1.1 Um curso intensivo de Scheme

Guix usa a implementação Guile do Scheme. Para começar a brincar com a linguagem, instale-a com guix install guile e inicie um REPL—abreviação de read-eval-print loop—executando guile na linha de comando.

Alternativamente, você também pode executar guix shell guile -- guile se preferir não ter o Guile instalado em seu perfil de usuário.

Nos exemplos a seguir, as linhas mostram o que você digitaria no REPL; linhas que começam com “⇒” mostram resultados de avaliação, enquanto linhas que começam com “-|” mostram coisas que são impressas. Veja Using Guile Interactively em GNU Guile Reference Manual, para mais detalhes sobre o REPL.

• A sintaxe do esquema se resume a uma árvore de expressões (ou s-expression no jargão Lisp). Uma expressão pode ser um literal, como números e strings, ou um composto que é uma lista entre parênteses de compostos e literais. #true e #false (abreviados #t e #f) representam os booleanos “true” e “false”, respectivamente.

  Exemplos de expressões válidas:

  "Hello World!"
  ⇒ "Hello World!"
  
  17
  ⇒ 17
  
  (display (string-append "Hello " "Guix" "\n"))
  -| Hello Guix!
  ⇒ #<unspecified>
  

• Este último exemplo é uma chamada de função aninhada em outra chamada de função. Quando uma expressão entre parênteses é avaliada, o primeiro termo é a função e o restante são os argumentos passados para a função. Cada função retorna a última expressão avaliada como valor de retorno.
• Funções anônimas —procedures na linguagem do Scheme — são declaradas com o termo lambda:

  (lambda (x) (* x x))
  ⇒ #<procedure 120e348 at <unknown port>:24:0 (x)>
  

  O procedimento acima retorna o quadrado do seu argumento. Como tudo é uma expressão, a expressão lambda retorna um procedimento anônimo, que por sua vez pode ser aplicado a um argumento:

  ((lambda (x) (* x x)) 3)
  ⇒ 9
  

  Os procedimentos são valores regulares, assim como números, strings, booleanos e assim por diante.

• Qualquer coisa pode receber um nome global com define:

  (define a 3)
  (define square (lambda (x) (* x x)))
  (square a)
  ⇒ 9
  

• Os procedimentos podem ser definidos de forma mais concisa com a seguinte sintaxe:

  (define (square x) (* x x))
  

• Uma estrutura de lista pode ser criada com o procedimento list:

  (list 2 a 5 7)
  ⇒ (2 3 5 7)
  

• Os procedimentos padrão são fornecidos pelo módulo (srfi srfi-1) para criar e processar listas (veja processamento de listas em GNU Guile Reference Manual). Aqui estão alguns dos mais úteis em ação:

  (use-modules (srfi srfi-1))  ;import list processing procedures
  
  (append (list 1 2) (list 3 4))
  ⇒ (1 2 3 4)
  
  (map (lambda (x) (* x x)) (list 1 2 3 4))
  ⇒ (1 4 9 16)
  
  (delete 3 (list 1 2 3 4))        ⇒ (1 2 4)
  (filter odd? (list 1 2 3 4))     ⇒ (1 3)
  (remove even? (list 1 2 3 4))    ⇒ (1 3)
  (find number? (list "a" 42 "b")) ⇒ 42
  

  Observe como o primeiro argumento para map, filter, remove e find é um procedimento!

• O quote desativa a avaliação de uma expressão entre parênteses, também chamada de expressão S ou “s-exp”: o primeiro termo não é chamado sobre os outros termos (veja quote em Manual de referência do GNU Guile). Assim, ele efetivamente retorna uma lista de termos.

  '(display (string-append "Hello " "Guix" "\n"))
  ⇒ (display (string-append "Hello " "Guix" "\n"))
  
  '(2 a 5 7)
  ⇒ (2 a 5 7)
  

• O quasiquote (`, uma crase) desativa a avaliação de uma expressão entre parênteses até que unquote (,, uma vírgula) a reative. Assim, nos fornece um controle refinado sobre o que é avaliado e o que não é.

  `(2 a 5 7 (2 ,a 5 ,(+ a 4)))
  ⇒ (2 a 5 7 (2 3 5 7))
  

  Observe que o resultado acima é uma lista de elementos mistos: números, símbolos (aqui a) e o último elemento é uma lista em si.

• Guix define uma variante de expressões simbólicas (S-expressions) com esteróides chamada G-expressions ou “gexps”, que vem com uma variante de quasiquote e unquote: #~ ( ou gexp) e #$ (ou ungexp). Eles permitem preparar código para execução posterior.

  Por exemplo, você encontrará gexps em algumas definições de pacotes onde eles fornecem código a ser executado durante o processo de construção do pacote. Eles se parecem com isto:

  (use-modules (guix gexp)           ;so we can write gexps
               (gnu packages base))  ;for 'coreutils'
  
  ;; Below is a G-expression representing staged code.
  #~(begin
      ;; Invoke 'ls' from the package defined by the 'coreutils'
      ;; variable.
      (system* #$(file-append coreutils "/bin/ls") "-l")
  
      ;; Create this package's output directory.
      (mkdir #$output))
  

  Veja Expressões-G em GNU Guix Reference Manual, para saber mais sobre gexps.

• Múltiplas variáveis podem ser nomeadas localmente com let (veja Local Bindings em GNU Guile Reference Manual):

  (define x 10)
  (let ((x 2)
        (y 3))
    (list x y))
  ⇒ (2 3)
  
  x
  ⇒ 10
  
  y
  error→ In procedure module-lookup: Unbound variable: y
  

  Use let* para permitir que declarações de variáveis posteriores se refiram a definições anteriores.

  (let* ((x 2)
         (y (* x 3)))
    (list x y))
  ⇒ (2 6)
  

• Keywords normalmente são usados para identificar os parâmetros nomeados de um procedimento. Eles são prefixados por #: (hash, dois pontos) seguido por caracteres alfanuméricos: #:like-this. Veja Palavras-chave em Manual de referência do GNU Guile.
• A porcentagem % normalmente é usada para variáveis globais somente-leitura no estágio de construção. Observe que é apenas uma convenção, como _ em C. Scheme trata % exatamente da mesma forma que qualquer outra letra.
• Os módulos são criados com define-module (veja Criando Módulos Guile em GNU Guile Reference Manual). Por exemplo

  (define-module (guix build-system ruby)
    #:use-module (guix store)
    #:export (ruby-build
              ruby-build-system))
  

  define o módulo guix build-system ruby que deve estar localizado em guix/build-system/ruby.scm em algum lugar no caminho de carregamento do Guile. Depende do módulo (guix store) e exporta duas variáveis, ruby-build e ruby-build-system.

  Veja Módulos de pacote em GNU Guix Reference Manual, para informações sobre módulos que definem pacotes.

Indo além: Scheme é uma linguagem que tem sido amplamente utilizada para ensinar programação e você encontrará muito material usando-a como veículo. Aqui está uma seleção de documentos para saber mais sobre o Scheme:

• A Scheme Primer, by Christine Lemmer-Webber and the Spritely Institute.
• Scheme at a Glance, por Steve Litt.
• Structure and Interpretation of Computer Programs, por Harold Abelson e Gerald Jay Sussman, com Julie Sussman. Coloquialmente conhecido como “SICP”, este livro é uma referência.

  Você também pode instalá-lo e lê-lo em seu computador:

  guix install sicp info-reader
  info sicp
  

Você encontrará mais livros, tutoriais e outros recursos em https://schemers.org/.

2.1 Tutorial sobre empacotamento

GNU Guix se destaca como o gerenciador de pacotes hackeável, principalmente porque usa GNU Guile, uma poderosa linguagem de programação de alto nível, um dos dialetos Scheme da família Lisp.

As definições de pacotes também são escritas em Scheme, o que capacita o Guix de maneiras muito exclusivas, ao contrário da maioria dos outros gerenciadores de pacotes que usam shell scripts ou linguagens simples.

• Utilize funções, estruturas, macros e toda a expressividade do Scheme para definições de seus pacotes.
• A herança facilita a personalização de um pacote, herdando-o e modificando apenas o que é necessário.
• Processamento em lote: toda a coleção de pacotes pode ser analisada, filtrada e processada. Construindo um servidor headless com todas as interfaces gráficas removidas? É possível. Quer reconstruir tudo, desde o código-fonte usando sinalizadores específicos de otimização do compilador? Passe o argumento #:make-flags "..." para a lista de pacotes. Não seria exagero pensar em Gentoo USE flags aqui, mas isso vai ainda mais longe: as mudanças não precisam ser pensadas de antemão pelo empacotador, elas podem ser programadas pelo usuário!

O tutorial a seguir cobre todos os fundamentos da criação de pacotes com Guix. Não pressupõe muito conhecimento do sistema Guix nem da linguagem Lisp. Espera-se apenas que o leitor esteja familiarizado com a linha de comando e tenha alguns conhecimentos básicos de programação.

• Um pacote “Hello World”
• Configuração
• Exemplo estendido
• Outros sistemas de construção
• Definição de pacote programável e automatizada
• Obtendo ajuda
• Conclusão
• Referências

(define-public hello
  (package
    (name "hello")
    (version "2.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/hello/hello-" version
                                  ".tar.gz"))
              (sha256
               (base32
                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
    (build-system gnu-build-system)
    (synopsis "Hello, GNU world: An example GNU package")
    (description
     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
serves as an example of standard GNU coding practices.  As such, it supports
command-line arguments, multiple languages, and so on.")
    (home-page "https://www.gnu.org/software/hello/")
    (license gpl3+)))

(use-modules (guix packages)
             (guix download)
             (guix build-system gnu)
             (guix licenses))

(package
  (name "my-hello")
  (version "2.10")
  (source (origin
            (method url-fetch)
            (uri (string-append "mirror://gnu/hello/hello-" version
                                ".tar.gz"))
            (sha256
             (base32
              "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
  (build-system gnu-build-system)
  (synopsis "Hello, Guix world: An example custom Guix package")
  (description
   "GNU Hello prints the message \"Hello, world!\" and then exits.  It
serves as an example of standard GNU coding practices.  As such, it supports
command-line arguments, multiple languages, and so on.")
  (home-page "https://www.gnu.org/software/hello/")
  (license gpl3+))

$ guix download mirror://gnu/hello/hello-2.10.tar.gz

Starting download of /tmp/guix-file.JLYgL7
From https://ftpmirror.gnu.org/gnu/hello/hello-2.10.tar.gz...
following redirection to `https://mirror.ibcp.fr/pub/gnu/hello/hello-2.10.tar.gz'...
 …10.tar.gz  709KiB                                 2.5MiB/s 00:00 [##################] 100.0%
/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz
0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i

$ guix download mirror://gnu/hello/hello-2.10.tar.gz.sig

Starting download of /tmp/guix-file.03tFfb
From https://ftpmirror.gnu.org/gnu/hello/hello-2.10.tar.gz.sig...
following redirection to `https://ftp.igh.cnrs.fr/pub/gnu/hello/hello-2.10.tar.gz.sig'...
 ….tar.gz.sig  819B                                                                                                                       1.2MiB/s 00:00 [##################] 100.0%
/gnu/store/rzs8wba9ka7grrmgcpfyxvs58mly0sx6-hello-2.10.tar.gz.sig
0q0v86n3y38z17rl146gdakw9xc4mcscpk8dscs412j22glrv9jf
$ gpg --verify /gnu/store/rzs8wba9ka7grrmgcpfyxvs58mly0sx6-hello-2.10.tar.gz.sig /gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz
gpg: Signature made Sun 16 Nov 2014 01:08:37 PM CET
gpg:                using RSA key A9553245FDE9B739
gpg: Good signature from "Sami Kerola <kerolasa@iki.fi>" [unknown]
gpg:                 aka "Sami Kerola (http://www.iki.fi/kerolasa/) <kerolasa@iki.fi>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8ED3 96E3 7E38 D471 A005  30D3 A955 3245 FDE9 B739

$ guix package --install-from-file=my-hello.scm

$ guix package --list-installed=my-hello
my-hello	2.10	out
/gnu/store/f1db2mfm8syb8qvc357c53slbvf1g9m9-my-hello-2.10

  -f, --install-from-file=FILE
                         install the package that the code within FILE
                         evaluates to

mkdir ~/my-channel

(define-module (my-hello)
  #:use-module (guix licenses)
  #:use-module (guix packages)
  #:use-module (guix build-system gnu)
  #:use-module (guix download))

(define-public my-hello
  (package
    (name "my-hello")
    (version "2.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/hello/hello-" version
                                  ".tar.gz"))
              (sha256
               (base32
                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
    (build-system gnu-build-system)
    (synopsis "Hello, Guix world: An example custom Guix package")
    (description
     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
serves as an example of standard GNU coding practices.  As such, it supports
command-line arguments, multiple languages, and so on.")
    (home-page "https://www.gnu.org/software/hello/")
    (license gpl3+)))

;; ...
(define-public my-hello
  ;; ...
  )

my-hello

guix show -L ~/my-channel my-hello
guix build -L ~/my-channel my-hello

cd ~/my-channel
git init
git add my-hello.scm
git commit -m "First commit of my channel."

