Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2025-07-25 23:45:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

refactor: prefer systemd sockets over socat

Browse source 
- Document preferred method for socket use depending on use case;
- Fix Github web-flow key;
- Standardize naming of services;
- Use sys-ssh in ansible formula;
- Start services conditionally with Qubes Service and evaluated by
  systemd ConditionPathExists= instead of installing on a per qube basis
  with rc.local scripts;
- Change Qusal services to "qusal-" prefix instead of "qubes-" prefix.

Fixes: https://github.com/ben-grande/qusal/issues/80
Fixes: https://github.com/ben-grande/qusal/issues/79
This commit is contained in:
Ben Grande 2024-06-25 22:16:26 +02:00
parent 3880a35cfa
commit 9c280689d8
No known key found for this signature in database
GPG key ID: 00C64E14F51F9E56
106 changed files with 606 additions and 567 deletions
Download patch file Download diff file Expand all files Collapse all files

54
docs/DESIGN.md
View file

@ -14,8 +14,10 @@ Qusal design document.
* [Qube naming](#qube-naming) * [Qube naming](#qube-naming)
* [Qube label](#qube-label) * [Qube label](#qube-label)
* [Qube menu](#qube-menu) * [Qube menu](#qube-menu)
* [Qube features](#qube-features)
* [Qube connections](#qube-connections) * [Qube connections](#qube-connections)
* [Qrexec call and policy](#qrexec-call-and-policy) * [Qrexec call and policy](#qrexec-call-and-policy)
* [Qrexec socket services](#qrexec-socket-services)
## Goal ## Goal
@ -167,6 +169,21 @@ building software is risky, the user trying to open a file manager on a qube
that doesn't have one is less risky but for the user the behavior is that doesn't have one is less risky but for the user the behavior is
unexpected. unexpected.
### Qube features
Control daemons using Qubes Services. It is much better to control services
this way as we can declare during the creation of qubes instead of having to
add a state to run a script during boot to unmask and start a specific
service. The method below is most of the times combined with `systemd.unit`
`ConditionPathExists=` to enable the service conditionally.
- Server's service name must match the syntax: `service-server` (example:
`rsync-server`, `syncthing-server`);
- Client's service name must match the syntax: `service-client` (example:
`ssh-client`;
- Local program's service name must match the syntax: `service` (example:
`docker`, `podman`.
### Qube connections ### Qube connections
There are several ways a qube can connect to another, either directly with There are several ways a qube can connect to another, either directly with
@ -202,3 +219,40 @@ Xen or with Qrexec. If something is not required, we remove it.
`qrexec-client-vm`. `qrexec-client-vm`.
3. Target qube for client script must default to `@default`, but other targets 3. Target qube for client script must default to `@default`, but other targets
must be allowed via parameters. must be allowed via parameters.
### Qrexec socket services
Native Qrexec TCP sockets `/dev/tcp` using `qubes.ConnectTCP` are very handy
to connect to a port of a qube. The downside of using `qubes.ConnectTCP`
directly is the user doesn't want or need to know in which port the client
wants to connect in the server. We will refer to Unix Domains Sockets as
`UDS`.
Using `qusal.Service`, such as `qusal.Rsync`, `qusal.Syncthing`, `qusal.Ssh`
has the following advantages:
- Usability: User recognizes the call per service name;
- Extensibility: Allows extending functionality for arguments added in the
future, no need to migrate user policy from `qubes.ConnectTCP`;
is not necessary;
Rules for server RPC service:
- Symlink `qubes.ConnectTCP` to `qusal.Service` if connecting to a local port;
- Use `qubes.ConnectTCP` directly when the user won't manage the policy for
the wanted call, such as `sys-syncthing-browser`, where it happens that only
this qube will access the admin interface of `sys-syncthing`;
- Use `socat` to connect to remote hosts or UDS with path defined by the
service argument.
Rules for client RPC call:
- Use `systemd.socket` units, it does not require `socat`, it is not
restricted to the use of `qubes.ConnectTCP` called by `qvm-connect-tcp`, the
service can be properly logged and status verified by a service manager
instead of forking socat to the background with a `rc.local` script and
finally, can be controlled by Qubes Services to enable or disable the unit
with `ConditionPathExists=` instead of doing if-else statements in
`rc.local`;
- Use of `socat` and `qvm-connect-tcp` is permitted for UDS and for
instructional use as it is very short.

10
qubesbuilder/qusal.yml
View file

@ -69,12 +69,10 @@ stages:
gpg-client: gpg gpg-client: gpg
sign-key: sign-key:
rpm: rpm: DF3834875B65758713D92E91A475969DE4E371E3
- DF3834875B65758713D92E91A475969DE4E371E3
#repository-publish: repository-publish:
# components: current-testing components: current-testing
# repository-upload-remote-host: # repository-upload-remote-host:
# rpm: user@yum.qubes-os.org:/some/path # rpm: user@yum.example.org:/some/path
# deb: user@deb.qubes-os.org:/another/path

7
rpm_spec/qusal-ansible.spec
View file

@ -30,7 +30,9 @@ BuildArch: noarch
Requires: qubes-mgmt-salt Requires: qubes-mgmt-salt
Requires: qubes-mgmt-salt-dom0 Requires: qubes-mgmt-salt-dom0
Requires: qusal-dotfiles
Requires: qusal-ssh Requires: qusal-ssh
Requires: qusal-sys-ssh
Requires: qusal-utils Requires: qusal-utils
@ -73,8 +75,6 @@ if test "$1" = "1"; then
## Install ## Install
qubesctl state.apply ansible.create qubesctl state.apply ansible.create
qubesctl --skip-dom0 --targets=tpl-ansible state.apply ansible.install qubesctl --skip-dom0 --targets=tpl-ansible state.apply ansible.install
qubesctl --skip-dom0 --targets=ansible state.apply ansible.configure,zsh.touch-zshrc
qubesctl --skip-dom0 --targets=ansible-minion state.apply ansible.configure-minion,zsh.touch-zshrc
elif test "$1" = "2"; then elif test "$1" = "2"; then
## Upgrade ## Upgrade
true true
@ -107,6 +107,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 3880a35
- fix: ansible references legacy zsh state
* Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - ab1438f * Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - ab1438f
- fix: change Launchpad repository to HTTPS domain - fix: change Launchpad repository to HTTPS domain

1
rpm_spec/qusal-docker.spec
View file

@ -72,7 +72,6 @@ cp -rv salt/%{project} %{buildroot}/srv/salt/qusal/%{name}
if test "$1" = "1"; then if test "$1" = "1"; then
## Install ## Install
qubesctl --skip-dom0 --targets=tpl-qubes-builder state.apply docker.install qubesctl --skip-dom0 --targets=tpl-qubes-builder state.apply docker.install
qubesctl --skip-dom0 --targets=qubes-builder state.apply docker.configure
elif test "$1" = "2"; then elif test "$1" = "2"; then
## Upgrade ## Upgrade
true true

3
rpm_spec/qusal-sys-net.spec
View file

@ -114,6 +114,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 4facf45
- feat: use native TCP socket with Qrexec
* Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea * Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea
- fix: generate RPM Specs for Qubes Builder V2 - fix: generate RPM Specs for Qubes Builder V2

3
rpm_spec/qusal-sys-print.spec
View file

@ -111,6 +111,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 4facf45
- feat: use native TCP socket with Qrexec
* Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea * Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea
- fix: generate RPM Specs for Qubes Builder V2 - fix: generate RPM Specs for Qubes Builder V2

3
rpm_spec/qusal-sys-rsync.spec
View file

@ -114,6 +114,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 4facf45
- feat: use native TCP socket with Qrexec
* Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea * Fri Jun 21 2024 Ben Grande <ben.grande.b@gmail.com> - c84dfea
- fix: generate RPM Specs for Qubes Builder V2 - fix: generate RPM Specs for Qubes Builder V2

