Previous: , Up: Servicios   [Contents][Index]


11.9.37 Servicios misceláneos

Servicio de huella dactilar

El módulo (gnu services authentication) proporciona un servicio DBus para leer e identificar huellas dactilares mediante un sensor de huellas.

Variable: fprintd-service-type

El tipo de servicio para fprintd, que proporciona la capacidad de lectura de huellas dactilares.

Servicios de control del sistema

El módulo (gnu services sysctl) proporciona servicios para configurar parámetros del núcleo durante el arranque.

Variable: sysctl-service-type

El tipo de servicio para sysctl, que modifica parámetros del núcleo bajo /proc/sys. Para activar el encaminamiento de tráfico IPv4 se puede instanciar de esta manera:

(service sysctl-service-type
         (sysctl-configuration
           (settings '(("net.ipv4.ip_forward" . "1")))))

Since sysctl-service-type is used in the default lists of services, %base-services and %desktop-services, you can use modify-services to change its configuration and add the kernel parameters that you want (see modify-services).

(modify-services %base-services
  (sysctl-service-type config =>
                       (sysctl-configuration
                         (settings (append '(("net.ipv4.ip_forward" . "1"))
                                           %default-sysctl-settings)))))
Tipo de datos: sysctl-configuration

Tipo de datos que representa la configuración de sysctl.

sysctl (predeterminado: (file-append procps "/sbin/sysctl")

El ejecutable sysctl usado.

settings (default: %default-sysctl-settings)

Una lista asociativa que especifica parámetros del núcleo y sus valores.

Variable: %default-sysctl-settings

An association list specifying the default sysctl parameters on Guix System.

Servicio del daemon de tarjetas inteligentes PC/SC

The (gnu services security-token) module provides the following service to run pcscd, the PC/SC Smart Card Daemon. pcscd is the daemon program for pcsc-lite and the MuscleCard framework. It is a resource manager that coordinates communications with smart card readers, smart cards and cryptographic tokens that are connected to the system.

Variable: pcscd-service-type

Tipo de servicio para el servicio pcscd. Su valor debe ser un objeto pcscd-configuration. Puede instanciarlo de esta manera para ejecutar pcscd con la configuración predeterminada:

Tipo de datos: pcscd-configuration

Tipo de datos que representa la configuración de pcscd.

pcsc-lite (predeterminado: pcsc-lite)

El paquete pcsc-lite que proporciona pcscd.

usb-drivers (predeterminado: (list ccid))

List of packages that provide USB drivers to pcscd. Drivers are expected to be under pcsc/drivers in the store directory of the package.

LIRC Service

El módulo (gnu services lirc) proporciona el siguiente servicio.

Variable: lirc-service-type

Type for a service that runs LIRC, a daemon that decodes infrared signals from remote controls.

The value for this service is a <lirc-configuration> object.

Data Type: lirc-configuration

Data type representing the configuration of lircd.

lirc (default: lirc) (type: file-like)

Package object for lirc.

device (default: #f) (type: string)
driver (default: #f) (type: string)
config-file (default: #f) (type: string-or-file-like)

TODO. See lircd manual for details.

extra-options (default: '()) (type: list-of-string)

Additional command-line options to pass to lircd.

SPICE Service

El módulo (gnu services spice) proporciona el siguiente servicio.

Variable: spice-vdagent-service-type

Type of the service that runs VDAGENT, a daemon that enables sharing the clipboard with a vm and setting the guest display resolution when the graphical console window resizes.

Data Type: spice-vdagent-configuration

Data type representing the configuration of spice-vdagent-service-type.

spice-vdagent (default: spice-vdagent) (type: file-like)

Package object for VDAGENT.

Servicio inputattach

El servicio inputattach permite el uso de dispositivos de entrada como tabletas Wacom, pantallas táctiles, o joysticks con el servidor gráfico Xorg.

Variable: inputattach-service-type

Tipo de un servicio que ejecuta inputattach con un dispositivo y reenvía los eventos que produzca.

Tipo de datos: inputattach-configuration
device-type (predeterminado: "wacom")

Tipo del dispositivo al que conectarse. Ejecute inputattach --help, del paquete inputattach, para ver la lista de tipos de dispositivo implementados.

device (predeterminado: "/dev/ttyS0")

El nombre de archivo para la conexión al dispositivo.

baud-rate (predeterminado: #f)

Tasa de transmisión usada para las conexiones serie. Debe ser un número o #f.

log-file (predeterminado: #f)

Si es verdadero, debe ser el nombre de un archivo en el que registrar los mensajes.