(append (list (channel
                (name 'my-channel)
                (url (string-append "file://" (getenv "HOME")
                                    "/my-channel"))))
        %default-channels)

$ git clone https://git.savannah.gnu.org/git/guix.git

(define-module (gnu packages version-control)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix utils)
  #:use-module (guix packages)
  #:use-module (guix git-download)
  #:use-module (guix build-system cmake)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages python)
  #:use-module (gnu packages ssh)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages web))

(define-public my-libgit2
  (let ((commit "e98d0a37c93574d2c6107bf7f31140b548c6a7bf")
        (revision "1"))
    (package
      (name "my-libgit2")
      (version (git-version "0.26.6" revision commit))
      (source (origin
                (method git-fetch)
                (uri (git-reference
                      (url "https://github.com/libgit2/libgit2/")
                      (commit commit)))
                (file-name (git-file-name name version))
                (sha256
                 (base32
                  "17pjvprmdrx4h6bb1hhc98w9qi6ki7yl57f090n9kbhswxqfs7s3"))
                (patches (search-patches "libgit2-mtime-0.patch"))
                (modules '((guix build utils)))
                ;; Remove bundled software.
                (snippet '(delete-file-recursively "deps"))))
      (build-system cmake-build-system)
      (outputs '("out" "debug"))
      (arguments
       `(#:tests? #true                         ; Run the test suite (this is the default)
         #:configure-flags '("-DUSE_SHA1DC=ON") ; SHA-1 collision detection
         #:phases
         (modify-phases %standard-phases
           (add-after 'unpack 'fix-hardcoded-paths
             (lambda _
               (substitute* "tests/repo/init.c"
                 (("#!/bin/sh") (string-append "#!" (which "sh"))))
               (substitute* "tests/clar/fs.h"
                 (("/bin/cp") (which "cp"))
                 (("/bin/rm") (which "rm")))))
           ;; Run checks more verbosely.
           (replace 'check
             (lambda* (#:key tests? #:allow-other-keys)
               (when tests?
                 (invoke "./libgit2_clar" "-v" "-Q"))))
           (add-after 'unpack 'make-files-writable-for-tests
             (lambda _ (for-each make-file-writable (find-files ".")))))))
      (inputs
       (list libssh2 http-parser python-wrapper))
      (native-inputs
       (list pkg-config))
      (propagated-inputs
       ;; These two libraries are in 'Requires.private' in libgit2.pc.
       (list openssl zlib))
      (home-page "https://libgit2.github.com/")
      (synopsis "Library providing Git core methods")
      (description
       "Libgit2 is a portable, pure C implementation of the Git core methods
provided as a re-entrant linkable library with a solid API, allowing you to
write native speed custom Git applications in any language with bindings.")
      ;; GPLv2 with linking exception
      (license license:gpl2))))

git clone https://github.com/libgit2/libgit2/
cd libgit2
git checkout v0.26.6
guix hash -rx .

#:make-flags (list (string-append "prefix=" (assoc-ref %outputs "out"))
                   "CC=gcc")

$ make CC=gcc prefix=/gnu/store/...-<out>

#:configure-flags '("-DUSE_SHA1DC=ON")

(define %standard-phases
  ;; Standard build phases, as a list of symbol/procedure pairs.
  (let-syntax ((phases (syntax-rules ()
                         ((_ p ...) `((p . ,p) ...)))))
    (phases set-SOURCE-DATE-EPOCH set-paths install-locale unpack
            bootstrap
            patch-usr-bin-file
            patch-source-shebangs configure patch-generated-file-shebangs
            build check install
            patch-shebangs strip
            validate-runpath
            validate-documentation-location
            delete-info-dir-file
            patch-dot-desktop-files
            install-license-files
            reset-gzip-timestamps
            compress-documentation)))

(add-to-load-path "/path/to/guix/checkout")
,use (guix build gnu-build-system)
(map first %standard-phases)
⇒ (set-SOURCE-DATE-EPOCH set-paths install-locale unpack bootstrap patch-usr-bin-file patch-source-shebangs configure patch-generated-file-shebangs build check install patch-shebangs strip validate-runpath validate-documentation-location delete-info-dir-file patch-dot-desktop-files install-license-files reset-gzip-timestamps compress-documentation)

(define* (unpack #:key source #:allow-other-keys)
  "Unpack SOURCE in the working directory, and change directory within the
source.  When SOURCE is a directory, copy it in a sub-directory of the current
working directory."
  (if (file-is-directory? source)
      (begin
        (mkdir "source")
        (chdir "source")

        ;; Preserve timestamps (set to the Epoch) on the copied tree so that
        ;; things work deterministically.
        (copy-recursively source "."
                          #:keep-mtime? #true))
      (begin
        (if (string-suffix? ".zip" source)
            (invoke "unzip" source)
            (invoke "tar" "xvf" source))
        (chdir (first-subdirectory "."))))
  #true)

(lambda* (#:key inputs outputs #:allow-other-keys)
  (let ((bash-directory (assoc-ref inputs "bash"))
        (output-directory (assoc-ref outputs "out"))
        (doc-directory (assoc-ref outputs "doc")))
    ;; ...
    #true))

$ guix import cran --recursive walrus

(define-public r-mc2d
    ; ...
    (license gpl2+)))

(define-public r-jmvcore
    ; ...
    (license gpl2+)))

(define-public r-wrs2
    ; ...
    (license gpl3)))

(define-public r-walrus
  (package
    (name "r-walrus")
    (version "1.0.3")
    (source
      (origin
        (method url-fetch)
        (uri (cran-uri "walrus" version))
        (sha256
          (base32
            "1nk2glcvy4hyksl5ipq2mz8jy4fss90hx6cq98m3w96kzjni6jjj"))))
    (build-system r-build-system)
    (propagated-inputs
      (list r-ggplot2 r-jmvcore r-r6 r-wrs2))
    (home-page "https://github.com/jamovi/walrus")
    (synopsis "Robust Statistical Methods")
    (description
      "This package provides a toolbox of common robust statistical
tests, including robust descriptives, robust t-tests, and robust ANOVA.
It is also available as a module for 'jamovi' (see
<https://www.jamovi.org> for more information).  Walrus is based on the
WRS2 package by Patrick Mair, which is in turn based on the scripts and
work of Rand Wilcox.  These analyses are described in depth in the book
'Introduction to Robust Estimation & Hypothesis Testing'.")
    (license gpl3)))

$ guix refresh hello

$ guix refresh hello --update

(define-public adwaita-icon-theme
  (package (inherit gnome-icon-theme)
    (name "adwaita-icon-theme")
    (version "3.26.1")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
                                  (version-major+minor version) "/"
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
                "17fpahgh5dyckgz7rwqvzgnhx53cx9kr2xw0szprc6bnqy977fi8"))))
    (native-inputs (list `(,gtk+ "bin")))))

3.1 Login automático em um TTY específico

Embora o manual do Guix explique o login automático de um usuário para todas TTYs ( veja auto-login to TTY em GNU Guix Reference Manual), alguns podem preferir uma situação em que um usuário está logado em um TTY com os outros TTYs configurados para fazer login com usuários diferentes ou com nenhum. Observe que é possível fazer login automático de um usuário em qualquer TTY, mas geralmente é aconselhável evitar tty1, que, por padrão, é usado para registrar avisos e erros.

Aqui está como se pode configurar o login automático para um usuário em um tty:

(define (auto-login-to-tty config tty user)
  (if (string=? tty (mingetty-configuration-tty config))
        (mingetty-configuration
         (inherit config)
         (auto-login user))
        config))

(define %my-services
  (modify-services %base-services
    ;; …
    (mingetty-service-type config =>
                           (auto-login-to-tty
                            config "tty3" "alice"))))

(operating-system
  ;; …
  (services %my-services))

Pode-se também compose (veja ‘Higher-Order Functions’ em guile, The Guile Reference Manual) auto-login-to-tty para fazer login de vários usuários em vários ttys.

Finalmente, aqui está uma nota de cautela. Configurar o login automático em um TTY significa que qualquer pessoa pode ligar seu computador e executar comandos como seu usuário normal. No entanto, se você tiver uma partição raiz criptografada e, portanto, já precisar inserir uma senha quando o sistema inicializar, o login automático pode ser uma opção conveniente.

3.2 Customizando o Kernel

Guix é, em sua essência, uma distribuição baseada em código-fonte com substitutos (veja Substitutos em GNU Guix Reference Manual) e, como tal, construir pacotes a partir de seu código-fonte é uma parte esperada das instalações e atualizações regulares de pacotes. Dado este ponto de partida, faz sentido que sejam feitos esforços para reduzir a quantidade de tempo gasto na compilação de pacotes, e as recentes mudanças e atualizações na construção e distribuição de substitutos continuam a ser um tópico de discussão dentro do Guix.

O kernel, embora não exija uma superabundância de RAM para ser construído, leva muito tempo em uma máquina média. A configuração oficial do kernel, como é o caso de muitas distribuições GNU/Linux, erra pelo lado da inclusão, e é isso que realmente faz com que a construção demore tanto tempo quando o kernel é compilado a partir do código-fonte.

O kernel do Linux, entretanto, também pode ser descrito apenas como um pacote antigo normal e, como tal, pode ser personalizado como qualquer outro pacote. O procedimento é um pouco diferente, embora isso se deva principalmente à natureza de como a definição do pacote é escrita.

A definição do pacote do kernel linux-libre é na verdade um procedimento que cria um pacote.

(define* (make-linux-libre* version gnu-revision source supported-systems
                            #:key
                            (extra-version #f)
                            ;; A function that takes an arch and a variant.
                            ;; See kernel-config for an example.
                            (configuration-file #f)
                            (defconfig "defconfig")
                            (extra-options %default-extra-linux-options))
  ...)

O pacote linux-libre atual é para a série 5.15.x e é declarado assim:

(define-public linux-libre-5.15
  (make-linux-libre* linux-libre-5.15-version
                     linux-libre-5.15-gnu-revision
                     linux-libre-5.15-source
                     '("x86_64-linux" "i686-linux" "armhf-linux" "aarch64-linux" "riscv64-linux")
                     #:configuration-file kernel-config))

Quaisquer chaves às quais não sejam atribuídos valores herdam seu valor padrão da definição make-linux-libre. Ao comparar os dois trechos acima, observe o comentário do código que se refere a #:configuration-file. Por causa disso, não é realmente fácil incluir uma configuração de kernel personalizada na definição, mas não se preocupe, existem outras maneiras de trabalhar com o que temos.

Existem duas maneiras de criar um kernel com uma configuração de kernel personalizada. A primeira é fornecer um arquivo .config padrão durante o processo de construção, incluindo um arquivo .config real como uma entrada nativa para nosso kernel personalizado. A seguir está um trecho da fase 'configure personalizada da definição do pacote make-linux-libre:

(let ((build  (assoc-ref %standard-phases 'build))
      (config (assoc-ref (or native-inputs inputs) "kconfig")))

  ;; Use a custom kernel configuration file or a default
  ;; configuration file.
  (if config
      (begin
        (copy-file config ".config")
        (chmod ".config" #o666))
      (invoke "make" ,defconfig)))

Abaixo está um exemplo de pacote de kernel. O pacote linux-libre não é nada especial e pode ser herdado e ter seus campos substituídos como qualquer outro pacote:

(define-public linux-libre/E2140
  (package
    (inherit linux-libre)
    (native-inputs
     `(("kconfig" ,(local-file "E2140.config"))
      ,@(alist-delete "kconfig"
                      (package-native-inputs linux-libre))))))

No mesmo diretório do arquivo que define linux-libre-E2140 está um arquivo chamado E2140.config, que é um arquivo de configuração real do kernel. A palavra-chave defconfig de make-linux-libre é deixada em branco aqui, então a única configuração do kernel no pacote é aquela que foi incluída no campo native-inputs.

A segunda maneira de criar um kernel customizado é passar um novo valor para a palavra-chave extra-options do procedimento make-linux-libre. A palavra-chave extra-options funciona com outra função definida logo abaixo dela:

(define %default-extra-linux-options
  `(;; https://lists.gnu.org/archive/html/guix-devel/2014-04/msg00039.html
   ("CONFIG_DEVPTS_MULTIPLE_INSTANCES" . #true)
   ;; Modules required for initrd:
   ("CONFIG_NET_9P" . m)
   ("CONFIG_NET_9P_VIRTIO" . m)
   ("CONFIG_VIRTIO_BLK" . m)
   ("CONFIG_VIRTIO_NET" . m)
   ("CONFIG_VIRTIO_PCI" . m)
   ("CONFIG_VIRTIO_BALLOON" . m)
   ("CONFIG_VIRTIO_MMIO" . m)
   ("CONFIG_FUSE_FS" . m)
   ("CONFIG_CIFS" . m)
   ("CONFIG_9P_FS" . m)))

(define (config->string options)
  (string-join (map (match-lambda
                      ((option . 'm)
                       (string-append option "=m"))
                      ((option . #true)
                       (string-append option "=y"))
                      ((option . #false)
                       (string-append option "=n")))
                    options)
               "\n"))

E no script de configuração personalizado do pacote ‘make-linux-libre‘:

;; Appending works even when the option wasn't in the
;; file.  The last one prevails if duplicated.
(let ((port (open-file ".config" "a"))
      (extra-configuration ,(config->string extra-options)))
  (display extra-configuration port)
  (close-port port))

(invoke "make" "oldconfig")

Portanto, ao não fornecer um arquivo de configuração, o .config começa em branco e então escrevemos nele a coleção de flags que desejamos. Aqui está outro kernel personalizado:

(define %macbook41-full-config
  (append %macbook41-config-options
          %file-systems
          %efi-support
          %emulation
          (@@ (gnu packages linux) %default-extra-linux-options)))

(define-public linux-libre-macbook41
  ;; XXX: Access the internal 'make-linux-libre*' procedure, which is
  ;; private and unexported, and is liable to change in the future.
  ((@@ (gnu packages linux) make-linux-libre*)
   (@@ (gnu packages linux) linux-libre-version)
   (@@ (gnu packages linux) linux-libre-gnu-revision)
   (@@ (gnu packages linux) linux-libre-source)
   '("x86_64-linux")
   #:extra-version "macbook41"
   #:extra-options %macbook41-config-options))

No exemplo acima %file-systems é uma coleção de sinalizadores que habilitam suporte a diferentes sistemas de arquivos, %efi-support habilita suporte EFI e %emulation permite que uma máquina x86_64-linux atue em Modo de 32 bits também. %default-extra-linux-options são os citados acima, que tiveram que ser adicionados pois foram substituídos na palavra-chave extra-options.

Tudo isso parece viável, mas como saber quais módulos são necessários para um sistema específico? Dois lugares que podem ser úteis para tentar responder a esta pergunta são o Gentoo Handbook e o documentação do próprio kernel. Pela documentação do kernel, parece que make localmodconfig é o comando que queremos.