5
rpm_spec/qusal-sys-ssh.spec
View file

@ -30,7 +30,6 @@ BuildArch: noarch
Requires: qubes-mgmt-salt Requires: qubes-mgmt-salt
Requires: qubes-mgmt-salt-dom0 Requires: qubes-mgmt-salt-dom0
Requires: qusal-dev
Requires: qusal-sys-ssh-agent Requires: qusal-sys-ssh-agent
Requires: qusal-utils Requires: qusal-utils
@ -83,7 +82,6 @@ if test "$1" = "1"; then
## Install ## Install
qubesctl state.apply sys-ssh.create qubesctl state.apply sys-ssh.create
qubesctl --skip-dom0 --targets=tpl-sys-ssh state.apply sys-ssh.install qubesctl --skip-dom0 --targets=tpl-sys-ssh state.apply sys-ssh.install
qubesctl --skip-dom0 --targets=sys-ssh state.apply sys-ssh.configure
elif test "$1" = "2"; then elif test "$1" = "2"; then
## Upgrade ## Upgrade
true true
@ -116,6 +114,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 4facf45
- feat: use native TCP socket with Qrexec
* Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - 22e2a2e * Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - 22e2a2e
- chore: add copyright to systemd services - chore: add copyright to systemd services

4
rpm_spec/qusal-sys-syncthing.spec
View file

@ -96,7 +96,6 @@ if test "$1" = "0"; then
## Uninstall ## Uninstall
qvm-port-forward -a del -q sys-syncthing -n tcp -p 22000 qvm-port-forward -a del -q sys-syncthing -n tcp -p 22000
qvm-port-forward -a del -q sys-syncthing -n udp -p 22000 qvm-port-forward -a del -q sys-syncthing -n udp -p 22000
qubesctl --skip-dom0 --targets=sys-syncthing state.apply sys-syncthing.cancel
qubesctl state.apply sys-syncthing.clean qubesctl state.apply sys-syncthing.clean
elif test "$1" = "1"; then elif test "$1" = "1"; then
## Upgrade ## Upgrade
@ -121,6 +120,9 @@ fi
%dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies. %dnl TODO: missing '%ghost', files generated during %post, such as Qrexec policies.
%changelog %changelog
* Tue Jun 25 2024 Ben Grande <ben.grande.b@gmail.com> - 4facf45
- feat: use native TCP socket with Qrexec
* Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - 22e2a2e * Mon Jun 24 2024 Ben Grande <ben.grande.b@gmail.com> - 22e2a2e
- chore: add copyright to systemd services - chore: add copyright to systemd services

19
salt/ansible/README.md
View file

@ -26,28 +26,13 @@ sudo qubesctl top.disable ansible
```sh ```sh
sudo qubesctl state.apply ansible.create sudo qubesctl state.apply ansible.create
sudo qubesctl --skip-dom0 --targets=tpl-ansible state.apply ansible.install sudo qubesctl --skip-dom0 --targets=tpl-ansible state.apply ansible.install
sudo qubesctl --skip-dom0 --targets=ansible state.apply ansible.configure
sudo qubesctl --skip-dom0 --targets=ansible-minion state.apply ansible.configure-minion
``` ```
<!-- pkg:end:post-install --> <!-- pkg:end:post-install -->
## Usage ## Usage
Configure the control node `ansible`: From the control node `ansible`, test connection to the managed node
```sh
ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ansible
qvm-copy ~/.ssh/id_ansible.pub
```
Select `ansible-minion` as the target qube for the copy operation.
Configure the minion `ansible-minion`:
```sh
mkdir -m 0700 ~/.ssh
cat ~/QubesIncoming/ansible/id_ansible.pub >> ~/.ssh/authorized_keys
```
From the control node `ansible`, test connection to the minion
`ansible-minion`: `ansible-minion`:
```sh ```sh
ssh minion ssh -p 1840 user@127.0.0.1
``` ```

30
salt/ansible/configure-minion.sls
View file

@ -1,30 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{% if grains['nodename'] != 'dom0' -%}
include:
- utils.tools.zsh.touch-zshrc
"{{ slsdotpath }}-minion-start-sshd":
file.managed:
- name: /rw/config/rc.local.d/50-ansible.rc
- source: salt://{{ slsdotpath }}/files/client/rc.local.d/50-ansible.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-minion-ssh-authorized_keys":
file.touch:
- name: /home/user/.ssh/authorized_keys
- dir_mode: '0700'
- file_mode: '0600'
- user: user
- group: user
- makedirs: True
{% endif -%}

9
salt/ansible/configure-minion.top
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
base:
'ansible':
- ansible.configure-minion

31
salt/ansible/configure.sls
View file

@ -1,31 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{% if grains['nodename'] != 'dom0' -%}
include:
- utils.tools.zsh.touch-zshrc
"{{ slsdotpath }}-autostart-ssh-over-qrexec":
file.managed:
- name: /rw/config/rc.local.d/50-ansible.rc
- source: salt://{{ slsdotpath }}/files/server/rc.local.d/50-ansible.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-ssh-config":
file.managed:
- name: /home/user/.ssh/config
- source: salt://{{ slsdotpath }}/files/server/ssh-config
- file_mode: '0600'
- dir_mode: '0700'
- user: root
- group: root
- makedirs: True
{% endif -%}

9
salt/ansible/configure.top
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
base:
'ansible':
- ansible.configure

5
salt/ansible/create.sls
View file

@ -46,6 +46,8 @@ prefs:
features: features:
- set: - set:
- menu-items: "qubes-run-terminal.desktop qubes-start.desktop" - menu-items: "qubes-run-terminal.desktop qubes-start.desktop"
- enable:
- service.ssh-client
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed
@ -73,6 +75,9 @@ prefs:
features: features:
- set: - set:
- menu-items: "qubes-run-terminal.desktop qubes-start.desktop" - menu-items: "qubes-run-terminal.desktop qubes-start.desktop"
- enable:
- servicevm
- service.ssh-server
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

2
salt/ansible/files/admin/policy/default.policy
View file

@ -2,5 +2,5 @@
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
qubes.ConnectTCP +22 {{ sls_path }} @default allow target={{ sls_path }}-minion qusal.Ssh * {{ sls_path }} @default allow target={{ sls_path }}-minion
## vim:ft=qrexecpolicy ## vim:ft=qrexecpolicy

7
salt/ansible/files/client/99-sshd-ansible.conf
View file

@ -1,7 +0,0 @@
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
PubkeyAuthentication yes
# vim: ft=sshdconfig

8
salt/ansible/files/client/rc.local.d/50-ansible.rc
View file

@ -1,8 +0,0 @@
#!/bin/sh
# vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
systemctl unmask ssh
systemctl --no-block start ssh

12
salt/ansible/files/server/99-ssh-ansible.conf
View file

@ -1,12 +0,0 @@
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
Host minion ansible-minion
Hostname 127.0.0.1
Port 22000
User user
IdentityFile ~/.ssh/id_ansible.pub
PreferredAuthentications publickey
# vim: ft=sshconfig

7
salt/ansible/files/server/rc.local.d/50-ansible.rc
View file

@ -1,7 +0,0 @@
#!/bin/sh
# vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
qvm-connect-tcp 22000:@default:22

4
salt/ansible/init.top
View file

@ -10,7 +10,3 @@ base:
- ansible.create - ansible.create
'tpl-ansible': 'tpl-ansible':
- ansible.install - ansible.install
'ansible':
- ansible.configure
'ansible-minion':
- ansible.configure-minion

22
salt/ansible/install.sls
View file

@ -9,7 +9,10 @@ SPDX-License-Identifier: AGPL-3.0-or-later
include: include:
- .install-repo - .install-repo
- utils.tools.common.update - utils.tools.common.update
- utils.tools.zsh - dotfiles.copy-sh
- dotfiles.copy-x11
- sys-ssh.install
- sys-ssh.install-client
- ssh.install - ssh.install
"{{ slsdotpath }}-installed": "{{ slsdotpath }}-installed":
@ -26,7 +29,6 @@ include:
- ansible-lint - ansible-lint
- python3-argcomplete - python3-argcomplete
- python3-jmespath - python3-jmespath
- openssh-server
- qubes-core-agent-passwordless-root - qubes-core-agent-passwordless-root
- bash-completion - bash-completion
- man-db - man-db
@ -48,20 +50,4 @@ include:
- skip_suggestions: True - skip_suggestions: True
- pkgs: {{ pkg.pkg|sequence|yaml }} - pkgs: {{ pkg.pkg|sequence|yaml }}
"{{ slsdotpath }}-ssh-config":
file.managed:
- name: /etc/ssh/ssh_config.d/99-ssh-ansible.conf
- source: salt://{{ slsdotpath }}/files/server/99-ssh-ansible.conf
- mode: '0644'
- user: root
- group: root
"{{ slsdotpath }}-sshd-config":
file.managed:
- name: /etc/ssh/sshd_config.d/99-sshd-ansible.conf
- source: salt://{{ slsdotpath }}/files/client/99-sshd-ansible.conf
- mode: '0644'
- user: root
- group: root
{% endif -%} {% endif -%}

