things locally. + +Substitutes can be anything resulting from a derivation build +(@pxref{Derivations}). Of course, in the common case, they are pre-built +package binaries, but source tarballs, for instance, which also result from +derivation builds, can be available as substitutes. + +@menu +* Official Substitute Server:: One particular source of substitutes. +* Substitute Server Authorization:: How to enable or disable substitutes. +* Substitute Authentication:: How Guix verifies substitutes. +* Proxy Settings:: How to get substitutes via proxy. +* Substitution Failure:: What happens when substitution fails. +* On Trusting Binaries:: How can you trust that binary blob? +@end menu + +@node Official Substitute Server +@subsection Official Substitute Server + +@cindex hydra +@cindex build farm +The @code{@value{SUBSTITUTE-SERVER}} server is a front-end to an official +build farm that builds packages from Guix continuously for some +architectures, and makes them available as substitutes. This is the default +source of substitutes; it can be overridden by passing the +@option{--substitute-urls} option either to @command{guix-daemon} +(@pxref{daemon-substitute-urls,, @code{guix-daemon --substitute-urls}}) or +to client tools such as @command{guix package} +(@pxref{client-substitute-urls,, client @option{--substitute-urls} option}). + +Substitute URLs can be either HTTP or HTTPS. HTTPS is recommended because +communications are encrypted; conversely, using HTTP makes all +communications visible to an eavesdropper, who could use the information +gathered to determine, for instance, whether your system has unpatched +security vulnerabilities. + +Substitutes from the official build farm are enabled by default when using +the Guix System Distribution (@pxref{GNU Distribution}). However, they are +disabled by default when using Guix on a foreign distribution, unless you +have explicitly enabled them via one of the recommended installation steps +(@pxref{Installation}). The following paragraphs describe how to enable or +disable substitutes for the official build farm; the same procedure can also +be used to enable substitutes for any other substitute server. + +@node Substitute Server Authorization +@subsection Substitute Server Authorization + +@cindex security +@cindex substitutes, authorization thereof +@cindex access control list (ACL), for substitutes +@cindex ACL (access control list), for substitutes +To allow Guix to download substitutes from @code{@value{SUBSTITUTE-SERVER}} +or a mirror thereof, you must add its public key to the access control list +(ACL) of archive imports, using the @command{guix archive} command +(@pxref{Invoking guix archive}). Doing so implies that you trust +@code{@value{SUBSTITUTE-SERVER}} to not be compromised and to serve genuine +substitutes. + +The public key for @code{@value{SUBSTITUTE-SERVER}} is installed along with +Guix, in @code{@var{prefix}/share/guix/@value{SUBSTITUTE-SERVER}.pub}, where +@var{prefix} is the installation prefix of Guix. If you installed Guix from +source, make sure you checked the GPG signature of +@file{guix-@value{VERSION}.tar.gz}, which contains this public key file. +Then, you can run something like this: + +@example +# guix archive --authorize < @var{prefix}/share/guix/@value{SUBSTITUTE-SERVER}.pub +@end example + +@quotation Note +Similarly, the @file{hydra.gnu.org.pub} file contains the public key of an +independent build farm also run by the project, reachable at +@indicateurl{https://mirror.hydra.gnu.org}. +@end quotation + +Once this is in place, the output of a command like @code{guix build} should +change from something like: + +@example +$ guix build emacs --dry-run +The following derivations would be built: + /gnu/store/yr7bnx8xwcayd6j95r2clmkdl1qh688w-emacs-24.3.drv + /gnu/store/x8qsh1hlhgjx6cwsjyvybnfv2i37z23w-dbus-1.6.4.tar.gz.drv + /gnu/store/1ixwp12fl950d15h2cj11c73733jay0z-alsa-lib-1.0.27.1.tar.bz2.drv + /gnu/store/nlma1pw0p603fpfiqy7kn4zm105r5dmw-util-linux-2.21.drv +@dots{} +@end example + +@noindent +to something like: + +@example +$ guix build emacs --dry-run +112.3 MB would be downloaded: + /gnu/store/pk3n22lbq6ydamyymqkkz7i69wiwjiwi-emacs-24.3 + /gnu/store/2ygn4ncnhrpr61rssa6z0d9x22si0va3-libjpeg-8d + /gnu/store/71yz6lgx4dazma9dwn2mcjxaah9w77jq-cairo-1.12.16 + /gnu/store/7zdhgp0n1518lvfn8mb96sxqfmvqrl7v-libxrender-0.9.7 +@dots{} +@end example + +@noindent +This indicates that substitutes from @code{@value{SUBSTITUTE-SERVER}} are +usable and will be downloaded, when possible, for future builds. + +@cindex substitutes, how to disable +The substitute mechanism can be disabled globally by running +@code{guix-daemon} with @code{--no-substitutes} (@pxref{Invoking +guix-daemon}). It can also be disabled temporarily by passing the +@code{--no-substitutes} option to @command{guix package}, @command{guix +build}, and other command-line tools. + +@node Substitute Authentication +@subsection Substitute Authentication + +@cindex digital signatures +Guix detects and raises an error when attempting to use a substitute that +has been tampered with. Likewise, it ignores substitutes that are not +signed, or that are not signed by one of the keys listed in the ACL. + +There is one exception though: if an unauthorized server provides +substitutes that are @emph{bit-for-bit identical} to those provided by an +authorized server, then the unauthorized server becomes eligible for +downloads. For example, assume we have chosen two substitute servers with +this option: + +@example +--substitute-urls="https://a.example.org https://b.example.org" +@end example + +@noindent +@cindex reproducible builds +If the ACL contains only the key for @code{b.example.org}, and if +@code{a.example.org} happens to serve the @emph{exact same} substitutes, +then Guix will download substitutes from @code{a.example.org} because it +comes first in the list and can be considered a mirror of +@code{b.example.org}. In practice, independent build machines usually +produce the same binaries, thanks to bit-reproducible builds (see below). + +When using HTTPS, the server's X.509 certificate is @emph{not} validated (in +other words, the server is not authenticated), contrary to what HTTPS +clients such as Web browsers usually do. This is because Guix authenticates +substitute information itself, as explained above, which is what we care +about (whereas X.509 certificates are about authenticating bindings between +domain names and public keys.) + +@node Proxy Settings +@subsection Proxy Settings + +@vindex http_proxy +Substitutes are downloaded over HTTP or HTTPS. The @code{http_proxy} +environment variable can be set in the environment of @command{guix-daemon} +and is honored for downloads of substitutes. Note that the value of +@code{http_proxy} in the environment where @command{guix build}, +@command{guix package}, and other client commands are run has +@emph{absolutely no effect}. + +@node Substitution Failure +@subsection Substitution Failure + +Even when a substitute for a derivation is available, sometimes the +substitution attempt will fail. This can happen for a variety of reasons: +the substitute server might be offline, the substitute may recently have +been deleted, the connection might have been interrupted, etc. + +When substitutes are enabled and a substitute for a derivation is available, +but the substitution attempt fails, Guix will attempt to build the +derivation locally depending on whether or not @code{--fallback} was given +(@pxref{fallback-option,, common build option @code{--fallback}}). +Specifically, if @code{--fallback} was omitted, then no local build will be +performed, and the derivation is considered to have failed. However, if +@code{--fallback} was given, then Guix will attempt to build the derivation +locally, and the success or failure of the derivation depends on the success +or failure of the local build. Note that when substitutes are disabled or +no substitute is available for the derivation in question, a local build +will @emph{always} be performed, regardless of whether or not +@code{--fallback} was given. + +To get an idea of how many substitutes are available right now, you can try +running the @command{guix weather} command (@pxref{Invoking guix weather}). +This command provides statistics on the substitutes provided by a server. + +@node On Trusting Binaries +@subsection On Trusting Binaries + +@cindex trust, of pre-built binaries +Today, each individual's control over their own computing is at the mercy of +institutions, corporations, and groups with enough power and determination +to subvert the computing infrastructure and exploit its weaknesses. While +using @code{@value{SUBSTITUTE-SERVER}} substitutes can be convenient, we +encourage users to also build on their own, or even run their own build +farm, such that @code{@value{SUBSTITUTE-SERVER}} is less of an interesting +target. One way to help is by publishing the software you build using +@command{guix publish} so that others have one more choice of server to +download substitutes from (@pxref{Invoking guix publish}). + +Guix has the foundations to maximize build reproducibility +(@pxref{Features}). In most cases, independent builds of a given package or +derivation should yield bit-identical results. Thus, through a diverse set +of independent package builds, we can strengthen the integrity of our +systems. The @command{guix challenge} command aims to help users assess +substitute servers, and to assist developers in finding out about +non-deterministic package builds (@pxref{Invoking guix challenge}). +Similarly, the @option{--check} option of @command{guix build} allows users +to check whether previously-installed substitutes are genuine by rebuilding +them locally (@pxref{build-check, @command{guix build --check}}). + +In the future, we want Guix to have support to publish and retrieve binaries +to/from other users, in a peer-to-peer fashion. If you would like to +discuss this project, join us on @email{guix-devel@@gnu.org}. + +@node Packages with Multiple Outputs +@section Packages with Multiple Outputs + +@cindex multiple-output packages +@cindex package outputs +@cindex outputs + +Often, packages defined in Guix have a single @dfn{output}---i.e., the +source package leads to exactly one directory in the store. When running +@command{guix package -i glibc}, one installs the default output of the GNU +libc package; the default output is called @code{out}, but its name can be +omitted as shown in this command. In this particular case, the default +output of @code{glibc} contains all the C header files, shared libraries, +static libraries, Info documentation, and other supporting files. + +Sometimes it is more appropriate to separate the various types of files +produced from a single source package into separate outputs. For instance, +the GLib C library (used by GTK+ and related packages) installs more than +20 MiB of reference documentation as HTML pages. To save space for users +who do not need it, the documentation goes to a separate output, called +@code{doc}. To install the main GLib output, which contains everything but +the documentation, one would run: + +@example +guix package -i glib +@end example + +@cindex documentation +The command to install its documentation is: + +@example +guix package -i glib:doc +@end example + +Some packages install programs with different ``dependency footprints''. +For instance, the WordNet package installs both command-line tools and +graphical user interfaces (GUIs). The former depend solely on the C +library, whereas the latter depend on Tcl/Tk and the underlying X +libraries. In this case, we leave the command-line tools in the default +output, whereas the GUIs are in a separate output. This allows users who do +not need the GUIs to save space. The @command{guix size} command can help +find out about such situations (@pxref{Invoking guix size}). @command{guix +graph} can also be helpful (@pxref{Invoking guix graph}). + +There are several such multiple-output packages in the GNU distribution. +Other conventional output names include @code{lib} for libraries and +possibly header files, @code{bin} for stand-alone programs, and @code{debug} +for debugging information (@pxref{Installing Debugging Files}). The outputs +of a packages are listed in the third column of the output of @command{guix +package --list-available} (@pxref{Invoking guix package}). + + +@node Invoking guix gc +@section Invoking @command{guix gc} + +@cindex garbage collector +@cindex disk space +Packages that are installed, but not used, may be @dfn{garbage-collected}. +The @command{guix gc} command allows users to explicitly run the garbage +collector to reclaim space from the @file{/gnu/store} directory. It is the +@emph{only} way to remove files from @file{/gnu/store}---removing files or +directories manually may break it beyond repair! + +@cindex GC roots +@cindex garbage collector roots +The garbage collector has a set of known @dfn{roots}: any file under +@file{/gnu/store} reachable from a root is considered @dfn{live} and cannot +be deleted; any other file is considered @dfn{dead} and may be deleted. The +set of garbage collector roots (``GC roots'' for short) includes default +user profiles; by default, the symlinks under @file{/var/guix/gcroots} +represent these GC roots. New GC roots can be added with @command{guix +build --root}, for example (@pxref{Invoking guix build}). The @command{guix +gc --list-roots} command lists them. + +Prior to running @code{guix gc --collect-garbage} to make space, it is often +useful to remove old generations from user profiles; that way, old package +builds referenced by those generations can be reclaimed. This is achieved +by running @code{guix package --delete-generations} (@pxref{Invoking guix +package}). + +Our recommendation is to run a garbage collection periodically, or when you +are short on disk space. For instance, to guarantee that at least 5@tie{}GB +are available on your disk, simply run: + +@example +guix gc -F 5G +@end example + +It is perfectly safe to run as a non-interactive periodic job +(@pxref{Scheduled Job Execution}, for how to set up such a job). Running +@command{guix gc} with no arguments will collect as much garbage as it can, +but that is often inconvenient: you may find yourself having to rebuild or +re-download software that is ``dead'' from the GC viewpoint but that is +necessary to build other pieces of software---e.g., the compiler tool chain. + +The @command{guix gc} command has three modes of operation: it can be used +to garbage-collect any dead files (the default), to delete specific files +(the @code{--delete} option), to print garbage-collector information, or for +more advanced queries. The garbage collection options are as follows: + +@table @code +@item --collect-garbage[=@var{min}] +@itemx -C [@var{min}] +Collect garbage---i.e., unreachable @file{/gnu/store} files and +sub-directories. This is the default operation when no option is specified. + +When @var{min} is given, stop once @var{min} bytes have been collected. +@var{min} may be a number of bytes, or it may include a unit as a suffix, +such as @code{MiB} for mebibytes and @code{GB} for gigabytes (@pxref{Block +size, size specifications,, coreutils, GNU Coreutils}). + +When @var{min} is omitted, collect all the garbage. + +@item --free-space=@var{free} +@itemx -F @var{free} +Collect garbage until @var{free} space is available under @file{/gnu/store}, +if possible; @var{free} denotes storage space, such as @code{500MiB}, as +described above. + +When @var{free} or more is already available in @file{/gnu/store}, do +nothing and exit immediately. + +@item --delete-generations[=@var{duration}] +@itemx -d [@var{duration}] +Before starting the garbage collection process, delete all the generations +older than @var{duration}, for all the user profiles; when run as root, this +applies to all the profiles @emph{of all the users}. + +For example, this command deletes all the generations of all your profiles +that are older than 2 months (except generations that are current), and then +proceeds to free space until at least 10 GiB are available: + +@example +guix gc -d 2m -F 10G +@end example + +@item --delete +@itemx -D +Attempt to delete all the store files and directories specified as +arguments. This fails if some of the files are not in the store, or if they +are still live. + +@item --list-failures +List store items corresponding to cached build failures. + +This prints nothing unless the daemon was started with +@option{--cache-failures} (@pxref{Invoking guix-daemon, +@option{--cache-failures}}). + +@item --list-roots +List the GC roots owned by the user; when run as root, list @emph{all} the +GC roots. + +@item --clear-failures +Remove the specified store items from the failed-build cache. + +Again, this option only makes sense when the daemon is started with +@option{--cache-failures}. Otherwise, it does nothing. + +@item --list-dead +Show the list of dead files and directories still present in the +store---i.e., files and directories no longer reachable from any root. + +@item --list-live +Show the list of live store files and directories. + +@end table + +In addition, the references among existing store files can be queried: + +@table @code + +@item --references +@itemx --referrers +@cindex package dependencies +List the references (respectively, the referrers) of store files given as +arguments. + +@item --requisites +@itemx -R +@cindex closure +List the requisites of the store files passed as arguments. Requisites +include the store files themselves, their references, and the references of +these, recursively. In other words, the returned list is the +@dfn{transitive closure} of the store files. + +@xref{Invoking guix size}, for a tool to profile the size of the closure of +an element. @xref{Invoking guix graph}, for a tool to visualize the graph +of references. + +@item --derivers +@cindex derivation +Return the derivation(s) leading to the given store items +(@pxref{Derivations}). + +For example, this command: + +@example +guix gc --derivers `guix package -I ^emacs$ | cut -f4` +@end example + +@noindent +returns the @file{.drv} file(s) leading to the @code{emacs} package +installed in your profile. + +Note that there may be zero matching @file{.drv} files, for instance because +these files have been garbage-collected. There can also be more than one +matching @file{.drv} due to fixed-output derivations. +@end table + +Lastly, the following options allow you to check the integrity of the store +and to control disk usage. + +@table @option + +@item --verify[=@var{options}] +@cindex integrity, of the store +@cindex integrity checking +Verify the integrity of the store. + +By default, make sure that all the store items marked as valid in the +database of the daemon actually exist in @file{/gnu/store}. + +When provided, @var{options} must be a comma-separated list containing one +or more of @code{contents} and @code{repair}. + +When passing @option{--verify=contents}, the daemon computes the content +hash of each store item and compares it against its hash in the database. +Hash mismatches are reported as data corruptions. Because it traverses +@emph{all the files in the store}, this command can take a long time, +especially on systems with a slow disk drive. + +@cindex repairing the store +@cindex corruption, recovering from +Using @option{--verify=repair} or @option{--verify=contents,repair} causes +the daemon to try to repair corrupt store items by fetching substitutes for +them (@pxref{Substitutes}). Because repairing is not atomic, and thus +potentially dangerous, it is available only to the system administrator. A +lightweight alternative, when you know exactly which items in the store are +corrupt, is @command{guix build --repair} (@pxref{Invoking guix build}). + +@item --optimize +@cindex deduplication +Optimize the store by hard-linking identical files---this is +@dfn{deduplication}. + +The daemon performs deduplication after each successful build or archive +import, unless it was started with @code{--disable-deduplication} +(@pxref{Invoking guix-daemon, @code{--disable-deduplication}}). Thus, this +option is primarily useful when the daemon was running with +@code{--disable-deduplication}. + +@end table + +@node Invoking guix pull +@section Invoking @command{guix pull} + +@cindex upgrading Guix +@cindex updating Guix +@cindex @command{guix pull} +@cindex pull +Packages are installed or upgraded to the latest version available in the +distribution currently available on your local machine. To update that +distribution, along with the Guix tools, you must run @command{guix pull}: +the command downloads the latest Guix source code and package descriptions, +and deploys it. Source code is downloaded from a @uref{https://git-scm.com, +Git} repository, by default the official GNU@tie{}Guix repository, though +this can be customized. + +On completion, @command{guix package} will use packages and package versions +from this just-retrieved copy of Guix. Not only that, but all the Guix +commands and Scheme modules will also be taken from that latest version. +New @command{guix} sub-commands added by the update also become available. + +Any user can update their Guix copy using @command{guix pull}, and the +effect is limited to the user who run @command{guix pull}. For instance, +when user @code{root} runs @command{guix pull}, this has no effect on the +version of Guix that user @code{alice} sees, and vice versa. + +The result of running @command{guix pull} is a @dfn{profile} available under +@file{~/.config/guix/current} containing the latest Guix. Thus, make sure +to add it to the beginning of your search path so that you use the latest +version, and similarly for the Info manual (@pxref{Documentation}): + +@example +export PATH="$HOME/.config/guix/current/bin:$PATH" +export INFOPATH="$HOME/.config/guix/current/share/info:$INFOPATH" +@end example + +The @code{--list-generations} or @code{-l} option lists past generations +produced by @command{guix pull}, along with details about their provenance: + +@example +$ guix pull -l +Generation 1 Jun 10 2018 00:18:18 + guix 65956ad + repository URL: https://git.savannah.gnu.org/git/guix.git + branch: origin/master + commit: 65956ad3526ba09e1f7a40722c96c6ef7c0936fe + +Generation 2 Jun 11 2018 11:02:49 + guix e0cc7f6 + repository URL: https://git.savannah.gnu.org/git/guix.git + branch: origin/master + commit: e0cc7f669bec22c37481dd03a7941c7d11a64f1d + 2 new packages: keepalived, libnfnetlink + 6 packages upgraded: emacs-nix-mode@@2.0.4, + guile2.0-guix@@0.14.0-12.77a1aac, guix@@0.14.0-12.77a1aac, + heimdal@@7.5.0, milkytracker@@1.02.00, nix@@2.0.4 + +Generation 3 Jun 13 2018 23:31:07 (current) + guix 844cc1c + repository URL: https://git.savannah.gnu.org/git/guix.git + branch: origin/master + commit: 844cc1c8f394f03b404c5bb3aee086922373490c + 28 new packages: emacs-helm-ls-git, emacs-helm-mu, @dots{} + 69 packages upgraded: borg@@1.1.6, cheese@@3.28.0, @dots{} +@end example + +@xref{Invoking guix describe, @command{guix describe}}, for other ways to +describe the current status of Guix. + +This @code{~/.config/guix/current} profile works like any other profile +created by @command{guix package} (@pxref{Invoking guix package}). That is, +you can list generations, roll back to the previous generation---i.e., the +previous Guix---and so on: + +@example +$ guix package -p ~/.config/guix/current --roll-back +switched from generation 3 to 2 +$ guix package -p ~/.config/guix/current --delete-generations=1 +deleting /var/guix/profiles/per-user/charlie/current-guix-1-link +@end example + +The @command{guix pull} command is usually invoked with no arguments, but it +supports the following options: + +@table @code +@item --url=@var{url} +@itemx --commit=@var{commit} +@itemx --branch=@var{branch} +Download code for the @code{guix} channel from the specified @var{url}, at +the given @var{commit} (a valid Git commit ID represented as a hexadecimal +string), or @var{branch}. + +@cindex @file{channels.scm}, configuration file +@cindex configuration file for channels +These options are provided for convenience, but you can also specify your +configuration in the @file{~/.config/guix/channels.scm} file or using the +@option{--channels} option (see below). + +@item --channels=@var{file} +@itemx -C @var{file} +Read the list of channels from @var{file} instead of +@file{~/.config/guix/channels.scm}. @var{file} must contain Scheme code +that evaluates to a list of channel objects. @xref{Channels}, for more +information. + +@item --news +@itemx -N +Display the list of packages added or upgraded since the previous +generation. + +This is the same information as displayed upon @command{guix pull} +completion, but without ellipses; it is also similar to the output of +@command{guix pull -l} for the last generation (see below). + +@item --list-generations[=@var{pattern}] +@itemx -l [@var{pattern}] +List all the generations of @file{~/.config/guix/current} or, if +@var{pattern} is provided, the subset of generations that match +@var{pattern}. The syntax of @var{pattern} is the same as with @code{guix +package --list-generations} (@pxref{Invoking guix package}). + +@xref{Invoking guix describe}, for a way to display information about the +current generation only. + +@item --profile=@var{profile} +@itemx -p @var{profile} +Use @var{profile} instead of @file{~/.config/guix/current}. + +@item --dry-run +@itemx -n +Show which channel commit(s) would be used and what would be built or +substituted but do not actually do it. + +@item --system=@var{system} +@itemx -s @var{system} +Attempt to build for @var{system}---e.g., @code{i686-linux}---instead of the +system type of the build host. + +@item --verbose +Produce verbose output, writing build logs to the standard error output. + +@item --bootstrap +Use the bootstrap Guile to build the latest Guix. This option is only +useful to Guix developers. +@end table + +The @dfn{channel} mechanism allows you to instruct @command{guix pull} which +repository and branch to pull from, as well as @emph{additional} +repositories containing package modules that should be deployed. +@xref{Channels}, for more information. + +In addition, @command{guix pull} supports all the common build options +(@pxref{Common Build Options}). + +@node Channels +@section Channels + +@cindex channels +@cindex @file{channels.scm}, configuration file +@cindex configuration file for channels +@cindex @command{guix pull}, configuration file +@cindex configuration of @command{guix pull} +Guix and its package collection are updated by running @command{guix pull} +(@pxref{Invoking guix pull}). By default @command{guix pull} downloads and +deploys Guix itself from the official GNU@tie{}Guix repository. This can be +customized by defining @dfn{channels} in the +@file{~/.config/guix/channels.scm} file. A channel specifies a URL and +branch of a Git repository to be deployed, and @command{guix pull} can be +instructed to pull from one or more channels. In other words, channels can +be used to @emph{customize} and to @emph{extend} Guix, as we will see below. + +@subsection Using a Custom Guix Channel + +The channel called @code{guix} specifies where Guix itself---its +command-line tools as well as its package collection---should be +downloaded. For instance, suppose you want to update from your own copy of +the Guix repository at @code{example.org}, and specifically the +@code{super-hacks} branch, you can write in +@code{~/.config/guix/channels.scm} this specification: + +@lisp +;; Tell 'guix pull' to use my own repo. +(list (channel + (name 'guix) + (url "https://example.org/my-guix.git") + (branch "super-hacks"))) +@end lisp + +@noindent +From there on, @command{guix pull} will fetch code from the +@code{super-hacks} branch of the repository at @code{example.org}. + +@subsection Specifying Additional Channels + +@cindex extending the package collection (channels) +@cindex personal packages (channels) +@cindex channels, for personal packages +You can also specify @emph{additional channels} to pull from. Let's say you +have a bunch of custom package variants or personal packages that you think +would make little sense to contribute to the Guix project, but would like to +have these packages transparently available to you at the command line. You +would first write modules containing those package definitions +(@pxref{Package Modules}), maintain them in a Git repository, and then you +and anyone else can use it as an additional channel to get packages from. +Neat, no? + +@c What follows stems from discussions at +@c <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22629#134> as well as +@c earlier discussions on guix-devel@gnu.org. +@quotation Warning +Before you, dear user, shout---``woow this is @emph{soooo coool}!''---and +publish your personal channel to the world, we would like to share a few +words of caution: + +@itemize +@item +Before publishing a channel, please consider contributing your package +definitions to Guix proper (@pxref{贡献}). Guix as a project is +open to free software of all sorts, and packages in Guix proper are readily +available to all Guix users and benefit from the project's quality assurance +process. + +@item +When you maintain package definitions outside Guix, we, Guix developers, +consider that @emph{the compatibility burden is on you}. Remember that +package modules and package definitions are just Scheme code that uses +various programming interfaces (APIs). We want to remain free to change +these APIs to keep improving Guix, possibly in ways that break your +channel. We never change APIs gratuitously, but we will @emph{not} commit +to freezing APIs either. + +@item +Corollary: if you're using an external channel and that channel breaks, +please @emph{report the issue to the channel authors}, not to the Guix +project. +@end itemize + +You've been warned! Having said this, we believe external channels are a +practical way to exert your freedom to augment Guix' package collection and +to share your improvements, which are basic tenets of +@uref{https://www.gnu.org/philosophy/free-sw.html, free software}. Please +email us at @email{guix-devel@@gnu.org} if you'd like to discuss this. +@end quotation + +To use a channel, write @code{~/.config/guix/channels.scm} to instruct +@command{guix pull} to pull from it @emph{in addition} to the default Guix +channel(s): + +@vindex %default-channels +@lisp +;; Add my personal packages to those Guix provides. +(cons (channel + (name 'my-personal-packages) + (url "https://example.org/personal-packages.git")) + %default-channels) +@end lisp + +@noindent +Note that the snippet above is (as always!)@: Scheme code; we use +@code{cons} to add a channel the list of channels that the variable +@code{%default-channels} is bound to (@pxref{Pairs, @code{cons} and lists,, +guile, GNU Guile Reference Manual}). With this file in place, @command{guix +pull} builds not only Guix but also the package modules from your own +repository. The result in @file{~/.config/guix/current} is the union of +Guix with your own package modules: + +@example +$ guix pull --list-generations +@dots{} +Generation 19 Aug 27 2018 16:20:48 + guix d894ab8 + repository URL: https://git.savannah.gnu.org/git/guix.git + branch: master + commit: d894ab8e9bfabcefa6c49d9ba2e834dd5a73a300 + my-personal-packages dd3df5e + repository URL: https://example.org/personal-packages.git + branch: master + commit: dd3df5e2c8818760a8fc0bd699e55d3b69fef2bb + 11 new packages: my-gimp, my-emacs-with-cool-features, @dots{} + 4 packages upgraded: emacs-racket-mode@@0.0.2-2.1b78827, @dots{} +@end example + +@noindent +The output of @command{guix pull} above shows that Generation@tie{}19 +includes both Guix and packages from the @code{my-personal-packages} +channel. Among the new and upgraded packages that are listed, some like +@code{my-gimp} and @code{my-emacs-with-cool-features} might come from +@code{my-personal-packages}, while others come from the Guix default +channel. + +To create a channel, create a Git repository containing your own package +modules and make it available. The repository can contain anything, but a +useful channel will contain Guile modules that export packages. Once you +start using a channel, Guix will behave as if the root directory of that +channel's Git repository has been added to the Guile load path (@pxref{Load +Paths,,, guile, GNU Guile Reference Manual}). For example, if your channel +contains a file at @file{my-packages/my-tools.scm} that defines a Guile +module, then the module will be available under the name @code{(my-packages +my-tools)}, and you will be able to use it like any other module +(@pxref{Modules,,, guile, GNU Guile Reference Manual}). + +@cindex dependencies, channels +@cindex meta-data, channels +@subsection Declaring Channel Dependencies + +Channel authors may decide to augment a package collection provided by other +channels. They can declare their channel to be dependent on other channels +in a meta-data file @file{.guix-channel}, which is to be placed in the root +of the channel repository. + +The meta-data file should contain a simple S-expression like this: + +@lisp +(channel + (version 0) + (dependencies + (channel + (name some-collection) + (url "https://example.org/first-collection.git")) + (channel + (name some-other-collection) + (url "https://example.org/second-collection.git") + (branch "testing")))) +@end lisp + +In the above example this channel is declared to depend on two other +channels, which will both be fetched automatically. The modules provided by +the channel will be compiled in an environment where the modules of all +these declared channels are available. + +For the sake of reliability and maintainability, you should avoid +dependencies on channels that you don't control, and you should aim to keep +the number of dependencies to a minimum. + +@subsection Replicating Guix + +@cindex pinning, channels +@cindex replicating Guix +@cindex reproducibility, of Guix +The @command{guix pull --list-generations} output above shows precisely +which commits were used to build this instance of Guix. We can thus +replicate it, say, on another machine, by providing a channel specification +in @file{~/.config/guix/channels.scm} that is ``pinned'' to these commits: + +@lisp +;; Deploy specific commits of my channels of interest. +(list (channel + (name 'guix) + (url "https://git.savannah.gnu.org/git/guix.git") + (commit "d894ab8e9bfabcefa6c49d9ba2e834dd5a73a300")) + (channel + (name 'my-personal-packages) + (url "https://example.org/personal-packages.git") + (branch "dd3df5e2c8818760a8fc0bd699e55d3b69fef2bb"))) +@end lisp + +The @command{guix describe --format=channels} command can even generate this +list of channels directly (@pxref{Invoking guix describe}). + +At this point the two machines run the @emph{exact same Guix}, with access +to the @emph{exact same packages}. The output of @command{guix build gimp} +on one machine will be exactly the same, bit for bit, as the output of the +same command on the other machine. It also means both machines have access +to all the source code of Guix and, transitively, to all the source code of +every package it defines. + +This gives you super powers, allowing you to track the provenance of binary +artifacts with very fine grain, and to reproduce software environments at +will---some sort of ``meta reproducibility'' capabilities, if you will. +@xref{Inferiors}, for another way to take advantage of these super powers. + +@node Inferiors +@section Inferiors + +@c TODO: Remove this once we're more confident about API stability. +@quotation Note +The functionality described here is a ``technology preview'' as of version +@value{VERSION}. As such, the interface is subject to change. +@end quotation + +@cindex inferiors +@cindex composition of Guix revisions +Sometimes you might need to mix packages from the revision of Guix you're +currently running with packages available in a different revision of Guix. +Guix @dfn{inferiors} allow you to achieve that by composing different Guix +revisions in arbitrary ways. + +@cindex inferior packages +Technically, an ``inferior'' is essentially a separate Guix process +connected to your main Guix process through a REPL (@pxref{Invoking guix +repl}). The @code{(guix inferior)} module allows you to create inferiors +and to communicate with them. It also provides a high-level interface to +browse and manipulate the packages that an inferior provides---@dfn{inferior +packages}. + +When combined with channels (@pxref{Channels}), inferiors provide a simple +way to interact with a separate revision of Guix. For example, let's assume +you want to install in your profile the current @code{guile} package, along +with the @code{guile-json} as it existed in an older revision of +Guix---perhaps because the newer @code{guile-json} has an incompatible API +and you want to run your code against the old API@. To do that, you could +write a manifest for use by @code{guix package --manifest} (@pxref{Invoking +guix package}); in that manifest, you would create an inferior for that old +Guix revision you care about, and you would look up the @code{guile-json} +package in the inferior: + +@lisp +(use-modules (guix inferior) (guix channels) + (srfi srfi-1)) ;for 'first' + +(define channels + ;; This is the old revision from which we want to + ;; extract guile-json. + (list (channel + (name 'guix) + (url "https://git.savannah.gnu.org/git/guix.git") + (commit + "65956ad3526ba09e1f7a40722c96c6ef7c0936fe")))) + +(define inferior + ;; An inferior representing the above revision. + (inferior-for-channels channels)) + +;; Now create a manifest with the current "guile" package +;; and the old "guile-json" package. +(packages->manifest + (list (first (lookup-inferior-packages inferior "guile-json")) + (specification->package "guile"))) +@end lisp + +On its first run, @command{guix package --manifest} might have to build the +channel you specified before it can create the inferior; subsequent runs +will be much faster because the Guix revision will be cached. + +The @code{(guix inferior)} module provides the following procedures to open +an inferior: + +@deffn {Scheme Procedure} inferior-for-channels @var{channels} @ + [#:cache-directory] [#:ttl] Return an inferior for @var{channels}, a list of +channels. Use the cache at @var{cache-directory}, where entries can be +reclaimed after @var{ttl} seconds. This procedure opens a new connection to +the build daemon. + +As a side effect, this procedure may build or substitute binaries for +@var{channels}, which can take time. +@end deffn + +@deffn {Scheme Procedure} open-inferior @var{directory} @ + [#:command "bin/guix"] Open the inferior Guix in @var{directory}, running +@code{@var{directory}/@var{command} repl} or equivalent. Return @code{#f} +if the inferior could not be launched. +@end deffn + +@cindex inferior packages +The procedures listed below allow you to obtain and manipulate inferior +packages. + +@deffn {Scheme Procedure} inferior-packages @var{inferior} +Return the list of packages known to @var{inferior}. +@end deffn + +@deffn {Scheme Procedure} lookup-inferior-packages @var{inferior} @var{name} @ + [@var{version}] Return the sorted list of inferior packages matching +@var{name} in @var{inferior}, with highest version numbers first. If +@var{version} is true, return only packages with a version number prefixed +by @var{version}. +@end deffn + +@deffn {Scheme Procedure} inferior-package? @var{obj} +Return true if @var{obj} is an inferior package. +@end deffn + +@deffn {Scheme Procedure} inferior-package-name @var{package} +@deffnx {Scheme Procedure} inferior-package-version @var{package} +@deffnx {Scheme Procedure} inferior-package-synopsis @var{package} +@deffnx {Scheme Procedure} inferior-package-description @var{package} +@deffnx {Scheme Procedure} inferior-package-home-page @var{package} +@deffnx {Scheme Procedure} inferior-package-location @var{package} +@deffnx {Scheme Procedure} inferior-package-inputs @var{package} +@deffnx {Scheme Procedure} inferior-package-native-inputs @var{package} +@deffnx {Scheme Procedure} inferior-package-propagated-inputs @var{package} +@deffnx {Scheme Procedure} inferior-package-transitive-propagated-inputs @var{package} +@deffnx {Scheme Procedure} inferior-package-native-search-paths @var{package} +@deffnx {Scheme Procedure} inferior-package-transitive-native-search-paths @var{package} +@deffnx {Scheme Procedure} inferior-package-search-paths @var{package} +These procedures are the counterpart of package record accessors +(@pxref{package Reference}). Most of them work by querying the inferior +@var{package} comes from, so the inferior must still be live when you call +these procedures. +@end deffn + +Inferior packages can be used transparently like any other package or +file-like object in G-expressions (@pxref{G-Expressions}). They are also +transparently handled by the @code{packages->manifest} procedure, which is +commonly use in manifests (@pxref{Invoking guix package, the +@option{--manifest} option of @command{guix package}}). Thus you can insert +an inferior package pretty much anywhere you would insert a regular package: +in manifests, in the @code{packages} field of your @code{operating-system} +declaration, and so on. + +@node Invoking guix describe +@section Invoking @command{guix describe} + +@cindex reproducibility +@cindex replicating Guix +Often you may want to answer questions like: ``Which revision of Guix am I +using?'' or ``Which channels am I using?'' This is useful information in +many situations: if you want to @emph{replicate} an environment on a +different machine or user account, if you want to report a bug or to +determine what change in the channels you are using caused it, or if you +want to record your system state for reproducibility purposes. The +@command{guix describe} command answers these questions. + +When run from a @command{guix pull}ed @command{guix}, @command{guix +describe} displays the channel(s) that it was built from, including their +repository URL and commit IDs (@pxref{Channels}): + +@example +$ guix describe +Generation 10 Sep 03 2018 17:32:44 (current) + guix e0fa68c + repository URL: https://git.savannah.gnu.org/git/guix.git + branch: master + commit: e0fa68c7718fffd33d81af415279d6ddb518f727 +@end example + +If you're familiar with the Git version control system, this is similar in +spirit to @command{git describe}; the output is also similar to that of +@command{guix pull --list-generations}, but limited to the current +generation (@pxref{Invoking guix pull, the @option{--list-generations} +option}). Because the Git commit ID shown above unambiguously refers to a +snapshot of Guix, this information is all it takes to describe the revision +of Guix you're using, and also to replicate it. + +To make it easier to replicate Guix, @command{guix describe} can also be +asked to return a list of channels instead of the human-readable description +above: + +@example +$ guix describe -f channels +(list (channel + (name 'guix) + (url "https://git.savannah.gnu.org/git/guix.git") + (commit + "e0fa68c7718fffd33d81af415279d6ddb518f727"))) +@end example + +@noindent +You can save this to a file and feed it to @command{guix pull -C} on some +other machine or at a later point in time, which will instantiate @emph{this +exact Guix revision} (@pxref{Invoking guix pull, the @option{-C} option}). +From there on, since you're able to deploy the same revision of Guix, you +can just as well @emph{replicate a complete software environment}. We +humbly think that this is @emph{awesome}, and we hope you'll like it too! + +The details of the options supported by @command{guix describe} are as +follows: + +@table @code +@item --format=@var{format} +@itemx -f @var{format} +Produce output in the specified @var{format}, one of: + +@table @code +@item human +produce human-readable output; +@item channels +produce a list of channel specifications that can be passed to @command{guix +pull -C} or installed as @file{~/.config/guix/channels.scm} (@pxref{Invoking +guix pull}); +@item json +@cindex JSON +produce a list of channel specifications in JSON format; +@item recutils +produce a list of channel specifications in Recutils format. +@end table + +@item --profile=@var{profile} +@itemx -p @var{profile} +Display information about @var{profile}. +@end table + +@node Invoking guix archive +@section Invoking @command{guix archive} + +@cindex @command{guix archive} +@cindex archive +The @command{guix archive} command allows users to @dfn{export} files from +the store into a single archive, and to later @dfn{import} them on a machine +that runs Guix. In particular, it allows store files to be transferred from +one machine to the store on another machine. + +@quotation Note +If you're looking for a way to produce archives in a format suitable for +tools other than Guix, @pxref{Invoking guix pack}. +@end quotation + +@cindex exporting store items +To export store files as an archive to standard output, run: + +@example +guix archive --export @var{options} @var{specifications}... +@end example + +@var{specifications} may be either store file names or package +specifications, as for @command{guix package} (@pxref{Invoking guix +package}). For instance, the following command creates an archive +containing the @code{gui} output of the @code{git} package and the main +output of @code{emacs}: + +@example +guix archive --export git:gui /gnu/store/...-emacs-24.3 > great.nar +@end example + +If the specified packages are not built yet, @command{guix archive} +automatically builds them. The build process may be controlled with the +common build options (@pxref{Common Build Options}). + +To transfer the @code{emacs} package to a machine connected over SSH, one +would run: + +@example +guix archive --export -r emacs | ssh the-machine guix archive --import +@end example + +@noindent +Similarly, a complete user profile may be transferred from one machine to +another like this: + +@example +guix archive --export -r $(readlink -f ~/.guix-profile) | \ + ssh the-machine guix-archive --import +@end example + +@noindent +However, note that, in both examples, all of @code{emacs} and the profile as +well as all of their dependencies are transferred (due to @code{-r}), +regardless of what is already available in the store on the target machine. +The @code{--missing} option can help figure out which items are missing from +the target store. The @command{guix copy} command simplifies and optimizes +this whole process, so this is probably what you should use in this case +(@pxref{Invoking guix copy}). + +@cindex nar, archive format +@cindex normalized archive (nar) +Archives are stored in the ``normalized archive'' or ``nar'' format, which +is comparable in spirit to `tar', but with differences that make it more +appropriate for our purposes. First, rather than recording all Unix +metadata for each file, the nar format only mentions the file type (regular, +directory, or symbolic link); Unix permissions and owner/group are +dismissed. Second, the order in which directory entries are stored always +follows the order of file names according to the C locale collation order. +This makes archive production fully deterministic. + +@c FIXME: Add xref to daemon doc about signatures. +When exporting, the daemon digitally signs the contents of the archive, and +that digital signature is appended. When importing, the daemon verifies the +signature and rejects the import in case of an invalid signature or if the +signing key is not authorized. + +The main options are: + +@table @code +@item --export +Export the specified store files or packages (see below.) Write the +resulting archive to the standard output. + +Dependencies are @emph{not} included in the output, unless +@code{--recursive} is passed. + +@item -r +@itemx --recursive +When combined with @code{--export}, this instructs @command{guix archive} to +include dependencies of the given items in the archive. Thus, the resulting +archive is self-contained: it contains the closure of the exported store +items. + +@item --import +Read an archive from the standard input, and import the files listed therein +into the store. Abort if the archive has an invalid digital signature, or +if it is signed by a public key not among the authorized keys (see +@code{--authorize} below.) + +@item --missing +Read a list of store file names from the standard input, one per line, and +write on the standard output the subset of these files missing from the +store. + +@item --generate-key[=@var{parameters}] +@cindex signing, archives +Generate a new key pair for the daemon. This is a prerequisite before +archives can be exported with @code{--export}. Note that this operation +usually takes time, because it needs to gather enough entropy to generate +the key pair. + +The generated key pair is typically stored under @file{/etc/guix}, in +@file{signing-key.pub} (public key) and @file{signing-key.sec} (private key, +which must be kept secret.) When @var{parameters} is omitted, an ECDSA key +using the Ed25519 curve is generated, or, for Libgcrypt versions before +1.6.0, it is a 4096-bit RSA key. Alternatively, @var{parameters} can +specify @code{genkey} parameters suitable for Libgcrypt (@pxref{General +public-key related Functions, @code{gcry_pk_genkey},, gcrypt, The Libgcrypt +Reference Manual}). + +@item --authorize +@cindex authorizing, archives +Authorize imports signed by the public key passed on standard input. The +public key must be in ``s-expression advanced format''---i.e., the same +format as the @file{signing-key.pub} file. + +The list of authorized keys is kept in the human-editable file +@file{/etc/guix/acl}. The file contains +@url{http://people.csail.mit.edu/rivest/Sexp.txt, ``advanced-format +s-expressions''} and is structured as an access-control list in the +@url{http://theworld.com/~cme/spki.txt, Simple Public-Key Infrastructure +(SPKI)}. + +@item --extract=@var{directory} +@itemx -x @var{directory} +Read a single-item archive as served by substitute servers +(@pxref{Substitutes}) and extract it to @var{directory}. This is a +low-level operation needed in only very narrow use cases; see below. + +For example, the following command extracts the substitute for Emacs served +by @code{@value{SUBSTITUTE-SERVER}} to @file{/tmp/emacs}: + +@example +$ wget -O - \ + https://@value{SUBSTITUTE-SERVER}/nar/@dots{}-emacs-24.5 \ + | bunzip2 | guix archive -x /tmp/emacs +@end example + +Single-item archives are different from multiple-item archives produced by +@command{guix archive --export}; they contain a single store item, and they +do @emph{not} embed a signature. Thus this operation does @emph{no} +signature verification and its output should be considered unsafe. + +The primary purpose of this operation is to facilitate inspection of archive +contents coming from possibly untrusted substitute servers. + +@end table + + +@c ********************************************************************* +@node Development +@chapter Development + +@cindex software development +If you are a software developer, Guix provides tools that you should find +helpful---independently of the language you're developing in. This is what +this chapter is about. + +The @command{guix environment} command provides a convenient way to set up +@dfn{development environments} containing all the dependencies and tools +necessary to work on the software package of your choice. The @command{guix +pack} command allows you to create @dfn{application bundles} that can be +easily distributed to users who do not run Guix. + +@menu +* Invoking guix environment:: Setting up development environments. +* Invoking guix pack:: Creating software bundles. +@end menu + +@node Invoking guix environment +@section Invoking @command{guix environment} + +@cindex reproducible build environments +@cindex development environments +@cindex @command{guix environment} +@cindex environment, package build environment +The purpose of @command{guix environment} is to assist hackers in creating +reproducible development environments without polluting their package +profile. The @command{guix environment} tool takes one or more packages, +builds all of their inputs, and creates a shell environment to use them. + +The general syntax is: + +@example +guix environment @var{options} @var{package}@dots{} +@end example + +The following example spawns a new shell set up for the development of +GNU@tie{}Guile: + +@example +guix environment guile +@end example + +If the needed dependencies are not built yet, @command{guix environment} +automatically builds them. The environment of the new shell is an augmented +version of the environment that @command{guix environment} was run in. It +contains the necessary search paths for building the given package added to +the existing environment variables. To create a ``pure'' environment, in +which the original environment variables have been unset, use the +@code{--pure} option@footnote{Users sometimes wrongfully augment environment +variables such as @code{PATH} in their @file{~/.bashrc} file. As a +consequence, when @code{guix environment} launches it, Bash may read +@file{~/.bashrc}, thereby introducing ``impurities'' in these environment +variables. It is an error to define such environment variables in +@file{.bashrc}; instead, they should be defined in @file{.bash_profile}, +which is sourced only by log-in shells. @xref{Bash Startup Files,,, bash, +The GNU Bash Reference Manual}, for details on Bash start-up files.}. + +@vindex GUIX_ENVIRONMENT +@command{guix environment} defines the @code{GUIX_ENVIRONMENT} variable in +the shell it spawns; its value is the file name of the profile of this +environment. This allows users to, say, define a specific prompt for +development environments in their @file{.bashrc} (@pxref{Bash Startup +Files,,, bash, The GNU Bash Reference Manual}): + +@example +if [ -n "$GUIX_ENVIRONMENT" ] +then + export PS1="\u@@\h \w [dev]\$ " +fi +@end example + +@noindent +...@: or to browse the profile: + +@example +$ ls "$GUIX_ENVIRONMENT/bin" +@end example + +Additionally, more than one package may be specified, in which case the +union of the inputs for the given packages are used. For example, the +command below spawns a shell where all of the dependencies of both Guile and +Emacs are available: + +@example +guix environment guile emacs +@end example + +Sometimes an interactive shell session is not desired. An arbitrary command +may be invoked by placing the @code{--} token to separate the command from +the rest of the arguments: + +@example +guix environment guile -- make -j4 +@end example + +In other situations, it is more convenient to specify the list of packages +needed in the environment. For example, the following command runs +@command{python} from an environment containing Python@tie{}2.7 and NumPy: + +@example +guix environment --ad-hoc python2-numpy python-2.7 -- python +@end example + +Furthermore, one might want the dependencies of a package and also some +additional packages that are not build-time or runtime dependencies, but are +useful when developing nonetheless. Because of this, the @code{--ad-hoc} +flag is positional. Packages appearing before @code{--ad-hoc} are +interpreted as packages whose dependencies will be added to the +environment. Packages appearing after are interpreted as packages that will +be added to the environment directly. For example, the following command +creates a Guix development environment that additionally includes Git and +strace: + +@example +guix environment guix --ad-hoc git strace +@end example + +Sometimes it is desirable to isolate the environment as much as possible, +for maximal purity and reproducibility. In particular, when using Guix on a +host distro that is not Guix System, it is desirable to prevent access to +@file{/usr/bin} and other system-wide resources from the development +environment. For example, the following command spawns a Guile REPL in a +``container'' where only the store and the current working directory are +mounted: + +@example +guix environment --ad-hoc --container guile -- guile +@end example + +@quotation Note +The @code{--container} option requires Linux-libre 3.19 or newer. +@end quotation + +The available options are summarized below. + +@table @code +@item --root=@var{file} +@itemx -r @var{file} +@cindex persistent environment +@cindex garbage collector root, for environments +Make @var{file} a symlink to the profile for this environment, and register +it as a garbage collector root. + +This is useful if you want to protect your environment from garbage +collection, to make it ``persistent''. + +When this option is omitted, the environment is protected from garbage +collection only for the duration of the @command{guix environment} session. +This means that next time you recreate the same environment, you could have +to rebuild or re-download packages. @xref{Invoking guix gc}, for more on GC +roots. + +@item --expression=@var{expr} +@itemx -e @var{expr} +Create an environment for the package or list of packages that @var{expr} +evaluates to. + +For example, running: + +@example +guix environment -e '(@@ (gnu packages maths) petsc-openmpi)' +@end example + +starts a shell with the environment for this specific variant of the PETSc +package. + +Running: + +@example +guix environment --ad-hoc -e '(@@ (gnu) %base-packages)' +@end example + +starts a shell with all the base system packages available. + +The above commands only use the default output of the given packages. To +select other outputs, two element tuples can be specified: + +@example +guix environment --ad-hoc -e '(list (@@ (gnu packages bash) bash) "include")' +@end example + +@item --load=@var{file} +@itemx -l @var{file} +Create an environment for the package or list of packages that the code +within @var{file} evaluates to. + +As an example, @var{file} might contain a definition like this +(@pxref{Defining Packages}): + +@example +@verbatiminclude environment-gdb.scm +@end example + +@item --manifest=@var{file} +@itemx -m @var{file} +Create an environment for the packages contained in the manifest object +returned by the Scheme code in @var{file}. + +This is similar to the same-named option in @command{guix package} +(@pxref{profile-manifest, @option{--manifest}}) and uses the same manifest +files. + +@item --ad-hoc +Include all specified packages in the resulting environment, as if an @i{ad +hoc} package were defined with them as inputs. This option is useful for +quickly creating an environment without having to write a package expression +to contain the desired inputs. + +For instance, the command: + +@example +guix environment --ad-hoc guile guile-sdl -- guile +@end example + +runs @command{guile} in an environment where Guile and Guile-SDL are +available. + +Note that this example implicitly asks for the default output of +@code{guile} and @code{guile-sdl}, but it is possible to ask for a specific +output---e.g., @code{glib:bin} asks for the @code{bin} output of @code{glib} +(@pxref{Packages with Multiple Outputs}). + +This option may be composed with the default behavior of @command{guix +environment}. Packages appearing before @code{--ad-hoc} are interpreted as +packages whose dependencies will be added to the environment, the default +behavior. Packages appearing after are interpreted as packages that will be +added to the environment directly. + +@item --pure +Unset existing environment variables when building the new environment, +except those specified with @option{--preserve} (see below.) This has the +effect of creating an environment in which search paths only contain package +inputs. + +@item --preserve=@var{regexp} +@itemx -E @var{regexp} +When used alongside @option{--pure}, preserve the environment variables +matching @var{regexp}---in other words, put them on a ``white list'' of +environment variables that must be preserved. This option can be repeated +several times. + +@example +guix environment --pure --preserve=^SLURM --ad-hoc openmpi @dots{} \ + -- mpirun @dots{} +@end example + +This example runs @command{mpirun} in a context where the only environment +variables defined are @code{PATH}, environment variables whose name starts +with @code{SLURM}, as well as the usual ``precious'' variables (@code{HOME}, +@code{USER}, etc.) + +@item --search-paths +Display the environment variable definitions that make up the environment. + +@item --system=@var{system} +@itemx -s @var{system} +Attempt to build for @var{system}---e.g., @code{i686-linux}. + +@item --container +@itemx -C +@cindex container +Run @var{command} within an isolated container. The current working +directory outside the container is mapped inside the container. +Additionally, unless overridden with @code{--user}, a dummy home directory +is created that matches the current user's home directory, and +@file{/etc/passwd} is configured accordingly. + +The spawned process runs as the current user outside the container. Inside +the container, it has the same UID and GID as the current user, unless +@option{--user} is passed (see below.) + +@item --network +@itemx -N +For containers, share the network namespace with the host system. +Containers created without this flag only have access to the loopback +device. + +@item --link-profile +@itemx -P +For containers, link the environment profile to @file{~/.guix-profile} +within the container. This is equivalent to running the command @command{ln +-s $GUIX_ENVIRONMENT ~/.guix-profile} within the container. Linking will +fail and abort the environment if the directory already exists, which will +certainly be the case if @command{guix environment} was invoked in the +user's home directory. + +Certain packages are configured to look in @code{~/.guix-profile} for +configuration files and data;@footnote{For example, the @code{fontconfig} +package inspects @file{~/.guix-profile/share/fonts} for additional fonts.} +@code{--link-profile} allows these programs to behave as expected within the +environment. + +@item --user=@var{user} +@itemx -u @var{user} +For containers, use the username @var{user} in place of the current user. +The generated @file{/etc/passwd} entry within the container will contain the +name @var{user}, the home directory will be @file{/home/@var{user}}, and no +user GECOS data will be copied. Furthermore, the UID and GID inside the +container are 1000. @var{user} need not exist on the system. + +Additionally, any shared or exposed path (see @code{--share} and +@code{--expose} respectively) whose target is within the current user's home +directory will be remapped relative to @file{/home/USER}; this includes the +automatic mapping of the current working directory. + +@example +# will expose paths as /home/foo/wd, /home/foo/test, and /home/foo/target +cd $HOME/wd +guix environment --container --user=foo \ + --expose=$HOME/test \ + --expose=/tmp/target=$HOME/target +@end example + +While this will limit the leaking of user identity through home paths and +each of the user fields, this is only one useful component of a broader +privacy/anonymity solution---not one in and of itself. + +@item --expose=@var{source}[=@var{target}] +For containers, expose the file system @var{source} from the host system as +the read-only file system @var{target} within the container. If +@var{target} is not specified, @var{source} is used as the target mount +point in the container. + +The example below spawns a Guile REPL in a container in which the user's +home directory is accessible read-only via the @file{/exchange} directory: + +@example +guix environment --container --expose=$HOME=/exchange --ad-hoc guile -- guile +@end example + +@item --share=@var{source}[=@var{target}] +For containers, share the file system @var{source} from the host system as +the writable file system @var{target} within the container. If @var{target} +is not specified, @var{source} is used as the target mount point in the +container. + +The example below spawns a Guile REPL in a container in which the user's +home directory is accessible for both reading and writing via the +@file{/exchange} directory: + +@example +guix environment --container --share=$HOME=/exchange --ad-hoc guile -- guile +@end example +@end table + +@command{guix environment} also supports all of the common build options +that @command{guix build} supports (@pxref{Common Build Options}) as well as +package transformation options (@pxref{Package Transformation Options}). + +@node Invoking guix pack +@section Invoking @command{guix pack} + +Occasionally you want to pass software to people who are not (yet!) lucky +enough to be using Guix. You'd tell them to run @command{guix package -i +@var{something}}, but that's not possible in this case. This is where +@command{guix pack} comes in. + +@quotation Note +If you are looking for ways to exchange binaries among machines that already +run Guix, @pxref{Invoking guix copy}, @ref{Invoking guix publish}, and +@ref{Invoking guix archive}. +@end quotation + +@cindex pack +@cindex bundle +@cindex application bundle +@cindex software bundle +The @command{guix pack} command creates a shrink-wrapped @dfn{pack} or +@dfn{software bundle}: it creates a tarball or some other archive containing +the binaries of the software you're interested in, and all its +dependencies. The resulting archive can be used on any machine that does +not have Guix, and people can run the exact same binaries as those you have +with Guix. The pack itself is created in a bit-reproducible fashion, so +anyone can verify that it really contains the build results that you pretend +to be shipping. + +For example, to create a bundle containing Guile, Emacs, Geiser, and all +their dependencies, you can run: + +@example +$ guix pack guile emacs geiser +@dots{} +/gnu/store/@dots{}-pack.tar.gz +@end example + +The result here is a tarball containing a @file{/gnu/store} directory with +all the relevant packages. The resulting tarball contains a @dfn{profile} +with the three packages of interest; the profile is the same as would be +created by @command{guix package -i}. It is this mechanism that is used to +create Guix's own standalone binary tarball (@pxref{Binary Installation}). + +Users of this pack would have to run +@file{/gnu/store/@dots{}-profile/bin/guile} to run Guile, which you may find +inconvenient. To work around it, you can create, say, a @file{/opt/gnu/bin} +symlink to the profile: + +@example +guix pack -S /opt/gnu/bin=bin guile emacs geiser +@end example + +@noindent +That way, users can happily type @file{/opt/gnu/bin/guile} and enjoy. + +@cindex relocatable binaries, with @command{guix pack} +What if the recipient of your pack does not have root privileges on their +machine, and thus cannot unpack it in the root file system? In that case, +you will want to use the @code{--relocatable} option (see below). This +option produces @dfn{relocatable binaries}, meaning they they can be placed +anywhere in the file system hierarchy: in the example above, users can +unpack your tarball in their home directory and directly run +@file{./opt/gnu/bin/guile}. + +@cindex Docker, build an image with guix pack +Alternatively, you can produce a pack in the Docker image format using the +following command: + +@example +guix pack -f docker guile emacs geiser +@end example + +@noindent +The result is a tarball that can be passed to the @command{docker load} +command. See the +@uref{https://docs.docker.com/engine/reference/commandline/load/, Docker +documentation} for more information. + +@cindex Singularity, build an image with guix pack +@cindex SquashFS, build an image with guix pack +Yet another option is to produce a SquashFS image with the following +command: + +@example +guix pack -f squashfs guile emacs geiser +@end example + +@noindent +The result is a SquashFS file system image that can either be mounted or +directly be used as a file system container image with the +@uref{http://singularity.lbl.gov, Singularity container execution +environment}, using commands like @command{singularity shell} or +@command{singularity exec}. + +Several command-line options allow you to customize your pack: + +@table @code +@item --format=@var{format} +@itemx -f @var{format} +Produce a pack in the given @var{format}. + +The available formats are: + +@table @code +@item tarball +This is the default format. It produces a tarball containing all the +specified binaries and symlinks. + +@item docker +This produces a tarball that follows the +@uref{https://github.com/docker/docker/blob/master/image/spec/v1.2.md, +Docker Image Specification}. + +@item squashfs +This produces a SquashFS image containing all the specified binaries and +symlinks, as well as empty mount points for virtual file systems like +procfs. +@end table + +@cindex relocatable binaries +@item --relocatable +@itemx -R +Produce @dfn{relocatable binaries}---i.e., binaries that can be placed +anywhere in the file system hierarchy and run from there. + +When this option is passed once, the resulting binaries require support for +@dfn{user namespaces} in the kernel Linux; when passed +@emph{twice}@footnote{Here's a trick to memorize it: @code{-RR}, which adds +PRoot support, can be thought of as the abbreviation of ``Really +Relocatable''. Neat, isn't it?}, relocatable binaries fall to back to PRoot +if user namespaces are unavailable, and essentially work anywhere---see +below for the implications. + +For example, if you create a pack containing Bash with: + +@example +guix pack -RR -S /mybin=bin bash +@end example + +@noindent +...@: you can copy that pack to a machine that lacks Guix, and from your +home directory as a normal user, run: + +@example +tar xf pack.tar.gz +./mybin/sh +@end example + +@noindent +In that shell, if you type @code{ls /gnu/store}, you'll notice that +@file{/gnu/store} shows up and contains all the dependencies of @code{bash}, +even though the machine actually lacks @file{/gnu/store} altogether! That is +probably the simplest way to deploy Guix-built software on a non-Guix +machine. + +@quotation Note +By default, relocatable binaries rely on the @dfn{user namespace} feature of +the kernel Linux, which allows unprivileged users to mount or change root. +Old versions of Linux did not support it, and some GNU/Linux distributions +turn it off. + +To produce relocatable binaries that work even in the absence of user +namespaces, pass @option{--relocatable} or @option{-R} @emph{twice}. In +that case, binaries will try user namespace support and fall back to PRoot +if user namespaces are not supported. + +The @uref{https://proot-me.github.io/, PRoot} program provides the necessary +support for file system virtualization. It achieves that by using the +@code{ptrace} system call on the running program. This approach has the +advantage to work without requiring special kernel support, but it incurs +run-time overhead every time a system call is made. +@end quotation + +@item --expression=@var{expr} +@itemx -e @var{expr} +Consider the package @var{expr} evaluates to. + +This has the same purpose as the same-named option in @command{guix build} +(@pxref{Additional Build Options, @code{--expression} in @command{guix +build}}). + +@item --manifest=@var{file} +@itemx -m @var{file} +Use the packages contained in the manifest object returned by the Scheme +code in @var{file}. + +This has a similar purpose as the same-named option in @command{guix +package} (@pxref{profile-manifest, @option{--manifest}}) and uses the same +manifest files. It allows you to define a collection of packages once and +use it both for creating profiles and for creating archives for use on +machines that do not have Guix installed. Note that you can specify +@emph{either} a manifest file @emph{or} a list of packages, but not both. + +@item --system=@var{system} +@itemx -s @var{system} +Attempt to build for @var{system}---e.g., @code{i686-linux}---instead of the +system type of the build host. + +@item --target=@var{triplet} +@cindex cross-compilation +Cross-build for @var{triplet}, which must be a valid GNU triplet, such as +@code{"mips64el-linux-gnu"} (@pxref{Specifying target triplets, GNU +configuration triplets,, autoconf, Autoconf}). + +@item --compression=@var{tool} +@itemx -C @var{tool} +Compress the resulting tarball using @var{tool}---one of @code{gzip}, +@code{bzip2}, @code{xz}, @code{lzip}, or @code{none} for no compression. + +@item --symlink=@var{spec} +@itemx -S @var{spec} +Add the symlinks specified by @var{spec} to the pack. This option can +appear several times. + +@var{spec} has the form @code{@var{source}=@var{target}}, where @var{source} +is the symlink that will be created and @var{target} is the symlink target. + +For instance, @code{-S /opt/gnu/bin=bin} creates a @file{/opt/gnu/bin} +symlink pointing to the @file{bin} sub-directory of the profile. + +@item --save-provenance +Save provenance information for the packages passed on the command line. +Provenance information includes the URL and commit of the channels in use +(@pxref{Channels}). + +Provenance information is saved in the +@file{/gnu/store/@dots{}-profile/manifest} file in the pack, along with the +usual package metadata---the name and version of each package, their +propagated inputs, and so on. It is useful information to the recipient of +the pack, who then knows how the pack was (supposedly) obtained. + +This option is not enabled by default because, like timestamps, provenance +information contributes nothing to the build process. In other words, there +is an infinity of channel URLs and commit IDs that can lead to the same +pack. Recording such ``silent'' metadata in the output thus potentially +breaks the source-to-binary bitwise reproducibility property. + +@item --localstatedir +@itemx --profile-name=@var{name} +Include the ``local state directory'', @file{/var/guix}, in the resulting +pack, and notably the @file{/var/guix/profiles/per-user/root/@var{name}} +profile---by default @var{name} is @code{guix-profile}, which corresponds to +@file{~root/.guix-profile}. + +@file{/var/guix} contains the store database (@pxref{The Store}) as well as +garbage-collector roots (@pxref{Invoking guix gc}). Providing it in the +pack means that the store is ``complete'' and manageable by Guix; not +providing it pack means that the store is ``dead'': items cannot be added to +it or removed from it after extraction of the pack. + +One use case for this is the Guix self-contained binary tarball +(@pxref{Binary Installation}). + +@item --bootstrap +Use the bootstrap binaries to build the pack. This option is only useful to +Guix developers. +@end table + +In addition, @command{guix pack} supports all the common build options +(@pxref{Common Build Options}) and all the package transformation options +(@pxref{Package Transformation Options}). + + +@c ********************************************************************* +@node Programming Interface +@chapter Programming Interface + +GNU Guix provides several Scheme programming interfaces (APIs) to define, +build, and query packages. The first interface allows users to write +high-level package definitions. These definitions refer to familiar +packaging concepts, such as the name and version of a package, its build +system, and its dependencies. These definitions can then be turned into +concrete build actions. + +Build actions are performed by the Guix daemon, on behalf of users. In a +standard setup, the daemon has write access to the store---the +@file{/gnu/store} directory---whereas users do not. The recommended setup +also has the daemon perform builds in chroots, under a specific build users, +to minimize interference with the rest of the system. + +@cindex derivation +Lower-level APIs are available to interact with the daemon and the store. +To instruct the daemon to perform a build action, users actually provide it +with a @dfn{derivation}. A derivation is a low-level representation of the +build actions to be taken, and the environment in which they should +occur---derivations are to package definitions what assembly is to C +programs. The term ``derivation'' comes from the fact that build results +@emph{derive} from them. + +This chapter describes all these APIs in turn, starting from high-level +package definitions. + +@menu +* Package Modules:: Packages from the programmer's viewpoint. +* Defining Packages:: Defining new packages. +* Build Systems:: Specifying how packages are built. +* The Store:: Manipulating the package store. +* Derivations:: Low-level interface to package derivations. +* The Store Monad:: Purely functional interface to the store. +* G-Expressions:: Manipulating build expressions. +* Invoking guix repl:: Fiddling with Guix interactively. +@end menu + +@node Package Modules +@section Package Modules + +From a programming viewpoint, the package definitions of the GNU +distribution are provided by Guile modules in the @code{(gnu packages +@dots{})} name space@footnote{Note that packages under the @code{(gnu +packages @dots{})} module name space are not necessarily ``GNU packages''. +This module naming scheme follows the usual Guile module naming convention: +@code{gnu} means that these modules are distributed as part of the GNU +system, and @code{packages} identifies modules that define packages.} +(@pxref{Modules, Guile modules,, guile, GNU Guile Reference Manual}). For +instance, the @code{(gnu packages emacs)} module exports a variable named +@code{emacs}, which is bound to a @code{<package>} object (@pxref{Defining +Packages}). + +The @code{(gnu packages @dots{})} module name space is automatically scanned +for packages by the command-line tools. For instance, when running +@code{guix package -i emacs}, all the @code{(gnu packages @dots{})} modules +are scanned until one that exports a package object whose name is +@code{emacs} is found. This package search facility is implemented in the +@code{(gnu packages)} module. + +@cindex customization, of packages +@cindex package module search path +Users can store package definitions in modules with different names---e.g., +@code{(my-packages emacs)}@footnote{Note that the file name and module name +must match. For instance, the @code{(my-packages emacs)} module must be +stored in a @file{my-packages/emacs.scm} file relative to the load path +specified with @option{--load-path} or @code{GUIX_PACKAGE_PATH}. +@xref{Modules and the File System,,, guile, GNU Guile Reference Manual}, for +details.}. There are two ways to make these package definitions visible to +the user interfaces: + +@enumerate +@item +By adding the directory containing your package modules to the search path +with the @code{-L} flag of @command{guix package} and other commands +(@pxref{Common Build Options}), or by setting the @code{GUIX_PACKAGE_PATH} +environment variable described below. + +@item +By defining a @dfn{channel} and configuring @command{guix pull} so that it +pulls from it. A channel is essentially a Git repository containing package +modules. @xref{Channels}, for more information on how to define and use +channels. +@end enumerate + +@code{GUIX_PACKAGE_PATH} works similarly to other search path variables: + +@defvr {Environment Variable} GUIX_PACKAGE_PATH +This is a colon-separated list of directories to search for additional +package modules. Directories listed in this variable take precedence over +the own modules of the distribution. +@end defvr + +The distribution is fully @dfn{bootstrapped} and @dfn{self-contained}: each +package is built based solely on other packages in the distribution. The +root of this dependency graph is a small set of @dfn{bootstrap binaries}, +provided by the @code{(gnu packages bootstrap)} module. For more +information on bootstrapping, @pxref{Bootstrapping}. + +@node Defining Packages +@section Defining Packages + +The high-level interface to package definitions is implemented in the +@code{(guix packages)} and @code{(guix build-system)} modules. As an +example, the package definition, or @dfn{recipe}, for the GNU Hello package +looks like this: + +@example +(define-module (gnu packages hello) + #:use-module (guix packages) + #:use-module (guix download) + #:use-module (guix build-system gnu) + #:use-module (guix licenses) + #:use-module (gnu packages gawk)) + +(define-public hello + (package + (name "hello") + (version "2.10") + (source (origin + (method url-fetch) + (uri (string-append "mirror://gnu/hello/hello-" version + ".tar.gz")) + (sha256 + (base32 + "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i")))) + (build-system gnu-build-system) + (arguments '(#:configure-flags '("--enable-silent-rules"))) + (inputs `(("gawk" ,gawk))) + (synopsis "Hello, GNU world: An example GNU package") + (description "Guess what GNU Hello prints!") + (home-page "http://www.gnu.org/software/hello/") + (license gpl3+))) +@end example + +@noindent +Without being a Scheme expert, the reader may have guessed the meaning of +the various fields here. This expression binds the variable @code{hello} to +a @code{<package>} object, which is essentially a record (@pxref{SRFI-9, +Scheme records,, guile, GNU Guile Reference Manual}). This package object +can be inspected using procedures found in the @code{(guix packages)} +module; for instance, @code{(package-name hello)} +returns---surprise!---@code{"hello"}. + +With luck, you may be able to import part or all of the definition of the +package you are interested in from another repository, using the @code{guix +import} command (@pxref{Invoking guix import}). + +In the example above, @var{hello} is defined in a module of its own, +@code{(gnu packages hello)}. Technically, this is not strictly necessary, +but it is convenient to do so: all the packages defined in modules under +@code{(gnu packages @dots{})} are automatically known to the command-line +tools (@pxref{Package Modules}). + +There are a few points worth noting in the above package definition: + +@itemize +@item +The @code{source} field of the package is an @code{<origin>} object +(@pxref{origin Reference}, for the complete reference). Here, the +@code{url-fetch} method from @code{(guix download)} is used, meaning that +the source is a file to be downloaded over FTP or HTTP. + +The @code{mirror://gnu} prefix instructs @code{url-fetch} to use one of the +GNU mirrors defined in @code{(guix download)}. + +The @code{sha256} field specifies the expected SHA256 hash of the file being +downloaded. It is mandatory, and allows Guix to check the integrity of the +file. The @code{(base32 @dots{})} form introduces the base32 representation +of the hash. You can obtain this information with @code{guix download} +(@pxref{Invoking guix download}) and @code{guix hash} (@pxref{Invoking guix +hash}). + +@cindex patches +When needed, the @code{origin} form can also have a @code{patches} field +listing patches to be applied, and a @code{snippet} field giving a Scheme +expression to modify the source code. + +@item +@cindex GNU Build System +The @code{build-system} field specifies the procedure to build the package +(@pxref{Build Systems}). Here, @var{gnu-build-system} represents the +familiar GNU Build System, where packages may be configured, built, and +installed with the usual @code{./configure && make && make check && make +install} command sequence. + +@item +The @code{arguments} field specifies options for the build system +(@pxref{Build Systems}). Here it is interpreted by @var{gnu-build-system} +as a request run @file{configure} with the @code{--enable-silent-rules} +flag. + +@cindex quote +@cindex quoting +@findex ' +@findex quote +What about these quote (@code{'}) characters? They are Scheme syntax to +introduce a literal list; @code{'} is synonymous with @code{quote}. +@xref{Expression Syntax, quoting,, guile, GNU Guile Reference Manual}, for +details. Here the value of the @code{arguments} field is a list of +arguments passed to the build system down the road, as with @code{apply} +(@pxref{Fly Evaluation, @code{apply},, guile, GNU Guile Reference Manual}). + +The hash-colon (@code{#:}) sequence defines a Scheme @dfn{keyword} +(@pxref{Keywords,,, guile, GNU Guile Reference Manual}), and +@code{#:configure-flags} is a keyword used to pass a keyword argument to the +build system (@pxref{Coding With Keywords,,, guile, GNU Guile Reference +Manual}). + +@item +The @code{inputs} field specifies inputs to the build process---i.e., +build-time or run-time dependencies of the package. Here, we define an +input called @code{"gawk"} whose value is that of the @var{gawk} variable; +@var{gawk} is itself bound to a @code{<package>} object. + +@cindex backquote (quasiquote) +@findex ` +@findex quasiquote +@cindex comma (unquote) +@findex , +@findex unquote +@findex ,@@ +@findex unquote-splicing +Again, @code{`} (a backquote, synonymous with @code{quasiquote}) allows us +to introduce a literal list in the @code{inputs} field, while @code{,} (a +comma, synonymous with @code{unquote}) allows us to insert a value in that +list (@pxref{Expression Syntax, unquote,, guile, GNU Guile Reference +Manual}). + +Note that GCC, Coreutils, Bash, and other essential tools do not need to be +specified as inputs here. Instead, @var{gnu-build-system} takes care of +ensuring that they are present (@pxref{Build Systems}). + +However, any other dependencies need to be specified in the @code{inputs} +field. Any dependency not specified here will simply be unavailable to the +build process, possibly leading to a build failure. +@end itemize + +@xref{package Reference}, for a full description of possible fields. + +Once a package definition is in place, the package may actually be built +using the @code{guix build} command-line tool (@pxref{Invoking guix build}), +troubleshooting any build failures you encounter (@pxref{Debugging Build +Failures}). You can easily jump back to the package definition using the +@command{guix edit} command (@pxref{Invoking guix edit}). @xref{打包指导}, for more information on how to test package definitions, and +@ref{Invoking guix lint}, for information on how to check a definition for +style conformance. +@vindex GUIX_PACKAGE_PATH +Lastly, @pxref{Channels}, for information on how to extend the distribution +by adding your own package definitions in a ``channel''. + +Finally, updating the package definition to a new upstream version can be +partly automated by the @command{guix refresh} command (@pxref{Invoking guix +refresh}). + +Behind the scenes, a derivation corresponding to the @code{<package>} object +is first computed by the @code{package-derivation} procedure. That +derivation is stored in a @code{.drv} file under @file{/gnu/store}. The +build actions it prescribes may then be realized by using the +@code{build-derivations} procedure (@pxref{The Store}). + +@deffn {Scheme Procedure} package-derivation @var{store} @var{package} [@var{system}] +Return the @code{<derivation>} object of @var{package} for @var{system} +(@pxref{Derivations}). + +@var{package} must be a valid @code{<package>} object, and @var{system} must +be a string denoting the target system type---e.g., @code{"x86_64-linux"} +for an x86_64 Linux-based GNU system. @var{store} must be a connection to +the daemon, which operates on the store (@pxref{The Store}). +@end deffn + +@noindent +@cindex cross-compilation +Similarly, it is possible to compute a derivation that cross-builds a +package for some other system: + +@deffn {Scheme Procedure} package-cross-derivation @var{store} @ + @var{package} @var{target} [@var{system}] Return the @code{<derivation>} +object of @var{package} cross-built from @var{system} to @var{target}. + +@var{target} must be a valid GNU triplet denoting the target hardware and +operating system, such as @code{"mips64el-linux-gnu"} (@pxref{Configuration +Names, GNU configuration triplets,, configure, GNU Configure and Build +System}). +@end deffn + +@cindex package transformations +@cindex input rewriting +@cindex dependency tree rewriting +Packages can be manipulated in arbitrary ways. An example of a useful +transformation is @dfn{input rewriting}, whereby the dependency tree of a +package is rewritten by replacing specific inputs by others: + +@deffn {Scheme Procedure} package-input-rewriting @var{replacements} @ + [@var{rewrite-name}] Return a procedure that, when passed a package, +replaces its direct and indirect dependencies (but not its implicit inputs) +according to @var{replacements}. @var{replacements} is a list of package +pairs; the first element of each pair is the package to replace, and the +second one is the replacement. + +Optionally, @var{rewrite-name} is a one-argument procedure that takes the +name of a package and returns its new name after rewrite. +@end deffn + +@noindent +Consider this example: + +@example +(define libressl-instead-of-openssl + ;; This is a procedure to replace OPENSSL by LIBRESSL, + ;; recursively. + (package-input-rewriting `((,openssl . ,libressl)))) + +(define git-with-libressl + (libressl-instead-of-openssl git)) +@end example + +@noindent +Here we first define a rewriting procedure that replaces @var{openssl} with +@var{libressl}. Then we use it to define a @dfn{variant} of the @var{git} +package that uses @var{libressl} instead of @var{openssl}. This is exactly +what the @option{--with-input} command-line option does (@pxref{Package +Transformation Options, @option{--with-input}}). + +The following variant of @code{package-input-rewriting} can match packages +to be replaced by name rather than by identity. + +@deffn {Scheme Procedure} package-input-rewriting/spec @var{replacements} +Return a procedure that, given a package, applies the given +@var{replacements} to all the package graph (excluding implicit inputs). +@var{replacements} is a list of spec/procedures pair; each spec is a package +specification such as @code{"gcc"} or @code{"guile@@2"}, and each procedure +takes a matching package and returns a replacement for that package. +@end deffn + +The example above could be rewritten this way: + +@example +(define libressl-instead-of-openssl + ;; Replace all the packages called "openssl" with LibreSSL. + (package-input-rewriting/spec `(("openssl" . ,(const libressl))))) +@end example + +The key difference here is that, this time, packages are matched by spec and +not by identity. In other words, any package in the graph that is called +@code{openssl} will be replaced. + +A more generic procedure to rewrite a package dependency graph is +@code{package-mapping}: it supports arbitrary changes to nodes in the graph. + +@deffn {Scheme Procedure} package-mapping @var{proc} [@var{cut?}] +Return a procedure that, given a package, applies @var{proc} to all the +packages depended on and returns the resulting package. The procedure stops +recursion when @var{cut?} returns true for a given package. +@end deffn + +@menu +* package Reference:: The package data type. +* origin Reference:: The origin data type. +@end menu + + +@node package Reference +@subsection @code{package} Reference + +This section summarizes all the options available in @code{package} +declarations (@pxref{Defining Packages}). + +@deftp {Data Type} package +This is the data type representing a package recipe. + +@table @asis +@item @code{name} +The name of the package, as a string. + +@item @code{version} +The version of the package, as a string. + +@item @code{source} +An object telling how the source code for the package should be acquired. +Most of the time, this is an @code{origin} object, which denotes a file +fetched from the Internet (@pxref{origin Reference}). It can also be any +other ``file-like'' object such as a @code{local-file}, which denotes a file +from the local file system (@pxref{G-Expressions, @code{local-file}}). + +@item @code{build-system} +The build system that should be used to build the package (@pxref{Build +Systems}). + +@item @code{arguments} (default: @code{'()}) +The arguments that should be passed to the build system. This is a list, +typically containing sequential keyword-value pairs. + +@item @code{inputs} (default: @code{'()}) +@itemx @code{native-inputs} (default: @code{'()}) +@itemx @code{propagated-inputs} (default: @code{'()}) +@cindex inputs, of packages +These fields list dependencies of the package. Each one is a list of +tuples, where each tuple has a label for the input (a string) as its first +element, a package, origin, or derivation as its second element, and +optionally the name of the output thereof that should be used, which +defaults to @code{"out"} (@pxref{Packages with Multiple Outputs}, for more +on package outputs). For example, the list below specifies three inputs: + +@example +`(("libffi" ,libffi) + ("libunistring" ,libunistring) + ("glib:bin" ,glib "bin")) ;the "bin" output of Glib +@end example + +@cindex cross compilation, package dependencies +The distinction between @code{native-inputs} and @code{inputs} is necessary +when considering cross-compilation. When cross-compiling, dependencies +listed in @code{inputs} are built for the @emph{target} architecture; +conversely, dependencies listed in @code{native-inputs} are built for the +architecture of the @emph{build} machine. + +@code{native-inputs} is typically used to list tools needed at build time, +but not at run time, such as Autoconf, Automake, pkg-config, Gettext, or +Bison. @command{guix lint} can report likely mistakes in this area +(@pxref{Invoking guix lint}). + +@anchor{package-propagated-inputs} +Lastly, @code{propagated-inputs} is similar to @code{inputs}, but the +specified packages will be automatically installed alongside the package +they belong to (@pxref{package-cmd-propagated-inputs, @command{guix +package}}, for information on how @command{guix package} deals with +propagated inputs.) + +For example this is necessary when a C/C++ library needs headers of another +library to compile, or when a pkg-config file refers to another one @i{via} +its @code{Requires} field. + +Another example where @code{propagated-inputs} is useful is for languages +that lack a facility to record the run-time search path akin to the +@code{RUNPATH} of ELF files; this includes Guile, Python, Perl, and more. +To ensure that libraries written in those languages can find library code +they depend on at run time, run-time dependencies must be listed in +@code{propagated-inputs} rather than @code{inputs}. + +@item @code{outputs} (default: @code{'("out")}) +The list of output names of the package. @xref{Packages with Multiple +Outputs}, for typical uses of additional outputs. + +@item @code{native-search-paths} (default: @code{'()}) +@itemx @code{search-paths} (default: @code{'()}) +A list of @code{search-path-specification} objects describing search-path +environment variables honored by the package. + +@item @code{replacement} (default: @code{#f}) +This must be either @code{#f} or a package object that will be used as a +@dfn{replacement} for this package. @xref{Security Updates, grafts}, for +details. + +@item @code{synopsis} +A one-line description of the package. + +@item @code{description} +A more elaborate description of the package. + +@item @code{license} +@cindex license, of packages +The license of the package; a value from @code{(guix licenses)}, or a list +of such values. + +@item @code{home-page} +The URL to the home-page of the package, as a string. + +@item @code{supported-systems} (default: @var{%supported-systems}) +The list of systems supported by the package, as strings of the form +@code{architecture-kernel}, for example @code{"x86_64-linux"}. + +@item @code{maintainers} (default: @code{'()}) +The list of maintainers of the package, as @code{maintainer} objects. + +@item @code{location} (default: source location of the @code{package} form) +The source location of the package. It is useful to override this when +inheriting from another package, in which case this field is not +automatically corrected. +@end table +@end deftp + +@deffn {Scheme Syntax} this-package +When used in the @emph{lexical scope} of a package field definition, this +identifier resolves to the package being defined. + +The example below shows how to add a package as a native input of itself +when cross-compiling: + +@example +(package + (name "guile") + ;; ... + + ;; When cross-compiled, Guile, for example, depends on + ;; a native version of itself. Add it here. + (native-inputs (if (%current-target-system) + `(("self" ,this-package)) + '()))) +@end example + +It is an error to refer to @code{this-package} outside a package definition. +@end deffn + +@node origin Reference +@subsection @code{origin} Reference + +This section summarizes all the options available in @code{origin} +declarations (@pxref{Defining Packages}). + +@deftp {Data Type} origin +This is the data type representing a source code origin. + +@table @asis +@item @code{uri} +An object containing the URI of the source. The object type depends on the +@code{method} (see below). For example, when using the @var{url-fetch} +method of @code{(guix download)}, the valid @code{uri} values are: a URL +represented as a string, or a list thereof. + +@item @code{method} +A procedure that handles the URI. + +Examples include: + +@table @asis +@item @var{url-fetch} from @code{(guix download)} +download a file from the HTTP, HTTPS, or FTP URL specified in the @code{uri} +field; + +@vindex git-fetch +@item @var{git-fetch} from @code{(guix git-download)} +clone the Git version control repository, and check out the revision +specified in the @code{uri} field as a @code{git-reference} object; a +@code{git-reference} looks like this: + +@example +(git-reference + (url "git://git.debian.org/git/pkg-shadow/shadow") + (commit "v4.1.5.1")) +@end example +@end table + +@item @code{sha256} +A bytevector containing the SHA-256 hash of the source. Typically the +@code{base32} form is used here to generate the bytevector from a base-32 +string. + +You can obtain this information using @code{guix download} (@pxref{Invoking +guix download}) or @code{guix hash} (@pxref{Invoking guix hash}). + +@item @code{file-name} (default: @code{#f}) +The file name under which the source code should be saved. When this is +@code{#f}, a sensible default value will be used in most cases. In case the +source is fetched from a URL, the file name from the URL will be used. For +version control checkouts, it is recommended to provide the file name +explicitly because the default is not very descriptive. + +@item @code{patches} (default: @code{'()}) +A list of file names, origins, or file-like objects (@pxref{G-Expressions, +file-like objects}) pointing to patches to be applied to the source. + +This list of patches must be unconditional. In particular, it cannot depend +on the value of @code{%current-system} or @code{%current-target-system}. + +@item @code{snippet} (default: @code{#f}) +A G-expression (@pxref{G-Expressions}) or S-expression that will be run in +the source directory. This is a convenient way to modify the source, +sometimes more convenient than a patch. + +@item @code{patch-flags} (default: @code{'("-p1")}) +A list of command-line flags that should be passed to the @code{patch} +command. + +@item @code{patch-inputs} (default: @code{#f}) +Input packages or derivations to the patching process. When this is +@code{#f}, the usual set of inputs necessary for patching are provided, such +as GNU@tie{}Patch. + +@item @code{modules} (default: @code{'()}) +A list of Guile modules that should be loaded during the patching process +and while running the code in the @code{snippet} field. + +@item @code{patch-guile} (default: @code{#f}) +The Guile package that should be used in the patching process. When this is +@code{#f}, a sensible default is used. +@end table +@end deftp + + +@node Build Systems +@section Build Systems + +@cindex build system +Each package definition specifies a @dfn{build system} and arguments for +that build system (@pxref{Defining Packages}). This @code{build-system} +field represents the build procedure of the package, as well as implicit +dependencies of that build procedure. + +Build systems are @code{<build-system>} objects. The interface to create +and manipulate them is provided by the @code{(guix build-system)} module, +and actual build systems are exported by specific modules. + +@cindex bag (low-level package representation) +Under the hood, build systems first compile package objects to @dfn{bags}. +A @dfn{bag} is like a package, but with less ornamentation---in other words, +a bag is a lower-level representation of a package, which includes all the +inputs of that package, including some that were implicitly added by the +build system. This intermediate representation is then compiled to a +derivation (@pxref{Derivations}). + +Build systems accept an optional list of @dfn{arguments}. In package +definitions, these are passed @i{via} the @code{arguments} field +(@pxref{Defining Packages}). They are typically keyword arguments +(@pxref{Optional Arguments, keyword arguments in Guile,, guile, GNU Guile +Reference Manual}). The value of these arguments is usually evaluated in +the @dfn{build stratum}---i.e., by a Guile process launched by the daemon +(@pxref{Derivations}). + +The main build system is @var{gnu-build-system}, which implements the +standard build procedure for GNU and many other packages. It is provided by +the @code{(guix build-system gnu)} module. + +@defvr {Scheme Variable} gnu-build-system +@var{gnu-build-system} represents the GNU Build System, and variants thereof +(@pxref{Configuration, configuration and makefile conventions,, standards, +GNU Coding Standards}). + +@cindex build phases +In a nutshell, packages using it are configured, built, and installed with +the usual @code{./configure && make && make check && make install} command +sequence. In practice, a few additional steps are often needed. All these +steps are split up in separate @dfn{phases}, notably@footnote{Please see the +@code{(guix build gnu-build-system)} modules for more details about the +build phases.