Para realmente executar make localmodconfig primeiro precisamos obter e descompactar o código-fonte do kernel:

tar xf $(guix build linux-libre --source)

Uma vez dentro do diretório que contém o código-fonte, execute touch .config para criar um .config inicial e vazio para começar. make localmodconfig funciona vendo o que você já tem em .config e informando o que está faltando. Se o arquivo estiver em branco, você está perdendo tudo. O próximo passo é executar:

guix shell -D linux-libre -- make localmodconfig

e observe a saída. Observe que o arquivo .config ainda está vazio. A saída geralmente contém dois tipos de avisos. O primeiro começa com "WARNING" e pode ser ignorado no nosso caso. A segunda leitura:

module pcspkr did not have configs CONFIG_INPUT_PCSPKR

Para cada uma dessas linhas, copie a parte CONFIG_XXXX_XXXX para .config no diretório e anexe =m, para que no final fique assim:

CONFIG_INPUT_PCSPKR=m
CONFIG_VIRTIO=m

Após copiar todas as opções de configuração, execute make localmodconfig novamente para ter certeza de que você não tem nenhuma saída começando com “module”. Depois de todos esses módulos específicos da máquina, restam mais alguns que também são necessários. CONFIG_MODULES é necessário para que você possa construir e carregar módulos separadamente e não ter tudo embutido no kernel. CONFIG_BLK_DEV_SD é necessário para leitura de discos rígidos. É possível que existam outros módulos dos quais você precisará.

Este post não pretende ser um guia para configurar seu próprio kernel, portanto, se você decidir construir um kernel personalizado, você terá que procurar outros guias para criar um kernel adequado às suas necessidades.

A segunda maneira de definir a configuração do kernel faz mais uso dos recursos do Guix e permite compartilhar segmentos de configuração entre diferentes kernels. Por exemplo, todas as máquinas que usam EFI para inicializar possuem vários sinalizadores de configuração EFI necessários. É provável que todos os kernels compartilhem uma lista de sistemas de arquivos para suporte. Ao usar variáveis, é mais fácil ver rapidamente quais recursos estão habilitados e garantir que você não tenha recursos em um kernel, mas ausentes em outro.

No entanto, não foi discutido o initrd do Guix e sua personalização. É provável que você precise modificar o initrd em uma máquina usando um kernel customizado, já que certos módulos que devem ser compilados podem não estar disponíveis para inclusão no initrd.

3.3 API de imagem do sistema Guix

Historicamente, o Sistema Guix é centrado em uma estrutura operating-system. Esta estrutura contém vários campos que vão desde o gerenciador de boot e a declaração do kernel até os serviços a serem instalados.

Dependendo da máquina de destino, que pode ir de uma máquina x86_64 padrão a um pequeno computador de placa única ARM, como o Pine64, as restrições de imagem podem variar muito. Os fabricantes de hardware imporão diferentes formatos de imagem com vários tamanhos de partição e deslocamentos.

Para criar imagens adequadas para todas essas máquinas, é necessária uma nova abstração: esse é o objetivo do registro image. Este registro contém todas as informações necessárias para ser transformada em uma imagem autônoma, que pode ser inicializada diretamente em qualquer máquina de destino.

(define-record-type* <image>
  image make-image
  image?
  (name               image-name ;symbol
                      (default #f))
  (format             image-format) ;symbol
  (target             image-target
                      (default #f))
  (size               image-size  ;size in bytes as integer
                      (default 'guess))
  (operating-system   image-operating-system  ;<operating-system>
                      (default #f))
  (partitions         image-partitions ;list of <partition>
                      (default '()))
  (compression?       image-compression? ;boolean
                      (default #t))
  (volatile-root?     image-volatile-root? ;boolean
                      (default #t))
  (substitutable?     image-substitutable? ;boolean
                      (default #t)))

Este registro contém o sistema operacional a ser instanciado. O campo format define o tipo de imagem e pode ser efi-raw, qcow2 ou iso9660 por exemplo. No futuro, poderá ser estendido para docker ou outros tipos de imagem.

Um novo diretório nas fontes do Guix é dedicado à definição de imagens. Por enquanto existem quatro arquivos:

• gnu/system/images/hurd.scm
• gnu/system/images/pine64.scm
• gnu/system/images/novena.scm
• gnu/system/images/pinebook-pro.scm

Vamos dar uma olhada em pine64.scm. Ele contém a variável pine64-barebones-os que é uma definição mínima de um sistema operacional dedicado à placa Pine A64 LTS.

(define pine64-barebones-os
  (operating-system
   (host-name "vignemale")
   (timezone "Europe/Paris")
   (locale "en_US.utf8")
   (bootloader (bootloader-configuration
                (bootloader u-boot-pine64-lts-bootloader)
                (targets '("/dev/vda"))))
   (initrd-modules '())
   (kernel linux-libre-arm64-generic)
   (file-systems (cons (file-system
                        (device (file-system-label "my-root"))
                        (mount-point "/")
                        (type "ext4"))
                       %base-file-systems))
   (services (cons (service agetty-service-type
                            (agetty-configuration
                             (extra-options '("-L")) ; no carrier detect
                             (baud-rate "115200")
                             (term "vt100")
                             (tty "ttyS0")))
                   %base-services))))

Os campos kernel e bootloader apontam para pacotes dedicados a esta placa.

Logo abaixo, a variável pine64-image-type também está definida.

(define pine64-image-type
  (image-type
   (name 'pine64-raw)
   (constructor (cut image-with-os arm64-disk-image <>))))

Ele está usando um registro do qual ainda não falamos, o registro image-type, definido desta forma:

(define-record-type* <image-type>
  image-type make-image-type
  image-type?
  (name           image-type-name) ;symbol
  (constructor    image-type-constructor)) ;<operating-system> -> <image>

O objetivo principal deste registro é associar um nome a um procedimento que transforma um isso é necessário, vamos dar uma olhada no comando que produz uma imagem de um arquivo de configuração operating-system:

guix system image my-os.scm

Este comando espera uma configuração operating-system mas como devemos indicar que queremos uma imagem direcionada a uma placa Pine64? Precisamos fornecer uma informação extra, o image-type, passando o sinalizador --image-type ou -t, desta forma:

guix system image --image-type=pine64-raw my-os.scm

Este parâmetro image-type aponta para o pine64-image-type definido acima. Portanto, ao operating-system declarado em my-os.scm será aplicado o procedimento (cut image-with-os arm64-disk-image <>) para transformá-lo em um imagem.

A imagem resultante se parece com:

(image
 (format 'disk-image)
 (target "aarch64-linux-gnu")
 (operating-system my-os)
 (partitions
  (list (partition
         (inherit root-partition)
         (offset root-offset)))))

que é a agregação do operating-system definido em my-os.scm ao registro arm64-disk-image.

Mas chega de loucura do esquema. O que essa API de imagem traz para o usuário do Guix?

Pode-se executar:

mathieu@cervin:~$ guix system --list-image-types
The available image types are:

   - unmatched-raw
   - rock64-raw
   - pinebook-pro-raw
   - pine64-raw
   - novena-raw
   - hurd-raw
   - hurd-qcow2
   - qcow2
   - iso9660
   - uncompressed-iso9660
   - tarball
   - efi-raw
   - mbr-raw
   - docker
   - wsl2
   - raw-with-offset
   - efi32-raw

e escrevendo um arquivo operating-system baseado em pine64-barebones-os, você pode personalizar sua imagem de acordo com suas preferências em um arquivo (my-pine-os.scm) como este :

(use-modules (gnu services linux)
             (gnu system images pine64))

(let ((base-os pine64-barebones-os))
  (operating-system
    (inherit base-os)
    (timezone "America/Indiana/Indianapolis")
    (services
     (cons
      (service earlyoom-service-type
               (earlyoom-configuration
                (prefer-regexp "icecat|chromium")))
      (operating-system-user-services base-os)))))

execute:

guix system image --image-type=pine64-raw my-pine-os.scm

ou,

guix system image --image-type=hurd-raw my-hurd-os.scm

para obter uma imagem que pode ser gravada diretamente em um disco rígido e inicializada.

Sem alterar nada em my-hurd-os.scm, chamando:

guix system image --image-type=hurd-qcow2 my-hurd-os.scm

em vez disso, produzirá uma imagem Hurd QEMU.

3.4 Usando chaves de segurança

O uso de chaves de segurança pode melhorar sua segurança, fornecendo uma segunda fonte de autenticação que não pode ser facilmente roubada ou copiada, pelo menos para um adversário remoto (algo que você possui), para o segredo principal (uma senha - algo que você conhece). , reduzindo o risco de falsificação de identidade.

O exemplo de configuração detalhado abaixo mostra qual configuração mínima precisa ser feita em seu sistema Guix para permitir o uso de uma chave de segurança Yubico. Espera-se que a configuração também possa ser útil para outras chaves de segurança, com pequenos ajustes.

• Configuração para uso como autenticador de dois fatores (2FA)
• Desativando a geração de código OTP para um Yubikey
• Exigindo que um Yubikey abra um banco de dados KeePassXC

(use-package-modules ... security-token ...)
...
(operating-system
 ...
 (users (cons* (user-account
               (name "your-user")
               (group "users")
               (supplementary-groups
		'("wheel" "netdev" "audio" "video"
                  "plugdev"))           ;<- added system group
               (home-directory "/home/your-user"))
              %base-user-accounts))
 ...
 (services
  (cons*
   ...
   (udev-rules-service 'fido2 libfido2 #:groups '("plugdev")))))

guix shell ungoogled-chromium -- chromium chrome://settings/securityKeys

guix shell python-yubikey-manager -- ykman config usb --force --disable OTP

(use-package-modules ... security-token ...)
...
(operating-system
 ...
 (services
  (cons*
   ...
   (udev-rules-service 'yubikey yubikey-personalization))))

guix shell yubikey-manager-qt -- ykman-gui

3.5 Trabalho mcron de DNS dinâmico

Se o seu ISP (Internet Service Provider) fornece apenas endereços IP dinâmicos, pode ser útil configurar um serviço DNS (Domain Name System) dinâmico (também conhecido como DDNS (Dynamic DNS)) para associar um nome de host estático para um endereço IP público, mas dinâmico. Existem vários serviços que podem ser usados para isso; no job mcron a seguir, DuckDNS é usado. Também deve funcionar com outros serviços DNS dinâmicos que oferecem uma interface semelhante para atualizar o endereço IP.

O Job mcron é fornecido abaixo, onde DOMAIN deve ser substituído pelo seu próprio prefixo de domínio, e o token fornecido pelo DuckDNS é associado a DOMAIN e adicionado ao arquivo /etc/duckdns/DOMAIN arquivo .token.

(define duckdns-job
  ;; Update personal domain IP every 5 minutes.
  #~(job '(next-minute (range 0 60 5))
	 #$(program-file
            "duckdns-update"
            (with-extensions (list guile-gnutls) ;required by (web client)
              #~(begin
                  (use-modules (ice-9 textual-ports)
                               (web client))
                  (let ((token (string-trim-both
                                (call-with-input-file "/etc/duckdns/DOMAIN.token"
                                  get-string-all)))
                        (query-template (string-append "https://www.duckdns.org/"
                                                       "update?domains=DOMAIN"
                                                       "&token=~a&ip=")))
                    (http-get (format #f query-template token))))))
         "duckdns-update"
         #:user "nobody"))

O Job então precisa ser adicionado à lista de trabalhos mcron do seu sistema, usando algo como:

(operating-system
 (services
  (cons* (service mcron-service-type
           (mcron-configuration
             (jobs (list duckdns-job ...))))
         ...
         %base-services)))

3.6 Conectando-se à VPN Wireguard

Para se conectar a um servidor VPN Wireguard, você precisa que o módulo do kernel esteja carregado na memória e um pacote que forneça ferramentas de rede que o suportem (por exemplo, wireguard-tools ou network-manager).

Aqui está um exemplo de configuração para Linux-Libre versão menor que 5.6, onde o módulo está fora da árvore e precisa ser carregado manualmente — as seguintes revisões do kernel o possuem integrado e, portanto, não precisam de tal configuração:

(use-modules (gnu))
(use-service-modules desktop)
(use-package-modules vpn)

(operating-system
  ;; …
  (services (cons (simple-service 'wireguard-module
                                  kernel-module-loader-service-type
                                  '("wireguard"))
                  %desktop-services))
  (packages (cons wireguard-tools %base-packages))
  (kernel-loadable-modules (list wireguard-linux-compat)))

Após reconfigurar e reiniciar seu sistema, você pode usar as ferramentas Wireguard ou NetworkManager para conectar-se a um servidor VPN.

• Usando ferramentas Wireguard
• Usando o NetworkManager

# nmcli connection import type wireguard file wg0.conf
Connection 'wg0' (edbee261-aa5a-42db-b032-6c7757c60fde) successfully added

$ nmcli connection up wg0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)

# nmcli connection modify wg0 connection.autoconnect no

3.7 Customizando um Gerenciador de Janelas

• StumpWM
• Bloqueio de sessão

(use-modules (gnu))
(use-package-modules wm)

(operating-system
  ;; …
  (packages (append (list sbcl stumpwm `(,stumpwm "lib"))
                    %base-packages)))

(use-modules (gnu))
(use-package-modules fonts wm)

(operating-system
  ;; …
  (packages (append (list sbcl stumpwm `(,stumpwm "lib"))
                    sbcl-ttf-fonts font-dejavu %base-packages)))

(require :ttf-fonts)
(setf xft:*font-dirs* '("/run/current-system/profile/share/fonts/"))
(setf clx-truetype:+font-cache-filename+ (concat (getenv "HOME") "/.fonts/font-cache.sexp"))
(xft:cache-fonts)
(set-font (make-instance 'xft:font :family "DejaVu Sans Mono" :subfamily "Book" :size 11))

xss-lock -- slock &
exec stumpwm

(service screen-locker-services-type
         (screen-locker-configuration
          (name "slock")
          (program (file-append slock "/bin/slock"))))

3.8 Executando Guix em um Servidor Linode

Para executar o Guix num servidor hospedado por Linode, comece com um servidor Debian recomendado. Recomendamos usar a distribuição padrão como forma de inicializar o Guix. Crie suas chaves SSH.

ssh-keygen

Certifique-se de adicionar sua chave SSH para facilitar o login no servidor remoto. Isto é feito trivialmente através da interface gráfica do Linode para adicionar chaves SSH. Vá para o seu perfil e clique em adicionar chave SSH. Copie nele a saída de:

cat ~/.ssh/<username>_rsa.pub

Desligue o Linode.

