diff options
Diffstat (limited to 'guix/vkraus/services/webid-oidc.scm')
| -rw-r--r-- | guix/vkraus/services/webid-oidc.scm | 520 |
1 files changed, 0 insertions, 520 deletions
diff --git a/guix/vkraus/services/webid-oidc.scm b/guix/vkraus/services/webid-oidc.scm deleted file mode 100644 index c20c550..0000000 --- a/guix/vkraus/services/webid-oidc.scm +++ /dev/null @@ -1,520 +0,0 @@ -;; webid-oidc, implementation of the Solid specification -;; Copyright (C) 2020, 2021 Vivien Kraus - -;; This program is free software: you can redistribute it and/or modify -;; it under the terms of the GNU Affero General Public License as -;; published by the Free Software Foundation, either version 3 of the -;; License, or (at your option) any later version. - -;; This program is distributed in the hope that it will be useful, -;; but WITHOUT ANY WARRANTY; without even the implied warranty of -;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -;; GNU Affero General Public License for more details. - -;; You should have received a copy of the GNU Affero General Public License -;; along with this program. If not, see <https://www.gnu.org/licenses/>. - -(define-module (vkraus services webid-oidc) - #:use-module (gnu services) - #:use-module (gnu services shepherd) - #:use-module (gnu services admin) - #:use-module (gnu services web) - #:use-module (gnu system shadow) - #:use-module (gnu packages admin) - #:use-module (vkraus packages webid-oidc) - #:use-module (guix gexp) - #:use-module (guix modules) - #:use-module (guix records) - #:use-module (ice-9 match) - #:use-module (ice-9 optargs)) - -(define-record-type* <webid-oidc-issuer-configuration> - webid-oidc-issuer-configuration - make-webid-oidc-issuer-configuration - webid-oidc-issuer-configuration? - (webid-oidc webid-oidc-issuer-configuration-webid-oidc - (default webid-oidc)) - (complete-corresponding-source - webid-oidc-issuer-configuration-complete-corresponding-source) - (issuer webid-oidc-issuer-configuration-issuer) - (key-file webid-oidc-issuer-configuration-key-file - (default "/var/lib/webid-oidc/issuer/key.jwk")) - (subject webid-oidc-issuer-configuration-subject) - (encrypted-password webid-oidc-issuer-configuration-encrypted-password) - (jwks-uri webid-oidc-issuer-configuration-jwks-uri) - (authorization-endpoint-uri - webid-oidc-issuer-configuration-authorization-endpoint-uri) - (token-endpoint-uri - webid-oidc-issuer-configuration-token-endpoint-uri) - (port webid-oidc-issuer-configuration-port (default 8088)) - (extra-options - webid-oidc-issuer-configuration-extra-options - (default '()))) - -(define-record-type* <webid-oidc-reverse-proxy-configuration> - webid-oidc-reverse-proxy-configuration - make-webid-oidc-reverse-proxy-configuration - webid-oidc-reverse-proxy-configuration? - (webid-oidc webid-oidc-reverse-proxy-configuration-webid-oidc - (default webid-oidc)) - (complete-corresponding-source - webid-oidc-reverse-proxy-configuration-complete-corresponding-source) - (port webid-oidc-reverse-proxy-port (default 8090)) - (inbound-uri webid-oidc-reverse-proxy-configuration-inbound-uri) - (outbound-uri webid-oidc-reverse-proxy-configuration-outbound-uri) - (header webid-oidc-reverse-proxy-configuration-header - (default "XXX-Agent")) - (extra-options - webid-oidc-reverse-proxy-extra-options - (default '()))) - -(define-record-type* <webid-oidc-hello-configuration> - webid-oidc-hello-configuration - make-webid-oidc-hello-configuration - webid-oidc-hello-configuration? - (webid-oidc webid-oidc-hello-configuration-webid-oidc - (default webid-oidc)) - (complete-corresponding-source - webid-oidc-hello-configuration-complete-corresponding-source) - (port webid-oidc-hello-configuration-port (default 