Here's a potential patch. I'm not sure about how to deprecate fields -- Efraim Flashner <efr...@flashner.co.il> רנשלפ םירפא GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted
diff --git a/doc/guix.texi b/doc/guix.texi
index f4f21c4744..852b2eb706 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -32510,10 +32510,9 @@ Web Services
@lisp
(service agate-service-type
- (agate-configuration
- (content "/srv/gemini")
- (cert "/srv/cert.pem")
- (key "/srv/key.rsa")))
+ (agate-configuration
+ (content "/srv/gemini")
+ (certs "/srv/gemini-certs")))
@end lisp
The example above represents the minimal tweaking necessary to get Agate
@@ -32544,13 +32543,10 @@ Web Services
@item @code{content} (default: @file{"/srv/gemini"})
The directory from which Agate will serve files.
-@item @code{cert} (default: @code{#f})
-The path to the TLS certificate PEM file to be used for encrypted
-connections. Must be filled in with a value from the user.
-
-@item @code{key} (default: @code{#f})
-The path to the PKCS8 private key file to be used for encrypted
-connections. Must be filled in with a value from the user.
+@item @code{certs} (default: @code{#f})
+The path to the directory containing the TLS certificate PEM and the PKCS8
+private key file to be used for encrypted connections. Must be filled in
+with a value from the user.
@item @code{addr} (default: @code{'("0.0.0.0:1965" "[::]:1965")})
A list of the addresses to listen on.
@@ -32561,8 +32557,9 @@ Web Services
@item @code{lang} (default: @code{#f})
RFC 4646 language code(s) for text/gemini documents. Optional.
-@item @code{silent?} (default: @code{#f})
-Set to @code{#t} to disable logging output.
+@item @code{only-tls13?} (default: @code{#f})
+Set to @code{#t} to allow only connections over TLS v1.3. By default TLS
+v1.2 is also allowed.
@item @code{serve-secret?} (default: @code{#f})
Set to @code{#t} to serve secret files (files/directories starting with
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 406117c457..57750e120b 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -302,12 +302,14 @@ (define-module (gnu services web)
agate-configuration?
agate-configuration-package
agate-configuration-content
- agate-configuration-cert
- agate-configuration-key
+ agate-configuration-cert ; deprecated
+ agate-configuration-key ; deprecated
+ agate-configuration-certs
agate-configuration-addr
agate-configuration-hostname
agate-configuration-lang
- agate-configuration-silent
+ agate-configuration-silent ; deprecated
+ agate-configuration-only-tls13
agate-configuration-serve-secret
agate-configuration-log-ip
agate-configuration-user
@@ -2181,6 +2183,8 @@ (define-record-type* <agate-configuration>
(default #f))
(key agate-configuration-key
(default #f))
+ (certs agate-configuration-certs
+ (default #f))
(addr agate-configuration-addr
(default '("0.0.0.0:1965" "[::]:1965")))
(hostname agate-configuration-hostname
@@ -2189,6 +2193,8 @@ (define-record-type* <agate-configuration>
(default #f))
(silent? agate-configuration-silent
(default #f))
+ (only-tls13? agate-configuration-only-tls13
+ (default #f))
(serve-secret? agate-configuration-serve-secret
(default #f))
(log-ip? agate-configuration-log-ip
@@ -2202,8 +2208,8 @@ (define-record-type* <agate-configuration>
(define agate-shepherd-service
(match-lambda
- (($ <agate-configuration> package content cert key addr
- hostname lang silent? serve-secret?
+ (($ <agate-configuration> package content cert key certs addr
+ hostname lang only-tls13? serve-secret?
log-ip? user group log-file)
(list (shepherd-service
(provision '(agate))
@@ -2213,8 +2219,13 @@ (define agate-shepherd-service
#~(make-forkexec-constructor
(list #$agate
"--content" #$content
- "--cert" #$cert
- "--key" #$key
+ #$@(if certs
+ (list "--certs" certs)
+ (if (and cert key
+ (equal? (dirname cert)
+ (dirname key)))
+ (list "--certs" (dirname cert))
+ '()))
"--addr" #$@addr
#$@(if lang
(list "--lang" lang)
@@ -2222,7 +2233,7 @@ (define agate-shepherd-service
#$@(if hostname
(list "--hostname" hostname)
'())
- #$@(if silent? '("--silent") '())
+ #$@(if only-tls13? '("--only-tls13") '())
#$@(if serve-secret? '("--serve-secret") '())
#$@(if log-ip? '("--log-ip") '()))
#:user #$user #:group #$group
signature.asc
Description: PGP signature