Na aba Armazenamento do Linode, redimensione o disco Debian para ser menor. Recomenda-se 30 GB de espaço livre. Em seguida, clique em "Adicionar um disco" e preencha o formulário com o seguinte:

• Label: "Guix"
• Filesystem: ext4
• Defina-o para o tamanho restante

Na aba Configurações, pressione “Editar” no perfil Debian padrão. Em "Bloquear atribuição de dispositivo", clique em "Adicionar um dispositivo". Deve ser /dev/sdc e você pode selecionar o disco "Guix". Salvar alterações.

Agora "Adicionar uma configuração", com o seguinte:

• Label: Guix
• Kernel:GRUB 2 (está na parte inferior! Esta etapa é IMPORTANTE!)
• Bloquear atribuição de dispositivo:
• /dev/sda: Guix
• /dev/sdb: swap
• Root device: /dev/sda
• Desligue todos os auxiliares de sistema de arquivos/inicialização

Agora ligue-o novamente, inicializando com a configuração do Debian. Quando estiver em execução, faça ssh para o seu servidor via ssh root@<your-server-IP-here>. (Você pode encontrar o endereço IP do seu servidor na seção Resumo do Linode.) Agora você pode executar as etapas "instalar o guix de veja Instalação de binários em GNU Guix":

sudo apt-get install gpg
wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
chmod +x guix-install.sh
./guix-install.sh
guix pull

Agora é hora de escrever uma configuração para o servidor. As principais informações estão abaixo. Salve o arquivo resultante como guix-config.scm.

(use-modules (gnu)
             (guix modules))
(use-service-modules networking
                     ssh)
(use-package-modules admin
                     package-management
                     ssh
                     tls)

(operating-system
  (host-name "my-server")
  (timezone "America/New_York")
  (locale "en_US.UTF-8")
  ;; This goofy code will generate the grub.cfg
  ;; without installing the grub bootloader on disk.
  (bootloader (bootloader-configuration
               (bootloader
                (bootloader
                 (inherit grub-bootloader)
                 (installer #~(const #true))))))
  (file-systems (cons (file-system
                        (device "/dev/sda")
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))


  (swap-devices (list "/dev/sdb"))


  (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                        %base-initrd-modules))

  (users (cons (user-account
                (name "janedoe")
                (group "users")
                ;; Adding the account to the "wheel" group
                ;; makes it a sudoer.
                (supplementary-groups '("wheel"))
                (home-directory "/home/janedoe"))
               %base-user-accounts))

  (packages (cons* openssh-sans-x
                   %base-packages))

  (services (cons*
             (service dhcp-client-service-type)
             (service openssh-service-type
                      (openssh-configuration
                       (openssh openssh-sans-x)
                       (password-authentication? #false)
                       (authorized-keys
                        `(("janedoe" ,(local-file "janedoe_rsa.pub"))
                          ("root" ,(local-file "janedoe_rsa.pub"))))))
             %base-services)))

Substitua os seguintes campos na configuração acima:

(host-name "my-server")       ; replace with your server name
; if you chose a linode server outside the U.S., then
; use tzselect to find a correct timezone string
(timezone "America/New_York") ; if needed replace timezone
(name "janedoe")              ; replace with your username
("janedoe" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key
("root" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key

A última linha no exemplo acima permite que você faça login no servidor como root e defina a senha root inicial (veja a nota no final desta receita sobre login root). Depois de fazer isso, você pode excluir essa linha da sua configuração e reconfigurar para evitar o login root.

Copie sua chave pública ssh (por exemplo: ~/.ssh/id_rsa.pub) como <seu-nome-de-usuário-aqui>_rsa.pub e coloque guix-config.scm no mesmo diretório. Em um novo terminal execute estes comandos.

sftp root@<remote server ip address>
put /path/to/files/<username>_rsa.pub .
put /path/to/files/guix-config.scm .

No seu primeiro terminal, monte o drive guix:

mkdir /mnt/guix
mount /dev/sdc /mnt/guix

Devido à forma como configuramos a seção bootloader do guix-config.scm, apenas o arquivo de configuração grub será instalado. Então, precisamos copiar algumas das outras coisas do GRUB já instaladas no sistema Debian:

mkdir -p /mnt/guix/boot/grub
cp -r /boot/grub/* /mnt/guix/boot/grub/

Agora inicialize a instalação do Guix:

guix system init guix-config.scm /mnt/guix

Ok, desligue-o! Agora, no console Linode, selecione boot e selecione "Guix".

Depois de inicializar, você poderá fazer login via SSH! (A configuração do servidor terá mudado.) Você pode encontrar um erro como:

$ ssh root@<server ip address>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@     WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!      @@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:0B+wp33w57AnKQuHCvQP0+ZdKaqYrI/kyU7CfVbS7R4.
Please contact your system administrator.
Add correct host key in /home/joshua/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/joshua/.ssh/known_hosts:3
ECDSA host key for 198.58.98.76 has changed and you have requested strict checking.
Host key verification failed.

Exclua o arquivo ~/.ssh/known_hosts ou exclua a linha incorreta começando com o endereço IP do seu servidor.

Certifique-se de definir sua senha e a senha do root.

ssh root@<endereço IP remoto>
passwd; para a senha root
passwd <nome de usuário>; para a senha do usuário

Talvez você não consiga executar os comandos acima neste momento. Se você tiver problemas para fazer login remotamente em sua caixa linode via SSH, então você ainda pode precisar definir sua senha root e de usuário inicialmente clicando na opção “Launch Console” em seu linode. Escolha “Glish” em vez de “Weblish”. Agora você deve conseguir fazer o ssh na máquina.

Viva! Neste ponto você pode desligar o servidor, excluir o disco Debian e redimensionar o Guix para o restante do tamanho. Parabéns!

A propósito, se você salvá-lo como uma imagem de disco neste momento, será fácil criar novas imagens Guix! Pode ser necessário reduzir o tamanho da imagem Guix para 6144 MB para salvá-la como uma imagem. Então você pode redimensioná-lo novamente para o tamanho máximo.

3.9 Running Guix on a Kimsufi Server

Para executar o Guix em um servidor hospedado por Kimsufi, clique na guia netboot, selecione Rescue64-pro e reinicie.

A OVH enviar-lhe-á por e-mail as credenciais necessárias para efetuar o ssh num sistema Debian.

Agora você pode executar as etapas "instalar guix de veja Instalação de binários em GNU Guix":

wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
chmod +x guix-install.sh
./guix-install.sh
guix pull

Particione as unidades e formate-as, primeiro interrompa a matriz raid:

mdadm --stop /dev/md127
mdadm --zero-superblock /dev/sda2 /dev/sdb2

Em seguida, limpe os discos e configure as partições, criaremos uma matriz RAID 1.

wipefs -a /dev/sda
wipefs -a /dev/sdb

parted /dev/sda --align=opt -s -m -- mklabel gpt
parted /dev/sda --align=opt -s -m -- \
 mkpart bios_grub 1049kb 512MiB \
 set 1 bios_grub on
parted /dev/sda --align=opt -s -m -- \
 mkpart primary 512MiB -512MiB
 set 2 raid on
parted /dev/sda --align=opt -s -m -- mkpart primary linux-swap 512MiB 100%

parted /dev/sdb --align=opt -s -m -- mklabel gpt
parted /dev/sdb --align=opt -s -m -- \
     mkpart bios_grub 1049kb 512MiB \
     set 1 bios_grub on
parted /dev/sdb --align=opt -s -m -- \
     mkpart primary 512MiB -512MiB \
     set 2 raid on
parted /dev/sdb --align=opt -s -m -- mkpart primary linux-swap 512MiB 100%

Crie a matriz:

mdadm --create /dev/md127 --level=1 --raid-disks=2 \
  --metadata=0.90 /dev/sda2 /dev/sdb2

Agora crie sistemas de arquivos nas partições relevantes, primeiro as partições de inicialização:

mkfs.ext4  /dev/sda1
mkfs.ext4  /dev/sdb1

Então a partição raiz:

mkfs.ext4 /dev/md127

Inicialize as partições swap:

mkswap /dev/sda3
swapon /dev/sda3
mkswap /dev/sdb3
swapon /dev/sdb3

Monte a unidade guix:

mkdir /mnt/guix
mount /dev/md127 /mnt/guix

Agora é hora de escrever um arquivo os.scm de declaração do sistema operacional; aqui está uma amostra:

(use-modules (gnu) (guix))
(use-service-modules networking ssh vpn virtualization sysctl admin mcron)
(use-package-modules ssh tls tmux vpn virtualization)

(operating-system
  (host-name "kimsufi")

  (bootloader (bootloader-configuration
	       (bootloader grub-bootloader)
	       (targets (list "/dev/sda" "/dev/sdb"))
	       (terminal-outputs '(console))))

  ;; Add a kernel module for RAID-1 (aka. "mirror").
  (initrd-modules (cons* "raid1"  %base-initrd-modules))

  (mapped-devices
   (list (mapped-device
          (source (list "/dev/sda2" "/dev/sdb2"))
          (target "/dev/md127")
          (type raid-device-mapping))))

  (swap-devices
   (list (swap-space
          (target "/dev/sda3"))
         (swap-space
          (target "/dev/sdb3"))))

  (issue
   ;; Default contents for /etc/issue.
   "\
This is the GNU system at Kimsufi.  Welcome.\n")

  (file-systems (cons* (file-system
		         (mount-point "/")
		         (device "/dev/md127")
		         (type "ext4")
		         (dependencies mapped-devices))
		       %base-file-systems))

  (users (cons (user-account
	        (name "guix")
	        (comment "guix")
	        (group "users")
	        (supplementary-groups '("wheel"))
	        (home-directory "/home/guix"))
	       %base-user-accounts))

  (sudoers-file
   (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
guix ALL=(ALL) NOPASSWD:ALL\n"))

  ;; Globally-installed packages.
  (packages (cons* tmux gnutls wireguard-tools %base-packages))
  (services
   (cons*
    (service static-networking-service-type
	     (list (static-networking
		    (addresses (list (network-address
				      (device "enp3s0")
				      (value "server-ip-address/24"))))
		    (routes (list (network-route
				   (destination "default")
				   (gateway "server-gateway"))))
		    (name-servers '("213.186.33.99")))))

    (service unattended-upgrade-service-type)

    (service openssh-service-type
	     (openssh-configuration
	      (openssh openssh-sans-x)
	      (permit-root-login #f)
	      (authorized-keys
	       `(("guix" ,(plain-file "ssh-key-name.pub"
                                      "ssh-public-key-content"))))))
    (modify-services %base-services
      (sysctl-service-type
       config =>
       (sysctl-configuration
	(settings (append '(("net.ipv6.conf.all.autoconf" . "0")
			    ("net.ipv6.conf.all.accept_ra" . "0"))
			  %default-sysctl-settings))))))))

Não se esqueça de substituir as variáveis server-ip-address, server-gateway, ssh-key-name e ssh-public-key-content pelos seus próprias valores.

O gateway é o último IP utilizável em seu bloco, portanto, se você tiver um servidor com IP ‘37.187.79.10’, seu gateway será ‘37.187.79.254’.

Transfira o arquivo de declaração do sistema operacional os.scm para o servidor por meio dos comandos scp ou sftp.

Agora só falta instalar o Guix com guix system init e reiniciar.

No entanto, primeiro precisamos configurar um chroot, porque a partição raiz do sistema de recuperação é montada em uma partição aufs e se você tentar instalar o Guix ele falhará na etapa de instalação do GRUB reclamando do caminho canônico de "aufs".

Instale os pacotes que serão usados no chroot:

guix install bash-static parted util-linux-with-udev coreutils guix

Em seguida, execute o seguinte para criar os diretórios necessários para o chroot:

cd /mnt && \
mkdir -p bin etc gnu/store root/.guix-profile/ root/.config/guix/current \
  var/guix proc sys dev

Copie o host resolv.conf no chroot:

cp /etc/resolv.conf etc/

Monte os dispositivos de bloco, a loja e seu banco de dados e a configuração atual do guix:

mount --rbind /proc /mnt/proc
mount --rbind /sys /mnt/sys
mount --rbind /dev /mnt/dev
mount --rbind /var/guix/ var/guix/
mount --rbind /gnu/store gnu/store/
mount --rbind /root/.config/ root/.config/
mount --rbind /root/.guix-profile/bin/ bin
mount --rbind /root/.guix-profile root/.guix-profile/

Faça chroot em /mnt e instale o sistema:

chroot /mnt/ /bin/bash

guix system init /root/os.scm /guix

Por fim, na interface do usuário (IU) da web, altere ‘netboot’ para ‘boot to disk’ e reinicie (também na IU da web).

Aguarde alguns minutos e tente fazer ssh com ssh guix@endereço IP do servidor> -i caminho para sua chave ssh

Você deve ter um sistema Guix instalado e funcionando no Kimsufi; Parabéns!

3.10 Configurando uma montagem vinculada

Para vincular a montagem de um sistema de arquivos, é necessário primeiro configurar algumas definições antes da seção operating-system da definição do sistema. Neste exemplo, vincularemos a montagem de uma pasta de uma unidade de disco rígido a /tmp, para evitar desgaste no SSD primário, sem dedicar uma partição inteira para ser montada como /tmp.

Primeiro, a unidade de origem que hospeda a pasta que desejamos vincular a montagem deve ser definida, para que a montagem de ligação possa depender dela.

(define source-drive ;; "source-drive" can be named anything you want.
   (file-system
    (device (uuid "UUID goes here"))
    (mount-point "/path-to-spinning-disk-goes-here")
    (type "ext4"))) ;; Make sure to set this to the appropriate type for your drive.

A pasta de origem também deve ser definida, para que o guix saiba que não é um dispositivo de bloco normal, mas uma pasta.

(define (%source-directory) "/caminho_para_ o_disco_vai_aqui/tmp") ;; "%source-directory" pode receber qualquer nome de variável válido.

Finalmente, dentro da definição file-systems, devemos adicionar a própria montagem.

(file-systems (cons*

                ...<other drives omitted for clarity>...

                source-drive ;; Deve corresponder ao nome que você deu à unidade de origem na definição anterior.