Servicio de diccionario

El módulo (gnu services dict) proporciona el servicio siguiente:

Variable: dicod-service-type

Tipo de servicio que ejecuta el daemon dicod, una implementación del servidor DICT (see Dicod in GNU Dico Manual).

Puede añadir open localhost en su archivo ~/.dico para hacer que localhost sea el servidor predeterminado de su cliente dico (see Initialization File in GNU Dico Manual).

Nota: This service is also available for Guix Home, where it runs directly with your user privileges (see home-dicod-service-type).

Tipo de datos: dicod-configuration

Tipo de datos que representa la configuración de dicod.

dico (predeterminado: dico)

El objeto paquete del servidor de diccionario GNU Dico.

interfaces (predeterminada: ’("localhost"))

Es la lista de direcciones IP y puertos, y posiblemente nombres de archivo de sockets, en los que se debe escuchar (see listen directive in GNU Dico Manual).

handlers (predeterminados: ’())

Lista de objetos <dicod-handler> que identifican los controladores (instancias de módulos).

databases (predeterminada: (list %dicod-database:gcide))

Lista de objetos <dicod-database> que identifican los diccionarios proporcionados.

Tipo de datos: dicod-handler

Tipo de datos que representa un controlador de diccionario (instancia de un módulo).

name

Nombre del controlador (instancia de un módulo).

module (predeterminado: #f)

Nombre del módulo del controlador de dicod (instancia). Si es #f, el módulo tiene el mismo nombre que el controlador. (see Modules in GNU Dico Manual).

options

Lista de cadenas o expresiones-G que representan los parámetros al módulo de control

Tipo de datos: dicod-database

Tipo de datos que representa una base de datos de diccionario.

name

Nombre de la base de datos, será usada en las órdenes DICT.

handler

Nombre del controlador de dicod (instancia de un módulo) usado por esta base de datos (see Handlers in GNU Dico Manual).

complex? (predeterminado: #f)

Determina si se usará la configuración compleja. La configuración compleja necesita un objeto <dicod-handler>, que no es necesario en otro caso.

options

Lista de cadenas o expresiones-g que representan los parámetros para la base de datos (see Databases in GNU Dico Manual).

Variable: %dicod-database:gcide

Un objeto <dicod-service> que ofrece el diccionario internacional colaborativo de inglés de GNU usando el paquete gcide.

The following is an example dicod-service-type configuration.

(service dicod-service-type
         (dicod-configuration
          (handlers (list
                     (dicod-handler
                      (name "wordnet")
                      (module "wordnet")
                      (options
                       (list #~(string-append "wnhome=" #$wordnet))))))
          (databases (list
                      (dicod-database
                       (name "wordnet")
                       (complex? #t)
                       (handler "wordnet"))
                      %dicod-database:gcide))))

Servicio Docker

El módulo (gnu services docker) proporciona los siguientes servicios.

Variable: docker-service-type

Este es el tipo del servicio que ejecuta Docker, un daemon que puede ejecutar empaquetados de aplicaciones (a los que a veces nos referimos como “contenedores”) en entornos aislados.

Tipo de datos: docker-configuration

Este es el tipo de datos que representa la configuración de Docker y Containerd.

docker (default: docker)

El paquete de daemon de Docker usado.

docker-cli (default: docker-cli)

El paquete de cliente de Docker usado.

containerd (predeterminado: containerd)

El paquete Containerd usado.

proxy (predeterminado: docker-libnetwork-cmd-proxy)

La pasarela de espacio de usuario para red de Docker usada.

enable-proxy? (predeterminado: #t)

Activa o desactiva el uso de la pasarela de espacio de usuario para red de Docker.

debug? (predeterminado: #f)

Activa o desactiva la salida de depuración.

enable-iptables? (predeterminado: #t)

Activa o desactiva la adición de reglas para iptables.

environment-variables (default: '())

List of environment variables to set for dockerd.

This must be a list of strings where each string has the form ‘key=value’ as in this example:

(list "LANGUAGE=eo:ca:eu"
      "TMPDIR=/tmp/dockerd")
config-file (type: maybe-file-like)

JSON configuration file pass to dockerd.

Variable: singularity-service-type

Tipo de servicio que le permite ejecutar Singularity, una herramienta tipo-Docker para crear y ejecutar aplicaciones empaquetadas (también conocidas como “contenedores”). El valor para este servicio es el paquete de Singularity usado.

