fix: use systemd-resolved DNS on boot

In case user configured Wireguard but there are no clients connected,
network hooks are never run and no domains can be resolved from the
sys-wireguard qube itself, therefore using Qrexec services to resolve
DNS in sys-wireguard hooks doesn't work and depended on connected
clients.

If Wireguard systemd service wasn't run, the nameserver will be empty
and that is not a problem.

In case user hasn't configured the Wireguard configuration correctly,
drop all connections.

salt/sys-wireguard/files/admin/bin/qvm-wireguard

@@ -31,6 +31,16 @@ system_conf="/etc/wireguard/wireguard.conf"
 
 qvm-run "$qube" -- "test -f ${user_conf}" || {
   echo "File '${user_conf}' was not found" >&2
+  if qvm-check -q --running -- "$qube" >/dev/null 2>&1; then
+    qvm-pause --verbose -- "$qube"
+  fi
+  echo "Firewalling $qube to drop all connections"
+  qvm-firewall --verbose -- "$qube" reset
+  qvm-firewall --verbose -- "$qube" del --rule-no 0
+  qvm-firewall --verbose -- "$qube" add drop
+  if qvm-check -q --paused -- "$qube" >/dev/null 2>&1; then
+    qvm-unpause --verbose -- "$qube"
+  fi
   exit 1
 }
 

salt/sys-wireguard/files/server/qubes-firewall.d/50-sys-wireguard-var

@@ -53,3 +53,5 @@ if test -n "${dns}"; then
     set_nft_dnat "${dns_secondary_ipv}" tcp "${dns_secondary}"
   fi
 fi
+
+ln -sf /run/resolvconf/resolv.conf /etc/resolv.conf