                (file-system
                 (device (%source-directory)) ;; Make sure "source-directory" matches your earlier definition.
                 (mount-point "/tmp")
                 (type "none") ;; We are mounting a folder, not a partition, so this type needs to be "none"
                 (flags '(bind-mount))
                 (dependencies (list source-drive)) ;; Ensure "source-drive" matches what you've named the variable for the drive.
                 )

                 ...<outras unidades omitidas para maior clareza>...

                ))

3.11 Obtendo substitutos pelo Tor

O daemon Guix pode usar um proxy HTTP para obter substitutos, aqui estamos configurando-o para obtê-los via Tor.

Aviso: Nem todo o tráfego do daemon Guix passará pelo Tor! Somente HTTP/HTTPS será encaminhado ao proxy; As conexões FTP, o protocolo Git, SSH, etc. ainda passarão pela rede aberta. Novamente, esta configuração não é infalível, pois parte do seu tráfego não será roteado pelo Tor. Use-o por sua conta e risco.

Observe também que o procedimento descrito aqui se aplica apenas à substituição de pacotes. Ao atualizar sua distribuição guix com guix pull, você ainda precisará usar torsocks se quiser rotear a conexão para os servidores de repositório git do guix através do Tor.

O servidor substituto do Guix está disponível como um serviço Onion, se você quiser usá-lo para obter seus substitutos através do Tor, configure seu sistema da seguinte forma:

(use-modules (gnu))
(use-service-module base networking)

(operating-system
  …
  (services
    (cons
      (service tor-service-type
              (tor-configuration
                (config-file (plain-file "tor-config"
                                         "HTTPTunnelPort 127.0.0.1:9250"))))
      (modify-services %base-services
        (guix-service-type
          config => (guix-configuration
                      (inherit config)
                      ;; ci.guix.gnu.org's Onion service
                      (substitute-urls
                       "https://4zwzi66wwdaalbhgnix55ea3ab4pvvw66ll2ow53kjub6se4q2bclcyd.onion")
                      (http-proxy "http://localhost:9250")))))))

Isso manterá um processo tor em execução que fornece um túnel HTTP CONNECT que será usado por guix-daemon. O daemon pode usar outros protocolos além do HTTP(S) para obter recursos remotos. A solicitação usando esses protocolos não passará pelo Tor, pois estamos apenas configurando um túnel HTTP aqui. Observe que substitutes-urls está usando HTTPS e não HTTP ou não funcionará, isso é uma limitação do túnel do Tor; você pode querer usar privoxy para evitar tais limitações.

Se você não deseja sempre obter substitutos através do Tor, mas usá-lo apenas algumas vezes, pule o guix-configuration. Quando você deseja obter um substituto da execução do túnel Tor:

sudo herd set-http-proxy guix-daemon http://localhost:9250
guix build \
  --substitute-urls=https://4zwzi66wwdaalbhgnix55ea3ab4pvvw66ll2ow53kjub6se4q2bclcyd.onion …

3.12 Configurando NGINX com Lua

O NGINX pode ser estendido com scripts Lua.

Guix fornece serviço NGINX com capacidade de carregar módulos Lua e pacotes Lua específicos, e responder a solicitações avaliando scripts Lua.

O exemplo a seguir demonstra a definição do sistema com configuração para avaliar o script Lua index.lua na solicitação HTTP para o endpoint http://localhost/hello:

local shell = require "resty.shell"

local stdin = ""
local timeout = 1000  -- ms
local max_size = 4096  -- byte

local ok, stdout, stderr, reason, status =
   shell.run([[/run/current-system/profile/bin/ls /tmp]], stdin, timeout, max_size)

ngx.say(stdout)

(use-modules (gnu))
(use-service-modules #;… web)
(use-package-modules #;… lua)
(operating-system
  ;; …
  (services
   ;; …
   (service nginx-service-type
            (nginx-configuration
             (modules
              (list
               (file-append nginx-lua-module "/etc/nginx/modules/ngx_http_lua_module.so")))
             (lua-package-path (list lua-resty-core
                                     lua-resty-lrucache
                                     lua-resty-signal
                                     lua-tablepool
                                     lua-resty-shell))
             (lua-package-cpath (list lua-resty-signal))
             (server-blocks
              (list (nginx-server-configuration
                     (server-name '("localhost"))
                     (listen '("80"))
                     (root "/etc")
                     (locations (list
                                 (nginx-location-configuration
                                  (uri "/hello")
                                  (body (list #~(format #f "content_by_lua_file ~s;"
                                                        #$(local-file "index.lua"))))))))))))))

3.13 Servidor de música com áudio Bluetooth

MPD, the Music Player Daemon, is a flexible server-side application for playing music. Client programs on different machines on the network — a mobile phone, a laptop, a desktop workstation — can connect to it to control the playback of audio files from your local music collection. MPD decodes the audio files and plays them back on one or many outputs.

By default MPD will play to the default audio device. In the example below we make things a little more interesting by setting up a headless music server. There will be no graphical user interface, no Pulseaudio daemon, and no local audio output. Instead we will configure MPD with two outputs: a bluetooth speaker and a web server to serve audio streams to any streaming media player.

Bluetooth is often rather frustrating to set up. You will have to pair your Bluetooth device and make sure that the device is automatically connected as soon as it powers on. The Bluetooth system service returned by the bluetooth-service procedure provides the infrastructure needed to set this up.

Reconfigure your system with at least the following services and packages:

(operating-system
  ;; …
  (packages (cons* bluez bluez-alsa
                   %base-packages))
  (services
   ;; …
   (dbus-service #:services (list bluez-alsa))
   (bluetooth-service #:auto-enable? #t)))

Start the bluetooth service and then use bluetoothctl to scan for Bluetooth devices. Try to identify your Bluetooth speaker and pick out its device ID from the resulting list of devices that is indubitably dominated by a baffling smorgasbord of your neighbors’ home automation gizmos. This only needs to be done once:

$ bluetoothctl 
[NEW] Controller 00:11:22:33:95:7F BlueZ 5.40 [default]

[bluetooth]# power on
[bluetooth]# Changing power on succeeded

[bluetooth]# agent on
[bluetooth]# Agent registered

[bluetooth]# default-agent
[bluetooth]# Default agent request successful

[bluetooth]# scan on
[bluetooth]# Discovery started
[CHG] Controller 00:11:22:33:95:7F Discovering: yes
[NEW] Device AA:BB:CC:A4:AA:CD My Bluetooth Speaker
[NEW] Device 44:44:FF:2A:20:DC My Neighbor's TV
…

[bluetooth]# pair AA:BB:CC:A4:AA:CD
Attempting to pair with AA:BB:CC:A4:AA:CD
[CHG] Device AA:BB:CC:A4:AA:CD Connected: yes

[My Bluetooth Speaker]# [CHG] Device AA:BB:CC:A4:AA:CD UUIDs: 0000110b-0000-1000-8000-00xxxxxxxxxx
[CHG] Device AA:BB:CC:A4:AA:CD UUIDs: 0000110c-0000-1000-8000-00xxxxxxxxxx
[CHG] Device AA:BB:CC:A4:AA:CD UUIDs: 0000110e-0000-1000-8000-00xxxxxxxxxx
[CHG] Device AA:BB:CC:A4:AA:CD Paired: yes
Pairing successful

[CHG] Device AA:BB:CC:A4:AA:CD Connected: no

[bluetooth]# 
[bluetooth]# trust AA:BB:CC:A4:AA:CD
[bluetooth]# [CHG] Device AA:BB:CC:A4:AA:CD Trusted: yes
Changing AA:BB:CC:A4:AA:CD trust succeeded

[bluetooth]# 
[bluetooth]# connect AA:BB:CC:A4:AA:CD
Attempting to connect to AA:BB:CC:A4:AA:CD
[bluetooth]# [CHG] Device AA:BB:CC:A4:AA:CD RSSI: -63
[CHG] Device AA:BB:CC:A4:AA:CD Connected: yes
Connection successful

[My Bluetooth Speaker]# scan off
[CHG] Device AA:BB:CC:A4:AA:CD RSSI is nil
Discovery stopped
[CHG] Controller 00:11:22:33:95:7F Discovering: no

Congratulations, you can now automatically connect to your Bluetooth speaker!

It is now time to configure ALSA to use the bluealsa Bluetooth module, so that you can define an ALSA pcm device corresponding to your Bluetooth speaker. For a headless server using bluealsa with a fixed Bluetooth device is likely simpler than configuring Pulseaudio and its stream switching behavior. We configure ALSA by crafting a custom alsa-configuration for the alsa-service-type. The configuration will declare a pcm type bluealsa from the bluealsa module provided by the bluez-alsa package, and then define a pcm device of that type for your Bluetooth speaker.

All that is left then is to make MPD send audio data to this ALSA device. We also add a secondary MPD output that makes the currently played audio files available as a stream through a web server on port 8080. When enabled a device on the network could listen to the audio stream by connecting any capable media player to the HTTP server on port 8080, independent of the status of the Bluetooth speaker.

What follows is the outline of an operating-system declaration that should accomplish the above-mentioned tasks:

(use-modules (gnu))
(use-service-modules audio dbus sound #;… etc)
(use-package-modules audio linux #;… etc)
(operating-system
  ;; …
  (packages (cons* bluez bluez-alsa
                   %base-packages))
  (services
   ;; …
   (service mpd-service-type
            (mpd-configuration
             (user "your-username")
             (music-dir "/path/to/your/music")
             (address "192.168.178.20")
             (outputs (list (mpd-output
                             (type "alsa")
                             (name "MPD")
                             (extra-options
                              ;; Use the same name as in the ALSA
                              ;; configuration below.
                              '((device . "pcm.btspeaker"))))
                            (mpd-output
                             (type "httpd")
                             (name "streaming")
                             (enabled? #false)
                             (always-on? #true)
                             (tags? #true)
                             (mixer-type 'null)
                             (extra-options
                              '((encoder . "vorbis")
                                (port    . "8080")
                                (bind-to-address . "192.168.178.20")
                                (max-clients . "0") ;no limit
                                (quality . "5.0")
                                (format  . "44100:16:1"))))))))
   (dbus-service #:services (list bluez-alsa))
   (bluetooth-service #:auto-enable? #t)
   (service alsa-service-type
            (alsa-configuration
             (pulseaudio? #false) ;we don't need it
             (extra-options
              #~(string-append "\
# Declare Bluetooth audio device type \"bluealsa\" from bluealsa module
pcm_type.bluealsa {
    lib \"" #$(file-append bluez-alsa "/lib/alsa-lib/libasound_module_pcm_bluealsa.so") "\"
}

# Declare control device type \"bluealsa\" from the same module
ctl_type.bluealsa {
    lib \"" #$(file-append bluez-alsa "/lib/alsa-lib/libasound_module_ctl_bluealsa.so") "\"
}

# Define the actual Bluetooth audio device.
pcm.btspeaker {
    type bluealsa
    device \"AA:BB:CC:A4:AA:CD\" # unique device identifier
    profile \"a2dp\"
}

# Define an associated controller.
ctl.btspeaker {
    type bluealsa
}
"))))))

Enjoy the music with the MPD client of your choice or a media player capable of streaming via HTTP!

4.1 Contêineres Guix

The easiest way to get started is to use guix shell with the --container option. Veja Invoking guix shell em GNU Guix Reference Manual for a reference of valid options.

The following snippet spawns a minimal shell process with most namespaces unshared from the system. The current working directory is visible to the process, but anything else on the file system is unavailable. This extreme isolation can be very useful when you want to rule out any sort of interference from environment variables, globally installed libraries, or configuration files.

guix shell --container

It is a bleak environment, barren, desolate. You will find that not even the GNU coreutils are available here, so to explore this deserted wasteland you need to use built-in shell commands. Even the usually gigantic /gnu/store directory is reduced to a faint shadow of itself.

$ echo /gnu/store/*
/gnu/store/…-gcc-10.3.0-lib
/gnu/store/…-glibc-2.33
/gnu/store/…-bash-static-5.1.8
/gnu/store/…-ncurses-6.2.20210619
/gnu/store/…-bash-5.1.8
/gnu/store/…-profile
/gnu/store/…-readline-8.1.1

There isn’t much you can do in an environment like this other than exiting it. You can use ^D or exit to terminate this limited shell environment.

You can make other directories available inside of the container environment; use --expose=DIRECTORY to bind-mount the given directory as a read-only location inside the container, or use --share=DIRECTORY to make the location writable. With an additional mapping argument after the directory name you can control the name of the directory inside the container. In the following example we map /etc on the host system to /the/host/etc inside a container in which the GNU coreutils are installed.

$ guix shell --container --share=/etc=/the/host/etc coreutils
$ ls /the/host/etc

Similarly, you can prevent the current working directory from being mapped into the container with the --no-cwd option. Another good idea is to create a dedicated directory that will serve as the container’s home directory, and spawn the container shell from that directory.

On a foreign system a container environment can be used to compile software that cannot possibly be linked with system libraries or with the system’s compiler toolchain. A common use-case in a research context is to install packages from within an R session. Outside of a container environment there is a good chance that the foreign compiler toolchain and incompatible system libraries are found first, resulting in incompatible binaries that cannot be used by R. In a container shell this problem disappears, as system libraries and executables simply aren’t available due to the unshared mount namespace.

Let’s take a comprehensive manifest providing a comfortable development environment for use with R:

(specifications->manifest
  (list "r-minimal"

        ;; base packages
        "bash-minimal"
        "glibc-locales"
        "nss-certs"

        ;; Common command line tools lest the container is too empty.
        "coreutils"
        "grep"
        "which"
        "wget"
        "sed"

        ;; R markdown tools
        "pandoc"

        ;; Toolchain and common libraries for "install.packages"
        "gcc-toolchain@10"
        "gfortran-toolchain"
        "gawk"
        "tar"
        "gzip"
        "unzip"
        "make"
        "cmake"
        "pkg-config"
        "cairo"
        "libxt"
        "openssl"
        "curl"
        "zlib"))

Let’s use this to run R inside a container environment. For convenience we share the net namespace to use the host system’s network interfaces. Now we can build R packages from source the traditional way without having to worry about ABI mismatch or incompatibilities.

