mirror of
https://github.com/ben-grande/qusal.git
synced 2024-10-01 02:35:49 -04:00
fix: allow update check to work on cacher clients
Qubes that have the updates-proxy-service enabled will have the repository definitions set to work with the proxy, being it a TemplateVM or another type of qube. Qubes that have that same service disabled and are based on templates that are being cached, will have the repository definitions corrected for it to work like normal systems via the networking instead of caching proxy. Optimizations were done for a faster runtime, previously it would call sed 38 times on Fedora-39, now it only calls sed 2 times for Fedora repositories (one extra for rpmfusion) and some more for PackageKit and dnf.conf markers. Inexpensive runtime is a must for a script that may run multiple times, such as when being called by a tool monitoring the filesystem such as inotify. Code from /usr/lib/qubes/update-proxy-configs was used for the NetVM use case of the cacher, thus the license had to be changed. For: https://github.com/ben-grande/qusal/issues/44 Fixes: https://github.com/ben-grande/qusal/issues/31
This commit is contained in:
Ben Grande
parent
a6f7d23819
commit
1ede2e1a1e
@ -106,13 +106,30 @@ non-template qubes and qubes that do not have a working Qrexec. Use the native
|
||||
configuration to set the update proxy using the IP address of `sys-cacher` by
|
||||
setting `sys-cacher` as the netvm of the client qube.
|
||||
|
||||
Set `sys-cacher` as the netvm of your qube:
|
||||
```sh
|
||||
qvm-prefs QUBE netvm sys-cacher
|
||||
```
|
||||
|
||||
Enable the service `netvm-cacher`:
|
||||
```sh
|
||||
qvm-features QUBE service.netvm-cacher 1
|
||||
```
|
||||
|
||||
Copy [apt-cacher-ng-repo](files/client/bin/apt-cacher-ng-repo) to your qube
|
||||
and set the script to run on boot. Make sure that the file
|
||||
`/var/run/qubes-service/netvm-cacher` exists on every startup for the proxy
|
||||
address change take effect.
|
||||
|
||||
The qube has to be restarted for changes to take effect.
|
||||
|
||||
### Non-TemplateVMs integration
|
||||
|
||||
**Attention**: this method will allow a client qube to bypass the qubes
|
||||
firewall and connect to a remote via the updates proxy.
|
||||
firewall and connect to a remote host via the updates proxy.
|
||||
|
||||
By default, only templates will use the proxy to update, if you want to cache
|
||||
Non-TemplateVMs updates or simply make them functional again, the qube will
|
||||
non-TemplateVMs updates or simply make them functional again, the qube will
|
||||
need the `service.updates-proxy-setup` feature set:
