10 files changed, 183 insertions, 88 deletions
diff --git a/genenetwork-development.scm b/genenetwork-development.scm
index 7d3a14b..f841255 100644
--- a/genenetwork-development.scm
+++ b/genenetwork-development.scm
@@ -21,7 +21,7 @@
 ;;; <https://www.gnu.org/licenses/>.
 
 (use-modules (gnu)
-             ((gn packages genenetwork) #:select (genenetwork2 genenetwork3 gn-auth))
+             ((gn packages genenetwork) #:select (genenetwork2 genenetwork3 gn-auth gn-libs))
              (gn services databases)
              ((gn packages guile) #:select (gn-guile))
              (gnu build linux-container)
@@ -122,7 +122,9 @@ be imported into G-expressions."
   (gn3-repository genenetwork-configuration-gn3-repository
                   (default "https://github.com/genenetwork/genenetwork3"))
   (gn-auth-repository genenetwork-configuration-gn-auth-repository
-                  (default "https://git.genenetwork.org/gn-auth"))
+                      (default "/home/git/public/gn-auth"))
+  (gn-libs-repository genenetwork-configuration-gn-libs-repository
+                      (default "/home/git/public/gn-libs"))
   (gn2-port genenetwork-configuration-gn2-port
             (default 8082))
   (gn3-port genenetwork-configuration-gn3-port
@@ -188,7 +190,7 @@ described by CONFIG, a <genenetwork-configuration>
 object. TEST-COMMAND is a list of strings specifying the command to be
 executed."
   (match-record config <genenetwork-configuration>
-    (gn2-repository gn3-repository gn3-port genotype-files)
+    (gn2-repository gn3-repository gn-libs-repository gn3-port genotype-files)
     (with-imported-modules '((guix build utils))
       (with-packages (list bash coreutils git-minimal nss-certs)
         #~(begin
@@ -216,6 +218,9 @@ executed."
             (invoke "git" "clone" "--depth" "1" #$gn3-repository)
             (with-directory-excursion "genenetwork3"
               (show-head-commit))
+            (invoke "git" "clone" "--depth" "1" #$gn-libs-repository)
+            (with-directory-excursion "gn-libs"
+              (show-head-commit))
             (invoke "git" "clone" "--depth" "1" #$gn2-repository)
             (with-directory-excursion "genenetwork2"
               (show-head-commit))
@@ -327,7 +332,7 @@ genenetwork3 source from the latest commit of @var{project}."
   "Return forge projects for genenetwork described by CONFIG, a
 <genenetwork-configuration> object."
   (match-record config <genenetwork-configuration>
-    (gn2-repository gn3-repository gn-auth-repository gn2-port)
+    (gn2-repository gn3-repository gn-auth-repository gn-libs-repository gn2-port)
     (list (forge-project
            (name "genenetwork2")
            (repository gn2-repository)
@@ -400,6 +405,20 @@ genenetwork3 source from the latest commit of @var{project}."
                            (trigger? #f))))
            (ci-jobs-trigger 'webhook))
           (forge-project
+           (name "gn-libs")
+           (repository gn-libs-repository)
+           (ci-jobs (list (forge-laminar-job
+                           (name "gn-libs")
+                           (run (guix-channel-job-gexp
+                                 (list (channel
+                                        (name 'gn-libs)
+                                        (url (forge-project-repository this-forge-project))
+                                        (branch "main")))
+                                 #:variables (list (variable-specification
+                                                    (module '(gn-libs))
+                                                    (name 'gn-libs)))
+                                 #:guix-daemon-uri %guix-daemon-uri))))))
+          (forge-project
            (name "gn-auth")
            (repository gn-auth-repository)
            (ci-jobs (list (forge-laminar-job
@@ -434,8 +453,7 @@ genenetwork3 source from the latest commit of @var{project}."
                                  #:variables (list (variable-specification
                                                     (module '(gn-auth))
                                                     (name 'gn-auth-all-tests)))
-                                 #:guix-daemon-uri %guix-daemon-uri)))))
-           (ci-jobs-trigger 'webhook)))))
+                                 #:guix-daemon-uri %guix-daemon-uri)))))))))
 
 (define (genenetwork2-cd-gexp config)
   "Return a G-expression that runs the latest genenetwork2 development
@@ -969,7 +987,7 @@ described by CONFIG, a <genenetwork-configuration> object."