}: + +@table @code +@item unpack +Unpack the source tarball, and change the current directory to the extracted +source tree. If the source is actually a directory, copy it to the build +tree, and enter that directory. + +@item patch-source-shebangs +Patch shebangs encountered in source files so they refer to the right store +file names. For instance, this changes @code{#!/bin/sh} to +@code{#!/gnu/store/@dots{}-bash-4.3/bin/sh}. + +@item configure +Run the @file{configure} script with a number of default options, such as +@code{--prefix=/gnu/store/@dots{}}, as well as the options specified by the +@code{#:configure-flags} argument. + +@item build +Run @code{make} with the list of flags specified with @code{#:make-flags}. +If the @code{#:parallel-build?} argument is true (the default), build with +@code{make -j}. + +@item check +Run @code{make check}, or some other target specified with +@code{#:test-target}, unless @code{#:tests? #f} is passed. If the +@code{#:parallel-tests?} argument is true (the default), run @code{make +check -j}. + +@item install +Run @code{make install} with the flags listed in @code{#:make-flags}. + +@item patch-shebangs +Patch shebangs on the installed executable files. + +@item strip +Strip debugging symbols from ELF files (unless @code{#:strip-binaries?} is +false), copying them to the @code{debug} output when available +(@pxref{Installing Debugging Files}). +@end table + +@vindex %standard-phases +The build-side module @code{(guix build gnu-build-system)} defines +@var{%standard-phases} as the default list of build phases. +@var{%standard-phases} is a list of symbol/procedure pairs, where the +procedure implements the actual phase. + +The list of phases used for a particular package can be changed with the +@code{#:phases} parameter. For instance, passing: + +@example +#:phases (modify-phases %standard-phases (delete 'configure)) +@end example + +means that all the phases described above will be used, except the +@code{configure} phase. + +In addition, this build system ensures that the ``standard'' environment for +GNU packages is available. This includes tools such as GCC, libc, +Coreutils, Bash, Make, Diffutils, grep, and sed (see the @code{(guix +build-system gnu)} module for a complete list). We call these the +@dfn{implicit inputs} of a package, because package definitions do not have +to mention them. +@end defvr + +Other @code{<build-system>} objects are defined to support other conventions +and tools used by free software packages. They inherit most of +@var{gnu-build-system}, and differ mainly in the set of inputs implicitly +added to the build process, and in the list of phases executed. Some of +these build systems are listed below. + +@defvr {Scheme Variable} ant-build-system +This variable is exported by @code{(guix build-system ant)}. It implements +the build procedure for Java packages that can be built with +@url{http://ant.apache.org/, Ant build tool}. + +It adds both @code{ant} and the @dfn{Java Development Kit} (JDK) as provided +by the @code{icedtea} package to the set of inputs. Different packages can +be specified with the @code{#:ant} and @code{#:jdk} parameters, +respectively. + +When the original package does not provide a suitable Ant build file, the +parameter @code{#:jar-name} can be used to generate a minimal Ant build file +@file{build.xml} with tasks to build the specified jar archive. In this +case the parameter @code{#:source-dir} can be used to specify the source +sub-directory, defaulting to ``src''. + +The @code{#:main-class} parameter can be used with the minimal ant buildfile +to specify the main class of the resulting jar. This makes the jar file +executable. The @code{#:test-include} parameter can be used to specify the +list of junit tests to run. It defaults to @code{(list "**/*Test.java")}. +The @code{#:test-exclude} can be used to disable some tests. It defaults to +@code{(list "**/Abstract*.java")}, because abstract classes cannot be run as +tests. + +The parameter @code{#:build-target} can be used to specify the Ant task that +should be run during the @code{build} phase. By default the ``jar'' task +will be run. + +@end defvr + +@defvr {Scheme Variable} android-ndk-build-system +@cindex Android distribution +@cindex Android NDK build system +This variable is exported by @code{(guix build-system android-ndk)}. It +implements a build procedure for Android NDK (native development kit) +packages using a Guix-specific build process. + +The build system assumes that packages install their public interface +(header) files to the subdirectory "include" of the "out" output and their +libraries to the subdirectory "lib" of the "out" output. + +It's also assumed that the union of all the dependencies of a package has no +conflicting files. + +For the time being, cross-compilation is not supported - so right now the +libraries and header files are assumed to be host tools. + +@end defvr + +@defvr {Scheme Variable} asdf-build-system/source +@defvrx {Scheme Variable} asdf-build-system/sbcl +@defvrx {Scheme Variable} asdf-build-system/ecl + +These variables, exported by @code{(guix build-system asdf)}, implement +build procedures for Common Lisp packages using +@url{https://common-lisp.net/project/asdf/, ``ASDF''}. ASDF is a system +definition facility for Common Lisp programs and libraries. + +The @code{asdf-build-system/source} system installs the packages in source +form, and can be loaded using any common lisp implementation, via ASDF. The +others, such as @code{asdf-build-system/sbcl}, install binary systems in the +format which a particular implementation understands. These build systems +can also be used to produce executable programs, or lisp images which +contain a set of packages pre-loaded. + +The build system uses naming conventions. For binary packages, the package +name should be prefixed with the lisp implementation, such as @code{sbcl-} +for @code{asdf-build-system/sbcl}. + +Additionally, the corresponding source package should be labeled using the +same convention as python packages (see @ref{Python模块}), using the +@code{cl-} prefix. + +For binary packages, each system should be defined as a Guix package. If +one package @code{origin} contains several systems, package variants can be +created in order to build all the systems. Source packages, which use +@code{asdf-build-system/source}, may contain several systems. + +In order to create executable programs and images, the build-side procedures +@code{build-program} and @code{build-image} can be used. They should be +called in a build phase after the @code{create-symlinks} phase, so that the +system which was just built can be used within the resulting image. +@code{build-program} requires a list of Common Lisp expressions to be passed +as the @code{#:entry-program} argument. + +If the system is not defined within its own @code{.asd} file of the same +name, then the @code{#:asd-file} parameter should be used to specify which +file the system is defined in. Furthermore, if the package defines a system +for its tests in a separate file, it will be loaded before the tests are run +if it is specified by the @code{#:test-asd-file} parameter. If it is not +set, the files @code{<system>-tests.asd}, @code{<system>-test.asd}, +@code{tests.asd}, and @code{test.asd} will be tried if they exist. + +If for some reason the package must be named in a different way than the +naming conventions suggest, the @code{#:asd-system-name} parameter can be +used to specify the name of the system. + +@end defvr + +@defvr {Scheme Variable} cargo-build-system +@cindex Rust programming language +@cindex Cargo (Rust build system) +This variable is exported by @code{(guix build-system cargo)}. It supports +builds of packages using Cargo, the build tool of the +@uref{https://www.rust-lang.org, Rust programming language}. + +In its @code{configure} phase, this build system replaces dependencies +specified in the @file{Carto.toml} file with inputs to the Guix package. +The @code{install} phase installs the binaries, and it also installs the +source code and @file{Cargo.toml} file. +@end defvr + +@cindex Clojure (programming language) +@cindex simple Clojure build system +@defvr {Scheme Variable} clojure-build-system +This variable is exported by @code{(guix build-system clojure)}. It +implements a simple build procedure for @uref{https://clojure.org/, Clojure} +packages using plain old @code{compile} in Clojure. Cross-compilation is +not supported yet. + +It adds @code{clojure}, @code{icedtea} and @code{zip} to the set of inputs. +Different packages can be specified with the @code{#:clojure}, @code{#:jdk} +and @code{#:zip} parameters, respectively. + +A list of source directories, test directories and jar names can be +specified with the @code{#:source-dirs}, @code{#:test-dirs} and +@code{#:jar-names} parameters, respectively. Compile directory and main +class can be specified with the @code{#:compile-dir} and @code{#:main-class} +parameters, respectively. Other parameters are documented below. + +This build system is an extension of @var{ant-build-system}, but with the +following phases changed: + +@table @code + +@item build +This phase calls @code{compile} in Clojure to compile source files and runs +@command{jar} to create jars from both source files and compiled files +according to the include list and exclude list specified in +@code{#:aot-include} and @code{#:aot-exclude}, respectively. The exclude +list has priority over the include list. These lists consist of symbols +representing Clojure libraries or the special keyword @code{#:all} +representing all Clojure libraries found under the source directories. The +parameter @code{#:omit-source?} decides if source should be included into +the jars. + +@item check +This phase runs tests according to the include list and exclude list +specified in @code{#:test-include} and @code{#:test-exclude}, respectively. +Their meanings are analogous to that of @code{#:aot-include} and +@code{#:aot-exclude}, except that the special keyword @code{#:all} now +stands for all Clojure libraries found under the test directories. The +parameter @code{#:tests?} decides if tests should be run. + +@item install +This phase installs all jars built previously. +@end table + +Apart from the above, this build system also contains an additional phase: + +@table @code + +@item install-doc +This phase installs all top-level files with base name matching +@var{%doc-regex}. A different regex can be specified with the +@code{#:doc-regex} parameter. All files (recursively) inside the +documentation directories specified in @code{#:doc-dirs} are installed as +well. +@end table +@end defvr + +@defvr {Scheme Variable} cmake-build-system +This variable is exported by @code{(guix build-system cmake)}. It +implements the build procedure for packages using the +@url{http://www.cmake.org, CMake build tool}. + +It automatically adds the @code{cmake} package to the set of inputs. Which +package is used can be specified with the @code{#:cmake} parameter. + +The @code{#:configure-flags} parameter is taken as a list of flags passed to +the @command{cmake} command. The @code{#:build-type} parameter specifies in +abstract terms the flags passed to the compiler; it defaults to +@code{"RelWithDebInfo"} (short for ``release mode with debugging +information''), which roughly means that code is compiled with @code{-O2 +-g}, as is the case for Autoconf-based packages by default. +@end defvr + +@defvr {Scheme Variable} dune-build-system +This variable is exported by @code{(guix build-system dune)}. It supports +builds of packages using @uref{https://dune.build/, Dune}, a build tool for +the OCaml programming language. It is implemented as an extension of the +@code{ocaml-build-system} which is described below. As such, the +@code{#:ocaml} and @code{#:findlib} parameters can be passed to this build +system. + +It automatically adds the @code{dune} package to the set of inputs. Which +package is used can be specified with the @code{#:dune} parameter. + +There is no @code{configure} phase because dune packages typically don't +need to be configured. The @code{#:build-flags} parameter is taken as a +list of flags passed to the @code{dune} command during the build. + +The @code{#:jbuild?} parameter can be passed to use the @code{jbuild} +command instead of the more recent @code{dune} command while building a +package. Its default value is @code{#f}. + +The @code{#:package} parameter can be passed to specify a package name, +which is useful when a package contains multiple packages and you want to +build only one of them. This is equivalent to passing the @code{-p} +argument to @code{dune}. +@end defvr + +@defvr {Scheme Variable} go-build-system +This variable is exported by @code{(guix build-system go)}. It implements a +build procedure for Go packages using the standard +@url{https://golang.org/cmd/go/#hdr-Compile_packages_and_dependencies, Go +build mechanisms}. + +The user is expected to provide a value for the key @code{#:import-path} +and, in some cases, @code{#:unpack-path}. The +@url{https://golang.org/doc/code.html#ImportPaths, import path} corresponds +to the file system path expected by the package's build scripts and any +referring packages, and provides a unique way to refer to a Go package. It +is typically based on a combination of the package source code's remote URI +and file system hierarchy structure. In some cases, you will need to unpack +the package's source code to a different directory structure than the one +indicated by the import path, and @code{#:unpack-path} should be used in +such cases. + +Packages that provide Go libraries should install their source code into the +built output. The key @code{#:install-source?}, which defaults to +@code{#t}, controls whether or not the source code is installed. It can be +set to @code{#f} for packages that only provide executable files. +@end defvr + +@defvr {Scheme Variable} glib-or-gtk-build-system +This variable is exported by @code{(guix build-system glib-or-gtk)}. It is +intended for use with packages making use of GLib or GTK+. + +This build system adds the following two phases to the ones defined by +@var{gnu-build-system}: + +@table @code +@item glib-or-gtk-wrap +The phase @code{glib-or-gtk-wrap} ensures that programs in @file{bin/} are +able to find GLib ``schemas'' and +@uref{https://developer.gnome.org/gtk3/stable/gtk-running.html, GTK+ +modules}. This is achieved by wrapping the programs in launch scripts that +appropriately set the @code{XDG_DATA_DIRS} and @code{GTK_PATH} environment +variables. + +It is possible to exclude specific package outputs from that wrapping +process by listing their names in the +@code{#:glib-or-gtk-wrap-excluded-outputs} parameter. This is useful when +an output is known not to contain any GLib or GTK+ binaries, and where +wrapping would gratuitously add a dependency of that output on GLib and +GTK+. + +@item glib-or-gtk-compile-schemas +The phase @code{glib-or-gtk-compile-schemas} makes sure that all +@uref{https://developer.gnome.org/gio/stable/glib-compile-schemas.html, +GSettings schemas} of GLib are compiled. Compilation is performed by the +@command{glib-compile-schemas} program. It is provided by the package +@code{glib:bin} which is automatically imported by the build system. The +@code{glib} package providing @command{glib-compile-schemas} can be +specified with the @code{#:glib} parameter. +@end table + +Both phases are executed after the @code{install} phase. +@end defvr + +@defvr {Scheme Variable} guile-build-system +This build system is for Guile packages that consist exclusively of Scheme +code and that are so lean that they don't even have a makefile, let alone a +@file{configure} script. It compiles Scheme code using @command{guild +compile} (@pxref{Compilation,,, guile, GNU Guile Reference Manual}) and +installs the @file{.scm} and @file{.go} files in the right place. It also +installs documentation. + +This build system supports cross-compilation by using the @code{--target} +option of @command{guild compile}. + +Packages built with @code{guile-build-system} must provide a Guile package +in their @code{native-inputs} field. +@end defvr + +@defvr {Scheme Variable} minify-build-system +This variable is exported by @code{(guix build-system minify)}. It +implements a minification procedure for simple JavaScript packages. + +It adds @code{uglify-js} to the set of inputs and uses it to compress all +JavaScript files in the @file{src} directory. A different minifier package +can be specified with the @code{#:uglify-js} parameter, but it is expected +that the package writes the minified code to the standard output. + +When the input JavaScript files are not all located in the @file{src} +directory, the parameter @code{#:javascript-files} can be used to specify a +list of file names to feed to the minifier. +@end defvr + +@defvr {Scheme Variable} ocaml-build-system +This variable is exported by @code{(guix build-system ocaml)}. It +implements a build procedure for @uref{https://ocaml.org, OCaml} packages, +which consists of choosing the correct set of commands to run for each +package. OCaml packages can expect many different commands to be run. This +build system will try some of them. + +When the package has a @file{setup.ml} file present at the top-level, it +will run @code{ocaml setup.ml -configure}, @code{ocaml setup.ml -build} and +@code{ocaml setup.ml -install}. The build system will assume that this file +was generated by @uref{http://oasis.forge.ocamlcore.org/, OASIS} and will +take care of setting the prefix and enabling tests if they are not +disabled. You can pass configure and build flags with the +@code{#:configure-flags} and @code{#:build-flags}. The @code{#:test-flags} +key can be passed to change the set of flags used to enable tests. The +@code{#:use-make?} key can be used to bypass this system in the build and +install phases. + +When the package has a @file{configure} file, it is assumed that it is a +hand-made configure script that requires a different argument format than in +the @code{gnu-build-system}. You can add more flags with the +@code{#:configure-flags} key. + +When the package has a @file{Makefile} file (or @code{#:use-make?} is +@code{#t}), it will be used and more flags can be passed to the build and +install phases with the @code{#:make-flags} key. + +Finally, some packages do not have these files and use a somewhat standard +location for its build system. In that case, the build system will run +@code{ocaml pkg/pkg.ml} or @code{ocaml pkg/build.ml} and take care of +providing the path to the required findlib module. Additional flags can be +passed via the @code{#:build-flags} key. Install is taken care of by +@command{opam-installer}. In this case, the @code{opam} package must be +added to the @code{native-inputs} field of the package definition. + +Note that most OCaml packages assume they will be installed in the same +directory as OCaml, which is not what we want in guix. In particular, they +will install @file{.so} files in their module's directory, which is usually +fine because it is in the OCaml compiler directory. In guix though, these +libraries cannot be found and we use @code{CAML_LD_LIBRARY_PATH}. This +variable points to @file{lib/ocaml/site-lib/stubslibs} and this is where +@file{.so} libraries should be installed. +@end defvr + +@defvr {Scheme Variable} python-build-system +This variable is exported by @code{(guix build-system python)}. It +implements the more or less standard build procedure used by Python +packages, which consists in running @code{python setup.py build} and then +@code{python setup.py install --prefix=/gnu/store/@dots{}}. + +For packages that install stand-alone Python programs under @code{bin/}, it +takes care of wrapping these programs so that their @code{PYTHONPATH} +environment variable points to all the Python libraries they depend on. + +Which Python package is used to perform the build can be specified with the +@code{#:python} parameter. This is a useful way to force a package to be +built for a specific version of the Python interpreter, which might be +necessary if the package is only compatible with a single interpreter +version. + +By default guix calls @code{setup.py} under control of @code{setuptools}, +much like @command{pip} does. Some packages are not compatible with +setuptools (and pip), thus you can disable this by setting the +@code{#:use-setuptools} parameter to @code{#f}. +@end defvr + +@defvr {Scheme Variable} perl-build-system +This variable is exported by @code{(guix build-system perl)}. It implements +the standard build procedure for Perl packages, which either consists in +running @code{perl Build.PL --prefix=/gnu/store/@dots{}}, followed by +@code{Build} and @code{Build install}; or in running @code{perl Makefile.PL +PREFIX=/gnu/store/@dots{}}, followed by @code{make} and @code{make install}, +depending on which of @code{Build.PL} or @code{Makefile.PL} is present in +the package distribution. Preference is given to the former if both +@code{Build.PL} and @code{Makefile.PL} exist in the package distribution. +This preference can be reversed by specifying @code{#t} for the +@code{#:make-maker?} parameter. + +The initial @code{perl Makefile.PL} or @code{perl Build.PL} invocation +passes flags specified by the @code{#:make-maker-flags} or +@code{#:module-build-flags} parameter, respectively. + +Which Perl package is used can be specified with @code{#:perl}. +@end defvr + +@defvr {Scheme Variable} r-build-system +This variable is exported by @code{(guix build-system r)}. It implements +the build procedure used by @uref{http://r-project.org, R} packages, which +essentially is little more than running @code{R CMD INSTALL +--library=/gnu/store/@dots{}} in an environment where @code{R_LIBS_SITE} +contains the paths to all R package inputs. Tests are run after +installation using the R function @code{tools::testInstalledPackage}. +@end defvr + +@defvr {Scheme Variable} rakudo-build-system +This variable is exported by @code{(guix build-system rakudo)} It implements +the build procedure used by @uref{https://rakudo.org/, Rakudo} for +@uref{https://perl6.org/, Perl6} packages. It installs the package to +@code{/gnu/store/@dots{}/NAME-VERSION/share/perl6} and installs the +binaries, library files and the resources, as well as wrap the files under +the @code{bin/} directory. Tests can be skipped by passing @code{#f} to the +@code{tests?} parameter. + +Which rakudo package is used can be specified with @code{rakudo}. Which +perl6-tap-harness package used for the tests can be specified with +@code{#:prove6} or removed by passing @code{#f} to the @code{with-prove6?} +parameter. Which perl6-zef package used for tests and installing can be +specified with @code{#:zef} or removed by passing @code{#f} to the +@code{with-zef?} parameter. +@end defvr + +@defvr {Scheme Variable} texlive-build-system +This variable is exported by @code{(guix build-system texlive)}. It is used +to build TeX packages in batch mode with a specified engine. The build +system sets the @code{TEXINPUTS} variable to find all TeX source files in +the inputs. + +By default it runs @code{luatex} on all files ending on @code{ins}. A +different engine and format can be specified with the @code{#:tex-format} +argument. Different build targets can be specified with the +@code{#:build-targets} argument, which expects a list of file names. The +build system adds only @code{texlive-bin} and @code{texlive-latex-base} +(both from @code{(gnu packages tex}) to the inputs. Both can be overridden +with the arguments @code{#:texlive-bin} and @code{#:texlive-latex-base}, +respectively. + +The @code{#:tex-directory} parameter tells the build system where to install +the built files under the texmf tree. +@end defvr + +@defvr {Scheme Variable} ruby-build-system +This variable is exported by @code{(guix build-system ruby)}. It implements +the RubyGems build procedure used by Ruby packages, which involves running +@code{gem build} followed by @code{gem install}. + +The @code{source} field of a package that uses this build system typically +references a gem archive, since this is the format that Ruby developers use +when releasing their software. The build system unpacks the gem archive, +potentially patches the source, runs the test suite, repackages the gem, and +installs it. Additionally, directories and tarballs may be referenced to +allow building unreleased gems from Git or a traditional source release +tarball. + +Which Ruby package is used can be specified with the @code{#:ruby} +parameter. A list of additional flags to be passed to the @command{gem} +command can be specified with the @code{#:gem-flags} parameter. +@end defvr + +@defvr {Scheme Variable} waf-build-system +This variable is exported by @code{(guix build-system waf)}. It implements +a build procedure around the @code{waf} script. The common +phases---@code{configure}, @code{build}, and @code{install}---are +implemented by passing their names as arguments to the @code{waf} script. + +The @code{waf} script is executed by the Python interpreter. Which Python +package is used to run the script can be specified with the @code{#:python} +parameter. +@end defvr + +@defvr {Scheme Variable} scons-build-system +This variable is exported by @code{(guix build-system scons)}. It +implements the build procedure used by the SCons software construction +tool. This build system runs @code{scons} to build the package, @code{scons +test} to run tests, and then @code{scons install} to install the package. + +Additional flags to be passed to @code{scons} can be specified with the +@code{#:scons-flags} parameter. The version of Python used to run SCons can +be specified by selecting the appropriate SCons package with the +@code{#:scons} parameter. +@end defvr + +@defvr {Scheme Variable} haskell-build-system +This variable is exported by @code{(guix build-system haskell)}. It +implements the Cabal build procedure used by Haskell packages, which +involves running @code{runhaskell Setup.hs configure +--prefix=/gnu/store/@dots{}} and @code{runhaskell Setup.hs build}. Instead +of installing the package by running @code{runhaskell Setup.hs install}, to +avoid trying to register libraries in the read-only compiler store +directory, the build system uses @code{runhaskell Setup.hs copy}, followed +by @code{runhaskell Setup.hs register}. In addition, the build system +generates the package documentation by running @code{runhaskell Setup.hs +haddock}, unless @code{#:haddock? #f} is passed. Optional Haddock +parameters can be passed with the help of the @code{#:haddock-flags} +parameter. If the file @code{Setup.hs} is not found, the build system looks +for @code{Setup.lhs} instead. + +Which Haskell compiler is used can be specified with the @code{#:haskell} +parameter which defaults to @code{ghc}. +@end defvr + +@defvr {Scheme Variable} dub-build-system +This variable is exported by @code{(guix build-system dub)}. It implements +the Dub build procedure used by D packages, which involves running @code{dub +build} and @code{dub run}. Installation is done by copying the files +manually. + +Which D compiler is used can be specified with the @code{#:ldc} parameter +which defaults to @code{ldc}. +@end defvr + +@defvr {Scheme Variable} emacs-build-system +This variable is exported by @code{(guix build-system emacs)}. It +implements an installation procedure similar to the packaging system of +Emacs itself (@pxref{Packages,,, emacs, The GNU Emacs Manual}). + +It first creates the @code{@var{package}-autoloads.el} file, then it byte +compiles all Emacs Lisp files. Differently from the Emacs packaging system, +the Info documentation files are moved to the standard documentation +directory and the @file{dir} file is deleted. Each package is installed in +its own directory under @file{share/emacs/site-lisp/guix.d}. +@end defvr + +@defvr {Scheme Variable} font-build-system +This variable is exported by @code{(guix build-system font)}. It implements +an installation procedure for font packages where upstream provides +pre-compiled TrueType, OpenType, etc.@: font files that merely need to be +copied into place. It copies font files to standard locations in the output +directory. +@end defvr + +@defvr {Scheme Variable} meson-build-system +This variable is exported by @code{(guix build-system meson)}. It +implements the build procedure for packages that use +@url{http://mesonbuild.com, Meson} as their build system. + +It adds both Meson and @uref{https://ninja-build.org/, Ninja} to the set of +inputs, and they can be changed with the parameters @code{#:meson} and +@code{#:ninja} if needed. The default Meson is @code{meson-for-build}, +which is special because it doesn't clear the @code{RUNPATH} of binaries and +libraries when they are installed. + +This build system is an extension of @var{gnu-build-system}, but with the +following phases changed to some specific for Meson: + +@table @code + +@item configure +The phase runs @code{meson} with the flags specified in +@code{#:configure-flags}. The flag @code{--build-type} is always set to +@code{plain} unless something else is specified in @code{#:build-type}. + +@item build +The phase runs @code{ninja} to build the package in parallel by default, but +this can be changed with @code{#:parallel-build?}. + +@item check +The phase runs @code{ninja} with the target specified in +@code{#:test-target}, which is @code{"test"} by default. + +@item install +The phase runs @code{ninja install} and can not be changed. +@end table + +Apart from that, the build system also adds the following phases: + +@table @code + +@item fix-runpath +This phase ensures that all binaries can find the libraries they need. It +searches for required libraries in subdirectories of the package being +built, and adds those to @code{RUNPATH} where needed. It also removes +references to libraries left over from the build phase by +@code{meson-for-build}, such as test dependencies, that aren't actually +required for the program to run. + +@item glib-or-gtk-wrap +This phase is the phase provided by @code{glib-or-gtk-build-system}, and it +is not enabled by default. It can be enabled with @code{#:glib-or-gtk?}. + +@item glib-or-gtk-compile-schemas +This phase is the phase provided by @code{glib-or-gtk-build-system}, and it +is not enabled by default. It can be enabled with @code{#:glib-or-gtk?}. +@end table +@end defvr + +@defvr {Scheme Variable} linux-module-build-system +@var{linux-module-build-system} allows building Linux kernel modules. + +@cindex build phases +This build system is an extension of @var{gnu-build-system}, but with the +following phases changed: + +@table @code + +@item configure +This phase configures the environment so that the Linux kernel's Makefile +can be used to build the external kernel module. + +@item build +This phase uses the Linux kernel's Makefile in order to build the external +kernel module. + +@item install +This phase uses the Linux kernel's Makefile in order to install the external +kernel module. +@end table + +It is possible and useful to specify the Linux kernel to use for building +the module (in the "arguments" form of a package using the +linux-module-build-system, use the key #:linux to specify it). +@end defvr + +Lastly, for packages that do not need anything as sophisticated, a +``trivial'' build system is provided. It is trivial in the sense that it +provides basically no support: it does not pull any implicit inputs, and +does not have a notion of build phases. + +@defvr {Scheme Variable} trivial-build-system +This variable is exported by @code{(guix build-system trivial)}. + +This build system requires a @code{#:builder} argument. This argument must +be a Scheme expression that builds the package output(s)---as with +@code{build-expression->derivation} (@pxref{Derivations, +@code{build-expression->derivation}}). +@end defvr + +@node The Store +@section The Store + +@cindex store +@cindex store items +@cindex store paths + +Conceptually, the @dfn{store} is the place where derivations that have been +built successfully are stored---by default, @file{/gnu/store}. +Sub-directories in the store are referred to as @dfn{store items} or +sometimes @dfn{store paths}. The store has an associated database that +contains information such as the store paths referred to by each store path, +and the list of @emph{valid} store items---results of successful builds. +This database resides in @file{@var{localstatedir}/guix/db}, where +@var{localstatedir} is the state directory specified @i{via} +@option{--localstatedir} at configure time, usually @file{/var}. + +The store is @emph{always} accessed by the daemon on behalf of its clients +(@pxref{Invoking guix-daemon}). To manipulate the store, clients connect to +the daemon over a Unix-domain socket, send requests to it, and read the +result---these are remote procedure calls, or RPCs. + +@quotation Note +Users must @emph{never} modify files under @file{/gnu/store} directly. This +would lead to inconsistencies and break the immutability assumptions of +Guix's functional model (@pxref{Introduction}). + +@xref{Invoking guix gc, @command{guix gc --verify}}, for information on how +to check the integrity of the store and attempt recovery from accidental +modifications. +@end quotation + +The @code{(guix store)} module provides procedures to connect to the daemon, +and to perform RPCs. These are described below. By default, +@code{open-connection}, and thus all the @command{guix} commands, connect to +the local daemon or to the URI specified by the @code{GUIX_DAEMON_SOCKET} +environment variable. + +@defvr {Environment Variable} GUIX_DAEMON_SOCKET +When set, the value of this variable should be a file name or a URI +designating the daemon endpoint. When it is a file name, it denotes a +Unix-domain socket to connect to. In addition to file names, the supported +URI schemes are: + +@table @code +@item file +@itemx unix +These are for Unix-domain sockets. +@code{file:///var/guix/daemon-socket/socket} is equivalent to +@file{/var/guix/daemon-socket/socket}. + +@item guix +@cindex daemon, remote access +@cindex remote access to the daemon +@cindex daemon, cluster setup +@cindex clusters, daemon setup +These URIs denote connections over TCP/IP, without encryption nor +authentication of the remote host. The URI must specify the host name and +optionally a port number (by default port 44146 is used): + +@example +guix://master.guix.example.org:1234 +@end example + +This setup is suitable on local networks, such as clusters, where only +trusted nodes may connect to the build daemon at +@code{master.guix.example.org}. + +The @code{--listen} option of @command{guix-daemon} can be used to instruct +it to listen for TCP connections (@pxref{Invoking guix-daemon, +@code{--listen}}). + +@item ssh +@cindex SSH access to build daemons +These URIs allow you to connect to a remote daemon over SSH@footnote{This +feature requires Guile-SSH (@pxref{Requirements}).}. A typical URL might +look like this: + +@example +ssh://charlie@@guix.example.org:22 +@end example + +As for @command{guix copy}, the usual OpenSSH client configuration files are +honored (@pxref{Invoking guix copy}). +@end table + +Additional URI schemes may be supported in the future. + +@c XXX: Remove this note when the protocol incurs fewer round trips +@c and when (guix derivations) no longer relies on file system access. +@quotation Note +The ability to connect to remote build daemons is considered experimental as +of @value{VERSION}. Please get in touch with us to share any problems or +suggestions you may have (@pxref{贡献}). +@end quotation +@end defvr + +@deffn {Scheme Procedure} open-connection [@var{uri}] [#:reserve-space? #t] +Connect to the daemon over the Unix-domain socket at @var{uri} (a string). +When @var{reserve-space?} is true, instruct it to reserve a little bit of +extra space on the file system so that the garbage collector can still +operate should the disk become full. Return a server object. + +@var{file} defaults to @var{%default-socket-path}, which is the normal +location given the options that were passed to @command{configure}. +@end deffn + +@deffn {Scheme Procedure} close-connection @var{server} +Close the connection to @var{server}. +@end deffn + +@defvr {Scheme Variable} current-build-output-port +This variable is bound to a SRFI-39 parameter, which refers to the port +where build and error logs sent by the daemon should be written. +@end defvr + +Procedures that make RPCs all take a server object as their first argument. + +@deffn {Scheme Procedure} valid-path? @var{server} @var{path} +@cindex invalid store items +Return @code{#t} when @var{path} designates a valid store item and @code{#f} +otherwise (an invalid item may exist on disk but still be invalid, for +instance because it is the result of an aborted or failed build.) + +A @code{&store-protocol-error} condition is raised if @var{path} is not +prefixed by the store directory (@file{/gnu/store}). +@end deffn + +@deffn {Scheme Procedure} add-text-to-store @var{server} @var{name} @var{text} [@var{references}] +Add @var{text} under file @var{name} in the store, and return its store +path. @var{references} is the list of store paths referred to by the +resulting store path. +@end deffn + +@deffn {Scheme Procedure} build-derivations @var{server} @var{derivations} +Build @var{derivations} (a list of @code{<derivation>} objects or derivation +paths), and return when the worker is done building them. Return @code{#t} +on success. +@end deffn + +Note that the @code{(guix monads)} module provides a monad as well as +monadic versions of the above procedures, with the goal of making it more +convenient to work with code that accesses the store (@pxref{The Store +Monad}). + +@c FIXME +@i{This section is currently incomplete.} + +@node Derivations +@section Derivations + +@cindex derivations +Low-level build actions and the environment in which they are performed are +represented by @dfn{derivations}. A derivation contains the following +pieces of information: + +@itemize +@item +The outputs of the derivation---derivations produce at least one file or +directory in the store, but may produce more. + +@item +@cindex build-time dependencies +@cindex dependencies, build-time +The inputs of the derivations---i.e., its build-time dependencies---which +may be other derivations or plain files in the store (patches, build +scripts, etc.) + +@item +The system type targeted by the derivation---e.g., @code{x86_64-linux}. + +@item +The file name of a build script in the store, along with the arguments to be +passed. + +@item +A list of environment variables to be defined. + +@end itemize + +@cindex derivation path +Derivations allow clients of the daemon to communicate build actions to the +store. They exist in two forms: as an in-memory representation, both on the +client- and daemon-side, and as files in the store whose name end in +@code{.drv}---these files are referred to as @dfn{derivation paths}. +Derivations paths can be passed to the @code{build-derivations} procedure to +perform the build actions they prescribe (@pxref{The Store}). + +@cindex fixed-output derivations +Operations such as file downloads and version-control checkouts for which +the expected content hash is known in advance are modeled as +@dfn{fixed-output derivations}. Unlike regular derivations, the outputs of +a fixed-output derivation are independent of its inputs---e.g., a source +code download produces the same result regardless of the download method and +tools being used. + +@cindex references +@cindex run-time dependencies +@cindex dependencies, run-time +The outputs of derivations---i.e., the build results---have a set of +@dfn{references}, as reported by the @code{references} RPC or the +@command{guix gc --references} command (@pxref{Invoking guix gc}). +References are the set of run-time dependencies of the build results. +References are a subset of the inputs of the derivation; this subset is +automatically computed by the build daemon by scanning all the files in the +outputs. + +The @code{(guix derivations)} module provides a representation of +derivations as Scheme objects, along with procedures to create and otherwise +manipulate derivations. The lowest-level primitive to create a derivation +is the @code{derivation} procedure: + +@deffn {Scheme Procedure} derivation @var{store} @var{name} @var{builder} @ + @var{args} [#:outputs '("out")] [#:hash #f] [#:hash-algo #f] @ [#:recursive? +#f] [#:inputs '()] [#:env-vars '()] @ [#:system (%current-system)] +[#:references-graphs #f] @ [#:allowed-references #f] +[#:disallowed-references #f] @ [#:leaked-env-vars #f] [#:local-build? #f] @ +[#:substitutable? #t] [#:properties '()] Build a derivation with the given +arguments, and return the resulting @code{<derivation>} object. + +When @var{hash} and @var{hash-algo} are given, a @dfn{fixed-output +derivation} is created---i.e., one whose result is known in advance, such as +a file download. If, in addition, @var{recursive?} is true, then that fixed +output may be an executable file or a directory and @var{hash} must be the +hash of an archive containing this output. + +When @var{references-graphs} is true, it must be a list of file name/store +path pairs. In that case, the reference graph of each store path is +exported in the build environment in the corresponding file, in a simple +text format. + +When @var{allowed-references} is true, it must be a list of store items or +outputs that the derivation's output may refer to. Likewise, +@var{disallowed-references}, if true, must be a list of things the outputs +may @emph{not} refer to. + +When @var{leaked-env-vars} is true, it must be a list of strings denoting +environment variables that are allowed to ``leak'' from the daemon's +environment to the build environment. This is only applicable to +fixed-output derivations---i.e., when @var{hash} is true. The main use is +to allow variables such as @code{http_proxy} to be passed to derivations +that download files. + +When @var{local-build?} is true, declare that the derivation is not a good +candidate for offloading and should rather be built locally (@pxref{Daemon +Offload Setup}). This is the case for small derivations where the costs of +data transfers would outweigh the benefits. + +When @var{substitutable?} is false, declare that substitutes of the +derivation's output should not be used (@pxref{Substitutes}). This is +useful, for instance, when building packages that capture details of the +host CPU instruction set. + +@var{properties} must be an association list describing ``properties'' of +the derivation. It is kept as-is, uninterpreted, in the derivation. +@end deffn + +@noindent +Here's an example with a shell script as its builder, assuming @var{store} +is an open connection to the daemon, and @var{bash} points to a Bash +executable in the store: + +@lisp +(use-modules (guix utils) + (guix store) + (guix derivations)) + +(let ((builder ; add the Bash script to the store + (add-text-to-store store "my-builder.sh" + "echo hello world > $out\n" '()))) + (derivation store "foo" + bash `("-e" ,builder) + #:inputs `((,bash) (,builder)) + #:env-vars '(("HOME" . "/homeless")))) +@result{} #<derivation /gnu/store/@dots{}-foo.drv => /gnu/store/@dots{}-foo> +@end lisp + +As can be guessed, this primitive is cumbersome to use directly. A better +approach is to write build scripts in Scheme, of course! The best course of +action for that is to write the build code as a ``G-expression'', and to +pass it to @code{gexp->derivation}. For more information, +@pxref{G-Expressions}. + +Once upon a time, @code{gexp->derivation} did not exist and constructing +derivations with build code written in Scheme was achieved with +@code{build-expression->derivation}, documented below. This procedure is +now deprecated in favor of the much nicer @code{gexp->derivation}. + +@deffn {Scheme Procedure} build-expression->derivation @var{store} @ + @var{name} @var{exp} @ [#:system (%current-system)] [#:inputs '()] @ +[#:outputs '("out")] [#:hash #f] [#:hash-algo #f] @ [#:recursive? #f] +[#:env-vars '()] [#:modules '()] @ [#:references-graphs #f] +[#:allowed-references #f] @ [#:disallowed-references #f] @ [#:local-build? +#f] [#:substitutable? #t] [#:guile-for-build #f] Return a derivation that +executes Scheme expression @var{exp} as a builder for derivation +@var{name}. @var{inputs} must be a list of @code{(name drv-path sub-drv)} +tuples; when @var{sub-drv} is omitted, @code{"out"} is assumed. +@var{modules} is a list of names of Guile modules from the current search +path to be copied in the store, compiled, and made available in the load +path during the execution of @var{exp}---e.g., @code{((guix build utils) +(guix build gnu-build-system))}. + +@var{exp} is evaluated in an environment where @code{%outputs} is bound to a +list of output/path pairs, and where @code{%build-inputs} is bound to a list +of string/output-path pairs made from @var{inputs}. Optionally, +@var{env-vars} is a list of string pairs specifying the name and value of +environment variables visible to the builder. The builder terminates by +passing the result of @var{exp} to @code{exit}; thus, when @var{exp} returns +@code{#f}, the build is considered to have failed. + +@var{exp} is built using @var{guile-for-build} (a derivation). When +@var{guile-for-build} is omitted or is @code{#f}, the value of the +@code{%guile-for-build} fluid is used instead. + +See the @code{derivation} procedure for the meaning of +@var{references-graphs}, @var{allowed-references}, +@var{disallowed-references}, @var{local-build?}, and @var{substitutable?}. +@end deffn + +@noindent +Here's an example of a single-output derivation that creates a directory +containing one file: + +@lisp +(let ((builder '(let ((out (assoc-ref %outputs "out"))) + (mkdir out) ; create /gnu/store/@dots{}-goo + (call-with-output-file (string-append out "/test") + (lambda (p) + (display '(hello guix) p)))))) + (build-expression->derivation store "goo" builder)) + +@result{} #<derivation /gnu/store/@dots{}-goo.drv => @dots{}> +@end lisp + + +@node The Store Monad +@section The Store Monad + +@cindex monad + +The procedures that operate on the store described in the previous sections +all take an open connection to the build daemon as their first argument. +Although the underlying model is functional, they either have side effects +or depend on the current state of the store. + +The former is inconvenient: the connection to the build daemon has to be +carried around in all those functions, making it impossible to compose +functions that do not take that parameter with functions that do. The +latter can be problematic: since store operations have side effects and/or +depend on external state, they have to be properly sequenced. + +@cindex monadic values +@cindex monadic functions +This is where the @code{(guix monads)} module comes in. This module +provides a framework for working with @dfn{monads}, and a particularly +useful monad for our uses, the @dfn{store monad}. Monads are a construct +that allows two things: associating ``context'' with values (in our case, +the context is the store), and building sequences of computations (here +computations include accesses to the store). Values in a monad---values +that carry this additional context---are called @dfn{monadic values}; +procedures that return such values are called @dfn{monadic procedures}. + +Consider this ``normal'' procedure: + +@example +(define (sh-symlink store) + ;; Return a derivation that symlinks the 'bash' executable. + (let* ((drv (package-derivation store bash)) + (out (derivation->output-path drv)) + (sh (string-append out "/bin/bash"))) + (build-expression->derivation store "sh" + `(symlink ,sh %output)))) +@end example + +Using @code{(guix monads)} and @code{(guix gexp)}, it may be rewritten as a +monadic function: + +@example +(define (sh-symlink) + ;; Same, but return a monadic value. + (mlet %store-monad ((drv (package->derivation bash))) + (gexp->derivation "sh" + #~(symlink (string-append #$drv "/bin/bash") + #$output)))) +@end example + +There are several things to note in the second version: the @code{store} +parameter is now implicit and is ``threaded'' in the calls to the +@code{package->derivation} and @code{gexp->derivation} monadic procedures, +and the monadic value returned by @code{package->derivation} is @dfn{bound} +using @code{mlet} instead of plain @code{let}. + +As it turns out, the call to @code{package->derivation} can even be omitted +since it will take place implicitly, as we will see later +(@pxref{G-Expressions}): + +@example +(define (sh-symlink) + (gexp->derivation "sh" + #~(symlink (string-append #$bash "/bin/bash") + #$output))) +@end example + +@c See +@c <https://syntaxexclamation.wordpress.com/2014/06/26/escaping-continuations/> +@c for the funny quote. +Calling the monadic @code{sh-symlink} has no effect. As someone once said, +``you exit a monad like you exit a building on fire: by running''. So, to +exit the monad and get the desired effect, one must use +@code{run-with-store}: + +@example +(run-with-store (open-connection) (sh-symlink)) +@result{} /gnu/store/...-sh-symlink +@end example + +Note that the @code{(guix monad-repl)} module extends the Guile REPL with +new ``meta-commands'' to make it easier to deal with monadic procedures: +@code{run-in-store}, and @code{enter-store-monad}. The former is used to +``run'' a single monadic value through the store: + +@example +scheme@@(guile-user)> ,run-in-store (package->derivation hello) +$1 = #<derivation /gnu/store/@dots{}-hello-2.9.drv => @dots{}> +@end example + +The latter enters a recursive REPL, where all the return values are +automatically run through the store: + +@example +scheme@@(guile-user)> ,enter-store-monad +store-monad@@(guile-user) [1]> (package->derivation hello) +$2 = #<derivation /gnu/store/@dots{}-hello-2.9.drv => @dots{}> +store-monad@@(guile-user) [1]> (text-file "foo" "Hello!") +$3 = "/gnu/store/@dots{}-foo" +store-monad@@(guile-user) [1]> ,q +scheme@@(guile-user)> +@end example + +@noindent +Note that non-monadic values cannot be returned in the @code{store-monad} +REPL. + +The main syntactic forms to deal with monads in general are provided by the +@code{(guix monads)} module and are described below. + +@deffn {Scheme Syntax} with-monad @var{monad} @var{body} ... +Evaluate any @code{>>=} or @code{return} forms in @var{body} as being in +@var{monad}. +@end deffn + +@deffn {Scheme Syntax} return @var{val} +Return a monadic value that encapsulates @var{val}. +@end deffn + +@deffn {Scheme Syntax} >>= @var{mval} @var{mproc} ... +@dfn{Bind} monadic value @var{mval}, passing its ``contents'' to monadic +procedures @var{mproc}@dots{}@footnote{This operation is commonly referred +to as ``bind'', but that name denotes an unrelated procedure in Guile. Thus +we use this somewhat cryptic symbol inherited from the Haskell language.}. +There can be one @var{mproc} or several of them, as in this example: + +@example +(run-with-state + (with-monad %state-monad + (>>= (return 1) + (lambda (x) (return (+ 1 x))) + (lambda (x) (return (* 2 x))))) + 'some-state) + +@result{} 4 +@result{} some-state +@end example +@end deffn + +@deffn {Scheme Syntax} mlet @var{monad} ((@var{var} @var{mval}) ...) @ + @var{body} ... +@deffnx {Scheme Syntax} mlet* @var{monad} ((@var{var} @var{mval}) ...) @ + @var{body} ... Bind the variables @var{var} to the monadic values +@var{mval} in @var{body}, which is a sequence of expressions. As with the +bind operator, this can be thought of as ``unpacking'' the raw, non-monadic +value ``contained'' in @var{mval} and making @var{var} refer to that raw, +non-monadic value within the scope of the @var{body}. The form (@var{var} +-> @var{val}) binds @var{var} to the ``normal'' value @var{val}, as per +@code{let}. The binding operations occur in sequence from left to right. +The last expression of @var{body} must be a monadic expression, and its +result will become the result of the @code{mlet} or @code{mlet*} when run in +the @var{monad}. + +@code{mlet*} is to @code{mlet} what @code{let*} is to @code{let} +(@pxref{Local Bindings,,, guile, GNU Guile Reference Manual}). +@end deffn + +@deffn {Scheme System} mbegin @var{monad} @var{mexp} ... +Bind @var{mexp} and the following monadic expressions in sequence, returning +the result of the last expression. Every expression in the sequence must be +a monadic expression. + +This is akin to @code{mlet}, except that the return values of the monadic +expressions are ignored. In that sense, it is analogous to @code{begin}, +but applied to monadic expressions. +@end deffn + +@deffn {Scheme System} mwhen @var{condition} @var{mexp0} @var{mexp*} ... +When @var{condition} is true, evaluate the sequence of monadic expressions +@var{mexp0}..@var{mexp*} as in an @code{mbegin}. When @var{condition} is +false, return @code{*unspecified*} in the current monad. Every expression +in the sequence must be a monadic expression. +@end deffn + +@deffn {Scheme System} munless @var{condition} @var{mexp0} @var{mexp*} ... +When @var{condition} is false, evaluate the sequence of monadic expressions +@var{mexp0}..@var{mexp*} as in an @code{mbegin}. When @var{condition} is +true, return @code{*unspecified*} in the current monad. Every expression in +the sequence must be a monadic expression. +@end deffn + +@cindex state monad +The @code{(guix monads)} module provides the @dfn{state monad}, which allows +an additional value---the state---to be @emph{threaded} through monadic +procedure calls. + +@defvr {Scheme Variable} %state-monad +The state monad. Procedures in the state monad can access and change the +state that is threaded. + +Consider the example below. The @code{square} procedure returns a value in +the state monad. It returns the square of its argument, but also increments +the current state value: + +@example +(define (square x) + (mlet %state-monad ((count (current-state))) + (mbegin %state-monad + (set-current-state (+ 1 count)) + (return (* x x))))) + +(run-with-state (sequence %state-monad (map square (iota 3))) 0) +@result{} (0 1 4) +@result{} 3 +@end example + +When ``run'' through @var{%state-monad}, we obtain that additional state +value, which is the number of @code{square} calls. +@end defvr + +@deffn {Monadic Procedure} current-state +Return the current state as a monadic value. +@end deffn + +@deffn {Monadic Procedure} set-current-state @var{value} +Set the current state to @var{value} and return the previous state as a +monadic value. +@end deffn + +@deffn {Monadic Procedure} state-push @var{value} +Push @var{value} to the current state, which is assumed to be a list, and +return the previous state as a monadic value. +@end deffn + +@deffn {Monadic Procedure} state-pop +Pop a value from the current state and return it as a monadic value. The +state is assumed to be a list. +@end deffn + +@deffn {Scheme Procedure} run-with-state @var{mval} [@var{state}] +Run monadic value @var{mval} starting with @var{state} as the initial +state. Return two values: the resulting value, and the resulting state. +@end deffn + +The main interface to the store monad, provided by the @code{(guix store)} +module, is as follows. + +@defvr {Scheme Variable} %store-monad +The store monad---an alias for @var{%state-monad}. + +Values in the store monad encapsulate accesses to the store. When its +effect is needed, a value of the store monad must be ``evaluated'' by +passing it to the @code{run-with-store} procedure (see below.) +@end defvr + +@deffn {Scheme Procedure} run-with-store @var{store} @var{mval} [#:guile-for-build] [#:system (%current-system)] +Run @var{mval}, a monadic value in the store monad, in @var{store}, an open +store connection. +@end deffn + +@deffn {Monadic Procedure} text-file @var{name} @var{text} [@var{references}] +Return as a monadic value the absolute file name in the store of the file +containing @var{text}, a string. @var{references} is a list of store items +that the resulting text file refers to; it defaults to the empty list. +@end deffn + +@deffn {Monadic Procedure} binary-file @var{name} @var{data} [@var{references}] +Return as a monadic value the absolute file name in the store of the file +containing @var{data}, a bytevector. @var{references} is a list of store +items that the resulting binary file refers to; it defaults to the empty +list. +@end deffn + +@deffn {Monadic Procedure} interned-file @var{file} [@var{name}] @ + [#:recursive? #t] [#:select? (const #t)] Return the name of @var{file} once +interned in the store. Use @var{name} as its store name, or the basename of +@var{file} if @var{name} is omitted. + +When @var{recursive?} is true, the contents of @var{file} are added +recursively; if @var{file} designates a flat file and @var{recursive?} is +true, its contents are added, and its permission bits are kept. + +When @var{recursive?} is true, call @code{(@var{select?} @var{file} +@var{stat})} for each directory entry, where @var{file} is the entry's +absolute file name and @var{stat} is the result of @code{lstat}; exclude +entries for which @var{select?} does not return true. + +The example below adds a file to the store, under two different names: + +@example +(run-with-store (open-connection) + (mlet %store-monad ((a (interned-file "README")) + (b (interned-file "README" "LEGU-MIN"))) + (return (list a b)))) + +@result{} ("/gnu/store/rwm@dots{}-README" "/gnu/store/44i@dots{}-LEGU-MIN") +@end example + +@end deffn + +The @code{(guix packages)} module exports the following package-related +monadic procedures: + +@deffn {Monadic Procedure} package-file @var{package} [@var{file}] @ + [#:system (%current-system)] [#:target #f] @ [#:output "out"] Return as a +monadic value in the absolute file name of @var{file} within the +@var{output} directory of @var{package}. When @var{file} is omitted, return +the name of the @var{output} directory of @var{package}. When @var{target} +is true, use it as a cross-compilation target triplet. +@end deffn + +@deffn {Monadic Procedure} package->derivation @var{package} [@var{system}] +@deffnx {Monadic Procedure} package->cross-derivation @var{package} @ + @var{target} [@var{system}] Monadic version of @code{package-derivation} and +@code{package-cross-derivation} (@pxref{Defining Packages}). +@end deffn + + +@node G-Expressions +@section G-Expressions + +@cindex G-expression +@cindex build code quoting +So we have ``derivations'', which represent a sequence of build actions to +be performed to produce an item in the store (@pxref{Derivations}). These +build actions are performed when asking the daemon to actually build the +derivations; they are run by the daemon in a container (@pxref{Invoking +guix-daemon}). + +@cindex strata of code +It should come as no surprise that we like to write these build actions in +Scheme. When we do that, we end up with two @dfn{strata} of Scheme +code@footnote{The term @dfn{stratum} in this context was coined by Manuel +Serrano et al.@: in the context of their work on Hop. Oleg Kiselyov, who +has written insightful +@url{http://okmij.org/ftp/meta-programming/#meta-scheme, essays and code on +this topic}, refers to this kind of code generation as @dfn{staging}.}: the +``host code''---code that defines packages, talks to the daemon, etc.---and +the ``build code''---code that actually performs build actions, such as +making directories, invoking @command{make}, etc. + +To describe a derivation and its build actions, one typically needs to embed +build code inside host code. It boils down to manipulating build code as +data, and the homoiconicity of Scheme---code has a direct representation as +data---comes in handy for that. But we need more than the normal +@code{quasiquote} mechanism in Scheme to construct build expressions. + +The @code{(guix gexp)} module implements @dfn{G-expressions}, a form of +S-expressions adapted to build expressions. G-expressions, or @dfn{gexps}, +consist essentially of three syntactic forms: @code{gexp}, @code{ungexp}, +and @code{ungexp-splicing} (or simply: @code{#~}, @code{#$}, and +@code{#$@@}), which are comparable to @code{quasiquote}, @code{unquote}, and +@code{unquote-splicing}, respectively (@pxref{Expression Syntax, +@code{quasiquote},, guile, GNU Guile Reference Manual}). However, there are +major differences: + +@itemize +@item +Gexps are meant to be written to a file and run or manipulated by other +processes. + +@item +When a high-level object such as a package or derivation is unquoted inside +a gexp, the result is as if its output file name had been introduced. + +@item +Gexps carry information about the packages or derivations they refer to, and +these dependencies are automatically added as inputs to the build processes +that use them. +@end itemize + +@cindex lowering, of high-level objects in gexps +This mechanism is not limited to package and derivation objects: +@dfn{compilers} able to ``lower'' other high-level objects to derivations or +files in the store can be defined, such that these objects can also be +inserted into gexps. For example, a useful type of high-level objects that +can be inserted in a gexp is ``file-like objects'', which make it easy to +add files to the store and to refer to them in derivations and such (see +@code{local-file} and @code{plain-file} below.) + +To illustrate the idea, here is an example of a gexp: + +@example +(define build-exp + #~(begin + (mkdir #$output) + (chdir #$output) + (symlink (string-append #$coreutils "/bin/ls") + "list-files"))) +@end example + +This gexp can be passed to @code{gexp->derivation}; we obtain a derivation +that builds a directory containing exactly one symlink to +@file{/gnu/store/@dots{}-coreutils-8.22/bin/ls}: + +@example +(gexp->derivation "the-thing" build-exp) +@end example + +As one would expect, the @code{"/gnu/store/@dots{}-coreutils-8.22"} string +is substituted to the reference to the @var{coreutils} package in the actual +build code, and @var{coreutils} is automatically made an input to the +derivation. Likewise, @code{#$output} (equivalent to @code{(ungexp +output)}) is replaced by a string containing the directory name of the +output of the derivation. + +@cindex cross compilation +In a cross-compilation context, it is useful to distinguish between +references to the @emph{native} build of a package---that can run on the +host---versus references to cross builds of a package. To that end, the +@code{#+} plays the same role as @code{#$}, but is a reference to a native +package build: + +@example +(gexp->derivation "vi" + #~(begin + (mkdir #$output) + (system* (string-append #+coreutils "/bin/ln") + "-s" + (string-append #$emacs "/bin/emacs") + (string-append #$output "/bin/vi"))) + #:target "mips64el-linux-gnu") +@end example + +@noindent +In the example above, the native build of @var{coreutils} is used, so that +@command{ln} can actually run on the host; but then the cross-compiled build +of @var{emacs} is referenced. + +@cindex imported modules, for gexps +@findex with-imported-modules +Another gexp feature is @dfn{imported modules}: sometimes you want to be +able to use certain Guile modules from the ``host environment'' in the gexp, +so those modules should be imported in the ``build environment''. The +@code{with-imported-modules} form allows you to express that: + +@example +(let ((build (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + (mkdir-p (string-append #$output "/bin")))))) + (gexp->derivation "empty-dir" + #~(begin + #$build + (display "success!\n") + #t))) +@end example + +@noindent +In this example, the @code{(guix build utils)} module is automatically +pulled into the isolated build environment of our gexp, such that +@code{(use-modules (guix build utils))} works as expected. + +@cindex module closure +@findex source-module-closure +Usually you want the @emph{closure} of the module to be imported---i.e., the +module itself and all the modules it depends on---rather than just the +module; failing to do that, attempts to use the module will fail because of +missing dependent modules. The @code{source-module-closure} procedure +computes the closure of a module by looking at its source file headers, +which comes in handy in this case: + +@example +(use-modules (guix modules)) ;for 'source-module-closure' + +(with-imported-modules (source-module-closure + '((guix build utils) + (gnu build vm))) + (gexp->derivation "something-with-vms" + #~(begin + (use-modules (guix build utils) + (gnu build vm)) + @dots{}))) +@end example + +@cindex extensions, for gexps +@findex with-extensions +In the same vein, sometimes you want to import not just pure-Scheme modules, +but also ``extensions'' such as Guile bindings to C libraries or other +``full-blown'' packages. Say you need the @code{guile-json} package +available on the build side, here's how you would do it: + +@example +(use-modules (gnu packages guile)) ;for 'guile-json' + +(with-extensions (list guile-json) + (gexp->derivation "something-with-json" + #~(begin + (use-modules (json)) + @dots{}))) +@end example + +The syntactic form to construct gexps is summarized below. + +@deffn {Scheme Syntax} #~@var{exp} +@deffnx {Scheme Syntax} (gexp @var{exp}) +Return a G-expression containing @var{exp}. @var{exp} may contain one or +more of the following forms: + +@table @code +@item #$@var{obj} +@itemx (ungexp @var{obj}) +Introduce a reference to @var{obj}. @var{obj} may have one of the supported +types, for example a package or a derivation, in which case the +@code{ungexp} form is replaced by its output file name---e.g., +@code{"/gnu/store/@dots{}-coreutils-8.22}. + +If @var{obj} is a list, it is traversed and references to supported objects +are substituted similarly. + +If @var{obj} is another gexp, its contents are inserted and its dependencies +are added to those of the containing gexp. + +If @var{obj} is another kind of object, it is inserted as is. + +@item #$@var{obj}:@var{output} +@itemx (ungexp @var{obj} @var{output}) +This is like the form above, but referring explicitly to the @var{output} of +@var{obj}---this is useful when @var{obj} produces multiple outputs +(@pxref{Packages with Multiple Outputs}). + +@item #+@var{obj} +@itemx #+@var{obj}:output +@itemx (ungexp-native @var{obj}) +@itemx (ungexp-native @var{obj} @var{output}) +Same as @code{ungexp}, but produces a reference to the @emph{native} build +of @var{obj} when used in a cross compilation context. + +@item #$output[:@var{output}] +@itemx (ungexp output [@var{output}]) +Insert a reference to derivation output @var{output}, or to the main output +when @var{output} is omitted. + +This only makes sense for gexps passed to @code{gexp->derivation}. + +@item #$@@@var{lst} +@itemx (ungexp-splicing @var{lst}) +Like the above, but splices the contents of @var{lst} inside the containing +list. + +@item #+@@@var{lst} +@itemx (ungexp-native-splicing @var{lst}) +Like the above, but refers to native builds of the objects listed in +@var{lst}. + +@end table + +G-expressions created by @code{gexp} or @code{#~} are run-time objects of +the @code{gexp?} type (see below.) +@end deffn + +@deffn {Scheme Syntax} with-imported-modules @var{modules} @var{body}@dots{} +Mark the gexps defined in @var{body}@dots{} as requiring @var{modules} in +their execution environment. + +Each item in @var{modules} can be the name of a module, such as @code{(guix +build utils)}, or it can be a module name, followed by an arrow, followed by +a file-like object: + +@example +`((guix build utils) + (guix gcrypt) + ((guix config) => ,(scheme-file "config.scm" + #~(define-module @dots{})))) +@end example + +@noindent +In the example above, the first two modules are taken from the search path, +and the last one is created from the given file-like object. + +This form has @emph{lexical} scope: it has an effect on the gexps directly +defined in @var{body}@dots{}, but not on those defined, say, in procedures +called from @var{body}@dots{}. +@end deffn + +@deffn {Scheme Syntax} with-extensions @var{extensions} @var{body}@dots{} +Mark the gexps defined in @var{body}@dots{} as requiring @var{extensions} in +their build and execution environment. @var{extensions} is typically a list +of package objects such as those defined in the @code{(gnu packages guile)} +module. + +Concretely, the packages listed in @var{extensions} are added to the load +path while compiling imported modules in @var{body}@dots{}; they are also +added to the load path of the gexp returned by @var{body}@dots{}. +@end deffn + +@deffn {Scheme Procedure} gexp? @var{obj} +Return @code{#t} if @var{obj} is a G-expression. +@end deffn + +G-expressions are meant to be written to disk, either as code building some +derivation, or as plain files in the store. The monadic procedures below +allow you to do that (@pxref{The Store Monad}, for more information about +monads.) + +@deffn {Monadic Procedure} gexp->derivation @var{name} @var{exp} @ + [#:system (%current-system)] [#:target #f] [#:graft? #t] @ [#:hash #f] +[#:hash-algo #f] @ [#:recursive? #f] [#:env-vars '()] [#:modules '()] @ +[#:module-path @var{%load-path}] @ [#:effective-version "2.2"] @ +[#:references-graphs #f] [#:allowed-references #f] @ +[#:disallowed-references #f] @ [#:leaked-env-vars #f] @ [#:script-name +(string-append @var{name} "-builder")] @ [#:deprecation-warnings #f] @ +[#:local-build? #f] [#:substitutable? #t] @ [#:properties '()] +[#:guile-for-build #f] Return a derivation @var{name} that runs @var{exp} (a +gexp) with @var{guile-for-build} (a derivation) on @var{system}; @var{exp} +is stored in a file called @var{script-name}. When @var{target} is true, it +is used as the cross-compilation target triplet for packages referred to by +@var{exp}. + +@var{modules} is deprecated in favor of @code{with-imported-modules}. Its +meaning is to make @var{modules} available in the evaluation context of +@var{exp}; @var{modules} is a list of names of Guile modules searched in +@var{module-path} to be copied in the store, compiled, and made available in +the load path during the execution of @var{exp}---e.g., @code{((guix build +utils) (guix build gnu-build-system))}. + +@var{effective-version} determines the string to use when adding extensions +of @var{exp} (see @code{with-extensions}) to the search path---e.g., +@code{"2.2"}. + +@var{graft?} determines whether packages referred to by @var{exp} should be +grafted when applicable. + +When @var{references-graphs} is true, it must be a list of tuples of one of +the following forms: + +@example +(@var{file-name} @var{package}) +(@var{file-name} @var{package} @var{output}) +(@var{file-name} @var{derivation}) +(@var{file-name} @var{derivation} @var{output}) +(@var{file-name} @var{store-item}) +@end example + +The right-hand-side of each element of @var{references-graphs} is +automatically made an input of the build process of @var{exp}. In the build +environment, each @var{file-name} contains the reference graph of the +corresponding item, in a simple text format. + +@var{allowed-references} must be either @code{#f} or a list of output names +and packages. In the latter case, the list denotes store items that the +result is allowed to refer to. Any reference to another store item will +lead to a build error. Similarly for @var{disallowed-references}, which can +list items that must not be referenced by the outputs. + +@var{deprecation-warnings} determines whether to show deprecation warnings +while compiling modules. It can be @code{#f}, @code{#t}, or +@code{'detailed}. + +The other arguments are as for @code{derivation} (@pxref{Derivations}). +@end deffn + +@cindex file-like objects +The @code{local-file}, @code{plain-file}, @code{computed-file}, +@code{program-file}, and @code{scheme-file} procedures below return +@dfn{file-like objects}. That is, when unquoted in a G-expression, these +objects lead to a file in the store. Consider this G-expression: + +@example +#~(system* #$(file-append glibc "/sbin/nscd") "-f" + #$(local-file "/tmp/my-nscd.conf")) +@end example + +The effect here is to ``intern'' @file{/tmp/my-nscd.conf} by copying it to +the store. Once expanded, for instance @i{via} @code{gexp->derivation}, the +G-expression refers to that copy under @file{/gnu/store}; thus, modifying or +removing the file in @file{/tmp} does not have any effect on what the +G-expression does. @code{plain-file} can be used similarly; it differs in +that the file content is directly passed as a string. + +@deffn {Scheme Procedure} local-file @var{file} [@var{name}] @ + [#:recursive? #f] [#:select? (const #t)] Return an object representing local +file @var{file} to add to the store; this object can be used in a gexp. If +@var{file} is a relative file name, it is looked up relative to the source +file where this form appears. @var{file} will be added to the store under +@var{name}--by default the base name of @var{file}. + +When @var{recursive?} is true, the contents of @var{file} are added +recursively; if @var{file} designates a flat file and @var{recursive?} is +true, its contents are added, and its permission bits are kept. + +When @var{recursive?} is true, call @code{(@var{select?} @var{file} +@var{stat})} for each directory entry, where @var{file} is the entry's +absolute file name and @var{stat} is the result of @code{lstat}; exclude +entries for which @var{select?} does not return true. + +This is the declarative counterpart of the @code{interned-file} monadic +procedure (@pxref{The Store Monad, @code{interned-file}}). +@end deffn + +@deffn {Scheme Procedure} plain-file @var{name} @var{content} +Return an object representing a text file called @var{name} with the given +@var{content} (a string or a bytevector) to be added to the store. + +This is the declarative counterpart of @code{text-file}. +@end deffn + +@deffn {Scheme Procedure} computed-file @var{name} @var{gexp} @ + [#:options '(#:local-build? #t)] Return an object representing the store +item @var{name}, a file or directory computed by @var{gexp}. @var{options} +is a list of additional arguments to pass to @code{gexp->derivation}. + +This is the declarative counterpart of @code{gexp->derivation}. +@end deffn + +@deffn {Monadic Procedure} gexp->script @var{name} @var{exp} @ + [#:guile (default-guile)] [#:module-path %load-path] Return an executable +script @var{name} that runs @var{exp} using @var{guile}, with @var{exp}'s +imported modules in its search path. Look up @var{exp}'s modules in +@var{module-path}. + +The example below builds a script that simply invokes the @command{ls} +command: + +@example +(use-modules (guix gexp) (gnu packages base)) + +(gexp->script "list-files" + #~(execl #$(file-append coreutils "/bin/ls") + "ls")) +@end example + +When ``running'' it through the store (@pxref{The Store Monad, +@code{run-with-store}}), we obtain a derivation that produces an executable +file @file{/gnu/store/@dots{}-list-files} along these lines: + +@example +#!/gnu/store/@dots{}-guile-2.0.11/bin/guile -ds +!# +(execl "/gnu/store/@dots{}-coreutils-8.22"/bin/ls" "ls") +@end example +@end deffn + +@deffn {Scheme Procedure} program-file @var{name} @var{exp} @ + [#:guile #f] [#:module-path %load-path] Return an object representing the +executable store item @var{name} that runs @var{gexp}. @var{guile} is the +Guile package used to execute that script. Imported modules of @var{gexp} +are looked up in @var{module-path}. + +This is the declarative counterpart of @code{gexp->script}. +@end deffn + +@deffn {Monadic Procedure} gexp->file @var{name} @var{exp} @ + [#:set-load-path? #t] [#:module-path %load-path] @ [#:splice? #f] @ [#:guile +(default-guile)] Return a derivation that builds a file @var{name} +containing @var{exp}. When @var{splice?} is true, @var{exp} is considered +to be a list of expressions that will be spliced in the resulting file. + +When @var{set-load-path?} is true, emit code in the resulting file to set +@code{%load-path} and @code{%load-compiled-path} to honor @var{exp}'s +imported modules. Look up @var{exp}'s modules in @var{module-path}. + +The resulting file holds references to all the dependencies of @var{exp} or +a subset thereof. +@end deffn + +@deffn {Scheme Procedure} scheme-file @var{name} @var{exp} [#:splice? #f] +Return an object representing the Scheme file @var{name} that contains +@var{exp}. + +This is the declarative counterpart of @code{gexp->file}. +@end deffn + +@deffn {Monadic Procedure} text-file* @var{name} @var{text} @dots{} +Return as a monadic value a derivation that builds a text file containing +all of @var{text}. @var{text} may list, in addition to strings, objects of +any type that can be used in a gexp: packages, derivations, local file +objects, etc. The resulting store file holds references to all these. + +This variant should be preferred over @code{text-file} anytime the file to +create will reference items from the store. This is typically the case when +building a configuration file that embeds store file names, like this: + +@example +(define (profile.sh) + ;; Return the name of a shell script in the store that + ;; initializes the 'PATH' environment variable. + (text-file* "profile.sh" + "export PATH=" coreutils "/bin:" + grep "/bin:" sed "/bin\n")) +@end example + +In this example, the resulting @file{/gnu/store/@dots{}-profile.sh} file +will reference @var{coreutils}, @var{grep}, and @var{sed}, thereby +preventing them from being garbage-collected during its lifetime. +@end deffn + +@deffn {Scheme Procedure} mixed-text-file @var{name} @var{text} @dots{} +Return an object representing store file @var{name} containing @var{text}. +@var{text} is a sequence of strings and file-like objects, as in: + +@example +(mixed-text-file "profile" + "export PATH=" coreutils "/bin:" grep "/bin") +@end example + +This is the declarative counterpart of @code{text-file*}. +@end deffn + +@deffn {Scheme Procedure} file-union @var{name} @var{files} +Return a @code{<computed-file>} that builds a directory containing all of +@var{files}. Each item in @var{files} must be a two-element list where the +first element is the file name to use in the new directory, and the second +element is a gexp denoting the target file. Here's an example: + +@example +(file-union "etc" + `(("hosts" ,(plain-file "hosts" + "127.0.0.1 localhost")) + ("bashrc" ,(plain-file "bashrc" + "alias ls='ls --color=auto'")))) +@end example + +This yields an @code{etc} directory containing these two files. +@end deffn + +@deffn {Scheme Procedure} directory-union @var{name} @var{things} +Return a directory that is the union of @var{things}, where @var{things} is +a list of file-like objects denoting directories. For example: + +@example +(directory-union "guile+emacs" (list guile emacs)) +@end example + +yields a directory that is the union of the @code{guile} and @code{emacs} +packages. +@end deffn + +@deffn {Scheme Procedure} file-append @var{obj} @var{suffix} @dots{} +Return a file-like object that expands to the concatenation of @var{obj} and +@var{suffix}, where @var{obj} is a lowerable object and each @var{suffix} is +a string. + +As an example, consider this gexp: + +@example +(gexp->script "run-uname" + #~(system* #$(file-append coreutils + "/bin/uname"))) +@end example + +The same effect could be achieved with: + +@example +(gexp->script "run-uname" + #~(system* (string-append #$coreutils + "/bin/uname"))) +@end example + +There is one difference though: in the @code{file-append} case, the +resulting script contains the absolute file name as a string, whereas in the +second case, the resulting script contains a @code{(string-append @dots{})} +expression to construct the file name @emph{at run time}. +@end deffn + + +Of course, in addition to gexps embedded in ``host'' code, there are also +modules containing build tools. To make it clear that they are meant to be +used in the build stratum, these modules are kept in the @code{(guix build +@dots{})} name space. + +@cindex lowering, of high-level objects in gexps +Internally, high-level objects are @dfn{lowered}, using their compiler, to +either derivations or store items. For instance, lowering a package yields +a derivation, and lowering a @code{plain-file} yields a store item. This is +achieved using the @code{lower-object} monadic procedure. + +@deffn {Monadic Procedure} lower-object @var{obj} [@var{system}] @ + [#:target #f] Return as a value in @var{%store-monad} the derivation or +store item corresponding to @var{obj} for @var{system}, cross-compiling for +@var{target} if @var{target} is true. @var{obj} must be an object that has +an associated gexp compiler, such as a @code{<package>}. +@end deffn + +@node Invoking guix repl +@section Invoking @command{guix repl} + +@cindex REPL, read-eval-print loop +The @command{guix repl} command spawns a Guile @dfn{read-eval-print loop} +(REPL) for interactive programming (@pxref{Using Guile Interactively,,, +guile, GNU Guile Reference Manual}). Compared to just launching the +@command{guile} command, @command{guix repl} guarantees that all the Guix +modules and all its dependencies are available in the search path. You can +use it this way: + +@example +$ guix repl +scheme@@(guile-user)> ,use (gnu packages base) +scheme@@(guile-user)> coreutils +$1 = #<package coreutils@@8.29 gnu/packages/base.scm:327 3e28300> +@end example + +@cindex inferiors +In addition, @command{guix repl} implements a simple machine-readable REPL +protocol for use by @code{(guix inferior)}, a facility to interact with +@dfn{inferiors}, separate processes running a potentially different revision +of Guix. + +The available options are as follows: + +@table @code +@item --type=@var{type} +@itemx -t @var{type} +Start a REPL of the given @var{TYPE}, which can be one of the following: + +@table @code +@item guile +This is default, and it spawns a standard full-featured Guile REPL. +@item machine +Spawn a REPL that uses the machine-readable protocol. This is the protocol +that the @code{(guix inferior)} module speaks. +@end table + +@item --listen=@var{endpoint} +By default, @command{guix repl} reads from standard input and writes to +standard output. When this option is passed, it will instead listen for +connections on @var{endpoint}. Here are examples of valid options: + +@table @code +@item --listen=tcp:37146 +Accept connections on localhost on port 37146. + +@item --listen=unix:/tmp/socket +Accept connections on the Unix-domain socket @file{/tmp/socket}. +@end table +@end table + +@c ********************************************************************* +@node Utilities +@chapter Utilities + +This section describes Guix command-line utilities. Some of them are +primarily targeted at developers and users who write new package +definitions, while others are more generally useful. They complement the +Scheme programming interface of Guix in a convenient way. + +@menu +* Invoking guix build:: Building packages from the command line. +* Invoking guix edit:: Editing package definitions. +* Invoking guix download:: Downloading a file and printing its hash. +* Invoking guix hash:: Computing the cryptographic hash of a file. +* Invoking guix import:: Importing package definitions. +* Invoking guix refresh:: Updating package definitions. +* Invoking guix lint:: Finding errors in package definitions. +* Invoking guix size:: Profiling disk usage. +* Invoking guix graph:: Visualizing the graph of packages. +* Invoking guix publish:: Sharing substitutes. +* Invoking guix challenge:: Challenging substitute servers. +* Invoking guix copy:: Copying to and from a remote store. +* Invoking guix container:: Process isolation. +* Invoking guix weather:: Assessing substitute availability. +* Invoking guix processes:: Listing client processes. +@end menu + +@node Invoking guix build +@section Invoking @command{guix build} + +@cindex package building +@cindex @command{guix build} +The @command{guix build} command builds packages or derivations and their +dependencies, and prints the resulting store paths. Note that it does not +modify the user's profile---this is the job of the @command{guix package} +command (@pxref{Invoking guix package}). Thus, it is mainly useful for +distribution developers. + +The general syntax is: + +@example +guix build @var{options} @var{package-or-derivation}@dots{} +@end example + +As an example, the following command builds the latest versions of Emacs and +of Guile, displays their build logs, and finally displays the resulting +directories: + +@example +guix build emacs guile +@end example + +Similarly, the following command builds all the available packages: + +@example +guix build --quiet --keep-going \ + `guix package -A | cut -f1,2 --output-delimiter=@@` +@end example + +@var{package-or-derivation} may be either the name of a package found in the +software distribution such as @code{coreutils} or @code{coreutils@@8.20}, or +a derivation such as @file{/gnu/store/@dots{}-coreutils-8.19.drv}. In the +former case, a package with the corresponding name (and optionally version) +is searched for among the GNU distribution modules (@pxref{Package +Modules}). + +Alternatively, the @code{--expression} option may be used to specify a +Scheme expression that evaluates to a package; this is useful when +disambiguating among several same-named packages or package variants is +needed. + +There may be zero or more @var{options}. The available options are +described in the subsections below. + +@menu +* Common Build Options:: Build options for most commands. +* Package Transformation Options:: Creating variants of packages. +* Additional Build Options:: Options specific to 'guix build'. +* Debugging Build Failures:: Real life packaging experience. +@end menu + +@node Common Build Options +@subsection Common Build Options + +A number of options that control the build process are common to +@command{guix build} and other commands that can spawn builds, such as +@command{guix package} or @command{guix archive}. These are the following: + +@table @code + +@item --load-path=@var{directory} +@itemx -L @var{directory} +Add @var{directory} to the front of the package module search path +(@pxref{Package Modules}). + +This allows users to define their own packages and make them visible to the +command-line tools. + +@item --keep-failed +@itemx -K +Keep the build tree of failed builds. Thus, if a build fails, its build +tree is kept under @file{/tmp}, in a directory whose name is shown at the +end of the build log. This is useful when debugging build issues. +@xref{Debugging Build Failures}, for tips and tricks on how to debug build +issues. + +This option has no effect when connecting to a remote daemon with a +@code{guix://} URI (@pxref{The Store, the @code{GUIX_DAEMON_SOCKET} +variable}). + +@item --keep-going +@itemx -k +Keep going when some of the derivations fail to build; return only once all +the builds have either completed or failed. + +The default behavior is to stop as soon as one of the specified derivations +has failed. + +@item --dry-run +@itemx -n +Do not build the derivations. + +@anchor{fallback-option} +@item --fallback +When substituting a pre-built binary fails, fall back to building packages +locally (@pxref{Substitution Failure}). + +@item --substitute-urls=@var{urls} +@anchor{client-substitute-urls} +Consider @var{urls} the whitespace-separated list of substitute source URLs, +overriding the default list of URLs of @command{guix-daemon} +(@pxref{daemon-substitute-urls,, @command{guix-daemon} URLs}). + +This means that substitutes may be downloaded from @var{urls}, provided they +are signed by a key authorized by the system administrator +(@pxref{Substitutes}). + +When @var{urls} is the empty string, substitutes are effectively disabled. + +@item --no-substitutes +Do not use substitutes for build products. That is, always build things +locally instead of allowing downloads of pre-built binaries +(@pxref{Substitutes}). + +@item --no-grafts +Do not ``graft'' packages. In practice, this means that package updates +available as grafts are not applied. @xref{Security Updates}, for more +information on grafts. + +@item --rounds=@var{n} +Build each derivation @var{n} times in a row, and raise an error if +consecutive build results are not bit-for-bit identical. + +This is a useful way to detect non-deterministic builds processes. +Non-deterministic build processes are a problem because they make it +practically impossible for users to @emph{verify} whether third-party +binaries are genuine. @xref{Invoking guix challenge}, for more. + +Note that, currently, the differing build results are not kept around, so +you will have to manually investigate in case of an error---e.g., by +stashing one of the build results with @code{guix archive --export} +(@pxref{Invoking guix archive}), then rebuilding, and finally comparing the +two results. + +@item --no-build-hook +Do not attempt to offload builds @i{via} the ``build hook'' of the daemon +(@pxref{Daemon Offload Setup}). That is, always build things locally +instead of offloading builds to remote machines. + +@item --max-silent-time=@var{seconds} +When the build or substitution process remains silent for more than +@var{seconds}, terminate it and report a build failure. + +By default, the daemon's setting is honored (@pxref{Invoking guix-daemon, +@code{--max-silent-time}}). + +@item --timeout=@var{seconds} +Likewise, when the build or substitution process lasts for more than +@var{seconds}, terminate it and report a build failure. + +By default, the daemon's setting is honored (@pxref{Invoking guix-daemon, +@code{--timeout}}). + +@c Note: This option is actually not part of %standard-build-options but +@c most programs honor it. +@cindex verbosity, of the command-line tools +@cindex build logs, verbosity +@item -v @var{level} +@itemx --verbosity=@var{level} +Use the given verbosity @var{level}, an integer. Choosing 0 means that no +output is produced, 1 is for quiet output, and 2 shows all the build log +output on standard error. + +@item --cores=@var{n} +@itemx -c @var{n} +Allow the use of up to @var{n} CPU cores for the build. The special value +@code{0} means to use as many CPU cores as available. + +@item --max-jobs=@var{n} +@itemx -M @var{n} +Allow at most @var{n} build jobs in parallel. @xref{Invoking guix-daemon, +@code{--max-jobs}}, for details about this option and the equivalent +@command{guix-daemon} option. + +@item --debug=@var{level} +Produce debugging output coming from the build daemon. @var{level} must be +an integer between 0 and 5; higher means more verbose output. Setting a +level of 4 or more may be helpful when debugging setup issues with the build +daemon. + +@end table + +Behind the scenes, @command{guix build} is essentially an interface to the +@code{package-derivation} procedure of the @code{(guix packages)} module, +and to the @code{build-derivations} procedure of the @code{(guix +derivations)} module. + +In addition to options explicitly passed on the command line, @command{guix +build} and other @command{guix} commands that support building honor the +@code{GUIX_BUILD_OPTIONS} environment variable. + +@defvr {Environment Variable} GUIX_BUILD_OPTIONS +Users can define this variable to a list of command line options that will +automatically be used by @command{guix build} and other @command{guix} +commands that can perform builds, as in the example below: + +@example +$ export GUIX_BUILD_OPTIONS="--no-substitutes -c 2 -L /foo/bar" +@end example + +These options are parsed independently, and the result is appended to the +parsed command-line options. +@end defvr + + +@node Package Transformation Options +@subsection Package Transformation Options + +@cindex package variants +Another set of command-line options supported by @command{guix build} and +also @command{guix package} are @dfn{package transformation options}. These +are options that make it possible to define @dfn{package variants}---for +instance, packages built from different source code. This is a convenient +way to create customized packages on the fly without having to type in the +definitions of package variants (@pxref{Defining Packages}). + +@table @code + +@item --with-source=@var{source} +@itemx --with-source=@var{package}=@var{source} +@itemx --with-source=@var{package}@@@var{version}=@var{source} +Use @var{source} as the source of @var{package}, and @var{version} as its +version number. @var{source} must be a file name or a URL, as for +@command{guix download} (@pxref{Invoking guix download}). + +When @var{package} is omitted, it is taken to be the package name specified +on the command line that matches the base of @var{source}---e.g., if +@var{source} is @code{/src/guile-2.0.10.tar.gz}, the corresponding package +is @code{guile}. + +Likewise, when @var{version} is omitted, the version string is inferred from +@var{source}; in the previous example, it is @code{2.0.10}. + +This option allows users to try out versions of packages other than the one +provided by the distribution. The example below downloads +@file{ed-1.7.tar.gz} from a GNU mirror and uses that as the source for the +@code{ed} package: + +@example +guix build ed --with-source=mirror://gnu/ed/ed-1.7.tar.gz +@end example + +As a developer, @code{--with-source} makes it easy to test release +candidates: + +@example +guix build guile --with-source=../guile-2.0.9.219-e1bb7.tar.xz +@end example + +@dots{} or to build from a checkout in a pristine environment: + +@example +$ git clone git://git.sv.gnu.org/guix.git +$ guix build guix --with-source=guix@@1.0=./guix +@end example + +@item --with-input=@var{package}=@var{replacement} +Replace dependency on @var{package} by a dependency on @var{replacement}. +@var{package} must be a package name, and @var{replacement} must be a +package specification such as @code{guile} or @code{guile@@1.8}. + +For instance, the following command builds Guix, but replaces its dependency +on the current stable version of Guile with a dependency on the legacy +version of Guile, @code{guile@@2.0}: + +@example +guix build --with-input=guile=guile@@2.0 guix +@end example + +This is a recursive, deep replacement. So in this example, both @code{guix} +and its dependency @code{guile-json} (which also depends on @code{guile}) +get rebuilt against @code{guile@@2.0}. + +This is implemented using the @code{package-input-rewriting} Scheme +procedure (@pxref{Defining Packages, @code{package-input-rewriting}}). + +@item --with-graft=@var{package}=@var{replacement} +This is similar to @code{--with-input} but with an important difference: +instead of rebuilding the whole dependency chain, @var{replacement} is built +and then @dfn{grafted} onto the binaries that were initially referring to +@var{package}. @xref{Security Updates}, for more information on grafts. + +For example, the command below grafts version 3.5.4 of GnuTLS onto Wget and +all its dependencies, replacing references to the version of GnuTLS they +currently refer to: + +@example +guix build --with-graft=gnutls=gnutls@@3.5.4 wget +@end example + +This has the advantage of being much faster than rebuilding everything. But +there is a caveat: it works if and only if @var{package} and +@var{replacement} are strictly compatible---for example, if they provide a +library, the application binary interface (ABI) of those libraries must be +compatible. If @var{replacement} is somehow incompatible with +@var{package}, then the resulting package may be unusable. Use with care! + +@item --with-git-url=@var{package}=@var{url} +@cindex Git, using the latest commit +@cindex latest commit, building +Build @var{package} from the latest commit of the @code{master} branch of +the Git repository at @var{url}. Git sub-modules of the repository are +fetched, recursively. + +For example, the following command builds the NumPy Python library against +the latest commit of the master branch of Python itself: + +@example +guix build python-numpy \ + --with-git-url=python=https://github.com/python/cpython +@end example + +This option can also be combined with @code{--with-branch} or +@code{--with-commit} (see below). + +@cindex continuous integration +Obviously, since it uses the latest commit of the given branch, the result +of such a command varies over time. Nevertheless it is a convenient way to +rebuild entire software stacks against the latest commit of one or more +packages. This is particularly useful in the context of continuous +integration (CI). + +Checkouts are kept in a cache under @file{~/.cache/guix/checkouts} to speed +up consecutive accesses to the same repository. You may want to clean it up +once in a while to save disk space. + +@item --with-branch=@var{package}=@var{branch} +Build @var{package} from the latest commit of @var{branch}. If the +@code{source} field of @var{package} is an origin with the @code{git-fetch} +method (@pxref{origin Reference}) or a @code{git-checkout} object, the +repository URL is taken from that @code{source}. Otherwise you have to use +@code{--with-git-url} to specify the URL of the Git repository. + +For instance, the following command builds @code{guile-sqlite3} from the +latest commit of its @code{master} branch, and then builds @code{guix} +(which depends on it) and @code{cuirass} (which depends on @code{guix}) +against this specific @code{guile-sqlite3} build: + +@example +guix build --with-branch=guile-sqlite3=master cuirass +@end example + +@item --with-commit=@var{package}=@var{commit} +This is similar to @code{--with-branch}, except that it builds from +@var{commit} rather than the tip of a branch. @var{commit} must be a valid +Git commit SHA1 identifier. +@end table + +@node Additional Build Options +@subsection Additional Build Options + +The command-line options presented below are specific to @command{guix +build}. + +@table @code + +@item --quiet +@itemx -q +Build quietly, without displaying the build log; this is equivalent to +@code{--verbosity=0}. Upon completion, the build log is kept in @file{/var} +(or similar) and can always be retrieved using the @option{--log-file} +option. + +@item --file=@var{file} +@itemx -f @var{file} +Build the package, derivation, or other file-like object that the code +within @var{file} evaluates to (@pxref{G-Expressions, file-like objects}). + +As an example, @var{file} might contain a package definition like this +(@pxref{Defining Packages}): + +@example +@verbatiminclude package-hello.scm +@end example + +@item --expression=@var{expr} +@itemx -e @var{expr} +Build the package or derivation @var{expr} evaluates to. + +For example, @var{expr} may be @code{(@@ (gnu packages guile) guile-1.8)}, +which unambiguously designates this specific variant of version 1.8 of +Guile. + +Alternatively, @var{expr} may be a G-expression, in which case it is used as +a build program passed to @code{gexp->derivation} (@pxref{G-Expressions}). + +Lastly, @var{expr} may refer to a zero-argument monadic procedure +(@pxref{The Store Monad}). The procedure must return a derivation as a +monadic value, which is then passed through @code{run-with-store}. + +@item --source +@itemx -S +Build the source derivations of the packages, rather than the packages +themselves. + +For instance, @code{guix build -S gcc} returns something like +@file{/gnu/store/@dots{}-gcc-4.7.2.tar.bz2}, which is the GCC source +tarball. + +The returned source tarball is the result of applying any patches and code +snippets specified in the package @code{origin} (@pxref{Defining Packages}). + +@item --sources +Fetch and return the source of @var{package-or-derivation} and all their +dependencies, recursively. This is a handy way to obtain a local copy of +all the source code needed to build @var{packages}, allowing you to +eventually build them even without network access. It is an extension of +the @code{--source} option and can accept one of the following optional +argument values: + +@table @code +@item package +This value causes the @code{--sources} option to behave in the same way as +the @code{--source} option. + +@item all +Build the source derivations of all packages, including any source that +might be listed as @code{inputs}. This is the default value. + +@example +$ guix build --sources tzdata +The following derivations will be built: + /gnu/store/@dots{}-tzdata2015b.tar.gz.drv + /gnu/store/@dots{}-tzcode2015b.tar.gz.drv +@end example + +@item transitive +Build the source derivations of all packages, as well of all transitive +inputs to the packages. This can be used e.g.