11
salt/docker/README.md
View file

@ -14,10 +14,12 @@ Setup docker in Qubes OS with the Docker repository.
## Installation ## Installation
TODO: remove installation steps or provide a docker qube.
- Top - Top
```sh ```sh
sudo qubesctl top.enable docker sudo qubesctl top.enable docker
sudo qubesctl --targets=tpl-qubes-builder,qubes-builder state.apply sudo qubesctl --targets=tpl-qubes-builder state.apply
sudo qubesctl top.disable docker sudo qubesctl top.disable docker
``` ```
@ -25,10 +27,15 @@ sudo qubesctl top.disable docker
<!-- pkg:begin:post-install --> <!-- pkg:begin:post-install -->
```sh ```sh
sudo qubesctl --skip-dom0 --targets=tpl-qubes-builder state.apply docker.install sudo qubesctl --skip-dom0 --targets=tpl-qubes-builder state.apply docker.install
sudo qubesctl --skip-dom0 --targets=qubes-builder state.apply docker.configure
``` ```
<!-- pkg:end:post-install --> <!-- pkg:end:post-install -->
Enable the Docker and/or Podman service for qubes that will use it:
```sh
qvm-features QUBE service.docker 1
qvm-features QUBE service.podman 1
```
## Usage ## Usage
The only qubes specific configuration to docker is changing its [root The only qubes specific configuration to docker is changing its [root

18
salt/docker/configure.sls
View file

@ -1,18 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{% if grains['nodename'] != 'dom0' -%}
"{{ slsdotpath }}-rc.local":
file.managed:
- name: /rw/config/rc.local.d/50-docker.rc
- source: salt://{{ slsdotpath }}/files/client/rc.local.d/50-docker.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True
{% endif -%}

9
salt/docker/configure.top
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
base:
'qubes-builder':
- docker.configure

9
salt/docker/files/client/rc.local.d/50-docker.rc
View file

@ -1,9 +0,0 @@
#!/bin/sh
# vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
usermod -aG docker user
systemctl unmask docker
systemctl --no-block restart docker

8
salt/docker/files/client/systemd/docker.service.d/50_qusal.conf Normal file
View file

@ -0,0 +1,8 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
# vim: ft=systemd
[Unit]
ConditionPathExists=/var/run/qubes-service/docker
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service

8
salt/docker/files/client/systemd/podman.service.d/50_qusal.conf Normal file
View file

@ -0,0 +1,8 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
# vim: ft=systemd
[Unit]
ConditionPathExists=/var/run/qubes-service/podman
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service

2
salt/docker/init.top
View file

@ -7,5 +7,3 @@ SPDX-License-Identifier: AGPL-3.0-or-later
base: base:
'tpl-qubes-builder': 'tpl-qubes-builder':
- docker.install - docker.install
'qubes-builder':
- docker.configure

18
salt/docker/install.sls
View file

@ -52,4 +52,22 @@ include:
- addusers: - addusers:
- user - user
"{{ slsdotpath }}-systemd":
file.recurse:
- name: /usr/lib/systemd/system/
- source: salt://{{ slsdotpath }}/files/client/systemd/
- dir_mode: '0755'
- file_mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-unmask-docker":
service.unmasked:
- name: docker
"{{ slsdotpath }}-enable-docker":
service.enabled:
- name: docker
{% endif -%} {% endif -%}

2
salt/electrum/README.md
View file

@ -88,7 +88,7 @@ socat TCP4-LISTEN:50002,reuseaddr,fork,bind=127.0.0.1 TCP:192.168.2.10:50002 &
In the qube `electrum`, add the `qvm-connect-tcp` command to the file In the qube `electrum`, add the `qvm-connect-tcp` command to the file
`/rw/config/rc.local`: `/rw/config/rc.local`:
```sh ```sh
qvm-connnect-tcp ::50002 qvm-connect-tcp ::50002
``` ```
In the qube `electrum`, run as the user `user` the electrum configuration In the qube `electrum`, run as the user `user` the electrum configuration

1
salt/mirage-builder/configure.sls
View file

@ -13,7 +13,6 @@ include:
- dotfiles.copy-sh - dotfiles.copy-sh
- dotfiles.copy-ssh - dotfiles.copy-ssh
- dotfiles.copy-git - dotfiles.copy-git
- docker.configure
"{{ slsdotpath }}-opam-completion-and-hooks": "{{ slsdotpath }}-opam-completion-and-hooks":
file.managed: file.managed:

3
salt/mirage-builder/create.sls
View file

@ -37,6 +37,9 @@ prefs:
- autostart: False - autostart: False
- include_in_backups: True - include_in_backups: True
features: features:
- enable:
- service.docker
- service.podman
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

56
salt/mirage-builder/files/client/keys/5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23.asc
View file