 (define transform-genenetwork-database-project
   (forge-project
    (name "transform-genenetwork-database")
-   (repository "https://git.genenetwork.org/gn-transform-databases")
+   (repository "/home/git/public/gn-transform-databases")
    (ci-jobs (list (forge-laminar-job
                    (name "transform-genenetwork-database-tests")
                    (run (guix-channel-job-gexp
@@ -984,8 +1002,7 @@ described by CONFIG, a <genenetwork-configuration> object."
                    (run (transform-genenetwork-database-gexp
                          %connection-settings
                          %virtuoso-data-dir
-                         "https://git.genenetwork.org/gn-transform-databases")))))
-   (ci-jobs-trigger 'webhook)))
+                         "https://git.genenetwork.org/gn-transform-databases")))))))
 
 
 ;;;
@@ -1355,7 +1372,7 @@ gn-auth."
                              (number-of-buffers 4000000)
                              (maximum-dirty-buffers 3000000)
                              (server-port 9081)
-                             (dirs-allowed "/var/lib/data")
+                             (dirs-allowed (list "/var/lib/data"))
                              (http-server-port %virtuoso-sparql-port)))
                    (service genenetwork-service-type
                             (genenetwork-configuration
@@ -1382,8 +1399,12 @@ gn-auth."
                              (hosts
                               (list (tissue-host
                                      (name "issues.genenetwork.org")
-                                     (user "laminar")
-                                     (upstream-repository "https://github.com/genenetwork/gn-gemtext-threads"))))))
+                                     (projects (list (tissue-project
+                                                      (name "issues.genenetwork.org")
+                                                      (user "laminar")
+                                                      (base-path "/")
+                                                      (upstream-repository
+                                                       "https://github.com/genenetwork/gn-gemtext-threads")))))))))
                    (service forge-nginx-service-type
                             (forge-nginx-configuration
                              (http-listen (forge-ip-socket
diff --git a/genenetwork/services/genenetwork.scm b/genenetwork/services/genenetwork.scm
index b863bcf..a403f21 100644
--- a/genenetwork/services/genenetwork.scm
+++ b/genenetwork/services/genenetwork.scm
@@ -109,6 +109,8 @@
                            (default "/var/empty"))
   (gn3-data-directory genenetwork-configuration-gn3-data-directory
                       (default "/var/genenetwork"))
+  (gn2-sessions-dir genenetwork-configuration-gn2-sessions-dir
+                    (default "/var/genenetwork/sessions/genenetwork2"))
   (gn2-secrets genenetwork-configuration-gn2-secrets
                (default "/etc/genenetwork"))
   (gn3-secrets genenetwork-configuration-gn3-secrets
@@ -119,6 +121,10 @@
                  (default 8091))
   (gn-doc-git-checkout genenetwork-configuration-gn-doc-git-checkout
                        (default "/export/data/gn-docs"))
+  (gn-virtuoso-ttl-directory genenetwork-configuration-gn-virtuoso-ttl-directory
+                             (default "/export/data/virtuoso/ttl"))
+  (gn-tmpdir genenetwork-configuration-gn-tmpdir
+             (default "/opt/gn/tmp"))
   (log-level genenetwork-configuration-log-level
              (default 'warning)
              (sanitize sanitize-log-level)))
@@ -142,6 +148,8 @@
                    (default "https://auth.genenetwork.org"))
   (gn2-server-url gn-uploader-configuration-gn2-server-url
                   (default "https://genenetwork.org"))
+  (sessions-dir gn-uploader-sessions-dir
+                (default "/var/genenetwork/sessions/gn-uploader"))
   (log-level gn-uploader-configuration-log-level
              (default 'warning)
              (sanitize sanitize-log-level)))
@@ -170,6 +178,8 @@
          (genenetwork3 (genenetwork-configuration-genenetwork3 config))
          (xapian-directory (genenetwork-configuration-xapian-db config))
          (sparql-endpoint (genenetwork-configuration-sparql-endpoint config))
+         (virtuoso-ttl-directory
+          (genenetwork-configuration-gn-virtuoso-ttl-directory config))
          (xapian-build-directory (string-append xapian-directory "/build"))
          (herd (file-append shepherd "/bin/herd"))
          (index-genenetwork (file-append genenetwork3 "/bin/index-genenetwork"))
@@ -203,7 +213,9 @@
                                                   "is-data-modified"
                                                   #$xapian-directory
                                                   #$sql-uri
-                                                  #$sparql-endpoint))))
+                                                  #$sparql-endpoint
+                                                  "--virtuoso-ttl-directory"
+                                                  #$virtuoso-ttl-directory))))
             (dynamic-wind
               (const #t)
               ;; build the index
@@ -212,7 +224,9 @@
                         "create-xapian-index"
                         #$xapian-build-directory
                         #$sql-uri
-                        #$sparql-endpoint)
+                        #$sparql-endpoint
+                        "--virtuoso-ttl-directory"
+                        #$virtuoso-ttl-directory)
                 (dynamic-wind
                   ;; stop GN3: Here there is magic!!!