|
||||
```sh
|
||||
qvm-tags add QUBE updatevm-sys-cacher
|
||||
|
||||
@ -1,106 +1,303 @@
|
||||
#!/bin/sh
|
||||
|
||||
# SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
||||
# SPDX-FileCopyrightText: 2015 - 2020 Marek Marczykowski-Gorecki <marmarek@invisiblethingslab.com>
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
## Description: rewrite repositories definitions to be used with the cacher.
|
||||
## It works for qubes that should be configured to use the cacher via Qrexec
|
||||
## or Netvm (direct networking).
|
||||
##
|
||||
## Looping through files and testing their permissions (read, write) is better
|
||||
## than finding a file and trying to sed it without knowledge, it is also
|
||||
## beneficial as 'find' fails if file is not existent and sending all 'find'
|
||||
## output to /dev/stderr is not great.
|
||||
##
|
||||
## Assigning the repositories files to '$@' avoids having to parse their names
|
||||
## in case they contain spaces, newlines and other dangerous characters to the
|
||||
## shell, it is also an easy way to use an array for /bin/sh.
|
||||
|
||||
set -eu
|
||||
|
||||
changes_file="$(mktemp)"
|
||||
trap 'rm -f "${changes_file}"' HUP INT QUIT ABRT EXIT
|
||||
set_proxy_marker(){
|
||||
marker_begin_text="QUBES BEGIN"
|
||||
marker_end_text="QUBES END"
|
||||
marker_begin="### ${marker_begin_text} ###"
|
||||
marker_end="### ${marker_end_text} ###"
|
||||
proxy_file="${1}"
|
||||
proxy_options="${2}"
|
||||
|
||||
rewrite_repo(){
|
||||
test -n "${2}" || return 1
|
||||
test -f "${repo}" || return 0
|
||||
test -r "${repo}" || return 0
|
||||
test -w "${repo}" || return 0
|
||||
sed -i "s|${1}|${2}|w ${changes_file}" "${repo}"
|
||||
if ! grep -q "^${marker_begin}$" "${proxy_file}"; then
|
||||
if grep -q "^${marker_end}$" "${proxy_file}"; then
|
||||
echo "Error: found marker ${marker_end_text} but not ${marker_begin_text} in ${proxy_file}" >&2
|
||||
echo "Fix the file by either removing both markers or adding missing ones and retry" >&2
|
||||
exit 1
|
||||
fi
|
||||
cp "${proxy_file}" "${proxy_file}.qubes-orig"
|
||||
echo "${marker_begin}" | tee -a "${proxy_file}" >/dev/null
|
||||
echo "${marker_end}" | tee -a "${proxy_file}" >/dev/null
|
||||
elif ! grep -q "^${marker_end}$" "${proxy_file}"; then
|
||||
echo "Error: found marker ${marker_begin_text} but not ${marker_end_text} in ${proxy_file}" >&2
|
||||
echo "Fix the file by either removing both markers or adding missing ones and retry" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
proxy_tmp_file="$(mktemp)"
|
||||
cat >"${proxy_tmp_file}" <<EOF
|
||||
# The text between ${marker_begin_text} and ${marker_end_text} is automatically
|
||||
# generated by $0. All changes here will be overriden.
|
||||
# You can override options after the ${marker_end_text}.
|
||||
${proxy_options}
|
||||
EOF
|
||||
|
||||
## Couldn't figure out how to write only changes on the next sed.
|
||||
if ! grep -q "${proxy_options}" "${proxy_file}"; then
|
||||
tee -a "${changes_file}" <"${proxy_tmp_file}" >/dev/null
|
||||
fi
|
||||
## GNU Sed, only reliable while we don't support BSD.
|
||||
sed -i -e "/^${marker_begin}$/,/^${marker_end}$/{
|
||||
/^${marker_end}$/b
|
||||
/^${marker_begin}$/!d
|
||||
r ${proxy_tmp_file}
|
||||
}" "${proxy_file}"
|
||||
rm -f "${proxy_tmp_file}"
|
||||
}
|
||||
|
||||
check_netvm_cacher(){
|
||||
proxy_host="127.0.0.1"
|
||||
proxy_port="8082"
|
||||
proxy_addr=""
|
||||
proxy_url=""
|
||||
proxy_conf=""
|
||||
if ! test -f /var/run/qubes-service/updates-proxy-setup; then
|
||||
return 0
|
||||
fi
|
||||
if test -f /var/run/qubes-service/netvm-cacher; then
|
||||
proxy_host="$(qubesdb-read /qubes-gateway)"
|
||||
if test -z "${proxy_host}"; then
|
||||
echo "Error: service netvm-cacher enabled but netvm IP was not found" >&2
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
proxy_addr="${proxy_host}:${proxy_port}"
|
||||
proxy_url="http://${proxy_addr}"
|
||||
proxy_conf="proxy=${proxy_addr}"
|
||||
}
|
||||
|
||||
set_proxy_os(){
|
||||
if test -e /etc/fedora-release; then
|
||||
## Fedora
|
||||
|
||||
if test -w /etc/dnf/dnf.conf; then
|
||||
set_proxy_marker /etc/dnf/dnf.conf "${proxy_conf}"
|
||||
fi
|
||||
|
||||
if test -n "${proxy_addr}"; then
|
||||
cat >/etc/yum.conf.d/qubes-proxy.conf <<EOF
|
||||
${proxy_conf}
|
||||
EOF
|
||||
else
|
||||
