2 files changed, 22 insertions, 3 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index d228d26b0cc..4ba4b650de7 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -36232,6 +36232,15 @@ Launch the app as this group (it must be an existing group).
 A list of sockets (as path strings) which gunicorn will be listening
 on.  This list must contain at least one socket.
 
+@item @code{socket-user} (default: @code{user}) (type: string)
+Owner of the directory containing the socket (must be an existing user).
+
+@item @code{socket-group} (default: @code{group}) (type: string)
+Group owner of the directory containing the socket (must be an existing group).
+
+@item @code{socket-mode} (default: @code{#o750}) (type: integer)
+File mode to use for the directory containing the socket.
+
 @item @code{workers} (default: @code{1}) (type: integer)
 The number of workers for the gunicorn app.
 
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 9acf9b0f5be..b17ccd59fc7 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -1061,6 +1061,14 @@ renewed TLS certificates, or @code{include}d files.")
   (wsgi-app-module gunicorn-app-wsgi-app-module)
   (user gunicorn-app-user)
   (group gunicorn-app-group)
+  (socket-user gunicorn-app-socket-user
+               (default (gunicorn-app-user this-gunicorn-app))
+               (thunked))
+  (socket-group gunicorn-app-socket-group
+                (default (gunicorn-app-group this-gunicorn-app))
+                (thunked))
+  (socket-mode gunicorn-app-socket-mode
+               (default #o750))
   (sockets gunicorn-app-sockets
            (default (list (string-append "unix:/var/run/gunicorn/"
                                          (gunicorn-app-name this-gunicorn-app)
@@ -1094,16 +1102,18 @@ renewed TLS certificates, or @code{include}d files.")
 
         ;; Create socket directories and set ownership.
         (for-each (match-lambda
-                    ((user group socket-directories ...)
+                    ((user group mode socket-directories ...)
                      (for-each (lambda (socket-directory)
                                  (mkdir-p socket-directory)
+                                 (chmod socket-directory mode)
                                  (chown socket-directory
                                         (passwd:uid (getpw user))
                                         (group:gid (getgrnam group))))
                                socket-directories)))
                   '#$(map (lambda (app)
-                            (cons* (gunicorn-app-user app)
-                                   (gunicorn-app-group app)
+                            (cons* (gunicorn-app-socket-user app)
+                                   (gunicorn-app-socket-group app)
+                                   (gunicorn-app-socket-mode app)
                                    (filter-map (lambda (socket)
                                                  (and
                                                   (unix-socket? socket)