@ -6,28 +6,36 @@ SQzvYjsE4I34To4UdE9KA97wrQjGoz2Bx72WDLyWwctD3DKQtYeHXswXXtXwKfjQ
7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa 7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa
buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v
yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs
b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBiBBMBCAAW b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBoBBMBCAAc
BQJZlGhBCRBK7hj4Ov3rIwIbAwIZAQAAmQEIACATWFmi2oxlBh3wAsySNCNV4IPf BQJZlGhBCRBK7hj4Ov3rIwIbAwUJDBJ3/wIZAQAA0O4IAJd0k8M+urETyMvTqNTj
DDMeh6j80WT7cgoX7V7xqJOxrfrqPEthQ3hgHIm7b5MPQlUr2q+UPL22t/I+ESF6 /U6nbqyOdKE4V93uUj5G7sNTfno7wod/Qjj6Zv5KodvA93HmEdQqsmVq5YJ5KGiw
9b0QWLFSMJbMSk+BXkvSjH9q8jAO0986/pShPV5DU2sMxnx4LfLfHNhTzjXKokws cmGCpd/GqJRPaYSY0hSUSBqYHiHLusCJkPBpQTBhcEMtfVCB2J6fVeoX2DV0K1xf
+8ptJ8uhMNIDXfXuzkZHIxoXk3rNcjDN5c5X+sK8UBRH092BIJWCOfaQt7v7wig5 CGblrSVB0viAxUMnmL5C55RuvbYZsTu8szXhkvIR96CtWbJ8QGaEf1/KSpWz8ept
4Ra28pM9GbHKXVNxmdLpCFyzvyMuCmINYYADsC848QQFFwnd4EQnupo6QvhEVx1O Y/omf3UPfvdOjnsxc8jVEqPNaR9xC6Q6t53rBa/XgMY6IYyesnyYnc5O6JuexUFa
j7wDwvuH5dCrLuLwtwXaQh0onG4583p0LGms2Mf5F+Ick6o/4peOlBoZz48= VjykRFtAiYfDaMARpXOmgMm0lhoBRKb/uMUaN3CSYTmE4pZweJcUi7eWgmoQljX2
=HXDP ut6ZAg0EZabFdgEQALI37i+IVAzpBCgqvQDZbSsZ0yhtMnA5myjZA+l7BvIGy4ve
-----END PGP PUBLIC KEY BLOCK----------BEGIN PGP PUBLIC KEY BLOCK----- s1bk6YetbBcCE8o2pQjI7N2rwyhLGhNO6ouSyhqGLEQv9fafKE4HFH0aRjP+gj1H
edhwtFoVChImhV863rWimQtTNtYB6GluBPwQqWfwmwQ2rT7ScOVZCLSHZD2gaaqW
xsBNBFmUaEEBCACzXTDt6ZnyaVtueZASBzgnAmK13q9Urgch+sKYeIhdymjuMQta BXOyTCZVnwt7K/gyDuE3qzDJnuahl+SSkPn5TtnZdW6sLORJJ+DjNvaUxEsmizZ4
x15OklctmrZtqre5kwPUosG3/B2/ikuPYElcHgGPL4uL5Em6S5C/oozfkYzhwRrT IBzvj0QKxfS3s4F+0X5iqCMheLFeybZGtSq9Tjs6Q61l4CG8Bh6dsLemv0WFrk3G
SQzvYjsE4I34To4UdE9KA97wrQjGoz2Bx72WDLyWwctD3DKQtYeHXswXXtXwKfjQ gFQRr7XUwr1bo5xGHC/FUJSsxRHoVNJnIL/9WldNO2tGU6qlTnAYxs/fOmf2B6o5
7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa cKXysXv7WAA8b+j5AVBMGxUSu7CLglaiCJC5DI7AAiUV7/t29rFZkam//Jbb4veC
buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v 4vvFocoVUaxrKGWK1BDldr4/WJKApJcPJF4Jtai1+oB6ak/JIjbkseHdJxcjo2B0
yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs dKtIFoWiPAB+DFs9MRDpp0iwocJCh+ucus1rdQ54YMaI44rRphXeOIQMYCi5q2Q1
b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBiBBMBCAAW /arzkSiyPV/2VoKoAfdgskPt1xKd7WIKErmpFMHIy8jJ5IPQ1s2dUwU4alfJLJa0
BQJZlGhBCRBK7hj4Ov3rIwIbAwIZAQAAmQEIACATWFmi2oxlBh3wAsySNCNV4IPf pvaV2m7wBYFAmwmz0WZgFxYAYEDamn4jFoKfqsEgcixRUVE3w5VkqwSwGRbLABEB
DDMeh6j80WT7cgoX7V7xqJOxrfrqPEthQ3hgHIm7b5MPQlUr2q+UPL22t/I+ESF6 AAG0G0dpdEh1YiA8bm9yZXBseUBnaXRodWIuY29tPokCTgQTAQoAOBYhBJaEeaGv
9b0QWLFSMJbMSk+BXkvSjH9q8jAO0986/pShPV5DU2sMxnx4LfLfHNhTzjXKokws +SfjfRpWa7VpDu67lSGUBQJlpsV2AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+8ptJ8uhMNIDXfXuzkZHIxoXk3rNcjDN5c5X+sK8UBRH092BIJWCOfaQt7v7wig5 AAoJELVpDu67lSGUgy4QAKW9XAL416iKrQB2LElmxqAoenHVCswlau0xGLh5dVNN
4Ra28pM9GbHKXVNxmdLpCFyzvyMuCmINYYADsC848QQFFwnd4EQnupo6QvhEVx1O p5f4/W6eEL8CZI7hfF3e5Gh6Me99aHgXSCK1QnxcqCJ6Oea4ZyrsNu3k6g7Um5ca
j7wDwvuH5dCrLuLwtwXaQh0onG4583p0LGms2Mf5F+Ick6o/4peOlBoZz48= VbYFD4yIahhXDYHSw6FYM2sgFY479YvgvKRwacC2tFfChLRbHgwLJ3O1dBjmVycJ
=HXDP Zpbyu+7taZ26g6KQfgcj3uuo3nz3p1ziIEpLHwtl/7joNEIIP/lJ8AKmUHPiGznN
6fxMvzN37PGMWtdvOi1rSNIMQYr1YY7jPnlLbFJwLrO/q/cGPU5HwGzlqh0a2ZqY
dnuwT3DREmgJ83H71xH+sTzZKs5oGlVTu6st7iWDvNpo2GoN01XzKa5caYglqsOC
uZ6IHlsdL50sXMtSROCi3hEWU9r1sWIm4k3pNz20y7lElD2X/MqbEMcgpawCV7lH
rm7MSrTgu6BNAF0SisbF9AKwXaBr2dwpMMyIBOFZO9mk4/c0n9q2FlGY4GkbgH2J
HqulFTwX/4yiQbh8gzCe+06FZAWITN1OQntTkkCQ+1MCZPf+bOfC08RTsOsVZIYB
2qAgw6XE0IF4a+PAtHSoYftwH2ocMY2gMuSNpQWm7m0+/j+K+RBoeUcnGNPQgszq
N60IDMqkqHjyubrm2aslfopWmPSvaQoyxwV/uztdo+UI0IV2z9gD7Sm49vMkpYp8
=uMz0
-----END PGP PUBLIC KEY BLOCK----- -----END PGP PUBLIC KEY BLOCK-----

1
salt/qubes-builder/configure.sls
View file

@ -13,7 +13,6 @@ include:
- dotfiles.copy-sh - dotfiles.copy-sh
- dotfiles.copy-ssh - dotfiles.copy-ssh
- dotfiles.copy-x11 - dotfiles.copy-x11
- docker.configure
"{{ slsdotpath }}-makedir-src": "{{ slsdotpath }}-makedir-src":
file.directory: file.directory:

6
salt/qubes-builder/create.sls
View file

@ -61,11 +61,13 @@ prefs:
- label: gray - label: gray
- audiovm: "" - audiovm: ""
- memory: 400 - memory: 400
- maxmem: 800 - maxmem: 1000
- vcpus: 1 - vcpus: 1
- default_dispvm: dvm-{{ slsdotpath }} - default_dispvm: dvm-{{ slsdotpath }}
features: features:
- enable: - enable:
- service.docker
- service.podman
- service.split-gpg2-client - service.split-gpg2-client
- disable: - disable:
- service.cups - service.cups
@ -113,7 +115,7 @@ features:
"{{ slsdotpath }}-shutdown-template": "{{ slsdotpath }}-shutdown-template":
qvm.shutdown: qvm.shutdown:
- require: - require:
- cmd: "{{ slsdotpath }}-install-salt-deps": - cmd: "{{ slsdotpath }}-install-salt-deps"
- name: tpl-{{ slsdotpath }} - name: tpl-{{ slsdotpath }}
- flags: - flags:
- force - force

11
salt/qubes-builder/install-qubes-executor.sls
View file

@ -18,25 +18,26 @@ include:
- pkgs: - pkgs:
- qubes-core-agent-networking - qubes-core-agent-networking
- qubes-core-agent-passwordless-root - qubes-core-agent-passwordless-root
- dnf-plugins-core
- createrepo_c - createrepo_c
- debootstrap - debootstrap
- devscripts - devscripts
- dnf-plugins-core
- dpkg-dev - dpkg-dev
- git - git
- mock - mock
- pbuilder - pbuilder
- which
- perl-Digest-MD5 - perl-Digest-MD5
- perl-Digest-SHA - perl-Digest-SHA
- pykickstart
- python3-debian
- python3-pyyaml - python3-pyyaml
- python3-sh - python3-sh
- reprepro
- rpm-build - rpm-build
- rpmdevtools - rpmdevtools
- wget2
- python3-debian
- reprepro
- systemd-udev - systemd-udev
- wget2
- which
"{{ slsdotpath }}-qubes-executor-add-user-to-mock-group": "{{ slsdotpath }}-qubes-executor-add-user-to-mock-group":
group.present: group.present:

8
salt/qubes-builder/install.sls
View file

@ -30,26 +30,24 @@ include:
## Minimal template dependencies ## Minimal template dependencies
- qubes-core-agent-networking - qubes-core-agent-networking
- qubes-core-agent-passwordless-root - qubes-core-agent-passwordless-root
## Undocumented Infraestructure Mirrors dependencies
- python3-lxml
## Undocumented Builder dependencies
- python3-click
## Dependencies: https://github.com/QubesOS/qubes-builderv2#dependencies ## Dependencies: https://github.com/QubesOS/qubes-builderv2#dependencies
- asciidoc - asciidoc
- createrepo_c - createrepo_c
- devscripts - devscripts
- m4 - m4
- mktorrent
- mock - mock
- openssl - openssl
- pacman - pacman
- podman - podman
- python3-click
- python3-docker - python3-docker
- python3-jinja2-cli - python3-jinja2-cli
- python3-lxml
- python3-packaging - python3-packaging
- python3-pathspec - python3-pathspec
- python3-podman - python3-podman
- python3-pyyaml - python3-pyyaml
- rb_libtorrent-examples
- reprepro - reprepro
- rpm - rpm
- rpm-sign - rpm-sign

