* bug#70429: agate service broken
@ 2024-04-16 22:33 Christopher Howard
2024-04-17 16:53 ` Efraim Flashner
2024-10-31 21:44 ` Christopher Howard
0 siblings, 2 replies; 3+ messages in thread
From: Christopher Howard @ 2024-04-16 22:33 UTC (permalink / raw)
To: 70429
Hello, I recently updated a server system which hadn't been updated for a long time, and my agate service is now broken. I will try below to include all the relevant data:
* Service fails to start. Herd does not give a reason for the failure when I do this manually.
* agate.log shows this error message:
> 2024-04-16 13:35:52 Unrecognized option: 'cert'
* Here is the service configuration I am using:
``` guile scheme
(service agate-service-type
(agate-configuration
(content "/srv/gemini")
(cert "/srv/gemini-tls/cert.pem")
(key "/srv/gemini-tls/key.rsa")
(log-ip? #f)))
```
* The working system generation:
> Generation 24 Aug 07 2023 22:24:43
> file name: /var/guix/profiles/system-24-link
> canonical file name: /gnu/store/nq8bmbmr4wa7q7pndaxfkxi8qrzna4gs-system
> label: GNU with Linux-Libre 6.3.13
> bootloader: grub
> root device: UUID: ce7cdde8-a12b-4f1d-a605-d55aa31f92fd
> kernel: /gnu/store/224j20diq0qgxqzmh1hgsp35zi3qn9jc-linux-libre-6.3.13/bzImage
> channels:
> guix:
> repository URL: https://git.savannah.gnu.org/git/guix.git
> branch: master
> commit: d43b53c476b4e9322b31274b788e851d37e72302
> configuration file: /gnu/store/0c11jz30v8mkzqk0gzd93abp7z6x0637-configuration.scm
* The failing system generation
> Generation 25 Apr 16 2024 13:26:31 (current)
> file name: /var/guix/profiles/system-25-link
> canonical file name: /gnu/store/4wng095zf7j26pmr3hkq2pcbw3hjs6ai-system
> label: GNU with Linux-Libre 6.8.5
> bootloader: grub
> root device: UUID: ce7cdde8-a12b-4f1d-a605-d55aa31f92fd
> kernel: /gnu/store/4f7nszk7znn8knhs17c7hl1nyklx7s4s-linux-libre-6.8.5/bzImage
> channels:
> guix:
> repository URL: https://git.savannah.gnu.org/git/guix.git
> branch: master
> commit: a8353e9d6b34fd8d42d2e8f14ce844849fe9c293
> configuration file: /gnu/store/0rd73nfs8gvdadp6ja65779v2h8yx3kg-configuration.scm
* My system information:
```
christopher@galadriel ~$ neofetch --stdout
christopher@galadriel
---------------------
OS: Guix System x86_64
Host: OptiPlex 7010 01
Kernel: 6.8.5-gnu
Uptime: 1 hour, 25 mins
Packages: 59 (guix-system), 38 (guix-user)
Shell: bash 5.1.16
Terminal: /dev/pts/0
CPU: Intel i5-3570 (4) @ 3.800GHz
GPU: Intel HD Graphics
Memory: 437MiB / 15923MiB
```
--
📛 Christopher Howard
🚀 gemini://gem.librehacker.com
🌐 http://gem.librehacker.com
בראשית ברא אלהים את השמים ואת הארץ
^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#70429: agate service broken
2024-04-16 22:33 bug#70429: agate service broken Christopher Howard
@ 2024-04-17 16:53 ` Efraim Flashner
2024-10-31 21:44 ` Christopher Howard
1 sibling, 0 replies; 3+ messages in thread
From: Efraim Flashner @ 2024-04-17 16:53 UTC (permalink / raw)
To: 70429
[-- Attachment #1.1: Type: text/plain, Size: 283 bytes --]
Here's a potential patch. I'm not sure about how to deprecate fields
--
Efraim Flashner <efraim@flashner.co.il> רנשלפ םירפא
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
[-- Attachment #1.2: newer-agate-service.diff --]
[-- Type: text/plain, Size: 5480 bytes --]
diff --git a/doc/guix.texi b/doc/guix.texi
index f4f21c4744..852b2eb706 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -32510,10 +32510,9 @@ Web Services
@lisp
(service agate-service-type
- (agate-configuration
- (content "/srv/gemini")
- (cert "/srv/cert.pem")
- (key "/srv/key.rsa")))
+ (agate-configuration
+ (content "/srv/gemini")
+ (certs "/srv/gemini-certs")))
@end lisp
The example above represents the minimal tweaking necessary to get Agate
@@ -32544,13 +32543,10 @@ Web Services
@item @code{content} (default: @file{"/srv/gemini"})
The directory from which Agate will serve files.
