diff options
Diffstat (limited to 'guix/vkraus/services/webid-oidc.scm')
-rw-r--r-- | guix/vkraus/services/webid-oidc.scm | 119 |
1 files changed, 119 insertions, 0 deletions
diff --git a/guix/vkraus/services/webid-oidc.scm b/guix/vkraus/services/webid-oidc.scm new file mode 100644 index 0000000..4c7834c --- /dev/null +++ b/guix/vkraus/services/webid-oidc.scm @@ -0,0 +1,119 @@ +(define-module (vkraus services webid-oidc) + #:use-module (gnu services) + #:use-module (gnu services shepherd) + #:use-module (gnu system shadow) + #:use-module (gnu packages admin) + #:use-module (vkraus packages webid-oidc) + #:use-module (guix gexp) + #:use-module (guix modules) + #:use-module (guix records) + #:use-module (ice-9 match) + #:use-module (ice-9 optargs)) + +(define-record-type* <webid-oidc-issuer-configuration> + webid-oidc-issuer-configuration + make-webid-oidc-issuer-configuration + webid-oidc-issuer-configuration? + (webid-oidc webid-oidc-issuer-configuration-webid-oidc + (default webid-oidc)) + (issuer webid-oidc-issuer-configuration-issuer) + (key-file webid-oidc-issuer-configuration-key-file + (default "/var/lib/webid-oidc/issuer/key.jwk")) + (subject webid-oidc-issuer-configuration-subject) + (password webid-oidc-issuer-configuration-password) + (jwks-uri webid-oidc-issuer-configuration-jwks-uri) + (authorization-endpoint-uri + webid-oidc-issuer-configuration-authorization-endpoint-uri) + (token-endpoint-uri + webid-oidc-issuer-configuration-token-endpoint-uri) + (port webid-oidc-issuer-configuration-port (default 8088)) + (extra-options + webid-oidc-issuer-configuration-extra-options + (default '()))) + +(export <webid-oidc-issuer-configuration> + webid-oidc-issuer-configuration + make-webid-oidc-issuer-configuration + webid-oidc-issuer-configuration? + webid-oidc-issuer-configuration-webid-oidc + webid-oidc-issuer-configuration-issuer + webid-oidc-issuer-configuration-key-file + webid-oidc-issuer-configuration-subject + webid-oidc-issuer-configuration-password + webid-oidc-issuer-configuration-jwks-uri + webid-oidc-issuer-configuration-authorization-endpoint-uri + webid-oidc-issuer-configuration-token-endpoint-uri + webid-oidc-issuer-configuration-port + webid-oidc-issuer-configuration-extra-options) + +(define webid-oidc-issuer-shepherd-service + (match-lambda + (($ <webid-oidc-issuer-configuration> + webid-oidc issuer key-file subject password jwks-uri + authorization-endpoint-uri token-endpoint-uri port + extra-options) + (with-imported-modules + (source-module-closure + '((gnu build shepherd) + (gnu system file-systems))) + (list (shepherd-service + (provision '(webid-oidc-issuer)) + (documentation "Run the Solid identity provider.") + (requirement '(user-processes)) + (modules '((gnu build shepherd) + (gnu system file-systems))) + (start + #~(begin + (let* ((user (getpwnam "webid-oidc-issuer")) + (prepare-directory + (lambda (dir) + (mkdir-p dir) + (chown dir (passwd:uid user) (passwd:gid user)) + (chmod dir #o700)))) + (prepare-directory "/var/log/webid-oidc") + (prepare-directory "/var/lib/webid-oidc") + (prepare-directory "/var/cache/webid-oidc")) + (make-forkexec-constructor + (list + (string-append #$webid-oidc "/bin/webid-oidc-issuer") + "--issuer" #$issuer + "--key-file" #$key-file + "--subject" #$subject + "--password" #$password + "--jwks-uri" #$jwks-uri + "--authorization-endpoint-uri" #$authorization-endpoint-uri + "--token-endpoint-uri" #$token-endpoint-uri + "--port" (with-output-to-string (lambda () (display #$port))) + "--log-file" "issuer.log" + "--error-file" "issuer.err" + #$@extra-options) + #:user "webid-oidc-issuer" + #:group "webid-oidc-issuer" + #:directory "/var/log/webid-oidc" + #:environment-variables + `("XDG_DATA_HOME=/var/lib" + "XDG_CACHE_HOME=/var/cache" + "LANG=C")))) + (stop #~(make-kill-destructor)))))))) + +(define %webid-oidc-issuer-accounts + (list (user-group (name "webid-oidc-issuer") + (system? #t)) + (user-account + (name "webid-oidc-issuer") + (group "webid-oidc-issuer") + (system? #t) + (comment "The user that runs the webid-oidc issuer.") + (home-directory "/var/empty") + (shell (file-append shadow "/sbin/nologin"))))) + +(define-public webid-oidc-issuer-service-type + (service-type + (name 'webid-oidc-issuer) + (extensions + (list + (service-extension account-service-type + (const %webid-oidc-issuer-accounts)) + (service-extension + shepherd-root-service-type + webid-oidc-issuer-shepherd-service))))) |