@: to prefetch package source +for later offline building. + +@example +$ guix build --sources=transitive tzdata +The following derivations will be built: + /gnu/store/@dots{}-tzcode2015b.tar.gz.drv + /gnu/store/@dots{}-findutils-4.4.2.tar.xz.drv + /gnu/store/@dots{}-grep-2.21.tar.xz.drv + /gnu/store/@dots{}-coreutils-8.23.tar.xz.drv + /gnu/store/@dots{}-make-4.1.tar.xz.drv + /gnu/store/@dots{}-bash-4.3.tar.xz.drv +@dots{} +@end example + +@end table + +@item --system=@var{system} +@itemx -s @var{system} +Attempt to build for @var{system}---e.g., @code{i686-linux}---instead of the +system type of the build host. The @command{guix build} command allows you +to repeat this option several times, in which case it builds for all the +specified systems; other commands ignore extraneous @option{-s} options. + +@quotation Note +The @code{--system} flag is for @emph{native} compilation and must not be +confused with cross-compilation. See @code{--target} below for information +on cross-compilation. +@end quotation + +An example use of this is on Linux-based systems, which can emulate +different personalities. For instance, passing @code{--system=i686-linux} +on an @code{x86_64-linux} system or @code{--system=armhf-linux} on an +@code{aarch64-linux} system allows you to build packages in a complete +32-bit environment. + +@quotation Note +Building for an @code{armhf-linux} system is unconditionally enabled on +@code{aarch64-linux} machines, although certain aarch64 chipsets do not +allow for this functionality, notably the ThunderX. +@end quotation + +Similarly, when transparent emulation with QEMU and @code{binfmt_misc} is +enabled (@pxref{Virtualization Services, @code{qemu-binfmt-service-type}}), +you can build for any system for which a QEMU @code{binfmt_misc} handler is +installed. + +Builds for a system other than that of the machine you are using can also be +offloaded to a remote machine of the right architecture. @xref{Daemon +Offload Setup}, for more information on offloading. + +@item --target=@var{triplet} +@cindex cross-compilation +Cross-build for @var{triplet}, which must be a valid GNU triplet, such as +@code{"mips64el-linux-gnu"} (@pxref{Specifying target triplets, GNU +configuration triplets,, autoconf, Autoconf}). + +@anchor{build-check} +@item --check +@cindex determinism, checking +@cindex reproducibility, checking +Rebuild @var{package-or-derivation}, which are already available in the +store, and raise an error if the build results are not bit-for-bit +identical. + +This mechanism allows you to check whether previously installed substitutes +are genuine (@pxref{Substitutes}), or whether the build result of a package +is deterministic. @xref{Invoking guix challenge}, for more background +information and tools. + +When used in conjunction with @option{--keep-failed}, the differing output +is kept in the store, under @file{/gnu/store/@dots{}-check}. This makes it +easy to look for differences between the two results. + +@item --repair +@cindex repairing store items +@cindex corruption, recovering from +Attempt to repair the specified store items, if they are corrupt, by +re-downloading or rebuilding them. + +This operation is not atomic and thus restricted to @code{root}. + +@item --derivations +@itemx -d +Return the derivation paths, not the output paths, of the given packages. + +@item --root=@var{file} +@itemx -r @var{file} +@cindex GC roots, adding +@cindex garbage collector roots, adding +Make @var{file} a symlink to the result, and register it as a garbage +collector root. + +Consequently, the results of this @command{guix build} invocation are +protected from garbage collection until @var{file} is removed. When that +option is omitted, build results are eligible for garbage collection as soon +as the build completes. @xref{Invoking guix gc}, for more on GC roots. + +@item --log-file +@cindex build logs, access +Return the build log file names or URLs for the given +@var{package-or-derivation}, or raise an error if build logs are missing. + +This works regardless of how packages or derivations are specified. For +instance, the following invocations are equivalent: + +@example +guix build --log-file `guix build -d guile` +guix build --log-file `guix build guile` +guix build --log-file guile +guix build --log-file -e '(@@ (gnu packages guile) guile-2.0)' +@end example + +If a log is unavailable locally, and unless @code{--no-substitutes} is +passed, the command looks for a corresponding log on one of the substitute +servers (as specified with @code{--substitute-urls}.) + +So for instance, imagine you want to see the build log of GDB on MIPS, but +you are actually on an @code{x86_64} machine: + +@example +$ guix build --log-file gdb -s mips64el-linux +https://@value{SUBSTITUTE-SERVER}/log/@dots{}-gdb-7.10 +@end example + +You can freely access a huge library of build logs! +@end table + +@node Debugging Build Failures +@subsection Debugging Build Failures + +@cindex build failures, debugging +When defining a new package (@pxref{Defining Packages}), you will probably +find yourself spending some time debugging and tweaking the build until it +succeeds. To do that, you need to operate the build commands yourself in an +environment as close as possible to the one the build daemon uses. + +To that end, the first thing to do is to use the @option{--keep-failed} or +@option{-K} option of @command{guix build}, which will keep the failed build +tree in @file{/tmp} or whatever directory you specified as @code{TMPDIR} +(@pxref{Invoking guix build, @code{--keep-failed}}). + +From there on, you can @command{cd} to the failed build tree and source the +@file{environment-variables} file, which contains all the environment +variable definitions that were in place when the build failed. So let's say +you're debugging a build failure in package @code{foo}; a typical session +would look like this: + +@example +$ guix build foo -K +@dots{} @i{build fails} +$ cd /tmp/guix-build-foo.drv-0 +$ source ./environment-variables +$ cd foo-1.2 +@end example + +Now, you can invoke commands as if you were the daemon (almost) and +troubleshoot your build process. + +Sometimes it happens that, for example, a package's tests pass when you run +them manually but they fail when the daemon runs them. This can happen +because the daemon runs builds in containers where, unlike in our +environment above, network access is missing, @file{/bin/sh} does not exist, +etc. (@pxref{Build Environment Setup}). + +In such cases, you may need to run inspect the build process from within a +container similar to the one the build daemon creates: + +@example +$ guix build -K foo +@dots{} +$ cd /tmp/guix-build-foo.drv-0 +$ guix environment --no-grafts -C foo --ad-hoc strace gdb +[env]# source ./environment-variables +[env]# cd foo-1.2 +@end example + +Here, @command{guix environment -C} creates a container and spawns a new +shell in it (@pxref{Invoking guix environment}). The @command{--ad-hoc +strace gdb} part adds the @command{strace} and @command{gdb} commands to the +container, which would may find handy while debugging. The +@option{--no-grafts} option makes sure we get the exact same environment, +with ungrafted packages (@pxref{Security Updates}, for more info on grafts). + +To get closer to a container like that used by the build daemon, we can +remove @file{/bin/sh}: + +@example +[env]# rm /bin/sh +@end example + +(Don't worry, this is harmless: this is all happening in the throw-away +container created by @command{guix environment}.) + +The @command{strace} command is probably not in the search path, but we can +run: + +@example +[env]# $GUIX_ENVIRONMENT/bin/strace -f -o log make check +@end example + +In this way, not only you will have reproduced the environment variables the +daemon uses, you will also be running the build process in a container +similar to the one the daemon uses. + + +@node Invoking guix edit +@section Invoking @command{guix edit} + +@cindex @command{guix edit} +@cindex package definition, editing +So many packages, so many source files! The @command{guix edit} command +facilitates the life of users and packagers by pointing their editor at the +source file containing the definition of the specified packages. For +instance: + +@example +guix edit gcc@@4.9 vim +@end example + +@noindent +launches the program specified in the @code{VISUAL} or in the @code{EDITOR} +environment variable to view the recipe of GCC@tie{}4.9.3 and that of Vim. + +If you are using a Guix Git checkout (@pxref{从Git编译}), or have +created your own packages on @code{GUIX_PACKAGE_PATH} (@pxref{Package +Modules}), you will be able to edit the package recipes. In other cases, +you will be able to examine the read-only recipes for packages currently in +the store. + + +@node Invoking guix download +@section Invoking @command{guix download} + +@cindex @command{guix download} +@cindex downloading package sources +When writing a package definition, developers typically need to download a +source tarball, compute its SHA256 hash, and write that hash in the package +definition (@pxref{Defining Packages}). The @command{guix download} tool +helps with this task: it downloads a file from the given URI, adds it to the +store, and prints both its file name in the store and its SHA256 hash. + +The fact that the downloaded file is added to the store saves bandwidth: +when the developer eventually tries to build the newly defined package with +@command{guix build}, the source tarball will not have to be downloaded +again because it is already in the store. It is also a convenient way to +temporarily stash files, which may be deleted eventually (@pxref{Invoking +guix gc}). + +The @command{guix download} command supports the same URIs as used in +package definitions. In particular, it supports @code{mirror://} URIs. +@code{https} URIs (HTTP over TLS) are supported @emph{provided} the Guile +bindings for GnuTLS are available in the user's environment; when they are +not available, an error is raised. @xref{Guile Preparations, how to install +the GnuTLS bindings for Guile,, gnutls-guile, GnuTLS-Guile}, for more +information. + +@command{guix download} verifies HTTPS server certificates by loading the +certificates of X.509 authorities from the directory pointed to by the +@code{SSL_CERT_DIR} environment variable (@pxref{X.509 Certificates}), +unless @option{--no-check-certificate} is used. + +The following options are available: + +@table @code +@item --format=@var{fmt} +@itemx -f @var{fmt} +Write the hash in the format specified by @var{fmt}. For more information +on the valid values for @var{fmt}, @pxref{Invoking guix hash}. + +@item --no-check-certificate +Do not validate the X.509 certificates of HTTPS servers. + +When using this option, you have @emph{absolutely no guarantee} that you are +communicating with the authentic server responsible for the given URL, which +makes you vulnerable to ``man-in-the-middle'' attacks. + +@item --output=@var{file} +@itemx -o @var{file} +Save the downloaded file to @var{file} instead of adding it to the store. +@end table + +@node Invoking guix hash +@section Invoking @command{guix hash} + +@cindex @command{guix hash} +The @command{guix hash} command computes the SHA256 hash of a file. It is +primarily a convenience tool for anyone contributing to the distribution: it +computes the cryptographic hash of a file, which can be used in the +definition of a package (@pxref{Defining Packages}). + +The general syntax is: + +@example +guix hash @var{option} @var{file} +@end example + +When @var{file} is @code{-} (a hyphen), @command{guix hash} computes the +hash of data read from standard input. @command{guix hash} has the +following options: + +@table @code + +@item --format=@var{fmt} +@itemx -f @var{fmt} +Write the hash in the format specified by @var{fmt}. + +Supported formats: @code{nix-base32}, @code{base32}, @code{base16} +(@code{hex} and @code{hexadecimal} can be used as well). + +If the @option{--format} option is not specified, @command{guix hash} will +output the hash in @code{nix-base32}. This representation is used in the +definitions of packages. + +@item --recursive +@itemx -r +Compute the hash on @var{file} recursively. + +@c FIXME: Replace xref above with xref to an ``Archive'' section when +@c it exists. +In this case, the hash is computed on an archive containing @var{file}, +including its children if it is a directory. Some of the metadata of +@var{file} is part of the archive; for instance, when @var{file} is a +regular file, the hash is different depending on whether @var{file} is +executable or not. Metadata such as time stamps has no impact on the hash +(@pxref{Invoking guix archive}). + +@item --exclude-vcs +@itemx -x +When combined with @option{--recursive}, exclude version control system +directories (@file{.bzr}, @file{.git}, @file{.hg}, etc.) + +@vindex git-fetch +As an example, here is how you would compute the hash of a Git checkout, +which is useful when using the @code{git-fetch} method (@pxref{origin +Reference}): + +@example +$ git clone http://example.org/foo.git +$ cd foo +$ guix hash -rx . +@end example +@end table + +@node Invoking guix import +@section Invoking @command{guix import} + +@cindex importing packages +@cindex package import +@cindex package conversion +@cindex Invoking @command{guix import} +The @command{guix import} command is useful for people who would like to add +a package to the distribution with as little work as possible---a legitimate +demand. The command knows of a few repositories from which it can +``import'' package metadata. The result is a package definition, or a +template thereof, in the format we know (@pxref{Defining Packages}). + +The general syntax is: + +@example +guix import @var{importer} @var{options}@dots{} +@end example + +@var{importer} specifies the source from which to import package metadata, +and @var{options} specifies a package identifier and other options specific +to @var{importer}. Currently, the available ``importers'' are: + +@table @code +@item gnu +Import metadata for the given GNU package. This provides a template for the +latest version of that GNU package, including the hash of its source +tarball, and its canonical synopsis and description. + +Additional information such as the package dependencies and its license +needs to be figured out manually. + +For example, the following command returns a package definition for +GNU@tie{}Hello: + +@example +guix import gnu hello +@end example + +Specific command-line options are: + +@table @code +@item --key-download=@var{policy} +As for @code{guix refresh}, specify the policy to handle missing OpenPGP +keys when verifying the package signature. @xref{Invoking guix refresh, +@code{--key-download}}. +@end table + +@item pypi +@cindex pypi +Import metadata from the @uref{https://pypi.python.org/, Python Package +Index}. Information is taken from the JSON-formatted description available +at @code{pypi.python.org} and usually includes all the relevant information, +including package dependencies. For maximum efficiency, it is recommended +to install the @command{unzip} utility, so that the importer can unzip +Python wheels and gather data from them. + +The command below imports metadata for the @code{itsdangerous} Python +package: + +@example +guix import pypi itsdangerous +@end example + +@table @code +@item --recursive +@itemx -r +Traverse the dependency graph of the given upstream package recursively and +generate package expressions for all those packages that are not yet in +Guix. +@end table + +@item gem +@cindex gem +Import metadata from @uref{https://rubygems.org/, RubyGems}. Information is +taken from the JSON-formatted description available at @code{rubygems.org} +and includes most relevant information, including runtime dependencies. +There are some caveats, however. The metadata doesn't distinguish between +synopses and descriptions, so the same string is used for both fields. +Additionally, the details of non-Ruby dependencies required to build native +extensions is unavailable and left as an exercise to the packager. + +The command below imports metadata for the @code{rails} Ruby package: + +@example +guix import gem rails +@end example + +@table @code +@item --recursive +@itemx -r +Traverse the dependency graph of the given upstream package recursively and +generate package expressions for all those packages that are not yet in +Guix. +@end table + +@item cpan +@cindex CPAN +Import metadata from @uref{https://www.metacpan.org/, MetaCPAN}. +Information is taken from the JSON-formatted metadata provided through +@uref{https://fastapi.metacpan.org/, MetaCPAN's API} and includes most +relevant information, such as module dependencies. License information +should be checked closely. If Perl is available in the store, then the +@code{corelist} utility will be used to filter core modules out of the list +of dependencies. + +The command command below imports metadata for the @code{Acme::Boolean} Perl +module: + +@example +guix import cpan Acme::Boolean +@end example + +@item cran +@cindex CRAN +@cindex Bioconductor +Import metadata from @uref{https://cran.r-project.org/, CRAN}, the central +repository for the @uref{http://r-project.org, GNU@tie{}R statistical and +graphical environment}. + +Information is extracted from the @code{DESCRIPTION} file of the package. + +The command command below imports metadata for the @code{Cairo} R package: + +@example +guix import cran Cairo +@end example + +When @code{--recursive} is added, the importer will traverse the dependency +graph of the given upstream package recursively and generate package +expressions for all those packages that are not yet in Guix. + +When @code{--archive=bioconductor} is added, metadata is imported from +@uref{https://www.bioconductor.org/, Bioconductor}, a repository of R +packages for for the analysis and comprehension of high-throughput genomic +data in bioinformatics. + +Information is extracted from the @code{DESCRIPTION} file of a package +published on the web interface of the Bioconductor SVN repository. + +The command below imports metadata for the @code{GenomicRanges} R package: + +@example +guix import cran --archive=bioconductor GenomicRanges +@end example + +@item texlive +@cindex TeX Live +@cindex CTAN +Import metadata from @uref{http://www.ctan.org/, CTAN}, the comprehensive +TeX archive network for TeX packages that are part of the +@uref{https://www.tug.org/texlive/, TeX Live distribution}. + +Information about the package is obtained through the XML API provided by +CTAN, while the source code is downloaded from the SVN repository of the Tex +Live project. This is done because the CTAN does not keep versioned +archives. + +The command command below imports metadata for the @code{fontspec} TeX +package: + +@example +guix import texlive fontspec +@end example + +When @code{--archive=DIRECTORY} is added, the source code is downloaded not +from the @file{latex} sub-directory of the @file{texmf-dist/source} tree in +the TeX Live SVN repository, but from the specified sibling directory under +the same root. + +The command below imports metadata for the @code{ifxetex} package from CTAN +while fetching the sources from the directory @file{texmf/source/generic}: + +@example +guix import texlive --archive=generic ifxetex +@end example + +@item json +@cindex JSON, import +Import package metadata from a local JSON file. Consider the following +example package definition in JSON format: + +@example +@{ + "name": "hello", + "version": "2.10", + "source": "mirror://gnu/hello/hello-2.10.tar.gz", + "build-system": "gnu", + "home-page": "https://www.gnu.org/software/hello/", + "synopsis": "Hello, GNU world: An example GNU package", + "description": "GNU Hello prints a greeting.", + "license": "GPL-3.0+", + "native-inputs": ["gcc@@6"] +@} +@end example + +The field names are the same as for the @code{<package>} record +(@xref{Defining Packages}). References to other packages are provided as +JSON lists of quoted package specification strings such as @code{guile} or +@code{guile@@2.0}. + +The importer also supports a more explicit source definition using the +common fields for @code{<origin>} records: + +@example +@{ + @dots{} + "source": @{ + "method": "url-fetch", + "uri": "mirror://gnu/hello/hello-2.10.tar.gz", + "sha256": @{ + "base32": "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i" + @} + @} + @dots{} +@} +@end example + +The command below reads metadata from the JSON file @code{hello.json} and +outputs a package expression: + +@example +guix import json hello.json +@end example + +@item nix +Import metadata from a local copy of the source of the +@uref{http://nixos.org/nixpkgs/, Nixpkgs distribution}@footnote{This relies +on the @command{nix-instantiate} command of @uref{http://nixos.org/nix/, +Nix}.}. Package definitions in Nixpkgs are typically written in a mixture +of Nix-language and Bash code. This command only imports the high-level +package structure that is written in the Nix language. It normally includes +all the basic fields of a package definition. + +When importing a GNU package, the synopsis and descriptions are replaced by +their canonical upstream variant. + +Usually, you will first need to do: + +@example +export NIX_REMOTE=daemon +@end example + +@noindent +so that @command{nix-instantiate} does not try to open the Nix database. + +As an example, the command below imports the package definition of +LibreOffice (more precisely, it imports the definition of the package bound +to the @code{libreoffice} top-level attribute): + +@example +guix import nix ~/path/to/nixpkgs libreoffice +@end example + +@item hackage +@cindex hackage +Import metadata from the Haskell community's central package archive +@uref{https://hackage.haskell.org/, Hackage}. Information is taken from +Cabal files and includes all the relevant information, including package +dependencies. + +Specific command-line options are: + +@table @code +@item --stdin +@itemx -s +Read a Cabal file from standard input. +@item --no-test-dependencies +@itemx -t +Do not include dependencies required only by the test suites. +@item --cabal-environment=@var{alist} +@itemx -e @var{alist} +@var{alist} is a Scheme alist defining the environment in which the Cabal +conditionals are evaluated. The accepted keys are: @code{os}, @code{arch}, +@code{impl} and a string representing the name of a flag. The value +associated with a flag has to be either the symbol @code{true} or +@code{false}. The value associated with other keys has to conform to the +Cabal file format definition. The default value associated with the keys +@code{os}, @code{arch} and @code{impl} is @samp{linux}, @samp{x86_64} and +@samp{ghc}, respectively. +@item --recursive +@itemx -r +Traverse the dependency graph of the given upstream package recursively and +generate package expressions for all those packages that are not yet in +Guix. +@end table + +The command below imports metadata for the latest version of the @code{HTTP} +Haskell package without including test dependencies and specifying the value +of the flag @samp{network-uri} as @code{false}: + +@example +guix import hackage -t -e "'((\"network-uri\" . false))" HTTP +@end example + +A specific package version may optionally be specified by following the +package name by an at-sign and a version number as in the following example: + +@example +guix import hackage mtl@@2.1.3.1 +@end example + +@item stackage +@cindex stackage +The @code{stackage} importer is a wrapper around the @code{hackage} one. It +takes a package name, looks up the package version included in a long-term +support (LTS) @uref{https://www.stackage.org, Stackage} release and uses the +@code{hackage} importer to retrieve its metadata. Note that it is up to you +to select an LTS release compatible with the GHC compiler used by Guix. + +Specific command-line options are: + +@table @code +@item --no-test-dependencies +@itemx -t +Do not include dependencies required only by the test suites. +@item --lts-version=@var{version} +@itemx -l @var{version} +@var{version} is the desired LTS release version. If omitted the latest +release is used. +@item --recursive +@itemx -r +Traverse the dependency graph of the given upstream package recursively and +generate package expressions for all those packages that are not yet in +Guix. +@end table + +The command below imports metadata for the @code{HTTP} Haskell package +included in the LTS Stackage release version 7.18: + +@example +guix import stackage --lts-version=7.18 HTTP +@end example + +@item elpa +@cindex elpa +Import metadata from an Emacs Lisp Package Archive (ELPA) package repository +(@pxref{Packages,,, emacs, The GNU Emacs Manual}). + +Specific command-line options are: + +@table @code +@item --archive=@var{repo} +@itemx -a @var{repo} +@var{repo} identifies the archive repository from which to retrieve the +information. Currently the supported repositories and their identifiers +are: +@itemize - +@item +@uref{http://elpa.gnu.org/packages, GNU}, selected by the @code{gnu} +identifier. This is the default. + +Packages from @code{elpa.gnu.org} are signed with one of the keys contained +in the GnuPG keyring at @file{share/emacs/25.1/etc/package-keyring.gpg} (or +similar) in the @code{emacs} package (@pxref{Package Installation, ELPA +package signatures,, emacs, The GNU Emacs Manual}). + +@item +@uref{http://stable.melpa.org/packages, MELPA-Stable}, selected by the +@code{melpa-stable} identifier. + +@item +@uref{http://melpa.org/packages, MELPA}, selected by the @code{melpa} +identifier. +@end itemize + +@item --recursive +@itemx -r +Traverse the dependency graph of the given upstream package recursively and +generate package expressions for all those packages that are not yet in +Guix. +@end table + +@item crate +@cindex crate +Import metadata from the crates.io Rust package repository +@uref{https://crates.io, crates.io}. + +@item opam +@cindex OPAM +@cindex OCaml +Import metadata from the @uref{https://opam.ocaml.org/, OPAM} package +repository used by the OCaml community. +@end table + +The structure of the @command{guix import} code is modular. It would be +useful to have more importers for other package formats, and your help is +welcome here (@pxref{贡献}). + +@node Invoking guix refresh +@section Invoking @command{guix refresh} + +@cindex @command{guix refresh} +The primary audience of the @command{guix refresh} command is developers of +the GNU software distribution. By default, it reports any packages provided +by the distribution that are outdated compared to the latest upstream +version, like this: + +@example +$ guix refresh +gnu/packages/gettext.scm:29:13: gettext would be upgraded from 0.18.1.1 to 0.18.2.1 +gnu/packages/glib.scm:77:12: glib would be upgraded from 2.34.3 to 2.37.0 +@end example + +Alternately, one can specify packages to consider, in which case a warning +is emitted for packages that lack an updater: + +@example +$ guix refresh coreutils guile guile-ssh +gnu/packages/ssh.scm:205:2: warning: no updater for guile-ssh +gnu/packages/guile.scm:136:12: guile would be upgraded from 2.0.12 to 2.0.13 +@end example + +@command{guix refresh} browses the upstream repository of each package and +determines the highest version number of the releases therein. The command +knows how to update specific types of packages: GNU packages, ELPA packages, +etc.---see the documentation for @option{--type} below. There are many +packages, though, for which it lacks a method to determine whether a new +upstream release is available. However, the mechanism is extensible, so +feel free to get in touch with us to add a new method! + +@table @code + +@item --recursive +Consider the packages specified, and all the packages upon which they +depend. + +@example +$ guix refresh --recursive coreutils +gnu/packages/acl.scm:35:2: warning: no updater for acl +gnu/packages/m4.scm:30:12: info: 1.4.18 is already the latest version of m4 +gnu/packages/xml.scm:68:2: warning: no updater for expat +gnu/packages/multiprecision.scm:40:12: info: 6.1.2 is already the latest version of gmp +@dots{} +@end example + +@end table + +Sometimes the upstream name differs from the package name used in Guix, and +@command{guix refresh} needs a little help. Most updaters honor the +@code{upstream-name} property in package definitions, which can be used to +that effect: + +@example +(define-public network-manager + (package + (name "network-manager") + ;; @dots{} + (properties '((upstream-name . "NetworkManager"))))) +@end example + +When passed @code{--update}, it modifies distribution source files to update +the version numbers and source tarball hashes of those package recipes +(@pxref{Defining Packages}). This is achieved by downloading each package's +latest source tarball and its associated OpenPGP signature, authenticating +the downloaded tarball against its signature using @command{gpg}, and +finally computing its hash. When the public key used to sign the tarball is +missing from the user's keyring, an attempt is made to automatically +retrieve it from a public key server; when this is successful, the key is +added to the user's keyring; otherwise, @command{guix refresh} reports an +error. + +The following options are supported: + +@table @code + +@item --expression=@var{expr} +@itemx -e @var{expr} +Consider the package @var{expr} evaluates to. + +This is useful to precisely refer to a package, as in this example: + +@example +guix refresh -l -e '(@@@@ (gnu packages commencement) glibc-final)' +@end example + +This command lists the dependents of the ``final'' libc (essentially all the +packages.) + +@item --update +@itemx -u +Update distribution source files (package recipes) in place. This is +usually run from a checkout of the Guix source tree (@pxref{在安装之前运行Guix}): + +@example +$ ./pre-inst-env guix refresh -s non-core -u +@end example + +@xref{Defining Packages}, for more information on package definitions. + +@item --select=[@var{subset}] +@itemx -s @var{subset} +Select all the packages in @var{subset}, one of @code{core} or +@code{non-core}. + +The @code{core} subset refers to all the packages at the core of the +distribution---i.e., packages that are used to build ``everything else''. +This includes GCC, libc, Binutils, Bash, etc. Usually, changing one of +these packages in the distribution entails a rebuild of all the others. +Thus, such updates are an inconvenience to users in terms of build time or +bandwidth used to achieve the upgrade. + +The @code{non-core} subset refers to the remaining packages. It is +typically useful in cases where an update of the core packages would be +inconvenient. + +@item --manifest=@var{file} +@itemx -m @var{file} +Select all the packages from the manifest in @var{file}. This is useful to +check if any packages of the user manifest can be updated. + +@item --type=@var{updater} +@itemx -t @var{updater} +Select only packages handled by @var{updater} (may be a comma-separated list +of updaters). Currently, @var{updater} may be one of: + +@table @code +@item gnu +the updater for GNU packages; +@item gnome +the updater for GNOME packages; +@item kde +the updater for KDE packages; +@item xorg +the updater for X.org packages; +@item kernel.org +the updater for packages hosted on kernel.org; +@item elpa +the updater for @uref{http://elpa.gnu.org/, ELPA} packages; +@item cran +the updater for @uref{https://cran.r-project.org/, CRAN} packages; +@item bioconductor +the updater for @uref{https://www.bioconductor.org/, Bioconductor} R +packages; +@item cpan +the updater for @uref{http://www.cpan.org/, CPAN} packages; +@item pypi +the updater for @uref{https://pypi.python.org, PyPI} packages. +@item gem +the updater for @uref{https://rubygems.org, RubyGems} packages. +@item github +the updater for @uref{https://github.com, GitHub} packages. +@item hackage +the updater for @uref{https://hackage.haskell.org, Hackage} packages. +@item stackage +the updater for @uref{https://www.stackage.org, Stackage} packages. +@item crate +the updater for @uref{https://crates.io, Crates} packages. +@item launchpad +the updater for @uref{https://launchpad.net, Launchpad} packages. +@end table + +For instance, the following command only checks for updates of Emacs +packages hosted at @code{elpa.gnu.org} and for updates of CRAN packages: + +@example +$ guix refresh --type=elpa,cran +gnu/packages/statistics.scm:819:13: r-testthat would be upgraded from 0.10.0 to 0.11.0 +gnu/packages/emacs.scm:856:13: emacs-auctex would be upgraded from 11.88.6 to 11.88.9 +@end example + +@end table + +In addition, @command{guix refresh} can be passed one or more package names, +as in this example: + +@example +$ ./pre-inst-env guix refresh -u emacs idutils gcc@@4.8 +@end example + +@noindent +The command above specifically updates the @code{emacs} and @code{idutils} +packages. The @code{--select} option would have no effect in this case. + +When considering whether to upgrade a package, it is sometimes convenient to +know which packages would be affected by the upgrade and should be checked +for compatibility. For this the following option may be used when passing +@command{guix refresh} one or more package names: + +@table @code + +@item --list-updaters +@itemx -L +List available updaters and exit (see @option{--type} above.) + +For each updater, display the fraction of packages it covers; at the end, +display the fraction of packages covered by all these updaters. + +@item --list-dependent +@itemx -l +List top-level dependent packages that would need to be rebuilt as a result +of upgrading one or more packages. + +@xref{Invoking guix graph, the @code{reverse-package} type of @command{guix +graph}}, for information on how to visualize the list of dependents of a +package. + +@end table + +Be aware that the @code{--list-dependent} option only @emph{approximates} +the rebuilds that would be required as a result of an upgrade. More +rebuilds might be required under some circumstances. + +@example +$ guix refresh --list-dependent flex +Building the following 120 packages would ensure 213 dependent packages are rebuilt: +hop@@2.4.0 geiser@@0.4 notmuch@@0.18 mu@@0.9.9.5 cflow@@1.4 idutils@@4.6 @dots{} +@end example + +The command above lists a set of packages that could be built to check for +compatibility with an upgraded @code{flex} package. + +@table @code + +@item --list-transitive +List all the packages which one or more packages depend upon. + +@example +$ guix refresh --list-transitive flex +flex@@2.6.4 depends on the following 25 packages: perl@@5.28.0 help2man@@1.47.6 +bison@@3.0.5 indent@@2.2.10 tar@@1.30 gzip@@1.9 bzip2@@1.0.6 xz@@5.2.4 file@@5.33 @dots{} +@end example + +@end table + +The command above lists a set of packages which, when changed, would cause +@code{flex} to be rebuilt. + +The following options can be used to customize GnuPG operation: + +@table @code + +@item --gpg=@var{command} +Use @var{command} as the GnuPG 2.x command. @var{command} is searched for +in @code{$PATH}. + +@item --keyring=@var{file} +Use @var{file} as the keyring for upstream keys. @var{file} must be in the +@dfn{keybox format}. Keybox files usually have a name ending in @file{.kbx} +and the GNU@tie{}Privacy Guard (GPG) can manipulate these files +(@pxref{kbxutil, @command{kbxutil},, gnupg, Using the GNU Privacy Guard}, +for information on a tool to manipulate keybox files). + +When this option is omitted, @command{guix refresh} uses +@file{~/.config/guix/upstream/trustedkeys.kbx} as the keyring for upstream +signing keys. OpenPGP signatures are checked against keys from this +keyring; missing keys are downloaded to this keyring as well (see +@option{--key-download} below.) + +You can export keys from your default GPG keyring into a keybox file using +commands like this one: + +@example +gpg --export rms@@gnu.org | kbxutil --import-openpgp >> mykeyring.kbx +@end example + +Likewise, you can fetch keys to a specific keybox file like this: + +@example +gpg --no-default-keyring --keyring mykeyring.kbx \ + --recv-keys @value{OPENPGP-SIGNING-KEY-ID} +@end example + +@ref{GPG Configuration Options, @option{--keyring},, gnupg, Using the GNU +Privacy Guard}, for more information on GPG's @option{--keyring} option. + +@item --key-download=@var{policy} +Handle missing OpenPGP keys according to @var{policy}, which may be one of: + +@table @code +@item always +Always download missing OpenPGP keys from the key server, and add them to +the user's GnuPG keyring. + +@item never +Never try to download missing OpenPGP keys. Instead just bail out. + +@item interactive +When a package signed with an unknown OpenPGP key is encountered, ask the +user whether to download it or not. This is the default behavior. +@end table + +@item --key-server=@var{host} +Use @var{host} as the OpenPGP key server when importing a public key. + +@end table + +The @code{github} updater uses the @uref{https://developer.github.com/v3/, +GitHub API} to query for new releases. When used repeatedly e.g.@: when +refreshing all packages, GitHub will eventually refuse to answer any further +API requests. By default 60 API requests per hour are allowed, and a full +refresh on all GitHub packages in Guix requires more than this. +Authentication with GitHub through the use of an API token alleviates these +limits. To use an API token, set the environment variable +@code{GUIX_GITHUB_TOKEN} to a token procured from +@uref{https://github.com/settings/tokens} or otherwise. + + +@node Invoking guix lint +@section Invoking @command{guix lint} + +@cindex @command{guix lint} +@cindex package, checking for errors +The @command{guix lint} command is meant to help package developers avoid +common errors and use a consistent style. It runs a number of checks on a +given set of packages in order to find common mistakes in their +definitions. Available @dfn{checkers} include (see @code{--list-checkers} +for a complete list): + +@table @code +@item synopsis +@itemx description +Validate certain typographical and stylistic rules about package +descriptions and synopses. + +@item inputs-should-be-native +Identify inputs that should most likely be native inputs. + +@item source +@itemx home-page +@itemx mirror-url +@itemx github-url +@itemx source-file-name +Probe @code{home-page} and @code{source} URLs and report those that are +invalid. Suggest a @code{mirror://} URL when applicable. If the +@code{source} URL redirects to a GitHub URL, recommend usage of the GitHub +URL. Check that the source file name is meaningful, e.g.@: is not just a +version number or ``git-checkout'', without a declared @code{file-name} +(@pxref{origin Reference}). + +@item source-unstable-tarball +Parse the @code{source} URL to determine if a tarball from GitHub is +autogenerated or if it is a release tarball. Unfortunately GitHub's +autogenerated tarballs are sometimes regenerated. + +@item cve +@cindex security vulnerabilities +@cindex CVE, Common Vulnerabilities and Exposures +Report known vulnerabilities found in the Common Vulnerabilities and +Exposures (CVE) databases of the current and past year +@uref{https://nvd.nist.gov/download.cfm#CVE_FEED, published by the US NIST}. + +To view information about a particular vulnerability, visit pages such as: + +@itemize +@item +@indicateurl{https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-YYYY-ABCD} +@item +@indicateurl{https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-YYYY-ABCD} +@end itemize + +@noindent +where @code{CVE-YYYY-ABCD} is the CVE identifier---e.g., +@code{CVE-2015-7554}. + +Package developers can specify in package recipes the +@uref{https://nvd.nist.gov/cpe.cfm,Common Platform Enumeration (CPE)} name +and version of the package when they differ from the name or version that +Guix uses, as in this example: + +@example +(package + (name "grub") + ;; @dots{} + ;; CPE calls this package "grub2". + (properties '((cpe-name . "grub2") + (cpe-version . "2.3"))) +@end example + +@c See <http://www.openwall.com/lists/oss-security/2017/03/15/3>. +Some entries in the CVE database do not specify which version of a package +they apply to, and would thus ``stick around'' forever. Package developers +who found CVE alerts and verified they can be ignored can declare them as in +this example: + +@example +(package + (name "t1lib") + ;; @dots{} + ;; These CVEs no longer apply and can be safely ignored. + (properties `((lint-hidden-cve . ("CVE-2011-0433" + "CVE-2011-1553" + "CVE-2011-1554" + "CVE-2011-5244"))))) +@end example + +@item formatting +Warn about obvious source code formatting issues: trailing white space, use +of tabulations, etc. +@end table + +The general syntax is: + +@example +guix lint @var{options} @var{package}@dots{} +@end example + +If no package is given on the command line, then all packages are checked. +The @var{options} may be zero or more of the following: + +@table @code +@item --list-checkers +@itemx -l +List and describe all the available checkers that will be run on packages +and exit. + +@item --checkers +@itemx -c +Only enable the checkers specified in a comma-separated list using the names +returned by @code{--list-checkers}. + +@end table + +@node Invoking guix size +@section Invoking @command{guix size} + +@cindex size +@cindex package size +@cindex closure +@cindex @command{guix size} +The @command{guix size} command helps package developers profile the disk +usage of packages. It is easy to overlook the impact of an additional +dependency added to a package, or the impact of using a single output for a +package that could easily be split (@pxref{Packages with Multiple +Outputs}). Such are the typical issues that @command{guix size} can +highlight. + +The command can be passed one or more package specifications such as +@code{gcc@@4.8} or @code{guile:debug}, or a file name in the store. +Consider this example: + +@example +$ guix size coreutils +store item total self +/gnu/store/@dots{}-gcc-5.5.0-lib 60.4 30.1 38.1% +/gnu/store/@dots{}-glibc-2.27 30.3 28.8 36.6% +/gnu/store/@dots{}-coreutils-8.28 78.9 15.0 19.0% +/gnu/store/@dots{}-gmp-6.1.2 63.1 2.7 3.4% +/gnu/store/@dots{}-bash-static-4.4.12 1.5 1.5 1.9% +/gnu/store/@dots{}-acl-2.2.52 61.1 0.4 0.5% +/gnu/store/@dots{}-attr-2.4.47 60.6 0.2 0.3% +/gnu/store/@dots{}-libcap-2.25 60.5 0.2 0.2% +total: 78.9 MiB +@end example + +@cindex closure +The store items listed here constitute the @dfn{transitive closure} of +Coreutils---i.e., Coreutils and all its dependencies, recursively---as would +be returned by: + +@example +$ guix gc -R /gnu/store/@dots{}-coreutils-8.23 +@end example + +Here the output shows three columns next to store items. The first column, +labeled ``total'', shows the size in mebibytes (MiB) of the closure of the +store item---that is, its own size plus the size of all its dependencies. +The next column, labeled ``self'', shows the size of the item itself. The +last column shows the ratio of the size of the item itself to the space +occupied by all the items listed here. + +In this example, we see that the closure of Coreutils weighs in at +79@tie{}MiB, most of which is taken by libc and GCC's run-time support +libraries. (That libc and GCC's libraries represent a large fraction of the +closure is not a problem @i{per se} because they are always available on the +system anyway.) + +When the package(s) passed to @command{guix size} are available in the +store@footnote{More precisely, @command{guix size} looks for the +@emph{ungrafted} variant of the given package(s), as returned by @code{guix +build @var{package} --no-grafts}. @xref{Security Updates}, for information +on grafts.}, @command{guix size} queries the daemon to determine its +dependencies, and measures its size in the store, similar to @command{du -ms +--apparent-size} (@pxref{du invocation,,, coreutils, GNU Coreutils}). + +When the given packages are @emph{not} in the store, @command{guix size} +reports information based on the available substitutes +(@pxref{Substitutes}). This makes it possible it to profile disk usage of +store items that are not even on disk, only available remotely. + +You can also specify several package names: + +@example +$ guix size coreutils grep sed bash +store item total self +/gnu/store/@dots{}-coreutils-8.24 77.8 13.8 13.4% +/gnu/store/@dots{}-grep-2.22 73.1 0.8 0.8% +/gnu/store/@dots{}-bash-4.3.42 72.3 4.7 4.6% +/gnu/store/@dots{}-readline-6.3 67.6 1.2 1.2% +@dots{} +total: 102.3 MiB +@end example + +@noindent +In this example we see that the combination of the four packages takes +102.3@tie{}MiB in total, which is much less than the sum of each closure +since they have a lot of dependencies in common. + +The available options are: + +@table @option + +@item --substitute-urls=@var{urls} +Use substitute information from @var{urls}. @xref{client-substitute-urls, +the same option for @code{guix build}}. + +@item --sort=@var{key} +Sort lines according to @var{key}, one of the following options: + +@table @code +@item self +the size of each item (the default); +@item closure +the total size of the item's closure. +@end table + +@item --map-file=@var{file} +Write a graphical map of disk usage in PNG format to @var{file}. + +For the example above, the map looks like this: + +@image{images/coreutils-size-map,5in,, map of Coreutils disk usage produced +by @command{guix size}} + +This option requires that +@uref{http://wingolog.org/software/guile-charting/, Guile-Charting} be +installed and visible in Guile's module search path. When that is not the +case, @command{guix size} fails as it tries to load it. + +@item --system=@var{system} +@itemx -s @var{system} +Consider packages for @var{system}---e.g., @code{x86_64-linux}. + +@end table + +@node Invoking guix graph +@section Invoking @command{guix graph} + +@cindex DAG +@cindex @command{guix graph} +@cindex package dependencies +Packages and their dependencies form a @dfn{graph}, specifically a directed +acyclic graph (DAG). It can quickly become difficult to have a mental model +of the package DAG, so the @command{guix graph} command provides a visual +representation of the DAG. By default, @command{guix graph} emits a DAG +representation in the input format of @uref{http://www.graphviz.org/, +Graphviz}, so its output can be passed directly to the @command{dot} command +of Graphviz. It can also emit an HTML page with embedded JavaScript code to +display a ``chord diagram'' in a Web browser, using the +@uref{https://d3js.org/, d3.js} library, or emit Cypher queries to construct +a graph in a graph database supporting the @uref{http://www.opencypher.org/, +openCypher} query language. The general syntax is: + +@example +guix graph @var{options} @var{package}@dots{} +@end example + +For example, the following command generates a PDF file representing the +package DAG for the GNU@tie{}Core Utilities, showing its build-time +dependencies: + +@example +guix graph coreutils | dot -Tpdf > dag.pdf +@end example + +The output looks like this: + +@image{images/coreutils-graph,2in,,Dependency graph of the GNU Coreutils} + +Nice little graph, no? + +But there is more than one graph! The one above is concise: it is the graph +of package objects, omitting implicit inputs such as GCC, libc, grep, etc. +It is often useful to have such a concise graph, but sometimes one may want +to see more details. @command{guix graph} supports several types of graphs, +allowing you to choose the level of detail: + +@table @code +@item package +This is the default type used in the example above. It shows the DAG of +package objects, excluding implicit dependencies. It is concise, but +filters out many details. + +@item reverse-package +This shows the @emph{reverse} DAG of packages. For example: + +@example +guix graph --type=reverse-package ocaml +@end example + +...@: yields the graph of packages that @emph{explicitly} depend on OCaml +(if you are also interested in cases where OCaml is an implicit dependency, +see @code{reverse-bag} below.) + +Note that for core packages this can yield huge graphs. If all you want is +to know the number of packages that depend on a given package, use +@command{guix refresh --list-dependent} (@pxref{Invoking guix refresh, +@option{--list-dependent}}). + +@item bag-emerged +This is the package DAG, @emph{including} implicit inputs. + +For instance, the following command: + +@example +guix graph --type=bag-emerged coreutils | dot -Tpdf > dag.pdf +@end example + +...@: yields this bigger graph: + +@image{images/coreutils-bag-graph,,5in,Detailed dependency graph of the GNU +Coreutils} + +At the bottom of the graph, we see all the implicit inputs of +@var{gnu-build-system} (@pxref{Build Systems, @code{gnu-build-system}}). + +Now, note that the dependencies of these implicit inputs---that is, the +@dfn{bootstrap dependencies} (@pxref{Bootstrapping})---are not shown here, +for conciseness. + +@item bag +Similar to @code{bag-emerged}, but this time including all the bootstrap +dependencies. + +@item bag-with-origins +Similar to @code{bag}, but also showing origins and their dependencies. + +@item reverse-bag +This shows the @emph{reverse} DAG of packages. Unlike +@code{reverse-package}, it also takes implicit dependencies into account. +For example: + +@example +guix graph -t reverse-bag dune +@end example + +@noindent +...@: yields the graph of all packages that depend on Dune, directly or +indirectly. Since Dune is an @emph{implicit} dependency of many packages +@i{via} @code{dune-build-system}, this shows a large number of packages, +whereas @code{reverse-package} would show very few if any. + +@item derivation +This is the most detailed representation: It shows the DAG of derivations +(@pxref{Derivations}) and plain store items. Compared to the above +representation, many additional nodes are visible, including build scripts, +patches, Guile modules, etc. + +For this type of graph, it is also possible to pass a @file{.drv} file name +instead of a package name, as in: + +@example +guix graph -t derivation `guix system build -d my-config.scm` +@end example + +@item module +This is the graph of @dfn{package modules} (@pxref{Package Modules}). For +example, the following command shows the graph for the package module that +defines the @code{guile} package: + +@example +guix graph -t module guile | dot -Tpdf > module-graph.pdf +@end example +@end table + +All the types above correspond to @emph{build-time dependencies}. The +following graph type represents the @emph{run-time dependencies}: + +@table @code +@item references +This is the graph of @dfn{references} of a package output, as returned by +@command{guix gc --references} (@pxref{Invoking guix gc}). + +If the given package output is not available in the store, @command{guix +graph} attempts to obtain dependency information from substitutes. + +Here you can also pass a store file name instead of a package name. For +example, the command below produces the reference graph of your profile +(which can be big!): + +@example +guix graph -t references `readlink -f ~/.guix-profile` +@end example + +@item referrers +This is the graph of the @dfn{referrers} of a store item, as returned by +@command{guix gc --referrers} (@pxref{Invoking guix gc}). + +This relies exclusively on local information from your store. For instance, +let us suppose that the current Inkscape is available in 10 profiles on your +machine; @command{guix graph -t referrers inkscape} will show a graph rooted +at Inkscape and with those 10 profiles linked to it. + +It can help determine what is preventing a store item from being garbage +collected. + +@end table + +The available options are the following: + +@table @option +@item --type=@var{type} +@itemx -t @var{type} +Produce a graph output of @var{type}, where @var{type} must be one of the +values listed above. + +@item --list-types +List the supported graph types. + +@item --backend=@var{backend} +@itemx -b @var{backend} +Produce a graph using the selected @var{backend}. + +@item --list-backends +List the supported graph backends. + +Currently, the available backends are Graphviz and d3.js. + +@item --expression=@var{expr} +@itemx -e @var{expr} +Consider the package @var{expr} evaluates to. + +This is useful to precisely refer to a package, as in this example: + +@example +guix graph -e '(@@@@ (gnu packages commencement) gnu-make-final)' +@end example + +@item --system=@var{system} +@itemx -s @var{system} +Display the graph for @var{system}---e.g., @code{i686-linux}. + +The package dependency graph is largely architecture-independent, but there +are some architecture-dependent bits that this option allows you to +visualize. +@end table + + + +@node Invoking guix publish +@section Invoking @command{guix publish} + +@cindex @command{guix publish} +The purpose of @command{guix publish} is to enable users to easily share +their store with others, who can then use it as a substitute server +(@pxref{Substitutes}). + +When @command{guix publish} runs, it spawns an HTTP server which allows +anyone with network access to obtain substitutes from it. This means that +any machine running Guix can also act as if it were a build farm, since the +HTTP interface is compatible with Hydra, the software behind the +@code{@value{SUBSTITUTE-SERVER}} build farm. + +For security, each substitute is signed, allowing recipients to check their +authenticity and integrity (@pxref{Substitutes}). Because @command{guix +publish} uses the signing key of the system, which is only readable by the +system administrator, it must be started as root; the @code{--user} option +makes it drop root privileges early on. + +The signing key pair must be generated before @command{guix publish} is +launched, using @command{guix archive --generate-key} (@pxref{Invoking guix +archive}). + +The general syntax is: + +@example +guix publish @var{options}@dots{} +@end example + +Running @command{guix publish} without any additional arguments will spawn +an HTTP server on port 8080: + +@example +guix publish +@end example + +Once a publishing server has been authorized (@pxref{Invoking guix +archive}), the daemon may download substitutes from it: + +@example +guix-daemon --substitute-urls=http://example.org:8080 +@end example + +By default, @command{guix publish} compresses archives on the fly as it +serves them. This ``on-the-fly'' mode is convenient in that it requires no +setup and is immediately available. However, when serving lots of clients, +we recommend using the @option{--cache} option, which enables caching of the +archives before they are sent to clients---see below for details. The +@command{guix weather} command provides a handy way to check what a server +provides (@pxref{Invoking guix weather}). + +As a bonus, @command{guix publish} also serves as a content-addressed mirror +for source files referenced in @code{origin} records (@pxref{origin +Reference}). For instance, assuming @command{guix publish} is running on +@code{example.org}, the following URL returns the raw +@file{hello-2.10.tar.gz} file with the given SHA256 hash (represented in +@code{nix-base32} format, @pxref{Invoking guix hash}): + +@example +http://example.org/file/hello-2.10.tar.gz/sha256/0ssi1@dots{}ndq1i +@end example + +Obviously, these URLs only work for files that are in the store; in other +cases, they return 404 (``Not Found''). + +@cindex build logs, publication +Build logs are available from @code{/log} URLs like: + +@example +http://example.org/log/gwspk@dots{}-guile-2.2.3 +@end example + +@noindent +When @command{guix-daemon} is configured to save compressed build logs, as +is the case by default (@pxref{Invoking guix-daemon}), @code{/log} URLs +return the compressed log as-is, with an appropriate @code{Content-Type} +and/or @code{Content-Encoding} header. We recommend running +@command{guix-daemon} with @code{--log-compression=gzip} since Web browsers +can automatically decompress it, which is not the case with bzip2 +compression. + +The following options are available: + +@table @code +@item --port=@var{port} +@itemx -p @var{port} +Listen for HTTP requests on @var{port}. + +@item --listen=@var{host} +Listen on the network interface for @var{host}. The default is to accept +connections from any interface. + +@item --user=@var{user} +@itemx -u @var{user} +Change privileges to @var{user} as soon as possible---i.e., once the server +socket is open and the signing key has been read. + +@item --compression[=@var{level}] +@itemx -C [@var{level}] +Compress data using the given @var{level}. When @var{level} is zero, +disable compression. The range 1 to 9 corresponds to different gzip +compression levels: 1 is the fastest, and 9 is the best (CPU-intensive). +The default is 3. + +Unless @option{--cache} is used, compression occurs on the fly and the +compressed streams are not cached. Thus, to reduce load on the machine that +runs @command{guix publish}, it may be a good idea to choose a low +compression level, to run @command{guix publish} behind a caching proxy, or +to use @option{--cache}. Using @option{--cache} has the advantage that it +allows @command{guix publish} to add @code{Content-Length} HTTP header to +its responses. + +@item --cache=@var{directory} +@itemx -c @var{directory} +Cache archives and meta-data (@code{.narinfo} URLs) to @var{directory} and +only serve archives that are in cache. + +When this option is omitted, archives and meta-data are created on-the-fly. +This can reduce the available bandwidth, especially when compression is +enabled, since this may become CPU-bound. Another drawback of the default +mode is that the length of archives is not known in advance, so +@command{guix publish} does not add a @code{Content-Length} HTTP header to +its responses, which in turn prevents clients from knowing the amount of +data being downloaded. + +Conversely, when @option{--cache} is used, the first request for a store +item (@i{via} a @code{.narinfo} URL) returns 404 and triggers a background +process to @dfn{bake} the archive---computing its @code{.narinfo} and +compressing the archive, if needed. Once the archive is cached in +@var{directory}, subsequent requests succeed and are served directly from +the cache, which guarantees that clients get the best possible bandwidth. + +The ``baking'' process is performed by worker threads. By default, one +thread per CPU core is created, but this can be customized. See +@option{--workers} below. + +When @option{--ttl} is used, cached entries are automatically deleted when +they have expired. + +@item --workers=@var{N} +When @option{--cache} is used, request the allocation of @var{N} worker +threads to ``bake'' archives. + +@item --ttl=@var{ttl} +Produce @code{Cache-Control} HTTP headers that advertise a time-to-live +(TTL) of @var{ttl}. @var{ttl} must denote a duration: @code{5d} means 5 +days, @code{1m} means 1 month, and so on. + +This allows the user's Guix to keep substitute information in cache for +@var{ttl}. However, note that @code{guix publish} does not itself guarantee +that the store items it provides will indeed remain available for as long as +@var{ttl}. + +Additionally, when @option{--cache} is used, cached entries that have not +been accessed for @var{ttl} and that no longer have a corresponding item in +the store, may be deleted. + +@item --nar-path=@var{path} +Use @var{path} as the prefix for the URLs of ``nar'' files (@pxref{Invoking +guix archive, normalized archives}). + +By default, nars are served at a URL such as +@code{/nar/gzip/@dots{}-coreutils-8.25}. This option allows you to change +the @code{/nar} part to @var{path}. + +@item --public-key=@var{file} +@itemx --private-key=@var{file} +Use the specific @var{file}s as the public/private key pair used to sign the +store items being published. + +The files must correspond to the same key pair (the private key is used for +signing and the public key is merely advertised in the signature metadata). +They must contain keys in the canonical s-expression format as produced by +@command{guix archive --generate-key} (@pxref{Invoking guix archive}). By +default, @file{/etc/guix/signing-key.pub} and +@file{/etc/guix/signing-key.sec} are used. + +@item --repl[=@var{port}] +@itemx -r [@var{port}] +Spawn a Guile REPL server (@pxref{REPL Servers,,, guile, GNU Guile Reference +Manual}) on @var{port} (37146 by default). This is used primarily for +debugging a running @command{guix publish} server. +@end table + +Enabling @command{guix publish} on Guix System is a one-liner: just +instantiate a @code{guix-publish-service-type} service in the +@code{services} field of the @code{operating-system} declaration +(@pxref{guix-publish-service-type, @code{guix-publish-service-type}}). + +If you are instead running Guix on a ``foreign distro'', follow these +instructions:” + +@itemize +@item +If your host distro uses the systemd init system: + +@example +# ln -s ~root/.guix-profile/lib/systemd/system/guix-publish.service \ + /etc/systemd/system/ +# systemctl start guix-publish && systemctl enable guix-publish +@end example + +@item +If your host distro uses the Upstart init system: + +@example +# ln -s ~root/.guix-profile/lib/upstart/system/guix-publish.conf /etc/init/ +# start guix-publish +@end example + +@item +Otherwise, proceed similarly with your distro's init system. +@end itemize + +@node Invoking guix challenge +@section Invoking @command{guix challenge} + +@cindex reproducible builds +@cindex verifiable builds +@cindex @command{guix challenge} +@cindex challenge +Do the binaries provided by this server really correspond to the source code +it claims to build? Is a package build process deterministic? These are the +questions the @command{guix challenge} command attempts to answer. + +The former is obviously an important question: Before using a substitute +server (@pxref{Substitutes}), one had better @emph{verify} that it provides +the right binaries, and thus @emph{challenge} it. The latter is what +enables the former: If package builds are deterministic, then independent +builds of the package should yield the exact same result, bit for bit; if a +server provides a binary different from the one obtained locally, it may be +either corrupt or malicious. + +We know that the hash that shows up in @file{/gnu/store} file names is the +hash of all the inputs of the process that built the file or +directory---compilers, libraries, build scripts, +etc. (@pxref{Introduction}). Assuming deterministic build processes, one +store file name should map to exactly one build output. @command{guix +challenge} checks whether there is, indeed, a single mapping by comparing +the build outputs of several independent builds of any given store item. + +The command output looks like this: + +@smallexample +$ guix challenge --substitute-urls="https://@value{SUBSTITUTE-SERVER} https://guix.example.org" +updating list of substitutes from 'https://@value{SUBSTITUTE-SERVER}'... 100.0% +updating list of substitutes from 'https://guix.example.org'... 100.0% +/gnu/store/@dots{}-openssl-1.0.2d contents differ: + local hash: 0725l22r5jnzazaacncwsvp9kgf42266ayyp814v7djxs7nk963q + https://@value{SUBSTITUTE-SERVER}/nar/@dots{}-openssl-1.0.2d: 0725l22r5jnzazaacncwsvp9kgf42266ayyp814v7djxs7nk963q + https://guix.example.org/nar/@dots{}-openssl-1.0.2d: 1zy4fmaaqcnjrzzajkdn3f5gmjk754b43qkq47llbyak9z0qjyim +/gnu/store/@dots{}-git-2.5.0 contents differ: + local hash: 00p3bmryhjxrhpn2gxs2fy0a15lnip05l97205pgbk5ra395hyha + https://@value{SUBSTITUTE-SERVER}/nar/@dots{}-git-2.5.0: 069nb85bv4d4a6slrwjdy8v1cn4cwspm3kdbmyb81d6zckj3nq9f + https://guix.example.org/nar/@dots{}-git-2.5.0: 0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73 +/gnu/store/@dots{}-pius-2.1.1 contents differ: + local hash: 0k4v3m9z1zp8xzzizb7d8kjj72f9172xv078sq4wl73vnq9ig3ax + https://@value{SUBSTITUTE-SERVER}/nar/@dots{}-pius-2.1.1: 0k4v3m9z1zp8xzzizb7d8kjj72f9172xv078sq4wl73vnq9ig3ax + https://guix.example.org/nar/@dots{}-pius-2.1.1: 1cy25x1a4fzq5rk0pmvc8xhwyffnqz95h2bpvqsz2mpvlbccy0gs + +@dots{} + +6,406 store items were analyzed: + - 4,749 (74.1%) were identical + - 525 (8.2%) differed + - 1,132 (17.7%) were inconclusive +@end smallexample + +@noindent +In this example, @command{guix challenge} first scans the store to determine +the set of locally-built derivations---as opposed to store items that were +downloaded from a substitute server---and then queries all the substitute +servers. It then reports those store items for which the servers obtained a +result different from the local build. + +@cindex non-determinism, in package builds +As an example, @code{guix.example.org} always gets a different answer. +Conversely, @code{@value{SUBSTITUTE-SERVER}} agrees with local builds, +except in the case of Git. This might indicate that the build process of +Git is non-deterministic, meaning that its output varies as a function of +various things that Guix does not fully control, in spite of building +packages in isolated environments (@pxref{Features}). Most common sources +of non-determinism include the addition of timestamps in build results, the +inclusion of random numbers, and directory listings sorted by inode number. +See @uref{https://reproducible-builds.org/docs/}, for more information. + +To find out what is wrong with this Git binary, we can do something along +these lines (@pxref{Invoking guix archive}): + +@example +$ wget -q -O - https://@value{SUBSTITUTE-SERVER}/nar/@dots{}-git-2.5.0 \ + | guix archive -x /tmp/git +$ diff -ur --no-dereference /gnu/store/@dots{}-git.2.5.0 /tmp/git +@end example + +This command shows the difference between the files resulting from the local +build, and the files resulting from the build on +@code{@value{SUBSTITUTE-SERVER}} (@pxref{Overview, Comparing and Merging +Files,, diffutils, Comparing and Merging Files}). The @command{diff} +command works great for text files. When binary files differ, a better +option is @uref{https://diffoscope.org/, Diffoscope}, a tool that helps +visualize differences for all kinds of files. + +Once you have done that work, you can tell whether the differences are due +to a non-deterministic build process or to a malicious server. We try hard +to remove sources of non-determinism in packages to make it easier to verify +substitutes, but of course, this is a process that involves not just Guix, +but a large part of the free software community. In the meantime, +@command{guix challenge} is one tool to help address the problem. + +If you are writing packages for Guix, you are encouraged to check whether +@code{@value{SUBSTITUTE-SERVER}} and other substitute servers obtain the +same build result as you did with: + +@example +$ guix challenge @var{package} +@end example + +@noindent +where @var{package} is a package specification such as @code{guile@@2.0} or +@code{glibc:debug}. + +The general syntax is: + +@example +guix challenge @var{options} [@var{packages}@dots{}] +@end example + +When a difference is found between the hash of a locally-built item and that +of a server-provided substitute, or among substitutes provided by different +servers, the command displays it as in the example above and its exit code +is 2 (other non-zero exit codes denote other kinds of errors.) + +The one option that matters is: + +@table @code + +@item --substitute-urls=@var{urls} +Consider @var{urls} the whitespace-separated list of substitute source URLs +to compare to. + +@item --verbose +@itemx -v +Show details about matches (identical contents) in addition to information +about mismatches. + +@end table + +@node Invoking guix copy +@section Invoking @command{guix copy} + +@cindex copy, of store items, over SSH +@cindex SSH, copy of store items +@cindex sharing store items across machines +@cindex transferring store items across machines +The @command{guix copy} command copies items from the store of one machine +to that of another machine over a secure shell (SSH) +connection@footnote{This command is available only when Guile-SSH was +found. @xref{Requirements}, for details.}. For example, the following +command copies the @code{coreutils} package, the user's profile, and all +their dependencies over to @var{host}, logged in as @var{user}: + +@example +guix copy --to=@var{user}@@@var{host} \ + coreutils `readlink -f ~/.guix-profile` +@end example + +If some of the items to be copied are already present on @var{host}, they +are not actually sent. + +The command below retrieves @code{libreoffice} and @code{gimp} from +@var{host}, assuming they are available there: + +@example +guix copy --from=@var{host} libreoffice gimp +@end example + +The SSH connection is established using the Guile-SSH client, which is +compatible with OpenSSH: it honors @file{~/.ssh/known_hosts} and +@file{~/.ssh/config}, and uses the SSH agent for authentication. + +The key used to sign items that are sent must be accepted by the remote +machine. Likewise, the key used by the remote machine to sign items you are +retrieving must be in @file{/etc/guix/acl} so it is accepted by your own +daemon. @xref{Invoking guix archive}, for more information about store item +authentication. + +The general syntax is: + +@example +guix copy [--to=@var{spec}|--from=@var{spec}] @var{items}@dots{} +@end example + +You must always specify one of the following options: + +@table @code +@item --to=@var{spec} +@itemx --from=@var{spec} +Specify the host to send to or receive from. @var{spec} must be an SSH spec +such as @code{example.org}, @code{charlie@@example.org}, or +@code{charlie@@example.org:2222}. +@end table + +The @var{items} can be either package names, such as @code{gimp}, or store +items, such as @file{/gnu/store/@dots{}-idutils-4.6}. + +When specifying the name of a package to send, it is first built if needed, +unless @option{--dry-run} was specified. Common build options are supported +(@pxref{Common Build Options}). + + +@node Invoking guix container +@section Invoking @command{guix container} +@cindex container +@cindex @command{guix container} +@quotation Note +As of version @value{VERSION}, this tool is experimental. The interface is +subject to radical change in the future. +@end quotation + +The purpose of @command{guix container} is to manipulate processes running +within an isolated environment, commonly known as a ``container'', typically +created by the @command{guix environment} (@pxref{Invoking guix +environment}) and @command{guix system container} (@pxref{Invoking guix +system}) commands. + +The general syntax is: + +@example +guix container @var{action} @var{options}@dots{} +@end example + +@var{action} specifies the operation to perform with a container, and +@var{options} specifies the context-specific arguments for the action. + +The following actions are available: + +@table @code +@item exec +Execute a command within the context of a running container. + +The syntax is: + +@example +guix container exec @var{pid} @var{program} @var{arguments}@dots{} +@end example + +@var{pid} specifies the process ID of the running container. @var{program} +specifies an executable file name within the root file system of the +container. @var{arguments} are the additional options that will be passed +to @var{program}. + +The following command launches an interactive login shell inside a Guix +system container, started by @command{guix system container}, and whose +process ID is 9001: + +@example +guix container exec 9001 /run/current-system/profile/bin/bash --login +@end example + +Note that the @var{pid} cannot be the parent process of a container. It +must be PID 1 of the container or one of its child processes. + +@end table + +@node Invoking guix weather +@section Invoking @command{guix weather} + +Occasionally you're grumpy because substitutes are lacking and you end up +building packages by yourself (@pxref{Substitutes}). The @command{guix +weather} command reports on substitute availability on the specified servers +so you can have an idea of whether you'll be grumpy today. It can sometimes +be useful info as a user, but it is primarily useful to people running +@command{guix publish} (@pxref{Invoking guix publish}). + +@cindex statistics, for substitutes +@cindex availability of substitutes +@cindex substitute availability +@cindex weather, substitute availability +Here's a sample run: + +@example +$ guix weather --substitute-urls=https://guix.example.org +computing 5,872 package derivations for x86_64-linux... +looking for 6,128 store items on https://guix.example.org.. +updating list of substitutes from 'https://guix.example.org'... 100.0% +https://guix.example.org + 43.4% substitutes available (2,658 out of 6,128) + 7,032.5 MiB of nars (compressed) + 19,824.2 MiB on disk (uncompressed) + 0.030 seconds per request (182.9 seconds in total) + 33.5 requests per second + + 9.8% (342 out of 3,470) of the missing items are queued + 867 queued builds + x86_64-linux: 518 (59.7%) + i686-linux: 221 (25.5%) + aarch64-linux: 128 (14.8%) + build rate: 23.41 builds per hour + x86_64-linux: 11.16 builds per hour + i686-linux: 6.03 builds per hour + aarch64-linux: 6.41 builds per hour +@end example + +@cindex continuous integration, statistics +As you can see, it reports the fraction of all the packages for which +substitutes are available on the server---regardless of whether substitutes +are enabled, and regardless of whether this server's signing key is +authorized. It also reports the size of the compressed archives (``nars'') +provided by the server, the size the corresponding store items occupy in the +store (assuming deduplication is turned off), and the server's throughput. +The second part gives continuous integration (CI) statistics, if the server +supports it. In addition, using the @option{--coverage} option, +@command{guix weather} can list ``important'' package substitutes missing on +the server (see below). + +To achieve that, @command{guix weather} queries over HTTP(S) meta-data +(@dfn{narinfos}) for all the relevant store items. Like @command{guix +challenge}, it ignores signatures on those substitutes, which is innocuous +since the command only gathers statistics and cannot install those +substitutes. + +Among other things, it is possible to query specific system types and +specific package sets. The available options are listed below. + +@table @code +@item --substitute-urls=@var{urls} +@var{urls} is the space-separated list of substitute server URLs to query. +When this option is omitted, the default set of substitute servers is +queried. + +@item --system=@var{system} +@itemx -s @var{system} +Query substitutes for @var{system}---e.g., @code{aarch64-linux}. This +option can be repeated, in which case @command{guix weather} will query +substitutes for several system types. + +@item --manifest=@var{file} +Instead of querying substitutes for all the packages, only ask for those +specified in @var{file}. @var{file} must contain a @dfn{manifest}, as with +the @code{-m} option of @command{guix package} (@pxref{Invoking guix +package}). + +@item --coverage[=@var{count}] +@itemx -c [@var{count}] +Report on substitute coverage for packages: list packages with at least +@var{count} dependents (zero by default) for which substitutes are +unavailable. Dependent packages themselves are not listed: if @var{b} +depends on @var{a} and @var{a} has no substitutes, only @var{a} is listed, +even though @var{b} usually lacks substitutes as well. The result looks +like this: + +@example +$ guix weather --substitute-urls=https://ci.guix.zh_CN.info -c 10 +computing 8,983 package derivations for x86_64-linux... +looking for 9,343 store items on https://ci.guix.zh_CN.info... +updating substitutes from 'https://ci.guix.zh_CN.info'... 100.0% +https://ci.guix.zh_CN.info + 64.7% substitutes available (6,047 out of 9,343) +@dots{} +2502 packages are missing from 'https://ci.guix.zh_CN.info' for 'x86_64-linux', among which: + 58 kcoreaddons@@5.49.0 /gnu/store/@dots{}-kcoreaddons-5.49.0 + 46 qgpgme@@1.11.1 /gnu/store/@dots{}-qgpgme-1.11.1 + 37 perl-http-cookiejar@@0.008 /gnu/store/@dots{}-perl-http-cookiejar-0.008 + @dots{} +@end example + +What this example shows is that @code{kcoreaddons} and presumably the 58 +packages that depend on it have no substitutes at @code{ci.guix.zh_CN.info}; +likewise for @code{qgpgme} and the 46 packages that depend on it. + +If you are a Guix developer, or if you are taking care of this build farm, +you'll probably want to have a closer look at these packages: they may +simply fail to build. +@end table + +@node Invoking guix processes +@section Invoking @command{guix processes} + +The @command{guix processes} command can be useful to developers and system +administrators, especially on multi-user machines and on build farms: it +lists the current sessions (connections to the daemon), as well as +information about the processes involved@footnote{Remote sessions, when +@command{guix-daemon} is started with @option{--listen} specifying a TCP +endpoint, are @emph{not} listed.}. Here's an example of the information it +returns: + +@example +$ sudo guix processes +SessionPID: 19002 +ClientPID: 19090 +ClientCommand: guix environment --ad-hoc python + +SessionPID: 19402 +ClientPID: 19367 +ClientCommand: guix publish -u guix-publish -p 3000 -C 9 @dots{} + +SessionPID: 19444 +ClientPID: 19419 +ClientCommand: cuirass --cache-directory /var/cache/cuirass @dots{} +LockHeld: /gnu/store/@dots{}-perl-ipc-cmd-0.96.lock +LockHeld: /gnu/store/@dots{}-python-six-bootstrap-1.11.0.lock +LockHeld: /gnu/store/@dots{}-libjpeg-turbo-2.0.0.lock +ChildProcess: 20495: guix offload x86_64-linux 7200 1 28800 +ChildProcess: 27733: guix offload x86_64-linux 7200 1 28800 +ChildProcess: 27793: guix offload x86_64-linux 7200 1 28800 +@end example + +In this example we see that @command{guix-daemon} has three clients: +@command{guix environment}, @command{guix publish}, and the Cuirass +continuous integration tool; their process identifier (PID) is given by the +@code{ClientPID} field. The @code{SessionPID} field gives the PID of the +@command{guix-daemon} sub-process of this particular session. + +The @code{LockHeld} fields show which store items are currently locked by +this session, which corresponds to store items being built or substituted +(the @code{LockHeld} field is not displayed when @command{guix processes} is +not running as root.) Last, by looking at the @code{ChildProcess} field, we +understand that these three builds are being offloaded (@pxref{Daemon +Offload Setup}). + +The output is in Recutils format so we can use the handy @command{recsel} +command to select sessions of interest (@pxref{Selection Expressions,,, +recutils, GNU recutils manual}). As an example, the command shows the +command line and PID of the client that triggered the build of a Perl +package: + +@example +$ sudo guix processes | \ + recsel -p ClientPID,ClientCommand -e 'LockHeld ~ "perl"' +ClientPID: 19419 +ClientCommand: cuirass --cache-directory /var/cache/cuirass @dots{} +@end example + + +@node System Configuration +@chapter System Configuration + +@cindex system configuration +The Guix System Distribution supports a consistent whole-system +configuration mechanism. By that we mean that all aspects of the global +system configuration---such as the available system services, timezone and +locale settings, user accounts---are declared in a single place. Such a +@dfn{system configuration} can be @dfn{instantiated}---i.e., effected. + +@c Yes, we're talking of Puppet, Chef, & co. here. ↑ +One of the advantages of putting all the system configuration under the +control of Guix is that it supports transactional system upgrades, and makes +it possible to roll back to a previous system instantiation, should +something go wrong with the new one (@pxref{Features}). Another advantage +is that it makes it easy to replicate the exact same configuration across +different machines, or at different points in time, without having to resort +to additional administration tools layered on top of the own tools of the +system. + +This section describes this mechanism. First we focus on the system +administrator's viewpoint---explaining how the system is configured and +instantiated. Then we show how this mechanism can be extended, for instance +to support new system services. + +@menu +* Using the Configuration System:: Customizing your GNU system. +* operating-system Reference:: Detail of operating-system declarations. +* File Systems:: Configuring file system mounts. +* Mapped Devices:: Block device extra processing. +* User Accounts:: Specifying user accounts. +* Keyboard Layout:: How the system interprets key strokes. +* Locales:: Language and cultural convention settings. +* Services:: Specifying system services. +* Setuid Programs:: Programs running with root privileges. +* X.509 Certificates:: Authenticating HTTPS servers. +* Name Service Switch:: Configuring libc's name service switch. +* Initial RAM Disk:: Linux-Libre bootstrapping. +* Bootloader Configuration:: Configuring the boot loader. +* Invoking guix system:: Instantiating a system configuration. +* Running Guix in a VM:: How to run Guix System in a virtual machine. +* Defining Services:: Adding new service definitions. +@end menu + +@node Using the Configuration System +@section Using the Configuration System + +The operating system is configured by providing an @code{operating-system} +declaration in a file that can then be passed to the @command{guix system} +command (@pxref{Invoking guix system}). A simple setup, with the default +system services, the default Linux-Libre kernel, initial RAM disk, and boot +loader looks like this: + +@findex operating-system +@lisp +@include os-config-bare-bones.texi +@end lisp + +This example should be self-describing. Some of the fields defined above, +such as @code{host-name} and @code{bootloader}, are mandatory. Others, such +as @code{packages} and @code{services}, can be omitted, in which case they +get a default value. + +Below we discuss the effect of some of the most important fields +(@pxref{operating-system Reference}, for details about all the available +fields), and how to @dfn{instantiate} the operating system using +@command{guix system}. + +@unnumberedsubsec Bootloader + +@cindex legacy boot, on Intel machines +@cindex BIOS boot, on Intel machines +@cindex UEFI boot +@cindex EFI boot +The @code{bootloader} field describes the method that will be used to boot +your system. Machines based on Intel processors can boot in ``legacy'' BIOS +mode, as in the example above. However, more recent machines rely instead +on the @dfn{Unified Extensible Firmware Interface} (UEFI) to boot. In that +case, the @code{bootloader} field should contain something along these +lines: + +@example +(bootloader-configuration + (bootloader grub-efi-bootloader) + (target "/boot/efi")) +@end example + +@xref{Bootloader Configuration}, for more information on the available +configuration options. + +@unnumberedsubsec Globally-Visible Packages + +@vindex %base-packages +The @code{packages} field lists packages that will be globally visible on +the system, for all user accounts---i.e., in every user's @code{PATH} +environment variable---in addition to the per-user profiles (@pxref{Invoking +guix package}). The @var{%base-packages} variable provides all the tools +one would expect for basic user and administrator tasks---including the GNU +Core Utilities, the GNU Networking Utilities, the GNU Zile lightweight text +editor, @command{find}, @command{grep}, etc. The example above adds +GNU@tie{}Screen to those, taken from the @code{(gnu packages screen)} module +(@pxref{Package Modules}). The @code{(list package output)} syntax can be +used to add a specific output of a package: + +@lisp +(use-modules (gnu packages)) +(use-modules (gnu packages dns)) + +(operating-system + ;; ... + (packages (cons (list bind "utils") + %base-packages))) +@end lisp + +@findex specification->package +Referring to packages by variable name, like @code{bind} above, has the +advantage of being unambiguous; it also allows typos and such to be +diagnosed right away as ``unbound variables''. The downside is that one +needs to know which module defines which package, and to augment the +@code{use-package-modules} line accordingly. To avoid that, one can use the +@code{specification->package} procedure of the @code{(gnu packages)} module, +which returns the best package for a given name or name and version: + +@lisp +(use-modules (gnu packages)) + +(operating-system + ;; ... + (packages (append (map specification->package + '("tcpdump" "htop" "gnupg@@2.0")) + %base-packages))) +@end lisp + +@unnumberedsubsec System Services + +@cindex services +@vindex %base-services +The @code{services} field lists @dfn{system services} to be made available +when the system starts (@pxref{Services}). The @code{operating-system} +declaration above specifies that, in addition to the basic services, we want +the OpenSSH secure shell daemon listening on port 2222 (@pxref{Networking +Services, @code{openssh-service-type}}). Under the hood, +@code{openssh-service-type} arranges so that @command{sshd} is started with +the right command-line options, possibly with supporting configuration files +generated as needed (@pxref{Defining Services}). + +@cindex customization, of services +@findex modify-services +Occasionally, instead of using the base services as is, you will want to +customize them. To do this, use @code{modify-services} (@pxref{Service +Reference, @code{modify-services}}) to modify the list. + +For example, suppose you want to modify @code{guix-daemon} and Mingetty (the +console log-in) in the @var{%base-services} list (@pxref{Base Services, +@code{%base-services}}). To do that, you can write the following in your +operating system declaration: + +@lisp +(define %my-services + ;; My very own list of services. + (modify-services %base-services + (guix-service-type config => + (guix-configuration + (inherit config) + (use-substitutes? #f) + (extra-options '("--gc-keep-derivations")))) + (mingetty-service-type config => + (mingetty-configuration + (inherit config))))) + +(operating-system + ;; @dots{} + (services %my-services)) +@end lisp + +This changes the configuration---i.e., the service parameters---of the +@code{guix-service-type} instance, and that of all the +@code{mingetty-service-type} instances in the @var{%base-services} list. +Observe how this is accomplished: first, we arrange for the original +configuration to be bound to the identifier @code{config} in the @var{body}, +and then we write the @var{body} so that it evaluates to the desired +configuration. In particular, notice how we use @code{inherit} to create a +new configuration which has the same values as the old configuration, but +with a few modifications. + +@cindex encrypted disk +The configuration for a typical ``desktop'' usage, with an encrypted root +partition, the X11 display server, GNOME and Xfce (users can choose which of +these desktop environments to use at the log-in screen by pressing +@kbd{F1}), network management, power management, and more, would look like +this: + +@lisp +@include os-config-desktop.texi +@end lisp + +A graphical system with a choice of lightweight window managers instead of +full-blown desktop environments would look like this: + +@lisp +@include os-config-lightweight-desktop.texi +@end lisp + +This example refers to the @file{/boot/efi} file system by its UUID, +@code{1234-ABCD}. Replace this UUID with the right UUID on your system, as +returned by the @command{blkid} command. + +@xref{Desktop Services}, for the exact list of services provided by +@var{%desktop-services}. @xref{X.509 Certificates}, for background +information about the @code{nss-certs} package that is used here. + +Again, @var{%desktop-services} is just a list of service objects. If you +want to remove services from there, you can do so using the procedures for +list filtering (@pxref{SRFI-1 Filtering and Partitioning,,, guile, GNU Guile +Reference Manual}). For instance, the following expression returns a list +that contains all the services in @var{%desktop-services} minus the Avahi +service: + +@example +(remove (lambda (service) + (eq? (service-kind service) avahi-service-type)) + %desktop-services) +@end example + +@unnumberedsubsec Instantiating the System + +Assuming the @code{operating-system} declaration is stored in the +@file{my-system-config.scm} file, the @command{guix system reconfigure +my-system-config.scm} command instantiates that configuration, and makes it +the default GRUB boot entry (@pxref{Invoking guix system}). + +The normal way to change the system configuration is by updating this file +and re-running @command{guix system reconfigure}. One should never have to +touch files in @file{/etc} or to run commands that modify the system state +such as @command{useradd} or @command{grub-install}. In fact, you must +avoid that since that would not only void your warranty but also prevent you +from rolling back to previous versions of your system, should you ever need +to. + +@cindex roll-back, of the operating system +Speaking of roll-back, each time you run @command{guix system reconfigure}, +a new @dfn{generation} of the system is created---without modifying or +deleting previous generations. Old system generations get an entry in the +bootloader boot menu, allowing you to boot them in case something went wrong +with the latest generation. Reassuring, no? The @command{guix system +list-generations} command lists the system generations available on disk. +It is also possible to roll back the system via the commands @command{guix +system roll-back} and @command{guix system switch-generation}. + +Although the @command{guix system reconfigure} command will not modify +previous generations, you must take care when the current generation is not +the latest (e.g., after invoking @command{guix system roll-back}), since the +operation might overwrite a later generation (@pxref{Invoking guix system}). + +@unnumberedsubsec The Programming Interface + +At the Scheme level, the bulk of an @code{operating-system} declaration is +instantiated with the following monadic procedure (@pxref{The Store Monad}): + +@deffn {Monadic Procedure} operating-system-derivation os +Return a derivation that builds @var{os}, an @code{operating-system} object +(@pxref{Derivations}). + +The output of the derivation is a single directory that refers to all the +packages, configuration files, and other supporting files needed to +instantiate @var{os}. +@end deffn + +This procedure is provided by the @code{(gnu system)} module. Along with +@code{(gnu services)} (@pxref{Services}), this module contains the guts of +Guix System. Make sure to visit it! + + +@node operating-system Reference +@section @code{operating-system} Reference + +This section summarizes all the options available in @code{operating-system} +declarations (@pxref{Using the Configuration System}). + +@deftp {Data Type} operating-system +This is the data type representing an operating system configuration. By +that, we mean all the global system configuration, not per-user +configuration (@pxref{Using the Configuration System}). + +@table @asis +@item @code{kernel} (default: @var{linux-libre}) +The package object of the operating system kernel to use@footnote{Currently +only the Linux-libre kernel is supported. In the future, it will be +possible to use the GNU@tie{}Hurd.}. + +@item @code{kernel-arguments} (default: @code{'("quiet")}) +List of strings or gexps representing additional arguments to pass on the +command-line of the kernel---e.g., @code{("console=ttyS0")}. + +@item @code{bootloader} +The system bootloader configuration object. @xref{Bootloader +Configuration}. + +@item @code{label} +This is the label (a string) as it appears in the bootloader's menu entry. +The default label includes the kernel name and version. + +@item @code{keyboard-layout} (default: @code{#f}) +This field specifies the keyboard layout to use in the console. It can be +either @code{#f}, in which case the default keyboard layout is used (usually +US English), or a @code{<keyboard-layout>} record. + +This keyboard layout is in effect as soon as the kernel has booted. For +instance, it is the keyboard layout in effect when you type a passphrase if +your root file system is on a @code{luks-device-mapping} mapped device +(@pxref{Mapped Devices}). + +@quotation Note +This does @emph{not} specify the keyboard layout used by the bootloader, nor +that used by the graphical display server. @xref{Bootloader Configuration}, +for information on how to specify the bootloader's keyboard layout. @xref{X +Window}, for information on how to specify the keyboard layout used by the X +Window System. +@end quotation + +@item @code{initrd-modules} (default: @code{%base-initrd-modules}) +@cindex initrd +@cindex initial RAM disk +The list of Linux kernel modules that need to be available in the initial +RAM disk. @xref{Initial RAM Disk}. + +@item @code{initrd} (default: @code{base-initrd}) +A procedure that returns an initial RAM disk for the Linux kernel. This +field is provided to support low-level customization and should rarely be +needed for casual use. @xref{Initial RAM Disk}. + +@item @code{firmware} (default: @var{%base-firmware}) +@cindex firmware +List of firmware packages loadable by the operating system kernel. + +The default includes firmware needed for Atheros- and Broadcom-based WiFi +devices (Linux-libre modules @code{ath9k} and @code{b43-open}, +respectively). @xref{Hardware Considerations}, for more info on supported +hardware. + +@item @code{host-name} +The host name. + +@item @code{hosts-file} +@cindex hosts file +A file-like object (@pxref{G-Expressions, file-like objects}) for use as +@file{/etc/hosts} (@pxref{Host Names,,, libc, The GNU C Library Reference +Manual}). The default is a file with entries for @code{localhost} and +@var{host-name}. + +@item @code{mapped-devices} (default: @code{'()}) +A list of mapped devices. @xref{Mapped Devices}. + +@item @code{file-systems} +A list of file systems. @xref{File Systems}. + +@item @code{swap-devices} (default: @code{'()}) +@cindex swap devices +A list of strings identifying devices or files to be used for ``swap space'' +(@pxref{Memory Concepts,,, libc, The GNU C Library Reference Manual}). For +example, @code{'("/dev/sda3")} or @code{'("/swapfile")}. It is possible to +specify a swap file in a file system on a mapped device, provided that the +necessary device mapping and file system are also specified. @xref{Mapped +Devices} and @ref{File Systems}. + +@item @code{users} (default: @code{%base-user-accounts}) +@itemx @code{groups} (default: @var{%base-groups}) +List of user accounts and groups. @xref{User Accounts}. + +If the @code{users} list lacks a user account with UID@tie{}0, a ``root'' +account with UID@tie{}0 is automatically added. + +@item @code{skeletons} (default: @code{(default-skeletons)}) +A list target file name/file-like object tuples (@pxref{G-Expressions, +file-like objects}). These are the skeleton files that will be added to the +home directory of newly-created user accounts. + +For instance, a valid value may look like this: + +@example +`((".bashrc" ,(plain-file "bashrc" "echo Hello\n")) + (".guile" ,(plain-file "guile" + "(use-modules (ice-9 readline)) + (activate-readline)"))) +@end example + +@item @code{issue} (default: @var{%default-issue}) +A string denoting the contents of the @file{/etc/issue} file, which is +displayed when users log in on a text console. + +@item @code{packages} (default: @var{%base-packages}) +The set of packages installed in the global profile, which is accessible at +@file{/run/current-system/profile}. + +The default set includes core utilities and it is good practice to install +non-core utilities in user profiles (@pxref{Invoking guix package}). + +@item @code{timezone} +A timezone identifying string---e.g., @code{"Europe/Paris"}. + +You can run the @command{tzselect} command to find out which timezone string +corresponds to your region. Choosing an invalid timezone name causes +@command{guix system} to fail. + +@item @code{locale} (default: @code{"en_US.utf8"}) +The name of the default locale (@pxref{Locale Names,,, libc, The GNU C +Library Reference Manual}). @xref{Locales}, for more information. + +@item @code{locale-definitions} (default: @var{%default-locale-definitions}) +The list of locale definitions to be compiled and that may be used at run +time. @xref{Locales}. + +@item @code{locale-libcs} (default: @code{(list @var{glibc})}) +The list of GNU@tie{}libc packages whose locale data and tools are used to +build the locale definitions. @xref{Locales}, for compatibility +considerations that justify this option. + +@item @code{name-service-switch} (default: @var{%default-nss}) +Configuration of the libc name service switch (NSS)---a +@code{<name-service-switch>} object. @xref{Name Service Switch}, for +details. + +@item @code{services} (default: @var{%base-services}) +A list of service objects denoting system services. @xref{Services}. + +@cindex essential services +@item @code{essential-services} (default: ...) +The list of ``essential services''---i.e., things like instances of +@code{system-service-type} and @code{host-name-service-type} (@pxref{Service +Reference}), which are derived from the operating system definition itself. +As a user you should @emph{never} need to touch this field. + +@item @code{pam-services} (default: @code{(base-pam-services)}) +@cindex PAM +@cindex pluggable authentication modules +@c FIXME: Add xref to PAM services section. +Linux @dfn{pluggable authentication module} (PAM) services. + +@item @code{setuid-programs} (default: @var{%setuid-programs}) +List of string-valued G-expressions denoting setuid programs. @xref{Setuid +Programs}. + +@item @code{sudoers-file} (default: @var{%sudoers-specification}) +@cindex sudoers file +The contents of the @file{/etc/sudoers} file as a file-like object +(@pxref{G-Expressions, @code{local-file} and @code{plain-file}}). + +This file specifies which users can use the @command{sudo} command, what +they are allowed to do, and what privileges they may gain. The default is +that only @code{root} and members of the @code{wheel} group may use +@code{sudo}. + +@end table + +@deffn {Scheme Syntax} this-operating-system +When used in the @emph{lexical scope} of an operating system field +definition, this identifier resolves to the operating system being defined. + +The example below shows how to refer to the operating system being defined +in the definition of the @code{label} field: + +@example +(use-modules (gnu) (guix)) + +(operating-system + ;; ... + (label (package-full-name + (operating-system-kernel this-operating-system)))) +@end example + +It is an error to refer to @code{this-operating-system} outside an operating +system definition. +@end deffn + +@end deftp + +@node File Systems +@section File Systems + +The list of file systems to be mounted is specified in the +@code{file-systems} field of the operating system declaration (@pxref{Using +the Configuration System}). Each file system is declared using the +@code{file-system} form, like this: + +@example +(file-system + (mount-point "/home") + (device "/dev/sda3") + (type "ext4")) +@end example + +As usual, some of the fields are mandatory---those shown in the example +above---while others can be omitted. These are described below. + +@deftp {Data Type} file-system +Objects of this type represent file systems to be mounted. They contain the +following members: + +@table @asis +@item @code{type} +This is a string specifying the type of the file system---e.g., +@code{"ext4"}. + +@item @code{mount-point} +This designates the place where the file system is to be mounted. + +@item @code{device} +This names the ``source'' of the file system. It can be one of three +things: a file system label, a file system UUID, or the name of a +@file{/dev} node. Labels and UUIDs offer a way to refer to file systems +without having to hard-code their actual device name@footnote{Note that, +while it is tempting to use @file{/dev/disk/by-uuid} and similar device +names to achieve the same result, this is not recommended: These special +device nodes are created by the udev daemon and may be unavailable at the +time the device is mounted.}. + +@findex file-system-label +File system labels are created using the @code{file-system-label} procedure, +UUIDs are created using @code{uuid}, and @file{/dev} node are plain +strings. Here's an example of a file system referred to by its label, as +shown by the @command{e2label} command: + +@example +(file-system + (mount-point "/home") + (type "ext4") + (device (file-system-label "my-home"))) +@end example + +@findex uuid +UUIDs are converted from their string representation (as shown by the +@command{tune2fs -l} command) using the @code{uuid} form@footnote{The +@code{uuid} form expects 16-byte UUIDs as defined in +@uref{https://tools.ietf.org/html/rfc4122, RFC@tie{}4122}. This is the form +of UUID used by the ext2 family of file systems and others, but it is +different from ``UUIDs'' found in FAT file systems, for instance.