services: gunicorn: Allow configuration of socket user/group/mode

Without this change, the mode is not at all configurable meaning
that—depending on the umask(1)—it may allow access to others.  Further,
in many scenarios the owner/group of the Unix domain socket should
differ from the owner/group of the gunicorn process.  For example,
we might want to grant the nginx group access to the socket but not
use that as the GID for the gunicorn process.

* gnu/services/web.scm (<gunicorn-app>): Add socket-user, socket-group
and socket-mode.
* gnu/services/web.scm (gunicorn-activation): Respect
gunicorn-app-socket-user, gunicorn-socket-app-group, and
gunicorn-app-socket-mode.
* doc/guix.texi (Guix Services): Document new record fields.

Change-Id: I1fe5b77deb791c38c1642753a52098d304124049

1 files changed, 13 insertions, 3 deletions

diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 9acf9b0f5be..b17ccd59fc7 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -1061,6 +1061,14 @@ renewed TLS certificates, or @code{include}d files.")
   (wsgi-app-module gunicorn-app-wsgi-app-module)
   (user gunicorn-app-user)
   (group gunicorn-app-group)
+  (socket-user gunicorn-app-socket-user
+               (default (gunicorn-app-user this-gunicorn-app))
+               (thunked))
+  (socket-group gunicorn-app-socket-group
+                (default (gunicorn-app-group this-gunicorn-app))
+                (thunked))
+  (socket-mode gunicorn-app-socket-mode
+               (default #o750))
   (sockets gunicorn-app-sockets
            (default (list (string-append "unix:/var/run/gunicorn/"
                                          (gunicorn-app-name this-gunicorn-app)
@@ -1094,16 +1102,18 @@ renewed TLS certificates, or @code{include}d files.")
 
         ;; Create socket directories and set ownership.
         (for-each (match-lambda
-                    ((user group socket-directories ...)
+                    ((user group mode socket-directories ...)
                      (for-each (lambda (socket-directory)
                                  (mkdir-p socket-directory)
+                                 (chmod socket-directory mode)
                                  (chown socket-directory
                                         (passwd:uid (getpw user))
                                         (group:gid (getgrnam group))))
                                socket-directories)))
                   '#$(map (lambda (app)
-                            (cons* (gunicorn-app-user app)
-                                   (gunicorn-app-group app)
+                            (cons* (gunicorn-app-socket-user app)
+                                   (gunicorn-app-socket-group app)
+                                   (gunicorn-app-socket-mode app)
                                    (filter-map (lambda (socket)
                                                  (and
                                                   (unix-socket? socket)