$ guix shell --container --network --manifest=manifest.scm -- R

R version 4.2.1 (2022-06-23) -- "Funny-Looking Kid"
Copyright (C) 2022 The R Foundation for Statistical Computing
…
> e <- Sys.getenv("GUIX_ENVIRONMENT")
> Sys.setenv(GIT_SSL_CAINFO=paste0(e, "/etc/ssl/certs/ca-certificates.crt"))
> Sys.setenv(SSL_CERT_FILE=paste0(e, "/etc/ssl/certs/ca-certificates.crt"))
> Sys.setenv(SSL_CERT_DIR=paste0(e, "/etc/ssl/certs"))
> install.packages("Cairo", lib=paste0(getwd()))
…
* installing *source* package 'Cairo' ...
…
* DONE (Cairo)

The downloaded source packages are in
	'/tmp/RtmpCuwdwM/downloaded_packages'
> library("Cairo", lib=getwd())
> # success!

Using container shells is fun, but they can become a little cumbersome when you want to go beyond just a single interactive process. Some tasks become a lot easier when they sit on the rock solid foundation of a proper Guix System and its rich set of system services. The next section shows you how to launch a complete Guix System inside of a container.

4.2 Contêineres do Sistema Guix

The Guix System provides a wide array of interconnected system services that are configured declaratively to form a dependable stateless GNU System foundation for whatever tasks you throw at it. Even when using Guix on a foreign distribution you can benefit from the design of Guix System by running a system instance as a container. Using the same kernel features of unshared namespaces mentioned in the previous section, the resulting Guix System instance is isolated from the host system and only shares file system locations that you explicitly declare.

A Guix System container differs from the shell process created by guix shell --container in a number of important ways. While in a container shell the containerized process is a Bash shell process, a Guix System container runs the Shepherd as PID 1. In a system container all system services (veja Services em GNU Guix Reference Manual) are set up just as they would be on a Guix System in a virtual machine or on bare metal—this includes daemons managed by the GNU Shepherd (veja Shepherd Services em GNU Guix Reference Manual) as well as other kinds of extensions to the operating system (veja Service Composition em GNU Guix Reference Manual).

The perceived increase in complexity of running a Guix System container is easily justified when dealing with more complex applications that have higher or just more rigid requirements on their execution contexts—configuration files, dedicated user accounts, directories for caches or log files, etc. In Guix System the demands of this kind of software are satisfied through the deployment of system services.

• Um banco de dados de contêineres
• Rede em contêineres

(service postgresql-service-type
         (postgresql-configuration
          (postgresql postgresql-14)))

(use-modules (gnu))
(use-package-modules databases)
(use-service-modules databases)

(operating-system
  (host-name "container")
  (timezone "Europe/Berlin")
  (file-systems (cons (file-system
                        (device (file-system-label "does-not-matter"))
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))
  (bootloader (bootloader-configuration
               (bootloader grub-bootloader)
               (targets '("/dev/sdX"))))
  (services
   (cons* (service postgresql-service-type
                   (postgresql-configuration
                    (postgresql postgresql-14)
                    (config-file
                     (postgresql-config-file
                      (log-destination "stderr")
                      (hba-file
                       (plain-file "pg_hba.conf"
                                   "\
local	all	all			trust
host	all	all	10.0.0.1/32 	trust"))
                      (extra-config
                       '(("listen_addresses" "*")
                         ("log_directory"    "/var/log/postgresql")))))))
          (service postgresql-role-service-type
                   (postgresql-role-configuration
                    (roles
                     (list (postgresql-role
                            (name "test")
                            (create-database? #t))))))
          %base-services)))

$ guix system container os.scm
The following derivations will be built:
  /gnu/store/…-run-container.drv
  …
building /gnu/store/…-run-container.drv...
/gnu/store/…-run-container

$ sudo /gnu/store/…-run-container
system container is running as PID 5983
…

$ guix shell util-linux
$ sudo nsenter -a -t 5983
root@container /# pgrep -a postgres
49 /gnu/store/…-postgresql-14.4/bin/postgres -D /var/lib/postgresql/data --config-file=/gnu/store/…-postgresql.conf -p 5432
51 postgres: checkpointer
52 postgres: background writer
53 postgres: walwriter
54 postgres: autovacuum launcher
55 postgres: stats collector
56 postgres: logical replication launcher
root@container /# exit

pid=5983
ns="guix-test"
host="veth-test"
client="ceth-test"

# Attach the new net namespace "guix-test" to the container PID.
sudo ip netns attach $ns $pid

# Create the pair of devices
sudo ip link add $host type veth peer name $client

# Move the client device into the container's net namespace
sudo ip link set $client netns $ns

sudo ip link set $host up
sudo ip addr add 10.0.0.1/24 dev $host

sudo ip netns exec $ns  ip link set lo up
sudo ip netns exec $ns  ip link set $client up
sudo ip netns exec $ns  ip addr add 10.0.0.2/24 dev $client

$ psql -h 10.0.0.2 -U test
psql (14.4)
Type "help" for help.

test=> CREATE TABLE hello (who TEXT NOT NULL);
CREATE TABLE
test=> INSERT INTO hello (who) VALUES ('world');
INSERT 0 1
test=> SELECT * FROM hello;
  who
-------
 world
(1 row)

sudo kill $pid
sudo ip netns del $ns
sudo ip link del $host

5.1 Ponte de rede para QEMU

By default, QEMU uses a so-called “user mode” host network back-end, which is convenient as it does not require any configuration. Unfortunately, it is also quite limited. In this mode, the guest VM (virtual machine) can access the network the same way the host would, but it cannot be reached from the host. Additionally, since the QEMU user networking mode relies on ICMP, ICMP-based networking tools such as ping do not work in this mode. Thus, it is often desirable to configure a network bridge, which enables the guest to fully participate in the network. This is necessary, for example, when the guest is to be used as a server.

• Creating a network bridge interface
• Configuring the QEMU bridge helper script
• Invoking QEMU with the right command line options
• Networking issues caused by Docker

# nmcli con add type bridge con-name br0 ifname br0

# nmcli con add type bridge-slave ifname enp2s0 master br0

(setuid-programs
 (cons (file-append qemu "/libexec/qemu-bridge-helper")
       %setuid-programs))

(extra-special-file "/etc/qemu/host.conf" "allow br0\n")

$ qemu-system-x86_64 [...] \
    -device virtio-net-pci,netdev=user0,mac=XX:XX:XX:XX:XX:XX \
    -netdev bridge,id=user0,br=br0 \
    [...]

mac_address="52:54:00:$(dd if=/dev/urandom bs=512 count=1 2>/dev/null \
                           | md5sum \
                           | sed -E 's/^(..)(..)(..).*$/\1:\2:\3/')"
echo $mac_address

(service iptables-service-type
             (iptables-configuration
              (ipv4-rules (plain-file "iptables.rules" "\
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -i br0 -o br0 -j ACCEPT
COMMIT
"))

5.2 Roteamento de rede para libvirt

If the machine hosting your virtual machines is connected wirelessly to the network, you won’t be able to use a true network bridge as explained in the preceding section (veja Ponte de rede para QEMU). In this case, the next best option is to use a virtual bridge with static routing and to configure a libvirt-powered virtual machine to use it (via the virt-manager GUI for example). This is similar to the default mode of operation of QEMU/libvirt, except that instead of using NAT (Network Address Translation), it relies on static routes to join the VM (virtual machine) IP address to the LAN (local area network). This provides two-way connectivity to and from the virtual machine, which is needed for exposing services hosted on the virtual machine.

• Creating a virtual network bridge
• Configuring the static routes for your virtual bridge

<network>
  <name>virbr0</name>
  <bridge name="virbr0" />
  <forward mode="route"/>
  <ip address="192.168.2.0" netmask="255.255.255.0">
    <dhcp>
      <range start="192.168.2.1" end="192.168.2.254"/>
    </dhcp>
  </ip>
</network>

virsh net-define /tmp/virbr0.xml
virsh net-autostart virbr0
virsh net-start virbr0

6.1 Perfis Guix na Prática

Guix provides a very useful feature that may be quite foreign to newcomers: profiles. They are a way to group package installations together and all users on the same system are free to use as many profiles as they want.

Whether you’re a developer or not, you may find that multiple profiles bring you great power and flexibility. While they shift the paradigm somewhat compared to traditional package managers, they are very convenient to use once you’ve understood how to set them up.

Nota: This section is an opinionated guide on the use of multiple profiles. It predates guix shell and its fast profile cache (veja Invoking guix shell em GNU Guix Reference Manual).

In many cases, you may find that using guix shell to set up the environment you need, when you need it, is less work that maintaining a dedicated profile. Your call!

If you are familiar with Python’s ‘virtualenv’, you can think of a profile as a kind of universal ‘virtualenv’ that can hold any kind of software whatsoever, not just Python software. Furthermore, profiles are self-sufficient: they capture all the runtime dependencies which guarantees that all programs within a profile will always work at any point in time.

Multiple profiles have many benefits:

• Clean semantic separation of the various packages a user needs for different contexts.
• Multiple profiles can be made available into the environment either on login or within a dedicated shell.
• Profiles can be loaded on demand. For instance, the user can use multiple shells, each of them running different profiles.
• Isolation: Programs from one profile will not use programs from the other, and the user can even install different versions of the same programs to the two profiles without conflict.
• Deduplication: Profiles share dependencies that happens to be the exact same. This makes multiple profiles storage-efficient.
• Reproducible: when used with declarative manifests, a profile can be fully specified by the Guix commit that was active when it was set up. This means that the exact same profile can be set up anywhere and anytime, with just the commit information. See the section on Perfis reproduzíveis.
• Easier upgrades and maintenance: Multiple profiles make it easy to keep package listings at hand and make upgrades completely frictionless.

Concretely, here follows some typical profiles:

• The dependencies of a project you are working on.
• Your favourite programming language libraries.
• Laptop-specific programs (like ‘powertop’) that you don’t need on a desktop.
• TeXlive (this one can be really useful when you need to install just one package for this one document you’ve just received over email).
• Games.

Let’s dive in the set up!

• Configuração básica com manifestos
• Pacotes necessários
• Perfil padrão
• Os benefícios dos manifestos
• Perfis reproduzíveis

(specifications->manifest
  '("package-1"
    ;; Version 1.3 of package-2.
    "package-2@1.3"
    ;; The "lib" output of package-3.
    "package-3:lib"
    ; ...
    "package-N"))

GUIX_EXTRA_PROFILES=$HOME/.guix-extra-profiles
mkdir -p "$GUIX_EXTRA_PROFILES"/my-project # if it does not exist yet
guix package --manifest=/path/to/guix-my-project-manifest.scm --profile="$GUIX_EXTRA_PROFILES"/my-project/my-project

guix package --list-profiles

for i in $GUIX_EXTRA_PROFILES/*; do
  profile=$i/$(basename "$i")
  if [ -f "$profile"/etc/profile ]; then
    GUIX_PROFILE="$profile"
    . "$GUIX_PROFILE"/etc/profile
  fi
  unset profile
done

for i in "$GUIX_EXTRA_PROFILES"/my-project-1 "$GUIX_EXTRA_PROFILES"/my-project-2; do
  profile=$i/$(basename "$i")
  if [ -f "$profile"/etc/profile ]; then
    GUIX_PROFILE="$profile"
    . "$GUIX_PROFILE"/etc/profile
  fi
  unset profile
done

GUIX_PROFILE="path/to/my-project" ; . "$GUIX_PROFILE"/etc/profile

guix package --search-paths=prefix --profile=$my_profile"

guix package -m /path/to/guix-my-project-manifest.scm -p "$GUIX_EXTRA_PROFILES"/my-project/my-project

for profile in "$GUIX_EXTRA_PROFILES"/*; do
  guix package --profile="$profile" --manifest="$HOME/.guix-manifests/guix-$profile-manifest.scm"
done

guix package -p "$GUIX_EXTRA_PROFILES"/my-project/my-project --list-generations

guix package -p "$GUIX_EXTRA_PROFILES"/my-project/my-project --switch-generations=17

env -i $(which bash) --login --noprofile --norc
. my-project/etc/profile

guix install package-foo
guix upgrade package-bar

GUIX_EXTRA_PROFILES=$HOME/.guix-extra-profiles
GUIX_EXTRA=$HOME/.guix-extra

mkdir -p "$GUIX_EXTRA"/my-project
guix pull --channels=channel-specs.scm --profile="$GUIX_EXTRA/my-project/guix"

mkdir -p "$GUIX_EXTRA_PROFILES/my-project"
"$GUIX_EXTRA"/my-project/guix/bin/guix package --manifest=/path/to/guix-my-project-manifest.scm --profile="$GUIX_EXTRA_PROFILES"/my-project/my-project

7.1 Começando

How do we go about “Guixifying” a repository? The first step, as we’ve seen, will be to add a guix.scm at the root of the repository in question. We’ll take Guile as an example in this chapter: it’s written in Scheme (mostly) and C, and has a number of dependencies—a C compilation tool chain, C libraries, Autoconf and its friends, LaTeX, and so on. The resulting guix.scm looks like the usual package definition (veja Defining Packages em GNU Guix Reference Manual), just without the define-public bit:

;; The ‘guix.scm’ file for Guile, for use by ‘guix shell’.

(use-modules (guix)
             (guix build-system gnu)
             ((guix licenses) #:prefix license:)
             (gnu packages autotools)
             (gnu packages base)
             (gnu packages bash)
             (gnu packages bdw-gc)
             (gnu packages compression)
             (gnu packages flex)
             (gnu packages gdb)
             (gnu packages gettext)
             (gnu packages gperf)
             (gnu packages libffi)
             (gnu packages libunistring)
             (gnu packages linux)
             (gnu packages pkg-config)
             (gnu packages readline)
             (gnu packages tex)
             (gnu packages texinfo)
             (gnu packages version-control))

(package
  (name "guile")
  (version "3.0.99-git")                          ;funky version number
  (source #f)                                     ;no source
  (build-system gnu-build-system)
  (native-inputs
   (append (list autoconf
                 automake
                 libtool
                 gnu-gettext
                 flex
                 texinfo
                 texlive-base                 ;for "make pdf"
                 texlive-epsf
                 gperf
                 git
                 gdb
                 strace
                 readline
                 lzip
                 pkg-config)

           ;; When cross-compiling, a native version of Guile itself is
           ;; needed.
           (if (%current-target-system)
               (list this-package)
               '())))
  (inputs
   (list libffi bash-minimal))
  (propagated-inputs
   (list libunistring libgc))

  (native-search-paths
   (list (search-path-specification
          (variable "GUILE_LOAD_PATH")
          (files '("share/guile/site/3.0")))
         (search-path-specification
          (variable "GUILE_LOAD_COMPILED_PATH")
          (files '("lib/guile/3.0/site-ccache")))))
  (synopsis "Scheme implementation intended especially for extensions")
  (description
   "Guile is the GNU Ubiquitous Intelligent Language for Extensions,
and it's actually a full-blown Scheme implementation!")
  (home-page "https://www.gnu.org/software/guile/")
  (license license:lgpl3+))

Quite a bit of boilerplate, but now someone who’d like to hack on Guile now only needs to run:

guix shell

That gives them a shell containing all the dependencies of Guile: those listed above, but also implicit dependencies such as the GCC tool chain, GNU Make, sed, grep, and so on. Veja Invoking guix shell em GNU Guix Reference Manual, for more info on guix shell.

