From: Dale Mellor <guix-devel-0brg6a@rdmp.org>
To: 68621@debbugs.gnu.org
Cc: hello@lnikki.la
Subject: [bug#68621] [PATCH v2 3/4] services: knot-resolver: Use default DNSSEC trust anchors.
Date: Tue, 23 Apr 2024 17:12:25 +0100 [thread overview]
Message-ID: <20240423161226.973140-3-guix-devel-0brg6a@rdmp.org> (raw)
In-Reply-To: <20240120212542.17473-1-hello@lnikki.la>
From: Leo Nikkilä <hello@lnikki.la>
* gnu/services/dns.scm (%kresd.conf): Use default anchors.
(knot-resolver-activation): Install default anchors when missing.
---
gnu/services/dns.scm | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/gnu/services/dns.scm b/gnu/services/dns.scm
index 6608046909..f83c5b6594 100644
--- a/gnu/services/dns.scm
+++ b/gnu/services/dns.scm
@@ -655,7 +655,6 @@ (define-record-type* <knot-resolver-configuration>
(define %kresd.conf
(plain-file "kresd.conf" "-- -*- mode: lua -*-
-trust_anchors.add_file('/var/cache/knot-resolver/root.keys')
net = { '127.0.0.1', '::1' }
user('knot-resolver', 'knot-resolver')
modules = { 'hints > iterate', 'stats', 'predict' }
@@ -676,10 +675,20 @@ (define %knot-resolver-accounts
(define (knot-resolver-activation config)
#~(begin
(use-modules (guix build utils))
- (let ((rundir "/var/cache/knot-resolver")
- (owner (getpwnam "knot-resolver")))
+ (let* ((rundir "/var/cache/knot-resolver")
+ (keyfile (string-append rundir "/root.keys"))
+ (owner (getpwnam "knot-resolver")))
(mkdir-p rundir)
- (chown rundir (passwd:uid owner) (passwd:gid owner)))))
+ (chown rundir (passwd:uid owner) (passwd:gid owner))
+
+ ;; Install initial trust anchors when missing.
+ (unless (file-exists? keyfile)
+ (copy-file #$(file-append (knot-resolver-configuration-package
+ config)
+ "/etc/knot-resolver/root.keys")
+ keyfile)
+ (chown keyfile (passwd:uid owner) (passwd:gid owner))
+ (chmod keyfile #o755)))))
(define knot-resolver-shepherd-services
(match-lambda
--
2.41.0
next prev parent reply other threads:[~2024-04-23 16:15 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-20 21:23 [bug#68621] [PATCH 0/2] Provide default DNSSEC trust anchors for knot-resolver Leo Nikkilä via Guix-patches via
2024-01-20 21:23 ` [bug#68620] [PATCH 1/2] gnu: knot-resolver: Re-enable default DNSSEC trust anchors Leo Nikkilä via Guix-patches via
2024-04-23 16:04 ` [bug#68620] Moved into 68621 Dale Mellor
2024-04-23 16:21 ` Dale Mellor
2024-01-20 21:23 ` [bug#68622] [PATCH 2/2] services: knot-resolver: Use default DNSSEC trust anchors Leo Nikkilä via Guix-patches via
2024-04-23 16:05 ` [bug#68622] Moved to 68621 Dale Mellor
2024-04-23 16:22 ` [bug#68622] Moved into 68621 Dale Mellor
2024-01-20 21:37 ` [bug#68621] [PATCH 0/2] Provide default DNSSEC trust anchors for knot-resolver Leo Nikkilä via Guix-patches via
2024-04-23 15:59 ` [bug#68621] Consolidating patches under this one issue number Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 1/4] gnu: knot-resolver: Re-enable default DNSSEC trust anchors Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 2/4] gnu: knot-resolver: Appease some guix lint complaints Dale Mellor
2024-04-23 16:12 ` Dale Mellor [this message]
2024-04-23 16:12 ` [bug#68621] [PATCH v2 4/4] gnu: knot-resolver: version to 5.7.2 Dale Mellor
2024-04-23 18:33 ` [bug#68621] [PATCH v2 0/4] Allow use of DNSSEC in knot-resolver service Dale Mellor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240423161226.973140-3-guix-devel-0brg6a@rdmp.org \
--to=guix-devel-0brg6a@rdmp.org \
--cc=68621@debbugs.gnu.org \
--cc=hello@lnikki.la \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).