services: Update rabbitmq service

Update RabbitMQ default configuration to use localhost interface by
default and avoid listening on public interfaces.

Change the default configuration file to set inter-node communication
listener to localhost network interface (see also
https://www.rabbitmq.com/docs/networking#distribution). This requires
setting RabbitMQ node name to `rabbit@localhost`, so introduce
`node-name` RabbitMQ configuration field with such default value.

Path to the RabbitMQ environment configuration file was hardcoded.
Remove the hardcoding and allow to create such file with env-config-file
RabbitMQ configuration field.

Add new RabbitMQ service tests to check RabbitMQ broker startup and
status after the service is started.

* gnu/services/high-availability.scm (<rabbitmq-configuration>)
  [<node-name>, <env-config-file>]: New fields.
  (rabbitmq-shepherd-service): Use them.
  (%default-rabbitmq-config-file): Update.
* gnu/tests/high-availability.scm (run-rabbitmq-test): Add new tests.
* doc/gnu.texi (High Availability Services): Document new fields and
  provide information about local interfaces.

Merges: guix/guix!9360
Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>

3 files changed, 68 insertions, 16 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index c349ffc6d33..7f587d73a9a 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -143,7 +143,7 @@ Copyright @copyright{} 2025 Zacchaeus@*
 Copyright @copyright{} 2025, 2026 Sergio Pastor Pérez@*
 Copyright @copyright{} 2024 Evgeny Pisemsky@*
 Copyright @copyright{} 2025 jgart@*
-Copyright @copyright{} 2025 Artur Wroblewski@*
+Copyright @copyright{} 2025-2026 Artur Wroblewski@*
 Copyright @copyright{} 2025 Edouard Klein@*
 Copyright @copyright{} 2025 Rodion Goritskov@*
 Copyright @copyright{} 2025 dan@*
@@ -37654,24 +37654,24 @@ A simple example configuration is given below.
 @lisp
 (service rabbitmq-service-type
          (rabbitmq-configuration
-           (rabbitmq-configuration
-             (plugins '("rabbitmq_stream"
-                        "rabbitmq_management"
-                        "rabbitmq_prometheus")))))
+           (plugins '("rabbitmq_stream"
+                      "rabbitmq_management"
+                      "rabbitmq_prometheus"))))
 @end lisp
-@end defvar
 
 At startup, RabbitMQ broker logs its initialization messages into
 @file{/var/log/messages} file.  Once running, the logging messages can be
 found in a logging file of a RabbitMQ node in @file{/var/log/rabbitmq}
 directory.
 
-@quotation Note
+@quotation Warning
 The default configuration of the RabbitMQ service enables the RabbitMQ
 broker to accept connections only on loopback interfaces.  However,
 enabling certain plugins may open ports on all network interfaces.  See
-also @url{https://www.rabbitmq.com/docs/networking#ports, RabbitMQ Port Access}.
+also @url{https://www.rabbitmq.com/docs/networking#ports, RabbitMQ Port
+Access}.
 @end quotation
+@end defvar
 
 @deftp {Data Type} rabbitmq-configuration
 This data type represents the configuration for RabbitMQ.
@@ -37680,10 +37680,23 @@ This data type represents the configuration for RabbitMQ.
 @item @code{rabbitmq} (default: @code{rabbitmq})
 The RabbitMQ package to use.
 
+@item @code{node-name} (default: @code{"rabbit@@localhost"})
+Node name of a RabbitMQ broker instance. See also
+@url{https://www.rabbitmq.com/docs/clustering#node-names, RabbitMQ Node
+Names}.
+
 @item @code{config-file} (default: @code{%default-rabbitmq-config-file})
 Configuration file for the RabbitMQ broker. See also
 @url{https://www.rabbitmq.com/docs/configure, RabbitMQ Configuration}.
 
+@item @code{env-config-file} (default: @code{#f})
+Environment configuration file for the RabbitMQ broker.
+
+Set RabbitMQ environment variables, for example Erlang parameters, node
+name, or configuration file location, using @code{variable=value} format.
+Each variable name without @code{RABBITMQ_} prefix. See also
+@url{https://www.rabbitmq.com/docs/configure, RabbitMQ Configuration}.
+
 @item @code{data-directory} (default: @code{"/var/lib/rabbitmq/data"})
 Directory with RabbitMQ broker data - a schema database, message stores,
 cluster member information, and other persistent node state.
@@ -37691,7 +37704,6 @@ cluster member information, and other persistent node state.
 @item @code{plugins} (default: @code{'()})
 A list of RabbitMQ plugins to enable.  View all available plugins using
 the @command{rabbitmq-plugins list} command.
-
 @end table
 @end deftp
 
diff --git a/gnu/services/high-availability.scm b/gnu/services/high-availability.scm
index 7b57d9a613e..73d534cf020 100644
--- a/gnu/services/high-availability.scm
+++ b/gnu/services/high-availability.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Christopher Baines <mail@cbaines.net>
-;;; Copyright © 2025 Artur Wroblewski <wrobell@riseup.net>
+;;; Copyright © 2025-2026 Artur Wroblewski <wrobell@riseup.net>
 ;;; Copyright © 2026 Mathieu Lirzin <mthl@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -32,19 +32,25 @@
 