}, like +this: + +@example +(file-system + (mount-point "/home") + (type "ext4") + (device (uuid "4dab5feb-d176-45de-b287-9b0a6e4c01cb"))) +@end example + +When the source of a file system is a mapped device (@pxref{Mapped +Devices}), its @code{device} field @emph{must} refer to the mapped device +name---e.g., @file{"/dev/mapper/root-partition"}. This is required so that +the system knows that mounting the file system depends on having the +corresponding device mapping established. + +@item @code{flags} (default: @code{'()}) +This is a list of symbols denoting mount flags. Recognized flags include +@code{read-only}, @code{bind-mount}, @code{no-dev} (disallow access to +special files), @code{no-suid} (ignore setuid and setgid bits), and +@code{no-exec} (disallow program execution.) + +@item @code{options} (default: @code{#f}) +This is either @code{#f}, or a string denoting mount options. + +@item @code{mount?} (default: @code{#t}) +This value indicates whether to automatically mount the file system when the +system is brought up. When set to @code{#f}, the file system gets an entry +in @file{/etc/fstab} (read by the @command{mount} command) but is not +automatically mounted. + +@item @code{needed-for-boot?} (default: @code{#f}) +This Boolean value indicates whether the file system is needed when +booting. If that is true, then the file system is mounted when the initial +RAM disk (initrd) is loaded. This is always the case, for instance, for the +root file system. + +@item @code{check?} (default: @code{#t}) +This Boolean indicates whether the file system needs to be checked for +errors before being mounted. + +@item @code{create-mount-point?} (default: @code{#f}) +When true, the mount point is created if it does not exist yet. + +@item @code{dependencies} (default: @code{'()}) +This is a list of @code{<file-system>} or @code{<mapped-device>} objects +representing file systems that must be mounted or mapped devices that must +be opened before (and unmounted or closed after) this one. + +As an example, consider a hierarchy of mounts: @file{/sys/fs/cgroup} is a +dependency of @file{/sys/fs/cgroup/cpu} and @file{/sys/fs/cgroup/memory}. + +Another example is a file system that depends on a mapped device, for +example for an encrypted partition (@pxref{Mapped Devices}). +@end table +@end deftp + +The @code{(gnu system file-systems)} exports the following useful variables. + +@defvr {Scheme Variable} %base-file-systems +These are essential file systems that are required on normal systems, such +as @var{%pseudo-terminal-file-system} and @var{%immutable-store} (see +below.) Operating system declarations should always contain at least these. +@end defvr + +@defvr {Scheme Variable} %pseudo-terminal-file-system +This is the file system to be mounted as @file{/dev/pts}. It supports +@dfn{pseudo-terminals} created @i{via} @code{openpty} and similar functions +(@pxref{Pseudo-Terminals,,, libc, The GNU C Library Reference Manual}). +Pseudo-terminals are used by terminal emulators such as @command{xterm}. +@end defvr + +@defvr {Scheme Variable} %shared-memory-file-system +This file system is mounted as @file{/dev/shm} and is used to support memory +sharing across processes (@pxref{Memory-mapped I/O, @code{shm_open},, libc, +The GNU C Library Reference Manual}). +@end defvr + +@defvr {Scheme Variable} %immutable-store +This file system performs a read-only ``bind mount'' of @file{/gnu/store}, +making it read-only for all the users including @code{root}. This prevents +against accidental modification by software running as @code{root} or by +system administrators. + +The daemon itself is still able to write to the store: it remounts it +read-write in its own ``name space.'' +@end defvr + +@defvr {Scheme Variable} %binary-format-file-system +The @code{binfmt_misc} file system, which allows handling of arbitrary +executable file types to be delegated to user space. This requires the +@code{binfmt.ko} kernel module to be loaded. +@end defvr + +@defvr {Scheme Variable} %fuse-control-file-system +The @code{fusectl} file system, which allows unprivileged users to mount and +unmount user-space FUSE file systems. This requires the @code{fuse.ko} +kernel module to be loaded. +@end defvr + +@node Mapped Devices +@section Mapped Devices + +@cindex device mapping +@cindex mapped devices +The Linux kernel has a notion of @dfn{device mapping}: a block device, such +as a hard disk partition, can be @dfn{mapped} into another device, usually +in @code{/dev/mapper/}, with additional processing over the data that flows +through it@footnote{Note that the GNU@tie{}Hurd makes no difference between +the concept of a ``mapped device'' and that of a file system: both boil down +to @emph{translating} input/output operations made on a file to operations +on its backing store. Thus, the Hurd implements mapped devices, like file +systems, using the generic @dfn{translator} mechanism (@pxref{Translators,,, +hurd, The GNU Hurd Reference Manual}).}. A typical example is encryption +device mapping: all writes to the mapped device are encrypted, and all reads +are deciphered, transparently. Guix extends this notion by considering any +device or set of devices that are @dfn{transformed} in some way to create a +new device; for instance, RAID devices are obtained by @dfn{assembling} +several other devices, such as hard disks or partitions, into a new one that +behaves as one partition. Other examples, not yet implemented, are LVM +logical volumes. + +Mapped devices are declared using the @code{mapped-device} form, defined as +follows; for examples, see below. + +@deftp {Data Type} mapped-device +Objects of this type represent device mappings that will be made when the +system boots up. + +@table @code +@item source +This is either a string specifying the name of the block device to be +mapped, such as @code{"/dev/sda3"}, or a list of such strings when several +devices need to be assembled for creating a new one. + +@item target +This string specifies the name of the resulting mapped device. For kernel +mappers such as encrypted devices of type @code{luks-device-mapping}, +specifying @code{"my-partition"} leads to the creation of the +@code{"/dev/mapper/my-partition"} device. For RAID devices of type +@code{raid-device-mapping}, the full device name such as @code{"/dev/md0"} +needs to be given. + +@item type +This must be a @code{mapped-device-kind} object, which specifies how +@var{source} is mapped to @var{target}. +@end table +@end deftp + +@defvr {Scheme Variable} luks-device-mapping +This defines LUKS block device encryption using the @command{cryptsetup} +command from the package with the same name. It relies on the +@code{dm-crypt} Linux kernel module. +@end defvr + +@defvr {Scheme Variable} raid-device-mapping +This defines a RAID device, which is assembled using the @code{mdadm} +command from the package with the same name. It requires a Linux kernel +module for the appropriate RAID level to be loaded, such as @code{raid456} +for RAID-4, RAID-5 or RAID-6, or @code{raid10} for RAID-10. +@end defvr + +@cindex disk encryption +@cindex LUKS +The following example specifies a mapping from @file{/dev/sda3} to +@file{/dev/mapper/home} using LUKS---the +@url{https://gitlab.com/cryptsetup/cryptsetup,Linux Unified Key Setup}, a +standard mechanism for disk encryption. The @file{/dev/mapper/home} device +can then be used as the @code{device} of a @code{file-system} declaration +(@pxref{File Systems}). + +@example +(mapped-device + (source "/dev/sda3") + (target "home") + (type luks-device-mapping)) +@end example + +Alternatively, to become independent of device numbering, one may obtain the +LUKS UUID (@dfn{unique identifier}) of the source device by a command like: + +@example +cryptsetup luksUUID /dev/sda3 +@end example + +and use it as follows: + +@example +(mapped-device + (source (uuid "cb67fc72-0d54-4c88-9d4b-b225f30b0f44")) + (target "home") + (type luks-device-mapping)) +@end example + +@cindex swap encryption +It is also desirable to encrypt swap space, since swap space may contain +sensitive data. One way to accomplish that is to use a swap file in a file +system on a device mapped via LUKS encryption. In this way, the swap file +is encrypted because the entire device is encrypted. @xref{Preparing for +Installation,,Disk Partitioning}, for an example. + +A RAID device formed of the partitions @file{/dev/sda1} and @file{/dev/sdb1} +may be declared as follows: + +@example +(mapped-device + (source (list "/dev/sda1" "/dev/sdb1")) + (target "/dev/md0") + (type raid-device-mapping)) +@end example + +The @file{/dev/md0} device can then be used as the @code{device} of a +@code{file-system} declaration (@pxref{File Systems}). Note that the RAID +level need not be given; it is chosen during the initial creation and +formatting of the RAID device and is determined automatically later. + + +@node User Accounts +@section User Accounts + +@cindex users +@cindex accounts +@cindex user accounts +User accounts and groups are entirely managed through the +@code{operating-system} declaration. They are specified with the +@code{user-account} and @code{user-group} forms: + +@example +(user-account + (name "alice") + (group "users") + (supplementary-groups '("wheel" ;allow use of sudo, etc. + "audio" ;sound card + "video" ;video devices such as webcams + "cdrom")) ;the good ol' CD-ROM + (comment "Bob's sister") + (home-directory "/home/alice")) +@end example + +When booting or upon completion of @command{guix system reconfigure}, the +system ensures that only the user accounts and groups specified in the +@code{operating-system} declaration exist, and with the specified +properties. Thus, account or group creations or modifications made by +directly invoking commands such as @command{useradd} are lost upon +reconfiguration or reboot. This ensures that the system remains exactly as +declared. + +@deftp {Data Type} user-account +Objects of this type represent user accounts. The following members may be +specified: + +@table @asis +@item @code{name} +The name of the user account. + +@item @code{group} +@cindex groups +This is the name (a string) or identifier (a number) of the user group this +account belongs to. + +@item @code{supplementary-groups} (default: @code{'()}) +Optionally, this can be defined as a list of group names that this account +belongs to. + +@item @code{uid} (default: @code{#f}) +This is the user ID for this account (a number), or @code{#f}. In the +latter case, a number is automatically chosen by the system when the account +is created. + +@item @code{comment} (default: @code{""}) +A comment about the account, such as the account owner's full name. + +@item @code{home-directory} +This is the name of the home directory for the account. + +@item @code{create-home-directory?} (default: @code{#t}) +Indicates whether the home directory of this account should be created if it +does not exist yet. + +@item @code{shell} (default: Bash) +This is a G-expression denoting the file name of a program to be used as the +shell (@pxref{G-Expressions}). + +@item @code{system?} (default: @code{#f}) +This Boolean value indicates whether the account is a ``system'' account. +System accounts are sometimes treated specially; for instance, graphical +login managers do not list them. + +@anchor{user-account-password} +@cindex password, for user accounts +@item @code{password} (default: @code{#f}) +You would normally leave this field to @code{#f}, initialize user passwords +as @code{root} with the @command{passwd} command, and then let users change +it with @command{passwd}. Passwords set with @command{passwd} are of course +preserved across reboot and reconfiguration. + +If you @emph{do} want to set an initial password for an account, then this +field must contain the encrypted password, as a string. You can use the +@code{crypt} procedure for this purpose: + +@example +(user-account + (name "charlie") + (group "users") + + ;; Specify a SHA-512-hashed initial password. + (password (crypt "InitialPassword!" "$6$abc"))) +@end example + +@quotation Note +The hash of this initial password will be available in a file in +@file{/gnu/store}, readable by all the users, so this method must be used +with care. +@end quotation + +@xref{Passphrase Storage,,, libc, The GNU C Library Reference Manual}, for +more information on password encryption, and @ref{Encryption,,, guile, GNU +Guile Reference Manual}, for information on Guile's @code{crypt} procedure. + +@end table +@end deftp + +@cindex groups +User group declarations are even simpler: + +@example +(user-group (name "students")) +@end example + +@deftp {Data Type} user-group +This type is for, well, user groups. There are just a few fields: + +@table @asis +@item @code{name} +The name of the group. + +@item @code{id} (default: @code{#f}) +The group identifier (a number). If @code{#f}, a new number is +automatically allocated when the group is created. + +@item @code{system?} (default: @code{#f}) +This Boolean value indicates whether the group is a ``system'' group. +System groups have low numerical IDs. + +@item @code{password} (default: @code{#f}) +What, user groups can have a password? Well, apparently yes. Unless +@code{#f}, this field specifies the password of the group. + +@end table +@end deftp + +For convenience, a variable lists all the basic user groups one may expect: + +@defvr {Scheme Variable} %base-groups +This is the list of basic user groups that users and/or packages expect to +be present on the system. This includes groups such as ``root'', ``wheel'', +and ``users'', as well as groups used to control access to specific devices +such as ``audio'', ``disk'', and ``cdrom''. +@end defvr + +@defvr {Scheme Variable} %base-user-accounts +This is the list of basic system accounts that programs may expect to find +on a GNU/Linux system, such as the ``nobody'' account. + +Note that the ``root'' account is not included here. It is a special-case +and is automatically added whether or not it is specified. +@end defvr + +@node Keyboard Layout +@section Keyboard Layout + +@cindex keyboard layout +@cindex keymap +To specify what each key of your keyboard does, you need to tell the +operating system what @dfn{keyboard layout} you want to use. The default, +when nothing is specified, is the US English QWERTY layout for 105-key PC +keyboards. However, German speakers will usually prefer the German QWERTZ +layout, French speakers will want the AZERTY layout, and so on; hackers +might prefer Dvorak or bépo, and they might even want to further customize +the effect of some of the keys. This section explains how to get that done. + +@cindex keyboard layout, definition +There are three components that will want to know about your keyboard +layout: + +@itemize +@item +The @emph{bootloader} may want to know what keyboard layout you want to use +(@pxref{Bootloader Configuration, @code{keyboard-layout}}). This is useful +if you want, for instance, to make sure that you can type the passphrase of +your encrypted root partition using the right layout. + +@item +The @emph{operating system kernel}, Linux, will need that so that the +console is properly configured (@pxref{operating-system Reference, +@code{keyboard-layout}}). + +@item +The @emph{graphical display server}, usually Xorg, also has its own idea of +the keyboard layout (@pxref{X Window, @code{keyboard-layout}}). +@end itemize + +Guix allows you to configure all three separately but, fortunately, it +allows you to share the same keyboard layout for all three components. + +@cindex XKB, keyboard layouts +Keyboard layouts are represented by records created by the +@code{keyboard-layout} procedure of @code{(gnu system keyboard)}. Following +the X Keyboard extension (XKB), each layout has four attributes: a name +(often a language code such as ``fi'' for Finnish or ``jp'' for Japanese), +an optional variant name, an optional keyboard model name, and a possibly +empty list of additional options. In most cases the layout name is all you +care about. Here are a few example: + +@example +;; The German QWERTZ layout. Here we assume a standard +;; "pc105" keyboard model. +(keyboard-layout "de") + +;; The bépo variant of the French layout. +(keyboard-layout "fr" "bepo") + +;; The Catalan layout. +(keyboard-layout "es" "cat") + +;; The Latin American Spanish layout. In addition, the +;; "Caps Lock" key is used as an additional "Ctrl" key, +;; and the "Menu" key is used as a "Compose" key to enter +;; accented letters. +(keyboard-layout "latam" + #:options '("ctrl:nocaps" "compose:menu")) + +;; The Russian layout for a ThinkPad keyboard. +(keyboard-layout "ru" #:model "thinkpad") + +;; The "US international" layout, which is the US layout plus +;; dead keys to enter accented characters. This is for an +;; Apple MacBook keyboard. +(keyboard-layout "us" "intl" #:model "macbook78") +@end example + +See the @file{share/X11/xkb} directory of the @code{xkeyboard-config} +package for a complete list of supported layouts, variants, and models. + +@cindex keyboard layout, configuration +Let's say you want your system to use the Turkish keyboard layout throughout +your system---bootloader, console, and Xorg. Here's what your system +configuration would look like: + +@findex set-xorg-configuration +@lisp +;; Using the Turkish layout for the bootloader, the console, +;; and for Xorg. + +(operating-system + ;; ... + (keyboard-layout (keyboard-layout "tr")) ;for the console + (bootloader (bootloader-configuration + (bootloader grub-efi-bootloader) + (target "/boot/efi") + (keyboard-layout keyboard-layout))) ;for GRUB + (services (cons (set-xorg-configuration + (xorg-configuration ;for Xorg + (keyboard-layout keyboard-layout))) + %desktop-services))) +@end lisp + +In the example above, for GRUB and for Xorg, we just refer to the +@code{keyboard-layout} field defined above, but we could just as well refer +to a different layout. The @code{set-xorg-configuration} procedure +communicates the desired Xorg configuration to the graphical log-in manager, +by default GDM. + +We've discussed how to specify the @emph{default} keyboard layout of your +system when it starts, but you can also adjust it at run time: + +@itemize +@item +If you're using GNOME, its settings panel has a ``Region & Language'' entry +where you can select one or more keyboard layouts. + +@item +Under Xorg, the @command{setxkbmap} command (from the same-named package) +allows you to change the current layout. For example, this is how you would +change the layout to US Dvorak: + +@example +setxkbmap us dvorak +@end example + +@item +The @code{loadkeys} command changes the keyboard layout in effect in the +Linux console. However, note that @code{loadkeys} does @emph{not} use the +XKB keyboard layout categorization described above. The command below loads +the French bépo layout: + +@example +loadkeys fr-bepo +@end example +@end itemize + +@node Locales +@section Locales + +@cindex locale +A @dfn{locale} defines cultural conventions for a particular language and +region of the world (@pxref{Locales,,, libc, The GNU C Library Reference +Manual}). Each locale has a name that typically has the form +@code{@var{language}_@var{territory}.@var{codeset}}---e.g., +@code{fr_LU.utf8} designates the locale for the French language, with +cultural conventions from Luxembourg, and using the UTF-8 encoding. + +@cindex locale definition +Usually, you will want to specify the default locale for the machine using +the @code{locale} field of the @code{operating-system} declaration +(@pxref{operating-system Reference, @code{locale}}). + +The selected locale is automatically added to the @dfn{locale definitions} +known to the system if needed, with its codeset inferred from its +name---e.g., @code{bo_CN.utf8} will be assumed to use the @code{UTF-8} +codeset. Additional locale definitions can be specified in the +@code{locale-definitions} slot of @code{operating-system}---this is useful, +for instance, if the codeset could not be inferred from the locale name. +The default set of locale definitions includes some widely used locales, but +not all the available locales, in order to save space. + +For instance, to add the North Frisian locale for Germany, the value of that +field may be: + +@example +(cons (locale-definition + (name "fy_DE.utf8") (source "fy_DE")) + %default-locale-definitions) +@end example + +Likewise, to save space, one might want @code{locale-definitions} to list +only the locales that are actually used, as in: + +@example +(list (locale-definition + (name "ja_JP.eucjp") (source "ja_JP") + (charset "EUC-JP"))) +@end example + +@vindex LOCPATH +The compiled locale definitions are available at +@file{/run/current-system/locale/X.Y}, where @code{X.Y} is the libc version, +which is the default location where the GNU@tie{}libc provided by Guix looks +for locale data. This can be overridden using the @code{LOCPATH} +environment variable (@pxref{locales-and-locpath, @code{LOCPATH} and locale +packages}). + +The @code{locale-definition} form is provided by the @code{(gnu system +locale)} module. Details are given below. + +@deftp {Data Type} locale-definition +This is the data type of a locale definition. + +@table @asis + +@item @code{name} +The name of the locale. @xref{Locale Names,,, libc, The GNU C Library +Reference Manual}, for more information on locale names. + +@item @code{source} +The name of the source for that locale. This is typically the +@code{@var{language}_@var{territory}} part of the locale name. + +@item @code{charset} (default: @code{"UTF-8"}) +The ``character set'' or ``code set'' for that locale, +@uref{http://www.iana.org/assignments/character-sets, as defined by IANA}. + +@end table +@end deftp + +@defvr {Scheme Variable} %default-locale-definitions +A list of commonly used UTF-8 locales, used as the default value of the +@code{locale-definitions} field of @code{operating-system} declarations. + +@cindex locale name +@cindex normalized codeset in locale names +These locale definitions use the @dfn{normalized codeset} for the part that +follows the dot in the name (@pxref{Using gettextized software, normalized +codeset,, libc, The GNU C Library Reference Manual}). So for instance it +has @code{uk_UA.utf8} but @emph{not}, say, @code{uk_UA.UTF-8}. +@end defvr + +@subsection Locale Data Compatibility Considerations + +@cindex incompatibility, of locale data +@code{operating-system} declarations provide a @code{locale-libcs} field to +specify the GNU@tie{}libc packages that are used to compile locale +declarations (@pxref{operating-system Reference}). ``Why would I care?'', +you may ask. Well, it turns out that the binary format of locale data is +occasionally incompatible from one libc version to another. + +@c See <https://sourceware.org/ml/libc-alpha/2015-09/msg00575.html> +@c and <https://lists.gnu.org/archive/html/guix-devel/2015-08/msg00737.html>. +For instance, a program linked against libc version 2.21 is unable to read +locale data produced with libc 2.22; worse, that program @emph{aborts} +instead of simply ignoring the incompatible locale data@footnote{Versions +2.23 and later of GNU@tie{}libc will simply skip the incompatible locale +data, which is already an improvement.}. Similarly, a program linked +against libc 2.22 can read most, but not all, of the locale data from libc +2.21 (specifically, @code{LC_COLLATE} data is incompatible); thus calls to +@code{setlocale} may fail, but programs will not abort. + +The ``problem'' with Guix is that users have a lot of freedom: They can +choose whether and when to upgrade software in their profiles, and might be +using a libc version different from the one the system administrator used to +build the system-wide locale data. + +Fortunately, unprivileged users can also install their own locale data and +define @var{GUIX_LOCPATH} accordingly (@pxref{locales-and-locpath, +@code{GUIX_LOCPATH} and locale packages}). + +Still, it is best if the system-wide locale data at +@file{/run/current-system/locale} is built for all the libc versions +actually in use on the system, so that all the programs can access it---this +is especially crucial on a multi-user system. To do that, the administrator +can specify several libc packages in the @code{locale-libcs} field of +@code{operating-system}: + +@example +(use-package-modules base) + +(operating-system + ;; @dots{} + (locale-libcs (list glibc-2.21 (canonical-package glibc)))) +@end example + +This example would lead to a system containing locale definitions for both +libc 2.21 and the current version of libc in +@file{/run/current-system/locale}. + + +@node Services +@section Services + +@cindex system services +An important part of preparing an @code{operating-system} declaration is +listing @dfn{system services} and their configuration (@pxref{Using the +Configuration System}). System services are typically daemons launched when +the system boots, or other actions needed at that time---e.g., configuring +network access. + +Guix has a broad definition of ``service'' (@pxref{Service Composition}), +but many services are managed by the GNU@tie{}Shepherd (@pxref{Shepherd +Services}). On a running system, the @command{herd} command allows you to +list the available services, show their status, start and stop them, or do +other specific operations (@pxref{Jump Start,,, shepherd, The GNU Shepherd +Manual}). For example: + +@example +# herd status +@end example + +The above command, run as @code{root}, lists the currently defined +services. The @command{herd doc} command shows a synopsis of the given +service and its associated actions: + +@example +# herd doc nscd +Run libc's name service cache daemon (nscd). + +# herd doc nscd action invalidate +invalidate: Invalidate the given cache--e.g., 'hosts' for host name lookups. +@end example + +The @command{start}, @command{stop}, and @command{restart} sub-commands have +the effect you would expect. For instance, the commands below stop the nscd +service and restart the Xorg display server: + +@example +# herd stop nscd +Service nscd has been stopped. +# herd restart xorg-server +Service xorg-server has been stopped. +Service xorg-server has been started. +@end example + +The following sections document the available services, starting with the +core services, that may be used in an @code{operating-system} declaration. + +@menu +* Base Services:: Essential system services. +* Scheduled Job Execution:: The mcron service. +* Log Rotation:: The rottlog service. +* Networking Services:: Network setup, SSH daemon, etc. +* X Window:: Graphical display. +* Printing Services:: Local and remote printer support. +* Desktop Services:: D-Bus and desktop services. +* Sound Services:: ALSA and Pulseaudio services. +* Database Services:: SQL databases, key-value stores, etc. +* Mail Services:: IMAP, POP3, SMTP, and all that. +* Messaging Services:: Messaging services. +* Telephony Services:: Telephony services. +* Monitoring Services:: Monitoring services. +* Kerberos Services:: Kerberos services. +* LDAP Services:: LDAP services. +* Web Services:: Web servers. +* Certificate Services:: TLS certificates via Let's Encrypt. +* DNS Services:: DNS daemons. +* VPN Services:: VPN daemons. +* Network File System:: NFS related services. +* Continuous Integration:: The Cuirass service. +* Power Management Services:: Extending battery life. +* Audio Services:: The MPD. +* Virtualization Services:: Virtualization services. +* Version Control Services:: Providing remote access to Git repositories. +* Game Services:: Game servers. +* Miscellaneous Services:: Other services. +@end menu + +@node Base Services +@subsection Base Services + +The @code{(gnu services base)} module provides definitions for the basic +services that one expects from the system. The services exported by this +module are listed below. + +@defvr {Scheme Variable} %base-services +This variable contains a list of basic services (@pxref{Service Types and +Services}, for more information on service objects) one would expect from +the system: a login service (mingetty) on each tty, syslogd, the libc name +service cache daemon (nscd), the udev device manager, and more. + +This is the default value of the @code{services} field of +@code{operating-system} declarations. Usually, when customizing a system, +you will want to append services to @var{%base-services}, like this: + +@example +(append (list (service avahi-service-type) + (service openssh-service-type)) + %base-services) +@end example +@end defvr + +@defvr {Scheme Variable} special-files-service-type +This is the service that sets up ``special files'' such as @file{/bin/sh}; +an instance of it is part of @code{%base-services}. + +The value associated with @code{special-files-service-type} services must be +a list of tuples where the first element is the ``special file'' and the +second element is its target. By default it is: + +@cindex @file{/bin/sh} +@cindex @file{sh}, in @file{/bin} +@example +`(("/bin/sh" ,(file-append @var{bash} "/bin/sh"))) +@end example + +@cindex @file{/usr/bin/env} +@cindex @file{env}, in @file{/usr/bin} +If you want to add, say, @code{/usr/bin/env} to your system, you can change +it to: + +@example +`(("/bin/sh" ,(file-append @var{bash} "/bin/sh")) + ("/usr/bin/env" ,(file-append @var{coreutils} "/bin/env"))) +@end example + +Since this is part of @code{%base-services}, you can use +@code{modify-services} to customize the set of special files (@pxref{Service +Reference, @code{modify-services}}). But the simple way to add a special +file is @i{via} the @code{extra-special-file} procedure (see below.) +@end defvr + +@deffn {Scheme Procedure} extra-special-file @var{file} @var{target} +Use @var{target} as the ``special file'' @var{file}. + +For example, adding the following lines to the @code{services} field of your +operating system declaration leads to a @file{/usr/bin/env} symlink: + +@example +(extra-special-file "/usr/bin/env" + (file-append coreutils "/bin/env")) +@end example +@end deffn + +@deffn {Scheme Procedure} host-name-service @var{name} +Return a service that sets the host name to @var{name}. +@end deffn + +@deffn {Scheme Procedure} login-service @var{config} +Return a service to run login according to @var{config}, a +@code{<login-configuration>} object, which specifies the message of the day, +among other things. +@end deffn + +@deftp {Data Type} login-configuration +This is the data type representing the configuration of login. + +@table @asis + +@item @code{motd} +@cindex message of the day +A file-like object containing the ``message of the day''. + +@item @code{allow-empty-passwords?} (default: @code{#t}) +Allow empty passwords by default so that first-time users can log in when +the 'root' account has just been created. + +@end table +@end deftp + +@deffn {Scheme Procedure} mingetty-service @var{config} +Return a service to run mingetty according to @var{config}, a +@code{<mingetty-configuration>} object, which specifies the tty to run, +among other things. +@end deffn + +@deftp {Data Type} mingetty-configuration +This is the data type representing the configuration of Mingetty, which +provides the default implementation of virtual console log-in. + +@table @asis + +@item @code{tty} +The name of the console this Mingetty runs on---e.g., @code{"tty1"}. + +@item @code{auto-login} (default: @code{#f}) +When true, this field must be a string denoting the user name under which +the system automatically logs in. When it is @code{#f}, a user name and +password must be entered to log in. + +@item @code{login-program} (default: @code{#f}) +This must be either @code{#f}, in which case the default log-in program is +used (@command{login} from the Shadow tool suite), or a gexp denoting the +name of the log-in program. + +@item @code{login-pause?} (default: @code{#f}) +When set to @code{#t} in conjunction with @var{auto-login}, the user will +have to press a key before the log-in shell is launched. + +@item @code{mingetty} (default: @var{mingetty}) +The Mingetty package to use. + +@end table +@end deftp + +@deffn {Scheme Procedure} agetty-service @var{config} +Return a service to run agetty according to @var{config}, an +@code{<agetty-configuration>} object, which specifies the tty to run, among +other things. +@end deffn + +@deftp {Data Type} agetty-configuration +This is the data type representing the configuration of agetty, which +implements virtual and serial console log-in. See the @code{agetty(8)} man +page for more information. + +@table @asis + +@item @code{tty} +The name of the console this agetty runs on, as a string---e.g., +@code{"ttyS0"}. This argument is optional, it will default to a reasonable +default serial port used by the kernel Linux. + +For this, if there is a value for an option @code{agetty.tty} in the kernel +command line, agetty will extract the device name of the serial port from it +and use that. + +If not and if there is a value for an option @code{console} with a tty in +the Linux command line, agetty will extract the device name of the serial +port from it and use that. + +In both cases, agetty will leave the other serial device settings (baud rate +etc.)@: alone---in the hope that Linux pinned them to the correct values. + +@item @code{baud-rate} (default: @code{#f}) +A string containing a comma-separated list of one or more baud rates, in +descending order. + +@item @code{term} (default: @code{#f}) +A string containing the value used for the @code{TERM} environment variable. + +@item @code{eight-bits?} (default: @code{#f}) +When @code{#t}, the tty is assumed to be 8-bit clean, and parity detection +is disabled. + +@item @code{auto-login} (default: @code{#f}) +When passed a login name, as a string, the specified user will be logged in +automatically without prompting for their login name or password. + +@item @code{no-reset?} (default: @code{#f}) +When @code{#t}, don't reset terminal cflags (control modes). + +@item @code{host} (default: @code{#f}) +This accepts a string containing the "login_host", which will be written +into the @file{/var/run/utmpx} file. + +@item @code{remote?} (default: @code{#f}) +When set to @code{#t} in conjunction with @var{host}, this will add an +@code{-r} fakehost option to the command line of the login program specified +in @var{login-program}. + +@item @code{flow-control?} (default: @code{#f}) +When set to @code{#t}, enable hardware (RTS/CTS) flow control. + +@item @code{no-issue?} (default: @code{#f}) +When set to @code{#t}, the contents of the @file{/etc/issue} file will not +be displayed before presenting the login prompt. + +@item @code{init-string} (default: @code{#f}) +This accepts a string that will be sent to the tty or modem before sending +anything else. It can be used to initialize a modem. + +@item @code{no-clear?} (default: @code{#f}) +When set to @code{#t}, agetty will not clear the screen before showing the +login prompt. + +@item @code{login-program} (default: (file-append shadow "/bin/login")) +This must be either a gexp denoting the name of a log-in program, or unset, +in which case the default value is the @command{login} from the Shadow tool +suite. + +@item @code{local-line} (default: @code{#f}) +Control the CLOCAL line flag. This accepts one of three symbols as +arguments, @code{'auto}, @code{'always}, or @code{'never}. If @code{#f}, the +default value chosen by agetty is @code{'auto}. + +@item @code{extract-baud?} (default: @code{#f}) +When set to @code{#t}, instruct agetty to try to extract the baud rate from +the status messages produced by certain types of modems. + +@item @code{skip-login?} (default: @code{#f}) +When set to @code{#t}, do not prompt the user for a login name. This can be +used with @var{login-program} field to use non-standard login systems. + +@item @code{no-newline?} (default: @code{#f}) +When set to @code{#t}, do not print a newline before printing the +@file{/etc/issue} file. + +@c Is this dangerous only when used with login-program, or always? +@item @code{login-options} (default: @code{#f}) +This option accepts a string containing options that are passed to the login +program. When used with the @var{login-program}, be aware that a malicious +user could try to enter a login name containing embedded options that could +be parsed by the login program. + +@item @code{login-pause} (default: @code{#f}) +When set to @code{#t}, wait for any key before showing the login prompt. +This can be used in conjunction with @var{auto-login} to save memory by +lazily spawning shells. + +@item @code{chroot} (default: @code{#f}) +Change root to the specified directory. This option accepts a directory +path as a string. + +@item @code{hangup?} (default: @code{#f}) +Use the Linux system call @code{vhangup} to do a virtual hangup of the +specified terminal. + +@item @code{keep-baud?} (default: @code{#f}) +When set to @code{#t}, try to keep the existing baud rate. The baud rates +from @var{baud-rate} are used when agetty receives a @key{BREAK} character. + +@item @code{timeout} (default: @code{#f}) +When set to an integer value, terminate if no user name could be read within +@var{timeout} seconds. + +@item @code{detect-case?} (default: @code{#f}) +When set to @code{#t}, turn on support for detecting an uppercase-only +terminal. This setting will detect a login name containing only uppercase +letters as indicating an uppercase-only terminal and turn on some +upper-to-lower case conversions. Note that this will not support Unicode +characters. + +@item @code{wait-cr?} (default: @code{#f}) +When set to @code{#t}, wait for the user or modem to send a carriage-return +or linefeed character before displaying @file{/etc/issue} or login prompt. +This is typically used with the @var{init-string} option. + +@item @code{no-hints?} (default: @code{#f}) +When set to @code{#t}, do not print hints about Num, Caps, and Scroll locks. + +@item @code{no-hostname?} (default: @code{#f}) +By default, the hostname is printed. When this option is set to @code{#t}, +no hostname will be shown at all. + +@item @code{long-hostname?} (default: @code{#f}) +By default, the hostname is only printed until the first dot. When this +option is set to @code{#t}, the fully qualified hostname by +@code{gethostname} or @code{getaddrinfo} is shown. + +@item @code{erase-characters} (default: @code{#f}) +This option accepts a string of additional characters that should be +interpreted as backspace when the user types their login name. + +@item @code{kill-characters} (default: @code{#f}) +This option accepts a string that should be interpreted to mean "ignore all +previous characters" (also called a "kill" character) when the types their +login name. + +@item @code{chdir} (default: @code{#f}) +This option accepts, as a string, a directory path that will be changed to +before login. + +@item @code{delay} (default: @code{#f}) +This options accepts, as an integer, the number of seconds to sleep before +opening the tty and displaying the login prompt. + +@item @code{nice} (default: @code{#f}) +This option accepts, as an integer, the nice value with which to run the +@command{login} program. + +@item @code{extra-options} (default: @code{'()}) +This option provides an "escape hatch" for the user to provide arbitrary +command-line arguments to @command{agetty} as a list of strings. + +@end table +@end deftp + +@deffn {Scheme Procedure} kmscon-service-type @var{config} +Return a service to run +@uref{https://www.freedesktop.org/wiki/Software/kmscon,kmscon} according to +@var{config}, a @code{<kmscon-configuration>} object, which specifies the +tty to run, among other things. +@end deffn + +@deftp {Data Type} kmscon-configuration +This is the data type representing the configuration of Kmscon, which +implements virtual console log-in. + +@table @asis + +@item @code{virtual-terminal} +The name of the console this Kmscon runs on---e.g., @code{"tty1"}. + +@item @code{login-program} (default: @code{#~(string-append #$shadow "/bin/login")}) +A gexp denoting the name of the log-in program. The default log-in program +is @command{login} from the Shadow tool suite. + +@item @code{login-arguments} (default: @code{'("-p")}) +A list of arguments to pass to @command{login}. + +@item @code{auto-login} (default: @code{#f}) +When passed a login name, as a string, the specified user will be logged in +automatically without prompting for their login name or password. + +@item @code{hardware-acceleration?} (default: #f) +Whether to use hardware acceleration. + +@item @code{kmscon} (default: @var{kmscon}) +The Kmscon package to use. + +@end table +@end deftp + +@cindex name service cache daemon +@cindex nscd +@deffn {Scheme Procedure} nscd-service [@var{config}] [#:glibc glibc] @ + [#:name-services '()] Return a service that runs the libc name service cache +daemon (nscd) with the given @var{config}---an @code{<nscd-configuration>} +object. @xref{Name Service Switch}, for an example. + +For convenience, the Shepherd service for nscd provides the following +actions: + +@table @code +@item invalidate +@cindex cache invalidation, nscd +@cindex nscd, cache invalidation +This invalidate the given cache. For instance, running: + +@example +herd invalidate nscd hosts +@end example + +@noindent +invalidates the host name lookup cache of nscd. + +@item statistics +Running @command{herd statistics nscd} displays information about nscd usage +and caches. +@end table + +@end deffn + +@defvr {Scheme Variable} %nscd-default-configuration +This is the default @code{<nscd-configuration>} value (see below) used by +@code{nscd-service}. It uses the caches defined by +@var{%nscd-default-caches}; see below. +@end defvr + +@deftp {Data Type} nscd-configuration +This is the data type representing the name service cache daemon (nscd) +configuration. + +@table @asis + +@item @code{name-services} (default: @code{'()}) +List of packages denoting @dfn{name services} that must be visible to the +nscd---e.g., @code{(list @var{nss-mdns})}. + +@item @code{glibc} (default: @var{glibc}) +Package object denoting the GNU C Library providing the @command{nscd} +command. + +@item @code{log-file} (default: @code{"/var/log/nscd.log"}) +Name of the nscd log file. This is where debugging output goes when +@code{debug-level} is strictly positive. + +@item @code{debug-level} (default: @code{0}) +Integer denoting the debugging levels. Higher numbers mean that more +debugging output is logged. + +@item @code{caches} (default: @var{%nscd-default-caches}) +List of @code{<nscd-cache>} objects denoting things to be cached; see below. + +@end table +@end deftp + +@deftp {Data Type} nscd-cache +Data type representing a cache database of nscd and its parameters. + +@table @asis + +@item @code{database} +This is a symbol representing the name of the database to be cached. Valid +values are @code{passwd}, @code{group}, @code{hosts}, and @code{services}, +which designate the corresponding NSS database (@pxref{NSS Basics,,, libc, +The GNU C Library Reference Manual}). + +@item @code{positive-time-to-live} +@itemx @code{negative-time-to-live} (default: @code{20}) +A number representing the number of seconds during which a positive or +negative lookup result remains in cache. + +@item @code{check-files?} (default: @code{#t}) +Whether to check for updates of the files corresponding to @var{database}. + +For instance, when @var{database} is @code{hosts}, setting this flag +instructs nscd to check for updates in @file{/etc/hosts} and to take them +into account. + +@item @code{persistent?} (default: @code{#t}) +Whether the cache should be stored persistently on disk. + +@item @code{shared?} (default: @code{#t}) +Whether the cache should be shared among users. + +@item @code{max-database-size} (default: 32@tie{}MiB) +Maximum size in bytes of the database cache. + +@c XXX: 'suggested-size' and 'auto-propagate?' seem to be expert +@c settings, so leave them out. + +@end table +@end deftp + +@defvr {Scheme Variable} %nscd-default-caches +List of @code{<nscd-cache>} objects used by default by +@code{nscd-configuration} (see above). + +It enables persistent and aggressive caching of service and host name +lookups. The latter provides better host name lookup performance, +resilience in the face of unreliable name servers, and also better +privacy---often the result of host name lookups is in local cache, so +external name servers do not even need to be queried. +@end defvr + +@anchor{syslog-configuration-type} +@cindex syslog +@cindex logging +@deftp {Data Type} syslog-configuration +This data type represents the configuration of the syslog daemon. + +@table @asis +@item @code{syslogd} (default: @code{#~(string-append #$inetutils "/libexec/syslogd")}) +The syslog daemon to use. + +@item @code{config-file} (default: @code{%default-syslog.conf}) +The syslog configuration file to use. + +@end table +@end deftp + +@anchor{syslog-service} +@cindex syslog +@deffn {Scheme Procedure} syslog-service @var{config} +Return a service that runs a syslog daemon according to @var{config}. + +@xref{syslogd invocation,,, inetutils, GNU Inetutils}, for more information +on the configuration file syntax. +@end deffn + +@defvr {Scheme Variable} guix-service-type +This is the type of the service that runs the build daemon, +@command{guix-daemon} (@pxref{Invoking guix-daemon}). Its value must be a +@code{guix-configuration} record as described below. +@end defvr + +@anchor{guix-configuration-type} +@deftp {Data Type} guix-configuration +This data type represents the configuration of the Guix build daemon. +@xref{Invoking guix-daemon}, for more information. + +@table @asis +@item @code{guix} (default: @var{guix}) +The Guix package to use. + +@item @code{build-group} (default: @code{"guixbuild"}) +Name of the group for build user accounts. + +@item @code{build-accounts} (default: @code{10}) +Number of build user accounts to create. + +@item @code{authorize-key?} (default: @code{#t}) +@cindex substitutes, authorization thereof +Whether to authorize the substitute keys listed in +@code{authorized-keys}---by default that of @code{@value{SUBSTITUTE-SERVER}} +(@pxref{Substitutes}). + +@vindex %default-authorized-guix-keys +@item @code{authorized-keys} (default: @var{%default-authorized-guix-keys}) +The list of authorized key files for archive imports, as a list of +string-valued gexps (@pxref{Invoking guix archive}). By default, it +contains that of @code{@value{SUBSTITUTE-SERVER}} (@pxref{Substitutes}). + +@item @code{use-substitutes?} (default: @code{#t}) +Whether to use substitutes. + +@item @code{substitute-urls} (default: @var{%default-substitute-urls}) +The list of URLs where to look for substitutes by default. + +@item @code{max-silent-time} (default: @code{0}) +@itemx @code{timeout} (default: @code{0}) +The number of seconds of silence and the number of seconds of activity, +respectively, after which a build process times out. A value of zero +disables the timeout. + +@item @code{log-compression} (default: @code{'bzip2}) +The type of compression used for build logs---one of @code{gzip}, +@code{bzip2}, or @code{none}. + +@item @code{extra-options} (default: @code{'()}) +List of extra command-line options for @command{guix-daemon}. + +@item @code{log-file} (default: @code{"/var/log/guix-daemon.log"}) +File where @command{guix-daemon}'s standard output and standard error are +written. + +@item @code{http-proxy} (default: @code{#f}) +The HTTP proxy used for downloading fixed-output derivations and +substitutes. + +@item @code{tmpdir} (default: @code{#f}) +A directory path where the @command{guix-daemon} will perform builds. + +@end table +@end deftp + +@deffn {Scheme Procedure} udev-service [#:udev @var{eudev} #:rules @code{'()}] +Run @var{udev}, which populates the @file{/dev} directory dynamically. udev +rules can be provided as a list of files through the @var{rules} variable. +The procedures @var{udev-rule} and @var{file->udev-rule} from @code{(gnu +services base)} simplify the creation of such rule files. +@end deffn + +@deffn {Scheme Procedure} udev-rule [@var{file-name} @var{contents}] +Return a udev-rule file named @var{file-name} containing the rules defined +by the @var{contents} literal. + +In the following example, a rule for a USB device is defined to be stored in +the file @file{90-usb-thing.rules}. The rule runs a script upon detecting a +USB device with a given product identifier. + +@example +(define %example-udev-rule + (udev-rule + "90-usb-thing.rules" + (string-append "ACTION==\"add\", SUBSYSTEM==\"usb\", " + "ATTR@{product@}==\"Example\", " + "RUN+=\"/path/to/script\""))) +@end example + +The @command{herd rules udev} command, as root, returns the name of the +directory containing all the active udev rules. +@end deffn + +Here we show how the default @var{udev-service} can be extended with it. + +@example +(operating-system + ;; @dots{} + (services + (modify-services %desktop-services + (udev-service-type config => + (udev-configuration (inherit config) + (rules (append (udev-configuration-rules config) + (list %example-udev-rule)))))))) +@end example + +@deffn {Scheme Procedure} file->udev-rule [@var{file-name} @var{file}] +Return a udev file named @var{file-name} containing the rules defined within +@var{file}, a file-like object. + +The following example showcases how we can use an existing rule file. + +@example +(use-modules (guix download) ;for url-fetch + (guix packages) ;for origin + ;; @dots{}) + +(define %android-udev-rules + (file->udev-rule + "51-android-udev.rules" + (let ((version "20170910")) + (origin + (method url-fetch) + (uri (string-append "https://raw.githubusercontent.com/M0Rf30/" + "android-udev-rules/" version "/51-android.rules")) + (sha256 + (base32 "0lmmagpyb6xsq6zcr2w1cyx9qmjqmajkvrdbhjx32gqf1d9is003")))))) +@end example +@end deffn + +Additionally, Guix package definitions can be included in @var{rules} in +order to extend the udev rules with the definitions found under their +@file{lib/udev/rules.d} sub-directory. In lieu of the previous +@var{file->udev-rule} example, we could have used the +@var{android-udev-rules} package which exists in Guix in the @code{(gnu +packages android)} module. + +The following example shows how to use the @var{android-udev-rules} package +so that the Android tool @command{adb} can detect devices without root +privileges. It also details how to create the @code{adbusers} group, which +is required for the proper functioning of the rules defined within the +@var{android-udev-rules} package. To create such a group, we must define it +both as part of the @var{supplementary-groups} of our @var{user-account} +declaration, as well as in the @var{groups} field of the +@var{operating-system} record. + +@example +(use-modules (gnu packages android) ;for android-udev-rules + (gnu system shadow) ;for user-group + ;; @dots{}) + +(operating-system + ;; @dots{} + (users (cons (user-acount + ;; @dots{} + (supplementary-groups + '("adbusers" ;for adb + "wheel" "netdev" "audio" "video")) + ;; @dots{}))) + + (groups (cons (user-group (system? #t) (name "adbusers")) + %base-groups)) + + ;; @dots{} + + (services + (modify-services %desktop-services + (udev-service-type + config => + (udev-configuration (inherit config) + (rules (cons android-udev-rules + (udev-configuration-rules config)))))))) +@end example + +@defvr {Scheme Variable} urandom-seed-service-type +Save some entropy in @var{%random-seed-file} to seed @file{/dev/urandom} +when rebooting. It also tries to seed @file{/dev/urandom} from +@file{/dev/hwrng} while booting, if @file{/dev/hwrng} exists and is +readable. +@end defvr + +@defvr {Scheme Variable} %random-seed-file +This is the name of the file where some random bytes are saved by +@var{urandom-seed-service} to seed @file{/dev/urandom} when rebooting. It +defaults to @file{/var/lib/random-seed}. +@end defvr + +@cindex mouse +@cindex gpm +@defvr {Scheme Variable} gpm-service-type +This is the type of the service that runs GPM, the @dfn{general-purpose +mouse daemon}, which provides mouse support to the Linux console. GPM +allows users to use the mouse in the console, notably to select, copy, and +paste text. + +The value for services of this type must be a @code{gpm-configuration} (see +below). This service is not part of @var{%base-services}. +@end defvr + +@deftp {Data Type} gpm-configuration +Data type representing the configuration of GPM. + +@table @asis +@item @code{options} (default: @code{%default-gpm-options}) +Command-line options passed to @command{gpm}. The default set of options +instruct @command{gpm} to listen to mouse events on @file{/dev/input/mice}. +@xref{Command Line,,, gpm, gpm manual}, for more information. + +@item @code{gpm} (default: @code{gpm}) +The GPM package to use. + +@end table +@end deftp + +@anchor{guix-publish-service-type} +@deffn {Scheme Variable} guix-publish-service-type +This is the service type for @command{guix publish} (@pxref{Invoking guix +publish}). Its value must be a @code{guix-configuration} object, as +described below. + +This assumes that @file{/etc/guix} already contains a signing key pair as +created by @command{guix archive --generate-key} (@pxref{Invoking guix +archive}). If that is not the case, the service will fail to start. +@end deffn + +@deftp {Data Type} guix-publish-configuration +Data type representing the configuration of the @code{guix publish} service. + +@table @asis +@item @code{guix} (default: @code{guix}) +The Guix package to use. + +@item @code{port} (default: @code{80}) +The TCP port to listen for connections. + +@item @code{host} (default: @code{"localhost"}) +The host (and thus, network interface) to listen to. Use @code{"0.0.0.0"} +to listen on all the network interfaces. + +@item @code{compression-level} (default: @code{3}) +The gzip compression level at which substitutes are compressed. Use +@code{0} to disable compression altogether, and @code{9} to get the best +compression ratio at the expense of increased CPU usage. + +@item @code{nar-path} (default: @code{"nar"}) +The URL path at which ``nars'' can be fetched. @xref{Invoking guix publish, +@code{--nar-path}}, for details. + +@item @code{cache} (default: @code{#f}) +When it is @code{#f}, disable caching and instead generate archives on +demand. Otherwise, this should be the name of a directory---e.g., +@code{"/var/cache/guix/publish"}---where @command{guix publish} caches +archives and meta-data ready to be sent. @xref{Invoking guix publish, +@option{--cache}}, for more information on the tradeoffs involved. + +@item @code{workers} (default: @code{#f}) +When it is an integer, this is the number of worker threads used for +caching; when @code{#f}, the number of processors is used. @xref{Invoking +guix publish, @option{--workers}}, for more information. + +@item @code{ttl} (default: @code{#f}) +When it is an integer, this denotes the @dfn{time-to-live} in seconds of the +published archives. @xref{Invoking guix publish, @option{--ttl}}, for more +information. +@end table +@end deftp + +@anchor{rngd-service} +@deffn {Scheme Procedure} rngd-service [#:rng-tools @var{rng-tools}] @ + [#:device "/dev/hwrng"] Return a service that runs the @command{rngd} +program from @var{rng-tools} to add @var{device} to the kernel's entropy +pool. The service will fail if @var{device} does not exist. +@end deffn + +@anchor{pam-limits-service} +@cindex session limits +@cindex ulimit +@cindex priority +@cindex realtime +@cindex jackd +@deffn {Scheme Procedure} pam-limits-service [#:limits @code{'()}] + +Return a service that installs a configuration file for the +@uref{http://linux-pam.org/Linux-PAM-html/sag-pam_limits.html, +@code{pam_limits} module}. The procedure optionally takes a list of +@code{pam-limits-entry} values, which can be used to specify @code{ulimit} +limits and nice priority limits to user sessions. + +The following limits definition sets two hard and soft limits for all login +sessions of users in the @code{realtime} group: + +@example +(pam-limits-service + (list + (pam-limits-entry "@@realtime" 'both 'rtprio 99) + (pam-limits-entry "@@realtime" 'both 'memlock 'unlimited))) +@end example + +The first entry increases the maximum realtime priority for non-privileged +processes; the second entry lifts any restriction of the maximum address +space that can be locked in memory. These settings are commonly used for +real-time audio systems. +@end deffn + +@node Scheduled Job Execution +@subsection Scheduled Job Execution + +@cindex cron +@cindex mcron +@cindex scheduling jobs +The @code{(gnu services mcron)} module provides an interface to +GNU@tie{}mcron, a daemon to run jobs at scheduled times (@pxref{Top,,, +mcron, GNU@tie{}mcron}). GNU@tie{}mcron is similar to the traditional Unix +@command{cron} daemon; the main difference is that it is implemented in +Guile Scheme, which provides a lot of flexibility when specifying the +scheduling of jobs and their actions. + +The example below defines an operating system that runs the +@command{updatedb} (@pxref{Invoking updatedb,,, find, Finding Files}) and +the @command{guix gc} commands (@pxref{Invoking guix gc}) daily, as well as +the @command{mkid} command on behalf of an unprivileged user (@pxref{mkid +invocation,,, idutils, ID Database Utilities}). It uses gexps to introduce +job definitions that are passed to mcron (@pxref{G-Expressions}). + +@lisp +(use-modules (guix) (gnu) (gnu services mcron)) +(use-package-modules base idutils) + +(define updatedb-job + ;; Run 'updatedb' at 3AM every day. Here we write the + ;; job's action as a Scheme procedure. + #~(job '(next-hour '(3)) + (lambda () + (execl (string-append #$findutils "/bin/updatedb") + "updatedb" + "--prunepaths=/tmp /var/tmp /gnu/store")))) + +(define garbage-collector-job + ;; Collect garbage 5 minutes after midnight every day. + ;; The job's action is a shell command. + #~(job "5 0 * * *" ;Vixie cron syntax + "guix gc -F 1G")) + +(define idutils-job + ;; Update the index database as user "charlie" at 12:15PM + ;; and 19:15PM. This runs from the user's home directory. + #~(job '(next-minute-from (next-hour '(12 19)) '(15)) + (string-append #$idutils "/bin/mkid src") + #:user "charlie")) + +(operating-system + ;; @dots{} + (services (cons (service mcron-service-type + (mcron-configuration + (jobs (list garbage-collector-job + updatedb-job + idutils-job)))) + %base-services))) +@end lisp + +@xref{Guile Syntax, mcron job specifications,, mcron, GNU@tie{}mcron}, for +more information on mcron job specifications. Below is the reference of the +mcron service. + +On a running system, you can use the @code{schedule} action of the service +to visualize the mcron jobs that will be executed next: + +@example +# herd schedule mcron +@end example + +@noindent +The example above lists the next five tasks that will be executed, but you +can also specify the number of tasks to display: + +@example +# herd schedule mcron 10 +@end example + +@defvr {Scheme Variable} mcron-service-type +This is the type of the @code{mcron} service, whose value is an +@code{mcron-configuration} object. + +This service type can be the target of a service extension that provides it +additional job specifications (@pxref{Service Composition}). In other +words, it is possible to define services that provide additional mcron jobs +to run. +@end defvr + +@deftp {Data Type} mcron-configuration +Data type representing the configuration of mcron. + +@table @asis +@item @code{mcron} (default: @var{mcron}) +The mcron package to use. + +@item @code{jobs} +This is a list of gexps (@pxref{G-Expressions}), where each gexp corresponds +to an mcron job specification (@pxref{Syntax, mcron job specifications,, +mcron, GNU@tie{}mcron}). +@end table +@end deftp + + +@node Log Rotation +@subsection Log Rotation + +@cindex rottlog +@cindex log rotation +@cindex logging +Log files such as those found in @file{/var/log} tend to grow endlessly, so +it's a good idea to @dfn{rotate} them once in a while---i.e., archive their +contents in separate files, possibly compressed. The @code{(gnu services +admin)} module provides an interface to GNU@tie{}Rot[t]log, a log rotation +tool (@pxref{Top,,, rottlog, GNU Rot[t]log Manual}). + +The example below defines an operating system that provides log rotation +with the default settings, for commonly encountered log files. + +@lisp +(use-modules (guix) (gnu)) +(use-service-modules admin mcron) +(use-package-modules base idutils) + +(operating-system + ;; @dots{} + (services (cons (service rottlog-service-type) + %base-services))) +@end lisp + +@defvr {Scheme Variable} rottlog-service-type +This is the type of the Rottlog service, whose value is a +@code{rottlog-configuration} object. + +Other services can extend this one with new @code{log-rotation} objects (see +below), thereby augmenting the set of files to be rotated. + +This service type can define mcron jobs (@pxref{Scheduled Job Execution}) to +run the rottlog service. +@end defvr + +@deftp {Data Type} rottlog-configuration +Data type representing the configuration of rottlog. + +@table @asis +@item @code{rottlog} (default: @code{rottlog}) +The Rottlog package to use. + +@item @code{rc-file} (default: @code{(file-append rottlog "/etc/rc")}) +The Rottlog configuration file to use (@pxref{Mandatory RC Variables,,, +rottlog, GNU Rot[t]log Manual}). + +@item @code{rotations} (default: @code{%default-rotations}) +A list of @code{log-rotation} objects as defined below. + +@item @code{jobs} +This is a list of gexps where each gexp corresponds to an mcron job +specification (@pxref{Scheduled Job Execution}). +@end table +@end deftp + +@deftp {Data Type} log-rotation +Data type representing the rotation of a group of log files. + +Taking an example from the Rottlog manual (@pxref{Period Related File +Examples,,, rottlog, GNU Rot[t]log Manual}), a log rotation might be defined +like this: + +@example +(log-rotation + (frequency 'daily) + (files '("/var/log/apache/*")) + (options '("storedir apache-archives" + "rotate 6" + "notifempty" + "nocompress"))) +@end example + +The list of fields is as follows: + +@table @asis +@item @code{frequency} (default: @code{'weekly}) +The log rotation frequency, a symbol. + +@item @code{files} +The list of files or file glob patterns to rotate. + +@item @code{options} (default: @code{'()}) +The list of rottlog options for this rotation (@pxref{Configuration +parameters,,, rottlog, GNU Rot[t]lg Manual}). + +@item @code{post-rotate} (default: @code{#f}) +Either @code{#f} or a gexp to execute once the rotation has completed. +@end table +@end deftp + +@defvr {Scheme Variable} %default-rotations +Specifies weekly rotation of @var{%rotated-files} and a couple of other +files. +@end defvr + +@defvr {Scheme Variable} %rotated-files +The list of syslog-controlled files to be rotated. By default it is: +@code{'("/var/log/messages" "/var/log/secure")}. +@end defvr + +@node Networking Services +@subsection Networking Services + +The @code{(gnu services networking)} module provides services to configure +the network interface. + +@cindex DHCP, networking service +@defvr {Scheme Variable} dhcp-client-service-type +This is the type of services that run @var{dhcp}, a Dynamic Host +Configuration Protocol (DHCP) client, on all the non-loopback network +interfaces. Its value is the DHCP client package to use, @code{isc-dhcp} by +default. +@end defvr + +@deffn {Scheme Procedure} dhcpd-service-type +This type defines a service that runs a DHCP daemon. To create a service of +this type, you must supply a @code{<dhcpd-configuration>}. For example: + +@example +(service dhcpd-service-type + (dhcpd-configuration + (config-file (local-file "my-dhcpd.conf")) + (interfaces '("enp0s25")))) +@end example +@end deffn + +@deftp {Data Type} dhcpd-configuration +@table @asis +@item @code{package} (default: @code{isc-dhcp}) +The package that provides the DHCP daemon. This package is expected to +provide the daemon at @file{sbin/dhcpd} relative to its output directory. +The default package is the @uref{http://www.isc.org/products/DHCP, ISC's +DHCP server}. +@item @code{config-file} (default: @code{#f}) +The configuration file to use. This is required. It will be passed to +@code{dhcpd} via its @code{-cf} option. This may be any ``file-like'' +object (@pxref{G-Expressions, file-like objects}). See @code{man +dhcpd.conf} for details on the configuration file syntax. +@item @code{version} (default: @code{"4"}) +The DHCP version to use. The ISC DHCP server supports the values ``4'', +``6'', and ``4o6''. These correspond to the @code{dhcpd} program options +@code{-4}, @code{-6}, and @code{-4o6}. See @code{man dhcpd} for details. +@item @code{run-directory} (default: @code{"/run/dhcpd"}) +The run directory to use. At service activation time, this directory will +be created if it does not exist. +@item @code{pid-file} (default: @code{"/run/dhcpd/dhcpd.pid"}) +The PID file to use. This corresponds to the @code{-pf} option of +@code{dhcpd}. See @code{man dhcpd} for details. +@item @code{interfaces} (default: @code{'()}) +The names of the network interfaces on which dhcpd should listen for +broadcasts. If this list is not empty, then its elements (which must be +strings) will be appended to the @code{dhcpd} invocation when starting the +daemon. It may not be necessary to explicitly specify any interfaces here; +see @code{man dhcpd} for details. +@end table +@end deftp + +@defvr {Scheme Variable} static-networking-service-type +@c TODO Document <static-networking> data structures. +This is the type for statically-configured network interfaces. +@end defvr + +@deffn {Scheme Procedure} static-networking-service @var{interface} @var{ip} @ + [#:netmask #f] [#:gateway #f] [#:name-servers @code{'()}] @ [#:requirement +@code{'(udev)}] Return a service that starts @var{interface} with address +@var{ip}. If @var{netmask} is true, use it as the network mask. If +@var{gateway} is true, it must be a string specifying the default network +gateway. @var{requirement} can be used to declare a dependency on another +service before configuring the interface. + +This procedure can be called several times, one for each network interface +of interest. Behind the scenes what it does is extend +@code{static-networking-service-type} with additional network interfaces to +handle. + +For example: + +@example +(static-networking-service "eno1" "192.168.1.82" + #:gateway "192.168.1.2" + #:name-servers '("192.168.1.2")) +@end example +@end deffn + +@cindex wicd +@cindex wireless +@cindex WiFi +@cindex network management +@deffn {Scheme Procedure} wicd-service [#:wicd @var{wicd}] +Return a service that runs @url{https://launchpad.net/wicd,Wicd}, a network +management daemon that aims to simplify wired and wireless networking. + +This service adds the @var{wicd} package to the global profile, providing +several commands to interact with the daemon and configure networking: +@command{wicd-client}, a graphical user interface, and the +@command{wicd-cli} and @command{wicd-curses} user interfaces. +@end deffn + +@cindex ModemManager + +@defvr {Scheme Variable} modem-manager-service-type +This is the service type for the +@uref{https://wiki.gnome.org/Projects/ModemManager, ModemManager} +service. The value for this service type is a +@code{modem-manager-configuration} record. + +This service is part of @code{%desktop-services} (@pxref{Desktop Services}). +@end defvr + +@deftp {Data Type} modem-manager-configuration +Data type representing the configuration of ModemManager. + +@table @asis +@item @code{modem-manager} (default: @code{modem-manager}) +The ModemManager package to use. + +@end table +@end deftp + +@cindex NetworkManager + +@defvr {Scheme Variable} network-manager-service-type +This is the service type for the +@uref{https://wiki.gnome.org/Projects/NetworkManager, NetworkManager} +service. The value for this service type is a +@code{network-manager-configuration} record. + +This service is part of @code{%desktop-services} (@pxref{Desktop Services}). +@end defvr + +@deftp {Data Type} network-manager-configuration +Data type representing the configuration of NetworkManager. + +@table @asis +@item @code{network-manager} (default: @code{network-manager}) +The NetworkManager package to use. + +@item @code{dns} (default: @code{"default"}) +Processing mode for DNS, which affects how NetworkManager uses the +@code{resolv.conf} configuration file. + +@table @samp +@item default +NetworkManager will update @code{resolv.conf} to reflect the nameservers +provided by currently active connections. + +@item dnsmasq +NetworkManager will run @code{dnsmasq} as a local caching nameserver, using +a "split DNS" configuration if you are connected to a VPN, and then update +@code{resolv.conf} to point to the local nameserver. + +@item none +NetworkManager will not modify @code{resolv.conf}. +@end table + +@item @code{vpn-plugins} (default: @code{'()}) +This is the list of available plugins for virtual private networks (VPNs). +An example of this is the @code{network-manager-openvpn} package, which +allows NetworkManager to manage VPNs @i{via} OpenVPN. + +@end table +@end deftp + +@cindex Connman +@deffn {Scheme Variable} connman-service-type +This is the service type to run @url{https://01.org/connman,Connman}, a +network connection manager. + +Its value must be an @code{connman-configuration} record as in this example: + +@example +(service connman-service-type + (connman-configuration + (disable-vpn? #t))) +@end example + +See below for details about @code{connman-configuration}. +@end deffn + +@deftp {Data Type} connman-configuration +Data Type representing the configuration of connman. + +@table @asis +@item @code{connman} (default: @var{connman}) +The connman package to use. + +@item @code{disable-vpn?} (default: @code{#f}) +When true, disable connman's vpn plugin. +@end table +@end deftp + +@cindex WPA Supplicant +@defvr {Scheme Variable} wpa-supplicant-service-type +This is the service type to run @url{https://w1.fi/wpa_supplicant/,WPA +supplicant}, an authentication daemon required to authenticate against +encrypted WiFi or ethernet networks. +@end defvr + +@deftp {Data Type} wpa-supplicant-configuration +Data type representing the configuration of WPA Supplicant. + +It takes the following parameters: + +@table @asis +@item @code{wpa-supplicant} (default: @code{wpa-supplicant}) +The WPA Supplicant package to use. + +@item @code{dbus?} (default: @code{#t}) +Whether to listen for requests on D-Bus. + +@item @code{pid-file} (default: @code{"/var/run/wpa_supplicant.pid"}) +Where to store the PID file. + +@item @code{interface} (default: @code{#f}) +If this is set, it must specify the name of a network interface that WPA +supplicant will control. + +@item @code{config-file} (default: @code{#f}) +Optional configuration file to use. + +@item @code{extra-options} (default: @code{'()}) +List of additional command-line arguments to pass to the daemon. +@end table +@end deftp + +@cindex iptables +@defvr {Scheme Variable} iptables-service-type +This is the service type to set up an iptables configuration. iptables is a +packet filtering framework supported by the Linux kernel. This service +supports configuring iptables for both IPv4 and IPv6. A simple example +configuration rejecting all incoming connections except those to the ssh +port 22 is shown below. + +@lisp +(service iptables-service-type + (iptables-configuration + (ipv4-rules (plain-file "iptables.rules" "*filter +:INPUT ACCEPT +:FORWARD ACCEPT +:OUTPUT ACCEPT +-A INPUT -p tcp --dport 22 -j ACCEPT +-A INPUT -j REJECT --reject-with icmp-port-unreachable +COMMIT +")) + (ipv6-rules (plain-file "ip6tables.rules" "*filter +:INPUT ACCEPT +:FORWARD ACCEPT +:OUTPUT ACCEPT +-A INPUT -p tcp --dport 22 -j ACCEPT +-A INPUT -j REJECT --reject-with icmp6-port-unreachable +COMMIT +")))) +@end lisp +@end defvr + +@deftp {Data Type} iptables-configuration +The data type representing the configuration of iptables. + +@table @asis +@item @code{iptables} (default: @code{iptables}) +The iptables package that provides @code{iptables-restore} and +@code{ip6tables-restore}. +@item @code{ipv4-rules} (default: @code{%iptables-accept-all-rules}) +The iptables rules to use. It will be passed to @code{iptables-restore}. +This may be any ``file-like'' object (@pxref{G-Expressions, file-like +objects}). +@item @code{ipv6-rules} (default: @code{%iptables-accept-all-rules}) +The ip6tables rules to use. It will be passed to @code{ip6tables-restore}. +This may be any ``file-like'' object (@pxref{G-Expressions, file-like +objects}). +@end table +@end deftp + +@cindex NTP (Network Time Protocol), service +@cindex real time clock +@defvr {Scheme Variable} ntp-service-type +This is the type of the service running the @uref{http://www.ntp.org, +Network Time Protocol (NTP)} daemon, @command{ntpd}. The daemon will keep +the system clock synchronized with that of the specified NTP servers. + +The value of this service is an @code{ntpd-configuration} object, as +described below. +@end defvr + +@deftp {Data Type} ntp-configuration +This is the data type for the NTP service configuration. + +@table @asis +@item @code{servers} (default: @code{%ntp-servers}) +This is the list of servers (host names) with which @command{ntpd} will be +synchronized. + +@item @code{allow-large-adjustment?} (default: @code{#f}) +This determines whether @command{ntpd} is allowed to make an initial +adjustment of more than 1,000 seconds. + +@item @code{ntp} (default: @code{ntp}) +The NTP package to use. +@end table +@end deftp + +@defvr {Scheme Variable} %ntp-servers +List of host names used as the default NTP servers. These are servers of +the @uref{https://www.ntppool.org/en/, NTP Pool Project}. +@end defvr + +@cindex OpenNTPD +@deffn {Scheme Procedure} openntpd-service-type +Run the @command{ntpd}, the Network Time Protocol (NTP) daemon, as +implemented by @uref{http://www.openntpd.org, OpenNTPD}. The daemon will +keep the system clock synchronized with that of the given servers. + +@example +(service + openntpd-service-type + (openntpd-configuration + (listen-on '("127.0.0.1" "::1")) + (sensor '("udcf0 correction 70000")) + (constraint-from '("www.gnu.org")) + (constraints-from '("https://www.google.com/")) + (allow-large-adjustment? #t))) + +@end example +@end deffn + +@deftp {Data Type} openntpd-configuration +@table @asis +@item @code{openntpd} (default: @code{(file-append openntpd "/sbin/ntpd")}) +The openntpd executable to use. +@item @code{listen-on} (default: @code{'("127.0.0.1" "::1")}) +A list of local IP addresses or hostnames the ntpd daemon should listen on. +@item @code{query-from} (default: @code{'()}) +A list of local IP address the ntpd daemon should use for outgoing queries. +@item @code{sensor} (default: @code{'()}) +Specify a list of timedelta sensor devices ntpd should use. @code{ntpd} +will listen to each sensor that acutally exists and ignore non-existant +ones. See @uref{https://man.openbsd.org/ntpd.conf, upstream documentation} +for more information. +@item @code{server} (default: @var{%ntp-servers}) +Specify a list of IP addresses or hostnames of NTP servers to synchronize +to. +@item @code{servers} (default: @code{'()}) +Specify a list of IP addresses or hostnames of NTP pools to synchronize to. +@item @code{constraint-from} (default: @code{'()}) +@code{ntpd} can be configured to query the ‘Date’ from trusted HTTPS servers +via TLS. This time information is not used for precision but acts as an +authenticated constraint, thereby reducing the impact of unauthenticated NTP +man-in-the-middle attacks. Specify a list of URLs, IP addresses or +hostnames of HTTPS servers to provide a constraint. +@item @code{constraints-from} (default: @code{'()}) +As with constraint from, specify a list of URLs, IP addresses or hostnames +of HTTPS servers to provide a constraint. Should the hostname resolve to +multiple IP addresses, @code{ntpd} will calculate a median constraint from +all of them. +@item @code{allow-large-adjustment?} (default: @code{#f}) +Determines if @code{ntpd} is allowed to make an initial adjustment of more +than 180 seconds. +@end table +@end deftp + +@cindex inetd +@deffn {Scheme variable} inetd-service-type +This service runs the @command{inetd} (@pxref{inetd invocation,,, inetutils, +GNU Inetutils}) daemon. @command{inetd} listens for connections on internet +sockets, and lazily starts the specified server program when a connection is +made on one of these sockets. + +The value of this service is an @code{inetd-configuration} object. The +following example configures the @command{inetd} daemon to provide the +built-in @command{echo} service, as well as an smtp service which forwards +smtp traffic over ssh to a server @code{smtp-server} behind a gateway +@code{hostname}: + +@example +(service + inetd-service-type + (inetd-configuration + (entries (list + (inetd-entry + (name "echo") + (socket-type 'stream) + (protocol "tcp") + (wait? #f) + (user "root")) + (inetd-entry + (node "127.0.0.1") + (name "smtp") + (socket-type 'stream) + (protocol "tcp") + (wait? #f) + (user "root") + (program (file-append openssh "/bin/ssh")) + (arguments + '("ssh" "-qT" "-i" "/path/to/ssh_key" + "-W" "smtp-server:25" "user@@hostname"))))) +@end example + +See below for more details about @code{inetd-configuration}. +@end deffn + +@deftp {Data Type} inetd-configuration +Data type representing the configuration of @command{inetd}. + +@table @asis +@item @code{program} (default: @code{(file-append inetutils "/libexec/inetd")}) +The @command{inetd} executable to use. + +@item @code{entries} (default: @code{'()}) +A list of @command{inetd} service entries. Each entry should be created by +the @code{inetd-entry} constructor. +@end table +@end deftp + +@deftp {Data Type} inetd-entry +Data type representing an entry in the @command{inetd} configuration. Each +entry corresponds to a socket where @command{inetd} will listen for +requests. + +@table @asis +@item @code{node} (default: @code{#f}) +Optional string, a comma-separated list of local addresses @command{inetd} +should use when listening for this service. @xref{Configuration file,,, +inetutils, GNU Inetutils} for a complete description of all options. +@item @code{name} +A string, the name must correspond to an entry in @code{/etc/services}. +@item @code{socket-type} +One of @code{'stream}, @code{'dgram}, @code{'raw}, @code{'rdm} or +@code{'seqpacket}. +@item @code{protocol} +A string, must correspond to an entry in @code{/etc/protocols}. +@item @code{wait?} (default: @code{#t}) +Whether @command{inetd} should wait for the server to exit before listening +to new service requests. +@item @code{user} +A string containing the user (and, optionally, group) name of the user as +whom the server should run. The group name can be specified in a suffix, +separated by a colon or period, i.e.@: @code{"user"}, @code{"user:group"} or +@code{"user.group"}. +@item @code{program} (default: @code{"internal"}) +The server program which will serve the requests, or @code{"internal"} if +@command{inetd} should use a built-in service. +@item @code{arguments} (default: @code{'()}) +A list strings or file-like objects, which are the server program's +arguments, starting with the zeroth argument, i.e.@: the name of the program +itself. For @command{inetd}'s internal services, this entry must be +@code{'()} or @code{'("internal")}. +@end table + +@xref{Configuration file,,, inetutils, GNU Inetutils} for a more detailed +discussion of each configuration field. +@end deftp + +@cindex Tor +@defvr {Scheme Variable} tor-service-type +This is the type for a service that runs the @uref{https://torproject.org, +Tor} anonymous networking daemon. The service is configured using a +@code{<tor-configuration>} record. By default, the Tor daemon runs as the +@code{tor} unprivileged user, which is a member of the @code{tor} group. + +@end defvr + +@deftp {Data Type} tor-configuration +@table @asis +@item @code{tor} (default: @code{tor}) +The package that provides the Tor daemon. This package is expected to +provide the daemon at @file{bin/tor} relative to its output directory. The +default package is the @uref{https://www.torproject.org, Tor Project's} +implementation. + +@item @code{config-file} (default: @code{(plain-file "empty" "")}) +The configuration file to use. It will be appended to a default +configuration file, and the final configuration file will be passed to +@code{tor} via its @code{-f} option. This may be any ``file-like'' object +(@pxref{G-Expressions, file-like objects}). See @code{man tor} for details +on the configuration file syntax. + +@item @code{hidden-services} (default: @code{'()}) +The list of @code{<hidden-service>} records to use. For any hidden service +you include in this list, appropriate configuration to enable the hidden +service will be automatically added to the default configuration file. You +may conveniently create @code{<hidden-service>} records using the +@code{tor-hidden-service} procedure described below. + +@item @code{socks-socket-type} (default: @code{'tcp}) +The default socket type that Tor should use for its SOCKS socket. This must +be either @code{'tcp} or @code{'unix}. If it is @code{'tcp}, then by +default Tor will listen on TCP port 9050 on the loopback interface (i.e., +localhost). If it is @code{'unix}, then Tor will listen on the UNIX domain +socket @file{/var/run/tor/socks-sock}, which will be made writable by +members of the @code{tor} group. + +If you want to customize the SOCKS socket in more detail, leave +@code{socks-socket-type} at its default value of @code{'tcp} and use +@code{config-file} to override the default by providing your own +@code{SocksPort} option. +@end table +@end deftp + +@cindex hidden service +@deffn {Scheme Procedure} tor-hidden-service @var{name} @var{mapping} +Define a new Tor @dfn{hidden service} called @var{name} and implementing +@var{mapping}. @var{mapping} is a list of port/host tuples, such as: + +@example + '((22 "127.0.0.1:22") + (80 "127.0.0.1:8080")) +@end example + +In this example, port 22 of the hidden service is mapped to local port 22, +and port 80 is mapped to local port 8080. + +This creates a @file{/var/lib/tor/hidden-services/@var{name}} directory, +where the @file{hostname} file contains the @code{.onion} host name for the +hidden service. + +See @uref{https://www.torproject.org/docs/tor-hidden-service.html.en, the +Tor project's documentation} for more information. +@end deffn + +The @code{(gnu services rsync)} module provides the following services: + +You might want an rsync daemon if you have files that you want available so +anyone (or just yourself) can download existing files or upload new files. + +@deffn {Scheme Variable} rsync-service-type +This is the type for the @uref{https://rsync.samba.org, rsync} rsync daemon, +@command{rsync-configuration} record as in this example: + +@example +(service rsync-service-type) +@end example + +See below for details about @code{rsync-configuration}. +@end deffn + +@deftp {Data Type} rsync-configuration +Data type representing the configuration for @code{rsync-service}. + +@table @asis +@item @code{package} (default: @var{rsync}) +@code{rsync} package to use. + +@item @code{port-number} (default: @code{873}) +TCP port on which @command{rsync} listens for incoming connections. If port +is less than @code{1024} @command{rsync} needs to be started as the +@code{root} user and group. + +@item @code{pid-file} (default: @code{"/var/run/rsyncd/rsyncd.pid"}) +Name of the file where @command{rsync} writes its PID. + +@item @code{lock-file} (default: @code{"/var/run/rsyncd/rsyncd.lock"}) +Name of the file where @command{rsync} writes its lock file. + +@item @code{log-file} (default: @code{"/var/log/rsyncd.log"}) +Name of the file where @command{rsync} writes its log file. + +@item @code{use-chroot?} (default: @var{#t}) +Whether to use chroot for @command{rsync} shared directory. + +@item @code{share-path} (default: @file{/srv/rsync}) +Location of the @command{rsync} shared directory. + +@item @code{share-comment} (default: @code{"Rsync share"}) +Comment of the @command{rsync} shared directory. + +@item @code{read-only?} (default: @var{#f}) +Read-write permissions to shared directory. + +@item @code{timeout} (default: @code{300}) +I/O timeout in seconds. + +@item @code{user} (default: @var{"root"}) +Owner of the @code{rsync} process. + +@item @code{group} (default: @var{"root"}) +Group of the @code{rsync} process. + +@item @code{uid} (default: @var{"rsyncd"}) +User name or user ID that file transfers to and from that module should take +place as when the daemon was run as @code{root}. + +@item @code{gid} (default: @var{"rsyncd"}) +Group name or group ID that will be used when accessing the module. + +@end table +@end deftp + +Furthermore, @code{(gnu services ssh)} provides the following services. +@cindex SSH +@cindex SSH server + +@deffn {Scheme Procedure} lsh-service [#:host-key "/etc/lsh/host-key"] @ + [#:daemonic? #t] [#:interfaces '()] [#:port-number 22] @ +[#:allow-empty-passwords? #f] [#:root-login? #f] @ [#:syslog-output? #t] +[#:x11-forwarding? #t] @ [#:tcp/ip-forwarding? #t] +[#:password-authentication? #t] @ [#:public-key-authentication? #t] +[#:initialize? #t] Run the @command{lshd} program from @var{lsh} to listen +on port @var{port-number}. @var{host-key} must designate a file containing +the host key, and readable only by root. + +When @var{daemonic?} is true, @command{lshd} will detach from the +controlling terminal and log its output to syslogd, unless one sets +@var{syslog-output?} to false. Obviously, it also makes lsh-service depend +on existence of syslogd service. When @var{pid-file?} is true, +@command{lshd} writes its PID to the file called @var{pid-file}. + +When @var{initialize?} is true, automatically create the seed and host key +upon service activation if they do not exist yet. This may take long and +require interaction. + +When @var{initialize?} is false, it is up to the user to initialize the +randomness generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to +create a key pair with the private key stored in file @var{host-key} +(@pxref{lshd basics,,, lsh, LSH Manual}). + +When @var{interfaces} is empty, lshd listens for connections on all the +network interfaces; otherwise, @var{interfaces} must be a list of host names +or addresses. + +@var{allow-empty-passwords?} specifies whether to accept log-ins with empty +passwords, and @var{root-login?} specifies whether to accept log-ins as +root. + +The other options should be self-descriptive. +@end deffn + +@cindex SSH +@cindex SSH server +@deffn {Scheme Variable} openssh-service-type +This is the type for the @uref{http://www.openssh.org, OpenSSH} secure shell +daemon, @command{sshd}. Its value must be an @code{openssh-configuration} +record as in this example: + +@example +(service openssh-service-type + (openssh-configuration + (x11-forwarding? #t) + (permit-root-login 'without-password) + (authorized-keys + `(("alice" ,(local-file "alice.pub")) + ("bob" ,(local-file "bob.pub")))))) +@end example + +See below for details about @code{openssh-configuration}. + +This service can be extended with extra authorized keys, as in this example: + +@example +(service-extension openssh-service-type + (const `(("charlie" + ,(local-file "charlie.pub"))))) +@end example +@end deffn + +@deftp {Data Type} openssh-configuration +This is the configuration record for OpenSSH's @command{sshd}. + +@table @asis +@item @code{pid-file} (default: @code{"/var/run/sshd.pid"}) +Name of the file where @command{sshd} writes its PID. + +@item @code{port-number} (default: @code{22}) +TCP port on which @command{sshd} listens for incoming connections. + +@item @code{permit-root-login} (default: @code{#f}) +This field determines whether and when to allow logins as root. If +@code{#f}, root logins are disallowed; if @code{#t}, they are allowed. If +it's the symbol @code{'without-password}, then root logins are permitted but +not with password-based authentication. + +@item @code{allow-empty-passwords?} (default: @code{#f}) +When true, users with empty passwords may log in. When false, they may not. + +@item @code{password-authentication?} (default: @code{#t}) +When true, users may log in with their password. When false, they have +other authentication methods. + +@item @code{public-key-authentication?} (default: @code{#t}) +When true, users may log in using public key authentication. When false, +users have to use other authentication method. + +Authorized public keys are stored in @file{~/.ssh/authorized_keys}. This is +used only by protocol version 2. + +@item @code{x11-forwarding?} (default: @code{#f}) +When true, forwarding of X11 graphical client connections is enabled---in +other words, @command{ssh} options @option{-X} and @option{-Y} will work. + +@item @code{allow-agent-forwarding?} (default: @code{#t}) +Whether to allow agent forwarding. + +@item @code{allow-tcp-forwarding?} (default: @code{#t}) +Whether to allow TCP forwarding. + +@item @code{gateway-ports?} (default: @code{#f}) +Whether to allow gateway ports. + +@item @code{challenge-response-authentication?} (default: @code{#f}) +Specifies whether challenge response authentication is allowed (e.g.@: via +PAM). + +@item @code{use-pam?} (default: @code{#t}) +Enables the Pluggable Authentication Module interface. If set to @code{#t}, +this will enable PAM authentication using +@code{challenge-response-authentication?} and +@code{password-authentication?}, in addition to PAM account and session +module processing for all authentication types. + +Because PAM challenge response authentication usually serves an equivalent +role to password authentication, you should disable either +@code{challenge-response-authentication?} or +@code{password-authentication?}. + +@item @code{print-last-log?} (default: @code{#t}) +Specifies whether @command{sshd} should print the date and time of the last +user login when a user logs in interactively. + +@item @code{subsystems} (default: @code{'(("sftp" "internal-sftp"))}) +Configures external subsystems (e.g.@: file transfer daemon). + +This is a list of two-element lists, each of which containing the subsystem +name and a command (with optional arguments) to execute upon subsystem +request. + +The command @command{internal-sftp} implements an in-process SFTP server. +Alternately, one can specify the @command{sftp-server} command: +@example +(service openssh-service-type + (openssh-configuration + (subsystems + `(("sftp" ,(file-append openssh "/libexec/sftp-server")))))) +@end example + +@item @code{accepted-environment} (default: @code{'()}) +List of strings describing which environment variables may be exported. + +Each string gets on its own line. See the @code{AcceptEnv} option in +@code{man sshd_config}. + +This example allows ssh-clients to export the @code{COLORTERM} variable. It +is set by terminal emulators, which support colors. You can use it in your +shell's ressource file to enable colors for the prompt and commands if this +variable is set. + +@example +(service openssh-service-type + (openssh-configuration + (accepted-environment '("COLORTERM")))) +@end example + +@item @code{authorized-keys} (default: @code{'()}) +@cindex authorized keys, SSH +@cindex SSH authorized keys +This is the list of authorized keys. Each element of the list is a user +name followed by one or more file-like objects that represent SSH public +keys. For example: + +@example +(openssh-configuration + (authorized-keys + `(("rekado" ,(local-file "rekado.pub")) + ("chris" ,(local-file "chris.pub")) + ("root" ,(local-file "rekado.pub") ,(local-file "chris.pub"))))) +@end example + +@noindent +registers the specified public keys for user accounts @code{rekado}, +@code{chris}, and @code{root}. + +Additional authorized keys can be specified @i{via} +@code{service-extension}. + +Note that this does @emph{not} interfere with the use of +@file{~/.ssh/authorized_keys}. + +@item @code{log-level} (default: @code{'info}) +This is a symbol specifying the logging level: @code{quiet}, @code{fatal}, +@code{error}, @code{info}, @code{verbose}, @code{debug}, etc. See the man +page for @file{sshd_config} for the full list of level names. + +@item @code{extra-content} (default: @code{""}) +This field can be used to append arbitrary text to the configuration file. +It is especially useful for elaborate configurations that cannot be +expressed otherwise. This configuration, for example, would generally +disable root logins, but permit them from one specific IP address: + +@example +(openssh-configuration + (extra-content "\ +Match Address 192.168.0.1 + PermitRootLogin yes")) +@end example + +@end table +@end deftp + +@deffn {Scheme Procedure} dropbear-service [@var{config}] +Run the @uref{https://matt.ucc.asn.au/dropbear/dropbear.html,Dropbear SSH +daemon} with the given @var{config}, a @code{<dropbear-configuration>} +object. + +For example, to specify a Dropbear service listening on port 1234, add this +call to the operating system's @code{services} field: + +@example +(dropbear-service (dropbear-configuration + (port-number 1234))) +@end example +@end deffn + +@deftp {Data Type} dropbear-configuration +This data type represents the configuration of a Dropbear SSH daemon. + +@table @asis +@item @code{dropbear} (default: @var{dropbear}) +The Dropbear package to use. + +@item @code{port-number} (default: 22) +The TCP port where the daemon waits for incoming connections. + +@item @code{syslog-output?} (default: @code{#t}) +Whether to enable syslog output. + +@item @code{pid-file} (default: @code{"/var/run/dropbear.pid"}) +File name of the daemon's PID file. + +@item @code{root-login?} (default: @code{#f}) +Whether to allow @code{root} logins. + +@item @code{allow-empty-passwords?} (default: @code{#f}) +Whether to allow empty passwords. + +@item @code{password-authentication?} (default: @code{#t}) +Whether to enable password-based authentication. +@end table +@end deftp + +@defvr {Scheme Variable} %facebook-host-aliases +This variable contains a string for use in @file{/etc/hosts} (@pxref{Host +Names,,, libc, The GNU C Library Reference Manual}). Each line contains a +entry that maps a known server name of the Facebook on-line service---e.g., +@code{www.facebook.com}---to the local host---@code{127.0.0.1} or its IPv6 +equivalent, @code{::1}. + +This variable is typically used in the @code{hosts-file} field of an +@code{operating-system} declaration (@pxref{operating-system Reference, +@file{/etc/hosts}}): + +@example +(use-modules (gnu) (guix)) + +(operating-system + (host-name "mymachine") + ;; ... + (hosts-file + ;; Create a /etc/hosts file with aliases for "localhost" + ;; and "mymachine", as well as for Facebook servers. + (plain-file "hosts" + (string-append (local-host-aliases host-name) + %facebook-host-aliases)))) +@end example + +This mechanism can prevent programs running locally, such as Web browsers, +from accessing Facebook. +@end defvr + +The @code{(gnu services avahi)} provides the following definition. + +@defvr {Scheme Variable} avahi-service-type +This is the service that runs @command{avahi-daemon}, a system-wide +mDNS/DNS-SD responder that allows for service discovery and +``zero-configuration'' host name lookups (see @uref{http://avahi.org/}). +Its value must be a @code{zero-configuration} record---see below. + +This service extends the name service cache daemon (nscd) so that it can +resolve @code{.local} host names using +@uref{http://0pointer.de/lennart/projects/nss-mdns/, nss-mdns}. @xref{Name +Service Switch}, for information on host name resolution. + +Additionally, add the @var{avahi} package to the system profile so that +commands such as @command{avahi-browse} are directly usable. +@end defvr + +@deftp {Data Type} avahi-configuration +Data type representation the configuration for Avahi. + +@table @asis + +@item @code{host-name} (default: @code{#f}) +If different from @code{#f}, use that as the host name to publish for this +machine; otherwise, use the machine's actual host name. + +@item @code{publish?} (default: @code{#t}) +When true, allow host names and services to be published (broadcast) over +the network. + +@item @code{publish-workstation?} (default: @code{#t}) +When true, @command{avahi-daemon} publishes the machine's host name and IP +address via mDNS on the local network. To view the host names published on +your local network, you can run: + +@example +avahi-browse _workstation._tcp +@end example + +@item @code{wide-area?} (default: @code{#f}) +When true, DNS-SD over unicast DNS is enabled. + +@item @code{ipv4?} (default: @code{#t}) +@itemx @code{ipv6?} (default: @code{#t}) +These fields determine whether to use IPv4/IPv6 sockets. + +@item @code{domains-to-browse} (default: @code{'()}) +This is a list of domains to browse. +@end table +@end deftp + +@deffn {Scheme Variable} openvswitch-service-type +This is the type of the @uref{http://www.openvswitch.org, Open vSwitch} +service, whose value should be an @code{openvswitch-configuration} object. +@end deffn + +@deftp {Data Type} openvswitch-configuration +Data type representing the configuration of Open vSwitch, a multilayer +virtual switch which is designed to enable massive network automation +through programmatic extension. + +@table @asis +@item @code{package} (default: @var{openvswitch}) +Package object of the Open vSwitch. + +@end table +@end deftp + +@node X Window +@subsection X Window + +@cindex X11 +@cindex X Window System +@cindex login manager +Support for the X Window graphical display system---specifically Xorg---is +provided by the @code{(gnu services xorg)} module. Note that there is no +@code{xorg-service} procedure. Instead, the X server is started by the +@dfn{login manager}, by default the GNOME Display Manager (GDM). + +@cindex GDM +@cindex GNOME, login manager +GDM of course allows users to log in into window managers and desktop +environments other than GNOME; for those using GNOME, GDM is required for +features such as automatic screen locking. + +@cindex window manager +To use X11, you must install at least one @dfn{window manager}---for example +the @code{windowmaker} or @code{openbox} packages---preferably by adding it +to the @code{packages} field of your operating system definition +(@pxref{operating-system Reference, system-wide packages}). + +@defvr {Scheme Variable} gdm-service-type +This is the type for the @uref{https://wiki.gnome.org/Projects/GDM/, GNOME +Desktop Manager} (GDM), a program that manages graphical display servers and +handles graphical user logins. Its value must be a @code{gdm-configuration} +(see below.) + +@cindex session types (X11) +@cindex X11 session types +GDM looks for @dfn{session types} described by the @file{.desktop} files in +@file{/run/current-system/profile/share/xsessions} and allows users to +choose a session from the log-in screen. Packages such as @code{gnome}, +@code{xfce}, and @code{i3} provide @file{.desktop} files; adding them to the +system-wide set of packages automatically makes them available at the log-in +screen. + +In addition, @file{~/.xsession} files are honored. When available, +@file{~/.xsession} must be an executable that starts a window manager and/or +other X clients. +@end defvr + +@deftp {Data Type} gdm-configuration +@table @asis +@item @code{auto-login?} (default: @code{#f}) +@itemx @code{default-user} (default: @code{#f}) +When @code{auto-login?} is false, GDM presents a log-in screen. + +When @code{auto-login?} is true, GDM logs in directly as +@code{default-user}. + +@item @code{gnome-shell-assets} (default: ...) +List of GNOME Shell assets needed by GDM: icon theme, fonts, etc. + +@item @code{xorg-configuration} (default: @code{(xorg-configuration)}) +Configuration of the Xorg graphical server. + +@item @code{xsession} (default: @code{(xinitrc)}) +Script to run before starting a X session. + +@item @code{dbus-daemon} (default: @code{dbus-daemon-wrapper}) +File name of the @code{dbus-daemon} executable. + +@item @code{gdm} (default: @code{gdm}) +The GDM package to use. +@end table +@end deftp + +@defvr {Scheme Variable} slim-service-type +This is the type for the SLiM graphical login manager for X11. + +Like GDM, SLiM looks for session types described by @file{.desktop} files +and allows users to choose a session from the log-in screen using @kbd{F1}. +It also honors @file{~/.xsession} files. +@end defvr + +@deftp {Data Type} slim-configuration +Data type representing the configuration of @code{slim-service-type}. + +@table @asis +@item @code{allow-empty-passwords?} (default: @code{#t}) +Whether to allow logins with empty passwords. + +@item @code{auto-login?} (default: @code{#f}) +@itemx @code{default-user} (default: @code{""}) +When @code{auto-login?} is false, SLiM presents a log-in screen. + +When @code{auto-login?