8
salt/sys-bitcoin/README.md
View file

@ -81,7 +81,7 @@ sudo qubesctl --skip-dom0 --targets=sys-bitcoin state.apply sys-bitcoin.configur
Add the tag `bitcoin-client` to the client and install in the client template: Add the tag `bitcoin-client` to the client and install in the client template:
```sh ```sh
sudo qubesctl --skip-dom0 --targets=tpl-QUBE state.apply sys-bitcoin.install-client sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-bitcoin.install-client
``` ```
@ -212,11 +212,11 @@ In the Electrum Server qubes or any Bitcoin Client, `sys-electrumx`,
`/rw/config/rc.local`: `/rw/config/rc.local`:
```sh ```sh
## RPC ## RPC
qvm-connnect-tcp ::8332 qvm-connect-tcp ::8332
## P2P (ElectRS) ## P2P (ElectRS)
qvm-connnect-tcp ::8333 qvm-connect-tcp ::8333
## ZMQPubHashBlock (Fulcrum) ## ZMQPubHashBlock (Fulcrum)
qvm-connnect-tcp ::8433 qvm-connect-tcp ::8433
``` ```
Still in the Electrum Server qube, you will have to add the RPC authentication Still in the Electrum Server qube, you will have to add the RPC authentication

2
salt/sys-cacher/README.md
View file

@ -89,7 +89,7 @@ The report page is available from `sys-cacher` and `sys-cacher-browser` at
security wise, every client has administrative access to the cacher qube. You security wise, every client has administrative access to the cacher qube. You
should add the following to the end of `sys-cacher` rc.local: should add the following to the end of `sys-cacher` rc.local:
```sh ```sh
echo "AdminAuth: username:password" | tee /etc/qubes-apt-cacher-ng/zzz_security.conf echo "AdminAuth: username:password" | tee /etc/qusal-apt-cacher-ng/zzz_security.conf
``` ```
Where username and password are HTTP Auth strings. Where username and password are HTTP Auth strings.

10
salt/sys-cacher/configure-browser.sls
View file

@ -18,6 +18,16 @@ include:
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-browser-systemd-services":
file.recurse:
- name: /rw/config/systemd/
- source: salt://{{ slsdotpath }}/files/browser/systemd/
- dir_mode: '0755'
- file_mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-browser-desktop-application": "{{ slsdotpath }}-browser-desktop-application":
file.managed: file.managed:
- name: /home/user/.local/share/applications/cacher-browser.desktop - name: /home/user/.local/share/applications/cacher-browser.desktop

4
salt/sys-cacher/create.sls
View file

@ -57,7 +57,7 @@ features:
- enable: - enable:
- servicevm - servicevm
- service.crond - service.crond
- service.apt-cacher-ng - service.acng-server
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed
@ -87,6 +87,8 @@ prefs:
- autostart: False - autostart: False
- include_in_backups: False - include_in_backups: False
features: features:
- enable:
- service.acng-browser
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

6
salt/sys-cacher/files/browser/rc.local.d/50-sys-cacher.rc
View file

@ -1,7 +1,9 @@
#!/bin/sh #!/bin/sh
# vim: ft=sh # vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
qvm-connect-tcp 8082:@default:8082 cp -r /rw/config/systemd/qusal-acng-browser-forwarder* /usr/lib/systemd/system/
systemctl daemon-reload
systemctl --no-block restart qusal-acng-browser-forwarder.socket

17
salt/sys-cacher/files/browser/systemd/qusal-acng-browser-forwarder.socket Normal file
View file

@ -0,0 +1,17 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward ACNG Admin Web Panel connection over Qrexec
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/acng-browser
[Socket]
ListenStream=127.0.0.1:8082
BindToDevice=lo
Accept=true
[Install]
WantedBy=multi-user.target

11
salt/sys-cacher/files/browser/systemd/qusal-acng-browser-forwarder@.service Normal file
View file

@ -0,0 +1,11 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward ACNG Admin Web Panel connection over Qrexec
[Service]
ExecStart=/usr/bin/qrexec-client-vm @default qubes.ConnectTCP+8082
StandardInput=socket
StandardOutput=inherit

0
salt/sys-cacher/files/client/systemd/qubes-apt-cacher-ng-repo.service → salt/sys-cacher/files/client/systemd/qusal-apt-cacher-ng-repo.service
View file

4
salt/sys-cacher/files/server/systemd/apt-cacher-ng.service.d/50_qusal.conf
View file

@ -3,11 +3,11 @@
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
# vim: ft=systemd # vim: ft=systemd
[Unit] [Unit]
ConditionPathExists=/var/run/qubes-service/apt-cacher-ng ConditionPathExists=/var/run/qubes-service/acng-server
After=qubes-sysinit.service After=qubes-sysinit.service
Before=qubes-qrexec-agent.service Before=qubes-qrexec-agent.service
[Service] [Service]
ExecStartPre=chown -R apt-cacher-ng:apt-cacher-ng /var/log/apt-cacher-ng /var/cache/apt-cacher-ng ExecStartPre=chown -R apt-cacher-ng:apt-cacher-ng /var/log/apt-cacher-ng /var/cache/apt-cacher-ng
ExecStart= ExecStart=
ExecStart=/usr/sbin/apt-cacher-ng -c "/etc/qubes-apt-cacher-ng" ForeGround=1 ExecStart=/usr/sbin/apt-cacher-ng -c "/etc/qusal-apt-cacher-ng" ForeGround=1

8
salt/sys-cacher/install-client.sls
View file

@ -23,13 +23,13 @@ SPDX-License-Identifier: AGPL-3.0-or-later
"{{ slsdotpath }}-install-client-systemd": "{{ slsdotpath }}-install-client-systemd":
file.managed: file.managed:
- name: /usr/lib/systemd/system/qubes-apt-cacher-ng-repo.service - name: /usr/lib/systemd/system/qusal-apt-cacher-ng-repo.service
- source: salt://{{ slsdotpath }}/files/client/systemd/qubes-apt-cacher-ng-repo.service - source: salt://{{ slsdotpath }}/files/client/systemd/qusal-apt-cacher-ng-repo.service
- mode: "0644" - mode: "0644"
- group: root - group: root
- user: root - user: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-install-client-systemd-start-qubes-apt-cacher-ng-repo.service": "{{ slsdotpath }}-install-client-systemd-start-qusal-apt-cacher-ng-repo.service":
service.enabled: service.enabled:
- name: qubes-apt-cacher-ng-repo.service - name: qusal-apt-cacher-ng-repo.service

19
salt/sys-cacher/install.sls
View file

@ -37,25 +37,14 @@ include:
service.enabled: service.enabled:
- name: apt-cacher-ng - name: apt-cacher-ng
## TODO: legacy: remove after some weeks for user to have time to upgrade
"{{ slsdotpath }}-mask-qubes-apt-cacher-ng":
service.masked:
- name: qubes-apt-cacher-ng
- runtime: False
## TODO: legacy: remove after some weeks for user to have time to upgrade
"{{ slsdotpath }}-disable-qubes-apt-cacher-ng":
service.disabled:
- name: qubes-apt-cacher-ng
"{{ slsdotpath }}-create-qubes-cacher-config-dir": "{{ slsdotpath }}-create-qubes-cacher-config-dir":
file.directory: file.directory:
- name: /etc/qubes-apt-cacher-ng - name: /etc/qusal-apt-cacher-ng
- mode: '0755' - mode: '0755'
"{{ slsdotpath }}-copy-package-config-to-qubes-cacher-config": "{{ slsdotpath }}-copy-package-config-to-qubes-cacher-config":
cmd.run: cmd.run:
- name: cp -rp /etc/apt-cacher-ng/* /etc/qubes-apt-cacher-ng - name: cp -rp /etc/apt-cacher-ng/* /etc/qusal-apt-cacher-ng
"{{ slsdotpath }}-systemd-service": "{{ slsdotpath }}-systemd-service":
file.managed: file.managed:
@ -68,12 +57,12 @@ include:
"{{ slsdotpath }}-update-deb_mirrors.gz": "{{ slsdotpath }}-update-deb_mirrors.gz":
cmd.run: cmd.run:
- name: cp /usr/lib/apt-cacher-ng/deb_mirrors.gz /etc/qubes-apt-cacher-ng/deb_mirrors.gz - name: cp /usr/lib/apt-cacher-ng/deb_mirrors.gz /etc/qusal-apt-cacher-ng/deb_mirrors.gz
- runas: root - runas: root
"{{ slsdotpath }}-update-conf": "{{ slsdotpath }}-update-conf":
file.recurse: file.recurse:
- name: /etc/qubes-apt-cacher-ng/ - name: /etc/qusal-apt-cacher-ng/
- source: salt://{{ slsdotpath }}/files/server/conf/ - source: salt://{{ slsdotpath }}/files/server/conf/
- file_mode: "0644" - file_mode: "0644"
- group: root - group: root