rm -f /etc/yum.conf.d/qubes-proxy.conf
|
||||
fi
|
||||
|
||||
set --
|
||||
for repo in \
|
||||
/etc/yum.repos.d/*.repo
|
||||
do
|
||||
test -f "${repo}" || continue
|
||||
test -r "${repo}" || continue
|
||||
test -w "${repo}" || continue
|
||||
set -- "${@}" "${repo}"
|
||||
done
|
||||
test -n "${*}" || return 0
|
||||
|
||||
case "${action}" in
|
||||
install)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|baseurl\s*=\s*https://|baseurl=http://HTTPS///|w ${changes_file}" \
|
||||
-e "s|metalink\s*=\s*https://|metalink=http://HTTPS///|w ${changes_file}" \
|
||||
{} \+
|
||||
|
||||
set --
|
||||
for repo in \
|
||||
/etc/yum.repos.d/rpmfusion*.repo
|
||||
do
|
||||
test -f "${repo}" || continue
|
||||
test -r "${repo}" || continue
|
||||
test -w "${repo}" || continue
|
||||
set -- "${@}" "${repo}"
|
||||
done
|
||||
test -n "${*}" || return 0
|
||||
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|^\s*#.*baseurl|baseurl|w ${changes_file}" \
|
||||
-e "s|^\s*metalink\s*=\s*|#metalink=|w ${changes_file}" \
|
||||
{} \+
|
||||
;;
|
||||
|
||||
uninstall)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|baseurl\s*=\s*http://HTTPS///|baseurl=https://|w ${changes_file}" \
|
||||
-e "s|metalink\s*=\s*http://HTTPS///|metalink=https://|w ${changes_file}" \
|
||||
{} \+
|
||||
|
||||
set --
|
||||
for repo in \
|
||||
/etc/yum.repos.d/rpmfusion*.repo
|
||||
do
|
||||
test -f "${repo}" || continue
|
||||
test -r "${repo}" || continue
|
||||
test -w "${repo}" || continue
|
||||
set -- "${@}" "${repo}"
|
||||
done
|
||||
test -n "${*}" || return 0
|
||||
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|^\s*baseurl|#baseurl|w ${changes_file}" \
|
||||
-e "s|^\s*#.*metalink\s*=|metalink=|w ${changes_file}" \
|
||||
{} \+ 2>/dev/null || true
|
||||
;;
|
||||
esac
|
||||
|
||||
elif test -e /etc/debian_version && test ! -e /usr/share/whonix/marker; then
|
||||
## Debian but not Whonix.
|
||||
|
||||
if test -n "${proxy_addr}"; then
|
||||
cat >/etc/apt/apt.conf.d/50cacher-proxy <<EOF
|
||||
# Use Cacher NetVM Update Proxy
|
||||
Acquire::http::Proxy "${proxy_url}";
|
||||
Acquire::tor::proxy "${proxy_url}";
|
||||
EOF
|
||||
else
|
||||
rm -f /etc/apt/apt.conf.d/50cacher-proxy
|
||||
fi
|
||||
|
||||
set --
|
||||
for repo in \
|
||||
/etc/apt/sources.list \
|
||||
/etc/apt/sources.list.d/*.list \
|
||||
/etc/apt/sources.list.d/*.sources
|
||||
do
|
||||
test -f "${repo}" || continue
|
||||
test -r "${repo}" || continue
|
||||
test -w "${repo}" || continue
|
||||
set -- "${@}" "${repo}"
|
||||
done
|
||||
test -n "${*}" || return 0
|
||||
|
||||
case "${action}" in
|
||||
install)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|URIs:\s*https://|URIs: http://HTTPS///|w ${changes_file}" \
|
||||
-e "s|^\s*\(#*\)\s*deb\(.*\)https://|\1deb\2http://HTTPS///|w ${changes_file}" \
|
||||
{} \+
|
||||
;;
|
||||
|
||||
uninstall)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|URIs:\s*http://HTTPS///|URIs: https://|w ${changes_file}" \
|
||||
-e "s|^\s*\(#*\)\s*deb\(.*\)http://HTTPS///|\1deb\2https://|w ${changes_file}" \
|
||||
{} \+
|
||||
;;
|
||||
esac
|
||||
|
||||
elif test -e /etc/arch-release; then
|
||||
## Archlinux
|
||||
|
||||
if test -n "${proxy_addr}"; then
|
||||
if ! test -d /run/qubes/bin; then
|
||||
mkdir -p /run/qubes/bin
|
||||
fi
|
||||
cat >/run/qubes/bin/pacman <<EOF
|
||||
#!/bin/sh
|
||||
exec env ALL_PROXY="${proxy_url}" /usr/bin/pacman "\$@"
|
||||
EOF
|
||||
chmod +x /run/qubes/bin/pacman
|
||||
cat >/etc/profile.d/qubes-proxy.sh << EOF
|
||||
export PATH=/run/qubes/bin:\$PATH
|
||||
EOF
|
||||
else
|
||||
rm -f /run/qubes/bin/pacman /etc/profile.d/qubes-proxy.sh
|
||||
fi
|
||||
|
||||
set --
|
||||
for repo in \
|
||||
/etc/pacman.d/mirrorlist \
|
||||
/etc/pacman.d/*.conf \
|
||||
/etc/pacman.d/*.conf.disabled
|
||||
do
|
||||
test -f "${repo}" || continue
|
||||
test -r "${repo}" || continue
|
||||
test -w "${repo}" || continue
|
||||
set -- "${@}" "${repo}"
|
||||
done
|
||||
test -n "${*}" || return 0
|
||||
|
||||
case "${action}" in
|
||||
install)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|Server\s*=\s*https://|Server = http://HTTPS///|w ${changes_file}" \
|
||||
{} \+
|
||||
;;
|
||||
|
||||
uninstall)
|
||||
find "${@}" -type f -exec sed -i \
|
||||
-e "s|Server\s*=\s*http://HTTPS///|Server = https://|w ${changes_file}" \
|
||||
{} \+
|
||||
;;