} is true, SLiM logs in directly as +@code{default-user}. + +@item @code{theme} (default: @code{%default-slim-theme}) +@itemx @code{theme-name} (default: @code{%default-slim-theme-name}) +The graphical theme to use and its name. + +@item @code{auto-login-session} (default: @code{#f}) +If true, this must be the name of the executable to start as the default +session---e.g., @code{(file-append windowmaker "/bin/windowmaker")}. + +If false, a session described by one of the available @file{.desktop} files +in @code{/run/current-system/profile} and @code{~/.guix-profile} will be +used. + +@quotation Note +You must install at least one window manager in the system profile or in +your user profile. Failing to do that, if @code{auto-login-session} is +false, you will be unable to log in. +@end quotation + +@item @code{xorg-configuration} (default @code{(xorg-configuration)}) +Configuration of the Xorg graphical server. + +@item @code{xauth} (default: @code{xauth}) +The XAuth package to use. + +@item @code{shepherd} (default: @code{shepherd}) +The Shepherd package used when invoking @command{halt} and @command{reboot}. + +@item @code{sessreg} (default: @code{sessreg}) +The sessreg package used in order to register the session. + +@item @code{slim} (default: @code{slim}) +The SLiM package to use. +@end table +@end deftp + +@defvr {Scheme Variable} %default-theme +@defvrx {Scheme Variable} %default-theme-name +The default SLiM theme and its name. +@end defvr + + +@deftp {Data Type} sddm-configuration +This is the data type representing the sddm service configuration. + +@table @asis +@item @code{display-server} (default: "x11") +Select display server to use for the greeter. Valid values are "x11" or +"wayland". + +@item @code{numlock} (default: "on") +Valid values are "on", "off" or "none". + +@item @code{halt-command} (default @code{#~(string-apppend #$shepherd "/sbin/halt")}) +Command to run when halting. + +@item @code{reboot-command} (default @code{#~(string-append #$shepherd "/sbin/reboot")}) +Command to run when rebooting. + +@item @code{theme} (default "maldives") +Theme to use. Default themes provided by SDDM are "elarun" or "maldives". + +@item @code{themes-directory} (default "/run/current-system/profile/share/sddm/themes") +Directory to look for themes. + +@item @code{faces-directory} (default "/run/current-system/profile/share/sddm/faces") +Directory to look for faces. + +@item @code{default-path} (default "/run/current-system/profile/bin") +Default PATH to use. + +@item @code{minimum-uid} (default 1000) +Minimum UID to display in SDDM. + +@item @code{maximum-uid} (default 2000) +Maximum UID to display in SDDM + +@item @code{remember-last-user?} (default #t) +Remember last user. + +@item @code{remember-last-session?} (default #t) +Remember last session. + +@item @code{hide-users} (default "") +Usernames to hide from SDDM greeter. + +@item @code{hide-shells} (default @code{#~(string-append #$shadow "/sbin/nologin")}) +Users with shells listed will be hidden from the SDDM greeter. + +@item @code{session-command} (default @code{#~(string-append #$sddm "/share/sddm/scripts/wayland-session")}) +Script to run before starting a wayland session. + +@item @code{sessions-directory} (default "/run/current-system/profile/share/wayland-sessions") +Directory to look for desktop files starting wayland sessions. + +@item @code{xorg-configuration} (default @code{(xorg-configuration)}) +Configuration of the Xorg graphical server. + +@item @code{xauth-path} (default @code{#~(string-append #$xauth "/bin/xauth")}) +Path to xauth. + +@item @code{xephyr-path} (default @code{#~(string-append #$xorg-server "/bin/Xephyr")}) +Path to Xephyr. + +@item @code{xdisplay-start} (default @code{#~(string-append #$sddm "/share/sddm/scripts/Xsetup")}) +Script to run after starting xorg-server. + +@item @code{xdisplay-stop} (default @code{#~(string-append #$sddm "/share/sddm/scripts/Xstop")}) +Script to run before stopping xorg-server. + +@item @code{xsession-command} (default: @code{xinitrc}) +Script to run before starting a X session. + +@item @code{xsessions-directory} (default: "/run/current-system/profile/share/xsessions") +Directory to look for desktop files starting X sessions. + +@item @code{minimum-vt} (default: 7) +Minimum VT to use. + +@item @code{auto-login-user} (default "") +User to use for auto-login. + +@item @code{auto-login-session} (default "") +Desktop file to use for auto-login. + +@item @code{relogin?} (default #f) +Relogin after logout. + +@end table +@end deftp + +@cindex login manager +@cindex X11 login +@deffn {Scheme Procedure} sddm-service config +Return a service that spawns the SDDM graphical login manager for config of +type @code{<sddm-configuration>}. + +@example + (sddm-service (sddm-configuration + (auto-login-user "Alice") + (auto-login-session "xfce.desktop"))) +@end example +@end deffn + +@cindex Xorg, configuration +@deftp {Data Type} xorg-configuration +This data type represents the configuration of the Xorg graphical display +server. Note that there is not Xorg service; instead, the X server is +started by a ``display manager'' such as GDM, SDDM, and SLiM. Thus, the +configuration of these display managers aggregates an +@code{xorg-configuration} record. + +@table @asis +@item @code{modules} (default: @code{%default-xorg-modules}) +This is a list of @dfn{module packages} loaded by the Xorg server---e.g., +@code{xf86-video-vesa}, @code{xf86-input-keyboard}, and so on. + +@item @code{fonts} (default: @code{%default-xorg-fonts}) +This is a list of font directories to add to the server's @dfn{font path}. + +@item @code{drivers} (default: @code{'()}) +This must be either the empty list, in which case Xorg chooses a graphics +driver automatically, or a list of driver names that will be tried in this +order---e.g., @code{("modesetting" "vesa")}. + +@item @code{resolutions} (default: @code{'()}) +When @code{resolutions} is the empty list, Xorg chooses an appropriate +screen resolution. Otherwise, it must be a list of resolutions---e.g., +@code{((1024 768) (640 480))}. + +@cindex keyboard layout, for Xorg +@cindex keymap, for Xorg +@item @code{keyboard-layout} (default: @code{#f}) +If this is @code{#f}, Xorg uses the default keyboard layout---usually US +English (``qwerty'') for a 105-key PC keyboard. + +Otherwise this must be a @code{keyboard-layout} object specifying the +keyboard layout in use when Xorg is running. @xref{Keyboard Layout}, for +more information on how to specify the keyboard layout. + +@item @code{extra-config} (default: @code{'()}) +This is a list of strings or objects appended to the configuration file. It +is used to pass extra text to be added verbatim to the configuration file. + +@item @code{server} (default: @code{xorg-server}) +This is the package providing the Xorg server. + +@item @code{server-arguments} (default: @code{%default-xorg-server-arguments}) +This is the list of command-line arguments to pass to the X server. The +default is @code{-nolisten tcp}. +@end table +@end deftp + +@deffn {Scheme Procedure} set-xorg-configuration @var{config} @ + [@var{login-manager-service-type}] Tell the log-in manager (of type +@var{login-manager-service-type}) to use @var{config}, an +<xorg-configuration> record. + +Since the Xorg configuration is embedded in the log-in manager's +configuration---e.g., @code{gdm-configuration}---this procedure provides a +shorthand to set the Xorg configuration. +@end deffn + +@deffn {Scheme Procedure} xorg-start-command [@var{config}] +Return a @code{startx} script in which the modules, fonts, etc. specified in +@var{config}, are available. The result should be used in place of +@code{startx}. + +Usually the X server is started by a login manager. +@end deffn + + +@deffn {Scheme Procedure} screen-locker-service @var{package} [@var{program}] +Add @var{package}, a package for a screen locker or screen saver whose +command is @var{program}, to the set of setuid programs and add a PAM entry +for it. For example: + +@lisp +(screen-locker-service xlockmore "xlock") +@end lisp + +makes the good ol' XlockMore usable. +@end deffn + + +@node Printing Services +@subsection Printing Services + +@cindex printer support with CUPS +The @code{(gnu services cups)} module provides a Guix service definition for +the CUPS printing service. To add printer support to a Guix system, add a +@code{cups-service} to the operating system definition: + +@deffn {Scheme Variable} cups-service-type +The service type for the CUPS print server. Its value should be a valid +CUPS configuration (see below). To use the default settings, simply write: +@example +(service cups-service-type) +@end example +@end deffn + +The CUPS configuration controls the basic things about your CUPS +installation: what interfaces it listens on, what to do if a print job +fails, how much logging to do, and so on. To actually add a printer, you +have to visit the @url{http://localhost:631} URL, or use a tool such as +GNOME's printer configuration services. By default, configuring a CUPS +service will generate a self-signed certificate if needed, for secure +connections to the print server. + +Suppose you want to enable the Web interface of CUPS and also add support +for Epson printers @i{via} the @code{escpr} package and for HP printers +@i{via} the @code{hplip-minimal} package. You can do that directly, like +this (you need to use the @code{(gnu packages cups)} module): + +@example +(service cups-service-type + (cups-configuration + (web-interface? #t) + (extensions + (list cups-filters escpr hplip-minimal)))) +@end example + +Note: If you wish to use the Qt5 based GUI which comes with the hplip +package then it is suggested that you install the @code{hplip} package, +either in your OS configuration file or as your user. + +The available configuration parameters follow. Each parameter definition is +preceded by its type; for example, @samp{string-list foo} indicates that the +@code{foo} parameter should be specified as a list of strings. There is +also a way to specify the configuration as a string, if you have an old +@code{cupsd.conf} file that you want to port over from some other system; +see the end for more details. + +@c The following documentation was initially generated by +@c (generate-documentation) in (gnu services cups). Manually maintained +@c documentation is better, so we shouldn't hesitate to edit below as +@c needed. However if the change you want to make to this documentation +@c can be done in an automated way, it's probably easier to change +@c (generate-documentation) than to make it below and have to deal with +@c the churn as CUPS updates. + + +Available @code{cups-configuration} fields are: + +@deftypevr {@code{cups-configuration} parameter} package cups +The CUPS package. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} package-list extensions +Drivers and other extensions to the CUPS package. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} files-configuration files-configuration +Configuration of where to write logs, what directories to use for print +spools, and related privileged configuration parameters. + +Available @code{files-configuration} fields are: + +@deftypevr {@code{files-configuration} parameter} log-location access-log +Defines the access log filename. Specifying a blank filename disables +access log generation. The value @code{stderr} causes log entries to be +sent to the standard error file when the scheduler is running in the +foreground, or to the system log daemon when run in the background. The +value @code{syslog} causes log entries to be sent to the system log daemon. +The server name may be included in filenames using the string @code{%s}, as +in @code{/var/log/cups/%s-access_log}. + +Defaults to @samp{"/var/log/cups/access_log"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} file-name cache-dir +Where CUPS should cache data. + +Defaults to @samp{"/var/cache/cups"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string config-file-perm +Specifies the permissions for all configuration files that the scheduler +writes. + +Note that the permissions for the printers.conf file are currently masked to +only allow access from the scheduler user (typically root). This is done +because printer device URIs sometimes contain sensitive authentication +information that should not be generally known on the system. There is no +way to disable this security feature. + +Defaults to @samp{"0640"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} log-location error-log +Defines the error log filename. Specifying a blank filename disables access +log generation. The value @code{stderr} causes log entries to be sent to +the standard error file when the scheduler is running in the foreground, or +to the system log daemon when run in the background. The value +@code{syslog} causes log entries to be sent to the system log daemon. The +server name may be included in filenames using the string @code{%s}, as in +@code{/var/log/cups/%s-error_log}. + +Defaults to @samp{"/var/log/cups/error_log"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string fatal-errors +Specifies which errors are fatal, causing the scheduler to exit. The kind +strings are: + +@table @code +@item none +No errors are fatal. + +@item all +All of the errors below are fatal. + +@item browse +Browsing initialization errors are fatal, for example failed connections to +the DNS-SD daemon. + +@item config +Configuration file syntax errors are fatal. + +@item listen +Listen or Port errors are fatal, except for IPv6 failures on the loopback or +@code{any} addresses. + +@item log +Log file creation or write errors are fatal. + +@item permissions +Bad startup file permissions are fatal, for example shared TLS certificate +and key files with world-read permissions. +@end table + +Defaults to @samp{"all -browse"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} boolean file-device? +Specifies whether the file pseudo-device can be used for new printer +queues. The URI @uref{file:///dev/null} is always allowed. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string group +Specifies the group name or ID that will be used when executing external +programs. + +Defaults to @samp{"lp"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string log-file-perm +Specifies the permissions for all log files that the scheduler writes. + +Defaults to @samp{"0644"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} log-location page-log +Defines the page log filename. Specifying a blank filename disables access +log generation. The value @code{stderr} causes log entries to be sent to +the standard error file when the scheduler is running in the foreground, or +to the system log daemon when run in the background. The value +@code{syslog} causes log entries to be sent to the system log daemon. The +server name may be included in filenames using the string @code{%s}, as in +@code{/var/log/cups/%s-page_log}. + +Defaults to @samp{"/var/log/cups/page_log"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string remote-root +Specifies the username that is associated with unauthenticated accesses by +clients claiming to be the root user. The default is @code{remroot}. + +Defaults to @samp{"remroot"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} file-name request-root +Specifies the directory that contains print jobs and other HTTP request +data. + +Defaults to @samp{"/var/spool/cups"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} sandboxing sandboxing +Specifies the level of security sandboxing that is applied to print filters, +backends, and other child processes of the scheduler; either @code{relaxed} +or @code{strict}. This directive is currently only used/supported on macOS. + +Defaults to @samp{strict}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} file-name server-keychain +Specifies the location of TLS certificates and private keys. CUPS will look +for public and private keys in this directory: a @code{.crt} files for +PEM-encoded certificates and corresponding @code{.key} files for PEM-encoded +private keys. + +Defaults to @samp{"/etc/cups/ssl"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} file-name server-root +Specifies the directory containing the server configuration files. + +Defaults to @samp{"/etc/cups"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} boolean sync-on-close? +Specifies whether the scheduler calls fsync(2) after writing configuration +or state files. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} space-separated-string-list system-group +Specifies the group(s) to use for @code{@@SYSTEM} group authentication. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} file-name temp-dir +Specifies the directory where temporary files are stored. + +Defaults to @samp{"/var/spool/cups/tmp"}. +@end deftypevr + +@deftypevr {@code{files-configuration} parameter} string user +Specifies the user name or ID that is used when running external programs. + +Defaults to @samp{"lp"}. +@end deftypevr +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} access-log-level access-log-level +Specifies the logging level for the AccessLog file. The @code{config} level +logs when printers and classes are added, deleted, or modified and when +configuration files are accessed or updated. The @code{actions} level logs +when print jobs are submitted, held, released, modified, or canceled, and +any of the conditions for @code{config}. The @code{all} level logs all +requests. + +Defaults to @samp{actions}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean auto-purge-jobs? +Specifies whether to purge job history data automatically when it is no +longer required for quotas. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} browse-local-protocols browse-local-protocols +Specifies which protocols to use for local printer sharing. + +Defaults to @samp{dnssd}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean browse-web-if? +Specifies whether the CUPS web interface is advertised. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean browsing? +Specifies whether shared printers are advertised. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string classification +Specifies the security classification of the server. Any valid banner name +can be used, including "classified", "confidential", "secret", "topsecret", +and "unclassified", or the banner can be omitted to disable secure printing +functions. + +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean classify-override? +Specifies whether users may override the classification (cover page) of +individual print jobs using the @code{job-sheets} option. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} default-auth-type default-auth-type +Specifies the default type of authentication to use. + +Defaults to @samp{Basic}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} default-encryption default-encryption +Specifies whether encryption will be used for authenticated requests. + +Defaults to @samp{Required}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string default-language +Specifies the default language to use for text and web content. + +Defaults to @samp{"en"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string default-paper-size +Specifies the default paper size for new print queues. @samp{"Auto"} uses a +locale-specific default, while @samp{"None"} specifies there is no default +paper size. Specific size names are typically @samp{"Letter"} or +@samp{"A4"}. + +Defaults to @samp{"Auto"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string default-policy +Specifies the default access policy to use. + +Defaults to @samp{"default"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean default-shared? +Specifies whether local printers are shared by default. + +Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer dirty-clean-interval +Specifies the delay for updating of configuration and state files, in +seconds. A value of 0 causes the update to happen as soon as possible, +typically within a few milliseconds. + +Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} error-policy error-policy +Specifies what to do when an error occurs. Possible values are +@code{abort-job}, which will discard the failed print job; @code{retry-job}, +which will retry the job at a later time; @code{retry-this-job}, which +retries the failed job immediately; and @code{stop-printer}, which stops the +printer. + +Defaults to @samp{stop-printer}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer filter-limit +Specifies the maximum cost of filters that are run concurrently, which can +be used to minimize disk, memory, and CPU resource problems. A limit of 0 +disables filter limiting. An average print to a non-PostScript printer +needs a filter limit of about 200. A PostScript printer needs about half +that (100). Setting the limit below these thresholds will effectively limit +the scheduler to printing a single job at any time. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer filter-nice +Specifies the scheduling priority of filters that are run to print a job. +The nice value ranges from 0, the highest priority, to 19, the lowest +priority. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} host-name-lookups host-name-lookups +Specifies whether to do reverse lookups on connecting clients. The +@code{double} setting causes @code{cupsd} to verify that the hostname +resolved from the address matches one of the addresses returned for that +hostname. Double lookups also prevent clients with unregistered addresses +from connecting to your server. Only set this option to @code{#t} or +@code{double} if absolutely required. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer job-kill-delay +Specifies the number of seconds to wait before killing the filters and +backend associated with a canceled or held job. + +Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer job-retry-interval +Specifies the interval between retries of jobs in seconds. This is +typically used for fax queues but can also be used with normal print queues +whose error policy is @code{retry-job} or @code{retry-current-job}. + +Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer job-retry-limit +Specifies the number of retries that are done for jobs. This is typically +used for fax queues but can also be used with normal print queues whose +error policy is @code{retry-job} or @code{retry-current-job}. + +Defaults to @samp{5}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean keep-alive? +Specifies whether to support HTTP keep-alive connections. + +Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer keep-alive-timeout +Specifies how long an idle client connection remains open, in seconds. + +Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer limit-request-body +Specifies the maximum size of print files, IPP requests, and HTML form +data. A limit of 0 disables the limit check. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} multiline-string-list listen +Listens on the specified interfaces for connections. Valid values are of +the form @var{address}:@var{port}, where @var{address} is either an IPv6 +address enclosed in brackets, an IPv4 address, or @code{*} to indicate all +addresses. Values can also be file names of local UNIX domain sockets. The +Listen directive is similar to the Port directive but allows you to restrict +access to specific interfaces or networks. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer listen-back-log +Specifies the number of pending connections that will be allowed. This +normally only affects very busy servers that have reached the MaxClients +limit, but can also be triggered by large numbers of simultaneous +connections. When the limit is reached, the operating system will refuse +additional connections until the scheduler can accept the pending ones. + +Defaults to @samp{128}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} location-access-control-list location-access-controls +Specifies a set of additional access controls. + +Available @code{location-access-controls} fields are: + +@deftypevr {@code{location-access-controls} parameter} file-name path +Specifies the URI path to which the access control applies. +@end deftypevr + +@deftypevr {@code{location-access-controls} parameter} access-control-list access-controls +Access controls for all access to this path, in the same format as the +@code{access-controls} of @code{operation-access-control}. + +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{location-access-controls} parameter} method-access-control-list method-access-controls +Access controls for method-specific access to this path. + +Defaults to @samp{()}. + +Available @code{method-access-controls} fields are: + +@deftypevr {@code{method-access-controls} parameter} boolean reverse? +If @code{#t}, apply access controls to all methods except the listed +methods. Otherwise apply to only the listed methods. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{method-access-controls} parameter} method-list methods +Methods to which this access control applies. + +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{method-access-controls} parameter} access-control-list access-controls +Access control directives, as a list of strings. Each string should be one +directive, such as "Order allow,deny". + +Defaults to @samp{()}. +@end deftypevr +@end deftypevr +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer log-debug-history +Specifies the number of debugging messages that are retained for logging if +an error occurs in a print job. Debug messages are logged regardless of the +LogLevel setting. + +Defaults to @samp{100}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} log-level log-level +Specifies the level of logging for the ErrorLog file. The value @code{none} +stops all logging while @code{debug2} logs everything. + +Defaults to @samp{info}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} log-time-format log-time-format +Specifies the format of the date and time in the log files. The value +@code{standard} logs whole seconds while @code{usecs} logs microseconds. + +Defaults to @samp{standard}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-clients +Specifies the maximum number of simultaneous clients that are allowed by the +scheduler. + +Defaults to @samp{100}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-clients-per-host +Specifies the maximum number of simultaneous clients that are allowed from a +single address. + +Defaults to @samp{100}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-copies +Specifies the maximum number of copies that a user can print of each job. + +Defaults to @samp{9999}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-hold-time +Specifies the maximum time a job may remain in the @code{indefinite} hold +state before it is canceled. A value of 0 disables cancellation of held +jobs. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-jobs +Specifies the maximum number of simultaneous jobs that are allowed. Set to +0 to allow an unlimited number of jobs. + +Defaults to @samp{500}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-jobs-per-printer +Specifies the maximum number of simultaneous jobs that are allowed per +printer. A value of 0 allows up to MaxJobs jobs per printer. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-jobs-per-user +Specifies the maximum number of simultaneous jobs that are allowed per +user. A value of 0 allows up to MaxJobs jobs per user. + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-job-time +Specifies the maximum time a job may take to print before it is canceled, in +seconds. Set to 0 to disable cancellation of "stuck" jobs. + +Defaults to @samp{10800}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer max-log-size +Specifies the maximum size of the log files before they are rotated, in +bytes. The value 0 disables log rotation. + +Defaults to @samp{1048576}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer multiple-operation-timeout +Specifies the maximum amount of time to allow between files in a multiple +file print job, in seconds. + +Defaults to @samp{300}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string page-log-format +Specifies the format of PageLog lines. Sequences beginning with percent +(@samp{%}) characters are replaced with the corresponding information, while +all other characters are copied literally. The following percent sequences +are recognized: + +@table @samp +@item %% +insert a single percent character + +@item %@{name@} +insert the value of the specified IPP attribute + +@item %C +insert the number of copies for the current page + +@item %P +insert the current page number + +@item %T +insert the current date and time in common log format + +@item %j +insert the job ID + +@item %p +insert the printer name + +@item %u +insert the username +@end table + +A value of the empty string disables page logging. The string @code{%p %u +%j %T %P %C %@{job-billing@} %@{job-originating-host-name@} %@{job-name@} +%@{media@} %@{sides@}} creates a page log with the standard items. + +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} environment-variables environment-variables +Passes the specified environment variable(s) to child processes; a list of +strings. + +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} policy-configuration-list policies +Specifies named access control policies. + +Available @code{policy-configuration} fields are: + +@deftypevr {@code{policy-configuration} parameter} string name +Name of the policy. +@end deftypevr + +@deftypevr {@code{policy-configuration} parameter} string job-private-access +Specifies an access list for a job's private values. @code{@@ACL} maps to +the printer's requesting-user-name-allowed or requesting-user-name-denied +values. @code{@@OWNER} maps to the job's owner. @code{@@SYSTEM} maps to +the groups listed for the @code{system-group} field of the +@code{files-config} configuration, which is reified into the +@code{cups-files.conf(5)} file. Other possible elements of the access list +include specific user names, and @code{@@@var{group}} to indicate members of +a specific group. The access list may also be simply @code{all} or +@code{default}. + +Defaults to @samp{"@@OWNER @@SYSTEM"}. +@end deftypevr + +@deftypevr {@code{policy-configuration} parameter} string job-private-values +Specifies the list of job values to make private, or @code{all}, +@code{default}, or @code{none}. + +Defaults to @samp{"job-name job-originating-host-name +job-originating-user-name phone"}. +@end deftypevr + +@deftypevr {@code{policy-configuration} parameter} string subscription-private-access +Specifies an access list for a subscription's private values. @code{@@ACL} +maps to the printer's requesting-user-name-allowed or +requesting-user-name-denied values. @code{@@OWNER} maps to the job's +owner. @code{@@SYSTEM} maps to the groups listed for the +@code{system-group} field of the @code{files-config} configuration, which is +reified into the @code{cups-files.conf(5)} file. Other possible elements of +the access list include specific user names, and @code{@@@var{group}} to +indicate members of a specific group. The access list may also be simply +@code{all} or @code{default}. + +Defaults to @samp{"@@OWNER @@SYSTEM"}. +@end deftypevr + +@deftypevr {@code{policy-configuration} parameter} string subscription-private-values +Specifies the list of job values to make private, or @code{all}, +@code{default}, or @code{none}. + +Defaults to @samp{"notify-events notify-pull-method notify-recipient-uri +notify-subscriber-user-name notify-user-data"}. +@end deftypevr + +@deftypevr {@code{policy-configuration} parameter} operation-access-control-list access-controls +Access control by IPP operation. + +Defaults to @samp{()}. +@end deftypevr +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean-or-non-negative-integer preserve-job-files +Specifies whether job files (documents) are preserved after a job is +printed. If a numeric value is specified, job files are preserved for the +indicated number of seconds after printing. Otherwise a boolean value +applies indefinitely. + +Defaults to @samp{86400}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean-or-non-negative-integer preserve-job-history +Specifies whether the job history is preserved after a job is printed. If a +numeric value is specified, the job history is preserved for the indicated +number of seconds after printing. If @code{#t}, the job history is +preserved until the MaxJobs limit is reached. + +Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer reload-timeout +Specifies the amount of time to wait for job completion before restarting +the scheduler. + +Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string rip-cache +Specifies the maximum amount of memory to use when converting documents into +bitmaps for a printer. + +Defaults to @samp{"128m"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string server-admin +Specifies the email address of the server administrator. + +Defaults to @samp{"root@@localhost.localdomain"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} host-name-list-or-* server-alias +The ServerAlias directive is used for HTTP Host header validation when +clients connect to the scheduler from external interfaces. Using the +special name @code{*} can expose your system to known browser-based DNS +rebinding attacks, even when accessing sites through a firewall. If the +auto-discovery of alternate names does not work, we recommend listing each +alternate name with a ServerAlias directive instead of using @code{*}. + +Defaults to @samp{*}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string server-name +Specifies the fully-qualified host name of the server. + +Defaults to @samp{"localhost"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} server-tokens server-tokens +Specifies what information is included in the Server header of HTTP +responses. @code{None} disables the Server header. @code{ProductOnly} +reports @code{CUPS}. @code{Major} reports @code{CUPS 2}. @code{Minor} +reports @code{CUPS 2.0}. @code{Minimal} reports @code{CUPS 2.0.0}. +@code{OS} reports @code{CUPS 2.0.0 (@var{uname})} where @var{uname} is the +output of the @code{uname} command. @code{Full} reports @code{CUPS 2.0.0 +(@var{uname}) IPP/2.0}. + +Defaults to @samp{Minimal}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} string set-env +Set the specified environment variable to be passed to child processes. + +Defaults to @samp{"variable value"}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} multiline-string-list ssl-listen +Listens on the specified interfaces for encrypted connections. Valid values +are of the form @var{address}:@var{port}, where @var{address} is either an +IPv6 address enclosed in brackets, an IPv4 address, or @code{*} to indicate +all addresses. + +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} ssl-options ssl-options +Sets encryption options. By default, CUPS only supports encryption using +TLS v1.0 or higher using known secure cipher suites. The @code{AllowRC4} +option enables the 128-bit RC4 cipher suites, which are required for some +older clients that do not implement newer ones. The @code{AllowSSL3} option +enables SSL v3.0, which is required for some older clients that do not +support TLS v1.0. + +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean strict-conformance? +Specifies whether the scheduler requires clients to strictly adhere to the +IPP specifications. + +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} non-negative-integer timeout +Specifies the HTTP request timeout, in seconds. + +Defaults to @samp{300}. + +@end deftypevr + +@deftypevr {@code{cups-configuration} parameter} boolean web-interface? +Specifies whether the web interface is enabled. + +Defaults to @samp{#f}. +@end deftypevr + +At this point you're probably thinking ``oh dear, Guix manual, I like you +but you can stop already with the configuration options''. Indeed. +However, one more point: it could be that you have an existing +@code{cupsd.conf} that you want to use. In that case, you can pass an +@code{opaque-cups-configuration} as the configuration of a +@code{cups-service-type}. + +Available @code{opaque-cups-configuration} fields are: + +@deftypevr {@code{opaque-cups-configuration} parameter} package cups +The CUPS package. +@end deftypevr + +@deftypevr {@code{opaque-cups-configuration} parameter} string cupsd.conf +The contents of the @code{cupsd.conf}, as a string. +@end deftypevr + +@deftypevr {@code{opaque-cups-configuration} parameter} string cups-files.conf +The contents of the @code{cups-files.conf} file, as a string. +@end deftypevr + +For example, if your @code{cupsd.conf} and @code{cups-files.conf} are in +strings of the same name, you could instantiate a CUPS service like this: + +@example +(service cups-service-type + (opaque-cups-configuration + (cupsd.conf cupsd.conf) + (cups-files.conf cups-files.conf))) +@end example + + +@node Desktop Services +@subsection Desktop Services + +The @code{(gnu services desktop)} module provides services that are usually +useful in the context of a ``desktop'' setup---that is, on a machine running +a graphical display server, possibly with graphical user interfaces, etc. +It also defines services that provide specific desktop environments like +GNOME, Xfce or MATE. + +To simplify things, the module defines a variable containing the set of +services that users typically expect on a machine with a graphical +environment and networking: + +@defvr {Scheme Variable} %desktop-services +This is a list of services that builds upon @var{%base-services} and adds or +adjusts services for a typical ``desktop'' setup. + +In particular, it adds a graphical login manager (@pxref{X Window, +@code{gdm-service-type}}), screen lockers, a network management tool +(@pxref{Networking Services, @code{network-manager-service-type}}), energy +and color management services, the @code{elogind} login and seat manager, +the Polkit privilege service, the GeoClue location service, the +AccountsService daemon that allows authorized users change system passwords, +an NTP client (@pxref{Networking Services}), the Avahi daemon, and has the +name service switch service configured to be able to use @code{nss-mdns} +(@pxref{Name Service Switch, mDNS}). +@end defvr + +The @var{%desktop-services} variable can be used as the @code{services} +field of an @code{operating-system} declaration (@pxref{operating-system +Reference, @code{services}}). + +Additionally, the @code{gnome-desktop-service-type}, +@code{xfce-desktop-service}, @code{mate-desktop-service-type} and +@code{enlightenment-desktop-service-type} procedures can add GNOME, Xfce, +MATE and/or Enlightenment to a system. To ``add GNOME'' means that +system-level services like the backlight adjustment helpers and the power +management utilities are added to the system, extending @code{polkit} and +@code{dbus} appropriately, allowing GNOME to operate with elevated +privileges on a limited number of special-purpose system interfaces. +Additionally, adding a service made by @code{gnome-desktop-service-type} +adds the GNOME metapackage to the system profile. Likewise, adding the Xfce +service not only adds the @code{xfce} metapackage to the system profile, but +it also gives the Thunar file manager the ability to open a ``root-mode'' +file management window, if the user authenticates using the administrator's +password via the standard polkit graphical interface. To ``add MATE'' means +that @code{polkit} and @code{dbus} are extended appropriately, allowing MATE +to operate with elevated privileges on a limited number of special-purpose +system interfaces. Additionally, adding a service of type +@code{mate-desktop-service-type} adds the MATE metapackage to the system +profile. ``Adding Enlightenment'' means that @code{dbus} is extended +appropriately, and several of Enlightenment's binaries are set as setuid, +allowing Enlightenment's screen locker and other functionality to work as +expetected. + +The desktop environments in Guix use the Xorg display server by default. If +you'd like to use the newer display server protocol called Wayland, you need +to use the @code{sddm-service} instead of GDM as the graphical login +manager. You should then select the ``GNOME (Wayland)'' session in SDDM. +Alternatively you can also try starting GNOME on Wayland manually from a TTY +with the command ``XDG_SESSION_TYPE=wayland exec dbus-run-session +gnome-session``. Currently only GNOME has support for Wayland. + +@defvr {Scheme Variable} gnome-desktop-service-type +This is the type of the service that adds the @uref{https://www.gnome.org, +GNOME} desktop environment. Its value is a +@code{gnome-desktop-configuration} object (see below.) + +This service adds the @code{gnome} package to the system profile, and +extends polkit with the actions from @code{gnome-settings-daemon}. +@end defvr + +@deftp {Data Type} gnome-desktop-configuration +Configuration record for the GNOME desktop environment. + +@table @asis +@item @code{gnome} (default @code{gnome}) +The GNOME package to use. +@end table +@end deftp + +@defvr {Scheme Variable} xfce-desktop-service-type +This is the type of a service to run the @uref{Xfce, https://xfce.org/} +desktop environment. Its value is an @code{xfce-desktop-configuration} +object (see below.) + +This service that adds the @code{xfce} package to the system profile, and +extends polkit with the ability for @code{thunar} to manipulate the file +system as root from within a user session, after the user has authenticated +with the administrator's password. +@end defvr + +@deftp {Data Type} xfce-desktop-configuration +Configuration record for the Xfce desktop environment. + +@table @asis +@item @code{xfce} (default @code{xfce}) +The Xfce package to use. +@end table +@end deftp + +@deffn {Scheme Variable} mate-desktop-service-type +This is the type of the service that runs the +@uref{https://mate-desktop.org/, MATE desktop environment}. Its value is a +@code{mate-desktop-configuration} object (see below.) + +This service adds the @code{mate} package to the system profile, and extends +polkit with the actions from @code{mate-settings-daemon}. +@end deffn + +@deftp {Data Type} mate-desktop-configuration +Configuration record for the MATE desktop environment. + +@table @asis +@item @code{mate} (default @code{mate}) +The MATE package to use. +@end table +@end deftp + +@deffn {Scheme Variable} enlightenment-desktop-service-type +Return a service that adds the @code{enlightenment} package to the system +profile, and extends dbus with actions from @code{efl}. +@end deffn + +@deftp {Data Type} enlightenment-desktop-service-configuration +@table @asis +@item @code{enlightenment} (default @code{enlightenment}) +The enlightenment package to use. +@end table +@end deftp + +Because the GNOME, Xfce and MATE desktop services pull in so many packages, +the default @code{%desktop-services} variable doesn't include any of them by +default. To add GNOME, Xfce or MATE, just @code{cons} them onto +@code{%desktop-services} in the @code{services} field of your +@code{operating-system}: + +@example +(use-modules (gnu)) +(use-service-modules desktop) +(operating-system + ... + ;; cons* adds items to the list given as its last argument. + (services (cons* (service gnome-desktop-service-type) + (service xfce-desktop-service) + %desktop-services)) + ...) +@end example + +These desktop environments will then be available as options in the +graphical login window. + +The actual service definitions included in @code{%desktop-services} and +provided by @code{(gnu services dbus)} and @code{(gnu services desktop)} are +described below. + +@deffn {Scheme Procedure} dbus-service [#:dbus @var{dbus}] [#:services '()] +Return a service that runs the ``system bus'', using @var{dbus}, with +support for @var{services}. + +@uref{http://dbus.freedesktop.org/, D-Bus} is an inter-process communication +facility. Its system bus is used to allow system services to communicate +and to be notified of system-wide events. + +@var{services} must be a list of packages that provide an +@file{etc/dbus-1/system.d} directory containing additional D-Bus +configuration and policy files. For example, to allow avahi-daemon to use +the system bus, @var{services} must be equal to @code{(list avahi)}. +@end deffn + +@deffn {Scheme Procedure} elogind-service [#:config @var{config}] +Return a service that runs the @code{elogind} login and seat management +daemon. @uref{https://github.com/elogind/elogind, Elogind} exposes a D-Bus +interface that can be used to know which users are logged in, know what kind +of sessions they have open, suspend the system, inhibit system suspend, +reboot the system, and other tasks. + +Elogind handles most system-level power events for a computer, for example +suspending the system when a lid is closed, or shutting it down when the +power button is pressed. + +The @var{config} keyword argument specifies the configuration for elogind, +and should be the result of an @code{(elogind-configuration (@var{parameter} +@var{value})...)} invocation. Available parameters and their default values +are: + +@table @code +@item kill-user-processes? +@code{#f} +@item kill-only-users +@code{()} +@item kill-exclude-users +@code{("root")} +@item inhibit-delay-max-seconds +@code{5} +@item handle-power-key +@code{poweroff} +@item handle-suspend-key +@code{suspend} +@item handle-hibernate-key +@code{hibernate} +@item handle-lid-switch +@code{suspend} +@item handle-lid-switch-docked +@code{ignore} +@item power-key-ignore-inhibited? +@code{#f} +@item suspend-key-ignore-inhibited? +@code{#f} +@item hibernate-key-ignore-inhibited? +@code{#f} +@item lid-switch-ignore-inhibited? +@code{#t} +@item holdoff-timeout-seconds +@code{30} +@item idle-action +@code{ignore} +@item idle-action-seconds +@code{(* 30 60)} +@item runtime-directory-size-percent +@code{10} +@item runtime-directory-size +@code{#f} +@item remove-ipc? +@code{#t} +@item suspend-state +@code{("mem" "standby" "freeze")} +@item suspend-mode +@code{()} +@item hibernate-state +@code{("disk")} +@item hibernate-mode +@code{("platform" "shutdown")} +@item hybrid-sleep-state +@code{("disk")} +@item hybrid-sleep-mode +@code{("suspend" "platform" "shutdown")} +@end table +@end deffn + +@deffn {Scheme Procedure} accountsservice-service @ + [#:accountsservice @var{accountsservice}] Return a service that runs +AccountsService, a system service that can list available accounts, change +their passwords, and so on. AccountsService integrates with PolicyKit to +enable unprivileged users to acquire the capability to modify their system +configuration. +@uref{https://www.freedesktop.org/wiki/Software/AccountsService/, the +accountsservice web site} for more information. + +The @var{accountsservice} keyword argument is the @code{accountsservice} +package to expose as a service. +@end deffn + +@deffn {Scheme Procedure} polkit-service @ + [#:polkit @var{polkit}] Return a service that runs the +@uref{http://www.freedesktop.org/wiki/Software/polkit/, Polkit privilege +management service}, which allows system administrators to grant access to +privileged operations in a structured way. By querying the Polkit service, +a privileged system component can know when it should grant additional +capabilities to ordinary users. For example, an ordinary user can be +granted the capability to suspend the system if the user is logged in +locally. +@end deffn + +@defvr {Scheme Variable} upower-service-type +Service that runs @uref{http://upower.freedesktop.org/, @command{upowerd}}, +a system-wide monitor for power consumption and battery levels, with the +given configuration settings. + +It implements the @code{org.freedesktop.UPower} D-Bus interface, and is +notably used by GNOME. +@end defvr + +@deftp {Data Type} upower-configuration +Data type representation the configuration for UPower. + +@table @asis + +@item @code{upower} (default: @var{upower}) +Package to use for @code{upower}. + +@item @code{watts-up-pro?} (default: @code{#f}) +Enable the Watts Up Pro device. + +@item @code{poll-batteries?} (default: @code{#t}) +Enable polling the kernel for battery level changes. + +@item @code{ignore-lid?} (default: @code{#f}) +Ignore the lid state, this can be useful if it's incorrect on a device. + +@item @code{use-percentage-for-policy?} (default: @code{#f}) +Whether battery percentage based policy should be used. The default is to +use the time left, change to @code{#t} to use the percentage. + +@item @code{percentage-low} (default: @code{10}) +When @code{use-percentage-for-policy?} is @code{#t}, this sets the +percentage at which the battery is considered low. + +@item @code{percentage-critical} (default: @code{3}) +When @code{use-percentage-for-policy?} is @code{#t}, this sets the +percentage at which the battery is considered critical. + +@item @code{percentage-action} (default: @code{2}) +When @code{use-percentage-for-policy?} is @code{#t}, this sets the +percentage at which action will be taken. + +@item @code{time-low} (default: @code{1200}) +When @code{use-time-for-policy?} is @code{#f}, this sets the time remaining +in seconds at which the battery is considered low. + +@item @code{time-critical} (default: @code{300}) +When @code{use-time-for-policy?} is @code{#f}, this sets the time remaining +in seconds at which the battery is considered critical. + +@item @code{time-action} (default: @code{120}) +When @code{use-time-for-policy?} is @code{#f}, this sets the time remaining +in seconds at which action will be taken. + +@item @code{critical-power-action} (default: @code{'hybrid-sleep}) +The action taken when @code{percentage-action} or @code{time-action} is +reached (depending on the configuration of +@code{use-percentage-for-policy?}). + +Possible values are: + +@itemize @bullet +@item +@code{'power-off} + +@item +@code{'hibernate} + +@item +@code{'hybrid-sleep}. +@end itemize + +@end table +@end deftp + +@deffn {Scheme Procedure} udisks-service [#:udisks @var{udisks}] +Return a service for @uref{http://udisks.freedesktop.org/docs/latest/, +UDisks}, a @dfn{disk management} daemon that provides user interfaces with +notifications and ways to mount/unmount disks. Programs that talk to UDisks +include the @command{udisksctl} command, part of UDisks, and GNOME Disks. +@end deffn + +@deffn {Scheme Procedure} colord-service [#:colord @var{colord}] +Return a service that runs @command{colord}, a system service with a D-Bus +interface to manage the color profiles of input and output devices such as +screens and scanners. It is notably used by the GNOME Color Manager +graphical tool. See @uref{http://www.freedesktop.org/software/colord/, the +colord web site} for more information. +@end deffn + +@deffn {Scheme Procedure} geoclue-application name [#:allowed? #t] [#:system? #f] [#:users '()] +Return a configuration allowing an application to access GeoClue location +data. @var{name} is the Desktop ID of the application, without the +@code{.desktop} part. If @var{allowed?} is true, the application will have +access to location information by default. The boolean @var{system?} value +indicates whether an application is a system component or not. Finally +@var{users} is a list of UIDs of all users for which this application is +allowed location info access. An empty users list means that all users are +allowed. +@end deffn + +@defvr {Scheme Variable} %standard-geoclue-applications +The standard list of well-known GeoClue application configurations, granting +authority to the GNOME date-and-time utility to ask for the current location +in order to set the time zone, and allowing the IceCat and Epiphany web +browsers to request location information. IceCat and Epiphany both query +the user before allowing a web page to know the user's location. +@end defvr + +@deffn {Scheme Procedure} geoclue-service [#:colord @var{colord}] @ + [#:whitelist '()] @ [#:wifi-geolocation-url +"https://location.services.mozilla.com/v1/geolocate?key=geoclue"] @ +[#:submit-data? #f] [#:wifi-submission-url +"https://location.services.mozilla.com/v1/submit?key=geoclue"] @ +[#:submission-nick "geoclue"] @ [#:applications +%standard-geoclue-applications] Return a service that runs the GeoClue +location service. This service provides a D-Bus interface to allow +applications to request access to a user's physical location, and optionally +to add information to online location databases. See +@uref{https://wiki.freedesktop.org/www/Software/GeoClue/, the GeoClue web +site} for more information. +@end deffn + +@deffn {Scheme Procedure} bluetooth-service [#:bluez @var{bluez}] @ + [@w{#:auto-enable? #f}] Return a service that runs the @command{bluetoothd} +daemon, which manages all the Bluetooth devices and provides a number of +D-Bus interfaces. When AUTO-ENABLE? is true, the bluetooth controller is +powered automatically at boot, which can be useful when using a bluetooth +keyboard or mouse. + +Users need to be in the @code{lp} group to access the D-Bus service. +@end deffn + +@node Sound Services +@subsection Sound Services + +@cindex sound support +@cindex ALSA +@cindex PulseAudio, sound support + +The @code{(gnu services sound)} module provides a service to configure the +Advanced Linux Sound Architecture (ALSA) system, which makes PulseAudio the +preferred ALSA output driver. + +@deffn {Scheme Variable} alsa-service-type +This is the type for the @uref{https://alsa-project.org/, Advanced Linux +Sound Architecture} (ALSA) system, which generates the +@file{/etc/asound.conf} configuration file. The value for this type is a +@command{alsa-configuration} record as in this example: + +@example +(service alsa-service-type) +@end example + +See below for details about @code{alsa-configuration}. +@end deffn + +@deftp {Data Type} alsa-configuration +Data type representing the configuration for @code{alsa-service}. + +@table @asis +@item @code{alsa-plugins} (default: @var{alsa-plugins}) +@code{alsa-plugins} package to use. + +@item @code{pulseaudio?} (default: @var{#t}) +Whether ALSA applications should transparently be made to use the +@uref{http://www.pulseaudio.org/, PulseAudio} sound server. + +Using PulseAudio allows you to run several sound-producing applications at +the same time and to individual control them @i{via} @command{pavucontrol}, +among other things. + +@item @code{extra-options} (default: @var{""}) +String to append to the @file{/etc/asound.conf} file. + +@end table +@end deftp + +Individual users who want to override the system configuration of ALSA can +do it with the @file{~/.asoundrc} file: + +@example +# In guix, we have to specify the absolute path for plugins. +pcm_type.jack @{ + lib "/home/alice/.guix-profile/lib/alsa-lib/libasound_module_pcm_jack.so" +@} + +# Routing ALSA to jack: +# <http://jackaudio.org/faq/routing_alsa.html>. +pcm.rawjack @{ + type jack + playback_ports @{ + 0 system:playback_1 + 1 system:playback_2 + @} + + capture_ports @{ + 0 system:capture_1 + 1 system:capture_2 + @} +@} + +pcm.!default @{ + type plug + slave @{ + pcm "rawjack" + @} +@} +@end example + +See @uref{https://www.alsa-project.org/main/index.php/Asoundrc} for the +details. + + +@node Database Services +@subsection Database Services + +@cindex database +@cindex SQL +The @code{(gnu services databases)} module provides the following services. + +@deffn {Scheme Procedure} postgresql-service [#:postgresql postgresql] @ + [#:config-file] [#:data-directory ``/var/lib/postgresql/data''] @ [#:port +5432] [#:locale ``en_US.utf8''] [#:extension-packages '()] Return a service +that runs @var{postgresql}, the PostgreSQL database server. + +The PostgreSQL daemon loads its runtime configuration from +@var{config-file}, creates a database cluster with @var{locale} as the +default locale, stored in @var{data-directory}. It then listens on +@var{port}. + +@cindex postgresql extension-packages +Additional extensions are loaded from packages listed in +@var{extension-packages}. Extensions are available at runtime. For +instance, to create a geographic database using the @code{postgis} +extension, a user can configure the postgresql-service as in this example: + +@cindex postgis +@example +(use-package-modules databases geo) + +(operating-system + ... + ;; postgresql is required to run `psql' but postgis is not required for + ;; proper operation. + (packages (cons* postgresql %base-packages)) + (services + (cons* + (postgresql-service #:extension-packages (list postgis)) + %base-services))) +@end example + +Then the extension becomes visible and you can initialise an empty +geographic database in this way: + +@example +psql -U postgres +> create database postgistest; +> \connect postgistest; +> create extension postgis; +> create extension postgis_topology; +@end example + +There is no need to add this field for contrib extensions such as hstore or +dblink as they are already loadable by postgresql. This field is only +required to add extensions provided by other packages. +@end deffn + +@deffn {Scheme Procedure} mysql-service [#:config (mysql-configuration)] +Return a service that runs @command{mysqld}, the MySQL or MariaDB database +server. + +The optional @var{config} argument specifies the configuration for +@command{mysqld}, which should be a @code{<mysql-configuration>} object. +@end deffn + +@deftp {Data Type} mysql-configuration +Data type representing the configuration of @var{mysql-service}. + +@table @asis +@item @code{mysql} (default: @var{mariadb}) +Package object of the MySQL database server, can be either @var{mariadb} or +@var{mysql}. + +For MySQL, a temporary root password will be displayed at activation time. +For MariaDB, the root password is empty. + +@item @code{port} (default: @code{3306}) +TCP port on which the database server listens for incoming connections. +@end table +@end deftp + +@defvr {Scheme Variable} memcached-service-type +This is the service type for the @uref{https://memcached.org/, Memcached} +service, which provides a distributed in memory cache. The value for the +service type is a @code{memcached-configuration} object. +@end defvr + +@example +(service memcached-service-type) +@end example + +@deftp {Data Type} memcached-configuration +Data type representing the configuration of memcached. + +@table @asis +@item @code{memcached} (default: @code{memcached}) +The Memcached package to use. + +@item @code{interfaces} (default: @code{'("0.0.0.0")}) +Network interfaces on which to listen. + +@item @code{tcp-port} (default: @code{11211}) +Port on which to accept connections on, + +@item @code{udp-port} (default: @code{11211}) +Port on which to accept UDP connections on, a value of 0 will disable +listening on a UDP socket. + +@item @code{additional-options} (default: @code{'()}) +Additional command line options to pass to @code{memcached}. +@end table +@end deftp + +@defvr {Scheme Variable} mongodb-service-type +This is the service type for @uref{https://www.mongodb.com/, MongoDB}. The +value for the service type is a @code{mongodb-configuration} object. +@end defvr + +@example +(service mongodb-service-type) +@end example + +@deftp {Data Type} mongodb-configuration +Data type representing the configuration of mongodb. + +@table @asis +@item @code{mongodb} (default: @code{mongodb}) +The MongoDB package to use. + +@item @code{config-file} (default: @code{%default-mongodb-configuration-file}) +The configuration file for MongoDB. + +@item @code{data-directory} (default: @code{"/var/lib/mongodb"}) +This value is used to create the directory, so that it exists and is owned +by the mongodb user. It should match the data-directory which MongoDB is +configured to use through the configuration file. +@end table +@end deftp + +@defvr {Scheme Variable} redis-service-type +This is the service type for the @uref{https://redis.io/, Redis} key/value +store, whose value is a @code{redis-configuration} object. +@end defvr + +@deftp {Data Type} redis-configuration +Data type representing the configuration of redis. + +@table @asis +@item @code{redis} (default: @code{redis}) +The Redis package to use. + +@item @code{bind} (default: @code{"127.0.0.1"}) +Network interface on which to listen. + +@item @code{port} (default: @code{6379}) +Port on which to accept connections on, a value of 0 will disable listening +on a TCP socket. + +@item @code{working-directory} (default: @code{"/var/lib/redis"}) +Directory in which to store the database and related files. +@end table +@end deftp + +@node Mail Services +@subsection Mail Services + +@cindex mail +@cindex email +The @code{(gnu services mail)} module provides Guix service definitions for +email services: IMAP, POP3, and LMTP servers, as well as mail transport +agents (MTAs). Lots of acronyms! These services are detailed in the +subsections below. + +@subsubheading Dovecot Service + +@deffn {Scheme Procedure} dovecot-service [#:config (dovecot-configuration)] +Return a service that runs the Dovecot IMAP/POP3/LMTP mail server. +@end deffn + +By default, Dovecot does not need much configuration; the default +configuration object created by @code{(dovecot-configuration)} will suffice +if your mail is delivered to @code{~/Maildir}. A self-signed certificate +will be generated for TLS-protected connections, though Dovecot will also +listen on cleartext ports by default. There are a number of options, +though, which mail administrators might need to change, and as is the case +with other services, Guix allows the system administrator to specify these +parameters via a uniform Scheme interface. + +For example, to specify that mail is located at @code{maildir~/.mail}, one +would instantiate the Dovecot service like this: + +@example +(dovecot-service #:config + (dovecot-configuration + (mail-location "maildir:~/.mail"))) +@end example + +The available configuration parameters follow. Each parameter definition is +preceded by its type; for example, @samp{string-list foo} indicates that the +@code{foo} parameter should be specified as a list of strings. There is +also a way to specify the configuration as a string, if you have an old +@code{dovecot.conf} file that you want to port over from some other system; +see the end for more details. + +@c The following documentation was initially generated by +@c (generate-documentation) in (gnu services mail). Manually maintained +@c documentation is better, so we shouldn't hesitate to edit below as +@c needed. However if the change you want to make to this documentation +@c can be done in an automated way, it's probably easier to change +@c (generate-documentation) than to make it below and have to deal with +@c the churn as dovecot updates. + +Available @code{dovecot-configuration} fields are: + +@deftypevr {@code{dovecot-configuration} parameter} package dovecot +The dovecot package. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} comma-separated-string-list listen +A list of IPs or hosts where to listen for connections. @samp{*} listens on +all IPv4 interfaces, @samp{::} listens on all IPv6 interfaces. If you want +to specify non-default ports or anything more complex, customize the address +and port fields of the @samp{inet-listener} of the specific services you are +interested in. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} protocol-configuration-list protocols +List of protocols we want to serve. Available protocols include +@samp{imap}, @samp{pop3}, and @samp{lmtp}. + +Available @code{protocol-configuration} fields are: + +@deftypevr {@code{protocol-configuration} parameter} string name +The name of the protocol. +@end deftypevr + +@deftypevr {@code{protocol-configuration} parameter} string auth-socket-path +UNIX socket path to the master authentication server to find users. This is +used by imap (for shared users) and lda. It defaults to +@samp{"/var/run/dovecot/auth-userdb"}. +@end deftypevr + +@deftypevr {@code{protocol-configuration} parameter} space-separated-string-list mail-plugins +Space separated list of plugins to load. +@end deftypevr + +@deftypevr {@code{protocol-configuration} parameter} non-negative-integer mail-max-userip-connections +Maximum number of IMAP connections allowed for a user from each IP address. +NOTE: The username is compared case-sensitively. Defaults to @samp{10}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} service-configuration-list services +List of services to enable. Available services include @samp{imap}, +@samp{imap-login}, @samp{pop3}, @samp{pop3-login}, @samp{auth}, and +@samp{lmtp}. + +Available @code{service-configuration} fields are: + +@deftypevr {@code{service-configuration} parameter} string kind +The service kind. Valid values include @code{director}, @code{imap-login}, +@code{pop3-login}, @code{lmtp}, @code{imap}, @code{pop3}, @code{auth}, +@code{auth-worker}, @code{dict}, @code{tcpwrap}, @code{quota-warning}, or +anything else. +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} listener-configuration-list listeners +Listeners for the service. A listener is either a +@code{unix-listener-configuration}, a @code{fifo-listener-configuration}, or +an @code{inet-listener-configuration}. Defaults to @samp{()}. + +Available @code{unix-listener-configuration} fields are: + +@deftypevr {@code{unix-listener-configuration} parameter} string path +Path to the file, relative to @code{base-dir} field. This is also used as +the section name. +@end deftypevr + +@deftypevr {@code{unix-listener-configuration} parameter} string mode +The access mode for the socket. Defaults to @samp{"0600"}. +@end deftypevr + +@deftypevr {@code{unix-listener-configuration} parameter} string user +The user to own the socket. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{unix-listener-configuration} parameter} string group +The group to own the socket. Defaults to @samp{""}. +@end deftypevr + + +Available @code{fifo-listener-configuration} fields are: + +@deftypevr {@code{fifo-listener-configuration} parameter} string path +Path to the file, relative to @code{base-dir} field. This is also used as +the section name. +@end deftypevr + +@deftypevr {@code{fifo-listener-configuration} parameter} string mode +The access mode for the socket. Defaults to @samp{"0600"}. +@end deftypevr + +@deftypevr {@code{fifo-listener-configuration} parameter} string user +The user to own the socket. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{fifo-listener-configuration} parameter} string group +The group to own the socket. Defaults to @samp{""}. +@end deftypevr + + +Available @code{inet-listener-configuration} fields are: + +@deftypevr {@code{inet-listener-configuration} parameter} string protocol +The protocol to listen for. +@end deftypevr + +@deftypevr {@code{inet-listener-configuration} parameter} string address +The address on which to listen, or empty for all addresses. Defaults to +@samp{""}. +@end deftypevr + +@deftypevr {@code{inet-listener-configuration} parameter} non-negative-integer port +The port on which to listen. +@end deftypevr + +@deftypevr {@code{inet-listener-configuration} parameter} boolean ssl? +Whether to use SSL for this service; @samp{yes}, @samp{no}, or +@samp{required}. Defaults to @samp{#t}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} non-negative-integer client-limit +Maximum number of simultaneous client connections per process. Once this +number of connections is received, the next incoming connection will prompt +Dovecot to spawn another process. If set to 0, @code{default-client-limit} +is used instead. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} non-negative-integer service-count +Number of connections to handle before starting a new process. Typically +the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 is +faster. <doc/wiki/LoginProcess.txt>. Defaults to @samp{1}. + +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} non-negative-integer process-limit +Maximum number of processes that can exist for this service. If set to 0, +@code{default-process-limit} is used instead. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} non-negative-integer process-min-avail +Number of processes to always keep waiting for more connections. Defaults +to @samp{0}. +@end deftypevr + +@deftypevr {@code{service-configuration} parameter} non-negative-integer vsz-limit +If you set @samp{service-count 0}, you probably need to grow this. Defaults +to @samp{256000000}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} dict-configuration dict +Dict configuration, as created by the @code{dict-configuration} constructor. + +Available @code{dict-configuration} fields are: + +@deftypevr {@code{dict-configuration} parameter} free-form-fields entries +A list of key-value pairs that this dict should hold. Defaults to +@samp{()}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} passdb-configuration-list passdbs +A list of passdb configurations, each one created by the +@code{passdb-configuration} constructor. + +Available @code{passdb-configuration} fields are: + +@deftypevr {@code{passdb-configuration} parameter} string driver +The driver that the passdb should use. Valid values include @samp{pam}, +@samp{passwd}, @samp{shadow}, @samp{bsdauth}, and @samp{static}. Defaults +to @samp{"pam"}. +@end deftypevr + +@deftypevr {@code{passdb-configuration} parameter} space-separated-string-list args +Space separated list of arguments to the passdb driver. Defaults to +@samp{""}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} userdb-configuration-list userdbs +List of userdb configurations, each one created by the +@code{userdb-configuration} constructor. + +Available @code{userdb-configuration} fields are: + +@deftypevr {@code{userdb-configuration} parameter} string driver +The driver that the userdb should use. Valid values include @samp{passwd} +and @samp{static}. Defaults to @samp{"passwd"}. +@end deftypevr + +@deftypevr {@code{userdb-configuration} parameter} space-separated-string-list args +Space separated list of arguments to the userdb driver. Defaults to +@samp{""}. +@end deftypevr + +@deftypevr {@code{userdb-configuration} parameter} free-form-args override-fields +Override fields from passwd. Defaults to @samp{()}. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} plugin-configuration plugin-configuration +Plug-in configuration, created by the @code{plugin-configuration} +constructor. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} list-of-namespace-configuration namespaces +List of namespaces. Each item in the list is created by the +@code{namespace-configuration} constructor. + +Available @code{namespace-configuration} fields are: + +@deftypevr {@code{namespace-configuration} parameter} string name +Name for this namespace. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} string type +Namespace type: @samp{private}, @samp{shared} or @samp{public}. Defaults to +@samp{"private"}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} string separator +Hierarchy separator to use. You should use the same separator for all +namespaces or some clients get confused. @samp{/} is usually a good one. +The default however depends on the underlying mail storage format. Defaults +to @samp{""}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} string prefix +Prefix required to access this namespace. This needs to be different for +all namespaces. For example @samp{Public/}. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} string location +Physical location of the mailbox. This is in the same format as +mail_location, which is also the default for it. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} boolean inbox? +There can be only one INBOX, and this setting defines which namespace has +it. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} boolean hidden? +If namespace is hidden, it's not advertised to clients via NAMESPACE +extension. You'll most likely also want to set @samp{list? #f}. This is +mostly useful when converting from another server with different namespaces +which you want to deprecate but still keep working. For example you can +create hidden namespaces with prefixes @samp{~/mail/}, @samp{~%u/mail/} and +@samp{mail/}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} boolean list? +Show the mailboxes under this namespace with the LIST command. This makes +the namespace visible for clients that do not support the NAMESPACE +extension. The special @code{children} value lists child mailboxes, but +hides the namespace prefix. Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} boolean subscriptions? +Namespace handles its own subscriptions. If set to @code{#f}, the parent +namespace handles them. The empty prefix should always have this as +@code{#t}). Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{namespace-configuration} parameter} mailbox-configuration-list mailboxes +List of predefined mailboxes in this namespace. Defaults to @samp{()}. + +Available @code{mailbox-configuration} fields are: + +@deftypevr {@code{mailbox-configuration} parameter} string name +Name for this mailbox. +@end deftypevr + +@deftypevr {@code{mailbox-configuration} parameter} string auto +@samp{create} will automatically create this mailbox. @samp{subscribe} will +both create and subscribe to the mailbox. Defaults to @samp{"no"}. +@end deftypevr + +@deftypevr {@code{mailbox-configuration} parameter} space-separated-string-list special-use +List of IMAP @code{SPECIAL-USE} attributes as specified by RFC 6154. Valid +values are @code{\All}, @code{\Archive}, @code{\Drafts}, @code{\Flagged}, +@code{\Junk}, @code{\Sent}, and @code{\Trash}. Defaults to @samp{()}. +@end deftypevr + +@end deftypevr + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name base-dir +Base directory where to store runtime data. Defaults to +@samp{"/var/run/dovecot/"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string login-greeting +Greeting message for clients. Defaults to @samp{"Dovecot ready."}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list login-trusted-networks +List of trusted network ranges. Connections from these IPs are allowed to +override their IP addresses and ports (for logging and for authentication +checks). @samp{disable-plaintext-auth} is also ignored for these networks. +Typically you would specify your IMAP proxy servers here. Defaults to +@samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list login-access-sockets +List of login access check sockets (e.g.@: tcpwrap). Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean verbose-proctitle? +Show more verbose process titles (in ps). Currently shows user name and IP +address. Useful for seeing who is actually using the IMAP processes (e.g.@: +shared mailboxes or if the same uid is used for multiple accounts). +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean shutdown-clients? +Should all processes be killed when Dovecot master process shuts down. +Setting this to @code{#f} means that Dovecot can be upgraded without forcing +existing client connections to close (although that could also be a problem +if the upgrade is e.g.@: due to a security fix). Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer doveadm-worker-count +If non-zero, run mail commands via this many connections to doveadm server, +instead of running them directly in the same process. Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string doveadm-socket-path +UNIX socket or host:port used for connecting to doveadm server. Defaults to +@samp{"doveadm-server"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list import-environment +List of environment variables that are preserved on Dovecot startup and +passed down to all of its child processes. You can also give key=value +pairs to always set specific settings. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean disable-plaintext-auth? +Disable LOGIN command and all other plaintext authentications unless SSL/TLS +is used (LOGINDISABLED capability). Note that if the remote IP matches the +local IP (i.e.@: you're connecting from the same computer), the connection +is considered secure and plaintext authentication is allowed. See also +ssl=required setting. Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer auth-cache-size +Authentication cache size (e.g.@: @samp{#e10e6}). 0 means it's disabled. +Note that bsdauth, PAM and vpopmail require @samp{cache-key} to be set for +caching to be used. Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-cache-ttl +Time to live for cached data. After TTL expires the cached record is no +longer used, *except* if the main database lookup returns internal failure. +We also try to handle password changes automatically: If user's previous +authentication was successful, but this one wasn't, the cache isn't used. +For now this works only with plaintext authentication. Defaults to @samp{"1 +hour"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-cache-negative-ttl +TTL for negative hits (user not found, password mismatch). 0 disables +caching them completely. Defaults to @samp{"1 hour"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list auth-realms +List of realms for SASL authentication mechanisms that need them. You can +leave it empty if you don't want to support multiple realms. Many clients +simply use the first one listed here, so keep the default realm first. +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-default-realm +Default realm/domain to use if none was specified. This is used for both +SASL realms and appending @@domain to username in plaintext logins. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-username-chars +List of allowed characters in username. If the user-given username contains +a character not listed in here, the login automatically fails. This is just +an extra check to make sure user can't exploit any potential quote escaping +vulnerabilities with SQL/LDAP databases. If you want to allow all +characters, set this value to empty. Defaults to +@samp{"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@@"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-username-translation +Username character translations before it's looked up from databases. The +value contains series of from -> to characters. For example @samp{#@@/@@} +means that @samp{#} and @samp{/} characters are translated to @samp{@@}. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-username-format +Username formatting before it's looked up from databases. You can use the +standard variables here, e.g.@: %Lu would lowercase the username, %n would +drop away the domain if it was given, or @samp{%n-AT-%d} would change the +@samp{@@} into @samp{-AT-}. This translation is done after +@samp{auth-username-translation} changes. Defaults to @samp{"%Lu"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-master-user-separator +If you want to allow master users to log in by specifying the master +username within the normal username string (i.e.@: not using SASL +mechanism's support for it), you can specify the separator character here. +The format is then <username><separator><master username>. UW-IMAP uses +@samp{*} as the separator, so that could be a good choice. Defaults to +@samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-anonymous-username +Username to use for users logging in with ANONYMOUS SASL mechanism. +Defaults to @samp{"anonymous"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer auth-worker-max-count +Maximum number of dovecot-auth worker processes. They're used to execute +blocking passdb and userdb queries (e.g.@: MySQL and PAM). They're +automatically created and destroyed as needed. Defaults to @samp{30}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-gssapi-hostname +Host name to use in GSSAPI principal names. The default is to use the name +returned by gethostname(). Use @samp{$ALL} (with quotes) to allow all +keytab entries. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-krb5-keytab +Kerberos keytab to use for the GSSAPI mechanism. Will use the system +default (usually @file{/etc/krb5.keytab}) if not specified. You may need to +change the auth service to run as root to be able to read this file. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-use-winbind? +Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +@samp{ntlm-auth} helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name auth-winbind-helper-path +Path for Samba's @samp{ntlm-auth} helper binary. Defaults to +@samp{"/usr/bin/ntlm_auth"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string auth-failure-delay +Time to delay before replying to failed authentications. Defaults to +@samp{"2 secs"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-ssl-require-client-cert? +Require a valid SSL client certificate or the authentication fails. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-ssl-username-from-cert? +Take the username from client's SSL certificate, using +@code{X509_NAME_get_text_by_NID()} which returns the subject's DN's +CommonName. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list auth-mechanisms +List of wanted authentication mechanisms. Supported mechanisms are: +@samp{plain}, @samp{login}, @samp{digest-md5}, @samp{cram-md5}, @samp{ntlm}, +@samp{rpa}, @samp{apop}, @samp{anonymous}, @samp{gssapi}, @samp{otp}, +@samp{skey}, and @samp{gss-spnego}. NOTE: See also +@samp{disable-plaintext-auth} setting. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list director-servers +List of IPs or hostnames to all director servers, including ourself. Ports +can be specified as ip:port. The default port is the same as what director +service's @samp{inet-listener} is using. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list director-mail-servers +List of IPs or hostnames to all backend mail servers. Ranges are allowed +too, like 10.0.0.10-10.0.0.30. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string director-user-expire +How long to redirect users to a specific server after it no longer has any +connections. Defaults to @samp{"15 min"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string director-username-hash +How the username is translated before being hashed. Useful values include +%Ln if user can log in with or without @@domain, %Ld if mailboxes are shared +within domain. Defaults to @samp{"%Lu"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string log-path +Log file to use for error messages. @samp{syslog} logs to syslog, +@samp{/dev/stderr} logs to stderr. Defaults to @samp{"syslog"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string info-log-path +Log file to use for informational messages. Defaults to @samp{log-path}. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string debug-log-path +Log file to use for debug messages. Defaults to @samp{info-log-path}. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string syslog-facility +Syslog facility to use if you're logging to syslog. Usually if you don't +want to use @samp{mail}, you'll use local0..local7. Also other standard +facilities are supported. Defaults to @samp{"mail"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-verbose? +Log unsuccessful authentication attempts and the reasons why they failed. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-verbose-passwords? +In case of password mismatches, log the attempted password. Valid values +are no, plain and sha1. sha1 can be useful for detecting brute force +password attempts vs. user simply trying the same password over and over +again. You can also truncate the value to n chars by appending ":n" (e.g.@: +sha1:6). Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-debug? +Even more verbose logging for debugging purposes. Shows for example SQL +queries. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean auth-debug-passwords? +In case of password mismatches, log the passwords and used scheme so the +problem can be debugged. Enabling this also enables @samp{auth-debug}. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mail-debug? +Enable mail process debugging. This can help you figure out why Dovecot +isn't finding your mails. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean verbose-ssl? +Show protocol level SSL errors. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string log-timestamp +Prefix for each line written to log file. % codes are in strftime(3) +format. Defaults to @samp{"\"%b %d %H:%M:%S \""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list login-log-format-elements +List of elements we want to log. The elements which have a non-empty +variable value are joined together to form a comma-separated string. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string login-log-format +Login log format. %s contains @samp{login-log-format-elements} string, %$ +contains the data we want to log. Defaults to @samp{"%$: %s"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-log-prefix +Log prefix for mail processes. See doc/wiki/Variables.txt for list of +possible variables you can use. Defaults to +@samp{"\"%s(%u)<%@{pid@}><%@{session@}>: \""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string deliver-log-format +Format to use for logging mail deliveries. You can use variables: +@table @code +@item %$ +Delivery status message (e.g.@: @samp{saved to INBOX}) +@item %m +Message-ID +@item %s +Subject +@item %f +From address +@item %p +Physical size +@item %w +Virtual size. +@end table +Defaults to @samp{"msgid=%m: %$"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-location +Location for users' mailboxes. The default is empty, which means that +Dovecot tries to find the mailboxes automatically. This won't work if the +user doesn't yet have any mail, so you should explicitly tell Dovecot the +full location. + +If you're using mbox, giving a path to the INBOX file (e.g.@: /var/mail/%u) +isn't enough. You'll also need to tell Dovecot where the other mailboxes +are kept. This is called the "root mail directory", and it must be the +first path given in the @samp{mail-location} setting. + +There are a few special variables you can use, eg.: + +@table @samp +@item %u +username +@item %n +user part in user@@domain, same as %u if there's no domain +@item %d +domain part in user@@domain, empty if there's no domain +@item %h +home director +@end table + +See doc/wiki/Variables.txt for full list. Some examples: +@table @samp +@item maildir:~/Maildir +@item mbox:~/mail:INBOX=/var/mail/%u +@item mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/% +@end table +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-uid +System user and group used to access mails. If you use multiple, userdb can +override these by returning uid or gid fields. You can use either numbers +or names. <doc/wiki/UserIds.txt>. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-gid + +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-privileged-group +Group to enable temporarily for privileged operations. Currently this is +used only with INBOX when either its initial creation or dotlocking fails. +Typically this is set to "mail" to give access to /var/mail. Defaults to +@samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-access-groups +Grant access to these supplementary groups for mail processes. Typically +these are used to set up access to shared mailboxes. Note that it may be +dangerous to set these if users can create symlinks (e.g.@: if "mail" group +is set here, ln -s /var/mail ~/mail/var could allow a user to delete others' +mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading +it). Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mail-full-filesystem-access? +Allow full file system access to clients. There's no access checks other +than what the operating system does for the active UID/GID. It works with +both maildir and mboxes, allowing you to prefix mailboxes names with e.g.@: +/path/ or ~user/. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mmap-disable? +Don't use mmap() at all. This is required if you store indexes to shared +file systems (NFS or clustered file system). Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean dotlock-use-excl? +Rely on @samp{O_EXCL} to work when creating dotlock files. NFS supports +@samp{O_EXCL} since version 3, so this should be safe to use nowadays by +default. Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-fsync +When to use fsync() or fdatasync() calls: +@table @code +@item optimized +Whenever necessary to avoid losing important data +@item always +Useful with e.g.@: NFS when write()s are delayed +@item never +Never use it (best performance, but crashes can lose data). +@end table +Defaults to @samp{"optimized"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mail-nfs-storage? +Mail storage exists in NFS. Set this to yes to make Dovecot flush NFS +caches whenever needed. If you're using only a single mail server this +isn't needed. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mail-nfs-index? +Mail index files also exist in NFS. Setting this to yes requires +@samp{mmap-disable? #t} and @samp{fsync-disable? #f}. Defaults to +@samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string lock-method +Locking method for index files. Alternatives are fcntl, flock and dotlock. +Dotlocking uses some tricks which may create more disk I/O than other +locking methods. NFS users: flock doesn't work, remember to change +@samp{mmap-disable}. Defaults to @samp{"fcntl"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name mail-temp-dir +Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. +Defaults to @samp{"/tmp"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer first-valid-uid +Valid UID range for users. This is mostly to make sure that users can't log +in as daemons or other system users. Note that denying root logins is +hardcoded to dovecot binary and can't be done even if @samp{first-valid-uid} +is set to 0. Defaults to @samp{500}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer last-valid-uid + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer first-valid-gid +Valid GID range for users. Users having non-valid GID as primary group ID +aren't allowed to log in. If user belongs to supplementary groups with +non-valid GIDs, those groups are not set. Defaults to @samp{1}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer last-valid-gid + +Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mail-max-keyword-length +Maximum allowed length for mail keyword name. It's only forced when trying +to create new keywords. Defaults to @samp{50}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} colon-separated-file-name-list valid-chroot-dirs +List of directories under which chrooting is allowed for mail processes +(i.e.@: /var/mail will allow chrooting to /var/mail/foo/bar too). This +setting doesn't affect @samp{login-chroot} @samp{mail-chroot} or auth chroot +settings. If this setting is empty, "/./" in home dirs are ignored. +WARNING: Never add directories here which local users can modify, that may +lead to root exploit. Usually this should be done only if you don't allow +shell access for users. <doc/wiki/Chrooting.txt>. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-chroot +Default chroot directory for mail processes. This can be overridden for +specific users in user database by giving /./ in user's home directory +(e.g.@: /home/./user chroots into /home). Note that usually there is no +real need to do chrooting, Dovecot doesn't allow users to access files +outside their mail directory anyway. If your home directories are prefixed +with the chroot directory, append "/."@: to @samp{mail-chroot}. +<doc/wiki/Chrooting.txt>. Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name auth-socket-path +UNIX socket path to master authentication server to find users. This is +used by imap (for shared users) and lda. Defaults to +@samp{"/var/run/dovecot/auth-userdb"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name mail-plugin-dir +Directory where to look up mail plugins. Defaults to +@samp{"/usr/lib/dovecot"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list mail-plugins +List of plugins to load for all services. Plugins specific to IMAP, LDA, +etc.@: are added to this list in their own .conf files. Defaults to +@samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mail-cache-min-mail-count +The minimum number of mails in a mailbox before updates are done to cache +file. This allows optimizing Dovecot's behavior to do less disk writes at +the cost of more disk reads. Defaults to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mailbox-idle-check-interval +When IDLE command is running, mailbox is checked once in a while to see if +there are any new mails or other changes. This setting defines the minimum +time to wait between those checks. Dovecot can also use dnotify, inotify +and kqueue to find out immediately when changes occur. Defaults to +@samp{"30 secs"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mail-save-crlf? +Save mails with CR+LF instead of plain LF. This makes sending those mails +take less CPU, especially with sendfile() syscall with Linux and FreeBSD. +But it also creates a bit more disk I/O which may just make it slower. Also +note that if other software reads the mboxes/maildirs, they may handle the +extra CRs wrong and cause problems. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean maildir-stat-dirs? +By default LIST command returns all entries in maildir beginning with a +dot. Enabling this option makes Dovecot return only entries which are +directories. This is done by stat()ing each entry, so it causes more disk +I/O. (For systems setting struct @samp{dirent->d_type} this check is free +and it's done always regardless of this setting). Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean maildir-copy-with-hardlinks? +When copying a message, do it with hard links whenever possible. This makes +the performance much better, and it's unlikely to have any side effects. +Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean maildir-very-dirty-syncs? +Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only +when its mtime changes unexpectedly or when we can't find the mail +otherwise. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list mbox-read-locks +Which locking methods to use for locking mbox. There are four available: + +@table @code +@item dotlock +Create <mailbox>.lock file. This is the oldest and most NFS-safe solution. +If you want to use /var/mail/ like directory, the users will need write +access to that directory. +@item dotlock-try +Same as dotlock, but if it fails because of permissions or because there +isn't enough disk space, just skip it. +@item fcntl +Use this if possible. Works with NFS too if lockd is used. +@item flock +May not exist in all systems. Doesn't work with NFS. +@item lockf +May not exist in all systems. Doesn't work with NFS. +@end table + +You can use multiple locking methods; if you do the order they're declared +in is important to avoid deadlocks if other MTAs/MUAs are using multiple +locking methods as well. Some operating systems don't allow using some of +them simultaneously. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list mbox-write-locks + +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mbox-lock-timeout +Maximum time to wait for lock (all of them) before aborting. Defaults to +@samp{"5 mins"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mbox-dotlock-change-timeout +If dotlock exists but the mailbox isn't modified in any way, override the +lock file after this much time. Defaults to @samp{"2 mins"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mbox-dirty-syncs? +When mbox changes unexpectedly we have to fully read it to find out what +changed. If the mbox is large this can take a long time. Since the change +is usually just a newly appended mail, it'd be faster to simply read the new +mails. If this setting is enabled, Dovecot does this but still safely +fallbacks to re-reading the whole mbox file whenever something in mbox isn't +how it's expected to be. The only real downside to this setting is that if +some other MUA changes message flags, Dovecot doesn't notice it +immediately. Note that a full sync is done with SELECT, EXAMINE, EXPUNGE +and CHECK commands. Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mbox-very-dirty-syncs? +Like @samp{mbox-dirty-syncs}, but don't do full syncs even with SELECT, +EXAMINE, EXPUNGE or CHECK commands. If this is set, @samp{mbox-dirty-syncs} +is ignored. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mbox-lazy-writes? +Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK +commands and when closing the mailbox). This is especially useful for POP3 +where clients often delete all mails. The downside is that our changes +aren't immediately visible to other MUAs. Defaults to @samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mbox-min-index-size +If mbox size is smaller than this (e.g.@: 100k), don't write index files. +If an index file already exists it's still read, just not updated. Defaults +to @samp{0}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mdbox-rotate-size +Maximum dbox file size until it's rotated. Defaults to @samp{10000000}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mdbox-rotate-interval +Maximum dbox file age until it's rotated. Typically in days. Day begins +from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. +Defaults to @samp{"1d"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean mdbox-preallocate-space? +When creating new mdbox files, immediately preallocate their size to +@samp{mdbox-rotate-size}. This setting currently works only in Linux with +some file systems (ext4, xfs). Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-attachment-dir +sdbox and mdbox support saving mail attachments to external files, which +also allows single instance storage for them. Other backends don't support +this for now. + +WARNING: This feature hasn't been tested much yet. Use at your own risk. + +Directory root where to store mail attachments. Disabled, if empty. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer mail-attachment-min-size +Attachments smaller than this aren't saved externally. It's also possible +to write a plugin to disable saving specific attachments externally. +Defaults to @samp{128000}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-attachment-fs +File system backend to use for saving attachments: +@table @code +@item posix +No SiS done by Dovecot (but this might help FS's own deduplication) +@item sis posix +SiS with immediate byte-by-byte comparison during saving +@item sis-queue posix +SiS with delayed comparison and deduplication. +@end table +Defaults to @samp{"sis posix"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string mail-attachment-hash +Hash format to use in attachment filenames. You can add any text and +variables: @code{%@{md4@}}, @code{%@{md5@}}, @code{%@{sha1@}}, +@code{%@{sha256@}}, @code{%@{sha512@}}, @code{%@{size@}}. Variables can be +truncated, e.g.@: @code{%@{sha256:80@}} returns only first 80 bits. +Defaults to @samp{"%@{sha1@}"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer default-process-limit + +Defaults to @samp{100}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer default-client-limit + +Defaults to @samp{1000}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer default-vsz-limit +Default VSZ (virtual memory size) limit for service processes. This is +mainly intended to catch and kill processes that leak memory before they eat +up everything. Defaults to @samp{256000000}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string default-login-user +Login user is internally used by login processes. This is the most +untrusted user in Dovecot system. It shouldn't have access to anything at +all. Defaults to @samp{"dovenull"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string default-internal-user +Internal user is used by unprivileged processes. It should be separate from +login user, so that login processes can't disturb other processes. Defaults +to @samp{"dovecot"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl? +SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>. Defaults to +@samp{"required"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-cert +PEM encoded X.509 SSL/TLS certificate (public key). Defaults to +@samp{"</etc/dovecot/default.pem"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-key +PEM encoded SSL/TLS private key. The key is opened before dropping root +privileges, so keep the key file unreadable by anyone but root. Defaults to +@samp{"</etc/dovecot/private/default.pem"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-key-password +If key file is password protected, give the password here. Alternatively +give it when starting dovecot with -p parameter. Since this file is often +world-readable, you may want to place this setting instead to a different. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-ca +PEM encoded trusted certificate authority. Set this only if you intend to +use @samp{ssl-verify-client-cert? #t}. The file should contain the CA +certificate(s) followed by the matching CRL(s). (e.g.@: @samp{ssl-ca +</etc/ssl/certs/ca.pem}). Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean ssl-require-crl? +Require that CRL check succeeds for client certificates. Defaults to +@samp{#t}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean ssl-verify-client-cert? +Request client to send a certificate. If you also want to require it, set +@samp{auth-ssl-require-client-cert? #t} in auth section. Defaults to +@samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-cert-username-field +Which field from certificate to use for username. commonName and +x500UniqueIdentifier are the usual choices. You'll also need to set +@samp{auth-ssl-username-from-cert? #t}. Defaults to @samp{"commonName"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-min-protocol +Minimum SSL protocol version to accept. Defaults to @samp{"TLSv1"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-cipher-list +SSL ciphers to use. Defaults to +@samp{"ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@@STRENGTH"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string ssl-crypto-device +SSL crypto device to use, for valid values run "openssl engine". Defaults +to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string postmaster-address +Address to use when sending rejection mails. %d expands to recipient +domain. Defaults to @samp{"postmaster@@%d"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string hostname +Hostname to use in various parts of sent mails (e.g.