El servicio no instala un daemon; en vez de ello, instala programas auxiliares con con el bit setuid de root (see Programas con setuid) de modo que usuarias sin privilegios puedan ejecutar singularity run y ordenes similares.

OCI backed services

Should you wish to manage your Docker containers with the same consistent interface you use for your other Shepherd services, oci-container-service-type is the tool to use: given an Open Container Initiative (OCI) container image, it will run it in a Shepherd service. One example where this is useful: it lets you run services that are available as Docker/OCI images but not yet packaged for Guix.

Variable: oci-container-service-type

This is a thin wrapper around Docker’s CLI that executes OCI images backed processes as Shepherd Services.

(service oci-container-service-type
         (list
          (oci-container-configuration
           (image "prom/prometheus")
           (network "host")
           (ports
             '(("9000" . "9000")
               ("9090" . "9090"))))
          (oci-container-configuration
           (image "grafana/grafana:10.0.1")
           (network "host")
           (ports
             '(("3000" . "3000")))
           (volumes
             '("/var/lib/grafana:/var/lib/grafana")))))

In this example two different Shepherd services are going be added to the system. Each oci-container-configuration record translates to a docker run invocation and its fields directly map to options. You can refer to the upstream, documentation for the semantics of each value. If the images are not found they will be pulled. The spawned services are going to be attached to the host network and are supposed to behave like other processes.

Data Type: oci-container-configuration

Available oci-container-configuration fields are:

user (default: "oci-container") (type: string)

The user under whose authority docker commands will be run.

group (default: "docker") (type: string)

The group under whose authority docker commands will be run.

command (default: ()) (type: list-of-strings)

Overwrite the default command (CMD) of the image.

entrypoint (default: "") (type: string)

Overwrite the default entrypoint (ENTRYPOINT) of the image.

environment (default: ()) (type: list)

Set environment variables. This can be a list of pairs or strings, even mixed:

(list '("LANGUAGE" . "eo:ca:eu")
      "JAVA_HOME=/opt/java")

String are passed directly to the Docker CLI. You can refer to the upstream documentation for semantics.

image (type: string)

The image used to build the container. Images are resolved by the Docker Engine, and follow the usual format myregistry.local:5000/testing/test-image:tag.

provision (default: "") (type: string)

Set the name of the provisioned Shepherd service.

network (default: "") (type: string)

Set a Docker network for the spawned container.

ports (default: ()) (type: list)

Set the port or port ranges to expose from the spawned container. This can be a list of pairs or strings, even mixed:

(list '("8080" . "80")
      "10443:443")

String are passed directly to the Docker CLI. You can refer to the upstream documentation for semantics.

volumes (default: ()) (type: list)

Set volume mappings for the spawned container. This can be a list of pairs or strings, even mixed:

(list '("/root/data/grafana" . "/var/lib/grafana")
      "/gnu/store:/gnu/store")

String are passed directly to the Docker CLI. You can refer to the upstream documentation for semantics.

container-user (default: "") (type: string)

Set the current user inside the spawned container. You can refer to the upstream documentation for semantics.

workdir (default: "") (type: string)

Set the current working for the spawned Shepherd service. You can refer to the upstream documentation for semantics.

Servicio Auditd

El módulo (gnu services auditd) proporciona el servicio siguiente:

Variable: auditd-service-type

Este es el tipo del servicio que ejecuta auditd, un daemon que recolecta información relevante a la seguridad en su sistema.

Ejemplos de cosas que se pueden recolectar:

  1. Acceso a archivos
  2. Llamadas al sistema
  3. Órdenes invocadas
  4. Intentos fallidos de ingreso en el sistema
  5. Activaciones de filtros en el cortafuegos
  6. Accesos de red

Puede usarse auditctl del paquete audit para añadir o eliminar eventos a recolectar (hasta el siguiente reinicio). Para hacer permanente la recolección de dichos eventos, introduzca los parámetros de la línea de órdenes de auditctl en un archivo llamado audit.rules del directorio de configuración (véase a continuación). También se puede usar aureport del paquete audit para ver un informe de todos los eventos registrados. El daemon audit habitualmente registra los eventos en el archivo /var/log/audit.

Tipo de datos: auditd-configuration

Este es el tipo de datos que representa la configuración de auditd.

audit (predeterminado: audit)

El paquete audit usado.

configuration-directory (predeterminado: %default-auditd-configuration-directory)

Directorio que contiene el archivo de configuración para el paquete audit, cuyo nombre debe ser auditd.conf, y de manera opcional reglas de audit que se instanciarán en el arranque.

servicio R-Shiny

El módulo (gnu services science) proporciona el siguiente servicio.