                   ;;     The name `gunicorn-genenetwork' is magical. It is not set
@@ -242,7 +256,7 @@
 
 (define (genenetwork-activation config)
   (match-record config <genenetwork-configuration>
-    (gn2-secrets gn3-secrets gn-auth-secrets auth-db llm-db-path)
+    (gn2-secrets gn3-secrets gn-auth-secrets auth-db llm-db-path genotype-files gn-tmpdir gn-doc-git-checkout gn2-sessions-dir)
     (with-imported-modules '((guix build utils))
       #~(begin
           (use-modules (guix build utils))
@@ -262,7 +276,11 @@
                              (passwd:uid (getpw "gunicorn-genenetwork2"))
                              (passwd:gid (getpw "gunicorn-genenetwork2"))))
                     (append (list #$gn2-secrets)
+                            (find-files #$genotype-files
+                                        #:directories? #t)
                             (find-files #$gn2-secrets
+                                        #:directories? #t)
+                            (find-files #$gn2-sessions-dir
                                         #:directories? #t)))
           (for-each (lambda (file)
                       (chown file
@@ -278,7 +296,31 @@
                             (find-files #$gn2-secrets
                                         #:directories? #f)
                             (find-files #$gn-auth-secrets
-                                        #:directories? #f)))))))
+                                        #:directories? #f)))
+          ;; Make sub-directories for various apps under gn-tmpdir and assign
+          ;; appropriate permissions
+          (for-each (match-lambda
+                      ((subdir user)
+                       (let ((full-path
+                              (string-append #$gn-tmpdir "/" subdir)))
+                         (unless (file-exists? full-path)
+                           (mkdir full-path #o755))
+                         (for-each (lambda (file)
+                                     (chown file
+                                            (passwd:uid (getpw user))
+                                            (passwd:gid (getpw user))))
+                                   (find-files full-path
+                                               #:directories? #t)))))
+                    '(("gn2-tmpdir" "gunicorn-genenetwork2")
+                      ("gn3-tmpdir" "gunicorn-genenetwork3")))
+
+          ;; setup correct ownership for gn-docs
+          (for-each (lambda (file)
+                      (chown file
+                             (passwd:uid (getpw "genenetwork"))
+                             (passwd:gid (getpw "genenetwork"))))
+                    (find-files #$gn-doc-git-checkout
+                                #:directories? #t))))))
 
 (define (configuration-file-gexp alist)
   "Return a G-expression that constructs a configuration file of
@@ -309,7 +351,7 @@ G-expressions or numbers."
 described by @var{config}, a @code{<genenetwork-configuration>}
 object."
   (match-record config <genenetwork-configuration>
-    (genenetwork2 genenetwork3 gn-auth server-name gn-auth-server-name gn2-port gn3-port gn-auth-port sql-uri auth-db xapian-db genotype-files sparql-endpoint gn-sourcecode-directory gn3-data-directory gn2-secrets gn3-secrets gn-auth-secrets llm-db-path log-level)
+    (genenetwork2 genenetwork3 gn-auth server-name gn-auth-server-name gn2-port gn3-port gn-auth-port sql-uri auth-db xapian-db genotype-files gn2-sessions-dir sparql-endpoint gn-sourcecode-directory gn3-data-directory gn2-secrets gn3-secrets gn-auth-secrets llm-db-path gn-tmpdir log-level)
     ;; If we mapped only the mysqld.sock socket file, it would break
     ;; when the external mysqld server is restarted.