8089)) - (extra-options - webid-oidc-hello-configuration-extra-options - (default '()))) - -(define-record-type* <webid-oidc-client-service-configuration> - webid-oidc-client-service-configuration - make-webid-oidc-client-service-configuration - webid-oidc-client-service-configuration? - (webid-oidc webid-oidc-client-service-configuration-webid-oidc - (default webid-oidc)) - (complete-corresponding-source - webid-oidc-client-service-configuration-complete-corresponding-source) - (client-id webid-oidc-client-service-configuration-client-id) - (redirect-uri webid-oidc-client-service-configuration-redirect-uri) - (client-name webid-oidc-client-service-configuration-client-name (default "Example Solid App")) - (client-uri webid-oidc-client-service-configuration-client-uri (default "https://webid-oidc.planete-kraus.eu/Running-a-client.html#Running-a-client")) - (port webid-oidc-client-service-configuration-port (default 8088)) - (extra-options - webid-oidc-client-service-configuration-extra-options - (default '()))) - -(define-record-type* <webid-oidc-server-configuration> - webid-oidc-server-configuration - make-webid-oidc-server-configuration - webid-oidc-server-configuration? - (webid-oidc webid-oidc-server-configuration-webid-oidc - (default webid-oidc)) - (complete-corresponding-source - webid-oidc-server-configuration-complete-corresponding-source) - (server-name webid-oidc-server-configuration-server-name) - (key-file webid-oidc-server-configuration-key-file - (default "/var/lib/webid-oidc/server/key.jwk")) - (subject webid-oidc-server-configuration-subject) - (encrypted-password webid-oidc-server-configuration-encrypted-password) - (jwks-uri webid-oidc-server-configuration-jwks-uri) - (authorization-endpoint-uri - webid-oidc-server-configuration-authorization-endpoint-uri) - (token-endpoint-uri - webid-oidc-server-configuration-token-endpoint-uri) - (port webid-oidc-server-configuration-port (default 8088)) - (extra-options - webid-oidc-issuer-configuration-extra-options - (default '()))) - -(export <webid-oidc-issuer-configuration> - webid-oidc-issuer-configuration - make-webid-oidc-issuer-configuration - webid-oidc-issuer-configuration? - webid-oidc-issuer-configuration-webid-oidc - webid-oidc-issuer-configuration-complete-corresponding-source - webid-oidc-issuer-configuration-issuer - webid-oidc-issuer-configuration-key-file - webid-oidc-issuer-configuration-subject - webid-oidc-issuer-configuration-encrypted-password - webid-oidc-issuer-configuration-jwks-uri - webid-oidc-issuer-configuration-authorization-endpoint-uri - webid-oidc-issuer-configuration-token-endpoint-uri - webid-oidc-issuer-configuration-port - webid-oidc-issuer-configuration-extra-options - <webid-oidc-reverse-proxy-configuration> - webid-oidc-reverse-proxy-configuration - make-webid-oidc-reverse-proxy-configuration - webid-oidc-reverse-proxy-configuration? - webid-oidc-reverse-proxy-configuration-webid-oidc - webid-oidc-reverse-proxy-configuration-complete-corresponding-source - webid-oidc-reverse-proxy-configuration-port - webid-oidc-reverse-proxy-configuration-inbound-uri - webid-oidc-reverse-proxy-configuration-outbound-uri - webid-oidc-reverse-proxy-configuration-header - webid-oidc-reverse-proxy-configuration-extra-options - <webid-oidc-hello-configuration> - webid-oidc-hello-configuration - make-webid-oidc-hello-configuration - webid-oidc-hello-configuration? - webid-oidc-hello-configuration-webid-oidc - webid-oidc-hello-configuration-complete-corresponding-source - webid-oidc-hello-configuration-port - webid-oidc-hello-configuration-extra-options - <webid-oidc-client-service-configuration> - webid-oidc-client-service-configuration - make-webid-oidc-client-service-configuration - webid-oidc-client-service-configuration? - webid-oidc-client-service-configuration-webid-oidc - webid-oidc-client-service-configuration-complete-corresponding-source - webid-oidc-client-service-configuration-client-id - webid-oidc-client-service-configuration-redirect-uri - webid-oidc-client-service-configuration-client-name - webid-oidc-client-service-configuration-client-uri - webid-oidc-client-service-configuration-port - webid-oidc-client-service-configuration-extra-options - <webid-oidc-server-configuration> - webid-oidc-server-configuration - make-webid-oidc-server-configuration - webid-oidc-server-configuration? - webid-oidc-server-configuration-webid-oidc - webid-oidc-server-configuration-complete-corresponding-source - webid-oidc-server-configuration-server-name - webid-oidc-server-configuration-key-file - webid-oidc-server-configuration-subject - webid-oidc-server-configuration-encrypted-password - webid-oidc-server-configuration-jwks-uri - webid-oidc-server-configuration-authorization-endpoint-uri - webid-oidc-server-configuration-token-endpoint-uri - webid-oidc-server-configuration-port - webid-oidc-server-configuration-extra-options) - -(define webid-oidc-issuer-shepherd-service - (match-lambda - (($ <webid-oidc-issuer-configuration> - webid-oidc ccs issuer key-file subject encrypted-password jwks-uri - authorization-endpoint-uri token-endpoint-uri port - extra-options) - (with-imported-modules - (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(webid-oidc-issuer)) - (documentation "Run the Solid identity provider.") - (requirement '(user-processes)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start - #~(begin - (let* ((user (getpwnam "webid-oidc")) - (prepare-directory - (lambda (dir) - (mkdir-p dir) - (chown dir (passwd:uid user) (passwd:gid user)) - (chmod dir #o700)))) - (prepare-directory "/var/log/webid-oidc") - (prepare-directory "/var/lib/webid-oidc") - (prepare-directory "/var/cache/webid-oidc")) - (make-forkexec-constructor - (list - (string-append #$webid-oidc "/bin/webid-oidc") - "identity-provider" - "--complete-corresponding-source" #$ccs - "--server-name" #$issuer - "--key-file" #$key-file - "--subject" #$subject - "--encrypted-password" #$encrypted-password - "--jwks-uri" #$jwks-uri - "--authorization-endpoint-uri" #$authorization-endpoint-uri - "--token-endpoint-uri" #$token-endpoint-uri - "--port" (with-output-to-string (lambda () (display #$port))) - "--log-file" "issuer.log" - "--error-file" "issuer.err" - #$@extra-options) - #:user "webid-oidc" - #:group "webid-oidc" - #:directory "/var/log/webid-oidc" - #:environment-variables - `("XDG_DATA_HOME=/var/lib" - "XDG_CACHE_HOME=/var/cache" - "LANG=C")))) - (stop #~(make-kill-destructor)))))))) - -(define webid-oidc-reverse-proxy-shepherd-service - (match-lambda - (($ <webid-oidc-reverse-proxy-configuration> - webid-oidc ccs port inbound-uri outbound-uri header - extra-options) - (with-imported-modules - (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(webid-oidc-reverse-proxy)) - (documentation "Run a proxy to authenticate with Solid.") - (requirement '(user-processes)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start - #~(begin - (let* ((user (getpwnam "webid-oidc")) - (prepare-directory - (lambda (dir) - (mkdir-p dir) - (chown dir (passwd:uid user) (passwd:gid user)) - (chmod dir #o700)))) - (prepare-directory "/var/log/webid-oidc") - (prepare-directory "/var/lib/webid-oidc") - (prepare-directory "/var/cache/webid-oidc")) - (make-forkexec-constructor - (list - (string-append #$webid-oidc "/bin/webid-oidc") - "reverse-proxy" - "--complete-corresponding-source" #$ccs - "--port" (with-output-to-string (lambda () (display #$port))) - "--server-name" #$inbound-uri - "--backend-uri" #$outbound-uri - "--header" #$header - "--log-file" "reverse-proxy.log" - "--error-file" "reverse-proxy.err" - #$@extra-options) - #:user "webid-oidc" - #:group "webid-oidc" - #:directory "/var/log/webid-oidc" - #:environment-variables - `("XDG_DATA_HOME=/var/lib" - "XDG_CACHE_HOME=/var/cache" - "LANG=C")))) - (stop #~(make-kill-destructor)))))))) - -(define webid-oidc-hello-shepherd-service - (match-lambda - (($ <webid-oidc-hello-configuration> - webid-oidc ccs port extra-options) - (with-imported-modules - (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(webid-oidc-hello)) - (documentation "Run a demonstration Solid server.") - (requirement '(user-processes)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start - #~(begin - (let* ((user (getpwnam "webid-oidc")) - (prepare-directory - (lambda (dir) - (mkdir-p dir) - (chown dir (passwd:uid user) (passwd:gid user)) - (chmod dir #o700)))) - (prepare-directory "/var/log/webid-oidc") - (prepare-directory "/var/lib/webid-oidc") - (prepare-directory "/var/cache/webid-oidc")) - (make-forkexec-constructor - (list - (string-append #$webid-oidc "/bin/webid-oidc-hello") - "--complete-corresponding-source" #$ccs - "--port" (with-output-to-string (lambda () (display #$port))) - "--log-file" "hello.log" - "--error-file" "hello.err" - #$@extra-options) - #:user "webid-oidc" - #:group "webid-oidc" - #:directory "/var/log/webid-oidc" - #:environment-variables - `("XDG_DATA_HOME=/var/lib" - "XDG_CACHE_HOME=/var/cache" - "LANG=C")))) - (stop #~(make-kill-destructor)))))))) - -(define webid-oidc-client-service-shepherd-service - (match-lambda - (($ <webid-oidc-client-service-configuration> - webid-oidc ccs client-id redirect-uri client-name client-uri port - extra-options) - (with-imported-modules - (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(webid-oidc-client-service)) - (documentation "Run a server for a Solid application.") - (requirement '(user-processes)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start - #~(begin - (let* ((user (getpwnam "webid-oidc")) - (prepare-directory - (lambda (dir) - (mkdir-p dir) - (chown dir (passwd:uid user) (passwd:gid user)) - (chmod dir #o700)))) - (prepare-directory "/var/log/webid-oidc")) - (make-forkexec-constructor - (list - (string-append #$webid-oidc "/bin/webid-oidc") - "client-service" - "--complete-corresponding-source" #$ccs - "--client-id" #$client-id - "--redirect-uri" #$redirect-uri - "--client-name" #$client-name - "--client-uri" #$client-uri - "--port" (with-output-to-string (lambda () (display #$port))) - "--log-file" "client-service.log" - "--error-file" "client-service.err" - #$@extra-options) - #:user "webid-oidc" - #:group "webid-oidc" - #:directory "/var/log/webid-oidc" - #:environment-variables - `("LANG=C")))) - (stop #~(make-kill-destructor)))))))) - -(define webid-oidc-server-shepherd-service - (match-lambda - (($ <webid-oidc-server-configuration> - webid-oidc ccs server-name key-file subject encrypted-password jwks-uri - authorization-endpoint-uri token-endpoint-uri port - extra-options) - (with-imported-modules - (source-module-closure - '((gnu build shepherd) - (gnu system file-systems))) - (list (shepherd-service - (provision '(webid-oidc-server)) - (documentation "Run the full Solid server.") - (requirement '(user-processes)) - (modules '((gnu build shepherd) - (gnu system file-systems))) - (start - #~(begin - (let* ((user (getpwnam "webid-oidc")) - (prepare-directory - (lambda (dir) - (mkdir-p dir) - (chown dir (passwd:uid user) (passwd:gid user)) - (chmod dir #o700)))) - (prepare-directory "/var/log/webid-oidc") - (prepare-directory "/var/lib/webid-oidc") - (prepare-directory "/var/cache/webid-oidc")) - (make-forkexec-constructor - (list - (string-append #$webid-oidc "/bin/webid-oidc") - "server" - "--complete-corresponding-source" #$ccs - "--server-name" #$server-name - "--key-file" #$key-file - "--subject" #$subject - "--encrypted-password" #$encrypted-password - "--jwks-uri" #$jwks-uri - "--authorization-endpoint-uri" #$authorization-endpoint-uri - "--token-endpoint-uri" #$token-endpoint-uri - "--port" (with-output-to-string (lambda () (display #$port))) - "--log-file" "server.log" - "--error-file" "server.err" - #$@extra-options) - #:user "webid-oidc" - #:group "webid-oidc" - #:directory "/var/log/webid-oidc" - #:environment-variables - `("XDG_DATA_HOME=/var/lib" - "XDG_CACHE_HOME=/var/cache" - "LANG=C")))) - (stop #~(make-kill-destructor)))))))) - -(define %webid-oidc-accounts - (list (user-group (name "webid-oidc") - (system? #t)) - (user-account - (name "webid-oidc") - (group "webid-oidc") - (system? #t) - (comment "The user that runs the webid-oidc issuer and resource server.") - (home-directory "/var/empty") - (shell (file-append shadow "/sbin/nologin"))))) - -(define (%webid-oidc-log-rotation file) - (list (log-rotation - (frequency 'daily) - (files - (map (lambda (ext) (string-append "/var/log/webid-oidc/" file "." ext)) - '("log" "err"))) - (options '("sharedscripts" - "storedir /var/log/webid-oidc"))))) - -(define-public webid-oidc-issuer-service-type - (service-type - (name 'webid-oidc-issuer) - (extensions - (list - (service-extension account-service-type - (const %webid-oidc-accounts)) - (service-extension rottlog-service-type - (const (%webid-oidc-log-rotation "issuer"))) - (service-extension - shepherd-root-service-type - webid-oidc-issuer-shepherd-service))))) - -(define-public webid-oidc-reverse-proxy-service-type - (service-type - (name 'webid-oidc-reverse-proxy) - (extensions - (list - (service-extension account-service-type - (const %webid-oidc-accounts)) - (service-extension rottlog-service-type - (const (%webid-oidc-log-rotation "reverse-proxy"))) - (service-extension - shepherd-root-service-type - webid-oidc-reverse-proxy-shepherd-service))))) - -(define-public webid-oidc-hello-service-type - (service-type - (name 'webid-oidc-hello) - (extensions - (list - (service-extension account-service-type - (const %webid-oidc-accounts)) - (service-extension rottlog-service-type - (const (%webid-oidc-log-rotation "hello"))) - (service-extension - shepherd-root-service-type - webid-oidc-hello-shepherd-service))))) - -(define-public webid-oidc-client-service-service-type - (service-type - (name 'webid-oidc-client-service) - (extensions - (list - (service-extension account-service-type - (const %webid-oidc-accounts)) - (service-extension rottlog-service-type - (const (%webid-oidc-log-rotation "client-service"))) - (service-extension - shepherd-root-service-type - webid-oidc-client-service-shepherd-service))))) - -(define-public webid-oidc-server-service-type - (service-type - (name 'webid-oidc-server) - (extensions - (list - (service-extension account-service-type - (const %webid-oidc-accounts)) - (service-extension rottlog-service-type - (const (%webid-oidc-log-rotation "server"))) - (service-extension - shepherd-root-service-type - webid-oidc-server-shepherd-service))))) - -(define-public webid-oidc-website - (nginx-server-configuration - (server-name '("webid-oidc.planete-kraus.eu")) - (listen '("443 ssl" "[::]:443 ssl")) - (ssl-certificate "/etc/letsencrypt/live/planete-kraus.eu/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/planete-kraus.eu/privkey.pem") - (root webid-oidc:website) - (locations - (list - (nginx-location-configuration - (uri "/project") - (body - (list "default_type text/turtle ;"))))))) |