2
salt/sys-cacher/uninstall-client.sls
View file

@ -27,4 +27,4 @@ SPDX-License-Identifier: AGPL-3.0-or-later
"{{ slsdotpath }}-uninstall-client-systemd-service": "{{ slsdotpath }}-uninstall-client-systemd-service":
file.absent: file.absent:
- name: /usr/lib/systemd/system/qubes-apt-cacher-ng-repo.service - name: /usr/lib/systemd/system/qusal-apt-cacher-ng-repo.service

1
salt/sys-git/files/server/rpc/qusal.GitInit
View file

@ -15,6 +15,7 @@ if ! command -v git >/dev/null; then
die "Command not found: git" die "Command not found: git"
fi fi
## TODO: subdirectory? dir+repo
untrusted_repo="${QREXEC_SERVICE_ARGUMENT}" untrusted_repo="${QREXEC_SERVICE_ARGUMENT}"
if test -z "${untrusted_repo}"; then if test -z "${untrusted_repo}"; then

12
salt/sys-pihole/configure-browser.sls
View file

@ -7,7 +7,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later
{% if grains['nodename'] != 'dom0' %} {% if grains['nodename'] != 'dom0' %}
"{{ slsdotpath }}-browser-auto-tcp-connect": "{{ slsdotpath }}-browser-rc.local":
file.managed: file.managed:
- name: /rw/config/rc.local.d/50-sys-pihole.rc - name: /rw/config/rc.local.d/50-sys-pihole.rc
- source: salt://{{ slsdotpath }}/files/browser/rc.local.d/50-sys-pihole.rc - source: salt://{{ slsdotpath }}/files/browser/rc.local.d/50-sys-pihole.rc
@ -16,6 +16,16 @@ SPDX-License-Identifier: AGPL-3.0-or-later
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-browser-systemd-services":
file.recurse:
- name: /rw/config/systemd/
- source: salt://{{ slsdotpath }}/files/browser/systemd/
- dir_mode: '0755'
- file_mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-browser-desktop-application": "{{ slsdotpath }}-browser-desktop-application":
file.managed: file.managed:
- name: /home/user/.local/share/applications/pihole-browser.desktop - name: /home/user/.local/share/applications/pihole-browser.desktop

2
salt/sys-pihole/create.sls
View file

@ -78,6 +78,8 @@ prefs:
- maxmem: 600 - maxmem: 600
- include_in_backups: False - include_in_backups: False
features: features:
- enable:
- service.http-client
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

6
salt/sys-pihole/files/browser/rc.local.d/50-sys-pihole.rc
View file

@ -1,7 +1,9 @@
#!/bin/sh #!/bin/sh
# vim: ft=sh # vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
qvm-connect-tcp 80:@default:80 cp -r /rw/config/systemd/qubes-http-forwarder* /usr/lib/systemd/system/
systemctl daemon-reload
systemctl --no-block restart qubes-http-forwarder.socket

7
salt/sys-ssh/files/client/systemd/qubes-ssh-forwarder.socket → salt/sys-pihole/files/browser/systemd/qubes-http-forwarder.socket
View file

@ -3,12 +3,13 @@
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
[Unit] [Unit]
Description=Forward connection to SSH over Qrexec Description=Forward HTTP connection over Qrexec
After=qubes-sysinit.service After=qubes-sysinit.service
ConditionPathExists=/var/run/qubes-service/ssh-setup Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/http-client
[Socket] [Socket]
ListenStream=127.0.0.1:840 ListenStream=127.0.0.1:80
BindToDevice=lo BindToDevice=lo
Accept=true Accept=true

11
salt/sys-pihole/files/browser/systemd/qubes-http-forwarder@.service Normal file
View file

@ -0,0 +1,11 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward HTTP connection over Qrexec
[Service]
ExecStart=/usr/bin/qrexec-client-vm @default qubes.ConnectTCP+80
StandardInput=socket
StandardOutput=inherit

56
salt/sys-pihole/files/server/keys/5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23.asc
View file