     (let* ((database-mapping (file-system-mapping
@@ -333,7 +375,9 @@ object."
                                        ("JS_GUIX_PATH" ,(file-append gn2-profile "/share/genenetwork2/javascript"))
                                        ("PLINK_COMMAND" ,(file-append gn2-profile "/bin/plink2"))
                                        ("SQL_URI" ,sql-uri)
-                                       ("AI_SEARCH_ENABLED" "True")))))
+                                       ("AI_SEARCH_ENABLED" "True")
+                                       ("SESSION_FILESYSTEM_CACHE_PATH" ,gn2-sessions-dir)
+                                       ("MAX_FORM_MEMORY_SIZE" 52428800)))))
            (gn3-profile (profile
                          (content (package->development-manifest genenetwork3))
                          (allow-collisions? #t)))
@@ -358,9 +402,9 @@ object."
                                         (configuration-file-gexp
                                          `(("GN_AUTH_SECRETS" ,(string-append gn-auth-secrets "/gn-auth-secrets.py"))
                                            ("AUTH_DB" ,auth-db)
-                                           ("SQL_URI" ,sql-uri)
-                                           ("CLIENTS_SSL_PUBLIC_KEYS_DIR" ,(string-append gn-auth-secrets "/clients-public-keys"))
-                                           ("SSL_PRIVATE_KEY" ,(string-append gn-auth-secrets "/gn-auth-ssl-private-key.pem")))))))
+                                           ("SQL_URI" ,sql-uri)))))
+           (gn2-tmpdir (string-append gn-tmpdir "/gn2-tmpdir"))
+           (gn3-tmpdir (string-append gn-tmpdir "/gn3-tmpdir")))
       (list (gunicorn-app
              (name "genenetwork2")
              (package genenetwork2)
@@ -375,7 +419,7 @@ object."
                      (value gn2-profile))
                     (environment-variable
                      (name "TMPDIR")
-                     (value "/tmp"))
+                     (value gn2-tmpdir))
                     (environment-variable
                      (name "GN2_SETTINGS")
                      (value gn2-conf))
@@ -388,13 +432,17 @@ object."
              (mappings (list database-mapping
                              (file-system-mapping
                               (source genotype-files)
-                              (target source))
+                              (target source)
+                              (writable? #t))
                              (file-system-mapping
                               (source gn-sourcecode-directory)
                               (target source))
-                             (file-system-mapping ; GN2 and GN3 need to share TMPDIR
-                              (source "/tmp")
-                              (target "/tmp")
+                             (file-system-mapping ; GN2 and GN3 need to communicate via TMPDIR
+                              (source gn-tmpdir)
+                              (target source))
+                             (file-system-mapping
+                              (source gn2-tmpdir)
+                              (target source)
                               (writable? #t))
                              (file-system-mapping
                               (source gn2-conf)
@@ -408,7 +456,11 @@ object."
                               (writable? #t))
                              (file-system-mapping
                               (source gn2-ca-bundle)
-                              (target source))))
+                              (target source))
+                             (file-system-mapping
+                              (source gn2-sessions-dir)
+                              (target source)
+                              (writable? #t))))
              (extra-cli-arguments
               (list "--log-level"
                     (string-upcase (symbol->string log-level)))))
@@ -429,7 +481,7 @@ object."
                      (value gn3-conf))
                     (environment-variable
                      (name "TMPDIR")
-                     (value "/tmp"))
+                     (value gn3-tmpdir))
                     (environment-variable
                      (name "GN3_SECRETS")
                      (value gn3-secrets))
@@ -455,9 +507,12 @@ object."
                              (file-system-mapping
                               (source gn3-data-directory)
                               (target source))    ; Rqtl usese this
-                             (file-system-mapping ; GN2 and GN3 need to share TMPDIR
-                              (source "/tmp")
-                              (target "/tmp")
+                             (file-system-mapping ; GN2 and GN3 need to communicate via TMPDIR
+                              (source gn-tmpdir)
+                              (target source))
+                             (file-system-mapping
+                              (source gn3-tmpdir)
+                              (target source)
                               (writable? #t))
                              (file-system-mapping
                               (source xapian-db)
@@ -526,7 +581,8 @@ a @code{<genenetwork-configuration>} record."