   #:export (rabbitmq-configuration rabbitmq-configuration?
                                    rabbitmq-configuration-rabbitmq
+                                   rabbitmq-configuration-node-name
                                    rabbitmq-configuration-config-file
+                                   rabbitmq-configuration-env-config-file
                                    rabbitmq-configuration-plugins
                                    rabbitmq-service-type))
 
-;; By default, start on local ipv4 and ipv6 interfaces only, see also:
+;; By default, start messaging and inter-node RabbitMQ listeners on local
+;; interfaces only, see also:
 ;;
 ;;   https://www.rabbitmq.com/docs/networking
 ;;
-;; NOTE: How to enable plugins to listen on localhost only?
+;; NOTE: Enabling a RabbitMQ plugin will make it usually listen on a public
+;; interface.
 (define %default-rabbitmq-config-file
   (plain-file "rabbitmq.conf" "
 listeners.tcp.1 = 127.0.0.1:5672
 listeners.tcp.2 = ::1:5672
+
+distribution.listener.interface = 127.0.0.1
 "))
 
 (define-record-type* <rabbitmq-configuration> rabbitmq-configuration
@@ -52,8 +58,11 @@ listeners.tcp.2 = ::1:5672
   rabbitmq-configuration?
   (rabbitmq rabbitmq-configuration-rabbitmq
             (default rabbitmq))
+  (node-name rabbitmq-configuration-node-name
+             (default "rabbit@localhost"))
   (config-file rabbitmq-configuration-config-file
                (default %default-rabbitmq-config-file))
+  (env-config-file rabbitmq-configuration-env-file (default #f))
   ;; It can be a mnesia database or a khepri database, so use "data" instead
   ;; of the traditional "mnesia".
   (data-directory rabbitmq-configuration-data-directory
@@ -102,7 +111,7 @@ listeners.tcp.2 = ::1:5672
 
 (define (rabbitmq-shepherd-service config)
   (match-record config <rabbitmq-configuration>
-    (rabbitmq data-directory config-file plugins)
+    (rabbitmq node-name data-directory config-file env-config-file plugins)
     (with-imported-modules
       (source-module-closure '((gnu build shepherd)))
       (list
@@ -119,10 +128,14 @@ listeners.tcp.2 = ::1:5672
               #:group "rabbitmq"
               #:environment-variables
               (append
+                (if #$env-config-file
+                  (list (string-append "RABBITMQ_CONF_ENV_FILE="
+                                       #$env-config-file))
+                  (list))
                 (list
+                  (string-append "RABBITMQ_NODENAME=" #$node-name)
                   (string-append "RABBITMQ_CONFIG_FILE=" #$config-file)
                   "RABBITMQ_PID_FILE=/var/run/rabbitmq/pid"
-                  "RABBITMQ_CONF_ENV_FILE=/run/current-system/profile/etc/rabbitmq/rabbitmq-env.conf"
                   (string-append
                     "RABBITMQ_ENABLED_PLUGINS_FILE="
                     #$data-directory
diff --git a/gnu/tests/high-availability.scm b/gnu/tests/high-availability.scm
index 591e5f5bc23..6eb13d1a068 100644
--- a/gnu/tests/high-availability.scm
+++ b/gnu/tests/high-availability.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
-;;; Copyright © 2025 Artur Wroblewski <wrobell@riseup.net>
+;;; Copyright © 2025-2026 Artur Wroblewski <wrobell@riseup.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -19,6 +19,7 @@
 
 (define-module (gnu tests high-availability)
   #:use-module (gnu tests)
+  #:use-module (gnu packages high-availability)
   #:use-module (gnu system)
   #:use-module (gnu system file-systems)
   #:use-module (gnu system shadow)
@@ -34,12 +35,15 @@
   (plain-file "rabbitmq.conf" "
 listeners.tcp.1 = 127.0.0.1:15672
 listeners.tcp.2 = ::1:15672
+
+distribution.listener.interface = 127.0.0.1
 "))
 
 (define %rabbitmq-os
   (simple-operating-system
     (service rabbitmq-service-type
-             (rabbitmq-configuration (config-file %rabbitmq-config-file)))))
+             (rabbitmq-configuration (node-name "rabbit@komputilo")
+                                     (config-file %rabbitmq-config-file)))))
 
 (define* (run-rabbitmq-test #:key (rabbitmq-port 15672))
   "Run tests in %RABBITMQ-OS, forwarding PORT."
@@ -94,6 +98,29 @@ listeners.tcp.2 = ::1:15672
              '(file-exists? "/var/log/rabbitmq/rabbit@komputilo.log")
              marionette))
 
+          (test-assert "RabbitMQ await startup command is successful"
+            (marionette-eval
+             '(begin
+                (use-modules (guix build utils))
+
+                (current-output-port (open-file "/dev/console" "w0"))
+                (invoke #$(file-append rabbitmq "/sbin/rabbitmqctl")
+                        "await_startup"
+                        "-n"
+                        "rabbit@komputilo"))
+             marionette))
+
+          (test-assert "RabbitMQ status command is successful"
+            (marionette-eval
+             '(begin
+                (use-modules (guix build utils))
+
+                (current-output-port (open-file "/dev/console" "w0"))
+                (invoke #$(file-append rabbitmq "/sbin/rabbitmqctl")
+                        "status"
+                        "-n"
+                        "rabbit@komputilo"))
+             marionette))
           (test-end))))
 
   (gexp->derivation "rabbitmq-test" test))