@ -6,28 +6,36 @@ SQzvYjsE4I34To4UdE9KA97wrQjGoz2Bx72WDLyWwctD3DKQtYeHXswXXtXwKfjQ
7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa 7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa
buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v
yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs
b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBiBBMBCAAW b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBoBBMBCAAc
BQJZlGhBCRBK7hj4Ov3rIwIbAwIZAQAAmQEIACATWFmi2oxlBh3wAsySNCNV4IPf BQJZlGhBCRBK7hj4Ov3rIwIbAwUJDBJ3/wIZAQAA0O4IAJd0k8M+urETyMvTqNTj
DDMeh6j80WT7cgoX7V7xqJOxrfrqPEthQ3hgHIm7b5MPQlUr2q+UPL22t/I+ESF6 /U6nbqyOdKE4V93uUj5G7sNTfno7wod/Qjj6Zv5KodvA93HmEdQqsmVq5YJ5KGiw
9b0QWLFSMJbMSk+BXkvSjH9q8jAO0986/pShPV5DU2sMxnx4LfLfHNhTzjXKokws cmGCpd/GqJRPaYSY0hSUSBqYHiHLusCJkPBpQTBhcEMtfVCB2J6fVeoX2DV0K1xf
+8ptJ8uhMNIDXfXuzkZHIxoXk3rNcjDN5c5X+sK8UBRH092BIJWCOfaQt7v7wig5 CGblrSVB0viAxUMnmL5C55RuvbYZsTu8szXhkvIR96CtWbJ8QGaEf1/KSpWz8ept
4Ra28pM9GbHKXVNxmdLpCFyzvyMuCmINYYADsC848QQFFwnd4EQnupo6QvhEVx1O Y/omf3UPfvdOjnsxc8jVEqPNaR9xC6Q6t53rBa/XgMY6IYyesnyYnc5O6JuexUFa
j7wDwvuH5dCrLuLwtwXaQh0onG4583p0LGms2Mf5F+Ick6o/4peOlBoZz48= VjykRFtAiYfDaMARpXOmgMm0lhoBRKb/uMUaN3CSYTmE4pZweJcUi7eWgmoQljX2
=HXDP ut6ZAg0EZabFdgEQALI37i+IVAzpBCgqvQDZbSsZ0yhtMnA5myjZA+l7BvIGy4ve
-----END PGP PUBLIC KEY BLOCK----------BEGIN PGP PUBLIC KEY BLOCK----- s1bk6YetbBcCE8o2pQjI7N2rwyhLGhNO6ouSyhqGLEQv9fafKE4HFH0aRjP+gj1H
edhwtFoVChImhV863rWimQtTNtYB6GluBPwQqWfwmwQ2rT7ScOVZCLSHZD2gaaqW
xsBNBFmUaEEBCACzXTDt6ZnyaVtueZASBzgnAmK13q9Urgch+sKYeIhdymjuMQta BXOyTCZVnwt7K/gyDuE3qzDJnuahl+SSkPn5TtnZdW6sLORJJ+DjNvaUxEsmizZ4
x15OklctmrZtqre5kwPUosG3/B2/ikuPYElcHgGPL4uL5Em6S5C/oozfkYzhwRrT IBzvj0QKxfS3s4F+0X5iqCMheLFeybZGtSq9Tjs6Q61l4CG8Bh6dsLemv0WFrk3G
SQzvYjsE4I34To4UdE9KA97wrQjGoz2Bx72WDLyWwctD3DKQtYeHXswXXtXwKfjQ gFQRr7XUwr1bo5xGHC/FUJSsxRHoVNJnIL/9WldNO2tGU6qlTnAYxs/fOmf2B6o5
7Fy4+Bf5IPh76dA8NJ6UtjjLIDlKqdxLW4atHe6xWFaJ+XdLUtsAroZcXBeWDCPa cKXysXv7WAA8b+j5AVBMGxUSu7CLglaiCJC5DI7AAiUV7/t29rFZkam//Jbb4veC
buXCDscJcLJRKZVc62gOZXXtPfoHqvUPp3nuLA4YjH9bphbrMWMf810Wxz9JTd3v 4vvFocoVUaxrKGWK1BDldr4/WJKApJcPJF4Jtai1+oB6ak/JIjbkseHdJxcjo2B0
yWgGqNY0zbBqeZoGv+TuExlRHT8ASGFS9SVDABEBAAHNNUdpdEh1YiAod2ViLWZs dKtIFoWiPAB+DFs9MRDpp0iwocJCh+ucus1rdQ54YMaI44rRphXeOIQMYCi5q2Q1
b3cgY29tbWl0IHNpZ25pbmcpIDxub3JlcGx5QGdpdGh1Yi5jb20+wsBiBBMBCAAW /arzkSiyPV/2VoKoAfdgskPt1xKd7WIKErmpFMHIy8jJ5IPQ1s2dUwU4alfJLJa0
BQJZlGhBCRBK7hj4Ov3rIwIbAwIZAQAAmQEIACATWFmi2oxlBh3wAsySNCNV4IPf pvaV2m7wBYFAmwmz0WZgFxYAYEDamn4jFoKfqsEgcixRUVE3w5VkqwSwGRbLABEB
DDMeh6j80WT7cgoX7V7xqJOxrfrqPEthQ3hgHIm7b5MPQlUr2q+UPL22t/I+ESF6 AAG0G0dpdEh1YiA8bm9yZXBseUBnaXRodWIuY29tPokCTgQTAQoAOBYhBJaEeaGv
9b0QWLFSMJbMSk+BXkvSjH9q8jAO0986/pShPV5DU2sMxnx4LfLfHNhTzjXKokws +SfjfRpWa7VpDu67lSGUBQJlpsV2AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+8ptJ8uhMNIDXfXuzkZHIxoXk3rNcjDN5c5X+sK8UBRH092BIJWCOfaQt7v7wig5 AAoJELVpDu67lSGUgy4QAKW9XAL416iKrQB2LElmxqAoenHVCswlau0xGLh5dVNN
4Ra28pM9GbHKXVNxmdLpCFyzvyMuCmINYYADsC848QQFFwnd4EQnupo6QvhEVx1O p5f4/W6eEL8CZI7hfF3e5Gh6Me99aHgXSCK1QnxcqCJ6Oea4ZyrsNu3k6g7Um5ca
j7wDwvuH5dCrLuLwtwXaQh0onG4583p0LGms2Mf5F+Ick6o/4peOlBoZz48= VbYFD4yIahhXDYHSw6FYM2sgFY479YvgvKRwacC2tFfChLRbHgwLJ3O1dBjmVycJ
=HXDP Zpbyu+7taZ26g6KQfgcj3uuo3nz3p1ziIEpLHwtl/7joNEIIP/lJ8AKmUHPiGznN
6fxMvzN37PGMWtdvOi1rSNIMQYr1YY7jPnlLbFJwLrO/q/cGPU5HwGzlqh0a2ZqY
dnuwT3DREmgJ83H71xH+sTzZKs5oGlVTu6st7iWDvNpo2GoN01XzKa5caYglqsOC
uZ6IHlsdL50sXMtSROCi3hEWU9r1sWIm4k3pNz20y7lElD2X/MqbEMcgpawCV7lH
rm7MSrTgu6BNAF0SisbF9AKwXaBr2dwpMMyIBOFZO9mk4/c0n9q2FlGY4GkbgH2J
HqulFTwX/4yiQbh8gzCe+06FZAWITN1OQntTkkCQ+1MCZPf+bOfC08RTsOsVZIYB
2qAgw6XE0IF4a+PAtHSoYftwH2ocMY2gMuSNpQWm7m0+/j+K+RBoeUcnGNPQgszq
N60IDMqkqHjyubrm2aslfopWmPSvaQoyxwV/uztdo+UI0IV2z9gD7Sm49vMkpYp8
=uMz0
-----END PGP PUBLIC KEY BLOCK----- -----END PGP PUBLIC KEY BLOCK-----

4
salt/sys-print/README.md
View file

@ -64,12 +64,12 @@ sudo qubesctl --skip-dom0 --targets=tpl-sys-print state.apply sys-print.install-
On the client template: On the client template:
```sh ```sh
sudo qubesctl --skip-dom0 --targets=tpl-QUBE state.apply sys-print.install-client sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-print.install-client
``` ```
The client qube requires the split Print service to be enabled: The client qube requires the split Print service to be enabled:
```sh ```sh
qvm-features QUBE service.print-setup 1 qvm-features QUBE service.print-client 1
``` ```
## Access Control ## Access Control

25
salt/sys-print/files/client/systemd/qusal-print-forwarder.service
View file

@ -1,25 +0,0 @@
# SPDX-FileCopyrightText: 2023 unman <unman@thirdeyesecurity.org>
# SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Print over Qrexec
After=qubes-sysinit.service
After=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/print-setup
[Service]
ExecStart=/usr/bin/socat TCP4-LISTEN:631,reuseaddr,fork,end-close EXEC:"qrexec-client-vm @default qusal.Print"
Restart=on-failure
RestartSec=3
# Hardening
ProtectSystem=full
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target

17
salt/sys-print/files/client/systemd/qusal-print-forwarder.socket Normal file
View file

@ -0,0 +1,17 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward Print connection over Qrexec
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/print-client
[Socket]
ListenStream=127.0.0.1:631
BindToDevice=lo
Accept=true
[Install]
WantedBy=multi-user.target

11
salt/sys-print/files/client/systemd/qusal-print-forwarder@.service Normal file
View file

@ -0,0 +1,11 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward Print connection over Qrexec
[Service]
ExecStart=/usr/bin/qrexec-client-vm @default qusal.Print
StandardInput=socket
StandardOutput=inherit

24
salt/sys-print/install-client.sls
View file

@ -5,24 +5,16 @@ SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later SPDX-License-Identifier: AGPL-3.0-or-later
#} #}
"{{ slsdotpath }}-installed-client": "{{ slsdotpath }}-client-systemd":
pkg.installed: file.recurse:
- require: - name: /usr/lib/systemd/system/
- sls: utils.tools.common.update - source: salt://{{ slsdotpath }}/files/client/systemd/
- install_recommends: False - file_mode: '0644'
- skip_suggestions: True - dir_mode: '0755'
- pkgs:
- socat
"{{ slsdotpath }}-client-systemd-print-forwarder":
file.managed:
- name: /usr/lib/systemd/system/qusal-print-forwarder.service
- source: salt://{{ slsdotpath }}/files/client/systemd/qusal-print-forwarder.service
- mode: '0644'
- user: root - user: root
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-enable-systemd-service-print-forwarder": "{{ slsdotpath }}-enable-systemd-service-print-forwarder.socket":
service.enabled: service.enabled:
- name: qusal-print-forwarder.service - name: qusal-print-forwarder.socket

2
salt/sys-rsync/README.md
View file

@ -49,7 +49,7 @@ sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-rsync.install-clien
The client qube requires the Rsync forwarder service to be enabled: The client qube requires the Rsync forwarder service to be enabled:
``` ```
qvm-features QUBE service.rsync-setup 1 qvm-features QUBE service.rsync-client 1
``` ```
## Access Control ## Access Control