The chef’s recommendation: Our suggestion is to create development environments like this:

guix shell --container --link-profile

... or, for short:

guix shell -CP

That gives a shell in an isolated container, and all the dependencies show up in $HOME/.guix-profile, which plays well with caches such as config.cache (veja Cache Files em Autoconf) and absolute file names recorded in generated Makefiles and the likes. The fact that the shell runs in a container brings peace of mind: nothing but the current directory and Guile’s dependencies is visible inside the container; nothing from the system can possibly interfere with your development.

7.2 Level 1: Building with Guix

Now that we have a package definition (veja Começando), why not also take advantage of it so we can build Guile with Guix? We had left the source field empty, because guix shell above only cares about the inputs of our package—so it can set up the development environment—not about the package itself.

To build the package with Guix, we’ll need to fill out the source field, along these lines:

(use-modules (guix)
             (guix git-download)  ;for ‘git-predicate’
             …)

(define vcs-file?
  ;; Return true if the given file is under version control.
  (or (git-predicate (current-source-directory))
      (const #t)))                                ;not in a Git checkout

(package
  (name "guile")
  (version "3.0.99-git")                          ;funky version number
  (source (local-file "." "guile-checkout"
                      #:recursive? #t
                      #:select? vcs-file?))
  …)

Here’s what we changed compared to the previous section:

1. We added (guix git-download) to our set of imported modules, so we can use its git-predicate procedure.
2. We defined vcs-file? as a procedure that returns true when passed a file that is under version control. For good measure, we add a fallback case for when we’re not in a Git checkout: always return true.
3. We set source to a local-file—a recursive copy of the current directory ("."), limited to files under version control (the #:select? bit).

From there on, our guix.scm file serves a second purpose: it lets us build the software with Guix. The whole point of building with Guix is that it’s a “clean” build—you can be sure nothing from your working tree or system interferes with the build result—and it lets you test a variety of things. First, you can do a plain native build:

guix build -f guix.scm

But you can also build for another system (possibly after setting up veja offloading em GNU Guix Reference Manual or veja transparent emulation em GNU Guix Reference Manual):

guix build -f guix.scm -s aarch64-linux -s riscv64-linux

… or cross-compile:

guix build -f guix.scm --target=x86_64-w64-mingw32

You can also use package transformations to test package variants (veja Package Transformation Options em GNU Guix Reference Manual):

# What if we built with Clang instead of GCC?
guix build -f guix.scm \
  --with-c-toolchain=guile@3.0.99-git=clang-toolchain

# What about that under-tested configure flag?
guix build -f guix.scm \
  --with-configure-flag=guile@3.0.99-git=--disable-networking

Handy!

7.3 Level 2: The Repository as a Channel

We now have a Git repository containing (among other things) a package definition (veja Level 1: Building with Guix). Can’t we turn it into a channel (veja Channels em GNU Guix Reference Manual)? After all, channels are designed to ship package definitions to users, and that’s exactly what we’re doing with our guix.scm.

Turns out we can indeed turn it into a channel, but with one caveat: we must create a separate directory for the .scm file(s) of our channel so that guix pull doesn’t load unrelated .scm files when someone pulls the channel—and in Guile, there are lots of them! So we’ll start like this, keeping a top-level guix.scm symlink for the sake of guix shell:

mkdir -p .guix/modules
mv guix.scm .guix/modules/guile-package.scm
ln -s .guix/modules/guile-package.scm guix.scm

To make it usable as part of a channel, we need to turn our guix.scm file into a package module (veja Package Modules em GNU Guix Reference Manual): we do that by changing the use-modules form at the top to a define-module form. We also need to actually export a package variable, with define-public, while still returning the package value at the end of the file so we can still use guix shell and guix build -f guix.scm. The end result looks like this (not repeating things that haven’t changed):

(define-module (guile-package)
  #:use-module (guix)
  #:use-module (guix git-download)   ;for ‘git-predicate’
  …)

(define vcs-file?
  ;; Return true if the given file is under version control.
  (or (git-predicate (dirname (dirname (current-source-directory))))
      (const #t)))                                ;not in a Git checkout

(define-public guile
  (package
    (name "guile")
    (version "3.0.99-git")                          ;funky version number
    (source (local-file "../.." "guile-checkout"
                        #:recursive? #t
                        #:select? vcs-file?))
    …))

;; Return the package object define above at the end of the module.
guile

We need one last thing: a .guix-channel file so Guix knows where to look for package modules in our repository:

;; This file lets us present this repo as a Guix channel.

(channel
  (version 0)
  (directory ".guix/modules"))  ;look for package modules under .guix/modules/

To recap, we now have these files:

.
├── .guix-channel
├── guix.scm → .guix/modules/guile-package.scm
└── .guix
    └── modules
       └── guile-package.scm

And that’s it: we have a channel! (We could do better and support channel authentication so users know they’re pulling genuine code. We’ll spare you the details here but it’s worth considering!) Users can pull from this channel by adding it to ~/.config/guix/channels.scm, along these lines:

(append (list (channel
                (name 'guile)
                (url "https://git.savannah.gnu.org/git/guile.git")
                (branch "main")))
        %default-channels)

After running guix pull, we can see the new package:

$ guix describe
Generation 264  May 26 2023 16:00:35    (current)
  guile 36fd2b4
    repository URL: https://git.savannah.gnu.org/git/guile.git
    branch: main
    commit: 36fd2b4920ae926c79b936c29e739e71a6dff2bc
  guix c5bc698
    repository URL: https://git.savannah.gnu.org/git/guix.git
    commit: c5bc698e8922d78ed85989985cc2ceb034de2f23
$ guix package -A ^guile$
guile   3.0.99-git      out,debug       guile-package.scm:51:4
guile   3.0.9           out,debug       gnu/packages/guile.scm:317:2
guile   2.2.7           out,debug       gnu/packages/guile.scm:258:2
guile   2.2.4           out,debug       gnu/packages/guile.scm:304:2
guile   2.0.14          out,debug       gnu/packages/guile.scm:148:2
guile   1.8.8           out             gnu/packages/guile.scm:77:2
$ guix build guile@3.0.99-git
[…]
/gnu/store/axnzbl89yz7ld78bmx72vpqp802dwsar-guile-3.0.99-git-debug
/gnu/store/r34gsij7f0glg2fbakcmmk0zn4v62s5w-guile-3.0.99-git

That’s how, as a developer, you get your software delivered directly into the hands of users! No intermediaries, yet no loss of transparency and provenance tracking.

With that in place, it also becomes trivial for anyone to create Docker images, Deb/RPM packages, or a plain tarball with guix pack (veja Invoking guix pack em GNU Guix Reference Manual):

# How about a Docker image of our Guile snapshot?
guix pack -f docker -S /bin=bin guile@3.0.99-git

# And a relocatable RPM?
guix pack -f rpm -R -S /bin=bin guile@3.0.99-git

7.4 Bonus: Package Variants

We now have an actual channel, but it contains only one package (veja Level 2: The Repository as a Channel). While we’re at it, we can define package variants (veja Defining Package Variants em GNU Guix Reference Manual) in our guile-package.scm file, variants that we want to be able to test as Guile developers—similar to what we did above with transformation options. We can add them like so:

;; This is the ‘.guix/modules/guile-package.scm’ file.

(define-module (guile-package)
  …)

(define-public guile
  …)

(define (package-with-configure-flags p flags)
  "Return P with FLAGS as additional 'configure' flags."
  (package/inherit p
    (arguments
     (substitute-keyword-arguments (package-arguments p)
       ((#:configure-flags original-flags #~(list))
        #~(append #$original-flags #$flags))))))

(define-public guile-without-threads
  (package
    (inherit (package-with-configure-flags guile
                                           #~(list "--without-threads")))
    (name "guile-without-threads")))

(define-public guile-without-networking
  (package
    (inherit (package-with-configure-flags guile
                                           #~(list "--disable-networking")))
    (name "guile-without-networking")))


;; Return the package object defined above at the end of the module.
guile

We can build these variants as regular packages once we’ve pulled the channel. Alternatively, from a checkout of Guile, we can run a command like this one from the top level:

guix build -L $PWD/.guix/modules guile-without-threads

7.5 Level 3: Setting Up Continuous Integration

The channel we defined above (veja Level 2: The Repository as a Channel) becomes even more interesting once we set up continuous integration (CI). There are several ways to do that.

You can use one of the mainstream continuous integration tools, such as GitLab-CI. To do that, you need to make sure you run jobs in a Docker image or virtual machine that has Guix installed. If we were to do that in the case of Guile, we’d have a job that runs a shell command like this one:

guix build -L $PWD/.guix/modules guile@3.0.99-git

Doing this works great and has the advantage of being easy to achieve on your favorite CI platform.

That said, you’ll really get the most of it by using Cuirass, a CI tool designed for and tightly integrated with Guix. Using it is more work than using a hosted CI tool because you first need to set it up, but that setup phase is greatly simplified if you use its Guix System service (veja Continuous Integration em GNU Guix Reference Manual). Going back to our example, we give Cuirass a spec file that goes like this:

;; Cuirass spec file to build all the packages of the ‘guile’ channel.
(list (specification
        (name "guile")
        (build '(channels guile))
        (channels
         (append (list (channel
                         (name 'guile)
                         (url "https://git.savannah.gnu.org/git/guile.git")
                         (branch "main")))
                 %default-channels))))

It differs from what you’d do with other CI tools in two important ways:

• Cuirass knows it’s tracking two channels, guile and guix. Indeed, our own guile package depends on many packages provided by the guix channel—GCC, the GNU libc, libffi, and so on. Changes to packages from the guix channel can potentially influence our guile build and this is something we’d like to see as soon as possible as Guile developers.
• Build results are not thrown away: they can be distributed as substitutes so that users of our guile channel transparently get pre-built binaries! (veja Substitutes em GNU Guix Reference Manual, for background info on substitutes.)

From a developer’s viewpoint, the end result is this status page listing evaluations: each evaluation is a combination of commits of the guix and guile channels providing a number of jobs—one job per package defined in guile-package.scm times the number of target architectures.

As for substitutes, they come for free! As an example, since our guile jobset is built on ci.guix.gnu.org, which runs guix publish (veja Invoking guix publish em GNU Guix Reference Manual) in addition to Cuirass, one automatically gets substitutes for guile builds from ci.guix.gnu.org; no additional work is needed for that.

7.6 Bonus: Build manifest

The Cuirass spec above is convenient: it builds every package in our channel, which includes a few variants (veja Level 3: Setting Up Continuous Integration). However, this might be insufficiently expressive in some cases: one might want specific cross-compilation jobs, transformations, Docker images, RPM/Deb packages, or even system tests.

To achieve that, you can write a manifest (veja Writing Manifests em GNU Guix Reference Manual). The one we have for Guile has entries for the package variants we defined above, as well as additional variants and cross builds:

;; This is ‘.guix/manifest.scm’.

(use-modules (guix)
             (guix profiles)
             (guile-package))   ;import our own package module

(define* (package->manifest-entry* package system
                                   #:key target)
  "Return a manifest entry for PACKAGE on SYSTEM, optionally cross-compiled to
TARGET."
  (manifest-entry
    (inherit (package->manifest-entry package))
    (name (string-append (package-name package) "." system
                         (if target
                             (string-append "." target)
                             "")))
    (item (with-parameters ((%current-system system)
                            (%current-target-system target))
            package))))

(define native-builds
  (manifest
   (append (map (lambda (system)
                  (package->manifest-entry* guile system))

                '("x86_64-linux" "i686-linux"
                  "aarch64-linux" "armhf-linux"
                  "powerpc64le-linux"))
           (map (lambda (guile)
                  (package->manifest-entry* guile "x86_64-linux"))
                (cons (package
                        (inherit (package-with-c-toolchain
                                  guile
                                  `(("clang-toolchain"
                                     ,(specification->package
                                       "clang-toolchain")))))
                        (name "guile-clang"))
                      (list guile-without-threads
                            guile-without-networking
                            guile-debug
                            guile-strict-typing))))))

(define cross-builds
  (manifest
   (map (lambda (target)
          (package->manifest-entry* guile "x86_64-linux"
                                    #:target target))
        '("i586-pc-gnu"
          "aarch64-linux-gnu"
          "riscv64-linux-gnu"
          "i686-w64-mingw32"
          "x86_64-linux-gnu"))))

(concatenate-manifests (list native-builds cross-builds))

We won’t go into the details of this manifest; suffice to say that it provides additional flexibility. We now need to tell Cuirass to build this manifest, which is done with a spec slightly different from the previous one:

;; Cuirass spec file to build all the packages of the ‘guile’ channel.
(list (specification
        (name "guile")
        (build '(manifest ".guix/manifest.scm"))
        (channels
         (append (list (channel
                         (name 'guile)
                         (url "https://git.savannah.gnu.org/git/guile.git")
                         (branch "main")))
                 %default-channels))))

We changed the (build …) part of the spec to '(manifest ".guix/manifest.scm") so that it would pick our manifest, and that’s it!

7.7 Empacotando

We picked Guile as the running example in this chapter and you can see the result here:

• .guix-channel;
• .guix/modules/guile-package.scm with the top-level guix.scm symlink;
• .guix/manifest.scm.

