services: Add openntpd service.
* gnu/packages/ntp.scm (openntpd)[arguments]: Add 'configure-flags to set openntpd daemon's user and localstatedir. Add a custom phase to not try to create said directory at install time. * gnu/services/networking.scm (<openntpd-configuration>): New record type. (openntpd-shepherd-service, openntpd-service-activation): New procedures. (openntpd-service-type): New variable. * doc/guix.texi (Networking Services): Add openntpd documentation.
This commit is contained in:
Efraim Flashner
parent
ac1a9ce8b0
commit
16718b6776
|
|
@ -24,7 +24,7 @@ Copyright @copyright{} 2015, 2016, 2017 Leo Famulari@*
|
|||
Copyright @copyright{} 2015, 2016, 2017, 2018 Ricardo Wurmus@*
|
||||
Copyright @copyright{} 2016 Ben Woodcroft@*
|
||||
Copyright @copyright{} 2016, 2017 Chris Marusich@*
|
||||
Copyright @copyright{} 2016, 2017 Efraim Flashner@*
|
||||
Copyright @copyright{} 2016, 2017, 2018 Efraim Flashner@*
|
||||
Copyright @copyright{} 2016 John Darrington@*
|
||||
Copyright @copyright{} 2016, 2017 ng0@*
|
||||
Copyright @copyright{} 2016, 2017 Jan Nieuwenhuizen@*
|
||||
|
|
@ -10767,6 +10767,59 @@ make an initial adjustment of more than 1,000 seconds.
|
|||
List of host names used as the default NTP servers.
|
||||
@end defvr
|
||||
|
||||
@cindex OpenNTPD
|
||||
@deffn {Scheme Procedure} openntpd-service-type
|
||||
Run the @command{ntpd}, the Network Time Protocol (NTP) daemon, as implemented
|
||||
by @uref{http://www.openntpd.org, OpenNTPD}. The daemon will keep the system
|
||||
clock synchronized with that of the given servers.
|
||||
|
||||
@example
|
||||
(service
|
||||
openntpd-service-type
|
||||
(openntpd-configuration
|
||||
(listen-on '("127.0.0.1" "::1"))
|
||||
(sensor '("udcf0 correction 70000"))
|
||||
(constraint-from '("www.gnu.org"))
|
||||
(constraints-from '("https://www.google.com/"))
|
||||
(allow-large-adjustment? #t)))
|
||||
|
||||
@end example
|
||||
@end deffn
|
||||
|
||||
@deftp {Data Type} openntpd-configuration
|
||||
@table @asis
|
||||
@item @code{openntpd} (default: @code{(file-append openntpd "/sbin/ntpd")})
|
||||
The openntpd executable to use.
|
||||
@item @code{listen-on} (default: @code{'("127.0.0.1" "::1")})
|
||||
A list of local IP addresses or hostnames the ntpd daemon should listen on.
|
||||
@item @code{query-from} (default: @code{'()})
|
||||
A list of local IP address the ntpd daemon should use for outgoing queries.
|
||||
@item @code{sensor} (default: @code{'()})
|
||||
Specify a list of timedelta sensor devices ntpd should use. @code{ntpd}
|
||||
will listen to each sensor that acutally exists and ignore non-existant ones.
|
||||
See @uref{https://man.openbsd.org/ntpd.conf, upstream documentation} for more
|
||||
information.
|
||||
@item @code{server} (default: @var{%ntp-servers})
|
||||
Specify a list of IP addresses or hostnames of NTP servers to synchronize to.
|
||||
@item @code{servers} (default: @code{'()})
|
||||
Specify a list of IP addresses or hostnames of NTP pools to synchronize to.
|
||||
@item @code{constraint-from} (default: @code{'()})
|
||||
@code{ntpd} can be configured to query the ‘Date’ from trusted HTTPS servers via TLS.
|
||||
This time information is not used for precision but acts as an authenticated
|
||||
constraint, thereby reducing the impact of unauthenticated NTP
|
||||
man-in-the-middle attacks.
|
||||
Specify a list of URLs, IP addresses or hostnames of HTTPS servers to provide
|
||||
a constraint.
|
||||
@item @code{constraints-from} (default: @code{'()})
|
||||
As with constraint from, specify a list of URLs, IP addresses or hostnames of
|
||||
HTTPS servers to provide a constraint. Should the hostname resolve to multiple
|
||||
IP addresses, @code{ntpd} will calculate a median constraint from all of them.
|
||||
@item @code{allow-large-adjustment?} (default: @code{#f})
|
||||
Determines if @code{ntpd} is allowed to make an initial adjustment of more
|
||||
than 180 seconds.
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@cindex inetd
|
||||
@deffn {Scheme variable} inetd-service-type
|
||||
This service runs the @command{inetd} (@pxref{inetd invocation,,,
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
|
||||
;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
|
||||
;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
|
||||
;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
|
||||
;;; Copyright © 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
|
@ -107,6 +107,17 @@ computers over a network.")
|
|||
(base32
|
||||
"0fn12i4kzsi0zkr4qp3dp9bycmirnfapajqvdfx02zhr4hanj0kv"))))
|
||||
(build-system gnu-build-system)
|
||||
(arguments
|
||||
'(#:configure-flags '("--with-privsep-user=ntpd"
|
||||
"--localstatedir=/var")
|
||||
#:phases
|
||||
(modify-phases %standard-phases
|
||||
(add-after 'unpack 'modify-install-locations
|
||||
(lambda _
|
||||
;; Don't try to create /var/run or /var/db
|
||||
(substitute* "src/Makefile.in"
|
||||
(("DESTDIR\\)\\$\\(localstatedir") "TMPDIR"))
|
||||
#t)))))
|
||||
(inputs
|
||||
`(("libressl" ,libressl))) ; enable TLS time constraints. See ntpd.conf(5).