                                               (number->string gn2-port) ";")
                                "proxy_set_header Host $host;"
                                "proxy_read_timeout 20m;"
-                               "proxy_set_header X-Forwarded-Proto $scheme;")))
+                               "proxy_set_header X-Forwarded-Proto $scheme;"
+                               "client_max_body_size 8050m;")))
                   (nginx-location-configuration
                    (uri "/api3/")
                    (body (list "rewrite /api3/(.*) /api/$1 break;"
@@ -628,14 +684,18 @@ a @code{<genenetwork-configuration>} record."
 
 (define (gn-uploader-activation config)
   (match-record config <gn-uploader-configuration>
-    (secrets data-directory)
+    (secrets data-directory sessions-dir)
     (with-imported-modules '((guix build utils))
       #~(begin
           (use-modules (guix build utils))
           ;; Let service user own their own secrets files.
-          (chown #$secrets
-                 (passwd:uid (getpw "gunicorn-gn-uploader"))
-                 (passwd:gid (getpw "gunicorn-gn-uploader")))
+          (for-each (lambda (file)
+                      (chown file
+                             (passwd:uid (getpw "gunicorn-gn-uploader"))
+                             (passwd:gid (getpw "gunicorn-gn-uploader"))))
+                    (append (list #$secrets)
+                            (find-files #$sessions-dir
+                                        #:directories? #t)))
           ;; Set owner-only permissions on secrets files.
           (for-each (lambda (file)
                       (chmod file #o600))
@@ -651,25 +711,26 @@ a @code{<genenetwork-configuration>} record."
 
 (define (gn-uploader-gunicorn-app config)
   (match-record config <gn-uploader-configuration>
-    (gn-uploader sql-uri port data-directory secrets log-level auth-server-url gn2-server-url)
+    (gn-uploader sql-uri port data-directory secrets log-level auth-server-url gn2-server-url sessions-dir)
     ;; If we mapped only the mysqld.sock socket file, it would break
     ;; when the external mysqld server is restarted.
-    (let ((database-mapping (file-system-mapping
-                             (source "/run/mysqld")
-                             (target source)
-                             (writable? #t)))
-          (gn-uploader-conf (computed-file "gn-uploader.conf"
-                                           (configuration-file-gexp
-                                            `(("UPLOADER_SECRETS" ,secrets)
-                                              ("SQL_URI" ,sql-uri)
-                                              ("UPLOAD_FOLDER" ,(string-append data-directory
-                                                                               "/uploads"))
-                                              ("AUTH_SERVER_URL" ,auth-server-url)
-                                              ("GN2_SERVER_URL" ,gn2-server-url)))))
-          (gn-uploader-profile (profile
-                                (content (package->development-manifest gn-uploader))
-                                (allow-collisions? #t)))
-          (gn-uploader-ca-bundle (file-append gn-uploader-profile "/etc/ssl/certs/ca-certificates.crt")))
+    (let* ((database-mapping (file-system-mapping
+                              (source "/run/mysqld")
+                              (target source)
+                              (writable? #t)))
+           (gn-uploader-conf (computed-file "gn-uploader.conf"
+                                            (configuration-file-gexp
+                                             `(("UPLOADER_SECRETS" ,secrets)
+                                               ("SQL_URI" ,sql-uri)
+                                               ("UPLOAD_FOLDER" ,(string-append data-directory
+                                                                                "/uploads"))
+                                               ("AUTH_SERVER_URL" ,auth-server-url)
+                                               ("GN2_SERVER_URL" ,gn2-server-url)
+                                               ("SESSION_FILESYSTEM_CACHE_PATH" ,sessions-dir)))))
+           (gn-uploader-profile (profile
+                                 (content (package->development-manifest gn-uploader))
+                                 (allow-collisions? #t)))
+           (gn-uploader-ca-bundle (file-append gn-uploader-profile "/etc/ssl/certs/ca-certificates.crt")))
       (list (gunicorn-app
              (name "gn-uploader")
              (package gn-uploader)
@@ -706,7 +767,11 @@ a @code{<genenetwork-configuration>} record."
