From 258cabed3285ec66893cc83ae704a40d57fec9ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B6ren=20Tempel?= <soeren+git@soeren-tempel.net>
Date: Sat, 16 May 2026 13:57:23 +0200
Subject: services: gunicorn: Allow configuration of socket user/group/mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without this change, the mode is not at all configurable meaning
that—depending on the umask(1)—it may allow access to others.  Further,
in many scenarios the owner/group of the Unix domain socket should
differ from the owner/group of the gunicorn process.  For example,
we might want to grant the nginx group access to the socket but not
use that as the GID for the gunicorn process.

* gnu/services/web.scm (<gunicorn-app>): Add socket-user, socket-group
and socket-mode.
* gnu/services/web.scm (gunicorn-activation): Respect
gunicorn-app-socket-user, gunicorn-socket-app-group, and
gunicorn-app-socket-mode.
* doc/guix.texi (Guix Services): Document new record fields.

Change-Id: I1fe5b77deb791c38c1642753a52098d304124049
---
 doc/guix.texi        |  9 +++++++++
 gnu/services/web.scm | 16 +++++++++++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index d228d26b0cc..4ba4b650de7 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -36232,6 +36232,15 @@ Launch the app as this group (it must be an existing group).
 A list of sockets (as path strings) which gunicorn will be listening
 on.  This list must contain at least one socket.
 
+@item @code{socket-user} (default: @code{user}) (type: string)
+Owner of the directory containing the socket (must be an existing user).
+
+@item @code{socket-group} (default: @code{group}) (type: string)
+Group owner of the directory containing the socket (must be an existing group).
+
+@item @code{socket-mode} (default: @code{#o750}) (type: integer)
+File mode to use for the directory containing the socket.
+
 @item @code{workers} (default: @code{1}) (type: integer)
 The number of workers for the gunicorn app.
 
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 9acf9b0f5be..b17ccd59fc7 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -1061,6 +1061,14 @@ renewed TLS certificates, or @code{include}d files.")
   (wsgi-app-module gunicorn-app-wsgi-app-module)
   (user gunicorn-app-user)
   (group gunicorn-app-group)
+  (socket-user gunicorn-app-socket-user
+               (default (gunicorn-app-user this-gunicorn-app))
+               (thunked))
+  (socket-group gunicorn-app-socket-group
+                (default (gunicorn-app-group this-gunicorn-app))
+                (thunked))
+  (socket-mode gunicorn-app-socket-mode
+               (default #o750))
   (sockets gunicorn-app-sockets
            (default (list (string-append "unix:/var/run/gunicorn/"
                                          (gunicorn-app-name this-gunicorn-app)
@@ -1094,16 +1102,18 @@ renewed TLS certificates, or @code{include}d files.")
 
         ;; Create socket directories and set ownership.
         (for-each (match-lambda
-                    ((user group socket-directories ...)
+                    ((user group mode socket-directories ...)
                      (for-each (lambda (socket-directory)
                                  (mkdir-p socket-directory)
+                                 (chmod socket-directory mode)
                                  (chown socket-directory
                                         (passwd:uid (getpw user))
                                         (group:gid (getgrnam group))))
                                socket-directories)))
                   '#$(map (lambda (app)
-                            (cons* (gunicorn-app-user app)
-                                   (gunicorn-app-group app)
+                            (cons* (gunicorn-app-socket-user app)
+                                   (gunicorn-app-socket-group app)
+                                   (gunicorn-app-socket-mode app)
                                    (filter-map (lambda (socket)
                                                  (and
                                                   (unix-socket? socket)
-- 
cgit v1.2.3