-@item @code{cert} (default: @code{#f})
-The path to the TLS certificate PEM file to be used for encrypted
-connections. Must be filled in with a value from the user.
-
-@item @code{key} (default: @code{#f})
-The path to the PKCS8 private key file to be used for encrypted
-connections. Must be filled in with a value from the user.
+@item @code{certs} (default: @code{#f})
+The path to the directory containing the TLS certificate PEM and the PKCS8
+private key file to be used for encrypted connections. Must be filled in
+with a value from the user.
@item @code{addr} (default: @code{'("0.0.0.0:1965" "[::]:1965")})
A list of the addresses to listen on.
@@ -32561,8 +32557,9 @@ Web Services
@item @code{lang} (default: @code{#f})
RFC 4646 language code(s) for text/gemini documents. Optional.
-@item @code{silent?} (default: @code{#f})
-Set to @code{#t} to disable logging output.
+@item @code{only-tls13?} (default: @code{#f})
+Set to @code{#t} to allow only connections over TLS v1.3. By default TLS
+v1.2 is also allowed.
@item @code{serve-secret?} (default: @code{#f})
Set to @code{#t} to serve secret files (files/directories starting with
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 406117c457..57750e120b 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -302,12 +302,14 @@ (define-module (gnu services web)
agate-configuration?
agate-configuration-package
agate-configuration-content
- agate-configuration-cert
- agate-configuration-key
+ agate-configuration-cert ; deprecated
+ agate-configuration-key ; deprecated
+ agate-configuration-certs
agate-configuration-addr
agate-configuration-hostname
agate-configuration-lang
- agate-configuration-silent
+ agate-configuration-silent ; deprecated
+ agate-configuration-only-tls13
agate-configuration-serve-secret
agate-configuration-log-ip
agate-configuration-user
@@ -2181,6 +2183,8 @@ (define-record-type* <agate-configuration>
(default #f))
(key agate-configuration-key
(default #f))
+ (certs agate-configuration-certs
+ (default #f))
(addr agate-configuration-addr
(default '("0.0.0.0:1965" "[::]:1965")))
(hostname agate-configuration-hostname
@@ -2189,6 +2193,8 @@ (define-record-type* <agate-configuration>
(default #f))
(silent? agate-configuration-silent
(default #f))
+ (only-tls13? agate-configuration-only-tls13
+ (default #f))
(serve-secret? agate-configuration-serve-secret
(default #f))
(log-ip? agate-configuration-log-ip
@@ -2202,8 +2208,8 @@ (define-record-type* <agate-configuration>
(define agate-shepherd-service
(match-lambda
- (($ <agate-configuration> package content cert key addr
- hostname lang silent? serve-secret?
+ (($ <agate-configuration> package content cert key certs addr
+ hostname lang only-tls13? serve-secret?
log-ip? user group log-file)
(list (shepherd-service
(provision '(agate))
@@ -2213,8 +2219,13 @@ (define agate-shepherd-service
#~(make-forkexec-constructor
(list #$agate
"--content" #$content
- "--cert" #$cert
- "--key" #$key
+ #$@(if certs
+ (list "--certs" certs)
+ (if (and cert key
+ (equal? (dirname cert)
+ (dirname key)))
+ (list "--certs" (dirname cert))
+ '()))
"--addr" #$@addr
#$@(if lang
(list "--lang" lang)
@@ -2222,7 +2233,7 @@ (define agate-shepherd-service
#$@(if hostname
(list "--hostname" hostname)
'())
- #$@(if silent? '("--silent") '())
+ #$@(if only-tls13? '("--only-tls13") '())
#$@(if serve-secret? '("--serve-secret") '())
#$@(if log-ip? '("--log-ip") '()))
#:user #$user #:group #$group
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply related [flat|nested] 3+ messages in thread
* bug#70429: agate service broken
2024-04-16 22:33 bug#70429: agate service broken Christopher Howard
2024-04-17 16:53 ` Efraim Flashner
@ 2024-10-31 21:44 ` Christopher Howard
1 sibling, 0 replies; 3+ messages in thread
From: Christopher Howard @ 2024-10-31 21:44 UTC (permalink / raw)
To: Efraim Flashner; +Cc: 70429-done
I'm trying to close out my old bugs, and I think this one can be closed. The deprecated fields are no longer present in web.scm, so I guess that must have been fixed.
--
Christopher Howard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-11-01 10:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-16 22:33 bug#70429: agate service broken Christopher Howard
2024-04-17 16:53 ` Efraim Flashner
2024-10-31 21:44 ` Christopher Howard
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).