                               (target source))
                              (file-system-mapping
                               (source gn-uploader-ca-bundle)
-                              (target source))))
+                              (target source))
+                             (file-system-mapping
+                              (source sessions-dir)
+                              (target source)
+                              (writable? #t))))
              (extra-cli-arguments
               (list "--log-level"
                     (string-upcase (symbol->string log-level)))))))))
diff --git a/production-deploy.sh b/production-deploy.sh
index bd95814..a88fcb8 100755
--- a/production-deploy.sh
+++ b/production-deploy.sh
@@ -29,7 +29,6 @@ container_script=$(guix system container \
                         --share=/export2/guix-containers/genenetwork/var/genenetwork=/var/genenetwork \
                         --share=/export2/guix-containers/genenetwork/var/lib/acme=/var/lib/acme \
                         --share=/export2/guix-containers/genenetwork/var/lib/redis=/var/lib/redis \
-                        --share=/export/mysql/database=/var/lib/mysql \
                         --share=/export2/guix-containers/genenetwork/var/lib/virtuoso=/var/lib/virtuoso \
                         --share=/export2/guix-containers/genenetwork/var/log=/var/log \
                         --share=/export2/guix-containers/genenetwork/etc/genenetwork=/etc/genenetwork \
@@ -38,7 +37,10 @@ container_script=$(guix system container \
                         --share=/export2/guix-containers/genenetwork/var/lib/genenetwork-gnqa=/var/lib/genenetwork-gnqa \
                         --share=/var/run/mysqld=/run/mysqld \
 			--share=/export/data/gn-docs/ \
-                        --share=/export2/guix-containers/genenetwork/tmp=/tmp \
+                        --share=/export2/guix-containers/genenetwork/tmp=/opt/gn/tmp \
+                        --expose=/export2/guix-containers/genenetwork/data/virtuoso=/export/data/virtuoso/ \
+                        --share=/export2/guix-containers/genenetwork/var/lib/gn-docs=/export/data/gn-docs \
+                        --share=/export2/guix-containers/genenetwork/var/genenetwork/sessions=/var/genenetwork/sessions \
                         production.scm)
 
 echo $container_script
diff --git a/production.scm b/production.scm
index 933320a..9e629f0 100644
--- a/production.scm
+++ b/production.scm
@@ -44,14 +44,11 @@
                     "@include " %sudoers-specification
                     "\nacme ALL = NOPASSWD: " (file-append shepherd "/bin/herd") " restart nginx\n"))
   (packages %base-packages)
-  (services (cons* (service mysql-service-type
-                            (mysql-configuration
-                             (auto-upgrade? #f)))
-                   (service virtuoso-service-type
+  (services (cons* (service virtuoso-service-type
                             (virtuoso-configuration
                              (server-port 9892)
                              (http-server-port 9893)
-                             (dirs-allowed "/var/lib/virtuoso")
+                             (dirs-allowed (list "/export/data/virtuoso"))
                              (number-of-buffers 4000000)
                              (maximum-dirty-buffers 3000000)
                              (database-file "/var/lib/virtuoso/genenetwork-virtuoso.db")
@@ -80,7 +77,7 @@
                              (gn3-port 9895)
                              (gn-auth-port 9896)
                              (sql-uri
-                              "mysql://webqtlout:webqtlout@localhost/db_webqtl?unix_socket=/run/mysqld/mysqld.sock")
+                              "mysql://webqtlout:webqtlout@localhost/db_webqtl?unix_socket=/run/mysqld/mysqld.sock&charset=utf8")
                              (xapian-db "/var/lib/xapian")
                              (sparql-endpoint "http://localhost:9893/sparql")
                              (gn3-data-directory "/var/genenetwork/data/genenetwork3")
@@ -90,5 +87,6 @@
                              (auth-db "/var/lib/genenetwork-sqlite/auth.db")
                              (llm-db-path "/var/lib/genenetwork-gnqa/llm.db")
                              (gn3-alias-server-port 9800)
+                             (gn-tmpdir "/opt/gn/tmp")
                              (log-level 'debug)))
                    %base-services)))
diff --git a/public-sparql-deploy.sh b/public-sparql-deploy.sh
index bee9abf..4ecacc6 100755
--- a/public-sparql-deploy.sh
+++ b/public-sparql-deploy.sh
@@ -26,6 +26,7 @@ container_script=$(guix system container \
 			--share=/export2/guix-containers/public-sparql/tmp=/tmp \
 			--share=/export2/guix-containers/public-sparql/var/log=/var/log \
 			--share=/export2/guix-containers/public-sparql/var/lib/acme=/var/lib/acme \
+                        --share=/export2/guix-containers/genenetwork/data/virtuoso=/export/data/virtuoso \
                         public-sparql.scm)
 
 echo $container_script
diff --git a/public-sparql.scm b/public-sparql.scm
index f6efb15..4603cec 100644
--- a/public-sparql.scm
+++ b/public-sparql.scm
@@ -20,6 +20,7 @@
 (use-modules (gnu)
              (gn services databases)
              (gnu services web)
+             ((gnu packages admin) #:select (shepherd))
              (forge nginx)
              (forge socket))
 
@@ -50,13 +51,17 @@ SPARQL endpoint is listening on."