Variable: rshiny-service-type

Tipo de servicio usado para ejecutar una aplicación web creada con r-shiny. Este servicio proporciona el valor adecuado a la variable de entorno R_LIBS_USER y ejecuta el guión proporcionado para llamar a runApp.

Tipo de datos: rshiny-configuration

Este es el tipo de datos que representa la configuración del rshiny.

package (predeterminado: r-shiny)

El paquete usado.

binary (default "rshiny")

Nombre del binario o del guión en el directorio paquete/bin/ ejecutado cuando se arranca este servicio.

La manera habitual de crear este archivo es la siguiente:


(let* ((out       (assoc-ref %outputs "out"))
       (targetdir (string-append out "/share/" ,name))
       (app       (string-append out "/bin/" ,name))
       (Rbin      (search-input-file %build-inputs "/bin/Rscript")))
  ;; …
  (mkdir-p (string-append out "/bin"))
  (call-with-output-file app
    (lambda (port)
      (format port
"#!~a
library(shiny)
setwd(\"~a\")
runApp(launch.browser=0, port=4202)~%\n"
      Rbin targetdir))))

Servicio Nix

El módulo (gnu services nix) proporciona el siguiente servicio.

Variable: nix-service-type

Tipo del servicio que ejecuta el daemon de construcción del gestor de paquetes Nix. Este es un ejemplo de cómo usarlo:

(use-modules (gnu))
(use-service-modules nix)
(use-package-modules package-management)

(operating-system
  ;; …
  (packages (append (list nix)
                    %base-packages))

  (services (append (list (service nix-service-type))
                    %base-services)))

Tras guix system reconfigure, configure Nix para su usuaria:

$ ln -s "/nix/var/nix/profiles/per-user/$USER/profile" ~/.nix-profile
$ source /run/current-system/profile/etc/profile.d/nix.sh
Tipo de datos: nix-configuration

Este tipo de datos representa la configuración del daemon de Nix.

nix (predeterminado: nix)

El paquete Nix usado.

sandbox (predeterminado: #t)

Especifica si las construcciones se ejecutan en un entorno aislado (“sandbox”) de manera predeterminada.

build-directory (default: "/tmp")

The directory where build directory are stored during builds. This is useful to change if, for example, the default location does not have enough space to hold build trees for big packages.

This is similar to setting the TMPDIR environment variable for guix-daemon. TMPDIR, for more info.

build-sandbox-items (predeterminada: '())

Lista de cadenas u objetos añadida al final del campo build-sandbox-items en el archivo de configuración.

extra-config (predeterminada: '())

Es una lista de cadenas u objetos añadida al final del archivo de configuración. Se usa para proporcionar texto adicional para ser introducido de forma literal en el archivo de configuración.

extra-options (predeterminadas: '())

Opciones de línea de órdenes adicionales para nix-service-type.

Fail2Ban service

fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IP addresses that show malicious signs – repeated password failures, attempts to make use of exploits, etc.

fail2ban-service-type service type is provided by the (gnu services security) module.

This service type runs the fail2ban daemon. It can be configured in various ways, which are:

Basic configuration

The basic parameters of the Fail2Ban service can be configured via its fail2ban configuration, which is documented below.

User-specified jail extensions

The fail2ban-jail-service function can be used to add new Fail2Ban jails.

Shepherd extension mechanism

Service developers can extend the fail2ban-service-type service type itself via the usual service extension mechanism.

Variable: fail2ban-service-type

This is the type of the service that runs fail2ban daemon. Below is an example of a basic, explicit configuration:

(append
 (list
  (service fail2ban-service-type
           (fail2ban-configuration
            (extra-jails
             (list
              (fail2ban-jail-configuration
               (name "sshd")
               (enabled? #t))))))
  ;; There is no implicit dependency on an actual SSH
  ;; service, so you need to provide one.
  (service openssh-service-type))
 %base-services)
Procedure: fail2ban-jail-service svc-type jail

Extend svc-type, a <service-type> object with jail, a fail2ban-jail-configuration object.

Por ejemplo:

(append
 (list
  (service
   ;; The 'fail2ban-jail-service' procedure can extend any service type
   ;; with a fail2ban jail.  This removes the requirement to explicitly
   ;; extend services with fail2ban-service-type.
   (fail2ban-jail-service
    openssh-service-type
    (fail2ban-jail-configuration
     (name "sshd")
     (enabled? #t)))
   (openssh-configuration ...))))

Below is the reference for the different jail-service-type configuration records.