These days, repositories are commonly peppered with dot files for various tools: .envrc, .gitlab-ci.yml, .github/workflows, Dockerfile, .buildpacks, Aptfile, requirements.txt, and whatnot. It may sound like we’re proposing a bunch of additional files, but in fact those files are expressive enough to supersede most or all of those listed above.

With a couple of files, we get support for:

• development environments (guix shell);
• pristine test builds, including for package variants and for cross-compilation (guix build);
• continuous integration (with Cuirass or with some other tool);
• continuous delivery to users (via the channel and with pre-built binaries);
• generation of derivative build artifacts such as Docker images or Deb/RPM packages (guix pack).

This a nice (in our view!) unified tool set for reproducible software deployment, and an illustration of how you as a developer can benefit from it!

8.1 Ambiente Guix via direnv

Guix provides a ‘direnv’ package, which could extend shell after directory change. This tool could be used to prepare a pure Guix environment.

The following example provides a shell function for ~/.direnvrc file, which could be used from Guix Git repository in ~/src/guix/.envrc file to setup a build environment similar to described in veja Building from Git em GNU Guix Reference Manual.

Create a ~/.direnvrc with a Bash code:

# Thanks <https://github.com/direnv/direnv/issues/73#issuecomment-152284914>
export_function()
{
  local name=$1
  local alias_dir=$PWD/.direnv/aliases
  mkdir -p "$alias_dir"
  PATH_add "$alias_dir"
  local target="$alias_dir/$name"
  if declare -f "$name" >/dev/null; then
    echo "#!$SHELL" > "$target"
    declare -f "$name" >> "$target" 2>/dev/null
    # Notice that we add shell variables to the function trigger.
    echo "$name \$*" >> "$target"
    chmod +x "$target"
  fi
}

use_guix()
{
    # Set GitHub token.
    export GUIX_GITHUB_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

    # Unset 'GUIX_PACKAGE_PATH'.
    export GUIX_PACKAGE_PATH=""

    # Recreate a garbage collector root.
    gcroots="$HOME/.config/guix/gcroots"
    mkdir -p "$gcroots"
    gcroot="$gcroots/guix"
    if [ -L "$gcroot" ]
    then
        rm -v "$gcroot"
    fi

    # Miscellaneous packages.
    PACKAGES_MAINTENANCE=(
        direnv
        git
        git:send-email
        git-cal
        gnupg
        guile-colorized
        guile-readline
        less
        ncurses
        openssh
        xdot
    )

    # Environment packages.
    PACKAGES=(help2man guile-sqlite3 guile-gcrypt)

    # Thanks <https://lists.gnu.org/archive/html/guix-devel/2016-09/msg00859.html>
    eval "$(guix environment --search-paths --root="$gcroot" --pure guix --ad-hoc ${PACKAGES[@]} ${PACKAGES_MAINTENANCE[@]} "$@")"

    # Predefine configure flags.
    configure()
    {
        ./configure --localstatedir=/var --prefix=
    }
    export_function configure

    # Run make and optionally build something.
    build()
    {
        make -j 2
        if [ $# -gt 0 ]
        then
            ./pre-inst-env guix build "$@"
        fi
    }
    export_function build

    # Predefine push Git command.
    push()
    {
        git push --set-upstream origin
    }
    export_function push

    clear                        # Clean up the screen.
    git-cal --author='Your Name' # Show contributions calendar.

    # Show commands help.
    echo "
build          build a package or just a project if no argument provided
configure      run ./configure with predefined parameters
push           push to upstream Git repository
"
}

Every project containing .envrc with a string use guix will have predefined environment variables and procedures.

Run direnv allow to setup the environment for the first time.

9.1 Configurando um nó principal

The recommended approach is to set up one head node running guix-daemon and exporting /gnu/store over NFS to compute nodes.

Remember that guix-daemon is responsible for spawning build processes and downloads on behalf of clients (veja Invoking guix-daemon em GNU Guix Reference Manual), and more generally accessing /gnu/store, which contains all the package binaries built by all the users (veja The Store em GNU Guix Reference Manual). “Client” here refers to all the Guix commands that users see, such as guix install. On a cluster, these commands may be running on the compute nodes and we’ll want them to talk to the head node’s guix-daemon instance.

To begin with, the head node can be installed following the usual binary installation instructions (veja Binary Installation em GNU Guix Reference Manual). Thanks to the installation script, this should be quick. Once installation is complete, we need to make some adjustments.

Since we want guix-daemon to be reachable not just from the head node but also from the compute nodes, we need to arrange so that it listens for connections over TCP/IP. To do that, we’ll edit the systemd startup file for guix-daemon, /etc/systemd/system/guix-daemon.service, and add a --listen argument to the ExecStart line so that it looks something like this:

ExecStart=/var/guix/profiles/per-user/root/current-guix/bin/guix-daemon --build-users-group=guixbuild --listen=/var/guix/daemon-socket/socket --listen=0.0.0.0

For these changes to take effect, the service needs to be restarted:

systemctl daemon-reload
systemctl restart guix-daemon

Nota: The --listen=0.0.0.0 bit means that guix-daemon will process all incoming TCP connections on port 44146 (veja Invoking guix-daemon em GNU Guix Reference Manual). This is usually fine in a cluster setup where the head node is reachable exclusively from the cluster’s local area network—you don’t want that to be exposed to the Internet!

The next step is to define our NFS exports in /etc/exports by adding something along these lines:

/gnu/store    *(ro)
/var/guix     *(rw, async)
/var/log/guix *(ro)

The /gnu/store directory can be exported read-only since only guix-daemon on the master node will ever modify it. /var/guix contains user profiles as managed by guix package; thus, to allow users to install packages with guix package, this must be read-write.

Users can create as many profiles as they like in addition to the default profile, ~/.guix-profile. For instance, guix package -p ~/dev/python-dev -i python installs Python in a profile reachable from the ~/dev/python-dev symlink. To make sure that this profile is protected from garbage collection—i.e., that Python will not be removed from /gnu/store while this profile exists—, home directories should be mounted on the head node as well so that guix-daemon knows about these non-standard profiles and avoids collecting software they refer to.

It may be a good idea to periodically remove unused bits from /gnu/store by running guix gc (veja Invoking guix gc em GNU Guix Reference Manual). This can be done by adding a crontab entry on the head node:

root@master# crontab -e

... with something like this:

# Every day at 5AM, run the garbage collector to make sure
# at least 10 GB are free on /gnu/store.
0 5 * * 1  /usr/local/bin/guix gc -F10G

We’re done with the head node! Let’s look at compute nodes now.

9.2 Configurando nós de computação

First of all, we need compute nodes to mount those NFS directories that the head node exports. This can be done by adding the following lines to /etc/fstab:

head-node:/gnu/store    /gnu/store    nfs  defaults,_netdev,vers=3 0 0
head-node:/var/guix     /var/guix     nfs  defaults,_netdev,vers=3 0 0
head-node:/var/log/guix /var/log/guix nfs  defaults,_netdev,vers=3 0 0

... where head-node is the name or IP address of your head node. From there on, assuming the mount points exist, you should be able to mount each of these on the compute nodes.

Next, we need to provide a default guix command that users can run when they first connect to the cluster (eventually they will invoke guix pull, which will provide them with their “own” guix command). Similar to what the binary installation script did on the head node, we’ll store that in /usr/local/bin:

mkdir -p /usr/local/bin
ln -s /var/guix/profiles/per-user/root/current-guix/bin/guix \
      /usr/local/bin/guix

We then need to tell guix to talk to the daemon running on our master node, by adding these lines to /etc/profile:

GUIX_DAEMON_SOCKET="guix://head-node"
export GUIX_DAEMON_SOCKET

To avoid warnings and make sure guix uses the right locale, we need to tell it to use locale data provided by Guix (veja Application Setup em GNU Guix Reference Manual):

GUIX_LOCPATH=/var/guix/profiles/per-user/root/guix-profile/lib/locale
export GUIX_LOCPATH

# Here we must use a valid locale name.  Try "ls $GUIX_LOCPATH/*"
# to see what names can be used.
LC_ALL=fr_FR.utf8
export LC_ALL

For convenience, guix package automatically generates ~/.guix-profile/etc/profile, which defines all the environment variables necessary to use the packages—PATH, C_INCLUDE_PATH, PYTHONPATH, etc. Likewise, guix pull does that under ~/.config/guix/current. Thus it’s a good idea to source both from /etc/profile:

for GUIX_PROFILE in "$HOME/.config/guix/current" "$HOME/.guix-profile"
do
  if [ -f "$GUIX_PROFILE/etc/profile" ]; then
    . "$GUIX_PROFILE/etc/profile"
  fi
done

Last but not least, Guix provides command-line completion notably for Bash and zsh. In /etc/bashrc, consider adding this line:

. /var/guix/profiles/per-user/root/current-guix/etc/bash_completion.d/guix

Voilà!

You can check that everything’s in place by logging in on a compute node and running:

guix install hello

The daemon on the head node should download pre-built binaries on your behalf and unpack them in /gnu/store, and guix install should create ~/.guix-profile containing the ~/.guix-profile/bin/hello command.

9.3 Network Access

Guix requires network access to download source code and pre-built binaries. The good news is that only the head node needs that since compute nodes simply delegate to it.

It is customary for cluster nodes to have access at best to a white list of hosts. Our head node needs at least ci.guix.gnu.org in this white list since this is where it gets pre-built binaries from by default, for all the packages that are in Guix proper.

Incidentally, ci.guix.gnu.org also serves as a content-addressed mirror of the source code of those packages. Consequently, it is sufficient to have only ci.guix.gnu.org in that white list.

Software packages maintained in a separate repository such as one of the various HPC channels are of course unavailable from ci.guix.gnu.org. For these packages, you may want to extend the white list such that source and pre-built binaries (assuming this-party servers provide binaries for these packages) can be downloaded. As a last resort, users can always download source on their workstation and add it to the cluster’s /gnu/store, like this:

GUIX_DAEMON_SOCKET=ssh://compute-node.example.org \
  guix download http://starpu.gforge.inria.fr/files/starpu-1.2.3/starpu-1.2.3.tar.gz

The above command downloads starpu-1.2.3.tar.gz and sends it to the cluster’s guix-daemon instance over SSH.

Air-gapped clusters require more work. At the moment, our suggestion would be to download all the necessary source code on a workstation running Guix. For instance, using the --sources option of guix build (veja Invoking guix build em GNU Guix Reference Manual), the example below downloads all the source code the openmpi package depends on:

$ guix build --sources=transitive openmpi

…

/gnu/store/xc17sm60fb8nxadc4qy0c7rqph499z8s-openmpi-1.10.7.tar.bz2
/gnu/store/s67jx92lpipy2nfj5cz818xv430n4b7w-gcc-5.4.0.tar.xz
/gnu/store/npw9qh8a46lrxiwh9xwk0wpi3jlzmjnh-gmp-6.0.0a.tar.xz
/gnu/store/hcz0f4wkdbsvsdky3c0vdvcawhdkyldb-mpfr-3.1.5.tar.xz
/gnu/store/y9akh452n3p4w2v631nj0injx7y0d68x-mpc-1.0.3.tar.gz
/gnu/store/6g5c35q8avfnzs3v14dzl54cmrvddjm2-glibc-2.25.tar.xz
/gnu/store/p9k48dk3dvvk7gads7fk30xc2pxsd66z-hwloc-1.11.8.tar.bz2
/gnu/store/cry9lqidwfrfmgl0x389cs3syr15p13q-gcc-5.4.0.tar.xz
/gnu/store/7ak0v3rzpqm2c5q1mp3v7cj0rxz0qakf-libfabric-1.4.1.tar.bz2
/gnu/store/vh8syjrsilnbfcf582qhmvpg1v3rampf-rdma-core-14.tar.gz
…

(In case you’re wondering, that’s more than 320 MiB of compressed source code.)

We can then make a big archive containing all of this (veja Invoking guix archive em GNU Guix Reference Manual):

$ guix archive --export \
    `guix build --sources=transitive openmpi` \
    > openmpi-source-code.nar

… and we can eventually transfer that archive to the cluster on removable storage and unpack it there:

$ guix archive --import < openmpi-source-code.nar

This process has to be repeated every time new source code needs to be brought to the cluster.

As we write this, the research institutes involved in Guix-HPC do not have air-gapped clusters though. If you have experience with such setups, we would like to hear feedback and suggestions.

9.4 Uso do Disco

A common concern of sysadmins’ is whether this is all going to eat a lot of disk space. If anything, if something is going to exhaust disk space, it’s going to be scientific data sets rather than compiled software—that’s our experience with almost ten years of Guix usage on HPC clusters. Nevertheless, it’s worth taking a look at how Guix contributes to disk usage.

First, having several versions or variants of a given package in /gnu/store does not necessarily cost much, because guix-daemon implements deduplication of identical files, and package variants are likely to have a number of common files.

As mentioned above, we recommend having a cron job to run guix gc periodically, which removes unused software from /gnu/store. However, there’s always a possibility that users will keep lots of software in their profiles, or lots of old generations of their profiles, which is “live” and cannot be deleted from the viewpoint of guix gc.

The solution to this is for users to regularly remove old generations of their profile. For instance, the following command removes generations that are more than two-month old:

guix package --delete-generations=2m

Likewise, it’s a good idea to invite users to regularly upgrade their profile, which can reduce the number of variants of a given piece of software stored in /gnu/store:

guix pull
guix upgrade

As a last resort, it is always possible for sysadmins to do some of this on behalf of their users. Nevertheless, one of the strengths of Guix is the freedom and control users get on their software environment, so we strongly recommend leaving users in control.

9.5 Security Considerations

On an HPC cluster, Guix is typically used to manage scientific software. Security-critical software such as the operating system kernel and system services such as sshd and the batch scheduler remain under control of sysadmins.

The Guix project has a good track record delivering security updates in a timely fashion (veja Security Updates em GNU Guix Reference Manual). To get security updates, users have to run guix pull && guix upgrade.

Because Guix uniquely identifies software variants, it is easy to see if a vulnerable piece of software is in use. For instance, to check whether the glibc 2.25 variant without the mitigation patch against “Stack Clash”, one can check whether user profiles refer to it at all:

guix gc --referrers /gnu/store/…-glibc-2.25

This will report whether profiles exist that refer to this specific glibc variant.