                (targets (list "/dev/sdX"))))
   (file-systems %base-file-systems)
   (users %base-user-accounts)
+  (sudoers-file
+   (mixed-text-file "sudoers"
+                    "@include " %sudoers-specification
+                    "\nacme ALL = NOPASSWD: " (file-append shepherd "/bin/herd") " restart nginx\n"))
   (packages %base-packages)
   (services (cons* (service virtuoso-service-type
                             (virtuoso-configuration
                              (server-port %virtuoso-port)
                              (http-server-port %sparql-port)
 			     (number-of-buffers 4000000)
-			     (dirs-allowed "/var/lib/virtuoso")
+			     (dirs-allowed (list "/export/data/virtuoso"))
 			     (maximum-dirty-buffers 3000000)
                              (database-file "/var/lib/virtuoso/public-virtuoso.db")
                              (transaction-file "/var/lib/virtuoso/public-virtuoso.trx")))
diff --git a/uploader-deploy.sh b/uploader-deploy.sh
index fdbbe0c..415790b 100755
--- a/uploader-deploy.sh
+++ b/uploader-deploy.sh
@@ -41,18 +41,22 @@ container_script=$(guix system container \
                         --network \
                         --load-path=. \
                         --verbosity=3 \
-                        --share=/export2/guix-containers/genenetwork/uploader/var/genenetwork=/var/genenetwork \
-                        --share=/export2/guix-containers/genenetwork/uploader/var/lib/acme=/var/lib/acme \
-                        --share=/export2/guix-containers/genenetwork/uploader/var/lib/mysql=/var/lib/mysql \
-                        --share=/export2/guix-containers/genenetwork/uploader/var/lib/virtuoso=/var/lib/virtuoso \
-                        --share=/export2/guix-containers/genenetwork/uploader/var/log=/var/log \
-                        --share=/export2/guix-containers/genenetwork/uploader/etc/genenetwork=/etc/genenetwork \
-                        --share=/export/data/uploader/genenetwork-xapian=/export/data/genenetwork-xapian \
-                        --share=/export/data/uploader/genenetwork-sqlite=/export/data/genenetwork-sqlite \
-                        --expose=/export/data/uploader/genotype_files=/export/data/genenetwork/genotype_files \
-                        --expose=/export/data/uploader/genenetwork3 \
-                        --share=/export/data/uploader/gn-uploader \
+                        --share=/export/guix-containers/uploader/var/genenetwork=/var/genenetwork \
+                        --share=/export/guix-containers/uploader/var/lib/acme=/var/lib/acme \
+                        --share=/export/guix-containers/uploader/var/lib/redis=/var/lib/redis \
+                        --share=/export/guix-containers/uploader/var/lib/virtuoso=/var/lib/virtuoso \
+                        --share=/export/guix-containers/uploader/var/log=/var/log \
+                        --share=/export/guix-containers/uploader/etc/genenetwork=/etc/genenetwork \
+                        --share=/export/guix-containers/uploader/var/lib/genenetwork-xapian=/var/lib/xapian \
+                        --share=/export/guix-containers/uploader/var/lib/genenetwork-sqlite=/var/lib/genenetwork-sqlite \
+                        --share=/export/guix-containers/uploader/var/lib/genenetwork-gnqa=/var/lib/genenetwork-gnqa \
                         --share=/var/run/mysqld3307=/run/mysqld \
+			--share=/export/data/gn-docs \
+                        --share=/export/guix-containers/uploader/tmp=/opt/gn/tmp \
+                        --expose=/export/guix-containers/uploader/data/virtuoso=/export/data/virtuoso/ \
+                        --share=/export/guix-containers/uploader/var/lib/gn-docs=/export/data/gn-docs \
+                        --share=/export/guix-containers/uploader/var/genenetwork/sessions=/var/genenetwork/sessions \
+                        --share=/export/data/uploader/gn-uploader \
                         uploader.scm)
 
 echo "${container_script}"
diff --git a/uploader.scm b/uploader.scm
index 62ab35f..5064426 100644
--- a/uploader.scm
+++ b/uploader.scm
@@ -42,11 +42,7 @@
                     "@include " %sudoers-specification