|
||||
esac
|
||||
|
||||
else
|
||||
## TODO: Gentoo.
|
||||
echo "Cacher does not support your Operating System distribution." >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
set_proxy_unspecific_os(){
|
||||
if test -w /etc/PackageKit/PackageKit.conf; then
|
||||
set_proxy_marker /etc/PackageKit/PackageKit.conf "ProxyHTTP=${proxy_url}"
|
||||
fi
|
||||
}
|
||||
|
||||
usage(){
|
||||
echo "Usage: ${0##*/} [install|uninstall]"
|
||||
echo "Note: autodetection occurs if not argument is specified"
|
||||
exit 1
|
||||
}
|
||||
|
||||
changes_file="$(mktemp)"
|
||||
trap 'rm -f "${changes_file}"' HUP INT QUIT ABRT EXIT
|
||||
|
||||
if test -f /var/run/qubes-service/updates-proxy-setup ||
|
||||
test -f /var/run/qubes-service/netvm-cacher
|
||||
then
|
||||
action="install"
|
||||
else
|
||||
action="uninstall"
|
||||
fi
|
||||
|
||||
case "${1-}" in
|
||||
install|uninstall) action="${1}";;
|
||||
"") ;;
|
||||
*) usage;;
|
||||
esac
|
||||
action="${1}"
|
||||
|
||||
if test -e /etc/fedora-release; then
|
||||
## Fedora
|
||||
for repo in /etc/yum.repos.d/*.repo; do
|
||||
case "${action}" in
|
||||
install)
|
||||
rewrite_repo "baseurl\s*=\s*https://" "baseurl=http://HTTPS///"
|
||||
rewrite_repo "metalink\s*=\s*https://" "metalink=http://HTTPS///"
|
||||
;;
|
||||
uninstall)
|
||||
rewrite_repo "baseurl\s*=\s*http://HTTPS///" "baseurl=https://"
|
||||
rewrite_repo "metalink\s*=\s*http://HTTPS///" "metalink=https://"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
for repo in /etc/yum.repos.d/rpmfusion*.repo; do
|
||||
case "${action}" in
|
||||
install)
|
||||
rewrite_repo "^\s*#.*baseurl" "baseurl"
|
||||
rewrite_repo "^\s*metalink\s*=\s*" "#metalink="
|
||||
;;
|
||||
uninstall)
|
||||
rewrite_repo "^\s*baseurl" "#baseurl"
|
||||
rewrite_repo "^\s*#.*metalink\s*=" "metalink="