|
||||
(home-page "http://www.openntpd.org/")
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
;;; GNU Guix --- Functional package management for GNU
|
||||
;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
|
||||
;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
|
||||
;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
|
||||
;;; Copyright © 2016, 2018 Efraim Flashner <efraim@flashner.co.il>
|
||||
;;; Copyright © 2016 John Darrington <jmd@gnu.org>
|
||||
;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
|
||||
;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
|
||||
|
|
@ -64,6 +64,10 @@
|
|||
ntp-service
|
||||
ntp-service-type
|
||||
|
||||
openntpd-configuration
|
||||
openntpd-configuration?
|
||||
openntpd-service-type
|
||||
|
||||
inetd-configuration
|
||||
inetd-entry
|
||||
inetd-service-type
|
||||
|
|
@ -446,6 +450,102 @@ make an initial adjustment of more than 1,000 seconds."
|
|||
(allow-large-adjustment?
|
||||
allow-large-adjustment?))))
|
||||
|
||||
|
||||
;;;
|
||||
;;; OpenNTPD.
|
||||
;;;
|
||||
|
||||
(define-record-type* <openntpd-configuration>
|
||||
openntpd-configuration make-openntpd-configuration
|
||||
openntpd-configuration?
|
||||
(openntpd openntpd-configuration-openntpd
|
||||
(default openntpd))
|
||||
(listen-on openntpd-listen-on
|
||||
(default '("127.0.0.1"
|
||||
"::1")))
|
||||
(query-from openntpd-query-from
|
||||
(default '()))
|
||||
(sensor openntpd-sensor
|
||||
(default '()))
|
||||
(server openntpd-server
|
||||
(default %ntp-servers))
|
||||
(servers openntpd-servers
|
||||
(default '()))
|
||||
(constraint-from openntpd-constraint-from
|
||||
(default '()))
|
||||
(constraints-from openntpd-constraints-from
|
||||
(default '()))
|
||||
(allow-large-adjustment? openntpd-allow-large-adjustment?
|
||||
(default #f))) ; upstream default
|
||||
|
||||
(define (openntpd-shepherd-service config)
|
||||
(match-record config <openntpd-configuration>
|
||||
(openntpd listen-on query-from sensor server servers constraint-from
|
||||
constraints-from allow-large-adjustment?)
|
||||
(let ()
|
||||
(define config
|
||||
(string-join
|
||||
(filter-map
|
||||
(lambda (field value)
|
||||
(string-join
|
||||
(map (cut string-append field <> "\n")
|
||||
value)))
|
||||
'("listen on " "query from " "sensor " "server " "servers "
|
||||
"constraint from ")
|
||||
(list listen-on query-from sensor server servers constraint-from))
|
||||
;; The 'constraints from' field needs to be enclosed in double quotes.
|
||||
(string-join
|
||||
(map (cut string-append "constraints from \"" <> "\"\n")
|
||||
constraints-from))))
|
||||
|
||||
(define ntpd.conf
|
||||
(plain-file "ntpd.conf" config))
|
||||
|
||||
(list (shepherd-service
|
||||
(provision '(ntpd))
|
||||
(documentation "Run the Network Time Protocol (NTP) daemon.")
|
||||
(requirement '(user-processes networking))
|
||||
(start #~(make-forkexec-constructor
|
||||
(list (string-append #$openntpd "/sbin/ntpd")
|
||||
"-f" #$ntpd.conf
|
||||
"-d" ;; don't daemonize
|
||||
#$@(if allow-large-adjustment?
|
||||
'("-s")
|
||||
'()))
|
||||
;; When ntpd is daemonized it repeatedly tries to respawn
|
||||
;; while running, leading shepherd to disable it. To
|
||||
;; prevent spamming stderr, redirect output to logfile.
|
||||
#:log-file "/var/log/ntpd"))
|
||||
(stop #~(make-kill-destructor)))))))
|
||||
|
||||
(define (openntpd-service-activation config)
|
||||
"Return the activation gexp for CONFIG."
|
||||
(with-imported-modules '((guix build utils))
|
||||
#~(begin
|
||||
(use-modules (guix build utils))
|
||||
|
||||
(mkdir-p "/var/db")
|
||||
(mkdir-p "/var/run")
|
||||
(unless (file-exists? "/var/db/ntpd.drift")
|
||||
(with-output-to-file "/var/db/ntpd.drift"
|
||||
(lambda _
|
||||
(format #t "0.0")))))))
|
||||
|
||||
(define openntpd-service-type
|
||||
(service-type (name 'openntpd)
|
||||
(extensions
|
||||
(list (service-extension shepherd-root-service-type
|
||||
openntpd-shepherd-service)
|
||||
(service-extension account-service-type
|
||||
(const %ntp-accounts))
|
||||
(service-extension activation-service-type
|
||||
openntpd-service-activation)))
|
||||
(default-value (openntpd-configuration))
|
||||
(description
|
||||
"Run the @command{ntpd}, the Network Time Protocol (NTP)
|
||||
daemon, as implemented by @uref{http://www.openntpd.org, OpenNTPD}. The
|
||||
daemon will keep the system clock synchronized with that of the given servers.")))
|
||||
|
||||
|
||||
;;;
|
||||
;;; Inetd.
|
||||
|
|
|
|||
Loading…
Reference in New Issue