                     "\nacme ALL = NOPASSWD: " (file-append shepherd "/bin/herd") " restart nginx\n"))
   (packages %base-packages)
-  (services (cons* (service virtuoso-service-type
-                            (virtuoso-configuration
-                             (server-port 10892)
-                             (http-server-port 10893)))
-                   (service forge-nginx-service-type
+  (services (cons* (service forge-nginx-service-type
                             (forge-nginx-configuration
                              (http-listen (forge-ip-socket
                                            (ip "0.0.0.0")
@@ -64,24 +60,26 @@
                              (gn2-port 10894)
                              (gn3-port 10895)
                              (gn-auth-port 10896)
-                             (sql-uri "mysql://webqtlout:webqtlout@127.0.0.1:3307/db_webqtl")
-                             (auth-db "/export/data/genenetwork-sqlite/auth.db")
-                             (xapian-db "/export/data/genenetwork-xapian")
-                             (genotype-files "/export/data/genenetwork/genotype_files")
+                             (sql-uri
+                              "mysql://webqtlout:webqtlout@localhost/db_webqtl?unix_socket=/run/mysqld/mysqld.sock&charset=utf8")
+                             (auth-db "/var/lib/genenetwork-sqlite/auth.db")
+                             (xapian-db "/var/lib/xapian")
                              (sparql-endpoint "http://localhost:10893/sparql")
-                             (gn3-data-directory "/export/data/uploader/genenetwork3")
+                             (gn3-data-directory "/var/genenetwork/data/genenetwork3")
                              (gn2-secrets "/etc/genenetwork/genenetwork2")
                              (gn3-secrets "/etc/genenetwork/genenetwork3/gn3-secrets.py")
-                             (gn-auth-secrets "/etc/genenetwork/gn-auth")))
+                             (gn-auth-secrets "/etc/genenetwork/gn-auth")
+                             (llm-db-path "/var/lib/genenetwork-gnqa/llm.db")))
                    (service gn-uploader-service-type
                             (gn-uploader-configuration
                              (gn-uploader gn-uploader)
                              (server-name "staging-uploader.genenetwork.org")
                              (port 10897)
                              (secrets "/etc/genenetwork/gn-uploader/gn-uploader-secrets.py")
-                             (sql-uri "mysql://webqtlout:webqtlout@127.0.0.1:3307/db_webqtl")
+                             (sql-uri
+                              "mysql://webqtlout:webqtlout@localhost/db_webqtl?unix_socket=/run/mysqld/mysqld.sock&charset=utf8")
                              (data-directory "/export/data/uploader/gn-uploader")
-                             (log-level "DEBUG")
+                             (log-level 'debug)
                              (auth-server-url "https://staging-auth.genenetwork.org/")
                              (gn2-server-url "https://staging.genenetwork.org")))
                    %base-services)))
diff --git a/virtuoso-deploy.sh b/virtuoso-deploy.sh
index 0414a65..0dd2509 100755
--- a/virtuoso-deploy.sh
+++ b/virtuoso-deploy.sh
@@ -25,6 +25,7 @@ container_script=$(guix system container \
                         --network \
                         --verbosity=3 \
                         --share=/export2/guix-containers/virtuoso/var/lib/virtuoso=/var/lib/virtuoso \
+                        --share=/export2/guix-containers/genenetwork/data/virtuoso=/export/data/virtuoso \
                         virtuoso.scm)
 
 echo $container_script
diff --git a/virtuoso.scm b/virtuoso.scm
index edcd575..3272f41 100644
--- a/virtuoso.scm
+++ b/virtuoso.scm
@@ -34,5 +34,5 @@
                            (virtuoso-configuration
                             (server-port 8891)
                             (http-server-port 8892)
-                            (dirs-allowed "/var/lib/virtuoso")))
+                            (dirs-allowed (list "/export/data/virtuoso"))))
                   %base-services)))