@: in Message-Id) and +in LMTP replies. Default is the system's real hostname@@domain. Defaults +to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean quota-full-tempfail? +If user is over quota, return with temporary failure instead of bouncing the +mail. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} file-name sendmail-path +Binary to use for sending mails. Defaults to @samp{"/usr/sbin/sendmail"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string submission-host +If non-empty, send mails via this SMTP host[:port] instead of sendmail. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string rejection-subject +Subject: header to use for rejection mails. You can use the same variables +as for @samp{rejection-reason} below. Defaults to @samp{"Rejected: %s"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string rejection-reason +Human readable error message for rejection mails. You can use variables: + +@table @code +@item %n +CRLF +@item %r +reason +@item %s +original subject +@item %t +recipient +@end table +Defaults to @samp{"Your message to <%t> was automatically rejected:%n%r"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string recipient-delimiter +Delimiter character between local-part and detail in email address. +Defaults to @samp{"+"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string lda-original-recipient-header +Header where the original recipient address (SMTP's RCPT TO: address) is +taken from if not available elsewhere. With dovecot-lda -a parameter +overrides this. A commonly used header for this is X-Original-To. Defaults +to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean lda-mailbox-autocreate? +Should saving a mail to a nonexistent mailbox automatically create it?. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} boolean lda-mailbox-autosubscribe? +Should automatically created mailboxes be also automatically subscribed?. +Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} non-negative-integer imap-max-line-length +Maximum IMAP command line length. Some clients generate very long command +lines with huge mailboxes, so you may need to raise this if you get "Too +long argument" or "IMAP command line too large" errors often. Defaults to +@samp{64000}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-logout-format +IMAP logout format string: +@table @code +@item %i +total number of bytes read from client +@item %o +total number of bytes sent to client. +@end table +See @file{doc/wiki/Variables.txt} for a list of all the variables you can +use. Defaults to @samp{"in=%i out=%o deleted=%@{deleted@} +expunged=%@{expunged@} trashed=%@{trashed@} hdr_count=%@{fetch_hdr_count@} +hdr_bytes=%@{fetch_hdr_bytes@} body_count=%@{fetch_body_count@} +body_bytes=%@{fetch_body_bytes@}"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-capability +Override the IMAP CAPABILITY response. If the value begins with '+', add +the given capabilities on top of the defaults (e.g.@: +XFOO XBAR). Defaults +to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-idle-notify-interval +How long to wait between "OK Still here" notifications when client is +IDLEing. Defaults to @samp{"2 mins"}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-id-send +ID field names and values to send to clients. Using * as the value makes +Dovecot use the default value. The following fields have default values +currently: name, version, os, os-version, support-url, support-email. +Defaults to @samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-id-log +ID fields sent by client to log. * means everything. Defaults to +@samp{""}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} space-separated-string-list imap-client-workarounds +Workarounds for various client bugs: + +@table @code +@item delay-newmail +Send EXISTS/RECENT new mail notifications only when replying to NOOP and +CHECK commands. Some clients ignore them otherwise, for example OSX Mail +(<v2.1). Outlook Express breaks more badly though, without this it may show +user "Message no longer in server" errors. Note that OE6 still breaks even +with this workaround if synchronization is set to "Headers Only". + +@item tb-extra-mailbox-sep +Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and adds +extra @samp{/} suffixes to mailbox names. This option causes Dovecot to +ignore the extra @samp{/} instead of treating it as invalid mailbox name. + +@item tb-lsub-flags +Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g.@: mbox). This +makes Thunderbird realize they aren't selectable and show them greyed out, +instead of only later giving "not selectable" popup error. +@end table +Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{dovecot-configuration} parameter} string imap-urlauth-host +Host allowed in URLAUTH URLs sent by client. "*" allows all. Defaults to +@samp{""}. +@end deftypevr + + +Whew! Lots of configuration options. The nice thing about it though is that +Guix has a complete interface to Dovecot's configuration language. This +allows not only a nice way to declare configurations, but also offers +reflective capabilities as well: users can write code to inspect and +transform configurations from within Scheme. + +However, it could be that you just want to get a @code{dovecot.conf} up and +running. In that case, you can pass an @code{opaque-dovecot-configuration} +as the @code{#:config} parameter to @code{dovecot-service}. As its name +indicates, an opaque configuration does not have easy reflective +capabilities. + +Available @code{opaque-dovecot-configuration} fields are: + +@deftypevr {@code{opaque-dovecot-configuration} parameter} package dovecot +The dovecot package. +@end deftypevr + +@deftypevr {@code{opaque-dovecot-configuration} parameter} string string +The contents of the @code{dovecot.conf}, as a string. +@end deftypevr + +For example, if your @code{dovecot.conf} is just the empty string, you could +instantiate a dovecot service like this: + +@example +(dovecot-service #:config + (opaque-dovecot-configuration + (string ""))) +@end example + +@subsubheading OpenSMTPD Service + +@deffn {Scheme Variable} opensmtpd-service-type +This is the type of the @uref{https://www.opensmtpd.org, OpenSMTPD} service, +whose value should be an @code{opensmtpd-configuration} object as in this +example: + +@example +(service opensmtpd-service-type + (opensmtpd-configuration + (config-file (local-file "./my-smtpd.conf")))) +@end example +@end deffn + +@deftp {Data Type} opensmtpd-configuration +Data type representing the configuration of opensmtpd. + +@table @asis +@item @code{package} (default: @var{opensmtpd}) +Package object of the OpenSMTPD SMTP server. + +@item @code{config-file} (default: @var{%default-opensmtpd-file}) +File-like object of the OpenSMTPD configuration file to use. By default it +listens on the loopback network interface, and allows for mail from users +and daemons on the local machine, as well as permitting email to remote +servers. Run @command{man smtpd.conf} for more information. + +@end table +@end deftp + +@subsubheading Exim Service + +@cindex mail transfer agent (MTA) +@cindex MTA (mail transfer agent) +@cindex SMTP + +@deffn {Scheme Variable} exim-service-type +This is the type of the @uref{https://exim.org, Exim} mail transfer agent +(MTA), whose value should be an @code{exim-configuration} object as in this +example: + +@example +(service exim-service-type + (exim-configuration + (config-file (local-file "./my-exim.conf")))) +@end example +@end deffn + +In order to use an @code{exim-service-type} service you must also have a +@code{mail-aliases-service-type} service present in your +@code{operating-system} (even if it has no aliases). + +@deftp {Data Type} exim-configuration +Data type representing the configuration of exim. + +@table @asis +@item @code{package} (default: @var{exim}) +Package object of the Exim server. + +@item @code{config-file} (default: @code{#f}) +File-like object of the Exim configuration file to use. If its value is +@code{#f} then use the default configuration file from the package provided +in @code{package}. The resulting configuration file is loaded after setting +the @code{exim_user} and @code{exim_group} configuration variables. + +@end table +@end deftp + +@subsubheading Mail Aliases Service + +@cindex email aliases +@cindex aliases, for email addresses + +@deffn {Scheme Variable} mail-aliases-service-type +This is the type of the service which provides @code{/etc/aliases}, +specifying how to deliver mail to users on this system. + +@example +(service mail-aliases-service-type + '(("postmaster" "bob") + ("bob" "bob@@example.com" "bob@@example2.com"))) +@end example +@end deffn + +The configuration for a @code{mail-aliases-service-type} service is an +association list denoting how to deliver mail that comes to this +system. Each entry is of the form @code{(alias addresses ...)}, with +@code{alias} specifying the local alias and @code{addresses} specifying +where to deliver this user's mail. + +The aliases aren't required to exist as users on the local system. In the +above example, there doesn't need to be a @code{postmaster} entry in the +@code{operating-system}'s @code{user-accounts} in order to deliver the +@code{postmaster} mail to @code{bob} (which subsequently would deliver mail +to @code{bob@@example.com} and @code{bob@@example2.com}). + +@subsubheading GNU Mailutils IMAP4 Daemon +@cindex GNU Mailutils IMAP4 Daemon + +@deffn {Scheme Variable} imap4d-service-type +This is the type of the GNU Mailutils IMAP4 Daemon (@pxref{imap4d,,, +mailutils, GNU Mailutils Manual}), whose value should be an +@code{imap4d-configuration} object as in this example: + +@example +(service imap4d-service-type + (imap4d-configuration + (config-file (local-file "imap4d.conf")))) +@end example +@end deffn + +@deftp {Data Type} imap4d-configuration +Data type representing the configuration of @command{imap4d}. + +@table @asis +@item @code{package} (default: @code{mailutils}) +The package that provides @command{imap4d}. + +@item @code{config-file} (default: @code{%default-imap4d-config-file}) +File-like object of the configuration file to use, by default it will listen +on TCP port 143 of @code{localhost}. @xref{Conf-imap4d,,, mailutils, GNU +Mailutils Manual}, for details. + +@end table +@end deftp + +@node Messaging Services +@subsection Messaging Services + +@cindex messaging +@cindex jabber +@cindex XMPP +The @code{(gnu services messaging)} module provides Guix service definitions +for messaging services: currently only Prosody is supported. + +@subsubheading Prosody Service + +@deffn {Scheme Variable} prosody-service-type +This is the type for the @uref{https://prosody.im, Prosody XMPP +communication server}. Its value must be a @code{prosody-configuration} +record as in this example: + +@example +(service prosody-service-type + (prosody-configuration + (modules-enabled (cons "groups" "mam" %default-modules-enabled)) + (int-components + (list + (int-component-configuration + (hostname "conference.example.net") + (plugin "muc") + (mod-muc (mod-muc-configuration))))) + (virtualhosts + (list + (virtualhost-configuration + (domain "example.net")))))) +@end example + +See below for details about @code{prosody-configuration}. + +@end deffn + +By default, Prosody does not need much configuration. Only one +@code{virtualhosts} field is needed: it specifies the domain you wish +Prosody to serve. + +You can perform various sanity checks on the generated configuration with +the @code{prosodyctl check} command. + +Prosodyctl will also help you to import certificates from the +@code{letsencrypt} directory so that the @code{prosody} user can access +them. See @url{https://prosody.im/doc/letsencrypt}. + +@example +prosodyctl --root cert import /etc/letsencrypt/live +@end example + +The available configuration parameters follow. Each parameter definition is +preceded by its type; for example, @samp{string-list foo} indicates that the +@code{foo} parameter should be specified as a list of strings. Types +starting with @code{maybe-} denote parameters that won't show up in +@code{prosody.cfg.lua} when their value is @code{'disabled}. + +There is also a way to specify the configuration as a string, if you have an +old @code{prosody.cfg.lua} file that you want to port over from some other +system; see the end for more details. + +The @code{file-object} type designates either a file-like object +(@pxref{G-Expressions, file-like objects}) or a file name. + +@c The following documentation was initially generated by +@c (generate-documentation) in (gnu services messaging). Manually maintained +@c documentation is better, so we shouldn't hesitate to edit below as +@c needed. However if the change you want to make to this documentation +@c can be done in an automated way, it's probably easier to change +@c (generate-documentation) than to make it below and have to deal with +@c the churn as Prosody updates. + +Available @code{prosody-configuration} fields are: + +@deftypevr {@code{prosody-configuration} parameter} package prosody +The Prosody package. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} file-name data-path +Location of the Prosody data storage directory. See +@url{https://prosody.im/doc/configure}. Defaults to +@samp{"/var/lib/prosody"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} file-object-list plugin-paths +Additional plugin directories. They are searched in all the specified paths +in order. See @url{https://prosody.im/doc/plugins_directory}. Defaults to +@samp{()}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} file-name certificates +Every virtual host and component needs a certificate so that clients and +servers can securely verify its identity. Prosody will automatically load +certificates/keys from the directory specified here. Defaults to +@samp{"/etc/prosody/certs"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string-list admins +This is a list of accounts that are admins for the server. Note that you +must create the accounts separately. See +@url{https://prosody.im/doc/admins} and +@url{https://prosody.im/doc/creating_accounts}. Example: @code{(admins +'("user1@@example.com" "user2@@example.net"))} Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} boolean use-libevent? +Enable use of libevent for better performance under high load. See +@url{https://prosody.im/doc/libevent}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} module-list modules-enabled +This is the list of modules Prosody will load on startup. It looks for +@code{mod_modulename.lua} in the plugins folder, so make sure that exists +too. Documentation on modules can be found at: +@url{https://prosody.im/doc/modules}. Defaults to @samp{("roster" +"saslauth" "tls" "dialback" "disco" "carbons" "private" "blocklist" "vcard" +"version" "uptime" "time" "ping" "pep" "register" "admin_adhoc")}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string-list modules-disabled +@samp{"offline"}, @samp{"c2s"} and @samp{"s2s"} are auto-loaded, but should +you want to disable them then add them to this list. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} file-object groups-file +Path to a text file where the shared groups are defined. If this path is +empty then @samp{mod_groups} does nothing. See +@url{https://prosody.im/doc/modules/mod_groups}. Defaults to +@samp{"/var/lib/prosody/sharedgroups.txt"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} boolean allow-registration? +Disable account creation by default, for security. See +@url{https://prosody.im/doc/creating_accounts}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} maybe-ssl-configuration ssl +These are the SSL/TLS-related settings. Most of them are disabled so to use +Prosody's defaults. If you do not completely understand these options, do +not add them to your config, it is easy to lower the security of your server +using them. See @url{https://prosody.im/doc/advanced_ssl_config}. + +Available @code{ssl-configuration} fields are: + +@deftypevr {@code{ssl-configuration} parameter} maybe-string protocol +This determines what handshake to use. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-file-name key +Path to your private key file. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-file-name certificate +Path to your certificate file. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} file-object capath +Path to directory containing root certificates that you wish Prosody to +trust when verifying the certificates of remote servers. Defaults to +@samp{"/etc/ssl/certs"}. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-file-object cafile +Path to a file containing root certificates that you wish Prosody to trust. +Similar to @code{capath} but with all certificates concatenated together. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string-list verify +A list of verification options (these mostly map to OpenSSL's +@code{set_verify()} flags). +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string-list options +A list of general options relating to SSL/TLS. These map to OpenSSL's +@code{set_options()}. For a full list of options available in LuaSec, see +the LuaSec source. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-non-negative-integer depth +How long a chain of certificate authorities to check when looking for a +trusted root certificate. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string ciphers +An OpenSSL cipher string. This selects what ciphers Prosody will offer to +clients, and in what order. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-file-name dhparam +A path to a file containing parameters for Diffie-Hellman key exchange. You +can create such a file with: @code{openssl dhparam -out +/etc/prosody/certs/dh-2048.pem 2048} +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string curve +Curve for Elliptic curve Diffie-Hellman. Prosody's default is +@samp{"secp384r1"}. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string-list verifyext +A list of "extra" verification options. +@end deftypevr + +@deftypevr {@code{ssl-configuration} parameter} maybe-string password +Password for encrypted private keys. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} boolean c2s-require-encryption? +Whether to force all client-to-server connections to be encrypted or not. +See @url{https://prosody.im/doc/modules/mod_tls}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string-list disable-sasl-mechanisms +Set of mechanisms that will never be offered. See +@url{https://prosody.im/doc/modules/mod_saslauth}. Defaults to +@samp{("DIGEST-MD5")}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} boolean s2s-require-encryption? +Whether to force all server-to-server connections to be encrypted or not. +See @url{https://prosody.im/doc/modules/mod_tls}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} boolean s2s-secure-auth? +Whether to require encryption and certificate authentication. This provides +ideal security, but requires servers you communicate with to support +encryption AND present valid, trusted certificates. See +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{#f}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string-list s2s-insecure-domains +Many servers don't support encryption or have invalid or self-signed +certificates. You can list domains here that will not be required to +authenticate using certificates. They will be authenticated using DNS. See +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string-list s2s-secure-domains +Even if you leave @code{s2s-secure-auth?} disabled, you can still require +valid certificates for some domains by specifying a list here. See +@url{https://prosody.im/doc/s2s#security}. Defaults to @samp{()}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string authentication +Select the authentication backend to use. The default provider stores +passwords in plaintext and uses Prosody's configured data storage to store +the authentication data. If you do not trust your server please see +@url{https://prosody.im/doc/modules/mod_auth_internal_hashed} for +information about using the hashed backend. See also +@url{https://prosody.im/doc/authentication} Defaults to +@samp{"internal_plain"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} maybe-string log +Set logging options. Advanced logging configuration is not yet supported by +the Prosody service. See @url{https://prosody.im/doc/logging}. Defaults to +@samp{"*syslog"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} file-name pidfile +File to write pid in. See @url{https://prosody.im/doc/modules/mod_posix}. +Defaults to @samp{"/var/run/prosody/prosody.pid"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} maybe-non-negative-integer http-max-content-size +Maximum allowed size of the HTTP body (in bytes). +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} maybe-string http-external-url +Some modules expose their own URL in various ways. This URL is built from +the protocol, host and port used. If Prosody sits behind a proxy, the +public URL will be @code{http-external-url} instead. See +@url{https://prosody.im/doc/http#external_url}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} virtualhost-configuration-list virtualhosts +A host in Prosody is a domain on which user accounts can be created. For +example if you want your users to have addresses like +@samp{"john.smith@@example.com"} then you need to add a host +@samp{"example.com"}. All options in this list will apply only to this +host. + +Note: the name "virtual" host is used in configuration to avoid confusion +with the actual physical host that Prosody is installed on. A single +Prosody instance can serve many domains, each one defined as a VirtualHost +entry in Prosody's configuration. Conversely a server that hosts a single +domain would have just one VirtualHost entry. + +See @url{https://prosody.im/doc/configure#virtual_host_settings}. + +Available @code{virtualhost-configuration} fields are: + +all these @code{prosody-configuration} fields: @code{admins}, +@code{use-libevent?}, @code{modules-enabled}, @code{modules-disabled}, +@code{groups-file}, @code{allow-registration?}, @code{ssl}, +@code{c2s-require-encryption?}, @code{disable-sasl-mechanisms}, +@code{s2s-require-encryption?}, @code{s2s-secure-auth?}, +@code{s2s-insecure-domains}, @code{s2s-secure-domains}, +@code{authentication}, @code{log}, @code{http-max-content-size}, +@code{http-external-url}, @code{raw-content}, plus: +@deftypevr {@code{virtualhost-configuration} parameter} string domain +Domain you wish Prosody to serve. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} int-component-configuration-list int-components +Components are extra services on a server which are available to clients, +usually on a subdomain of the main server (such as +@samp{"mycomponent.example.com"}). Example components might be chatroom +servers, user directories, or gateways to other protocols. + +Internal components are implemented with Prosody-specific plugins. To add +an internal component, you simply fill the hostname field, and the plugin +you wish to use for the component. + +See @url{https://prosody.im/doc/components}. Defaults to @samp{()}. + +Available @code{int-component-configuration} fields are: + +all these @code{prosody-configuration} fields: @code{admins}, +@code{use-libevent?}, @code{modules-enabled}, @code{modules-disabled}, +@code{groups-file}, @code{allow-registration?}, @code{ssl}, +@code{c2s-require-encryption?}, @code{disable-sasl-mechanisms}, +@code{s2s-require-encryption?}, @code{s2s-secure-auth?}, +@code{s2s-insecure-domains}, @code{s2s-secure-domains}, +@code{authentication}, @code{log}, @code{http-max-content-size}, +@code{http-external-url}, @code{raw-content}, plus: +@deftypevr {@code{int-component-configuration} parameter} string hostname +Hostname of the component. +@end deftypevr + +@deftypevr {@code{int-component-configuration} parameter} string plugin +Plugin you wish to use for the component. +@end deftypevr + +@deftypevr {@code{int-component-configuration} parameter} maybe-mod-muc-configuration mod-muc +Multi-user chat (MUC) is Prosody's module for allowing you to create hosted +chatrooms/conferences for XMPP users. + +General information on setting up and using multi-user chatrooms can be +found in the "Chatrooms" documentation +(@url{https://prosody.im/doc/chatrooms}), which you should read if you are +new to XMPP chatrooms. + +See also @url{https://prosody.im/doc/modules/mod_muc}. + +Available @code{mod-muc-configuration} fields are: + +@deftypevr {@code{mod-muc-configuration} parameter} string name +The name to return in service discovery responses. Defaults to +@samp{"Prosody Chatrooms"}. +@end deftypevr + +@deftypevr {@code{mod-muc-configuration} parameter} string-or-boolean restrict-room-creation +If @samp{#t}, this will only allow admins to create new chatrooms. +Otherwise anyone can create a room. The value @samp{"local"} restricts room +creation to users on the service's parent domain. E.g.@: +@samp{user@@example.com} can create rooms on @samp{rooms.example.com}. The +value @samp{"admin"} restricts to service administrators only. Defaults to +@samp{#f}. +@end deftypevr + +@deftypevr {@code{mod-muc-configuration} parameter} non-negative-integer max-history-messages +Maximum number of history messages that will be sent to the member that has +just joined the room. Defaults to @samp{20}. +@end deftypevr + +@end deftypevr + +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} ext-component-configuration-list ext-components +External components use XEP-0114, which most standalone components support. +To add an external component, you simply fill the hostname field. See +@url{https://prosody.im/doc/components}. Defaults to @samp{()}. + +Available @code{ext-component-configuration} fields are: + +all these @code{prosody-configuration} fields: @code{admins}, +@code{use-libevent?}, @code{modules-enabled}, @code{modules-disabled}, +@code{groups-file}, @code{allow-registration?}, @code{ssl}, +@code{c2s-require-encryption?}, @code{disable-sasl-mechanisms}, +@code{s2s-require-encryption?}, @code{s2s-secure-auth?}, +@code{s2s-insecure-domains}, @code{s2s-secure-domains}, +@code{authentication}, @code{log}, @code{http-max-content-size}, +@code{http-external-url}, @code{raw-content}, plus: +@deftypevr {@code{ext-component-configuration} parameter} string component-secret +Password which the component will use to log in. +@end deftypevr + +@deftypevr {@code{ext-component-configuration} parameter} string hostname +Hostname of the component. +@end deftypevr + +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} non-negative-integer-list component-ports +Port(s) Prosody listens on for component connections. Defaults to +@samp{(5347)}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} string component-interface +Interface Prosody listens on for component connections. Defaults to +@samp{"127.0.0.1"}. +@end deftypevr + +@deftypevr {@code{prosody-configuration} parameter} maybe-raw-content raw-content +Raw content that will be added to the configuration file. +@end deftypevr + +It could be that you just want to get a @code{prosody.cfg.lua} up and +running. In that case, you can pass an @code{opaque-prosody-configuration} +record as the value of @code{prosody-service-type}. As its name indicates, +an opaque configuration does not have easy reflective capabilities. +Available @code{opaque-prosody-configuration} fields are: + +@deftypevr {@code{opaque-prosody-configuration} parameter} package prosody +The prosody package. +@end deftypevr + +@deftypevr {@code{opaque-prosody-configuration} parameter} string prosody.cfg.lua +The contents of the @code{prosody.cfg.lua} to use. +@end deftypevr + +For example, if your @code{prosody.cfg.lua} is just the empty string, you +could instantiate a prosody service like this: + +@example +(service prosody-service-type + (opaque-prosody-configuration + (prosody.cfg.lua ""))) +@end example + +@c end of Prosody auto-generated documentation + +@subsubheading BitlBee Service + +@cindex IRC (Internet Relay Chat) +@cindex IRC gateway +@url{http://bitlbee.org,BitlBee} is a gateway that provides an IRC interface +to a variety of messaging protocols such as XMPP. + +@defvr {Scheme Variable} bitlbee-service-type +This is the service type for the @url{http://bitlbee.org,BitlBee} IRC +gateway daemon. Its value is a @code{bitlbee-configuration} (see below). + +To have BitlBee listen on port 6667 on localhost, add this line to your +services: + +@example +(service bitlbee-service-type) +@end example +@end defvr + +@deftp {Data Type} bitlbee-configuration +This is the configuration for BitlBee, with the following fields: + +@table @asis +@item @code{interface} (default: @code{"127.0.0.1"}) +@itemx @code{port} (default: @code{6667}) +Listen on the network interface corresponding to the IP address specified in +@var{interface}, on @var{port}. + +When @var{interface} is @code{127.0.0.1}, only local clients can connect; +when it is @code{0.0.0.0}, connections can come from any networking +interface. + +@item @code{package} (default: @code{bitlbee}) +The BitlBee package to use. + +@item @code{plugins} (default: @code{'()}) +List of plugin packages to use---e.g., @code{bitlbee-discord}. + +@item @code{extra-settings} (default: @code{""}) +Configuration snippet added as-is to the BitlBee configuration file. +@end table +@end deftp + +@subsubheading Quassel Service + +@cindex IRC (Internet Relay Chat) +@url{https://quassel-irc.org/,Quassel} is a distributed IRC client, meaning +that one or more clients can attach to and detach from the central core. + +@defvr {Scheme Variable} quassel-service-type +This is the service type for the @url{https://quassel-irc.org/,Quassel} IRC +backend daemon. Its value is a @code{quassel-configuration} (see below). +@end defvr + +@deftp {Data Type} quassel-configuration +This is the configuration for Quassel, with the following fields: + +@table @asis +@item @code{quassel} (default: @code{quassel}) +The Quassel package to use. + +@item @code{interface} (default: @code{"::,0.0.0.0"}) +@item @code{port} (default: @code{4242}) +Listen on the network interface(s) corresponding to the IPv4 or IPv6 +interfaces specified in the comma delimited @var{interface}, on @var{port}. + +@item @code{loglevel} (default: @code{"Info"}) +The level of logging desired. Accepted values are Debug, Info, Warning and +Error. +@end table +@end deftp + +@node Telephony Services +@subsection Telephony Services + +@cindex Murmur (VoIP server) +@cindex VoIP server +This section describes how to set up and run a Murmur server. Murmur is the +server of the @uref{https://mumble.info, Mumble} voice-over-IP (VoIP) suite. + +@deftp {Data Type} murmur-configuration +The service type for the Murmur server. An example configuration can look +like this: + +@example +(service murmur-service-type + (murmur-configuration + (welcome-text + "Welcome to this Mumble server running on Guix!") + (cert-required? #t) ;disallow text password logins + (ssl-cert "/etc/letsencrypt/live/mumble.example.com/fullchain.pem") + (ssl-key "/etc/letsencrypt/live/mumble.example.com/privkey.pem"))) +@end example + +After reconfiguring your system, you can manually set the murmur +@code{SuperUser} password with the command that is printed during the +activation phase. + +It is recommended to register a normal Mumble user account and grant it +admin or moderator rights. You can use the @code{mumble} client to login as +new normal user, register yourself, and log out. For the next step login +with the name @code{SuperUser} use the @code{SuperUser} password that you +set previously, and grant your newly registered mumble user administrator or +moderator rights and create some channels. + +Available @code{murmur-configuration} fields are: + +@table @asis +@item @code{package} (default: @code{mumble}) +Package that contains @code{bin/murmurd}. + +@item @code{user} (default: @code{"murmur"}) +User who will run the Murmur server. + +@item @code{group} (default: @code{"murmur"}) +Group of the user who will run the murmur server. + +@item @code{port} (default: @code{64738}) +Port on which the server will listen. + +@item @code{welcome-text} (default: @code{""}) +Welcome text sent to clients when they connect. + +@item @code{server-password} (default: @code{""}) +Password the clients have to enter in order to connect. + +@item @code{max-users} (default: @code{100}) +Maximum of users that can be connected to the server at once. + +@item @code{max-user-bandwidth} (default: @code{#f}) +Maximum voice traffic a user can send per second. + +@item @code{database-file} (default: @code{"/var/lib/murmur/db.sqlite"}) +File name of the sqlite database. The service's user will become the owner +of the directory. + +@item @code{log-file} (default: @code{"/var/log/murmur/murmur.log"}) +File name of the log file. The service's user will become the owner of the +directory. + +@item @code{autoban-attempts} (default: @code{10}) +Maximum number of logins a user can make in @code{autoban-timeframe} without +getting auto banned for @code{autoban-time}. + +@item @code{autoban-timeframe} (default: @code{120}) +Timeframe for autoban in seconds. + +@item @code{autoban-time} (default: @code{300}) +Amount of time in seconds for which a client gets banned when violating the +autoban limits. + +@item @code{opus-threshold} (default: @code{100}) +Percentage of clients that need to support opus before switching over to +opus audio codec. + +@item @code{channel-nesting-limit} (default: @code{10}) +How deep channels can be nested at maximum. + +@item @code{channelname-regex} (default: @code{#f}) +A string in form of a Qt regular expression that channel names must conform +to. + +@item @code{username-regex} (default: @code{#f}) +A string in form of a Qt regular expression that user names must conform to. + +@item @code{text-message-length} (default: @code{5000}) +Maximum size in bytes that a user can send in one text chat message. + +@item @code{image-message-length} (default: @code{(* 128 1024)}) +Maximum size in bytes that a user can send in one image message. + +@item @code{cert-required?} (default: @code{#f}) +If it is set to @code{#t} clients that use weak password authentification +will not be accepted. Users must have completed the certificate wizard to +join. + +@item @code{remember-channel?} (default: @code{#f}) +Should murmur remember the last channel each user was in when they +disconnected and put them into the remembered channel when they rejoin. + +@item @code{allow-html?} (default: @code{#f}) +Should html be allowed in text messages, user comments, and channel +descriptions. + +@item @code{allow-ping?} (default: @code{#f}) +Setting to true exposes the current user count, the maximum user count, and +the server's maximum bandwidth per client to unauthenticated users. In the +Mumble client, this information is shown in the Connect dialog. + +Disabling this setting will prevent public listing of the server. + +@item @code{bonjour?} (default: @code{#f}) +Should the server advertise itself in the local network through the bonjour +protocol. + +@item @code{send-version?} (default: @code{#f}) +Should the murmur server version be exposed in ping requests. + +@item @code{log-days} (default: @code{31}) +Murmur also stores logs in the database, which are accessible via RPC. The +default is 31 days of months, but you can set this setting to 0 to keep logs +forever, or -1 to disable logging to the database. + +@item @code{obfuscate-ips?} (default: @code{#t}) +Should logged ips be obfuscated to protect the privacy of users. + +@item @code{ssl-cert} (default: @code{#f}) +File name of the SSL/TLS certificate used for encrypted connections. + +@example +(ssl-cert "/etc/letsencrypt/live/example.com/fullchain.pem") +@end example +@item @code{ssl-key} (default: @code{#f}) +Filepath to the ssl private key used for encrypted connections. +@example +(ssl-key "/etc/letsencrypt/live/example.com/privkey.pem") +@end example + +@item @code{ssl-dh-params} (default: @code{#f}) +File name of a PEM-encoded file with Diffie-Hellman parameters for the +SSL/TLS encryption. Alternatively you set it to @code{"@@ffdhe2048"}, +@code{"@@ffdhe3072"}, @code{"@@ffdhe4096"}, @code{"@@ffdhe6144"} or +@code{"@@ffdhe8192"} to use bundled parameters from RFC 7919. + +@item @code{ssl-ciphers} (default: @code{#f}) +The @code{ssl-ciphers} option chooses the cipher suites to make available +for use in SSL/TLS. + +This option is specified using +@uref{https://www.openssl.org/docs/apps/ciphers.html#CIPHER-LIST-FORMAT, +OpenSSL cipher list notation}. + +It is recommended that you try your cipher string using 'openssl ciphers +<string>' before setting it here, to get a feel for which cipher suites you +will get. After setting this option, it is recommend that you inspect your +Murmur log to ensure that Murmur is using the cipher suites that you +expected it to. + +Note: Changing this option may impact the backwards compatibility of your +Murmur server, and can remove the ability for older Mumble clients to be +able to connect to it. + +@item @code{public-registration} (default: @code{#f}) +Must be a @code{<murmur-public-registration-configuration>} record or +@code{#f}. + +You can optionally register your server in the public server list that the +@code{mumble} client shows on startup. You cannot register your server if +you have set a @code{server-password}, or set @code{allow-ping} to +@code{#f}. + +It might take a few hours until it shows up in the public list. + +@item @code{file} (default: @code{#f}) +Optional alternative override for this configuration. +@end table +@end deftp + +@deftp {Data Type} murmur-public-registration-configuration +Configuration for public registration of a murmur service. + +@table @asis +@item @code{name} +This is a display name for your server. Not to be confused with the +hostname. + +@item @code{password} +A password to identify your registration. Subsequent updates will need the +same password. Don't lose your password. + +@item @code{url} +This should be a @code{http://} or @code{https://} link to your web site. + +@item @code{hostname} (default: @code{#f}) +By default your server will be listed by its IP address. If it is set your +server will be linked by this host name instead. +@end table +@end deftp + + + +@node Monitoring Services +@subsection Monitoring Services + +@subsubheading Tailon Service + +@uref{https://tailon.readthedocs.io/, Tailon} is a web application for +viewing and searching log files. + +The following example will configure the service with default values. By +default, Tailon can be accessed on port 8080 (@code{http://localhost:8080}). + +@example +(service tailon-service-type) +@end example + +The following example customises more of the Tailon configuration, adding +@command{sed} to the list of allowed commands. + +@example +(service tailon-service-type + (tailon-configuration + (config-file + (tailon-configuration-file + (allowed-commands '("tail" "grep" "awk" "sed")))))) +@end example + + +@deftp {Data Type} tailon-configuration +Data type representing the configuration of Tailon. This type has the +following parameters: + +@table @asis +@item @code{config-file} (default: @code{(tailon-configuration-file)}) +The configuration file to use for Tailon. This can be set to a +@dfn{tailon-configuration-file} record value, or any gexp +(@pxref{G-Expressions}). + +For example, to instead use a local file, the @code{local-file} function can +be used: + +@example +(service tailon-service-type + (tailon-configuration + (config-file (local-file "./my-tailon.conf")))) +@end example + +@item @code{package} (default: @code{tailon}) +The tailon package to use. + +@end table +@end deftp + +@deftp {Data Type} tailon-configuration-file +Data type representing the configuration options for Tailon. This type has +the following parameters: + +@table @asis +@item @code{files} (default: @code{(list "/var/log")}) +List of files to display. The list can include strings for a single file or +directory, or a list, where the first item is the name of a subsection, and +the remaining items are the files or directories in that subsection. + +@item @code{bind} (default: @code{"localhost:8080"}) +Address and port to which Tailon should bind on. + +@item @code{relative-root} (default: @code{#f}) +URL path to use for Tailon, set to @code{#f} to not use a path. + +@item @code{allow-transfers?} (default: @code{#t}) +Allow downloading the log files in the web interface. + +@item @code{follow-names?} (default: @code{#t}) +Allow tailing of not-yet existent files. + +@item @code{tail-lines} (default: @code{200}) +Number of lines to read initially from each file. + +@item @code{allowed-commands} (default: @code{(list "tail" "grep" "awk")}) +Commands to allow running. By default, @code{sed} is disabled. + +@item @code{debug?} (default: @code{#f}) +Set @code{debug?} to @code{#t} to show debug messages. + +@item @code{wrap-lines} (default: @code{#t}) +Initial line wrapping state in the web interface. Set to @code{#t} to +initially wrap lines (the default), or to @code{#f} to initially not wrap +lines. + +@item @code{http-auth} (default: @code{#f}) +HTTP authentication type to use. Set to @code{#f} to disable authentication +(the default). Supported values are @code{"digest"} or @code{"basic"}. + +@item @code{users} (default: @code{#f}) +If HTTP authentication is enabled (see @code{http-auth}), access will be +restricted to the credentials provided here. To configure users, use a list +of pairs, where the first element of the pair is the username, and the 2nd +element of the pair is the password. + +@example +(tailon-configuration-file + (http-auth "basic") + (users '(("user1" . "password1") + ("user2" . "password2")))) +@end example + +@end table +@end deftp + + +@subsubheading Darkstat Service +@cindex darkstat +Darkstat is a packet sniffer that captures network traffic, calculates +statistics about usage, and serves reports over HTTP. + +@defvar {Scheme Variable} darkstat-service-type +This is the service type for the @uref{https://unix4lyfe.org/darkstat/, +darkstat} service, its value must be a @code{darkstat-configuration} record +as in this example: + +@example +(service darkstat-service-type + (darkstat-configuration + (interface "eno1"))) +@end example +@end defvar + +@deftp {Data Type} darkstat-configuration +Data type representing the configuration of @command{darkstat}. + +@table @asis +@item @code{package} (default: @code{darkstat}) +The darkstat package to use. + +@item @code{interface} +Capture traffic on the specified network interface. + +@item @code{port} (default: @code{"667"}) +Bind the web interface to the specified port. + +@item @code{bind-address} (default: @code{"127.0.0.1"}) +Bind the web interface to the specified address. + +@item @code{base} (default: @code{"/"}) +Specify the path of the base URL. This can be useful if @command{darkstat} +is accessed via a reverse proxy. + +@end table +@end deftp + +@subsubheading Prometheus Node Exporter Service + +@cindex prometheus-node-exporter +The Prometheus ``node exporter'' makes hardware and operating system +statistics provided by the Linux kernel available for the Prometheus +monitoring system. This service should be deployed on all physical nodes +and virtual machines, where monitoring these statistics is desirable. + +@defvar {Scheme variable} prometheus-node-exporter-service-type +This is the service type for the +@uref{https://github.com/prometheus/node_exporter/, +prometheus-node-exporter} service, its value must be a +@code{prometheus-node-exporter-configuration} record as in this example: + +@example +(service prometheus-node-exporter-service-type + (prometheus-node-exporter-configuration + (web-listen-address ":9100"))) +@end example +@end defvar + +@deftp {Data Type} prometheus-node-exporter-configuration +Data type representing the configuration of @command{node_exporter}. + +@table @asis +@item @code{package} (default: @code{go-github-com-prometheus-node-exporter}) +The prometheus-node-exporter package to use. + +@item @code{web-listen-address} (default: @code{":9100"}) +Bind the web interface to the specified address. + +@end table +@end deftp + +@subsubheading Zabbix server +@cindex zabbix zabbix-server +Zabbix provides monitoring metrics, among others network utilization, CPU +load and disk space consumption: + +@itemize +@item High performance, high capacity (able to monitor hundreds of thousands of devices). +@item Auto-discovery of servers and network devices and interfaces. +@item Low-level discovery, allows to automatically start monitoring new items, file systems or network interfaces among others. +@item Distributed monitoring with centralized web administration. +@item Native high performance agents. +@item SLA, and ITIL KPI metrics on reporting. +@item High-level (business) view of monitored resources through user-defined visual console screens and dashboards. +@item Remote command execution through Zabbix proxies. +@end itemize + +@c %start of fragment + +Available @code{zabbix-server-configuration} fields are: + +@deftypevr {@code{zabbix-server-configuration} parameter} package zabbix-server +The zabbix-server package. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string user +User who will run the Zabbix server. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} group group +Group who will run the Zabbix server. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string db-host +Database host name. + +Defaults to @samp{"127.0.0.1"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string db-name +Database name. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string db-user +Database user. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string db-password +Database password. Please, use @code{include-files} with +@code{DBPassword=SECRET} inside a specified file instead. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} number db-port +Database port. + +Defaults to @samp{5432}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string log-type +Specifies where log messages are written to: + +@itemize @bullet +@item +@code{system} - syslog. + +@item +@code{file} - file specified with @code{log-file} parameter. + +@item +@code{console} - standard output. + +@end itemize + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string log-file +Log file name for @code{log-type} @code{file} parameter. + +Defaults to @samp{"/var/log/zabbix/server.log"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string pid-file +Name of PID file. + +Defaults to @samp{"/var/run/zabbix/zabbix_server.pid"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string ssl-ca-location +The location of certificate authority (CA) files for SSL server certificate +verification. + +Defaults to @samp{"/etc/ssl/certs/ca-certificates.crt"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string ssl-cert-location +Location of SSL client certificates. + +Defaults to @samp{"/etc/ssl/certs"}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} string extra-options +Extra options will be appended to Zabbix server configuration file. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-server-configuration} parameter} include-files include-files +You may include individual files or all files in a directory in the +configuration file. + +Defaults to @samp{()}. + +@end deftypevr + +@c %end of fragment + +@subsubheading Zabbix agent +@cindex zabbix zabbix-agent + +Zabbix agent gathers information for Zabbix server. + +@c %start of fragment + +Available @code{zabbix-agent-configuration} fields are: + +@deftypevr {@code{zabbix-agent-configuration} parameter} package zabbix-agent +The zabbix-agent package. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string user +User who will run the Zabbix agent. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} group group +Group who will run the Zabbix agent. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string hostname +Unique, case sensitive hostname which is required for active checks and must +match hostname as configured on the server. + +Defaults to @samp{"Zabbix server"}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string log-type +Specifies where log messages are written to: + +@itemize @bullet +@item +@code{system} - syslog. + +@item +@code{file} - file specified with @code{log-file} parameter. + +@item +@code{console} - standard output. + +@end itemize + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string log-file +Log file name for @code{log-type} @code{file} parameter. + +Defaults to @samp{"/var/log/zabbix/agent.log"}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string pid-file +Name of PID file. + +Defaults to @samp{"/var/run/zabbix/zabbix_agent.pid"}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} list server +List of IP addresses, optionally in CIDR notation, or hostnames of Zabbix +servers and Zabbix proxies. Incoming connections will be accepted only from +the hosts listed here. + +Defaults to @samp{("127.0.0.1")}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} list server-active +List of IP:port (or hostname:port) pairs of Zabbix servers and Zabbix +proxies for active checks. If port is not specified, default port is used. +If this parameter is not specified, active checks are disabled. + +Defaults to @samp{("127.0.0.1")}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} string extra-options +Extra options will be appended to Zabbix server configuration file. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-agent-configuration} parameter} include-files include-files +You may include individual files or all files in a directory in the +configuration file. + +Defaults to @samp{()}. + +@end deftypevr + +@c %end of fragment + +@subsubheading Zabbix front-end +@cindex zabbix zabbix-front-end + +This service provides a WEB interface to Zabbix server. + +@c %start of fragment + +Available @code{zabbix-front-end-configuration} fields are: + +@deftypevr {@code{zabbix-front-end-configuration} parameter} nginx-server-configuration-list nginx +NGINX configuration. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string db-host +Database host name. + +Defaults to @samp{"localhost"}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} number db-port +Database port. + +Defaults to @samp{5432}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string db-name +Database name. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string db-user +Database user. + +Defaults to @samp{"zabbix"}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string db-password +Database password. Please, use @code{db-secret-file} instead. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string db-secret-file +Secret file which will be appended to @file{zabbix.conf.php} file. This +file contains credentials for use by Zabbix front-end. You are expected to +create it manually. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} string zabbix-host +Zabbix server hostname. + +Defaults to @samp{"localhost"}. + +@end deftypevr + +@deftypevr {@code{zabbix-front-end-configuration} parameter} number zabbix-port +Zabbix server port. + +Defaults to @samp{10051}. + +@end deftypevr + + +@c %end of fragment + +@node Kerberos Services +@subsection Kerberos Services +@cindex Kerberos + +The @code{(gnu services kerberos)} module provides services relating to the +authentication protocol @dfn{Kerberos}. + +@subsubheading Krb5 Service + +Programs using a Kerberos client library normally expect a configuration +file in @file{/etc/krb5.conf}. This service generates such a file from a +definition provided in the operating system declaration. It does not cause +any daemon to be started. + +No ``keytab'' files are provided by this service---you must explicitly +create them. This service is known to work with the MIT client library, +@code{mit-krb5}. Other implementations have not been tested. + +@defvr {Scheme Variable} krb5-service-type +A service type for Kerberos 5 clients. +@end defvr + +@noindent +Here is an example of its use: +@lisp +(service krb5-service-type + (krb5-configuration + (default-realm "EXAMPLE.COM") + (allow-weak-crypto? #t) + (realms (list + (krb5-realm + (name "EXAMPLE.COM") + (admin-server "groucho.example.com") + (kdc "karl.example.com")) + (krb5-realm + (name "ARGRX.EDU") + (admin-server "kerb-admin.argrx.edu") + (kdc "keys.argrx.edu")))))) +@end lisp + +@noindent +This example provides a Kerberos@tie{}5 client configuration which: +@itemize +@item Recognizes two realms, @i{viz:} ``EXAMPLE.COM'' and ``ARGRX.EDU'', both +of which have distinct administration servers and key distribution centers; +@item Will default to the realm ``EXAMPLE.COM'' if the realm is not explicitly +specified by clients; +@item Accepts services which only support encryption types known to be weak. +@end itemize + +The @code{krb5-realm} and @code{krb5-configuration} types have many fields. +Only the most commonly used ones are described here. For a full list, and +more detailed explanation of each, see the MIT +@uref{http://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html,,krb5.conf} +documentation. + + +@deftp {Data Type} krb5-realm +@cindex realm, kerberos +@table @asis +@item @code{name} +This field is a string identifying the name of the realm. A common +convention is to use the fully qualified DNS name of your organization, +converted to upper case. + +@item @code{admin-server} +This field is a string identifying the host where the administration server +is running. + +@item @code{kdc} +This field is a string identifying the key distribution center for the +realm. +@end table +@end deftp + +@deftp {Data Type} krb5-configuration + +@table @asis +@item @code{allow-weak-crypto?} (default: @code{#f}) +If this flag is @code{#t} then services which only offer encryption +algorithms known to be weak will be accepted. + +@item @code{default-realm} (default: @code{#f}) +This field should be a string identifying the default Kerberos realm for the +client. You should set this field to the name of your Kerberos realm. If +this value is @code{#f} then a realm must be specified with every Kerberos +principal when invoking programs such as @command{kinit}. + +@item @code{realms} +This should be a non-empty list of @code{krb5-realm} objects, which clients +may access. Normally, one of them will have a @code{name} field matching +the @code{default-realm} field. +@end table +@end deftp + + +@subsubheading PAM krb5 Service +@cindex pam-krb5 + +The @code{pam-krb5} service allows for login authentication and password +management via Kerberos. You will need this service if you want PAM enabled +applications to authenticate users using Kerberos. + +@defvr {Scheme Variable} pam-krb5-service-type +A service type for the Kerberos 5 PAM module. +@end defvr + +@deftp {Data Type} pam-krb5-configuration +Data type representing the configuration of the Kerberos 5 PAM module This +type has the following parameters: +@table @asis +@item @code{pam-krb5} (default: @code{pam-krb5}) +The pam-krb5 package to use. + +@item @code{minimum-uid} (default: @code{1000}) +The smallest user ID for which Kerberos authentications should be +attempted. Local accounts with lower values will silently fail to +authenticate. +@end table +@end deftp + + +@node LDAP Services +@subsection LDAP Services +@cindex LDAP +@cindex nslcd, LDAP service + +The @code{(gnu services authentication)} module provides the +@code{nslcd-service-type}, which can be used to authenticate against an LDAP +server. In addition to configuring the service itself, you may want to add +@code{ldap} as a name service to the Name Service Switch. @xref{Name Service +Switch} for detailed information. + +Here is a simple operating system declaration with a default configuration +of the @code{nslcd-service-type} and a Name Service Switch configuration +that consults the @code{ldap} name service last: + +@example +(use-service-modules authentication) +(use-modules (gnu system nss)) +... +(operating-system + ... + (services + (cons* + (service nslcd-service-type) + (service dhcp-client-service-type) + %base-services)) + (name-service-switch + (let ((services (list (name-service (name "db")) + (name-service (name "files")) + (name-service (name "ldap"))))) + (name-service-switch + (inherit %mdns-host-lookup-nss) + (password services) + (shadow services) + (group services) + (netgroup services) + (gshadow services))))) +@end example + +@c %start of generated documentation for nslcd-configuration + +Available @code{nslcd-configuration} fields are: + +@deftypevr {@code{nslcd-configuration} parameter} package nss-pam-ldapd +The @code{nss-pam-ldapd} package to use. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number threads +The number of threads to start that can handle requests and perform LDAP +queries. Each thread opens a separate connection to the LDAP server. The +default is to start 5 threads. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} string uid +This specifies the user id with which the daemon should be run. + +Defaults to @samp{"nslcd"}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} string gid +This specifies the group id with which the daemon should be run. + +Defaults to @samp{"nslcd"}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} log-option log +This option controls the way logging is done via a list containing SCHEME +and LEVEL. The SCHEME argument may either be the symbols "none" or +"syslog", or an absolute file name. The LEVEL argument is optional and +specifies the log level. The log level may be one of the following symbols: +"crit", "error", "warning", "notice", "info" or "debug". All messages with +the specified log level or higher are logged. + +Defaults to @samp{("/var/log/nslcd" info)}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} list uri +The list of LDAP server URIs. Normally, only the first server will be used +with the following servers as fall-back. + +Defaults to @samp{("ldap://localhost:389/")}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string ldap-version +The version of the LDAP protocol to use. The default is to use the maximum +version supported by the LDAP library. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string binddn +Specifies the distinguished name with which to bind to the directory server +for lookups. The default is to bind anonymously. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string bindpw +Specifies the credentials with which to bind. This option is only +applicable when used with binddn. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string rootpwmoddn +Specifies the distinguished name to use when the root user tries to modify a +user's password using the PAM module. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string rootpwmodpw +Specifies the credentials with which to bind if the root user tries to +change a user's password. This option is only applicable when used with +rootpwmoddn + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string sasl-mech +Specifies the SASL mechanism to be used when performing SASL authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string sasl-realm +Specifies the SASL realm to be used when performing SASL authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string sasl-authcid +Specifies the authentication identity to be used when performing SASL +authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string sasl-authzid +Specifies the authorization identity to be used when performing SASL +authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean sasl-canonicalize? +Determines whether the LDAP server host name should be canonicalised. If +this is enabled the LDAP library will do a reverse host name lookup. By +default, it is left up to the LDAP library whether this check is performed +or not. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string krb5-ccname +Set the name for the GSS-API Kerberos credentials cache. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} string base +The directory search base. + +Defaults to @samp{"dc=example,dc=com"}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} scope-option scope +Specifies the search scope (subtree, onelevel, base or children). The +default scope is subtree; base scope is almost never useful for name service +lookups; children scope is not supported on all servers. + +Defaults to @samp{(subtree)}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-deref-option deref +Specifies the policy for dereferencing aliases. The default policy is to +never dereference aliases. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean referrals +Specifies whether automatic referral chasing should be enabled. The default +behaviour is to chase referrals. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} list-of-map-entries maps +This option allows for custom attributes to be looked up instead of the +default RFC 2307 attributes. It is a list of maps, each consisting of the +name of a map, the RFC 2307 attribute to match and the query expression for +the attribute as it is available in the directory. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} list-of-filter-entries filters +A list of filters consisting of the name of a map to which the filter +applies and an LDAP search filter expression. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number bind-timelimit +Specifies the time limit in seconds to use when connecting to the directory +server. The default value is 10 seconds. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number timelimit +Specifies the time limit (in seconds) to wait for a response from the LDAP +server. A value of zero, which is the default, is to wait indefinitely for +searches to be completed. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number idle-timelimit +Specifies the period if inactivity (in seconds) after which the con‐ nection +to the LDAP server will be closed. The default is not to time out +connections. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number reconnect-sleeptime +Specifies the number of seconds to sleep when connecting to all LDAP servers +fails. By default one second is waited between the first failure and the +first retry. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number reconnect-retrytime +Specifies the time after which the LDAP server is considered to be +permanently unavailable. Once this time is reached retries will be done +only once per this time period. The default value is 10 seconds. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-ssl-option ssl +Specifies whether to use SSL/TLS or not (the default is not to). If +'start-tls is specified then StartTLS is used rather than raw LDAP over SSL. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-tls-reqcert-option tls-reqcert +Specifies what checks to perform on a server-supplied certificate. The +meaning of the values is described in the ldap.conf(5) manual page. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-cacertdir +Specifies the directory containing X.509 certificates for peer authen‐ +tication. This parameter is ignored when using GnuTLS. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-cacertfile +Specifies the path to the X.509 certificate for peer authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-randfile +Specifies the path to an entropy source. This parameter is ignored when +using GnuTLS. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-ciphers +Specifies the ciphers to use for TLS as a string. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-cert +Specifies the path to the file containing the local certificate for client +TLS authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string tls-key +Specifies the path to the file containing the private key for client TLS +authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number pagesize +Set this to a number greater than 0 to request paged results from the LDAP +server in accordance with RFC2696. The default (0) is to not request paged +results. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-ignore-users-option nss-initgroups-ignoreusers +This option prevents group membership lookups through LDAP for the specified +users. Alternatively, the value 'all-local may be used. With that value +nslcd builds a full list of non-LDAP users on startup. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number nss-min-uid +This option ensures that LDAP users with a numeric user id lower than the +specified value are ignored. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number nss-uid-offset +This option specifies an offset that is added to all LDAP numeric user ids. +This can be used to avoid user id collisions with local users. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-number nss-gid-offset +This option specifies an offset that is added to all LDAP numeric group +ids. This can be used to avoid user id collisions with local groups. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean nss-nested-groups +If this option is set, the member attribute of a group may point to another +group. Members of nested groups are also returned in the higher level group +and parent groups are returned when finding groups for a specific user. The +default is not to perform extra searches for nested groups. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean nss-getgrent-skipmembers +If this option is set, the group member list is not retrieved when looking +up groups. Lookups for finding which groups a user belongs to will remain +functional so the user will likely still get the correct groups assigned on +login. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean nss-disable-enumeration +If this option is set, functions which cause all user/group entries to be +loaded from the directory will not succeed in doing so. This can +dramatically reduce LDAP server load in situations where there are a great +number of users and/or groups. This option is not recommended for most +configurations. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string validnames +This option can be used to specify how user and group names are verified +within the system. This pattern is used to check all user and group names +that are requested and returned from LDAP. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean ignorecase +This specifies whether or not to perform searches using case-insensitive +matching. Enabling this could open up the system to authorization bypass +vulnerabilities and introduce nscd cache poisoning vulnerabilities which +allow denial of service. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-boolean pam-authc-ppolicy +This option specifies whether password policy controls are requested and +handled from the LDAP server when performing user authentication. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string pam-authc-search +By default nslcd performs an LDAP search with the user's credentials after +BIND (authentication) to ensure that the BIND operation was successful. The +default search is a simple check to see if the user's DN exists. A search +filter can be specified that will be used instead. It should return at +least one entry. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string pam-authz-search +This option allows flexible fine tuning of the authorisation check that +should be performed. The search filter specified is executed and if any +entries match, access is granted, otherwise access is denied. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} maybe-string pam-password-prohibit-message +If this option is set password modification using pam_ldap will be denied +and the specified message will be presented to the user instead. The +message can be used to direct the user to an alternative means of changing +their password. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{nslcd-configuration} parameter} list pam-services +List of pam service names for which LDAP authentication should suffice. + +Defaults to @samp{()}. + +@end deftypevr + +@c %end of generated documentation for nslcd-configuration + + +@node Web Services +@subsection Web Services + +@cindex web +@cindex www +@cindex HTTP +The @code{(gnu services web)} module provides the Apache HTTP Server, the +nginx web server, and also a fastcgi wrapper daemon. + +@subsubheading Apache HTTP Server + +@deffn {Scheme Variable} httpd-service-type +Service type for the @uref{https://httpd.apache.org/,Apache HTTP} server +(@dfn{httpd}). The value for this service type is a +@code{httpd-configuration} record. + +A simple example configuration is given below. + +@example +(service httpd-service-type + (httpd-configuration + (config + (httpd-config-file + (server-name "www.example.com") + (document-root "/srv/http/www.example.com"))))) +@end example + +Other services can also extend the @code{httpd-service-type} to add to the +configuration. + +@example +(simple-service 'my-extra-server httpd-service-type + (list + (httpd-virtualhost + "*:80" + (list (string-append + "ServerName "www.example.com + DocumentRoot \"/srv/http/www.example.com\""))))) +@end example +@end deffn + +The details for the @code{httpd-configuration}, @code{httpd-module}, +@code{httpd-config-file} and @code{httpd-virtualhost} record types are given +below. + +@deffn {Data Type} httpd-configuration +This data type represents the configuration for the httpd service. + +@table @asis +@item @code{package} (default: @code{httpd}) +The httpd package to use. + +@item @code{pid-file} (default: @code{"/var/run/httpd"}) +The pid file used by the shepherd-service. + +@item @code{config} (default: @code{(httpd-config-file)}) +The configuration file to use with the httpd service. The default value is a +@code{httpd-config-file} record, but this can also be a different +G-expression that generates a file, for example a @code{plain-file}. A file +outside of the store can also be specified through a string. + +@end table +@end deffn + +@deffn {Data Type} httpd-module +This data type represents a module for the httpd service. + +@table @asis +@item @code{name} +The name of the module. + +@item @code{file} +The file for the module. This can be relative to the httpd package being +used, the absolute location of a file, or a G-expression for a file within +the store, for example @code{(file-append mod-wsgi "/modules/mod_wsgi.so")}. + +@end table +@end deffn + +@defvr {Scheme Variable} %default-httpd-modules +A default list of @code{httpd-module} objects. +@end defvr + +@deffn {Data Type} httpd-config-file +This data type represents a configuration file for the httpd service. + +@table @asis +@item @code{modules} (default: @code{%default-httpd-modules}) +The modules to load. Additional modules can be added here, or loaded by +additional configuration. + +For example, in order to handle requests for PHP files, you can use Apache’s +@code{mod_proxy_fcgi} module along with @code{php-fpm-service-type}: + +@example +(service httpd-service-type + (httpd-configuration + (config + (httpd-config-file + (modules (cons* + (httpd-module + (name "proxy_module") + (file "modules/mod_proxy.so")) + (httpd-module + (name "proxy_fcgi_module") + (file "modules/mod_proxy_fcgi.so")) + %default-httpd-modules)) + (extra-config (list "\ +<FilesMatch \\.php$> + SetHandler \"proxy:unix:/var/run/php-fpm.sock|fcgi://localhost/\" +</FilesMatch>")))))) +(service php-fpm-service-type + (php-fpm-configuration + (socket "/var/run/php-fpm.sock") + (socket-group "httpd"))) +@end example + +@item @code{server-root} (default: @code{httpd}) +The @code{ServerRoot} in the configuration file, defaults to the httpd +package. Directives including @code{Include} and @code{LoadModule} are taken +as relative to the server root. + +@item @code{server-name} (default: @code{#f}) +The @code{ServerName} in the configuration file, used to specify the request +scheme, hostname and port that the server uses to identify itself. + +This doesn't need to be set in the server config, and can be specifyed in +virtual hosts. The default is @code{#f} to not specify a @code{ServerName}. + +@item @code{document-root} (default: @code{"/srv/http"}) +The @code{DocumentRoot} from which files will be served. + +@item @code{listen} (default: @code{'("80")}) +The list of values for the @code{Listen} directives in the config file. The +value should be a list of strings, when each string can specify the port +number to listen on, and optionally the IP address and protocol to use. + +@item @code{pid-file} (default: @code{"/var/run/httpd"}) +The @code{PidFile} to use. This should match the @code{pid-file} set in the +@code{httpd-configuration} so that the Shepherd service is configured +correctly. + +@item @code{error-log} (default: @code{"/var/log/httpd/error_log"}) +The @code{ErrorLog} to which the server will log errors. + +@item @code{user} (default: @code{"httpd"}) +The @code{User} which the server will answer requests as. + +@item @code{group} (default: @code{"httpd"}) +The @code{Group} which the server will answer requests as. + +@item @code{extra-config} (default: @code{(list "TypesConfig etc/httpd/mime.types")}) +A flat list of strings and G-expressions which will be added to the end of +the configuration file. + +Any values which the service is extended with will be appended to this list. + +@end table +@end deffn + +@deffn {Data Type} httpd-virtualhost +This data type represents a virtualhost configuration block for the httpd +service. + +These should be added to the extra-config for the httpd-service. + +@example +(simple-service 'my-extra-server httpd-service-type + (list + (httpd-virtualhost + "*:80" + (list (string-append + "ServerName "www.example.com + DocumentRoot \"/srv/http/www.example.com\""))))) +@end example + +@table @asis +@item @code{addresses-and-ports} +The addresses and ports for the @code{VirtualHost} directive. + +@item @code{contents} +The contents of the @code{VirtualHost} directive, this should be a list of +strings and G-expressions. + +@end table +@end deffn + +@subsubheading NGINX + +@deffn {Scheme Variable} nginx-service-type +Service type for the @uref{https://nginx.org/,NGinx} web server. The value +for this service type is a @code{<nginx-configuration>} record. + +A simple example configuration is given below. + +@example +(service nginx-service-type + (nginx-configuration + (server-blocks + (list (nginx-server-configuration + (server-name '("www.example.com")) + (root "/srv/http/www.example.com")))))) +@end example + +In addition to adding server blocks to the service configuration directly, +this service can be extended by other services to add server blocks, as in +this example: + +@example +(simple-service 'my-extra-server nginx-service-type + (list (nginx-server-configuration + (root "/srv/http/extra-website") + (try-files (list "$uri" "$uri/index.html"))))) +@end example +@end deffn + +At startup, @command{nginx} has not yet read its configuration file, so it +uses a default file to log error messages. If it fails to load its +configuration file, that is where error messages are logged. After the +configuration file is loaded, the default error log file changes as per +configuration. In our case, startup error messages can be found in +@file{/var/run/nginx/logs/error.log}, and after configuration in +@file{/var/log/nginx/error.log}. The second location can be changed with +the @var{log-directory} configuration option. + +@deffn {Data Type} nginx-configuration +This data type represents the configuration for NGinx. Some configuration +can be done through this and the other provided record types, or +alternatively, a config file can be provided. + +@table @asis +@item @code{nginx} (default: @code{nginx}) +The nginx package to use. + +@item @code{log-directory} (default: @code{"/var/log/nginx"}) +The directory to which NGinx will write log files. + +@item @code{run-directory} (default: @code{"/var/run/nginx"}) +The directory in which NGinx will create a pid file, and write temporary +files. + +@item @code{server-blocks} (default: @code{'()}) +A list of @dfn{server blocks} to create in the generated configuration file, +the elements should be of type @code{<nginx-server-configuration>}. + +The following example would setup NGinx to serve @code{www.example.com} from +the @code{/srv/http/www.example.com} directory, without using HTTPS. +@example +(service nginx-service-type + (nginx-configuration + (server-blocks + (list (nginx-server-configuration + (server-name '("www.example.com")) + (root "/srv/http/www.example.com")))))) +@end example + +@item @code{upstream-blocks} (default: @code{'()}) +A list of @dfn{upstream blocks} to create in the generated configuration +file, the elements should be of type @code{<nginx-upstream-configuration>}. + +Configuring upstreams through the @code{upstream-blocks} can be useful when +combined with @code{locations} in the @code{<nginx-server-configuration>} +records. The following example creates a server configuration with one +location configuration, that will proxy requests to a upstream +configuration, which will handle requests with two servers. + +@example +(service + nginx-service-type + (nginx-configuration + (server-blocks + (list (nginx-server-configuration + (server-name '("www.example.com")) + (root "/srv/http/www.example.com") + (locations + (list + (nginx-location-configuration + (uri "/path1") + (body '("proxy_pass http://server-proxy;")))))))) + (upstream-blocks + (list (nginx-upstream-configuration + (name "server-proxy") + (servers (list "server1.example.com" + "server2.example.com"))))))) +@end example + +@item @code{file} (default: @code{#f}) +If a configuration @var{file} is provided, this will be used, rather than +generating a configuration file from the provided @code{log-directory}, +@code{run-directory}, @code{server-blocks} and @code{upstream-blocks}. For +proper operation, these arguments should match what is in @var{file} to +ensure that the directories are created when the service is activated. + +This can be useful if you have an existing configuration file, or it's not +possible to do what is required through the other parts of the +nginx-configuration record. + +@item @code{server-names-hash-bucket-size} (default: @code{#f}) +Bucket size for the server names hash tables, defaults to @code{#f} to use +the size of the processors cache line. + +@item @code{server-names-hash-bucket-max-size} (default: @code{#f}) +Maximum bucket size for the server names hash tables. + +@item @code{extra-content} (default: @code{""}) +Extra content for the @code{http} block. Should be string or a string +valued G-expression. + +@end table +@end deffn + +@deftp {Data Type} nginx-server-configuration +Data type representing the configuration of an nginx server block. This +type has the following parameters: + +@table @asis +@item @code{listen} (default: @code{'("80" "443 ssl")}) +Each @code{listen} directive sets the address and port for IP, or the path +for a UNIX-domain socket on which the server will accept requests. Both +address and port, or only address or only port can be specified. An address +may also be a hostname, for example: + +@example +'("127.0.0.1:8000" "127.0.0.1" "8000" "*:8000" "localhost:8000") +@end example + +@item @code{server-name} (default: @code{(list 'default)}) +A list of server names this server represents. @code{'default} represents +the default server for connections matching no other server. + +@item @code{root} (default: @code{"/srv/http"}) +Root of the website nginx will serve. + +@item @code{locations} (default: @code{'()}) +A list of @dfn{nginx-location-configuration} or +@dfn{nginx-named-location-configuration} records to use within this server +block. + +@item @code{index} (default: @code{(list "index.html")}) +Index files to look for when clients ask for a directory. If it cannot be +found, Nginx will send the list of files in the directory. + +@item @code{try-files} (default: @code{'()}) +A list of files whose existence is checked in the specified order. +@code{nginx} will use the first file it finds to process the request. + +@item @code{ssl-certificate} (default: @code{#f}) +Where to find the certificate for secure connections. Set it to @code{#f} +if you don't have a certificate or you don't want to use HTTPS. + +@item @code{ssl-certificate-key} (default: @code{#f}) +Where to find the private key for secure connections. Set it to @code{#f} +if you don't have a key or you don't want to use HTTPS. + +@item @code{server-tokens?} (default: @code{#f}) +Whether the server should add its configuration to response. + +@item @code{raw-content} (default: @code{'()}) +A list of raw lines added to the server block. + +@end table +@end deftp + +@deftp {Data Type} nginx-upstream-configuration +Data type representing the configuration of an nginx @code{upstream} block. +This type has the following parameters: + +@table @asis +@item @code{name} +Name for this group of servers. + +@item @code{servers} +Specify the addresses of the servers in the group. The address can be +specified as a IP address (e.g.@: @samp{127.0.0.1}), domain name (e.g.@: +@samp{backend1.example.com}) or a path to a UNIX socket using the prefix +@samp{unix:}. For addresses using an IP address or domain name, the default +port is 80, and a different port can be specified explicitly. + +@end table +@end deftp + +@deftp {Data Type} nginx-location-configuration +Data type representing the configuration of an nginx @code{location} block. +This type has the following parameters: + +@table @asis +@item @code{uri} +URI which this location block matches. + +@anchor{nginx-location-configuration body} +@item @code{body} +Body of the location block, specified as a list of strings. This can contain +many configuration directives. For example, to pass requests to a upstream +server group defined using an @code{nginx-upstream-configuration} block, the +following directive would be specified in the body @samp{(list "proxy_pass +http://upstream-name;")}. + +@end table +@end deftp + +@deftp {Data Type} nginx-named-location-configuration +Data type representing the configuration of an nginx named location block. +Named location blocks are used for request redirection, and not used for +regular request processing. This type has the following parameters: + +@table @asis +@item @code{name} +Name to identify this location block. + +@item @code{body} +@xref{nginx-location-configuration body}, as the body for named location +blocks can be used in a similar way to the +@code{nginx-location-configuration body}. One restriction is that the body +of a named location block cannot contain location blocks. + +@end table +@end deftp + +@subsubheading Varnish Cache +@cindex Varnish +Varnish is a fast cache server that sits in between web applications and end +users. It proxies requests from clients and caches the accessed URLs such +that multiple requests for the same resource only creates one request to the +back-end. + +@defvr {Scheme Variable} varnish-service-type +Service type for the Varnish daemon. +@end defvr + +@deftp {Data Type} varnish-configuration +Data type representing the @code{varnish} service configuration. This type +has the following parameters: + +@table @asis +@item @code{package} (default: @code{varnish}) +The Varnish package to use. + +@item @code{name} (default: @code{"default"}) +A name for this Varnish instance. Varnish will create a directory in +@file{/var/varnish/} with this name and keep temporary files there. If the +name starts with a forward slash, it is interpreted as an absolute directory +name. + +Pass the @code{-n} argument to other Varnish programs to connect to the +named instance, e.g.@: @command{varnishncsa -n default}. + +@item @code{backend} (default: @code{"localhost:8080"}) +The backend to use. This option has no effect if @code{vcl} is set. + +@item @code{vcl} (default: #f) +The @dfn{VCL} (Varnish Configuration Language) program to run. If this is +@code{#f}, Varnish will proxy @code{backend} using the default +configuration. Otherwise this must be a file-like object with valid VCL +syntax. + +@c Varnish does not support HTTPS, so keep this URL to avoid confusion. +For example, to mirror @url{http://www.gnu.org,www.gnu.org} with VCL you can +do something along these lines: + +@example +(define %gnu-mirror + (plain-file + "gnu.vcl" + "vcl 4.1; +backend gnu @{ .host = "www.gnu.org"; @}")) + +(operating-system + ... + (services (cons (service varnish-service-type + (varnish-configuration + (listen '(":80")) + (vcl %gnu-mirror))) + %base-services))) +@end example + +The configuration of an already running Varnish instance can be inspected +and changed using the @command{varnishadm} program. + +Consult the @url{https://varnish-cache.org/docs/,Varnish User Guide} and +@url{https://book.varnish-software.com/4.0/,Varnish Book} for comprehensive +documentation on Varnish and its configuration language. + +@item @code{listen} (default: @code{'("localhost:80")}) +List of addresses Varnish will listen on. + +@item @code{storage} (default: @code{'("malloc,128m")}) +List of storage backends that will be available in VCL. + +@item @code{parameters} (default: @code{'()}) +List of run-time parameters in the form @code{'(("parameter" . "value"))}. + +@item @code{extra-options} (default: @code{'()}) +Additional arguments to pass to the @command{varnishd} process. + +@end table +@end deftp + +@subsubheading FastCGI +@cindex fastcgi +@cindex fcgiwrap +FastCGI is an interface between the front-end and the back-end of a web +service. It is a somewhat legacy facility; new web services should +generally just talk HTTP between the front-end and the back-end. However +there are a number of back-end services such as PHP or the optimized HTTP +Git repository access that use FastCGI, so we have support for it in Guix. + +To use FastCGI, you configure the front-end web server (e.g., nginx) to +dispatch some subset of its requests to the fastcgi backend, which listens +on a local TCP or UNIX socket. There is an intermediary @code{fcgiwrap} +program that sits between the actual backend process and the web server. +The front-end indicates which backend program to run, passing that +information to the @code{fcgiwrap} process. + +@defvr {Scheme Variable} fcgiwrap-service-type +A service type for the @code{fcgiwrap} FastCGI proxy. +@end defvr + +@deftp {Data Type} fcgiwrap-configuration +Data type representing the configuration of the @code{fcgiwrap} service. +This type has the following parameters: +@table @asis +@item @code{package} (default: @code{fcgiwrap}) +The fcgiwrap package to use. + +@item @code{socket} (default: @code{tcp:127.0.0.1:9000}) +The socket on which the @code{fcgiwrap} process should listen, as a string. +Valid @var{socket} values include @code{unix:@var{/path/to/unix/socket}}, +@code{tcp:@var{dot.ted.qu.ad}:@var{port}} and +@code{tcp6:[@var{ipv6_addr}]:port}. + +@item @code{user} (default: @code{fcgiwrap}) +@itemx @code{group} (default: @code{fcgiwrap}) +The user and group names, as strings, under which to run the @code{fcgiwrap} +process. The @code{fastcgi} service will ensure that if the user asks for +the specific user or group names @code{fcgiwrap} that the corresponding user +and/or group is present on the system. + +It is possible to configure a FastCGI-backed web service to pass HTTP +authentication information from the front-end to the back-end, and to allow +@code{fcgiwrap} to run the back-end process as a corresponding local user. +To enable this capability on the back-end., run @code{fcgiwrap} as the +@code{root} user and group. Note that this capability also has to be +configured on the front-end as well. +@end table +@end deftp + +@cindex php-fpm +PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI +implementation with some additional features useful for sites of any size. + +These features include: +@itemize @bullet +@item Adaptive process spawning +@item Basic statistics (similar to Apache's mod_status) +@item Advanced process management with graceful stop/start +@item Ability to start workers with different uid/gid/chroot/environment +and different php.ini (replaces safe_mode) +@item Stdout & stderr logging +@item Emergency restart in case of accidental opcode cache destruction +@item Accelerated upload support +@item Support for a "slowlog" +@item Enhancements to FastCGI, such as fastcgi_finish_request() - +a special function to finish request & flush all data while continuing to do +something time-consuming (video converting, stats processing, etc.) +@end itemize +...@: and much more. + +@defvr {Scheme Variable} php-fpm-service-type +A Service type for @code{php-fpm}. +@end defvr + +@deftp {Data Type} php-fpm-configuration +Data Type for php-fpm service configuration. +@table @asis +@item @code{php} (default: @code{php}) +The php package to use. +@item @code{socket} (default: @code{(string-append "/var/run/php" (version-major (package-version php)) "-fpm.sock")}) +The address on which to accept FastCGI requests. Valid syntaxes are: +@table @asis +@item @code{"ip.add.re.ss:port"} +Listen on a TCP socket to a specific address on a specific port. +@item @code{"port"} +Listen on a TCP socket to all addresses on a specific port. +@item @code{"/path/to/unix/socket"} +Listen on a unix socket. +@end table + +@item @code{user} (default: @code{php-fpm}) +User who will own the php worker processes. +@item @code{group} (default: @code{php-fpm}) +Group of the worker processes. +@item @code{socket-user} (default: @code{php-fpm}) +User who can speak to the php-fpm socket. +@item @code{socket-group} (default: @code{php-fpm}) +Group that can speak to the php-fpm socket. +@item @code{pid-file} (default: @code{(string-append "/var/run/php" (version-major (package-version php)) "-fpm.pid")}) +The process id of the php-fpm process is written to this file once the +service has started. +@item @code{log-file} (default: @code{(string-append "/var/log/php" (version-major (package-version php)) "-fpm.log")}) +Log for the php-fpm master process. +@item @code{process-manager} (default: @code{(php-fpm-dynamic-process-manager-configuration)}) +Detailed settings for the php-fpm process manager. Must be either: +@table @asis +@item @code{<php-fpm-dynamic-process-manager-configuration>} +@item @code{<php-fpm-static-process-manager-configuration>} +@item @code{<php-fpm-on-demand-process-manager-configuration>} +@end table +@item @code{display-errors} (default @code{#f}) +Determines whether php errors and warning should be sent to clients and +displayed in their browsers. This is useful for local php development, but +a security risk for public sites, as error messages can reveal passwords and +personal data. +@item @code{timezone} (default @code{#f}) +Specifies @code{php_admin_value[date.timezone]} parameter. +@item @code{workers-logfile} (default @code{(string-append "/var/log/php" (version-major (package-version php)) "-fpm.www.log")}) +This file will log the @code{stderr} outputs of php worker processes. Can +be set to @code{#f} to disable logging. +@item @code{file} (default @code{#f}) +An optional override of the whole configuration. You can use the +@code{mixed-text-file} function or an absolute filepath for it. +@end table +@end deftp + +@deftp {Data type} php-fpm-dynamic-process-manager-configuration +Data Type for the @code{dynamic} php-fpm process manager. With the +@code{dynamic} process manager, spare worker processes are kept around based +on it's configured limits. +@table @asis +@item @code{max-children} (default: @code{5}) +Maximum of worker processes. +@item @code{start-servers} (default: @code{2}) +How many worker processes should be started on start-up. +@item @code{min-spare-servers} (default: @code{1}) +How many spare worker processes should be kept around at minimum. +@item @code{max-spare-servers} (default: @code{3}) +How many spare worker processes should be kept around at maximum. +@end table +@end deftp + +@deftp {Data type} php-fpm-static-process-manager-configuration +Data Type for the @code{static} php-fpm process manager. With the +@code{static} process manager, an unchanging number of worker processes are +created. +@table @asis +@item @code{max-children} (default: @code{5}) +Maximum of worker processes. +@end table +@end deftp + +@deftp {Data type} php-fpm-on-demand-process-manager-configuration +Data Type for the @code{on-demand} php-fpm process manager. With the +@code{on-demand} process manager, worker processes are only created as +requests arrive. +@table @asis +@item @code{max-children} (default: @code{5}) +Maximum of worker processes. +@item @code{process-idle-timeout} (default: @code{10}) +The time in seconds after which a process with no requests is killed. +@end table +@end deftp + + +@deffn {Scheme Procedure} nginx-php-fpm-location @ + [#:nginx-package nginx] @ [socket (string-append "/var/run/php" @ +(version-major (package-version php)) @ "-fpm.sock")] A helper function to +quickly add php to an @code{nginx-server-configuration}. +@end deffn + +A simple services setup for nginx with php can look like this: +@example +(services (cons* (service dhcp-client-service-type) + (service php-fpm-service-type) + (service nginx-service-type + (nginx-server-configuration + (server-name '("example.com")) + (root "/srv/http/") + (locations + (list (nginx-php-location))) + (listen '("80")) + (ssl-certificate #f) + (ssl-certificate-key #f))) + %base-services)) +@end example + +@cindex cat-avatar-generator +The cat avatar generator is a simple service to demonstrate the use of +php-fpm in @code{Nginx}. It is used to generate cat avatar from a seed, for +instance the hash of a user's email address. + +@deffn {Scheme Procedure} cat-avatar-generator-service @ + [#:cache-dir "/var/cache/cat-avatar-generator"] @ [#:package +cat-avatar-generator] @ [#:configuration (nginx-server-configuration)] +Returns an nginx-server-configuration that inherits @code{configuration}. +It extends the nginx configuration to add a server block that serves +@code{package}, a version of cat-avatar-generator. During execution, +cat-avatar-generator will be able to use @code{cache-dir} as its cache +directory. +@end deffn + +A simple setup for cat-avatar-generator can look like this: +@example +(services (cons* (cat-avatar-generator-service + #:configuration + (nginx-server-configuration + (server-name '("example.com")))) + ... + %base-services)) +@end example + +@subsubheading Hpcguix-web + +@cindex hpcguix-web +The @uref{hpcguix-web, https://github.com/UMCUGenetics/hpcguix-web/} program +is a customizable web interface to browse Guix packages, initially designed +for users of high-performance computing (HPC) clusters. + +@defvr {Scheme Variable} hpcguix-web-service-type +The service type for @code{hpcguix-web}. +@end defvr + +@deftp {Data Type} hpcguix-web-configuration +Data type for the hpcguix-web service configuration. + +@table @asis +@item @code{specs} +A gexp (@pxref{G-Expressions}) specifying the hpcguix-web service +configuration. The main items available in this spec are: + +@table @asis +@item @code{title-prefix} (default: @code{"hpcguix | "}) +The page title prefix. + +@item @code{guix-command} (default: @code{"guix"}) +The @command{guix} command. + +@item @code{package-filter-proc} (default: @code{(const #t)}) +A procedure specifying how to filter packages that are displayed. + +@item @code{package-page-extension-proc} (default: @code{(const '())}) +Extension package for @code{hpcguix-web}. + +@item @code{menu} (default: @code{'()}) +Additional entry in page @code{menu}. + +@item @code{channels} (default: @code{%default-channels}) +List of channels from which the package list is built (@pxref{Channels}). + +@item @code{package-list-expiration} (default: @code{(* 12 3600)}) +The expiration time, in seconds, after which the package list is rebuilt +from the latest instances of the given channels. +@end table + +See the hpcguix-web repository for a +@uref{https://github.com/UMCUGenetics/hpcguix-web/blob/master/hpcweb-configuration.scm, +complete example}. + +@item @code{package} (default: @code{hpcguix-web}) +The hpcguix-web package to use. +@end table +@end deftp + +A typical hpcguix-web service declaration looks like this: + +@example +(service hpcguix-web-service-type + (hpcguix-web-configuration + (specs + #~(define site-config + (hpcweb-configuration + (title-prefix "Guix-HPC - ") + (menu '(("/about" "ABOUT")))))))) +@end example + +@quotation Note +The hpcguix-web service periodically updates the package list it publishes +by pulling channels from Git. To that end, it needs to access X.509 +certificates so that it can authenticate Git servers when communicating over +HTTPS, and it assumes that @file{/etc/ssl/certs} contains those +certificates. + +Thus, make sure to add @code{nss-certs} or another certificate package to +the @code{packages} field of your configuration. @ref{X.509 Certificates}, +for more information on X.509 certificates. +@end quotation + +@node Certificate Services +@subsection Certificate Services + +@cindex Web +@cindex HTTP, HTTPS +@cindex Let's Encrypt +@cindex TLS certificates +The @code{(gnu services certbot)} module provides a service to automatically +obtain a valid TLS certificate from the Let's Encrypt certificate +authority. These certificates can then be used to serve content securely +over HTTPS or other TLS-based protocols, with the knowledge that the client +will be able to verify the server's authenticity. + +@url{https://letsencrypt.org/, Let's Encrypt} provides the @code{certbot} +tool to automate the certification process. This tool first securely +generates a key on the server. It then makes a request to the Let's Encrypt +certificate authority (CA) to sign the key. The CA checks that the request +originates from the host in question by using a challenge-response protocol, +requiring the server to provide its response over HTTP. If that protocol +completes successfully, the CA signs the key, resulting in a certificate. +That certificate is valid for a limited period of time, and therefore to +continue to provide TLS services, the server needs to periodically ask the +CA to renew its signature. + +The certbot service automates this process: the initial key generation, the +initial certification request to the Let's Encrypt service, the web server +challenge/response integration, writing the certificate to disk, the +automated periodic renewals, and the deployment tasks associated with the +renewal (e.g.@: reloading services, copying keys with different +permissions). + +Certbot is run twice a day, at a random minute within the hour. It won't do +anything until your certificates are due for renewal or revoked, but running +it regularly would give your service a chance of staying online in case a +Let's Encrypt-initiated revocation happened for some reason. + +By using this service, you agree to the ACME Subscriber Agreement, which can +be found there: @url{https://acme-v01.api.letsencrypt.org/directory}. + +@defvr {Scheme Variable} certbot-service-type +A service type for the @code{certbot} Let's Encrypt client. Its value must +be a @code{certbot-configuration} record as in this example: + +@example +(define %nginx-deploy-hook + (program-file + "nginx-deploy-hook" + #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read))) + (kill pid SIGHUP)))) + +(service certbot-service-type + (certbot-configuration + (email "foo@@example.net") + (certificates + (list + (certificate-configuration + (domains '("example.net" "www.example.net")) + (deploy-hook %nginx-deploy-hook)) + (certificate-configuration + (domains '("bar.example.net"))))))) +@end example + +See below for details about @code{certbot-configuration}. +@end defvr + +@deftp {Data Type} certbot-configuration +Data type representing the configuration of the @code{certbot} service. +This type has the following parameters: + +@table @asis +@item @code{package} (default: @code{certbot}) +The certbot package to use. + +@item @code{webroot} (default: @code{/var/www}) +The directory from which to serve the Let's Encrypt challenge/response +files. + +@item @code{certificates} (default: @code{()}) +A list of @code{certificates-configuration}s for which to generate +certificates and request signatures. Each certificate has a @code{name} and +several @code{domains}. + +@item @code{email} +Mandatory email used for registration, recovery contact, and important +account notifications. + +@item @code{rsa-key-size} (default: @code{2048}) +Size of the RSA key. + +@item @code{default-location} (default: @i{see below}) +The default @code{nginx-location-configuration}. Because @code{certbot} +needs to be able to serve challenges and responses, it needs to be able to +run a web server. It does so by extending the @code{nginx} web service with +an @code{nginx-server-configuration} listening on the @var{domains} on port +80, and which has a @code{nginx-location-configuration} for the +@code{/.well-known/} URI path subspace used by Let's Encrypt. @xref{Web +Services}, for more on these nginx configuration data types. + +Requests to other URL paths will be matched by the @code{default-location}, +which if present is added to all @code{nginx-server-configuration}s. + +By default, the @code{default-location} will issue a redirect from +@code{http://@var{domain}/...