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
elif test -e /etc/debian_version && test ! -e /usr/share/whonix/marker; then
|
||||
## Debian but not Whonix.
|
||||
for repo in \
|
||||
/etc/apt/sources.list \
|
||||
/etc/apt/sources.list.d/*.list \
|
||||
/etc/apt/sources.list.d/*.sources
|
||||
do
|
||||
case "${action}" in
|
||||
install)
|
||||
rewrite_repo "URIs:\s*https://" "URIs: http://HTTPS///"
|
||||
rewrite_repo "^\s*\(#*\)\s*deb\(.*\)https://" "\1deb\2http://HTTPS///"
|
||||
;;
|
||||
uninstall)
|
||||
rewrite_repo "URIs:\s*http://HTTPS///" "URIs: https://"
|
||||
rewrite_repo "^\s*\(#*\)\s*deb\(.*\)http://HTTPS///" "\1deb\2https://"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
elif test -e /etc/arch-release; then
|
||||
## Archlinux
|
||||
for repo in \
|
||||
/etc/pacman.d/mirrorlist \
|
||||
/etc/pacman.d/*.conf \
|
||||
/etc/pacman.d/*.conf.disabled
|
||||
do
|
||||
case "${action}" in
|
||||
install)
|
||||
rewrite_repo "Server\s*=\s*https://" "Server = http://HTTPS///"
|
||||
;;
|
||||
uninstall)
|
||||
rewrite_repo "Server\s*=\s*http://HTTPS///" "Server = https://"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
else
|
||||
echo "Cacher does not support your Operating System distribution." >&2
|
||||
if test "$(id -u)" != "0"; then
|
||||
echo "Error: Permission denied, action requires root privileges."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
## Stateful cmd module.
|
||||
check_netvm_cacher
|
||||
set_proxy_os
|
||||
set_proxy_unspecific_os
|
||||
|
||||
## Stateful Salt cmd Module.
|
||||
echo
|
||||
if test -s "${changes_file}"; then
|
||||
echo "changed=yes comment='URIs have been modified'"
|
||||
echo "changed=yes comment='configuration was modified'"
|
||||
else
|
||||
echo "changed=no comment='URIs remained untouched'"
|
||||
echo "changed=no comment='configuration remained untouched'"
|
||||
fi
|
||||
exit
|
||||
|
||||
@ -0,0 +1,15 @@
|
||||
# SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
[Unit]
|
||||
Description=Dynamically write repository definitions to be used by apt-cacher-ng
|
||||
After=qubes-mount-dirs.service
|
||||
Before=qubes-update-check.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/qubes/apt-cacher-ng-repo
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -4,17 +4,33 @@ SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.co
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
"{{ slsdotpath }}-install-client-tool":
|
||||
file.managed:
|
||||
- name: /usr/bin/apt-cacher-ng-repo
|
||||
- source: salt://{{ slsdotpath }}/files/client/bin/apt-cacher-ng-repo
|
||||
- mode: "0755"
|
||||
|
||||
"{{ slsdotpath }}-install-client-scripts":
|
||||
file.recurse:
|
||||
- name: /usr/bin/
|
||||
- source: salt://{{ slsdotpath }}/files/client/bin/
|
||||
- file_mode: "0755"
|
||||
- group: root
|
||||
- user: root
|
||||
- makedirs: True
|
||||
|
||||
"{{ slsdotpath }}-install-client-https":
|
||||
"{{ slsdotpath }}-install-client-repository-definitions":
|
||||
cmd.run:
|
||||
- name: apt-cacher-ng-repo install
|
||||
- name: apt-cacher-ng-repo
|
||||
- stateful: True
|
||||
- runas: root
|
||||
- require:
|
||||
- file: "{{ slsdotpath }}-install-client-scripts"
|
||||
|
||||
"{{ slsdotpath }}-install-client-systemd":
|
||||
file.managed:
|
||||
- name: /usr/lib/systemd/system/qubes-apt-cacher-ng-repo.service
|
||||
- source: salt://{{ slsdotpath }}/files/client/systemd/qubes-apt-cacher-ng-repo.service
|
||||
- mode: "0644"
|
||||
- group: root
|
||||
- user: root
|
||||
- makedirs: True
|
||||
|
||||
"{{ slsdotpath }}-install-client-systemd-start-qubes-apt-cacher-ng-repo.service":
|
||||
service.enabled:
|
||||
- name: qubes-apt-cacher-ng-repo.service
|
||||
|
||||
@ -4,8 +4,12 @@ SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.co
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
"{{ slsdotpath }}-uninstall-client-https":
|
||||
"{{ slsdotpath }}-uninstall-client-repository-modifications":
|
||||
cmd.run:
|
||||
- name: apt-cacher-ng-repo uninstall
|
||||
- stateful: True
|
||||
- runas: root
|
||||
|
||||
"{{ slsdotpath }}-uninstall-client-systemd-service":
|
||||
file.absent:
|
||||
- name: /usr/lib/systemd/system/qubes-apt-cacher-ng-repo.service
|
||||
|
||||
Loading…
Reference in New Issue
Block a user