Data Type: fail2ban-configuration

Available fail2ban-configuration fields are:

fail2ban (default: fail2ban) (type: package)

The fail2ban package to use. It is used for both binaries and as base default configuration that is to be extended with <fail2ban-jail-configuration> objects.

run-directory (default: "/var/run/fail2ban") (type: string)

The state directory for the fail2ban daemon.

jails (default: '()) (type: list-of-fail2ban-jail-configurations)

Instances of <fail2ban-jail-configuration> collected from extensions.

extra-jails (default: '()) (type: list-of-fail2ban-jail-configurations)

Instances of <fail2ban-jail-configuration> explicitly provided.

extra-content (default: '()) (type: text-config)

Extra raw content to add to the end of the jail.local file, provided as a list of file-like objects.

Data Type: fail2ban-ignore-cache-configuration

Available fail2ban-ignore-cache-configuration fields are:

key (type: string)

Cache key.

max-count (type: integer)

Cache size.

max-time (type: integer)

Cache time.

Data Type: fail2ban-jail-action-configuration

Available fail2ban-jail-action-configuration fields are:

name (type: string)

Action name.

arguments (default: '()) (type: list-of-arguments)

Action arguments.

Data Type: fail2ban-jail-configuration

Available fail2ban-jail-configuration fields are:

name (type: string)

Required name of this jail configuration.

enabled? (default: #t) (type: boolean)

Whether this jail is enabled.

backend (type: maybe-symbol)

Backend to use to detect changes in the log-path. The default is ’auto. To consult the defaults of the jail configuration, refer to the /etc/fail2ban/jail.conf file of the fail2ban package.

max-retry (type: maybe-integer)

The number of failures before a host gets banned (e.g. (max-retry 5)).

max-matches (type: maybe-integer)

The number of matches stored in ticket (resolvable via tag <matches>) in action.

find-time (type: maybe-string)

The time window during which the maximum retry count must be reached for an IP address to be banned. A host is banned if it has generated max-retry during the last find-time seconds (e.g. (find-time "10m")). It can be provided in seconds or using Fail2Ban’s "time abbreviation format", as described in man 5 jail.conf.

ban-time (type: maybe-string)

The duration, in seconds or time abbreviated format, that a ban should last. (e.g. (ban-time "10m")).

ban-time-increment? (type: maybe-boolean)

Whether to consider past bans to compute increases to the default ban time of a specific IP address.

ban-time-factor (type: maybe-string)

The coefficient to use to compute an exponentially growing ban time.

ban-time-formula (type: maybe-string)

This is the formula used to calculate the next value of a ban time.

ban-time-multipliers (type: maybe-string)

Used to calculate next value of ban time instead of formula.

ban-time-max-time (type: maybe-string)

The maximum number of seconds a ban should last.

ban-time-rnd-time (type: maybe-string)

The maximum number of seconds a randomized ban time should last. This can be useful to stop “clever” botnets calculating the exact time an IP address can be unbanned again.

ban-time-overall-jails? (type: maybe-boolean)

When true, it specifies the search of an IP address in the database should be made across all jails. Otherwise, only the current jail of the ban IP address is considered.

ignore-self? (type: maybe-boolean)

Never ban the local machine’s own IP address.

ignore-ip (default: '()) (type: list-of-strings)

A list of IP addresses, CIDR masks or DNS hosts to ignore. fail2ban will not ban a host which matches an address in this list.

ignore-cache (type: maybe-fail2ban-ignore-cache-configuration)

Provide cache parameters for the ignore failure check.

filter (type: maybe-fail2ban-jail-filter-configuration)

The filter to use by the jail, specified via a <fail2ban-jail-filter-configuration> object. By default, jails have names matching their filter name.

log-time-zone (type: maybe-string)

The default time zone for log lines that do not have one.

log-encoding (type: maybe-symbol)

The encoding of the log files handled by the jail. Possible values are: 'ascii, 'utf-8 and 'auto.

log-path (default: '()) (type: list-of-strings)

The file names of the log files to be monitored.

action (default: '()) (type: list-of-fail2ban-jail-actions)

A list of <fail2ban-jail-action-configuration>.

extra-content (default: '()) (type: text-config)

Extra content for the jail configuration, provided as a list of file-like objects.

Data Type: fail2ban-jail-filter-configuration

Available fail2ban-jail-filter-configuration fields are:

name (type: string)

Filter to use.

mode (type: maybe-string)

Mode for filter.


Previous: Servicios de Hurd, Up: Servicios   [Contents][Index]