} to @code{https://@var{domain}/...}, leaving +you to define what to serve on your site via @code{https}. + +Pass @code{#f} to not issue a default location. +@end table +@end deftp + +@deftp {Data Type} certificate-configuration +Data type representing the configuration of a certificate. This type has +the following parameters: + +@table @asis +@item @code{name} (default: @i{see below}) +This name is used by Certbot for housekeeping and in file paths; it doesn't +affect the content of the certificate itself. To see certificate names, run +@code{certbot certificates}. + +Its default is the first provided domain. + +@item @code{domains} (default: @code{()}) +The first domain provided will be the subject CN of the certificate, and all +domains will be Subject Alternative Names on the certificate. + +@item @code{deploy-hook} (default: @code{#f}) +Command to be run in a shell once for each successfully issued certificate. +For this command, the shell variable @code{$RENEWED_LINEAGE} will point to +the config live subdirectory (for example, +@samp{"/etc/letsencrypt/live/example.com"}) containing the new certificates +and keys; the shell variable @code{$RENEWED_DOMAINS} will contain a +space-delimited list of renewed certificate domains (for example, +@samp{"example.com www.example.com"}. + +@end table +@end deftp + +For each @code{certificate-configuration}, the certificate is saved to +@code{/etc/letsencrypt/live/@var{name}/fullchain.pem} and the key is saved +to @code{/etc/letsencrypt/live/@var{name}/privkey.pem}. +@node DNS Services +@subsection DNS Services +@cindex DNS (domain name system) +@cindex domain name system (DNS) + +The @code{(gnu services dns)} module provides services related to the +@dfn{domain name system} (DNS). It provides a server service for hosting an +@emph{authoritative} DNS server for multiple zones, slave or master. This +service uses @uref{https://www.knot-dns.cz/, Knot DNS}. And also a caching +and forwarding DNS server for the LAN, which uses +@uref{http://www.thekelleys.org.uk/dnsmasq/doc.html, dnsmasq}. + +@subsubheading Knot Service + +An example configuration of an authoritative server for two zones, one +master and one slave, is: + +@lisp +(define-zone-entries example.org.zone +;; Name TTL Class Type Data + ("@@" "" "IN" "A" "127.0.0.1") + ("@@" "" "IN" "NS" "ns") + ("ns" "" "IN" "A" "127.0.0.1")) + +(define master-zone + (knot-zone-configuration + (domain "example.org") + (zone (zone-file + (origin "example.org") + (entries example.org.zone))))) + +(define slave-zone + (knot-zone-configuration + (domain "plop.org") + (dnssec-policy "default") + (master (list "plop-master")))) + +(define plop-master + (knot-remote-configuration + (id "plop-master") + (address (list "208.76.58.171")))) + +(operating-system + ;; ... + (services (cons* (service knot-service-type + (knot-configuration + (remotes (list plop-master)) + (zones (list master-zone slave-zone)))) + ;; ... + %base-services))) +@end lisp + +@deffn {Scheme Variable} knot-service-type +This is the type for the Knot DNS server. + +Knot DNS is an authoritative DNS server, meaning that it can serve multiple +zones, that is to say domain names you would buy from a registrar. This +server is not a resolver, meaning that it can only resolve names for which +it is authoritative. This server can be configured to serve zones as a +master server or a slave server as a per-zone basis. Slave zones will get +their data from masters, and will serve it as an authoritative server. From +the point of view of a resolver, there is no difference between master and +slave. + +The following data types are used to configure the Knot DNS server: +@end deffn + +@deftp {Data Type} knot-key-configuration +Data type representing a key. This type has the following parameters: + +@table @asis +@item @code{id} (default: @code{""}) +An identifier for other configuration fields to refer to this key. IDs must +be unique and must not be empty. + +@item @code{algorithm} (default: @code{#f}) +The algorithm to use. Choose between @code{#f}, @code{'hmac-md5}, +@code{'hmac-sha1}, @code{'hmac-sha224}, @code{'hmac-sha256}, +@code{'hmac-sha384} and @code{'hmac-sha512}. + +@item @code{secret} (default: @code{""}) +The secret key itself. + +@end table +@end deftp + +@deftp {Data Type} knot-acl-configuration +Data type representing an Access Control List (ACL) configuration. This +type has the following parameters: + +@table @asis +@item @code{id} (default: @code{""}) +An identifier for ether configuration fields to refer to this key. IDs must +be unique and must not be empty. + +@item @code{address} (default: @code{'()}) +An ordered list of IP addresses, network subnets, or network ranges +represented with strings. The query must match one of them. Empty value +means that address match is not required. + +@item @code{key} (default: @code{'()}) +An ordered list of references to keys represented with strings. The string +must match a key ID defined in a @code{knot-key-configuration}. No key +means that a key is not require to match that ACL. + +@item @code{action} (default: @code{'()}) +An ordered list of actions that are permitted or forbidden by this ACL. +Possible values are lists of zero or more elements from @code{'transfer}, +@code{'notify} and @code{'update}. + +@item @code{deny?} (default: @code{#f}) +When true, the ACL defines restrictions. Listed actions are forbidden. +When false, listed actions are allowed. + +@end table +@end deftp + +@deftp {Data Type} zone-entry +Data type represnting a record entry in a zone file. This type has the +following parameters: + +@table @asis +@item @code{name} (default: @code{"@@"}) +The name of the record. @code{"@@"} refers to the origin of the zone. +Names are relative to the origin of the zone. For example, in the +@code{example.org} zone, @code{"ns.example.org"} actually refers to +@code{ns.example.org.example.org}. Names ending with a dot are absolute, +which means that @code{"ns.example.org."} refers to @code{ns.example.org}. + +@item @code{ttl} (default: @code{""}) +The Time-To-Live (TTL) of this record. If not set, the default TTL is used. + +@item @code{class} (default: @code{"IN"}) +The class of the record. Knot currently supports only @code{"IN"} and +partially @code{"CH"}. + +@item @code{type} (default: @code{"A"}) +The type of the record. Common types include A (IPv4 address), AAAA (IPv6 +address), NS (Name Server) and MX (Mail eXchange). Many other types are +defined. + +@item @code{data} (default: @code{""}) +The data contained in the record. For instance an IP address associated +with an A record, or a domain name associated with an NS record. Remember +that domain names are relative to the origin unless they end with a dot. + +@end table +@end deftp + +@deftp {Data Type} zone-file +Data type representing the content of a zone file. This type has the +following parameters: + +@table @asis +@item @code{entries} (default: @code{'()}) +The list of entries. The SOA record is taken care of, so you don't need to +put it in the list of entries. This list should probably contain an entry +for your primary authoritative DNS server. Other than using a list of +entries directly, you can use @code{define-zone-entries} to define a object +containing the list of entries more easily, that you can later pass to the +@code{entries} field of the @code{zone-file}. + +@item @code{origin} (default: @code{""}) +The name of your zone. This parameter cannot be empty. + +@item @code{ns} (default: @code{"ns"}) +The domain of your primary authoritative DNS server. The name is relative +to the origin, unless it ends with a dot. It is mandatory that this primary +DNS server corresponds to an NS record in the zone and that it is associated +to an IP address in the list of entries. + +@item @code{mail} (default: @code{"hostmaster"}) +An email address people can contact you at, as the owner of the zone. This +is translated as @code{<mail>@@<origin>}. + +@item @code{serial} (default: @code{1}) +The serial number of the zone. As this is used to keep track of changes by +both slaves and resolvers, it is mandatory that it @emph{never} decreases. +Always increment it when you make a change in your zone. + +@item @code{refresh} (default: @code{(* 2 24 3600)}) +The frequency at which slaves will do a zone transfer. This value is a +number of seconds. It can be computed by multiplications or with +@code{(string->duration)}. + +@item @code{retry} (default: @code{(* 15 60)}) +The period after which a slave will retry to contact its master when it +fails to do so a first time. + +@item @code{expiry} (default: @code{(* 14 24 3600)}) +Default TTL of records. Existing records are considered correct for at most +this amount of time. After this period, resolvers will invalidate their +cache and check again that it still exists. + +@item @code{nx} (default: @code{3600}) +Default TTL of inexistant records. This delay is usually short because you +want your new domains to reach everyone quickly. + +@end table +@end deftp + +@deftp {Data Type} knot-remote-configuration +Data type representing a remote configuration. This type has the following +parameters: + +@table @asis +@item @code{id} (default: @code{""}) +An identifier for other configuration fields to refer to this remote. IDs +must be unique and must not be empty. + +@item @code{address} (default: @code{'()}) +An ordered list of destination IP addresses. Addresses are tried in +sequence. An optional port can be given with the @@ separator. For +instance: @code{(list "1.2.3.4" "2.3.4.5@@53")}. Default port is 53. + +@item @code{via} (default: @code{'()}) +An ordered list of source IP addresses. An empty list will have Knot choose +an appropriate source IP. An optional port can be given with the @@ +separator. The default is to choose at random. + +@item @code{key} (default: @code{#f}) +A reference to a key, that is a string containing the identifier of a key +defined in a @code{knot-key-configuration} field. + +@end table +@end deftp + +@deftp {Data Type} knot-keystore-configuration +Data type representing a keystore to hold dnssec keys. This type has the +following parameters: + +@table @asis +@item @code{id} (default: @code{""}) +The id of the keystore. It must not be empty. + +@item @code{backend} (default: @code{'pem}) +The backend to store the keys in. Can be @code{'pem} or @code{'pkcs11}. + +@item @code{config} (default: @code{"/var/lib/knot/keys/keys"}) +The configuration string of the backend. An example for the PKCS#11 is: +@code{"pkcs11:token=knot;pin-value=1234 +/gnu/store/.../lib/pkcs11/libsofthsm2.so"}. For the pem backend, the string +reprensents a path in the file system. + +@end table +@end deftp + +@deftp {Data Type} knot-policy-configuration +Data type representing a dnssec policy. Knot DNS is able to automatically +sign your zones. It can either generate and manage your keys automatically +or use keys that you generate. + +Dnssec is usually implemented using two keys: a Key Signing Key (KSK) that +is used to sign the second, and a Zone Signing Key (ZSK) that is used to +sign the zone. In order to be trusted, the KSK needs to be present in the +parent zone (usually a top-level domain). If your registrar supports +dnssec, you will have to send them your KSK's hash so they can add a DS +record in their zone. This is not automated and need to be done each time +you change your KSK. + +The policy also defines the lifetime of keys. Usually, ZSK can be changed +easily and use weaker cryptographic functions (they use lower parameters) in +order to sign records quickly, so they are changed often. The KSK however +requires manual interaction with the registrar, so they are changed less +often and use stronger parameters because they sign only one record. + +This type has the following parameters: + +@table @asis +@item @code{id} (default: @code{""}) +The id of the policy. It must not be empty. + +@item @code{keystore} (default: @code{"default"}) +A reference to a keystore, that is a string containing the identifier of a +keystore defined in a @code{knot-keystore-configuration} field. The +@code{"default"} identifier means the default keystore (a kasp database that +was setup by this service). + +@item @code{manual?} (default: @code{#f}) +Whether the key management is manual or automatic. + +@item @code{single-type-signing?} (default: @code{#f}) +When @code{#t}, use the Single-Type Signing Scheme. + +@item @code{algorithm} (default: @code{"ecdsap256sha256"}) +An algorithm of signing keys and issued signatures. + +@item @code{ksk-size} (default: @code{256}) +The length of the KSK. Note that this value is correct for the default +algorithm, but would be unsecure for other algorithms. + +@item @code{zsk-size} (default: @code{256}) +The length of the ZSK. Note that this value is correct for the default +algorithm, but would be unsecure for other algorithms. + +@item @code{dnskey-ttl} (default: @code{'default}) +The TTL value for DNSKEY records added into zone apex. The special +@code{'default} value means same as the zone SOA TTL. + +@item @code{zsk-lifetime} (default: @code{(* 30 24 3600)}) +The period between ZSK publication and the next rollover initiation. + +@item @code{propagation-delay} (default: @code{(* 24 3600)}) +An extra delay added for each key rollover step. This value should be high +enough to cover propagation of data from the master server to all slaves. + +@item @code{rrsig-lifetime} (default: @code{(* 14 24 3600)}) +A validity period of newly issued signatures. + +@item @code{rrsig-refresh} (default: @code{(* 7 24 3600)}) +A period how long before a signature expiration the signature will be +refreshed. + +@item @code{nsec3?} (default: @code{#f}) +When @code{#t}, NSEC3 will be used instead of NSEC. + +@item @code{nsec3-iterations} (default: @code{5}) +The number of additional times the hashing is performed. + +@item @code{nsec3-salt-length} (default: @code{8}) +The length of a salt field in octets, which is appended to the original +owner name before hashing. + +@item @code{nsec3-salt-lifetime} (default: @code{(* 30 24 3600)}) +The validity period of newly issued salt field. + +@end table +@end deftp + +@deftp {Data Type} knot-zone-configuration +Data type representing a zone served by Knot. This type has the following +parameters: + +@table @asis +@item @code{domain} (default: @code{""}) +The domain served by this configuration. It must not be empty. + +@item @code{file} (default: @code{""}) +The file where this zone is saved. This parameter is ignored by master +zones. Empty means default location that depends on the domain name. + +@item @code{zone} (default: @code{(zone-file)}) +The content of the zone file. This parameter is ignored by slave zones. It +must contain a zone-file record. + +@item @code{master} (default: @code{'()}) +A list of master remotes. When empty, this zone is a master. When set, +this zone is a slave. This is a list of remotes identifiers. + +@item @code{ddns-master} (default: @code{#f}) +The main master. When empty, it defaults to the first master in the list of +masters. + +@item @code{notify} (default: @code{'()}) +A list of slave remote identifiers. + +@item @code{acl} (default: @code{'()}) +A list of acl identifiers. + +@item @code{semantic-checks?} (default: @code{#f}) +When set, this adds more semantic checks to the zone. + +@item @code{disable-any?} (default: @code{#f}) +When set, this forbids queries of the ANY type. + +@item @code{zonefile-sync} (default: @code{0}) +The delay between a modification in memory and on disk. 0 means immediate +synchronization. + +@item @code{serial-policy} (default: @code{'increment}) +A policy between @code{'increment} and @code{'unixtime}. + +@end table +@end deftp + +@deftp {Data Type} knot-configuration +Data type representing the Knot configuration. This type has the following +parameters: + +@table @asis +@item @code{knot} (default: @code{knot}) +The Knot package. + +@item @code{run-directory} (default: @code{"/var/run/knot"}) +The run directory. This directory will be used for pid file and sockets. + +@item @code{listen-v4} (default: @code{"0.0.0.0"}) +An ip address on which to listen. + +@item @code{listen-v6} (default: @code{"::"}) +An ip address on which to listen. + +@item @code{listen-port} (default: @code{53}) +A port on which to listen. + +@item @code{keys} (default: @code{'()}) +The list of knot-key-configuration used by this configuration. + +@item @code{acls} (default: @code{'()}) +The list of knot-acl-configuration used by this configuration. + +@item @code{remotes} (default: @code{'()}) +The list of knot-remote-configuration used by this configuration. + +@item @code{zones} (default: @code{'()}) +The list of knot-zone-configuration used by this configuration. + +@end table +@end deftp + +@subsubheading Dnsmasq Service + +@deffn {Scheme Variable} dnsmasq-service-type +This is the type of the dnsmasq service, whose value should be an +@code{dnsmasq-configuration} object as in this example: + +@example +(service dnsmasq-service-type + (dnsmasq-configuration + (no-resolv? #t) + (servers '("192.168.1.1")))) +@end example +@end deffn + +@deftp {Data Type} dnsmasq-configuration +Data type representing the configuration of dnsmasq. + +@table @asis +@item @code{package} (default: @var{dnsmasq}) +Package object of the dnsmasq server. + +@item @code{no-hosts?} (default: @code{#f}) +When true, don't read the hostnames in /etc/hosts. + +@item @code{port} (default: @code{53}) +The port to listen on. Setting this to zero completely disables DNS +responses, leaving only DHCP and/or TFTP functions. + +@item @code{local-service?} (default: @code{#t}) +Accept DNS queries only from hosts whose address is on a local subnet, ie a +subnet for which an interface exists on the server. + +@item @code{listen-addresses} (default: @code{'()}) +Listen on the given IP addresses. + +@item @code{resolv-file} (default: @code{"/etc/resolv.conf"}) +The file to read the IP address of the upstream nameservers from. + +@item @code{no-resolv?} (default: @code{#f}) +When true, don't read @var{resolv-file}. + +@item @code{servers} (default: @code{'()}) +Specify IP address of upstream servers directly. + +@item @code{cache-size} (default: @code{150}) +Set the size of dnsmasq's cache. Setting the cache size to zero disables +caching. + +@item @code{negative-cache?} (default: @code{#t}) +When false, disable negative caching. + +@end table +@end deftp + +@subsubheading ddclient Service + +@cindex ddclient +The ddclient service described below runs the ddclient daemon, which takes +care of automatically updating DNS entries for service providers such as +@uref{https://dyn.com/dns/, Dyn}. + +The following example show instantiates the service with its default +configuration: + +@example +(service ddclient-service-type) +@end example + +Note that ddclient needs to access credentials that are stored in a +@dfn{secret file}, by default @file{/etc/ddclient/secrets} (see +@code{secret-file} below.) You are expected to create this file manually, +in an ``out-of-band'' fashion (you @emph{could} make this file part of the +service configuration, for instance by using @code{plain-file}, but it will +be world-readable @i{via} @file{/gnu/store}.) See the examples in the +@file{share/ddclient} directory of the @code{ddclient} package. + +@c %start of fragment + +Available @code{ddclient-configuration} fields are: + +@deftypevr {@code{ddclient-configuration} parameter} package ddclient +The ddclient package. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} integer daemon +The period after which ddclient will retry to check IP and domain name. + +Defaults to @samp{300}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} boolean syslog +Use syslog for the output. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string mail +Mail to user. + +Defaults to @samp{"root"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string mail-failure +Mail failed update to user. + +Defaults to @samp{"root"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string pid +The ddclient PID file. + +Defaults to @samp{"/var/run/ddclient/ddclient.pid"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} boolean ssl +Enable SSL support. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string user +Specifies the user name or ID that is used when running ddclient program. + +Defaults to @samp{"ddclient"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string group +Group of the user who will run the ddclient program. + +Defaults to @samp{"ddclient"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} string secret-file +Secret file which will be appended to @file{ddclient.conf} file. This file +contains credentials for use by ddclient. You are expected to create it +manually. + +Defaults to @samp{"/etc/ddclient/secrets.conf"}. + +@end deftypevr + +@deftypevr {@code{ddclient-configuration} parameter} list extra-options +Extra options will be appended to @file{ddclient.conf} file. + +Defaults to @samp{()}. + +@end deftypevr + + +@c %end of fragment + + +@node VPN Services +@subsection VPN Services +@cindex VPN (virtual private network) +@cindex virtual private network (VPN) + +The @code{(gnu services vpn)} module provides services related to +@dfn{virtual private networks} (VPNs). It provides a @emph{client} service +for your machine to connect to a VPN, and a @emph{servire} service for your +machine to host a VPN. Both services use @uref{https://openvpn.net/, +OpenVPN}. + +@deffn {Scheme Procedure} openvpn-client-service @ + [#:config (openvpn-client-configuration)] + +Return a service that runs @command{openvpn}, a VPN daemon, as a client. +@end deffn + +@deffn {Scheme Procedure} openvpn-server-service @ + [#:config (openvpn-server-configuration)] + +Return a service that runs @command{openvpn}, a VPN daemon, as a server. + +Both can be run simultaneously. +@end deffn + +@c %automatically generated documentation + +Available @code{openvpn-client-configuration} fields are: + +@deftypevr {@code{openvpn-client-configuration} parameter} package openvpn +The OpenVPN package. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} string pid-file +The OpenVPN pid file. + +Defaults to @samp{"/var/run/openvpn/openvpn.pid"}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} proto proto +The protocol (UDP or TCP) used to open a channel between clients and +servers. + +Defaults to @samp{udp}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} dev dev +The device type used to represent the VPN connection. + +Defaults to @samp{tun}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} string ca +The certificate authority to check connections against. + +Defaults to @samp{"/etc/openvpn/ca.crt"}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} string cert +The certificate of the machine the daemon is running on. It should be +signed by the authority given in @code{ca}. + +Defaults to @samp{"/etc/openvpn/client.crt"}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} string key +The key of the machine the daemon is running on. It must be the key whose +certificate is @code{cert}. + +Defaults to @samp{"/etc/openvpn/client.key"}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} boolean comp-lzo? +Whether to use the lzo compression algorithm. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} boolean persist-key? +Don't re-read key files across SIGUSR1 or --ping-restart. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} boolean persist-tun? +Don't close and reopen TUN/TAP device or run up/down scripts across SIGUSR1 +or --ping-restart restarts. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} number verbosity +Verbosity level. + +Defaults to @samp{3}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} tls-auth-client tls-auth +Add an additional layer of HMAC authentication on top of the TLS control +channel to protect against DoS attacks. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} key-usage verify-key-usage? +Whether to check the server certificate has server usage extension. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} bind bind? +Bind to a specific local port number. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} resolv-retry resolv-retry? +Retry resolving server address. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-client-configuration} parameter} openvpn-remote-list remote +A list of remote servers to connect to. + +Defaults to @samp{()}. + +Available @code{openvpn-remote-configuration} fields are: + +@deftypevr {@code{openvpn-remote-configuration} parameter} string name +Server name. + +Defaults to @samp{"my-server"}. + +@end deftypevr + +@deftypevr {@code{openvpn-remote-configuration} parameter} number port +Port number the server listens to. + +Defaults to @samp{1194}. + +@end deftypevr + +@end deftypevr +@c %end of automatic openvpn-client documentation + +@c %automatically generated documentation + +Available @code{openvpn-server-configuration} fields are: + +@deftypevr {@code{openvpn-server-configuration} parameter} package openvpn +The OpenVPN package. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string pid-file +The OpenVPN pid file. + +Defaults to @samp{"/var/run/openvpn/openvpn.pid"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} proto proto +The protocol (UDP or TCP) used to open a channel between clients and +servers. + +Defaults to @samp{udp}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} dev dev +The device type used to represent the VPN connection. + +Defaults to @samp{tun}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string ca +The certificate authority to check connections against. + +Defaults to @samp{"/etc/openvpn/ca.crt"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string cert +The certificate of the machine the daemon is running on. It should be +signed by the authority given in @code{ca}. + +Defaults to @samp{"/etc/openvpn/client.crt"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string key +The key of the machine the daemon is running on. It must be the key whose +certificate is @code{cert}. + +Defaults to @samp{"/etc/openvpn/client.key"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} boolean comp-lzo? +Whether to use the lzo compression algorithm. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} boolean persist-key? +Don't re-read key files across SIGUSR1 or --ping-restart. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} boolean persist-tun? +Don't close and reopen TUN/TAP device or run up/down scripts across SIGUSR1 +or --ping-restart restarts. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} number verbosity +Verbosity level. + +Defaults to @samp{3}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} tls-auth-server tls-auth +Add an additional layer of HMAC authentication on top of the TLS control +channel to protect against DoS attacks. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} number port +Specifies the port number on which the server listens. + +Defaults to @samp{1194}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} ip-mask server +An ip and mask specifying the subnet inside the virtual network. + +Defaults to @samp{"10.8.0.0 255.255.255.0"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} cidr6 server-ipv6 +A CIDR notation specifying the IPv6 subnet inside the virtual network. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string dh +The Diffie-Hellman parameters file. + +Defaults to @samp{"/etc/openvpn/dh2048.pem"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string ifconfig-pool-persist +The file that records client IPs. + +Defaults to @samp{"/etc/openvpn/ipp.txt"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} gateway redirect-gateway? +When true, the server will act as a gateway for its clients. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} boolean client-to-client? +When true, clients are allowed to talk to each other inside the VPN. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} keepalive keepalive +Causes ping-like messages to be sent back and forth over the link so that +each side knows when the other side has gone down. @code{keepalive} +requires a pair. The first element is the period of the ping sending, and +the second element is the timeout before considering the other side down. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} number max-clients +The maximum number of clients. + +Defaults to @samp{100}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} string status +The status file. This file shows a small report on current connection. It +is truncated and rewritten every minute. + +Defaults to @samp{"/var/run/openvpn/status"}. + +@end deftypevr + +@deftypevr {@code{openvpn-server-configuration} parameter} openvpn-ccd-list client-config-dir +The list of configuration for some clients. + +Defaults to @samp{()}. + +Available @code{openvpn-ccd-configuration} fields are: + +@deftypevr {@code{openvpn-ccd-configuration} parameter} string name +Client name. + +Defaults to @samp{"client"}. + +@end deftypevr + +@deftypevr {@code{openvpn-ccd-configuration} parameter} ip-mask iroute +Client own network + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{openvpn-ccd-configuration} parameter} ip-mask ifconfig-push +Client VPN IP. + +Defaults to @samp{#f}. + +@end deftypevr + +@end deftypevr + + +@c %end of automatic openvpn-server documentation + + +@node Network File System +@subsection Network File System +@cindex NFS + +The @code{(gnu services nfs)} module provides the following services, which +are most commonly used in relation to mounting or exporting directory trees +as @dfn{network file systems} (NFS). + +@subsubheading RPC Bind Service +@cindex rpcbind + +The RPC Bind service provides a facility to map program numbers into +universal addresses. Many NFS related services use this facility. Hence it +is automatically started when a dependent service starts. + +@defvr {Scheme Variable} rpcbind-service-type +A service type for the RPC portmapper daemon. +@end defvr + + +@deftp {Data Type} rpcbind-configuration +Data type representing the configuration of the RPC Bind Service. This type +has the following parameters: +@table @asis +@item @code{rpcbind} (default: @code{rpcbind}) +The rpcbind package to use. + +@item @code{warm-start?} (default: @code{#t}) +If this parameter is @code{#t}, then the daemon will read a state file on +startup thus reloading state information saved by a previous instance. +@end table +@end deftp + + +@subsubheading Pipefs Pseudo File System +@cindex pipefs +@cindex rpc_pipefs + +The pipefs file system is used to transfer NFS related data between the +kernel and user space programs. + +@defvr {Scheme Variable} pipefs-service-type +A service type for the pipefs pseudo file system. +@end defvr + +@deftp {Data Type} pipefs-configuration +Data type representing the configuration of the pipefs pseudo file system +service. This type has the following parameters: +@table @asis +@item @code{mount-point} (default: @code{"/var/lib/nfs/rpc_pipefs"}) +The directory to which the file system is to be attached. +@end table +@end deftp + + +@subsubheading GSS Daemon Service +@cindex GSSD +@cindex GSS +@cindex global security system + +The @dfn{global security system} (GSS) daemon provides strong security for +RPC based protocols. Before exchanging RPC requests an RPC client must +establish a security context. Typically this is done using the Kerberos +command @command{kinit} or automatically at login time using PAM services +(@pxref{Kerberos Services}). + +@defvr {Scheme Variable} gss-service-type +A service type for the Global Security System (GSS) daemon. +@end defvr + +@deftp {Data Type} gss-configuration +Data type representing the configuration of the GSS daemon service. This +type has the following parameters: +@table @asis +@item @code{nfs-utils} (default: @code{nfs-utils}) +The package in which the @command{rpc.gssd} command is to be found. + +@item @code{pipefs-directory} (default: @code{"/var/lib/nfs/rpc_pipefs"}) +The directory where the pipefs file system is mounted. + +@end table +@end deftp + + +@subsubheading IDMAP Daemon Service +@cindex idmapd +@cindex name mapper + +The idmap daemon service provides mapping between user IDs and user names. +Typically it is required in order to access file systems mounted via NFSv4. + +@defvr {Scheme Variable} idmap-service-type +A service type for the Identity Mapper (IDMAP) daemon. +@end defvr + +@deftp {Data Type} idmap-configuration +Data type representing the configuration of the IDMAP daemon service. This +type has the following parameters: +@table @asis +@item @code{nfs-utils} (default: @code{nfs-utils}) +The package in which the @command{rpc.idmapd} command is to be found. + +@item @code{pipefs-directory} (default: @code{"/var/lib/nfs/rpc_pipefs"}) +The directory where the pipefs file system is mounted. + +@item @code{domain} (default: @code{#f}) +The local NFSv4 domain name. This must be a string or @code{#f}. If it is +@code{#f} then the daemon will use the host's fully qualified domain name. + +@end table +@end deftp + +@node Continuous Integration +@subsection Continuous Integration + +@cindex continuous integration +@uref{https://git.savannah.gnu.org/cgit/guix/guix-cuirass.git, Cuirass} is a +continuous integration tool for Guix. It can be used both for development +and for providing substitutes to others (@pxref{Substitutes}). + +The @code{(gnu services cuirass)} module provides the following service. + +@defvr {Scheme Procedure} cuirass-service-type +The type of the Cuirass service. Its value must be a +@code{cuirass-configuration} object, as described below. +@end defvr + +To add build jobs, you have to set the @code{specifications} field of the +configuration. Here is an example of a service that polls the Guix +repository and builds the packages from a manifest. Some of the packages +are defined in the @code{"custom-packages"} input, which is the equivalent +of @code{GUIX_PACKAGE_PATH}. + +@example +(define %cuirass-specs + #~(list + '((#:name . "my-manifest") + (#:load-path-inputs . ("guix")) + (#:package-path-inputs . ("custom-packages")) + (#:proc-input . "guix") + (#:proc-file . "build-aux/cuirass/gnu-system.scm") + (#:proc . cuirass-jobs) + (#:proc-args . ((subset . "manifests") + (systems . ("x86_64-linux")) + (manifests . (("config" . "guix/manifest.scm"))))) + (#:inputs . (((#:name . "guix") + (#:url . "git://git.savannah.gnu.org/guix.git") + (#:load-path . ".") + (#:branch . "master") + (#:no-compile? . #t)) + ((#:name . "config") + (#:url . "git://git.example.org/config.git") + (#:load-path . ".") + (#:branch . "master") + (#:no-compile? . #t)) + ((#:name . "custom-packages") + (#:url . "git://git.example.org/custom-packages.git") + (#:load-path . ".") + (#:branch . "master") + (#:no-compile? . #t))))))) + +(service cuirass-service-type + (cuirass-configuration + (specifications %cuirass-specs))) +@end example + +While information related to build jobs is located directly in the +specifications, global settings for the @command{cuirass} process are +accessible in other @code{cuirass-configuration} fields. + +@deftp {Data Type} cuirass-configuration +Data type representing the configuration of Cuirass. + +@table @asis +@item @code{log-file} (default: @code{"/var/log/cuirass.log"}) +Location of the log file. + +@item @code{cache-directory} (default: @code{"/var/cache/cuirass"}) +Location of the repository cache. + +@item @code{user} (default: @code{"cuirass"}) +Owner of the @code{cuirass} process. + +@item @code{group} (default: @code{"cuirass"}) +Owner's group of the @code{cuirass} process. + +@item @code{interval} (default: @code{60}) +Number of seconds between the poll of the repositories followed by the +Cuirass jobs. + +@item @code{database} (default: @code{"/var/lib/cuirass/cuirass.db"}) +Location of sqlite database which contains the build results and previously +added specifications. + +@item @code{ttl} (default: @code{(* 30 24 3600)}) +Specifies the time-to-live (TTL) in seconds of garbage collector roots that +are registered for build results. This means that build results are +protected from garbage collection for at least @var{ttl} seconds. + +@item @code{port} (default: @code{8081}) +Port number used by the HTTP server. + +@item --listen=@var{host} +Listen on the network interface for @var{host}. The default is to accept +connections from localhost. + +@item @code{specifications} (default: @code{#~'()}) +A gexp (@pxref{G-Expressions}) that evaluates to a list of specifications, +where a specification is an association list (@pxref{Associations Lists,,, +guile, GNU Guile Reference Manual}) whose keys are keywords +(@code{#:keyword-example}) as shown in the example above. + +@item @code{use-substitutes?} (default: @code{#f}) +This allows using substitutes to avoid building every dependencies of a job +from source. + +@item @code{one-shot?} (default: @code{#f}) +Only evaluate specifications and build derivations once. + +@item @code{fallback?} (default: @code{#f}) +When substituting a pre-built binary fails, fall back to building packages +locally. + +@item @code{cuirass} (default: @code{cuirass}) +The Cuirass package to use. +@end table +@end deftp + +@node Power Management Services +@subsection Power Management Services + +@cindex tlp +@cindex power management with TLP +@subsubheading TLP daemon + +The @code{(gnu services pm)} module provides a Guix service definition for +the Linux power management tool TLP. + +TLP enables various powersaving modes in userspace and kernel. Contrary to +@code{upower-service}, it is not a passive, monitoring tool, as it will +apply custom settings each time a new power source is detected. More +information can be found at @uref{http://linrunner.de/en/tlp/tlp.html, TLP +home page}. + +@deffn {Scheme Variable} tlp-service-type +The service type for the TLP tool. Its value should be a valid TLP +configuration (see below). To use the default settings, simply write: +@example +(service tlp-service-type) +@end example +@end deffn + +By default TLP does not need much configuration but most TLP parameters can +be tweaked using @code{tlp-configuration}. + +Each parameter definition is preceded by its type; for example, +@samp{boolean foo} indicates that the @code{foo} parameter should be +specified as a boolean. Types starting with @code{maybe-} denote parameters +that won't show up in TLP config file when their value is @code{'disabled}. + +@c The following documentation was initially generated by +@c (generate-tlp-documentation) in (gnu services pm). Manually maintained +@c documentation is better, so we shouldn't hesitate to edit below as +@c needed. However if the change you want to make to this documentation +@c can be done in an automated way, it's probably easier to change +@c (generate-documentation) than to make it below and have to deal with +@c the churn as TLP updates. + +Available @code{tlp-configuration} fields are: + +@deftypevr {@code{tlp-configuration} parameter} package tlp +The TLP package. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean tlp-enable? +Set to true if you wish to enable TLP. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string tlp-default-mode +Default mode when no power supply can be detected. Alternatives are AC and +BAT. + +Defaults to @samp{"AC"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer disk-idle-secs-on-ac +Number of seconds Linux kernel has to wait after the disk goes idle, before +syncing on AC. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer disk-idle-secs-on-bat +Same as @code{disk-idle-ac} but on BAT mode. + +Defaults to @samp{2}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer max-lost-work-secs-on-ac +Dirty pages flushing periodicity, expressed in seconds. + +Defaults to @samp{15}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer max-lost-work-secs-on-bat +Same as @code{max-lost-work-secs-on-ac} but on BAT mode. + +Defaults to @samp{60}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list cpu-scaling-governor-on-ac +CPU frequency scaling governor on AC mode. With intel_pstate driver, +alternatives are powersave and performance. With acpi-cpufreq driver, +alternatives are ondemand, powersave, performance and conservative. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list cpu-scaling-governor-on-bat +Same as @code{cpu-scaling-governor-on-ac} but on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-scaling-min-freq-on-ac +Set the min available frequency for the scaling governor on AC. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-scaling-max-freq-on-ac +Set the max available frequency for the scaling governor on AC. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-scaling-min-freq-on-bat +Set the min available frequency for the scaling governor on BAT. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-scaling-max-freq-on-bat +Set the max available frequency for the scaling governor on BAT. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-min-perf-on-ac +Limit the min P-state to control the power dissipation of the CPU, in AC +mode. Values are stated as a percentage of the available performance. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-max-perf-on-ac +Limit the max P-state to control the power dissipation of the CPU, in AC +mode. Values are stated as a percentage of the available performance. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-min-perf-on-bat +Same as @code{cpu-min-perf-on-ac} on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-non-negative-integer cpu-max-perf-on-bat +Same as @code{cpu-max-perf-on-ac} on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-boolean cpu-boost-on-ac? +Enable CPU turbo boost feature on AC mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-boolean cpu-boost-on-bat? +Same as @code{cpu-boost-on-ac?} on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean sched-powersave-on-ac? +Allow Linux kernel to minimize the number of CPU cores/hyper-threads used +under light load conditions. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean sched-powersave-on-bat? +Same as @code{sched-powersave-on-ac?} but on BAT mode. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean nmi-watchdog? +Enable Linux kernel NMI watchdog. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-string phc-controls +For Linux kernels with PHC patch applied, change CPU voltages. An example +value would be @samp{"F:V F:V F:V F:V"}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string energy-perf-policy-on-ac +Set CPU performance versus energy saving policy on AC. Alternatives are +performance, normal, powersave. + +Defaults to @samp{"performance"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string energy-perf-policy-on-bat +Same as @code{energy-perf-policy-ac} but on BAT mode. + +Defaults to @samp{"powersave"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} space-separated-string-list disks-devices +Hard disk devices. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} space-separated-string-list disk-apm-level-on-ac +Hard disk advanced power management level. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} space-separated-string-list disk-apm-level-on-bat +Same as @code{disk-apm-bat} but on BAT mode. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list disk-spindown-timeout-on-ac +Hard disk spin down timeout. One value has to be specified for each +declared hard disk. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list disk-spindown-timeout-on-bat +Same as @code{disk-spindown-timeout-on-ac} but on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list disk-iosched +Select IO scheduler for disk devices. One value has to be specified for +each declared hard disk. Example alternatives are cfq, deadline and noop. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string sata-linkpwr-on-ac +SATA aggressive link power management (ALPM) level. Alternatives are +min_power, medium_power, max_performance. + +Defaults to @samp{"max_performance"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string sata-linkpwr-on-bat +Same as @code{sata-linkpwr-ac} but on BAT mode. + +Defaults to @samp{"min_power"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-string sata-linkpwr-blacklist +Exclude specified SATA host devices for link power management. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-on-off-boolean ahci-runtime-pm-on-ac? +Enable Runtime Power Management for AHCI controller and disks on AC mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-on-off-boolean ahci-runtime-pm-on-bat? +Same as @code{ahci-runtime-pm-on-ac} on BAT mode. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer ahci-runtime-pm-timeout +Seconds of inactivity before disk is suspended. + +Defaults to @samp{15}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string pcie-aspm-on-ac +PCI Express Active State Power Management level. Alternatives are default, +performance, powersave. + +Defaults to @samp{"performance"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string pcie-aspm-on-bat +Same as @code{pcie-aspm-ac} but on BAT mode. + +Defaults to @samp{"powersave"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-power-profile-on-ac +Radeon graphics clock speed level. Alternatives are low, mid, high, auto, +default. + +Defaults to @samp{"high"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-power-profile-on-bat +Same as @code{radeon-power-ac} but on BAT mode. + +Defaults to @samp{"low"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-dpm-state-on-ac +Radeon dynamic power management method (DPM). Alternatives are battery, +performance. + +Defaults to @samp{"performance"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-dpm-state-on-bat +Same as @code{radeon-dpm-state-ac} but on BAT mode. + +Defaults to @samp{"battery"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-dpm-perf-level-on-ac +Radeon DPM performance level. Alternatives are auto, low, high. + +Defaults to @samp{"auto"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string radeon-dpm-perf-level-on-bat +Same as @code{radeon-dpm-perf-ac} but on BAT mode. + +Defaults to @samp{"auto"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} on-off-boolean wifi-pwr-on-ac? +Wifi power saving mode. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} on-off-boolean wifi-pwr-on-bat? +Same as @code{wifi-power-ac?} but on BAT mode. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} y-n-boolean wol-disable? +Disable wake on LAN. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer sound-power-save-on-ac +Timeout duration in seconds before activating audio power saving on Intel +HDA and AC97 devices. A value of 0 disables power saving. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} non-negative-integer sound-power-save-on-bat +Same as @code{sound-powersave-ac} but on BAT mode. + +Defaults to @samp{1}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} y-n-boolean sound-power-save-controller? +Disable controller in powersaving mode on Intel HDA devices. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean bay-poweroff-on-bat? +Enable optical drive in UltraBay/MediaBay on BAT mode. Drive can be powered +on again by releasing (and reinserting) the eject lever or by pressing the +disc eject button on newer models. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string bay-device +Name of the optical drive device to power off. + +Defaults to @samp{"sr0"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string runtime-pm-on-ac +Runtime Power Management for PCI(e) bus devices. Alternatives are on and +auto. + +Defaults to @samp{"on"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} string runtime-pm-on-bat +Same as @code{runtime-pm-ac} but on BAT mode. + +Defaults to @samp{"auto"}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean runtime-pm-all? +Runtime Power Management for all PCI(e) bus devices, except blacklisted +ones. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-space-separated-string-list runtime-pm-blacklist +Exclude specified PCI(e) device addresses from Runtime Power Management. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} space-separated-string-list runtime-pm-driver-blacklist +Exclude PCI(e) devices assigned to the specified drivers from Runtime Power +Management. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean usb-autosuspend? +Enable USB autosuspend feature. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-string usb-blacklist +Exclude specified devices from USB autosuspend. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean usb-blacklist-wwan? +Exclude WWAN devices from USB autosuspend. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-string usb-whitelist +Include specified devices into USB autosuspend, even if they are already +excluded by the driver or via @code{usb-blacklist-wwan?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} maybe-boolean usb-autosuspend-disable-on-shutdown? +Enable USB autosuspend before shutdown. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{tlp-configuration} parameter} boolean restore-device-state-on-startup? +Restore radio device state (bluetooth, wifi, wwan) from previous shutdown on +system startup. + +Defaults to @samp{#f}. + +@end deftypevr + +@cindex thermald +@cindex CPU frequency scaling with thermald +@subsubheading Thermald daemon + +The @code{(gnu services pm)} module provides an interface to thermald, a CPU +frequency scaling service which helps prevent overheating. + +@defvr {Scheme Variable} thermald-service-type +This is the service type for @uref{https://01.org/linux-thermal-daemon/, +thermald}, the Linux Thermal Daemon, which is responsible for controlling +the thermal state of processors and preventing overheating. +@end defvr + +@deftp {Data Type} thermald-configuration +Data type representing the configuration of @code{thermald-service-type}. + +@table @asis +@item @code{ignore-cpuid-check?} (default: @code{#f}) +Ignore cpuid check for supported CPU models. + +@item @code{thermald} (default: @var{thermald}) +Package object of thermald. + +@end table +@end deftp + +@node Audio Services +@subsection Audio Services + +The @code{(gnu services audio)} module provides a service to start MPD (the +Music Player Daemon). + +@cindex mpd +@subsubheading Music Player Daemon + +The Music Player Daemon (MPD) is a service that can play music while being +controlled from the local machine or over the network by a variety of +clients. + +The following example shows how one might run @code{mpd} as user +@code{"bob"} on port @code{6666}. It uses pulseaudio for output. + +@example +(service mpd-service-type + (mpd-configuration + (user "bob") + (port "6666"))) +@end example + +@defvr {Scheme Variable} mpd-service-type +The service type for @command{mpd} +@end defvr + +@deftp {Data Type} mpd-configuration +Data type representing the configuration of @command{mpd}. + +@table @asis +@item @code{user} (default: @code{"mpd"}) +The user to run mpd as. + +@item @code{music-dir} (default: @code{"~/Music"}) +The directory to scan for music files. + +@item @code{playlist-dir} (default: @code{"~/.mpd/playlists"}) +The directory to store playlists. + +@item @code{db-file} (default: @code{"~/.mpd/tag_cache"}) +The location of the music database. + +@item @code{state-file} (default: @code{"~/.mpd/state"}) +The location of the file that stores current MPD's state. + +@item @code{sticker-file} (default: @code{"~/.mpd/sticker.sql"}) +The location of the sticker database. + +@item @code{port} (default: @code{"6600"}) +The port to run mpd on. + +@item @code{address} (default: @code{"any"}) +The address that mpd will bind to. To use a Unix domain socket, an absolute +path can be specified here. + +@end table +@end deftp + +@node Virtualization Services +@subsection Virtualization services + +The @code{(gnu services virtualization)} module provides services for the +libvirt and virtlog daemons, as well as other virtualization-related +services. + +@subsubheading Libvirt daemon +@code{libvirtd} is the server side daemon component of the libvirt +virtualization management system. This daemon runs on host servers and +performs required management tasks for virtualized guests. + +@deffn {Scheme Variable} libvirt-service-type +This is the type of the @uref{https://libvirt.org, libvirt daemon}. Its +value must be a @code{libvirt-configuration}. + +@example +(service libvirt-service-type + (libvirt-configuration + (unix-sock-group "libvirt") + (tls-port "16555"))) +@end example +@end deffn + +@c Auto-generated with (generate-libvirt-documentation) +Available @code{libvirt-configuration} fields are: + +@deftypevr {@code{libvirt-configuration} parameter} package libvirt +Libvirt package. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean listen-tls? +Flag listening for secure TLS connections on the public TCP/IP port. must +set @code{listen} for this to have any effect. + +It is necessary to setup a CA and issue server certificates before using +this capability. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean listen-tcp? +Listen for unencrypted TCP connections on the public TCP/IP port. must set +@code{listen} for this to have any effect. + +Using the TCP socket requires SASL authentication by default. Only SASL +mechanisms which support data encryption are allowed. This is DIGEST_MD5 +and GSSAPI (Kerberos5) + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string tls-port +Port for accepting secure TLS connections This can be a port number, or +service name + +Defaults to @samp{"16514"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string tcp-port +Port for accepting insecure TCP connections This can be a port number, or +service name + +Defaults to @samp{"16509"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string listen-addr +IP address or hostname used for client connections. + +Defaults to @samp{"0.0.0.0"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean mdns-adv? +Flag toggling mDNS advertisement of the libvirt service. + +Alternatively can disable for all services on a host by stopping the Avahi +daemon. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string mdns-name +Default mDNS advertisement name. This must be unique on the immediate +broadcast network. + +Defaults to @samp{"Virtualization Host <hostname>"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string unix-sock-group +UNIX domain socket group ownership. This can be used to allow a 'trusted' +set of users access to management capabilities without becoming root. + +Defaults to @samp{"root"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string unix-sock-ro-perms +UNIX socket permissions for the R/O socket. This is used for monitoring VM +status only. + +Defaults to @samp{"0777"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string unix-sock-rw-perms +UNIX socket permissions for the R/W socket. Default allows only root. If +PolicyKit is enabled on the socket, the default will change to allow +everyone (eg, 0777) + +Defaults to @samp{"0770"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string unix-sock-admin-perms +UNIX socket permissions for the admin socket. Default allows only owner +(root), do not change it unless you are sure to whom you are exposing the +access to. + +Defaults to @samp{"0777"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string unix-sock-dir +The directory in which sockets will be found/created. + +Defaults to @samp{"/var/run/libvirt"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string auth-unix-ro +Authentication scheme for UNIX read-only sockets. By default socket +permissions allow anyone to connect + +Defaults to @samp{"polkit"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string auth-unix-rw +Authentication scheme for UNIX read-write sockets. By default socket +permissions only allow root. If PolicyKit support was compiled into +libvirt, the default will be to use 'polkit' auth. + +Defaults to @samp{"polkit"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string auth-tcp +Authentication scheme for TCP sockets. If you don't enable SASL, then all +TCP traffic is cleartext. Don't do this outside of a dev/test scenario. + +Defaults to @samp{"sasl"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string auth-tls +Authentication scheme for TLS sockets. TLS sockets already have encryption +provided by the TLS layer, and limited authentication is done by +certificates. + +It is possible to make use of any SASL authentication mechanism as well, by +using 'sasl' for this option + +Defaults to @samp{"none"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} optional-list access-drivers +API access control scheme. + +By default an authenticated user is allowed access to all APIs. Access +drivers can place restrictions on this. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string key-file +Server key file path. If set to an empty string, then no private key is +loaded. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string cert-file +Server key file path. If set to an empty string, then no certificate is +loaded. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string ca-file +Server key file path. If set to an empty string, then no CA certificate is +loaded. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string crl-file +Certificate revocation list path. If set to an empty string, then no CRL is +loaded. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean tls-no-sanity-cert +Disable verification of our own server certificates. + +When libvirtd starts it performs some sanity checks against its own +certificates. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean tls-no-verify-cert +Disable verification of client certificates. + +Client certificate verification is the primary authentication mechanism. +Any client which does not present a certificate signed by the CA will be +rejected. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} optional-list tls-allowed-dn-list +Whitelist of allowed x509 Distinguished Name. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} optional-list sasl-allowed-usernames +Whitelist of allowed SASL usernames. The format for username depends on the +SASL authentication mechanism. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string tls-priority +Override the compile time default TLS priority string. The default is +usually "NORMAL" unless overridden at build time. Only set this is it is +desired for libvirt to deviate from the global default settings. + +Defaults to @samp{"NORMAL"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-clients +Maximum number of concurrent client connections to allow over all sockets +combined. + +Defaults to @samp{5000}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-queued-clients +Maximum length of queue of connections waiting to be accepted by the +daemon. Note, that some protocols supporting retransmission may obey this +so that a later reattempt at connection succeeds. + +Defaults to @samp{1000}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-anonymous-clients +Maximum length of queue of accepted but not yet authenticated clients. Set +this to zero to turn this feature off + +Defaults to @samp{20}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer min-workers +Number of workers to start up initially. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-workers +Maximum number of worker threads. + +If the number of active clients exceeds @code{min-workers}, then more +threads are spawned, up to max_workers limit. Typically you'd want +max_workers to equal maximum number of clients allowed. + +Defaults to @samp{20}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer prio-workers +Number of priority workers. If all workers from above pool are stuck, some +calls marked as high priority (notably domainDestroy) can be executed in +this pool. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-requests +Total global limit on concurrent RPC calls. + +Defaults to @samp{20}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer max-client-requests +Limit on concurrent requests from a single client connection. To avoid one +client monopolizing the server this should be a small fraction of the global +max_requests and max_workers parameter. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-min-workers +Same as @code{min-workers} but for the admin interface. + +Defaults to @samp{1}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-max-workers +Same as @code{max-workers} but for the admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-max-clients +Same as @code{max-clients} but for the admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-max-queued-clients +Same as @code{max-queued-clients} but for the admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-max-client-requests +Same as @code{max-client-requests} but for the admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer log-level +Logging level. 4 errors, 3 warnings, 2 information, 1 debug. + +Defaults to @samp{3}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string log-filters +Logging filters. + +A filter allows to select a different logging level for a given category of +logs The format for a filter is one of: + +@itemize @bullet +@item +x:name + +@item +x:+name + +@end itemize + +where @code{name} is a string which is matched against the category given in +the @code{VIR_LOG_INIT()} at the top of each libvirt source file, e.g., +"remote", "qemu", or "util.json" (the name in the filter can be a substring +of the full category name, in order to match multiple similar categories), +the optional "+" prefix tells libvirt to log stack trace for each message +matching name, and @code{x} is the minimal level where matching messages +should be logged: + +@itemize @bullet +@item +1: DEBUG + +@item +2: INFO + +@item +3: WARNING + +@item +4: ERROR + +@end itemize + +Multiple filters can be defined in a single filters statement, they just +need to be separated by spaces. + +Defaults to @samp{"3:remote 4:event"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string log-outputs +Logging outputs. + +An output is one of the places to save logging information The format for an +output can be: + +@table @code +@item x:stderr +output goes to stderr + +@item x:syslog:name +use syslog for the output and use the given name as the ident + +@item x:file:file_path +output to a file, with the given filepath + +@item x:journald +output to journald logging system + +@end table + +In all case the x prefix is the minimal level, acting as a filter + +@itemize @bullet +@item +1: DEBUG + +@item +2: INFO + +@item +3: WARNING + +@item +4: ERROR + +@end itemize + +Multiple outputs can be defined, they just need to be separated by spaces. + +Defaults to @samp{"3:stderr"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer audit-level +Allows usage of the auditing subsystem to be altered + +@itemize @bullet +@item +0: disable all auditing + +@item +1: enable auditing, only if enabled on host + +@item +2: enable auditing, and exit if disabled on host. + +@end itemize + +Defaults to @samp{1}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} boolean audit-logging +Send audit messages via libvirt logging infrastructure. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} optional-string host-uuid +Host UUID. UUID must not have all digits be the same. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} string host-uuid-source +Source to read host UUID. + +@itemize @bullet +@item +@code{smbios}: fetch the UUID from @code{dmidecode -s system-uuid} + +@item +@code{machine-id}: fetch the UUID from @code{/etc/machine-id} + +@end itemize + +If @code{dmidecode} does not provide a valid UUID a temporary UUID will be +generated. + +Defaults to @samp{"smbios"}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer keepalive-interval +A keepalive message is sent to a client after @code{keepalive_interval} +seconds of inactivity to check if the client is still responding. If set to +-1, libvirtd will never send keepalive requests; however clients can still +send them and the daemon will send responses. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer keepalive-count +Maximum number of keepalive messages that are allowed to be sent to the +client without getting any response before the connection is considered +broken. + +In other words, the connection is automatically closed approximately after +@code{keepalive_interval * (keepalive_count + 1)} seconds since the last +message received from the client. When @code{keepalive-count} is set to 0, +connections will be automatically closed after @code{keepalive-interval} +seconds of inactivity without sending any keepalive messages. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-keepalive-interval +Same as above but for admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer admin-keepalive-count +Same as above but for admin interface. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{libvirt-configuration} parameter} integer ovs-timeout +Timeout for Open vSwitch calls. + +The @code{ovs-vsctl} utility is used for the configuration and its timeout +option is set by default to 5 seconds to avoid potential infinite waits +blocking libvirt. + +Defaults to @samp{5}. + +@end deftypevr + +@c %end of autogenerated docs + +@subsubheading Virtlog daemon +The virtlogd service is a server side daemon component of libvirt that is +used to manage logs from virtual machine consoles. + +This daemon is not used directly by libvirt client applications, rather it +is called on their behalf by @code{libvirtd}. By maintaining the logs in a +standalone daemon, the main @code{libvirtd} daemon can be restarted without +risk of losing logs. The @code{virtlogd} daemon has the ability to re-exec() +itself upon receiving @code{SIGUSR1}, to allow live upgrades without +downtime. + +@deffn {Scheme Variable} virtlog-service-type +This is the type of the virtlog daemon. Its value must be a +@code{virtlog-configuration}. + +@example +(service virtlog-service-type + (virtlog-configuration + (max-clients 1000))) +@end example +@end deffn + +@deftypevr {@code{virtlog-configuration} parameter} integer log-level +Logging level. 4 errors, 3 warnings, 2 information, 1 debug. + +Defaults to @samp{3}. + +@end deftypevr + +@deftypevr {@code{virtlog-configuration} parameter} string log-filters +Logging filters. + +A filter allows to select a different logging level for a given category of +logs The format for a filter is one of: + +@itemize @bullet +@item +x:name + +@item +x:+name + +@end itemize + +where @code{name} is a string which is matched against the category given in +the @code{VIR_LOG_INIT()} at the top of each libvirt source file, e.g., +"remote", "qemu", or "util.json" (the name in the filter can be a substring +of the full category name, in order to match multiple similar categories), +the optional "+" prefix tells libvirt to log stack trace for each message +matching name, and @code{x} is the minimal level where matching messages +should be logged: + +@itemize @bullet +@item +1: DEBUG + +@item +2: INFO + +@item +3: WARNING + +@item +4: ERROR + +@end itemize + +Multiple filters can be defined in a single filters statement, they just +need to be separated by spaces. + +Defaults to @samp{"3:remote 4:event"}. + +@end deftypevr + +@deftypevr {@code{virtlog-configuration} parameter} string log-outputs +Logging outputs. + +An output is one of the places to save logging information The format for an +output can be: + +@table @code +@item x:stderr +output goes to stderr + +@item x:syslog:name +use syslog for the output and use the given name as the ident + +@item x:file:file_path +output to a file, with the given filepath + +@item x:journald +output to journald logging system + +@end table + +In all case the x prefix is the minimal level, acting as a filter + +@itemize @bullet +@item +1: DEBUG + +@item +2: INFO + +@item +3: WARNING + +@item +4: ERROR + +@end itemize + +Multiple outputs can be defined, they just need to be separated by spaces. + +Defaults to @samp{"3:stderr"}. + +@end deftypevr + +@deftypevr {@code{virtlog-configuration} parameter} integer max-clients +Maximum number of concurrent client connections to allow over all sockets +combined. + +Defaults to @samp{1024}. + +@end deftypevr + +@deftypevr {@code{virtlog-configuration} parameter} integer max-size +Maximum file size before rolling over. + +Defaults to @samp{2MB} + +@end deftypevr + +@deftypevr {@code{virtlog-configuration} parameter} integer max-backups +Maximum number of backup files to keep. + +Defaults to @samp{3} + +@end deftypevr + +@subsubheading Transparent Emulation with QEMU + +@cindex emulation +@cindex @code{binfmt_misc} +@code{qemu-binfmt-service-type} provides support for transparent emulation +of program binaries built for different architectures---e.g., it allows you +to transparently execute an ARMv7 program on an x86_64 machine. It achieves +this by combining the @uref{https://www.qemu.org, QEMU} emulator and the +@code{binfmt_misc} feature of the kernel Linux. + +@defvr {Scheme Variable} qemu-binfmt-service-type +This is the type of the QEMU/binfmt service for transparent emulation. Its +value must be a @code{qemu-binfmt-configuration} object, which specifies the +QEMU package to use as well as the architecture we want to emulated: + +@example +(service qemu-binfmt-service-type + (qemu-binfmt-configuration + (platforms (lookup-qemu-platforms "arm" "aarch64" "mips64el")))) +@end example + +In this example, we enable transparent emulation for the ARM and aarch64 +platforms. Running @code{herd stop qemu-binfmt} turns it off, and running +@code{herd start qemu-binfmt} turns it back on (@pxref{Invoking herd, the +@command{herd} command,, shepherd, The GNU Shepherd Manual}). +@end defvr + +@deftp {Data Type} qemu-binfmt-configuration +This is the configuration for the @code{qemu-binfmt} service. + +@table @asis +@item @code{platforms} (default: @code{'()}) +The list of emulated QEMU platforms. Each item must be a @dfn{platform +object} as returned by @code{lookup-qemu-platforms} (see below). + +@item @code{guix-support?} (default: @code{#f}) +When it is true, QEMU and all its dependencies are added to the build +environment of @command{guix-daemon} (@pxref{Invoking guix-daemon, +@code{--chroot-directory} option}). This allows the @code{binfmt_misc} +handlers to be used within the build environment, which in turn means that +you can transparently build programs for another architecture. + +For example, let's suppose you're on an x86_64 machine and you have this +service: + +@example +(service qemu-binfmt-service-type + (qemu-binfmt-configuration + (platforms (lookup-qemu-platforms "arm")) + (guix-support? #t))) +@end example + +You can run: + +@example +guix build -s armhf-linux inkscape +@end example + +@noindent +and it will build Inkscape for ARMv7 @emph{as if it were a native build}, +transparently using QEMU to emulate the ARMv7 CPU. Pretty handy if you'd +like to test a package build for an architecture you don't have access to! + +@item @code{qemu} (default: @code{qemu}) +The QEMU package to use. +@end table +@end deftp + +@deffn {Scheme Procedure} lookup-qemu-platforms @var{platforms}@dots{} +Return the list of QEMU platform objects corresponding to +@var{platforms}@dots{}. @var{platforms} must be a list of strings +corresponding to platform names, such as @code{"arm"}, @code{"sparc"}, +@code{"mips64el"}, and so on. +@end deffn + +@deffn {Scheme Procedure} qemu-platform? @var{obj} +Return true if @var{obj} is a platform object. +@end deffn + +@deffn {Scheme Procedure} qemu-platform-name @var{platform} +Return the name of @var{platform}---a string such as @code{"arm"}. +@end deffn + +@node Version Control Services +@subsection Version Control Services + +The @code{(gnu services version-control)} module provides a service to allow +remote access to local Git repositories. There are three options: the +@code{git-daemon-service}, which provides access to repositories via the +@code{git://} unsecured TCP-based protocol, extending the @code{nginx} web +server to proxy some requests to @code{git-http-backend}, or providing a web +interface with @code{cgit-service-type}. + +@deffn {Scheme Procedure} git-daemon-service [#:config (git-daemon-configuration)] + +Return a service that runs @command{git daemon}, a simple TCP server to +expose repositories over the Git protocol for anonymous access. + +The optional @var{config} argument should be a +@code{<git-daemon-configuration>} object, by default it allows read-only +access to exported@footnote{By creating the magic file +"git-daemon-export-ok" in the repository directory.} repositories under +@file{/srv/git}. + +@end deffn + +@deftp {Data Type} git-daemon-configuration +Data type representing the configuration for @code{git-daemon-service}. + +@table @asis +@item @code{package} (default: @var{git}) +Package object of the Git distributed version control system. + +@item @code{export-all?} (default: @var{#f}) +Whether to allow access for all Git repositories, even if they do not have +the @file{git-daemon-export-ok} file. + +@item @code{base-path} (default: @file{/srv/git}) +Whether to remap all the path requests as relative to the given path. If +you run git daemon with @var{(base-path "/srv/git")} on example.com, then if +you later try to pull @code{git://example.com/hello.git}, git daemon will +interpret the path as @code{/srv/git/hello.git}. + +@item @code{user-path} (default: @var{#f}) +Whether to allow @code{~user} notation to be used in requests. When +specified with empty string, requests to @code{git://host/~alice/foo} is +taken as a request to access @code{foo} repository in the home directory of +user @code{alice}. If @var{(user-path "path")} is specified, the same +request is taken as a request to access @code{path/foo} repository in the +home directory of user @code{alice}. + +@item @code{listen} (default: @var{'()}) +Whether to listen on specific IP addresses or hostnames, defaults to all. + +@item @code{port} (default: @var{#f}) +Whether to listen on an alternative port, which defaults to 9418. + +@item @code{whitelist} (default: @var{'()}) +If not empty, only allow access to this list of directories. + +@item @code{extra-options} (default: @var{'()}) +Extra options will be passed to @code{git daemon}, please run @command{man +git-daemon} for more information. + +@end table +@end deftp + +The @code{git://} protocol lacks authentication. When you pull from a +repository fetched via @code{git://}, you don't know that the data you +receive was modified is really coming from the specified host, and you have +your connection is subject to eavesdropping. It's better to use an +authenticated and encrypted transport, such as @code{https}. Although Git +allows you to serve repositories using unsophisticated file-based web +servers, there is a faster protocol implemented by the +@code{git-http-backend} program. This program is the back-end of a proper +Git web service. It is designed to sit behind a FastCGI proxy. @xref{Web +Services}, for more on running the necessary @code{fcgiwrap} daemon. + +Guix has a separate configuration data type for serving Git repositories +over HTTP. + +@deftp {Data Type} git-http-configuration +Data type representing the configuration for @code{git-http-service}. + +@table @asis +@item @code{package} (default: @var{git}) +Package object of the Git distributed version control system. + +@item @code{git-root} (default: @file{/srv/git}) +Directory containing the Git repositories to expose to the world. + +@item @code{export-all?} (default: @var{#f}) +Whether to expose access for all Git repositories in @var{git-root}, even if +they do not have the @file{git-daemon-export-ok} file. + +@item @code{uri-path} (default: @file{/git/}) +Path prefix for Git access. With the default @code{/git/} prefix, this will +map @code{http://@var{server}/git/@var{repo}.git} to +@code{/srv/git/@var{repo}.git}. Requests whose URI paths do not begin with +this prefix are not passed on to this Git instance. + +@item @code{fcgiwrap-socket} (default: @code{127.0.0.1:9000}) +The socket on which the @code{fcgiwrap} daemon is listening. @xref{Web +Services}. +@end table +@end deftp + +There is no @code{git-http-service-type}, currently; instead you can create +an @code{nginx-location-configuration} from a @code{git-http-configuration} +and then add that location to a web server. + +@deffn {Scheme Procedure} git-http-nginx-location-configuration @ + [config=(git-http-configuration)] Compute an +@code{nginx-location-configuration} that corresponds to the given Git http +configuration. An example nginx service definition to serve the default +@file{/srv/git} over HTTPS might be: + +@example +(service nginx-service-type + (nginx-configuration + (server-blocks + (list + (nginx-server-configuration + (listen '("443 ssl")) + (server-name "git.my-host.org") + (ssl-certificate + "/etc/letsencrypt/live/git.my-host.org/fullchain.pem") + (ssl-certificate-key + "/etc/letsencrypt/live/git.my-host.org/privkey.pem") + (locations + (list + (git-http-nginx-location-configuration + (git-http-configuration (uri-path "/")))))))))) +@end example + +This example assumes that you are using Let's Encrypt to get your TLS +certificate. @xref{Certificate Services}. The default @code{certbot} +service will redirect all HTTP traffic on @code{git.my-host.org} to HTTPS. +You will also need to add an @code{fcgiwrap} proxy to your system services. +@xref{Web Services}. +@end deffn + +@subsubheading Cgit Service + +@cindex Cgit service +@cindex Git, web interface +@uref{https://git.zx2c4.com/cgit/, Cgit} is a web frontend for Git +repositories written in C. + +The following example will configure the service with default values. By +default, Cgit can be accessed on port 80 (@code{http://localhost:80}). + +@example +(service cgit-service-type) +@end example + +The @code{file-object} type designates either a file-like object +(@pxref{G-Expressions, file-like objects}) or a string. + +@c %start of fragment + +Available @code{cgit-configuration} fields are: + +@deftypevr {@code{cgit-configuration} parameter} package package +The CGIT package. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} nginx-server-configuration-list nginx +NGINX configuration. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object about-filter +Specifies a command which will be invoked to format the content of about +pages (both top-level and for each repository). + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string agefile +Specifies a path, relative to each repository path, which can be used to +specify the date and time of the youngest commit in the repository. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object auth-filter +Specifies a command that will be invoked for authenticating repository +access. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string branch-sort +Flag which, when set to @samp{age}, enables date ordering in the branch ref +list, and when set @samp{name} enables ordering by branch name. + +Defaults to @samp{"name"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string cache-root +Path used to store the cgit cache entries. + +Defaults to @samp{"/var/cache/cgit"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-static-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of repository pages accessed with a fixed SHA1. + +Defaults to @samp{-1}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-dynamic-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of repository pages accessed without a fixed SHA1. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-repo-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of the repository summary page. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-root-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of the repository index page. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-scanrc-ttl +Number which specifies the time-to-live, in minutes, for the result of +scanning a path for Git repositories. + +Defaults to @samp{15}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-about-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of the repository about page. + +Defaults to @samp{15}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-snapshot-ttl +Number which specifies the time-to-live, in minutes, for the cached version +of snapshots. + +Defaults to @samp{5}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer cache-size +The maximum number of entries in the cgit cache. When set to @samp{0}, +caching is disabled. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean case-sensitive-sort? +Sort items in the repo list case sensitively. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} list clone-prefix +List of common prefixes which, when combined with a repository URL, +generates valid clone URLs for the repository. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} list clone-url +List of @code{clone-url} templates. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object commit-filter +Command which will be invoked to format commit messages. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string commit-sort +Flag which, when set to @samp{date}, enables strict date ordering in the +commit log, and when set to @samp{topo} enables strict topological ordering. + +Defaults to @samp{"git log"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object css +URL which specifies the css document to include in all cgit pages. + +Defaults to @samp{"/share/cgit/cgit.css"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object email-filter +Specifies a command which will be invoked to format names and email address +of committers, authors, and taggers, as represented in various places +throughout the cgit interface. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean embedded? +Flag which, when set to @samp{#t}, will make cgit generate a HTML fragment +suitable for embedding in other HTML pages. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-commit-graph? +Flag which, when set to @samp{#t}, will make cgit print an ASCII-art commit +history graph to the left of the commit messages in the repository log page. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-filter-overrides? +Flag which, when set to @samp{#t}, allows all filter settings to be +overridden in repository-specific cgitrc files. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-follow-links? +Flag which, when set to @samp{#t}, allows users to follow a file in the log +view. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-http-clone? +If set to @samp{#t}, cgit will act as an dumb HTTP endpoint for Git clones. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-index-links? +Flag which, when set to @samp{#t}, will make cgit generate extra links +"summary", "commit", "tree" for each repo in the repository index. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-index-owner? +Flag which, when set to @samp{#t}, will make cgit display the owner of each +repo in the repository index. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-log-filecount? +Flag which, when set to @samp{#t}, will make cgit print the number of +modified files for each commit on the repository log page. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-log-linecount? +Flag which, when set to @samp{#t}, will make cgit print the number of added +and removed lines for each commit on the repository log page. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-remote-branches? +Flag which, when set to @code{#t}, will make cgit display remote branches in +the summary and refs views. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-subject-links? +Flag which, when set to @code{1}, will make cgit use the subject of the +parent commit as link text when generating links to parent commits in commit +view. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-html-serving? +Flag which, when set to @samp{#t}, will make cgit use the subject of the +parent commit as link text when generating links to parent commits in commit +view. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-tree-linenumbers? +Flag which, when set to @samp{#t}, will make cgit generate linenumber links +for plaintext blobs printed in the tree view. + +Defaults to @samp{#t}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean enable-git-config? +Flag which, when set to @samp{#f}, will allow cgit to use Git config to set +any repo specific settings. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object favicon +URL used as link to a shortcut icon for cgit. + +Defaults to @samp{"/favicon.ico"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string footer +The content of the file specified with this option will be included verbatim +at the bottom of all pages (i.e.@: it replaces the standard "generated +by..."@: message). + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string head-include +The content of the file specified with this option will be included verbatim +in the HTML HEAD section on all pages. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string header +The content of the file specified with this option will be included verbatim +at the top of all pages. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object include +Name of a configfile to include before the rest of the current config- file +is parsed. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string index-header +The content of the file specified with this option will be included verbatim +above the repository index. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string index-info +The content of the file specified with this option will be included verbatim +below the heading on the repository index page. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean local-time? +Flag which, if set to @samp{#t}, makes cgit print commit and tag times in +the servers timezone. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object logo +URL which specifies the source of an image which will be used as a logo on +all cgit pages. + +Defaults to @samp{"/share/cgit/cgit.png"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string logo-link +URL loaded when clicking on the cgit logo image. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object owner-filter +Command which will be invoked to format the Owner column of the main page. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-atom-items +Number of items to display in atom feeds view. + +Defaults to @samp{10}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-commit-count +Number of entries to list per page in "log" view. + +Defaults to @samp{50}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-message-length +Number of commit message characters to display in "log" view. + +Defaults to @samp{80}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-repo-count +Specifies the number of entries to list per page on the repository index +page. + +Defaults to @samp{50}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-repodesc-length +Specifies the maximum number of repo description characters to display on +the repository index page. + +Defaults to @samp{80}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer max-blob-size +Specifies the maximum size of a blob to display HTML for in KBytes. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string max-stats +Maximum statistics period. Valid values are @samp{week},@samp{month}, +@samp{quarter} and @samp{year}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} mimetype-alist mimetype +Mimetype for the specified filename extension. + +Defaults to @samp{((gif "image/gif") (html "text/html") (jpg "image/jpeg") +(jpeg "image/jpeg") (pdf "application/pdf") (png "image/png") (svg +"image/svg+xml"))}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object mimetype-file +Specifies the file to use for automatic mimetype lookup. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string module-link +Text which will be used as the formatstring for a hyperlink when a submodule +is printed in a directory listing. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean nocache? +If set to the value @samp{#t} caching will be disabled. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean noplainemail? +If set to @samp{#t} showing full author email addresses will be disabled. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean noheader? +Flag which, when set to @samp{#t}, will make cgit omit the standard header +on all pages. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} project-list project-list +A list of subdirectories inside of @code{repository-directory}, relative to +it, that should loaded as Git repositories. An empty list means that all +subdirectories will be loaded. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object readme +Text which will be used as default value for @code{cgit-repo-readme}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean remove-suffix? +If set to @code{#t} and @code{repository-directory} is enabled, if any +repositories are found with a suffix of @code{.git}, this suffix will be +removed for the URL and name. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer renamelimit +Maximum number of files to consider when detecting renames. + +Defaults to @samp{-1}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string repository-sort +The way in which repositories in each section are sorted. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} robots-list robots +Text used as content for the @code{robots} meta-tag. + +Defaults to @samp{("noindex" "nofollow")}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string root-desc +Text printed below the heading on the repository index page. + +Defaults to @samp{"a fast webinterface for the git dscm"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string root-readme +The content of the file specified with this option will be included verbatim +below thef "about" link on the repository index page. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string root-title +Text printed as heading on the repository index page. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean scan-hidden-path +If set to @samp{#t} and repository-directory is enabled, +repository-directory will recurse into directories whose name starts with a +period. Otherwise, repository-directory will stay away from such +directories, considered as "hidden". Note that this does not apply to the +".git" directory in non-bare repos. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} list snapshots +Text which specifies the default set of snapshot formats that cgit generates +links for. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} repository-directory repository-directory +Name of the directory to scan for repositories (represents +@code{scan-path}). + +Defaults to @samp{"/srv/git"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string section +The name of the current repository section - all repositories defined after +this option will inherit the current section name. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string section-sort +Flag which, when set to @samp{1}, will sort the sections on the repository +listing by name. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer section-from-path +A number which, if defined prior to repository-directory, specifies how many +path elements from each repo path to use as a default section name. + +Defaults to @samp{0}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} boolean side-by-side-diffs? +If set to @samp{#t} shows side-by-side diffs instead of unidiffs per +default. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} file-object source-filter +Specifies a command which will be invoked to format plaintext blobs in the +tree view. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer summary-branches +Specifies the number of branches to display in the repository "summary" +view. + +Defaults to @samp{10}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer summary-log +Specifies the number of log entries to display in the repository "summary" +view. + +Defaults to @samp{10}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} integer summary-tags +Specifies the number of tags to display in the repository "summary" view. + +Defaults to @samp{10}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string strict-export +Filename which, if specified, needs to be present within the repository for +cgit to allow access to that repository. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} string virtual-root +URL which, if specified, will be used as root for all cgit links. + +Defaults to @samp{"/"}. + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} repository-cgit-configuration-list repositories +A list of @dfn{cgit-repo} records to use with config. + +Defaults to @samp{()}. + +Available @code{repository-cgit-configuration} fields are: + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-list snapshots +A mask of snapshot formats for this repo that cgit generates links for, +restricted by the global @code{snapshots} setting. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object source-filter +Override the default @code{source-filter}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string url +The relative URL used to access the repository. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object about-filter +Override the default @code{about-filter}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string branch-sort +Flag which, when set to @samp{age}, enables date ordering in the branch ref +list, and when set to @samp{name} enables ordering by branch name. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-list clone-url +A list of URLs which can be used to clone repo. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object commit-filter +Override the default @code{commit-filter}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string commit-sort +Flag which, when set to @samp{date}, enables strict date ordering in the +commit log, and when set to @samp{topo} enables strict topological ordering. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string defbranch +The name of the default branch for this repository. If no such branch +exists in the repository, the first branch name (when sorted) is used as +default instead. By default branch pointed to by HEAD, or "master" if there +is no suitable HEAD. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string desc +The value to show as repository description. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string homepage +The value to show as repository homepage. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object email-filter +Override the default @code{email-filter}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-commit-graph? +A flag which can be used to disable the global setting +@code{enable-commit-graph?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-log-filecount? +A flag which can be used to disable the global setting +@code{enable-log-filecount?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-log-linecount? +A flag which can be used to disable the global setting +@code{enable-log-linecount?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-remote-branches? +Flag which, when set to @code{#t}, will make cgit display remote branches in +the summary and refs views. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-subject-links? +A flag which can be used to override the global setting +@code{enable-subject-links?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} maybe-repo-boolean enable-html-serving? +A flag which can be used to override the global setting +@code{enable-html-serving?}. + +Defaults to @samp{disabled}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-boolean hide? +Flag which, when set to @code{#t}, hides the repository from the repository +index. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-boolean ignore? +Flag which, when set to @samp{#t}, ignores the repository. + +Defaults to @samp{#f}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object logo +URL which specifies the source of an image which will be used as a logo on +this repo’s pages. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string logo-link +URL loaded when clicking on the cgit logo image. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-file-object owner-filter +Override the default @code{owner-filter}. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string module-link +Text which will be used as the formatstring for a hyperlink when a submodule +is printed in a directory listing. The arguments for the formatstring are +the path and SHA1 of the submodule commit. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} module-link-path module-link-path +Text which will be used as the formatstring for a hyperlink when a submodule +with the specified subdirectory path is printed in a directory listing. + +Defaults to @samp{()}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string max-stats +Override the default maximum statistics period. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string name +The value to show as repository name. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string owner +A value used to identify the owner of the repository. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string path +An absolute path to the repository directory. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string readme +A path (relative to repo) which specifies a file to include verbatim as the +"About" page for this repo. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-string section +The name of the current repository section - all repositories defined after +this option will inherit the current section name. + +Defaults to @samp{""}. + +@end deftypevr + +@deftypevr {@code{repository-cgit-configuration} parameter} repo-list extra-options +Extra options will be appended to cgitrc file. + +Defaults to @samp{()}. + +@end deftypevr + +@end deftypevr + +@deftypevr {@code{cgit-configuration} parameter} list extra-options +Extra options will be appended to cgitrc file. + +Defaults to @samp{()}. + +@end deftypevr + + +@c %end of fragment + +However, it could be that you just want to get a @code{cgitrc} up and +running. In that case, you can pass an @code{opaque-cgit-configuration} as +a record to @code{cgit-service-type}. As its name indicates, an opaque +configuration does not have easy reflective capabilities. + +Available @code{opaque-cgit-configuration} fields are: + +@deftypevr {@code{opaque-cgit-configuration} parameter} package cgit +The cgit package. +@end deftypevr + +@deftypevr {@code{opaque-cgit-configuration} parameter} string string +The contents of the @code{cgitrc}, as a string. +@end deftypevr + +For example, if your @code{cgitrc} is just the empty string, you could +instantiate a cgit service like this: + +@example +(service cgit-service-type + (opaque-cgit-configuration + (cgitrc ""))) +@end example + +@subsubheading Gitolite Service + +@cindex Gitolite service +@cindex Git, hosting +@uref{http://gitolite.com/gitolite/, Gitolite} is a tool for hosting Git +repositories on a central server. + +Gitolite can handle multiple repositories and users, and supports flexible +configuration of the permissions for the users on the repositories. + +The following example will configure Gitolite using the default @code{git} +user, and the provided SSH public key. + +@example +(service gitolite-service-type + (gitolite-configuration + (admin-pubkey (plain-file + "yourname.pub" + "ssh-rsa AAAA... guix@@example.com")))) +@end example + +Gitolite is configured through a special admin repository which you can +clone, for example, if you setup Gitolite on @code{example.com}, you would +run the following command to clone the admin repository. + +@example +git clone git@@example.com:gitolite-admin +@end example + +When the Gitolite service is activated, the provided @code{admin-pubkey} +will be inserted in to the @file{keydir} directory in the gitolite-admin +repository. If this results in a change in the repository, it will be +committed using the message ``gitolite setup by GNU Guix''. + +@deftp {Data Type} gitolite-configuration +Data type representing the configuration for @code{gitolite-service-type}. + +@table @asis +@item @code{package} (default: @var{gitolite}) +Gitolite package to use. + +@item @code{user} (default: @var{git}) +User to use for Gitolite. This will be user that you use when accessing +Gitolite over SSH. + +@item @code{group} (default: @var{git}) +Group to use for Gitolite. + +@item @code{home-directory} (default: @var{"/var/lib/gitolite"}) +Directory in which to store the Gitolite configuration and repositories. + +@item @code{rc-file} (default: @var{(gitolite-rc-file)}) +A ``file-like'' object (@pxref{G-Expressions, file-like objects}), +representing the configuration for Gitolite. + +@item @code{admin-pubkey} (default: @var{#f}) +A ``file-like'' object (@pxref{G-Expressions, file-like objects}) used to +setup Gitolite. This will be inserted in to the @file{keydir} directory +within the gitolite-admin repository. + +To specify the SSH key as a string, use the @code{plain-file} function. + +@example +(plain-file "yourname.pub" "ssh-rsa AAAA... guix@@example.com") +@end example + +@end table +@end deftp + +@deftp {Data Type} gitolite-rc-file +Data type representing the Gitolite RC file. + +@table @asis +@item @code{umask} (default: @code{#o0077}) +This controls the permissions Gitolite sets on the repositories and their +contents. + +A value like @code{#o0027} will give read access to the group used by +Gitolite (by default: @code{git}). This is necessary when using Gitolite +with software like cgit or gitweb. + +@item @code{git-config-keys} (default: @code{""}) +Gitolite allows you to set git config values using the "config" +keyword. This setting allows control over the config keys to accept. + +@item @code{roles} (default: @code{'(("READERS" . 