services: gunicorn: Allow configuration of socket user/group/mode

Without this change, the mode is not at all configurable meaning
that—depending on the umask(1)—it may allow access to others.  Further,
in many scenarios the owner/group of the Unix domain socket should
differ from the owner/group of the gunicorn process.  For example,
we might want to grant the nginx group access to the socket but not
use that as the GID for the gunicorn process.

* gnu/services/web.scm (<gunicorn-app>): Add socket-user, socket-group
and socket-mode.
* gnu/services/web.scm (gunicorn-activation): Respect
gunicorn-app-socket-user, gunicorn-socket-app-group, and
gunicorn-app-socket-mode.
* doc/guix.texi (Guix Services): Document new record fields.

Change-Id: I1fe5b77deb791c38c1642753a52098d304124049

1 files changed, 9 insertions, 0 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index d228d26b0cc..4ba4b650de7 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -36232,6 +36232,15 @@ Launch the app as this group (it must be an existing group).
 A list of sockets (as path strings) which gunicorn will be listening
 on.  This list must contain at least one socket.
 
+@item @code{socket-user} (default: @code{user}) (type: string)
+Owner of the directory containing the socket (must be an existing user).
+
+@item @code{socket-group} (default: @code{group}) (type: string)
+Group owner of the directory containing the socket (must be an existing group).
+
+@item @code{socket-mode} (default: @code{#o750}) (type: integer)
+File mode to use for the directory containing the socket.
+
 @item @code{workers} (default: @code{1}) (type: integer)
 The number of workers for the gunicorn app.