1) ("WRITERS" . ))}) +Set the role names allowed to be used by users running the perms command. + +@item @code{enable} (default: @code{'("help" "desc" "info" "perms" "writable" "ssh-authkeys" "git-config" "daemon" "gitweb")}) +This setting controls the commands and features to enable within Gitolite. + +@end table +@end deftp + + +@node Game Services +@subsection Game Services + +@subsubheading The Battle for Wesnoth Service +@cindex wesnothd +@uref{https://wesnoth.org, The Battle for Wesnoth} is a fantasy, turn based +tactical strategy game, with several single player campaigns, and +multiplayer games (both networked and local). + +@defvar {Scheme Variable} wesnothd-service-type +Service type for the wesnothd service. Its value must be a +@code{wesnothd-configuration} object. To run wesnothd in the default +configuration, instantiate it as: + +@example +(service wesnothd-service-type) +@end example +@end defvar + +@deftp {Data Type} wesnothd-configuration +Data type representing the configuration of @command{wesnothd}. + +@table @asis +@item @code{package} (default: @code{wesnoth-server}) +The wesnoth server package to use. + +@item @code{port} (default: @code{15000}) +The port to bind the server to. +@end table +@end deftp + +@node Miscellaneous Services +@subsection Miscellaneous Services + +@cindex fingerprint +@subsubheading Fingerprint Service + +The @code{(gnu services authentication)} module provides a DBus service to +read and identify fingerprints via a fingerprint sensor. + +@defvr {Scheme Variable} fprintd-service-type +The service type for @command{fprintd}, which provides the fingerprint +reading capability. + +@example +(service fprintd-service-type) +@end example +@end defvr + +@cindex sysctl +@subsubheading System Control Service + +The @code{(gnu services sysctl)} provides a service to configure kernel +parameters at boot. + +@defvr {Scheme Variable} sysctl-service-type +The service type for @command{sysctl}, which modifies kernel parameters +under @file{/proc/sys/}. To enable IPv4 forwarding, it can be instantiated +as: + +@example +(service sysctl-service-type + (sysctl-configuration + (settings '(("net.ipv4.ip_forward" . "1"))))) +@end example +@end defvr + +@deftp {Data Type} sysctl-configuration +The data type representing the configuration of @command{sysctl}. + +@table @asis +@item @code{sysctl} (default: @code{(file-append procps "/sbin/sysctl"}) +The @command{sysctl} executable to use. + +@item @code{settings} (default: @code{'()}) +An association list specifies kernel parameters and their values. +@end table +@end deftp + +@cindex pcscd +@subsubheading PC/SC Smart Card Daemon Service + +The @code{(gnu services security-token)} module provides the following +service to run @command{pcscd}, the PC/SC Smart Card Daemon. +@command{pcscd} is the daemon program for pcsc-lite and the MuscleCard +framework. It is a resource manager that coordinates communications with +smart card readers, smart cards and cryptographic tokens that are connected +to the system. + +@defvr {Scheme Variable} pcscd-service-type +Service type for the @command{pcscd} service. Its value must be a +@code{pcscd-configuration} object. To run pcscd in the default +configuration, instantiate it as: + +@example +(service pcscd-service-type) +@end example +@end defvr + +@deftp {Data Type} pcscd-configuration +The data type representing the configuration of @command{pcscd}. + +@table @asis +@item @code{pcsc-lite} (default: @code{pcsc-lite}) +The pcsc-lite package that provides pcscd. +@item @code{usb-drivers} (default: @code{(list ccid)}) +List of packages that provide USB drivers to pcscd. Drivers are expected to +be under @file{pcsc/drivers} in the store directory of the package. +@end table +@end deftp + +@cindex lirc +@subsubheading Lirc Service + +The @code{(gnu services lirc)} module provides the following service. + +@deffn {Scheme Procedure} lirc-service [#:lirc lirc] @ + [#:device #f] [#:driver #f] [#:config-file #f] @ [#:extra-options '()] +Return a service that runs @url{http://www.lirc.org,LIRC}, a daemon that +decodes infrared signals from remote controls. + +Optionally, @var{device}, @var{driver} and @var{config-file} (configuration +file name) may be specified. See @command{lircd} manual for details. + +Finally, @var{extra-options} is a list of additional command-line options +passed to @command{lircd}. +@end deffn + +@cindex spice +@subsubheading Spice Service + +The @code{(gnu services spice)} module provides the following service. + +@deffn {Scheme Procedure} spice-vdagent-service [#:spice-vdagent] +Returns a service that runs @url{http://www.spice-space.org,VDAGENT}, a +daemon that enables sharing the clipboard with a vm and setting the guest +display resolution when the graphical console window resizes. +@end deffn + +@cindex inputattach +@subsubheading inputattach Service + +@cindex tablet input, for Xorg +@cindex touchscreen input, for Xorg +The @uref{https://linuxwacom.github.io/, inputattach} service allows you to +use input devices such as Wacom tablets, touchscreens, or joysticks with the +Xorg display server. + +@deffn {Scheme Variable} inputattach-service-type +Type of a service that runs @command{inputattach} on a device and dispatches +events from it. +@end deffn + +@deftp {Data Type} inputattach-configuration +@table @asis +@item @code{device-type} (default: @code{"wacom"}) +The type of device to connect to. Run @command{inputattach --help}, from +the @code{inputattach} package, to see the list of supported device types. + +@item @code{device} (default: @code{"/dev/ttyS0"}) +The device file to connect to the device. + +@item @code{log-file} (default: @code{#f}) +If true, this must be the name of a file to log messages to. +@end table +@end deftp + +@subsection Dictionary Services +@cindex dictionary +The @code{(gnu services dict)} module provides the following service: + +@deffn {Scheme Procedure} dicod-service [#:config (dicod-configuration)] +Return a service that runs the @command{dicod} daemon, an implementation of +DICT server (@pxref{Dicod,,, dico, GNU Dico Manual}). + +The optional @var{config} argument specifies the configuration for +@command{dicod}, which should be a @code{<dicod-configuration>} object, by +default it serves the GNU Collaborative International Dictonary of English. + +You can add @command{open localhost} to your @file{~/.dico} file to make +@code{localhost} the default server for @command{dico} client +(@pxref{Initialization File,,, dico, GNU Dico Manual}). +@end deffn + +@deftp {Data Type} dicod-configuration +Data type representing the configuration of dicod. + +@table @asis +@item @code{dico} (default: @var{dico}) +Package object of the GNU Dico dictionary server. + +@item @code{interfaces} (default: @var{'("localhost")}) +This is the list of IP addresses and ports and possibly socket file names to +listen to (@pxref{Server Settings, @code{listen} directive,, dico, GNU Dico +Manual}). + +@item @code{handlers} (default: @var{'()}) +List of @code{<dicod-handler>} objects denoting handlers (module instances). + +@item @code{databases} (default: @var{(list %dicod-database:gcide)}) +List of @code{<dicod-database>} objects denoting dictionaries to be served. +@end table +@end deftp + +@deftp {Data Type} dicod-handler +Data type representing a dictionary handler (module instance). + +@table @asis +@item @code{name} +Name of the handler (module instance). + +@item @code{module} (default: @var{#f}) +Name of the dicod module of the handler (instance). If it is @code{#f}, the +module has the same name as the handler. (@pxref{Modules,,, dico, GNU Dico +Manual}). + +@item @code{options} +List of strings or gexps representing the arguments for the module handler +@end table +@end deftp + +@deftp {Data Type} dicod-database +Data type representing a dictionary database. + +@table @asis +@item @code{name} +Name of the database, will be used in DICT commands. + +@item @code{handler} +Name of the dicod handler (module instance) used by this database +(@pxref{Handlers,,, dico, GNU Dico Manual}). + +@item @code{complex?} (default: @var{#f}) +Whether the database configuration complex. The complex configuration will +need a corresponding @code{<dicod-handler>} object, otherwise not. + +@item @code{options} +List of strings or gexps representing the arguments for the database +(@pxref{Databases,,, dico, GNU Dico Manual}). +@end table +@end deftp + +@defvr {Scheme Variable} %dicod-database:gcide +A @code{<dicod-database>} object serving the GNU Collaborative International +Dictionary of English using the @code{gcide} package. +@end defvr + +The following is an example @code{dicod-service} configuration. + +@example +(dicod-service #:config + (dicod-configuration + (handlers (list (dicod-handler + (name "wordnet") + (module "dictorg") + (options + (list #~(string-append "dbdir=" #$wordnet)))))) + (databases (list (dicod-database + (name "wordnet") + (complex? #t) + (handler "wordnet") + (options '("database=wn"))) + %dicod-database:gcide)))) +@end example + +@cindex Docker +@subsubheading Docker Service + +The @code{(gnu services docker)} module provides the following service. + +@defvr {Scheme Variable} docker-service-type + +This is the type of the service that runs +@url{http://www.docker.com,Docker}, a daemon that can execute application +bundles (sometimes referred to as ``containers'') in isolated environments. + +@end defvr + +@deftp {Data Type} docker-configuration +This is the data type representing the configuration of Docker and +Containerd. + +@table @asis + +@item @code{package} (default: @code{docker}) +The Docker package to use. + +@item @code{containerd} (default: @var{containerd}) +The Containerd package to use. + +@end table +@end deftp + +@node Setuid Programs +@section Setuid Programs + +@cindex setuid programs +Some programs need to run with ``root'' privileges, even when they are +launched by unprivileged users. A notorious example is the @command{passwd} +program, which users can run to change their password, and which needs to +access the @file{/etc/passwd} and @file{/etc/shadow} files---something +normally restricted to root, for obvious security reasons. To address that, +these executables are @dfn{setuid-root}, meaning that they always run with +root privileges (@pxref{How Change Persona,,, libc, The GNU C Library +Reference Manual}, for more info about the setuid mechanism.) + +The store itself @emph{cannot} contain setuid programs: that would be a +security issue since any user on the system can write derivations that +populate the store (@pxref{The Store}). Thus, a different mechanism is +used: instead of changing the setuid bit directly on files that are in the +store, we let the system administrator @emph{declare} which programs should +be setuid root. + +The @code{setuid-programs} field of an @code{operating-system} declaration +contains a list of G-expressions denoting the names of programs to be +setuid-root (@pxref{Using the Configuration System}). For instance, the +@command{passwd} program, which is part of the Shadow package, can be +designated by this G-expression (@pxref{G-Expressions}): + +@example +#~(string-append #$shadow "/bin/passwd") +@end example + +A default set of setuid programs is defined by the @code{%setuid-programs} +variable of the @code{(gnu system)} module. + +@defvr {Scheme Variable} %setuid-programs +A list of G-expressions denoting common programs that are setuid-root. + +The list includes commands such as @command{passwd}, @command{ping}, +@command{su}, and @command{sudo}. +@end defvr + +Under the hood, the actual setuid programs are created in the +@file{/run/setuid-programs} directory at system activation time. The files +in this directory refer to the ``real'' binaries, which are in the store. + +@node X.509 Certificates +@section X.509 Certificates + +@cindex HTTPS, certificates +@cindex X.509 certificates +@cindex TLS +Web servers available over HTTPS (that is, HTTP over the transport-layer +security mechanism, TLS) send client programs an @dfn{X.509 certificate} +that the client can then use to @emph{authenticate} the server. To do that, +clients verify that the server's certificate is signed by a so-called +@dfn{certificate authority} (CA). But to verify the CA's signature, clients +must have first acquired the CA's certificate. + +Web browsers such as GNU@tie{}IceCat include their own set of CA +certificates, such that they are able to verify CA signatures +out-of-the-box. + +However, most other programs that can talk HTTPS---@command{wget}, +@command{git}, @command{w3m}, etc.---need to be told where CA certificates +can be found. + +@cindex @code{nss-certs} +In Guix, this is done by adding a package that provides certificates to the +@code{packages} field of the @code{operating-system} declaration +(@pxref{operating-system Reference}). Guix includes one such package, +@code{nss-certs}, which is a set of CA certificates provided as part of +Mozilla's Network Security Services. + +Note that it is @emph{not} part of @var{%base-packages}, so you need to +explicitly add it. The @file{/etc/ssl/certs} directory, which is where most +applications and libraries look for certificates by default, points to the +certificates installed globally. + +Unprivileged users, including users of Guix on a foreign distro, can also +install their own certificate package in their profile. A number of +environment variables need to be defined so that applications and libraries +know where to find them. Namely, the OpenSSL library honors the +@code{SSL_CERT_DIR} and @code{SSL_CERT_FILE} variables. Some applications +add their own environment variables; for instance, the Git version control +system honors the certificate bundle pointed to by the @code{GIT_SSL_CAINFO} +environment variable. Thus, you would typically run something like: + +@example +$ guix package -i nss-certs +$ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs" +$ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt" +$ export GIT_SSL_CAINFO="$SSL_CERT_FILE" +@end example + +As another example, R requires the @code{CURL_CA_BUNDLE} environment +variable to point to a certificate bundle, so you would have to run +something like this: + +@example +$ guix package -i nss-certs +$ export CURL_CA_BUNDLE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt" +@end example + +For other applications you may want to look up the required environment +variable in the relevant documentation. + + +@node Name Service Switch +@section Name Service Switch + +@cindex name service switch +@cindex NSS +The @code{(gnu system nss)} module provides bindings to the configuration +file of the libc @dfn{name service switch} or @dfn{NSS} (@pxref{NSS +Configuration File,,, libc, The GNU C Library Reference Manual}). In a +nutshell, the NSS is a mechanism that allows libc to be extended with new +``name'' lookup methods for system databases, which includes host names, +service names, user accounts, and more (@pxref{Name Service Switch, System +Databases and Name Service Switch,, libc, The GNU C Library Reference +Manual}). + +The NSS configuration specifies, for each system database, which lookup +method is to be used, and how the various methods are chained together---for +instance, under which circumstances NSS should try the next method in the +list. The NSS configuration is given in the @code{name-service-switch} +field of @code{operating-system} declarations (@pxref{operating-system +Reference, @code{name-service-switch}}). + +@cindex nss-mdns +@cindex .local, host name lookup +As an example, the declaration below configures the NSS to use the +@uref{http://0pointer.de/lennart/projects/nss-mdns/, @code{nss-mdns} +back-end}, which supports host name lookups over multicast DNS (mDNS) for +host names ending in @code{.local}: + +@example +(name-service-switch + (hosts (list %files ;first, check /etc/hosts + + ;; If the above did not succeed, try + ;; with 'mdns_minimal'. + (name-service + (name "mdns_minimal") + + ;; 'mdns_minimal' is authoritative for + ;; '.local'. When it returns "not found", + ;; no need to try the next methods. + (reaction (lookup-specification + (not-found => return)))) + + ;; Then fall back to DNS. + (name-service + (name "dns")) + + ;; Finally, try with the "full" 'mdns'. + (name-service + (name "mdns"))))) +@end example + +Do not worry: the @code{%mdns-host-lookup-nss} variable (see below) +contains this configuration, so you will not have to type it if all you want +is to have @code{.local} host lookup working. + +Note that, in this case, in addition to setting the +@code{name-service-switch} of the @code{operating-system} declaration, you +also need to use @code{avahi-service-type} (@pxref{Networking Services, +@code{avahi-service-type}}), or @var{%desktop-services}, which includes it +(@pxref{Desktop Services}). Doing this makes @code{nss-mdns} accessible to +the name service cache daemon (@pxref{Base Services, @code{nscd-service}}). + +For convenience, the following variables provide typical NSS configurations. + +@defvr {Scheme Variable} %default-nss +This is the default name service switch configuration, a +@code{name-service-switch} object. +@end defvr + +@defvr {Scheme Variable} %mdns-host-lookup-nss +This is the name service switch configuration with support for host name +lookup over multicast DNS (mDNS) for host names ending in @code{.local}. +@end defvr + +The reference for name service switch configuration is given below. It is a +direct mapping of the configuration file format of the C library , so please +refer to the C library manual for more information (@pxref{NSS Configuration +File,,, libc, The GNU C Library Reference Manual}). Compared to the +configuration file format of libc NSS, it has the advantage not only of +adding this warm parenthetic feel that we like, but also static checks: you +will know about syntax errors and typos as soon as you run @command{guix +system}. + +@deftp {Data Type} name-service-switch + +This is the data type representation the configuration of libc's name +service switch (NSS). Each field below represents one of the supported +system databases. + +@table @code +@item aliases +@itemx ethers +@itemx group +@itemx gshadow +@itemx hosts +@itemx initgroups +@itemx netgroup +@itemx networks +@itemx password +@itemx public-key +@itemx rpc +@itemx services +@itemx shadow +The system databases handled by the NSS. Each of these fields must be a +list of @code{<name-service>} objects (see below). +@end table +@end deftp + +@deftp {Data Type} name-service + +This is the data type representing an actual name service and the associated +lookup action. + +@table @code +@item name +A string denoting the name service (@pxref{Services in the NSS +configuration,,, libc, The GNU C Library Reference Manual}). + +Note that name services listed here must be visible to nscd. This is +achieved by passing the @code{#:name-services} argument to +@code{nscd-service} the list of packages providing the needed name services +(@pxref{Base Services, @code{nscd-service}}). + +@item reaction +An action specified using the @code{lookup-specification} macro +(@pxref{Actions in the NSS configuration,,, libc, The GNU C Library +Reference Manual}). For example: + +@example +(lookup-specification (unavailable => continue) + (success => return)) +@end example +@end table +@end deftp + +@node Initial RAM Disk +@section Initial RAM Disk + +@cindex initrd +@cindex initial RAM disk +For bootstrapping purposes, the Linux-Libre kernel is passed an @dfn{initial +RAM disk}, or @dfn{initrd}. An initrd contains a temporary root file system +as well as an initialization script. The latter is responsible for mounting +the real root file system, and for loading any kernel modules that may be +needed to achieve that. + +The @code{initrd-modules} field of an @code{operating-system} declaration +allows you to specify Linux-libre kernel modules that must be available in +the initrd. In particular, this is where you would list modules needed to +actually drive the hard disk where your root partition is---although the +default value of @code{initrd-modules} should cover most use cases. For +example, assuming you need the @code{megaraid_sas} module in addition to the +default modules to be able to access your root file system, you would write: + +@example +(operating-system + ;; @dots{} + (initrd-modules (cons "megaraid_sas" %base-initrd-modules))) +@end example + +@defvr {Scheme Variable} %base-initrd-modules +This is the list of kernel modules included in the initrd by default. +@end defvr + +Furthermore, if you need lower-level customization, the @code{initrd} field +of an @code{operating-system} declaration allows you to specify which initrd +you would like to use. The @code{(gnu system linux-initrd)} module provides +three ways to build an initrd: the high-level @code{base-initrd} procedure +and the low-level @code{raw-initrd} and @code{expression->initrd} +procedures. + +The @code{base-initrd} procedure is intended to cover most common uses. For +example, if you want to add a bunch of kernel modules to be loaded at boot +time, you can define the @code{initrd} field of the operating system +declaration like this: + +@example +(initrd (lambda (file-systems . rest) + ;; Create a standard initrd but set up networking + ;; with the parameters QEMU expects by default. + (apply base-initrd file-systems + #:qemu-networking? #t + rest))) +@end example + +The @code{base-initrd} procedure also handles common use cases that involves +using the system as a QEMU guest, or as a ``live'' system with volatile root +file system. + +The @code{base-initrd} procedure is built from @code{raw-initrd} procedure. +Unlike @code{base-initrd}, @code{raw-initrd} doesn't do anything high-level, +such as trying to guess which kernel modules and packages should be included +to the initrd. An example use of @code{raw-initrd} is when a user has a +custom Linux kernel configuration and default kernel modules included by +@code{base-initrd} are not available. + +The initial RAM disk produced by @code{base-initrd} or @code{raw-initrd} +honors several options passed on the Linux kernel command line (that is, +arguments passed @i{via} the @code{linux} command of GRUB, or the +@code{-append} option of QEMU), notably: + +@table @code +@item --load=@var{boot} +Tell the initial RAM disk to load @var{boot}, a file containing a Scheme +program, once it has mounted the root file system. + +Guix uses this option to yield control to a boot program that runs the +service activation programs and then spawns the GNU@tie{}Shepherd, the +initialization system. + +@item --root=@var{root} +Mount @var{root} as the root file system. @var{root} can be a device name +like @code{/dev/sda1}, a file system label, or a file system UUID. + +@item --system=@var{system} +Have @file{/run/booted-system} and @file{/run/current-system} point to +@var{system}. + +@item modprobe.blacklist=@var{modules}@dots{} +@cindex module, black-listing +@cindex black list, of kernel modules +Instruct the initial RAM disk as well as the @command{modprobe} command +(from the kmod package) to refuse to load @var{modules}. @var{modules} must +be a comma-separated list of module names---e.g., @code{usbkbd,9pnet}. + +@item --repl +Start a read-eval-print loop (REPL) from the initial RAM disk before it +tries to load kernel modules and to mount the root file system. Our +marketing team calls it @dfn{boot-to-Guile}. The Schemer in you will love +it. @xref{Using Guile Interactively,,, guile, GNU Guile Reference Manual}, +for more information on Guile's REPL. + +@end table + +Now that you know all the features that initial RAM disks produced by +@code{base-initrd} and @code{raw-initrd} provide, here is how to use it and +customize it further. + +@cindex initrd +@cindex initial RAM disk +@deffn {Scheme Procedure} raw-initrd @var{file-systems} @ + [#:linux-modules '()] [#:mapped-devices '()] @ [#:keyboard-layout #f] @ +[#:helper-packages '()] [#:qemu-networking? #f] [#:volatile-root? #f] Return +a derivation that builds a raw initrd. @var{file-systems} is a list of file +systems to be mounted by the initrd, possibly in addition to the root file +system specified on the kernel command line via @code{--root}. +@var{linux-modules} is a list of kernel modules to be loaded at boot time. +@var{mapped-devices} is a list of device mappings to realize before +@var{file-systems} are mounted (@pxref{Mapped Devices}). +@var{helper-packages} is a list of packages to be copied in the initrd. It +may include @code{e2fsck/static} or other packages needed by the initrd to +check the root file system. + +When true, @var{keyboard-layout} is a @code{<keyboard-layout>} record +denoting the desired console keyboard layout. This is done before +@var{mapped-devices} are set up and before @var{file-systems} are mounted +such that, should the user need to enter a passphrase or use the REPL, this +happens using the intended keyboard layout. + +When @var{qemu-networking?} is true, set up networking with the standard +QEMU parameters. When @var{virtio?} is true, load additional modules so +that the initrd can be used as a QEMU guest with para-virtualized I/O +drivers. + +When @var{volatile-root?} is true, the root file system is writable but any +changes to it are lost. +@end deffn + +@deffn {Scheme Procedure} base-initrd @var{file-systems} @ + [#:mapped-devices '()] [#:keyboard-layout #f] @ [#:qemu-networking? #f] +[#:volatile-root? #f] @ [#:linux-modules '()] Return as a file-like object a +generic initrd, with kernel modules taken from @var{linux}. +@var{file-systems} is a list of file-systems to be mounted by the initrd, +possibly in addition to the root file system specified on the kernel command +line via @code{--root}. @var{mapped-devices} is a list of device mappings +to realize before @var{file-systems} are mounted. + +When true, @var{keyboard-layout} is a @code{<keyboard-layout>} record +denoting the desired console keyboard layout. This is done before +@var{mapped-devices} are set up and before @var{file-systems} are mounted +such that, should the user need to enter a passphrase or use the REPL, this +happens using the intended keyboard layout. + +@var{qemu-networking?} and @var{volatile-root?} behaves as in +@code{raw-initrd}. + +The initrd is automatically populated with all the kernel modules necessary +for @var{file-systems} and for the given options. Additional kernel modules +can be listed in @var{linux-modules}. They will be added to the initrd, and +loaded at boot time in the order in which they appear. +@end deffn + +Needless to say, the initrds we produce and use embed a statically-linked +Guile, and the initialization program is a Guile program. That gives a lot +of flexibility. The @code{expression->initrd} procedure builds such an +initrd, given the program to run in that initrd. + +@deffn {Scheme Procedure} expression->initrd @var{exp} @ + [#:guile %guile-static-stripped] [#:name "guile-initrd"] Return as a +file-like object a Linux initrd (a gzipped cpio archive) containing +@var{guile} and that evaluates @var{exp}, a G-expression, upon booting. All +the derivations referenced by @var{exp} are automatically copied to the +initrd. +@end deffn + +@node Bootloader Configuration +@section Bootloader Configuration + +@cindex bootloader +@cindex boot loader + +The operating system supports multiple bootloaders. The bootloader is +configured using @code{bootloader-configuration} declaration. All the +fields of this structure are bootloader agnostic except for one field, +@code{bootloader} that indicates the bootloader to be configured and +installed. + +Some of the bootloaders do not honor every field of +@code{bootloader-configuration}. For instance, the extlinux bootloader does +not support themes and thus ignores the @code{theme} field. + +@deftp {Data Type} bootloader-configuration +The type of a bootloader configuration declaration. + +@table @asis + +@item @code{bootloader} +@cindex EFI, bootloader +@cindex UEFI, bootloader +@cindex BIOS, bootloader +The bootloader to use, as a @code{bootloader} object. For now +@code{grub-bootloader}, @code{grub-efi-bootloader}, +@code{extlinux-bootloader} and @code{u-boot-bootloader} are supported. + +@vindex grub-efi-bootloader +@code{grub-efi-bootloader} allows to boot on modern systems using the +@dfn{Unified Extensible Firmware Interface} (UEFI). This is what you should +use if the installation image contains a @file{/sys/firmware/efi} directory +when you boot it on your system. + +@vindex grub-bootloader +@code{grub-bootloader} allows you to boot in particular Intel-based machines +in ``legacy'' BIOS mode. + +@cindex ARM, bootloaders +@cindex AArch64, bootloaders +Available bootloaders are described in @code{(gnu bootloader @dots{})} +modules. In particular, @code{(gnu bootloader u-boot)} contains definitions +of bootloaders for a wide range of ARM and AArch64 systems, using the +@uref{http://www.denx.de/wiki/U-Boot/, U-Boot bootloader}. + +@item @code{target} +This is a string denoting the target onto which to install the bootloader. + +The interpretation depends on the bootloader in question. For +@code{grub-bootloader}, for example, it should be a device name understood +by the bootloader @command{installer} command, such as @code{/dev/sda} or +@code{(hd0)} (@pxref{Invoking grub-install,,, grub, GNU GRUB Manual}). For +@code{grub-efi-bootloader}, it should be the mount point of the EFI file +system, usually @file{/boot/efi}. + +@item @code{menu-entries} (default: @code{()}) +A possibly empty list of @code{menu-entry} objects (see below), denoting +entries to appear in the bootloader menu, in addition to the current system +entry and the entry pointing to previous system generations. + +@item @code{default-entry} (default: @code{0}) +The index of the default boot menu entry. Index 0 is for the entry of the +current system. + +@item @code{timeout} (default: @code{5}) +The number of seconds to wait for keyboard input before booting. Set to 0 +to boot immediately, and to -1 to wait indefinitely. + +@cindex keyboard layout, for the bootloader +@item @code{keyboard-layout} (default: @code{#f}) +If this is @code{#f}, the bootloader's menu (if any) uses the default +keyboard layout, usually US@tie{}English (``qwerty''). + +Otherwise, this must be a @code{keyboard-layout} object (@pxref{Keyboard +Layout}). + +@quotation Note +This option is currently ignored by bootloaders other than @code{grub} and +@code{grub-efi}. +@end quotation + +@item @code{theme} (default: @var{#f}) +The bootloader theme object describing the theme to use. If no theme is +provided, some bootloaders might use a default theme, that's true for GRUB. + +@item @code{terminal-outputs} (default: @code{'gfxterm}) +The output terminals used for the bootloader boot menu, as a list of +symbols. GRUB accepts the values: @code{console}, @code{serial}, +@code{serial_@{0-3@}}, @code{gfxterm}, @code{vga_text}, @code{mda_text}, +@code{morse}, and @code{pkmodem}. This field corresponds to the GRUB +variable @code{GRUB_TERMINAL_OUTPUT} (@pxref{Simple configuration,,, +grub,GNU GRUB manual}). + +@item @code{terminal-inputs} (default: @code{'()}) +The input terminals used for the bootloader boot menu, as a list of +symbols. For GRUB, the default is the native platform terminal as +determined at run-time. GRUB accepts the values: @code{console}, +@code{serial}, @code{serial_@{0-3@}}, @code{at_keyboard}, and +@code{usb_keyboard}. This field corresponds to the GRUB variable +@code{GRUB_TERMINAL_INPUT} (@pxref{Simple configuration,,, grub,GNU GRUB +manual}). + +@item @code{serial-unit} (default: @code{#f}) +The serial unit used by the bootloader, as an integer from 0 to 3. For +GRUB, it is chosen at run-time; currently GRUB chooses 0, which corresponds +to COM1 (@pxref{Serial terminal,,, grub,GNU GRUB manual}). + +@item @code{serial-speed} (default: @code{#f}) +The speed of the serial interface, as an integer. For GRUB, the default +value is chosen at run-time; currently GRUB chooses 9600@tie{}bps +(@pxref{Serial terminal,,, grub,GNU GRUB manual}). +@end table + +@end deftp + +@cindex dual boot +@cindex boot menu +Should you want to list additional boot menu entries @i{via} the +@code{menu-entries} field above, you will need to create them with the +@code{menu-entry} form. For example, imagine you want to be able to boot +another distro (hard to imagine!), you can define a menu entry along these +lines: + +@example +(menu-entry + (label "The Other Distro") + (linux "/boot/old/vmlinux-2.6.32") + (linux-arguments '("root=/dev/sda2")) + (initrd "/boot/old/initrd")) +@end example + +Details below. + +@deftp {Data Type} menu-entry +The type of an entry in the bootloader menu. + +@table @asis + +@item @code{label} +The label to show in the menu---e.g., @code{"GNU"}. + +@item @code{linux} +The Linux kernel image to boot, for example: + +@example +(file-append linux-libre "/bzImage") +@end example + +For GRUB, it is also possible to specify a device explicitly in the file +path using GRUB's device naming convention (@pxref{Naming convention,,, +grub, GNU GRUB manual}), for example: + +@example +"(hd0,msdos1)/boot/vmlinuz" +@end example + +If the device is specified explicitly as above, then the @code{device} field +is ignored entirely. + +@item @code{linux-arguments} (default: @code{()}) +The list of extra Linux kernel command-line arguments---e.g., +@code{("console=ttyS0")}. + +@item @code{initrd} +A G-Expression or string denoting the file name of the initial RAM disk to +use (@pxref{G-Expressions}). +@item @code{device} (default: @code{#f}) +The device where the kernel and initrd are to be found---i.e., for GRUB, +@dfn{root} for this menu entry (@pxref{root,,, grub, GNU GRUB manual}). + +This may be a file system label (a string), a file system UUID (a +bytevector, @pxref{File Systems}), or @code{#f}, in which case the +bootloader will search the device containing the file specified by the +@code{linux} field (@pxref{search,,, grub, GNU GRUB manual}). It must +@emph{not} be an OS device name such as @file{/dev/sda1}. + +@end table +@end deftp + +@c FIXME: Write documentation once it's stable. +For now only GRUB has theme support. GRUB themes are created using the +@code{grub-theme} form, which is not documented yet. + +@defvr {Scheme Variable} %default-theme +This is the default GRUB theme used by the operating system if no +@code{theme} field is specified in @code{bootloader-configuration} record. + +It comes with a fancy background image displaying the GNU and Guix logos. +@end defvr + + +@node Invoking guix system +@section Invoking @code{guix system} + +Once you have written an operating system declaration as seen in the +previous section, it can be @dfn{instantiated} using the @command{guix +system} command. The synopsis is: + +@example +guix system @var{options}@dots{} @var{action} @var{file} +@end example + +@var{file} must be the name of a file containing an @code{operating-system} +declaration. @var{action} specifies how the operating system is +instantiated. Currently the following values are supported: + +@table @code +@item search +Display available service type definitions that match the given regular +expressions, sorted by relevance: + +@example +$ guix system search console font +name: console-fonts +location: gnu/services/base.scm:729:2 +extends: shepherd-root +description: Install the given fonts on the specified ttys (fonts are ++ per virtual console on GNU/Linux). The value of this service is a list ++ of tty/font pairs like: ++ ++ '(("tty1" . "LatGrkCyr-8x16")) +relevance: 20 + +name: mingetty +location: gnu/services/base.scm:1048:2 +extends: shepherd-root +description: Provide console login using the `mingetty' program. +relevance: 2 + +name: login +location: gnu/services/base.scm:775:2 +extends: pam +description: Provide a console log-in service as specified by its ++ configuration value, a `login-configuration' object. +relevance: 2 + +@dots{} +@end example + +As for @command{guix package --search}, the result is written in +@code{recutils} format, which makes it easy to filter the output +(@pxref{Top, GNU recutils databases,, recutils, GNU recutils manual}). + +@item reconfigure +Build the operating system described in @var{file}, activate it, and switch +to it@footnote{This action (and the related actions @code{switch-generation} +and @code{roll-back}) are usable only on systems already running Guix +System.}. + +This effects all the configuration specified in @var{file}: user accounts, +system services, global package list, setuid programs, etc. The command +starts system services specified in @var{file} that are not currently +running; if a service is currently running this command will arrange for it +to be upgraded the next time it is stopped (e.g.@: by @code{herd stop X} or +@code{herd restart X}). + +This command creates a new generation whose number is one greater than the +current generation (as reported by @command{guix system list-generations}). +If that generation already exists, it will be overwritten. This behavior +mirrors that of @command{guix package} (@pxref{Invoking guix package}). + +It also adds a bootloader menu entry for the new OS configuration, ---unless +@option{--no-bootloader} is passed. For GRUB, it moves entries for older +configurations to a submenu, allowing you to choose an older system +generation at boot time should you need it. + +@quotation Note +@c The paragraph below refers to the problem discussed at +@c <http://lists.gnu.org/archive/html/guix-devel/2014-08/msg00057.html>. +It is highly recommended to run @command{guix pull} once before you run +@command{guix system reconfigure} for the first time (@pxref{Invoking guix +pull}). Failing to do that you would see an older version of Guix once +@command{reconfigure} has completed. +@end quotation + +@item switch-generation +@cindex generations +Switch to an existing system generation. This action atomically switches +the system profile to the specified system generation. It also rearranges +the system's existing bootloader menu entries. It makes the menu entry for +the specified system generation the default, and it moves the entries for +the other generatiors to a submenu, if supported by the bootloader being +used. The next time the system boots, it will use the specified system +generation. + +The bootloader itself is not being reinstalled when using this command. +Thus, the installed bootloader is used with an updated configuration file. + +The target generation can be specified explicitly by its generation number. +For example, the following invocation would switch to system generation 7: + +@example +guix system switch-generation 7 +@end example + +The target generation can also be specified relative to the current +generation with the form @code{+N} or @code{-N}, where @code{+3} means ``3 +generations ahead of the current generation,'' and @code{-1} means ``1 +generation prior to the current generation.'' When specifying a negative +value such as @code{-1}, you must precede it with @code{--} to prevent it +from being parsed as an option. For example: + +@example +guix system switch-generation -- -1 +@end example + +Currently, the effect of invoking this action is @emph{only} to switch the +system profile to an existing generation and rearrange the bootloader menu +entries. To actually start using the target system generation, you must +reboot after running this action. In the future, it will be updated to do +the same things as @command{reconfigure}, like activating and deactivating +services. + +This action will fail if the specified generation does not exist. + +@item roll-back +@cindex rolling back +Switch to the preceding system generation. The next time the system boots, +it will use the preceding system generation. This is the inverse of +@command{reconfigure}, and it is exactly the same as invoking +@command{switch-generation} with an argument of @code{-1}. + +Currently, as with @command{switch-generation}, you must reboot after +running this action to actually start using the preceding system generation. + +@item delete-generations +@cindex deleting system generations +@cindex saving space +Delete system generations, making them candidates for garbage collection +(@pxref{Invoking guix gc}, for information on how to run the ``garbage +collector''). + +This works in the same way as @command{guix package --delete-generations} +(@pxref{Invoking guix package, @code{--delete-generations}}). With no +arguments, all system generations but the current one are deleted: + +@example +guix system delete-generations +@end example + +You can also select the generations you want to delete. The example below +deletes all the system generations that are more than two month old: + +@example +guix system delete-generations 2m +@end example + +Running this command automatically reinstalls the bootloader with an updated +list of menu entries---e.g., the ``old generations'' sub-menu in GRUB no +longer lists the generations that have been deleted. + +@item build +Build the derivation of the operating system, which includes all the +configuration files and programs needed to boot and run the system. This +action does not actually install anything. + +@item init +Populate the given directory with all the files necessary to run the +operating system specified in @var{file}. This is useful for first-time +installations of Guix System. For instance: + +@example +guix system init my-os-config.scm /mnt +@end example + +copies to @file{/mnt} all the store items required by the configuration +specified in @file{my-os-config.scm}. This includes configuration files, +packages, and so on. It also creates other essential files needed for the +system to operate correctly---e.g., the @file{/etc}, @file{/var}, and +@file{/run} directories, and the @file{/bin/sh} file. + +This command also installs bootloader on the target specified in +@file{my-os-config}, unless the @option{--no-bootloader} option was passed. + +@item vm +@cindex virtual machine +@cindex VM +@anchor{guix system vm} +Build a virtual machine that contains the operating system declared in +@var{file}, and return a script to run that virtual machine (VM). + +@quotation Note +The @code{vm} action and others below can use KVM support in the Linux-libre +kernel. Specifically, if the machine has hardware virtualization support, +the corresponding KVM kernel module should be loaded, and the +@file{/dev/kvm} device node must exist and be readable and writable by the +user and by the build users of the daemon (@pxref{Build Environment Setup}). +@end quotation + +Arguments given to the script are passed to QEMU as in the example below, +which enables networking and requests 1@tie{}GiB of RAM for the emulated +machine: + +@example +$ /gnu/store/@dots{}-run-vm.sh -m 1024 -net user +@end example + +The VM shares its store with the host system. + +Additional file systems can be shared between the host and the VM using the +@code{--share} and @code{--expose} command-line options: the former +specifies a directory to be shared with write access, while the latter +provides read-only access to the shared directory. + +The example below creates a VM in which the user's home directory is +accessible read-only, and where the @file{/exchange} directory is a +read-write mapping of @file{$HOME/tmp} on the host: + +@example +guix system vm my-config.scm \ + --expose=$HOME --share=$HOME/tmp=/exchange +@end example + +On GNU/Linux, the default is to boot directly to the kernel; this has the +advantage of requiring only a very tiny root disk image since the store of +the host can then be mounted. + +The @code{--full-boot} option forces a complete boot sequence, starting with +the bootloader. This requires more disk space since a root image containing +at least the kernel, initrd, and bootloader data files must be created. The +@code{--image-size} option can be used to specify the size of the image. + +@cindex System images, creation in various formats +@cindex Creating system images in various formats +@item vm-image +@itemx disk-image +@itemx docker-image +Return a virtual machine, disk image, or Docker image of the operating +system declared in @var{file} that stands alone. By default, @command{guix +system} estimates the size of the image needed to store the system, but you +can use the @option{--image-size} option to specify a value. Docker images +are built to contain exactly what they need, so the @option{--image-size} +option is ignored in the case of @code{docker-image}. + +You can specify the root file system type by using the +@option{--file-system-type} option. It defaults to @code{ext4}. + +When using @code{vm-image}, the returned image is in qcow2 format, which the +QEMU emulator can efficiently use. @xref{Running Guix in a VM}, for more +information on how to run the image in a virtual machine. + +When using @code{disk-image}, a raw disk image is produced; it can be copied +as is to a USB stick, for instance. Assuming @code{/dev/sdc} is the device +corresponding to a USB stick, one can copy the image to it using the +following command: + +@example +# dd if=$(guix system disk-image my-os.scm) of=/dev/sdc +@end example + +When using @code{docker-image}, a Docker image is produced. Guix builds the +image from scratch, not from a pre-existing Docker base image. As a result, +it contains @emph{exactly} what you define in the operating system +configuration file. You can then load the image and launch a Docker +container using commands like the following: + +@example +image_id="$(docker load < guix-system-docker-image.tar.gz)" +docker run -e GUIX_NEW_SYSTEM=/var/guix/profiles/system \\ + --entrypoint /var/guix/profiles/system/profile/bin/guile \\ + $image_id /var/guix/profiles/system/boot +@end example + +This command starts a new Docker container from the specified image. It +will boot the Guix system in the usual manner, which means it will start any +services you have defined in the operating system configuration. Depending +on what you run in the Docker container, it may be necessary to give the +container additional permissions. For example, if you intend to build +software using Guix inside of the Docker container, you may need to pass the +@option{--privileged} option to @code{docker run}. + +@item container +Return a script to run the operating system declared in @var{file} within a +container. Containers are a set of lightweight isolation mechanisms +provided by the kernel Linux-libre. Containers are substantially less +resource-demanding than full virtual machines since the kernel, shared +objects, and other resources can be shared with the host system; this also +means they provide thinner isolation. + +Currently, the script must be run as root in order to support more than a +single user and group. The container shares its store with the host system. + +As with the @code{vm} action (@pxref{guix system vm}), additional file +systems to be shared between the host and container can be specified using +the @option{--share} and @option{--expose} options: + +@example +guix system container my-config.scm \ + --expose=$HOME --share=$HOME/tmp=/exchange +@end example + +@quotation Note +This option requires Linux-libre 3.19 or newer. +@end quotation + +@end table + +@var{options} can contain any of the common build options (@pxref{Common +Build Options}). In addition, @var{options} can contain one of the +following: + +@table @option +@item --expression=@var{expr} +@itemx -e @var{expr} +Consider the operating-system @var{expr} evaluates to. This is an +alternative to specifying a file which evaluates to an operating system. +This is used to generate the Guix system installer @pxref{Building the +Installation Image}). + +@item --system=@var{system} +@itemx -s @var{system} +Attempt to build for @var{system} instead of the host system type. This +works as per @command{guix build} (@pxref{Invoking guix build}). + +@item --derivation +@itemx -d +Return the derivation file name of the given operating system without +building anything. + +@item --file-system-type=@var{type} +@itemx -t @var{type} +For the @code{disk-image} action, create a file system of the given +@var{type} on the image. + +When this option is omitted, @command{guix system} uses @code{ext4}. + +@cindex ISO-9660 format +@cindex CD image format +@cindex DVD image format +@code{--file-system-type=iso9660} produces an ISO-9660 image, suitable for +burning on CDs and DVDs. + +@item --image-size=@var{size} +For the @code{vm-image} and @code{disk-image} actions, create an image of +the given @var{size}. @var{size} may be a number of bytes, or it may +include a unit as a suffix (@pxref{Block size, size specifications,, +coreutils, GNU Coreutils}). + +When this option is omitted, @command{guix system} computes an estimate of +the image size as a function of the size of the system declared in +@var{file}. + +@item --root=@var{file} +@itemx -r @var{file} +Make @var{file} a symlink to the result, and register it as a garbage +collector root. + +@item --skip-checks +Skip pre-installation safety checks. + +By default, @command{guix system init} and @command{guix system reconfigure} +perform safety checks: they make sure the file systems that appear in the +@code{operating-system} declaration actually exist (@pxref{File Systems}), +and that any Linux kernel modules that may be needed at boot time are listed +in @code{initrd-modules} (@pxref{Initial RAM Disk}). Passing this option +skips these tests altogether. + +@cindex on-error +@cindex on-error strategy +@cindex error strategy +@item --on-error=@var{strategy} +Apply @var{strategy} when an error occurs when reading @var{file}. +@var{strategy} may be one of the following: + +@table @code +@item nothing-special +Report the error concisely and exit. This is the default strategy. + +@item backtrace +Likewise, but also display a backtrace. + +@item debug +Report the error and enter Guile's debugger. From there, you can run +commands such as @code{,bt} to get a backtrace, @code{,locals} to display +local variable values, and more generally inspect the state of the program. +@xref{Debug Commands,,, guile, GNU Guile Reference Manual}, for a list of +available debugging commands. +@end table +@end table + +Once you have built, configured, re-configured, and re-re-configured your +Guix installation, you may find it useful to list the operating system +generations available on disk---and that you can choose from the bootloader +boot menu: + +@table @code + +@item list-generations +List a summary of each generation of the operating system available on disk, +in a human-readable way. This is similar to the @option{--list-generations} +option of @command{guix package} (@pxref{Invoking guix package}). + +Optionally, one can specify a pattern, with the same syntax that is used in +@command{guix package --list-generations}, to restrict the list of +generations displayed. For instance, the following command displays +generations that are up to 10 days old: + +@example +$ guix system list-generations 10d +@end example + +@end table + +The @command{guix system} command has even more to offer! The following +sub-commands allow you to visualize how your system services relate to each +other: + +@anchor{system-extension-graph} +@table @code + +@item extension-graph +Emit in Dot/Graphviz format to standard output the @dfn{service extension +graph} of the operating system defined in @var{file} (@pxref{Service +Composition}, for more information on service extensions.) + +The command: + +@example +$ guix system extension-graph @var{file} | dot -Tpdf > services.pdf +@end example + +produces a PDF file showing the extension relations among services. + +@anchor{system-shepherd-graph} +@item shepherd-graph +Emit in Dot/Graphviz format to standard output the @dfn{dependency graph} of +shepherd services of the operating system defined in @var{file}. +@xref{Shepherd Services}, for more information and for an example graph. + +@end table + +@node Running Guix in a VM +@section Running Guix in a Virtual Machine + +@cindex virtual machine +To run Guix in a virtual machine (VM), one can either use the pre-built Guix +VM image distributed at +@indicateurl{https://alpha.gnu.org/gnu/guix/guix-system-vm-image-@value{VERSION}.@var{system}.xz} +, or build their own virtual machine image using @command{guix system +vm-image} (@pxref{Invoking guix system}). The returned image is in qcow2 +format, which the @uref{http://qemu.org/, QEMU emulator} can efficiently +use. + +@cindex QEMU +If you built your own image, you must copy it out of the store (@pxref{The +Store}) and give yourself permission to write to the copy before you can use +it. When invoking QEMU, you must choose a system emulator that is suitable +for your hardware platform. Here is a minimal QEMU invocation that will +boot the result of @command{guix system vm-image} on x86_64 hardware: + +@example +$ qemu-system-x86_64 \ + -net user -net nic,model=virtio \ + -enable-kvm -m 256 /tmp/qemu-image +@end example + +Here is what each of these options means: + +@table @code +@item qemu-system-x86_64 +This specifies the hardware platform to emulate. This should match the +host. + +@item -net user +Enable the unprivileged user-mode network stack. The guest OS can access +the host but not vice versa. This is the simplest way to get the guest OS +online. + +@item -net nic,model=virtio +You must create a network interface of a given model. If you do not create +a NIC, the boot will fail. Assuming your hardware platform is x86_64, you +can get a list of available NIC models by running +@command{qemu-system-x86_64 -net nic,model=help}. + +@item -enable-kvm +If your system has hardware virtualization extensions, enabling the virtual +machine support (KVM) of the Linux kernel will make things run faster. + +@item -m 256 +RAM available to the guest OS, in mebibytes. Defaults to 128@tie{}MiB, +which may be insufficient for some operations. + +@item /tmp/qemu-image +The file name of the qcow2 image. +@end table + +The default @command{run-vm.sh} script that is returned by an invocation of +@command{guix system vm} does not add a @command{-net user} flag by +default. To get network access from within the vm add the +@code{(dhcp-client-service)} to your system definition and start the VM +using @command{`guix system vm config.scm` -net user}. An important caveat +of using @command{-net user} for networking is that @command{ping} will not +work, because it uses the ICMP protocol. You'll have to use a different +command to check for network connectivity, for example @command{guix +download}. + +@subsection Connecting Through SSH + +@cindex SSH +@cindex SSH server +To enable SSH inside a VM you need to add a SSH server like +@code{(dropbear-service)} or @code{(lsh-service)} to your VM. The +@code{(lsh-service}) doesn't currently boot unsupervised. It requires you +to type some characters to initialize the randomness generator. In addition +you need to forward the SSH port, 22 by default, to the host. You can do +this with + +@example +`guix system vm config.scm` -net user,hostfwd=tcp::10022-:22 +@end example + +To connect to the VM you can run + +@example +ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 10022 +@end example + +The @command{-p} tells @command{ssh} the port you want to connect to. +@command{-o UserKnownHostsFile=/dev/null} prevents @command{ssh} from +complaining every time you modify your @command{config.scm} file and the +@command{-o StrictHostKeyChecking=no} prevents you from having to allow a +connection to an unknown host every time you connect. + +@subsection Using @command{virt-viewer} with Spice + +As an alternative to the default @command{qemu} graphical client you can use +the @command{remote-viewer} from the @command{virt-viewer} package. To +connect pass the @command{-spice port=5930,disable-ticketing} flag to +@command{qemu}. See previous section for further information on how to do +this. + +Spice also allows you to do some nice stuff like share your clipboard with +your VM. To enable that you'll also have to pass the following flags to +@command{qemu}: + +@example +-device virtio-serial-pci,id=virtio-serial0,max_ports=16,bus=pci.0,addr=0x5 +-chardev spicevmc,name=vdagent,id=vdagent +-device virtserialport,nr=1,bus=virtio-serial0.0,chardev=vdagent, +name=com.redhat.spice.0 +@end example + +You'll also need to add the @pxref{Miscellaneous Services, Spice service}. + +@node Defining Services +@section Defining Services + +The previous sections show the available services and how one can combine +them in an @code{operating-system} declaration. But how do we define them +in the first place? And what is a service anyway? + +@menu +* Service Composition:: The model for composing services. +* Service Types and Services:: Types and services. +* Service Reference:: API reference. +* Shepherd Services:: A particular type of service. +@end menu + +@node Service Composition +@subsection Service Composition + +@cindex services +@cindex daemons +Here we define a @dfn{service} as, broadly, something that extends the +functionality of the operating system. Often a service is a process---a +@dfn{daemon}---started when the system boots: a secure shell server, a Web +server, the Guix build daemon, etc. Sometimes a service is a daemon whose +execution can be triggered by another daemon---e.g., an FTP server started +by @command{inetd} or a D-Bus service activated by @command{dbus-daemon}. +Occasionally, a service does not map to a daemon. For instance, the +``account'' service collects user accounts and makes sure they exist when +the system runs; the ``udev'' service collects device management rules and +makes them available to the eudev daemon; the @file{/etc} service populates +the @file{/etc} directory of the system. + +@cindex service extensions +Guix system services are connected by @dfn{extensions}. For instance, the +secure shell service @emph{extends} the Shepherd---the initialization +system, running as PID@tie{}1---by giving it the command lines to start and +stop the secure shell daemon (@pxref{Networking Services, +@code{openssh-service-type}}); the UPower service extends the D-Bus service +by passing it its @file{.service} specification, and extends the udev +service by passing it device management rules (@pxref{Desktop Services, +@code{upower-service}}); the Guix daemon service extends the Shepherd by +passing it the command lines to start and stop the daemon, and extends the +account service by passing it a list of required build user accounts +(@pxref{Base Services}). + +All in all, services and their ``extends'' relations form a directed acyclic +graph (DAG). If we represent services as boxes and extensions as arrows, a +typical system might provide something like this: + +@image{images/service-graph,,5in,Typical service extension graph.} + +@cindex system service +At the bottom, we see the @dfn{system service}, which produces the directory +containing everything to run and boot the system, as returned by the +@command{guix system build} command. @xref{Service Reference}, to learn +about the other service types shown here. @xref{system-extension-graph, the +@command{guix system extension-graph} command}, for information on how to +generate this representation for a particular operating system definition. + +@cindex service types +Technically, developers can define @dfn{service types} to express these +relations. There can be any number of services of a given type on the +system---for instance, a system running two instances of the GNU secure +shell server (lsh) has two instances of @code{lsh-service-type}, with +different parameters. + +The following section describes the programming interface for service types +and services. + +@node Service Types and Services +@subsection Service Types and Services + +A @dfn{service type} is a node in the DAG described above. Let us start +with a simple example, the service type for the Guix build daemon +(@pxref{Invoking guix-daemon}): + +@example +(define guix-service-type + (service-type + (name 'guix) + (extensions + (list (service-extension shepherd-root-service-type guix-shepherd-service) + (service-extension account-service-type guix-accounts) + (service-extension activation-service-type guix-activation))) + (default-value (guix-configuration)))) +@end example + +@noindent +It defines three things: + +@enumerate +@item +A name, whose sole purpose is to make inspection and debugging easier. + +@item +A list of @dfn{service extensions}, where each extension designates the +target service type and a procedure that, given the parameters of the +service, returns a list of objects to extend the service of that type. + +Every service type has at least one service extension. The only exception +is the @dfn{boot service type}, which is the ultimate service. + +@item +Optionally, a default value for instances of this type. +@end enumerate + +In this example, @code{guix-service-type} extends three services: + +@table @code +@item shepherd-root-service-type +The @code{guix-shepherd-service} procedure defines how the Shepherd service +is extended. Namely, it returns a @code{<shepherd-service>} object that +defines how @command{guix-daemon} is started and stopped (@pxref{Shepherd +Services}). + +@item account-service-type +This extension for this service is computed by @code{guix-accounts}, which +returns a list of @code{user-group} and @code{user-account} objects +representing the build user accounts (@pxref{Invoking guix-daemon}). + +@item activation-service-type +Here @code{guix-activation} is a procedure that returns a gexp, which is a +code snippet to run at ``activation time''---e.g., when the service is +booted. +@end table + +A service of this type is instantiated like this: + +@example +(service guix-service-type + (guix-configuration + (build-accounts 5) + (use-substitutes? #f))) +@end example + +The second argument to the @code{service} form is a value representing the +parameters of this specific service instance. +@xref{guix-configuration-type, @code{guix-configuration}}, for information +about the @code{guix-configuration} data type. When the value is omitted, +the default value specified by @code{guix-service-type} is used: + +@example +(service guix-service-type) +@end example + +@code{guix-service-type} is quite simple because it extends other services +but is not extensible itself. + +@c @subsubsubsection Extensible Service Types + +The service type for an @emph{extensible} service looks like this: + +@example +(define udev-service-type + (service-type (name 'udev) + (extensions + (list (service-extension shepherd-root-service-type + udev-shepherd-service))) + + (compose concatenate) ;concatenate the list of rules + (extend (lambda (config rules) + (match config + (($ <udev-configuration> udev initial-rules) + (udev-configuration + (udev udev) ;the udev package to use + (rules (append initial-rules rules))))))))) +@end example + +This is the service type for the +@uref{https://wiki.gentoo.org/wiki/Project:Eudev, eudev device management +daemon}. Compared to the previous example, in addition to an extension of +@code{shepherd-root-service-type}, we see two new fields: + +@table @code +@item compose +This is the procedure to @dfn{compose} the list of extensions to services of +this type. + +Services can extend the udev service by passing it lists of rules; we +compose those extensions simply by concatenating them. + +@item extend +This procedure defines how the value of the service is @dfn{extended} with +the composition of the extensions. + +Udev extensions are composed into a list of rules, but the udev service +value is itself a @code{<udev-configuration>} record. So here, we extend +that record by appending the list of rules it contains to the list of +contributed rules. + +@item description +This is a string giving an overview of the service type. The string can +contain Texinfo markup (@pxref{Overview,,, texinfo, GNU Texinfo}). The +@command{guix system search} command searches these strings and displays +them (@pxref{Invoking guix system}). +@end table + +There can be only one instance of an extensible service type such as +@code{udev-service-type}. If there were more, the @code{service-extension} +specifications would be ambiguous. + +Still here? The next section provides a reference of the programming +interface for services. + +@node Service Reference +@subsection Service Reference + +We have seen an overview of service types (@pxref{Service Types and +Services}). This section provides a reference on how to manipulate services +and service types. This interface is provided by the @code{(gnu services)} +module. + +@deffn {Scheme Procedure} service @var{type} [@var{value}] +Return a new service of @var{type}, a @code{<service-type>} object (see +below.) @var{value} can be any object; it represents the parameters of this +particular service instance. + +When @var{value} is omitted, the default value specified by @var{type} is +used; if @var{type} does not specify a default value, an error is raised. + +For instance, this: + +@example +(service openssh-service-type) +@end example + +@noindent +is equivalent to this: + +@example +(service openssh-service-type + (openssh-configuration)) +@end example + +In both cases the result is an instance of @code{openssh-service-type} with +the default configuration. +@end deffn + +@deffn {Scheme Procedure} service? @var{obj} +Return true if @var{obj} is a service. +@end deffn + +@deffn {Scheme Procedure} service-kind @var{service} +Return the type of @var{service}---i.e., a @code{<service-type>} object. +@end deffn + +@deffn {Scheme Procedure} service-value @var{service} +Return the value associated with @var{service}. It represents its +parameters. +@end deffn + +Here is an example of how a service is created and manipulated: + +@example +(define s + (service nginx-service-type + (nginx-configuration + (nginx nginx) + (log-directory log-directory) + (run-directory run-directory) + (file config-file)))) + +(service? s) +@result{} #t + +(eq? (service-kind s) nginx-service-type) +@result{} #t +@end example + +The @code{modify-services} form provides a handy way to change the +parameters of some of the services of a list such as @code{%base-services} +(@pxref{Base Services, @code{%base-services}}). It evaluates to a list of +services. Of course, you could always use standard list combinators such as +@code{map} and @code{fold} to do that (@pxref{SRFI-1, List Library,, guile, +GNU Guile Reference Manual}); @code{modify-services} simply provides a more +concise form for this common pattern. + +@deffn {Scheme Syntax} modify-services @var{services} @ + (@var{type} @var{variable} => @var{body}) @dots{} + +Modify the services listed in @var{services} according to the given +clauses. Each clause has the form: + +@example +(@var{type} @var{variable} => @var{body}) +@end example + +where @var{type} is a service type---e.g., @code{guix-service-type}---and +@var{variable} is an identifier that is bound within the @var{body} to the +service parameters---e.g., a @code{guix-configuration} instance---of the +original service of that @var{type}. + +The @var{body} should evaluate to the new service parameters, which will be +used to configure the new service. This new service will replace the +original in the resulting list. Because a service's service parameters are +created using @code{define-record-type*}, you can write a succinct +@var{body} that evaluates to the new service parameters by using the +@code{inherit} feature that @code{define-record-type*} provides. + +@xref{Using the Configuration System}, for example usage. + +@end deffn + +Next comes the programming interface for service types. This is something +you want to know when writing new service definitions, but not necessarily +when simply looking for ways to customize your @code{operating-system} +declaration. + +@deftp {Data Type} service-type +@cindex service type +This is the representation of a @dfn{service type} (@pxref{Service Types and +Services}). + +@table @asis +@item @code{name} +This is a symbol, used only to simplify inspection and debugging. + +@item @code{extensions} +A non-empty list of @code{<service-extension>} objects (see below). + +@item @code{compose} (default: @code{#f}) +If this is @code{#f}, then the service type denotes services that cannot be +extended---i.e., services that do not receive ``values'' from other +services. + +Otherwise, it must be a one-argument procedure. The procedure is called by +@code{fold-services} and is passed a list of values collected from +extensions. It may return any single value. + +@item @code{extend} (default: @code{#f}) +If this is @code{#f}, services of this type cannot be extended. + +Otherwise, it must be a two-argument procedure: @code{fold-services} calls +it, passing it the initial value of the service as the first argument and +the result of applying @code{compose} to the extension values as the second +argument. It must return a value that is a valid parameter value for the +service instance. +@end table + +@xref{Service Types and Services}, for examples. +@end deftp + +@deffn {Scheme Procedure} service-extension @var{target-type} @ + @var{compute} Return a new extension for services of type +@var{target-type}. @var{compute} must be a one-argument procedure: +@code{fold-services} calls it, passing it the value associated with the +service that provides the extension; it must return a valid value for the +target service. +@end deffn + +@deffn {Scheme Procedure} service-extension? @var{obj} +Return true if @var{obj} is a service extension. +@end deffn + +Occasionally, you might want to simply extend an existing service. This +involves creating a new service type and specifying the extension of +interest, which can be verbose; the @code{simple-service} procedure provides +a shorthand for this. + +@deffn {Scheme Procedure} simple-service @var{name} @var{target} @var{value} +Return a service that extends @var{target} with @var{value}. This works by +creating a singleton service type @var{name}, of which the returned service +is an instance. + +For example, this extends mcron (@pxref{Scheduled Job Execution}) with an +additional job: + +@example +(simple-service 'my-mcron-job mcron-service-type + #~(job '(next-hour (3)) "guix gc -F 2G")) +@end example +@end deffn + +At the core of the service abstraction lies the @code{fold-services} +procedure, which is responsible for ``compiling'' a list of services down to +a single directory that contains everything needed to boot and run the +system---the directory shown by the @command{guix system build} command +(@pxref{Invoking guix system}). In essence, it propagates service +extensions down the service graph, updating each node parameters on the way, +until it reaches the root node. + +@deffn {Scheme Procedure} fold-services @var{services} @ + [#:target-type @var{system-service-type}] Fold @var{services} by propagating +their extensions down to the root of type @var{target-type}; return the root +service adjusted accordingly. +@end deffn + +Lastly, the @code{(gnu services)} module also defines several essential +service types, some of which are listed below. + +@defvr {Scheme Variable} system-service-type +This is the root of the service graph. It produces the system directory as +returned by the @command{guix system build} command. +@end defvr + +@defvr {Scheme Variable} boot-service-type +The type of the ``boot service'', which produces the @dfn{boot script}. The +boot script is what the initial RAM disk runs when booting. +@end defvr + +@defvr {Scheme Variable} etc-service-type +The type of the @file{/etc} service. This service is used to create files +under @file{/etc} and can be extended by passing it name/file tuples such +as: + +@example +(list `("issue" ,(plain-file "issue" "Welcome!\n"))) +@end example + +In this example, the effect would be to add an @file{/etc/issue} file +pointing to the given file. +@end defvr + +@defvr {Scheme Variable} setuid-program-service-type +Type for the ``setuid-program service''. This service collects lists of +executable file names, passed as gexps, and adds them to the set of +setuid-root programs on the system (@pxref{Setuid Programs}). +@end defvr + +@defvr {Scheme Variable} profile-service-type +Type of the service that populates the @dfn{system profile}---i.e., the +programs under @file{/run/current-system/profile}. Other services can +extend it by passing it lists of packages to add to the system profile. +@end defvr + + +@node Shepherd Services +@subsection Shepherd Services + +@cindex shepherd services +@cindex PID 1 +@cindex init system +The @code{(gnu services shepherd)} module provides a way to define services +managed by the GNU@tie{}Shepherd, which is the initialization system---the +first process that is started when the system boots, also known as +PID@tie{}1 (@pxref{Introduction,,, shepherd, The GNU Shepherd Manual}). + +Services in the Shepherd can depend on each other. For instance, the SSH +daemon may need to be started after the syslog daemon has been started, +which in turn can only happen once all the file systems have been mounted. +The simple operating system defined earlier (@pxref{Using the Configuration +System}) results in a service graph like this: + +@image{images/shepherd-graph,,5in,Typical shepherd service graph.} + +You can actually generate such a graph for any operating system definition +using the @command{guix system shepherd-graph} command +(@pxref{system-shepherd-graph, @command{guix system shepherd-graph}}). + +The @code{%shepherd-root-service} is a service object representing +PID@tie{}1, of type @code{shepherd-root-service-type}; it can be extended by +passing it lists of @code{<shepherd-service>} objects. + +@deftp {Data Type} shepherd-service +The data type representing a service managed by the Shepherd. + +@table @asis +@item @code{provision} +This is a list of symbols denoting what the service provides. + +These are the names that may be passed to @command{herd start}, +@command{herd status}, and similar commands (@pxref{Invoking herd,,, +shepherd, The GNU Shepherd Manual}). @xref{Slots of services, the +@code{provides} slot,, shepherd, The GNU Shepherd Manual}, for details. + +@item @code{requirements} (default: @code{'()}) +List of symbols denoting the Shepherd services this one depends on. + +@cindex one-shot services, for the Shepherd +@item @code{one-shot?} (default: @code{#f}) +Whether this service is @dfn{one-shot}. One-shot services stop immediately +after their @code{start} action has completed. @xref{Slots of services,,, +shepherd, The GNU Shepherd Manual}, for more info. + +@item @code{respawn?} (default: @code{#t}) +Whether to restart the service when it stops, for instance when the +underlying process dies. + +@item @code{start} +@itemx @code{stop} (default: @code{#~(const #f)}) +The @code{start} and @code{stop} fields refer to the Shepherd's facilities +to start and stop processes (@pxref{Service De- and Constructors,,, +shepherd, The GNU Shepherd Manual}). They are given as G-expressions that +get expanded in the Shepherd configuration file (@pxref{G-Expressions}). + +@item @code{actions} (default: @code{'()}) +@cindex actions, of Shepherd services +This is a list of @code{shepherd-action} objects (see below) defining +@dfn{actions} supported by the service, in addition to the standard +@code{start} and @code{stop} actions. Actions listed here become available +as @command{herd} sub-commands: + +@example +herd @var{action} @var{service} [@var{arguments}@dots{}] +@end example + +@item @code{documentation} +A documentation string, as shown when running: + +@example +herd doc @var{service-name} +@end example + +where @var{service-name} is one of the symbols in @code{provision} +(@pxref{Invoking herd,,, shepherd, The GNU Shepherd Manual}). + +@item @code{modules} (default: @code{%default-modules}) +This is the list of modules that must be in scope when @code{start} and +@code{stop} are evaluated. + +@end table +@end deftp + +@deftp {Data Type} shepherd-action +This is the data type that defines additional actions implemented by a +Shepherd service (see above). + +@table @code +@item name +Symbol naming the action. + +@item documentation +This is a documentation string for the action. It can be viewed by running: + +@example +herd doc @var{service} action @var{action} +@end example + +@item procedure +This should be a gexp that evaluates to a procedure of at least one +argument, which is the ``running value'' of the service (@pxref{Slots of +services,,, shepherd, The GNU Shepherd Manual}). +@end table + +The following example defines an action called @code{say-hello} that kindly +greets the user: + +@example +(shepherd-action + (name 'say-hello) + (documentation "Say hi!") + (procedure #~(lambda (running . args) + (format #t "Hello, friend! arguments: ~s\n" + args) + #t))) +@end example + +Assuming this action is added to the @code{example} service, then you can +do: + +@example +# herd say-hello example +Hello, friend! arguments: () +# herd say-hello example a b c +Hello, friend! arguments: ("a" "b" "c") +@end example + +This, as you can see, is a fairly sophisticated way to say hello. +@xref{Service Convenience,,, shepherd, The GNU Shepherd Manual}, for more +info on actions. +@end deftp + +@defvr {Scheme Variable} shepherd-root-service-type +The service type for the Shepherd ``root service''---i.e., PID@tie{}1. + +This is the service type that extensions target when they want to create +shepherd services (@pxref{Service Types and Services}, for an example). +Each extension must pass a list of @code{<shepherd-service>}. +@end defvr + +@defvr {Scheme Variable} %shepherd-root-service +This service represents PID@tie{}1. +@end defvr + + +@node Documentation +@chapter Documentation + +@cindex documentation, searching for +@cindex searching for documentation +@cindex Info, documentation format +@cindex man pages +@cindex manual pages +In most cases packages installed with Guix come with documentation. There +are two main documentation formats: ``Info'', a browseable hypertext format +used for GNU software, and ``manual pages'' (or ``man pages''), the linear +documentation format traditionally found on Unix. Info manuals are accessed +with the @command{info} command or with Emacs, and man pages are accessed +using @command{man}. + +You can look for documentation of software installed on your system by +keyword. For example, the following command searches for information about +``TLS'' in Info manuals: + +@example +$ info -k TLS +"(emacs)Network Security" -- STARTTLS +"(emacs)Network Security" -- TLS +"(gnutls)Core TLS API" -- gnutls_certificate_set_verify_flags +"(gnutls)Core TLS API" -- gnutls_certificate_set_verify_function +@dots{} +@end example + +@noindent +The command below searches for the same keyword in man pages: + +@example +$ man -k TLS +SSL (7) - OpenSSL SSL/TLS library +certtool (1) - GnuTLS certificate tool +@dots {} +@end example + +These searches are purely local to your computer so you have the guarantee +that documentation you find corresponds to what you have actually installed, +you can access it off-line, and your privacy is respected. + +Once you have these results, you can view the relevant documentation by +running, say: + +@example +$ info "(gnutls)Core TLS API" +@end example + +@noindent +or: + +@example +$ man certtool +@end example + +Info manuals contain sections and indices as well as hyperlinks like those +found in Web pages. The @command{info} reader (@pxref{Top, Info reader,, +info-stnd, Stand-alone GNU Info}) and its Emacs counterpart (@pxref{Misc +Help,,, emacs, The GNU Emacs Manual}) provide intuitive key bindings to +navigate manuals. @xref{Getting Started,,, info, Info: An Introduction}, +for an introduction to Info navigation. + +@node Installing Debugging Files +@chapter Installing Debugging Files + +@cindex debugging files +Program binaries, as produced by the GCC compilers for instance, are +typically written in the ELF format, with a section containing +@dfn{debugging information}. Debugging information is what allows the +debugger, GDB, to map binary code to source code; it is required to debug a +compiled program in good conditions. + +The problem with debugging information is that is takes up a fair amount of +disk space. For example, debugging information for the GNU C Library weighs +in at more than 60 MiB. Thus, as a user, keeping all the debugging info of +all the installed programs is usually not an option. Yet, space savings +should not come at the cost of an impediment to debugging---especially in +the GNU system, which should make it easier for users to exert their +computing freedom (@pxref{GNU Distribution}). + +Thankfully, the GNU Binary Utilities (Binutils) and GDB provide a mechanism +that allows users to get the best of both worlds: debugging information can +be stripped from the binaries and stored in separate files. GDB is then +able to load debugging information from those files, when they are available +(@pxref{Separate Debug Files,,, gdb, Debugging with GDB}). + +The GNU distribution takes advantage of this by storing debugging +information in the @code{lib/debug} sub-directory of a separate package +output unimaginatively called @code{debug} (@pxref{Packages with Multiple +Outputs}). Users can choose to install the @code{debug} output of a package +when they need it. For instance, the following command installs the +debugging information for the GNU C Library and for GNU Guile: + +@example +guix package -i glibc:debug guile:debug +@end example + +GDB must then be told to look for debug files in the user's profile, by +setting the @code{debug-file-directory} variable (consider setting it from +the @file{~/.gdbinit} file, @pxref{Startup,,, gdb, Debugging with GDB}): + +@example +(gdb) set debug-file-directory ~/.guix-profile/lib/debug +@end example + +From there on, GDB will pick up debugging information from the @code{.debug} +files under @file{~/.guix-profile/lib/debug}. + +In addition, you will most likely want GDB to be able to show the source +code being debugged. To do that, you will have to unpack the source code of +the package of interest (obtained with @code{guix build --source}, +@pxref{Invoking guix build}), and to point GDB to that source directory +using the @code{directory} command (@pxref{Source Path, @code{directory},, +gdb, Debugging with GDB}). + +@c XXX: keep me up-to-date +The @code{debug} output mechanism in Guix is implemented by the +@code{gnu-build-system} (@pxref{Build Systems}). Currently, it is +opt-in---debugging information is available only for the packages with +definitions explicitly declaring a @code{debug} output. This may be changed +to opt-out in the future if our build farm servers can handle the load. To +check whether a package has a @code{debug} output, use @command{guix package +--list-available} (@pxref{Invoking guix package}). + + +@node Security Updates +@chapter Security Updates + +@cindex security updates +@cindex security vulnerabilities +Occasionally, important security vulnerabilities are discovered in software +packages and must be patched. Guix developers try hard to keep track of +known vulnerabilities and to apply fixes as soon as possible in the +@code{master} branch of Guix (we do not yet provide a ``stable'' branch +containing only security updates.) The @command{guix lint} tool helps +developers find out about vulnerable versions of software packages in the +distribution: + +@smallexample +$ guix lint -c cve +gnu/packages/base.scm:652:2: glibc@@2.21: probably vulnerable to CVE-2015-1781, CVE-2015-7547 +gnu/packages/gcc.scm:334:2: gcc@@4.9.3: probably vulnerable to CVE-2015-5276 +gnu/packages/image.scm:312:2: openjpeg@@2.1.0: probably vulnerable to CVE-2016-1923, CVE-2016-1924 +@dots{} +@end smallexample + +@xref{Invoking guix lint}, for more information. + +@quotation Note +As of version @value{VERSION}, the feature described below is considered +``beta''. +@end quotation + +Guix follows a functional package management discipline +(@pxref{Introduction}), which implies that, when a package is changed, +@emph{every package that depends on it} must be rebuilt. This can +significantly slow down the deployment of fixes in core packages such as +libc or Bash, since basically the whole distribution would need to be +rebuilt. Using pre-built binaries helps (@pxref{Substitutes}), but +deployment may still take more time than desired. + +@cindex grafts +To address this, Guix implements @dfn{grafts}, a mechanism that allows for +fast deployment of critical updates without the costs associated with a +whole-distribution rebuild. The idea is to rebuild only the package that +needs to be patched, and then to ``graft'' it onto packages explicitly +installed by the user and that were previously referring to the original +package. The cost of grafting is typically very low, and order of +magnitudes lower than a full rebuild of the dependency chain. + +@cindex replacements of packages, for grafts +For instance, suppose a security update needs to be applied to Bash. Guix +developers will provide a package definition for the ``fixed'' Bash, say +@code{bash-fixed}, in the usual way (@pxref{Defining Packages}). Then, the +original package definition is augmented with a @code{replacement} field +pointing to the package containing the bug fix: + +@example +(define bash + (package + (name "bash") + ;; @dots{} + (replacement bash-fixed))) +@end example + +From there on, any package depending directly or indirectly on Bash---as +reported by @command{guix gc --requisites} (@pxref{Invoking guix gc})---that +is installed is automatically ``rewritten'' to refer to @code{bash-fixed} +instead of @code{bash}. This grafting process takes time proportional to +the size of the package, usually less than a minute for an ``average'' +package on a recent machine. Grafting is recursive: when an indirect +dependency requires grafting, then grafting ``propagates'' up to the package +that the user is installing. + +Currently, the length of the name and version of the graft and that of the +package it replaces (@code{bash-fixed} and @code{bash} in the example above) +must be equal. This restriction mostly comes from the fact that grafting +works by patching files, including binary files, directly. Other +restrictions may apply: for instance, when adding a graft to a package +providing a shared library, the original shared library and its replacement +must have the same @code{SONAME} and be binary-compatible. + +The @option{--no-grafts} command-line option allows you to forcefully avoid +grafting (@pxref{Common Build Options, @option{--no-grafts}}). Thus, the +command: + +@example +guix build bash --no-grafts +@end example + +@noindent +returns the store file name of the original Bash, whereas: + +@example +guix build bash +@end example + +@noindent +returns the store file name of the ``fixed'', replacement Bash. This allows +you to distinguish between the two variants of Bash. + +To verify which Bash your whole profile refers to, you can run +(@pxref{Invoking guix gc}): + +@example +guix gc -R `readlink -f ~/.guix-profile` | grep bash +@end example + +@noindent +@dots{} and compare the store file names that you get with those above. +Likewise for a complete Guix system generation: + +@example +guix gc -R `guix system build my-config.scm` | grep bash +@end example + +Lastly, to check which Bash running processes are using, you can use the +@command{lsof} command: + +@example +lsof | grep /gnu/store/.*bash +@end example + + +@node Bootstrapping +@chapter Bootstrapping + +@c Adapted from the ELS 2013 paper. + +@cindex bootstrapping + +Bootstrapping in our context refers to how the distribution gets built +``from nothing''. Remember that the build environment of a derivation +contains nothing but its declared inputs (@pxref{Introduction}). So there's +an obvious chicken-and-egg problem: how does the first package get built? +How does the first compiler get compiled? Note that this is a question of +interest only to the curious hacker, not to the regular user, so you can +shamelessly skip this section if you consider yourself a ``regular user''. + +@cindex bootstrap binaries +The GNU system is primarily made of C code, with libc at its core. The GNU +build system itself assumes the availability of a Bourne shell and +command-line tools provided by GNU Coreutils, Awk, Findutils, `sed', and +`grep'. Furthermore, build programs---programs that run @code{./configure}, +@code{make}, etc.---are written in Guile Scheme (@pxref{Derivations}). +Consequently, to be able to build anything at all, from scratch, Guix relies +on pre-built binaries of Guile, GCC, Binutils, libc, and the other packages +mentioned above---the @dfn{bootstrap binaries}. + +These bootstrap binaries are ``taken for granted'', though we can also +re-create them if needed (more on that later). + +@unnumberedsec Preparing to Use the Bootstrap Binaries + +@c As of Emacs 24.3, Info-mode displays the image, but since it's a +@c large image, it's hard to scroll. Oh well. +@image{images/bootstrap-graph,6in,,Dependency graph of the early bootstrap +derivations} + +The figure above shows the very beginning of the dependency graph of the +distribution, corresponding to the package definitions of the @code{(gnu +packages bootstrap)} module. A similar figure can be generated with +@command{guix graph} (@pxref{Invoking guix graph}), along the lines of: + +@example +guix graph -t derivation \ + -e '(@@@@ (gnu packages bootstrap) %bootstrap-gcc)' \ + | dot -Tps > t.ps +@end example + +At this level of detail, things are slightly complex. First, Guile itself +consists of an ELF executable, along with many source and compiled Scheme +files that are dynamically loaded when it runs. This gets stored in the +@file{guile-2.0.7.tar.xz} tarball shown in this graph. This tarball is part +of Guix's ``source'' distribution, and gets inserted into the store with +@code{add-to-store} (@pxref{The Store}). + +But how do we write a derivation that unpacks this tarball and adds it to +the store? To solve this problem, the @code{guile-bootstrap-2.0.drv} +derivation---the first one that gets built---uses @code{bash} as its +builder, which runs @code{build-bootstrap-guile.sh}, which in turn calls +@code{tar} to unpack the tarball. Thus, @file{bash}, @file{tar}, @file{xz}, +and @file{mkdir} are statically-linked binaries, also part of the Guix +source distribution, whose sole purpose is to allow the Guile tarball to be +unpacked. + +Once @code{guile-bootstrap-2.0.drv} is built, we have a functioning Guile +that can be used to run subsequent build programs. Its first task is to +download tarballs containing the other pre-built binaries---this is what the +@code{.tar.xz.drv} derivations do. Guix modules such as +@code{ftp-client.scm} are used for this purpose. The +@code{module-import.drv} derivations import those modules in a directory in +the store, using the original layout. The @code{module-import-compiled.drv} +derivations compile those modules, and write them in an output directory +with the right layout. This corresponds to the @code{#:modules} argument of +@code{build-expression->derivation} (@pxref{Derivations}). + +Finally, the various tarballs are unpacked by the derivations +@code{gcc-bootstrap-0.drv}, @code{glibc-bootstrap-0.drv}, etc., at which +point we have a working C tool chain. + + +@unnumberedsec Building the Build Tools + +Bootstrapping is complete when we have a full tool chain that does not +depend on the pre-built bootstrap tools discussed above. This no-dependency +requirement is verified by checking whether the files of the final tool +chain contain references to the @file{/gnu/store} directories of the +bootstrap inputs. The process that leads to this ``final'' tool chain is +described by the package definitions found in the @code{(gnu packages +commencement)} module. + +The @command{guix graph} command allows us to ``zoom out'' compared to the +graph above, by looking at the level of package objects instead of +individual derivations---remember that a package may translate to several +derivations, typically one derivation to download its source, one to build +the Guile modules it needs, and one to actually build the package from +source. The command: + +@example +guix graph -t bag \ + -e '(@@@@ (gnu packages commencement) + glibc-final-with-bootstrap-bash)' | dot -Tps > t.ps +@end example + +@noindent +produces the dependency graph leading to the ``final'' C +library@footnote{You may notice the @code{glibc-intermediate} label, +suggesting that it is not @emph{quite} final, but as a good approximation, +we will consider it final.}, depicted below. + +@image{images/bootstrap-packages,6in,,Dependency graph of the early +packages} + +@c See <http://lists.gnu.org/archive/html/gnu-system-discuss/2012-10/msg00000.html>. +The first tool that gets built with the bootstrap binaries is +GNU@tie{}Make---noted @code{make-boot0} above---which is a prerequisite for +all the following packages. From there Findutils and Diffutils get built. + +Then come the first-stage Binutils and GCC, built as pseudo cross +tools---i.e., with @code{--target} equal to @code{--host}. They are used to +build libc. Thanks to this cross-build trick, this libc is guaranteed not +to hold any reference to the initial tool chain. + +From there the final Binutils and GCC (not shown above) are built. GCC uses +@code{ld} from the final Binutils, and links programs against the just-built +libc. This tool chain is used to build the other packages used by Guix and +by the GNU Build System: Guile, Bash, Coreutils, etc. + +And voilà! At this point we have the complete set of build tools that the +GNU Build System expects. These are in the @code{%final-inputs} variable of +the @code{(gnu packages commencement)} module, and are implicitly used by +any package that uses @code{gnu-build-system} (@pxref{Build Systems, +@code{gnu-build-system}}). + + +@unnumberedsec Building the Bootstrap Binaries + +@cindex bootstrap binaries +Because the final tool chain does not depend on the bootstrap binaries, +those rarely need to be updated. Nevertheless, it is useful to have an +automated way to produce them, should an update occur, and this is what the +@code{(gnu packages make-bootstrap)} module provides. + +The following command builds the tarballs containing the bootstrap binaries +(Guile, Binutils, GCC, libc, and a tarball containing a mixture of Coreutils +and other basic command-line tools): + +@example +guix build bootstrap-tarballs +@end example + +The generated tarballs are those that should be referred to in the +@code{(gnu packages bootstrap)} module mentioned at the beginning of this +section. + +Still here? Then perhaps by now you've started to wonder: when do we reach a +fixed point? That is an interesting question! The answer is unknown, but if +you would like to investigate further (and have significant computational +and storage resources to do so), then let us know. + +@unnumberedsec Reducing the Set of Bootstrap Binaries + +Our bootstrap binaries currently include GCC, Guile, etc. That's a lot of +binary code! Why is that a problem? It's a problem because these big chunks +of binary code are practically non-auditable, which makes it hard to +establish what source code produced them. Every unauditable binary also +leaves us vulnerable to compiler backdoors as described by Ken Thompson in +the 1984 paper @emph{Reflections on Trusting Trust}. + +This is mitigated by the fact that our bootstrap binaries were generated +from an earlier Guix revision. Nevertheless it lacks the level of +transparency that we get in the rest of the package dependency graph, where +Guix always gives us a source-to-binary mapping. Thus, our goal is to +reduce the set of bootstrap binaries to the bare minimum. + +The @uref{http://bootstrappable.org, Bootstrappable.org web site} lists +on-going projects to do that. One of these is about replacing the bootstrap +GCC with a sequence of assemblers, interpreters, and compilers of increasing +complexity, which could be built from source starting from a simple and +auditable assembler. Your help is welcome! + + +@node Porting +@chapter Porting to a New Platform + +As discussed above, the GNU distribution is self-contained, and +self-containment is achieved by relying on pre-built ``bootstrap binaries'' +(@pxref{Bootstrapping}). These binaries are specific to an operating system +kernel, CPU architecture, and application binary interface (ABI). Thus, to +port the distribution to a platform that is not yet supported, one must +build those bootstrap binaries, and update the @code{(gnu packages +bootstrap)} module to use them on that platform. + +Fortunately, Guix can @emph{cross compile} those bootstrap binaries. When +everything goes well, and assuming the GNU tool chain supports the target +platform, this can be as simple as running a command like this one: + +@example +guix build --target=armv5tel-linux-gnueabi bootstrap-tarballs +@end example + +For this to work, the @code{glibc-dynamic-linker} procedure in @code{(gnu +packages bootstrap)} must be augmented to return the right file name for +libc's dynamic linker on that platform; likewise, +@code{system->linux-architecture} in @code{(gnu packages linux)} must be +taught about the new platform. + +Once these are built, the @code{(gnu packages bootstrap)} module needs to be +updated to refer to these binaries on the target platform. That is, the +hashes and URLs of the bootstrap tarballs for the new platform must be added +alongside those of the currently supported platforms. The bootstrap Guile +tarball is treated specially: it is expected to be available locally, and +@file{gnu/local.mk} has rules to download it for the supported +architectures; a rule for the new platform must be added as well. + +In practice, there may be some complications. First, it may be that the +extended GNU triplet that specifies an ABI (like the @code{eabi} suffix +above) is not recognized by all the GNU tools. Typically, glibc recognizes +some of these, whereas GCC uses an extra @code{--with-abi} configure flag +(see @code{gcc.scm} for examples of how to handle this). Second, some of +the required packages could fail to build for that platform. Lastly, the +generated binaries could be broken for some reason. + +@c ********************************************************************* +@include contributing.zh_CN.texi + +@c ********************************************************************* +@node Acknowledgments +@chapter Acknowledgments + +Guix is based on the @uref{http://nixos.org/nix/, Nix package manager}, +which was designed and implemented by Eelco Dolstra, with contributions from +other people (see the @file{nix/AUTHORS} file in Guix.) Nix pioneered +functional package management, and promoted unprecedented features, such as +transactional package upgrades and rollbacks, per-user profiles, and +referentially transparent build processes. Without this work, Guix would +not exist. + +The Nix-based software distributions, Nixpkgs and NixOS, have also been an +inspiration for Guix. + +GNU@tie{}Guix itself is a collective work with contributions from a number +of people. See the @file{AUTHORS} file in Guix for more information on +these fine people. The @file{THANKS} file lists people who have helped by +reporting bugs, taking care of the infrastructure, providing artwork and +themes, making suggestions, and more---thank you! + + +@c ********************************************************************* +@node GNU Free Documentation License +@appendix GNU Free Documentation License +@cindex license, GNU Free Documentation License +@include fdl-1.3.texi + +@c ********************************************************************* +@node Concept Index +@unnumbered Concept Index +@printindex cp + +@node Programming Index +@unnumbered Programming Index +@syncodeindex tp fn +@syncodeindex vr fn +@printindex fn + +@bye + +@c Local Variables: +@c ispell-local-dictionary: "american"; +@c End: |