11
salt/sys-rsync/configure.sls
View file

@ -1,6 +1,6 @@
{# {#
SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org> SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later SPDX-License-Identifier: AGPL-3.0-or-later
#} #}
@ -8,15 +8,6 @@ SPDX-License-Identifier: AGPL-3.0-or-later
include: include:
- dev.home-cleanup - dev.home-cleanup
"{{ slsdotpath }}-start-rsync-on-boot":
file.managed:
- name: /rw/config/rc.local.d/50-sys-rsync.rc
- source: salt://{{ slsdotpath }}/files/server/rc.local.d/50-sys-rsync.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-creates-local-rsync-configuration-dir": "{{ slsdotpath }}-creates-local-rsync-configuration-dir":
file.directory: file.directory:
- name: /usr/local/etc/rsync.d - name: /usr/local/etc/rsync.d

1
salt/sys-rsync/create.sls
View file

@ -41,6 +41,7 @@ prefs:
features: features:
- enable: - enable:
- servicevm - servicevm
- service.rsync-server
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

4
salt/sys-rsync/files/client/systemd/qubes-rsync-forwarder.socket → salt/sys-rsync/files/client/systemd/qusal-rsync-forwarder.socket
View file

@ -3,9 +3,9 @@
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
[Unit] [Unit]
Description=Forward connection to Rsync over Qrexec Description=Forward Rsync connection over Qrexec
After=qubes-sysinit.service After=qubes-sysinit.service
ConditionPathExists=/var/run/qubes-service/rsync-setup ConditionPathExists=/var/run/qubes-service/rsync-client
[Socket] [Socket]
ListenStream=127.0.0.1:1839 ListenStream=127.0.0.1:1839

2
salt/sys-rsync/files/client/systemd/qubes-rsync-forwarder@.service → salt/sys-rsync/files/client/systemd/qusal-rsync-forwarder@.service
View file

@ -3,7 +3,7 @@
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
[Unit] [Unit]
Description=Forward connection to Rsync over Qrexec Description=Forward Rsync connection over Qrexec
[Service] [Service]
ExecStart=/usr/bin/qrexec-client-vm @default qusal.Rsync ExecStart=/usr/bin/qrexec-client-vm @default qusal.Rsync

8
salt/sys-rsync/files/server/rc.local.d/50-sys-rsync.rc
View file

@ -1,8 +0,0 @@
#!/bin/sh
# vim: ft=sh
# SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
systemctl unmask rsync
systemctl --no-block restart rsync

8
salt/sys-rsync/files/server/systemd/rsync.service.d/50_qusal.conf Normal file
View file

@ -0,0 +1,8 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
# vim: ft=systemd
[Unit]
ConditionPathExists=/var/run/qubes-service/rsync-server
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service

4
salt/sys-rsync/install-client.sls
View file

@ -30,8 +30,8 @@ include:
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-client-systemd-start-qubes-rsync-forwarder.socket": "{{ slsdotpath }}-client-systemd-enable-qusal-rsync-forwarder.socket":
service.enabled: service.enabled:
- name: qubes-rsync-forwarder.socket - name: qusal-rsync-forwarder.socket
{% endif -%} {% endif -%}

22
salt/sys-rsync/install.sls
View file

@ -20,16 +20,22 @@ include:
- rsync - rsync
- man-db - man-db
"{{ slsdotpath }}-stop-rsync": "{{ slsdotpath }}-systemd":
service.dead: file.recurse:
- name: /usr/lib/systemd/system/
- source: salt://{{ slsdotpath }}/files/server/systemd/
- dir_mode: '0755'
- file_mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-unmask-rsync":
service.unmasked:
- name: rsync - name: rsync
"{{ slsdotpath }}-disable-rsync": "{{ slsdotpath }}-enable-rsync":
service.disabled: service.enabled:
- name: rsync
"{{ slsdotpath }}-mask-rsync":
service.masked:
- name: rsync - name: rsync
"{{ slsdotpath }}-set-rsyncd.conf": "{{ slsdotpath }}-set-rsyncd.conf":

24
salt/sys-ssh-agent/README.md
View file

@ -150,7 +150,7 @@ Or you can manually add the key to the agent which are not located under the
`~/.ssh/identities.d` directory so they aren't automatically added (substitute `~/.ssh/identities.d` directory so they aren't automatically added (substitute
AGENT, SECS, and LIFE for their appropriate values): AGENT, SECS, and LIFE for their appropriate values):
```sh ```sh
SSH_AUTH_SOCK="/run/user/1000/qubes-ssh-agent/<AGENT>.sock" ssh-add -t <SECS> -f <FILE> SSH_AUTH_SOCK="/run/user/1000/qusal-ssh-agent/<AGENT>.sock" ssh-add -t <SECS> -f <FILE>
``` ```
#### Reload agent #### Reload agent
@ -177,17 +177,17 @@ qvm-ssh-agent ls <AGENT>
Enable and start the connection to the SSH Agent via Qrexec for specified Enable and start the connection to the SSH Agent via Qrexec for specified
`<AGENT>`: `<AGENT>`:
```sh ```sh
sudo systemctl --no-block restart qubes-ssh-agent-forwarder@<AGENT>.service sudo systemctl --no-block restart qusal-ssh-agent-forwarder@<AGENT>.service
sudo systemctl --no-block restart qubes-ssh-agent-forwarder@personal.service sudo systemctl --no-block restart qusal-ssh-agent-forwarder@personal.service
``` ```
You can start the service on boot if you place the above line You can start the service on boot if you place the above line
`/rw/config/rc.local` of the client. `/rw/config/rc.local` of the client.
The ssh-agent socket will be at `/tmp/qubes-ssh-agent-forwarder/<AGENT>.sock`. The ssh-agent socket will be at `/tmp/qusal-ssh-agent-forwarder/<AGENT>.sock`.
You can test the connection is working with: You can test the connection is working with:
```sh ```sh
SSH_AUTH_SOCK="/tmp/qubes-ssh-agent-forwarder/personal.sock" ssh-add -l SSH_AUTH_SOCK="/tmp/qusal-ssh-agent-forwarder/personal.sock" ssh-add -l
``` ```
#### Single agent per client #### Single agent per client
@ -196,8 +196,8 @@ You might want to set the `SSH_AUTH_SOCK` and `SSH_AGENT_PID` environment
variables to point to the `work` agent so every connection will use the same variables to point to the `work` agent so every connection will use the same
agent: agent:
```sh ```sh
echo 'export SSH_AUTH_SOCK=/tmp/qubes-ssh-agent-forwarder/work.sock; echo 'export SSH_AUTH_SOCK=/tmp/qusal-ssh-agent-forwarder/work.sock;
SSH_AGENT_PID="$(pgrep -f "/tmp/qubes-ssh-agent-forwarder/work.sock")"; SSH_AGENT_PID="$(pgrep -f "/tmp/qusal-ssh-agent-forwarder/work.sock")";
' | tee -a ~/.profile ' | tee -a ~/.profile
``` ```
@ -210,19 +210,19 @@ the `IdentityAgent` option.
You can control the SSH agent via SSH command-line option: You can control the SSH agent via SSH command-line option:
```sh ```sh
ssh -o IdentityAgent=/tmp/qubes-ssh-agent-forwarder/personal.sock personal-site.com ssh -o IdentityAgent=/tmp/qusal-ssh-agent-forwarder/personal.sock personal-site.com
ssh -o IdentityAgent=/tmp/qubes-ssh-agent-forwarder/work.sock work-site.com ssh -o IdentityAgent=/tmp/qusal-ssh-agent-forwarder/work.sock work-site.com
``` ```
You can control the SSH agent via SSH configuration: You can control the SSH agent via SSH configuration:
```sshconfig ```sshconfig
Host personal Host personal
IdentityAgent /tmp/qubes-ssh-agent-forwarder/personal.sock IdentityAgent /tmp/qusal-ssh-agent-forwarder/personal.sock
... ...
Host work Host work
IdentityAgent /tmp/qubes-ssh-agent-forwarder/work.sock IdentityAgent /tmp/qusal-ssh-agent-forwarder/work.sock
... ...
``` ```
## Credits ## Credits
- [Unman](https://github.com/unman/qubes-ssh-agent) - [Unman](https://github.com/unman/qusal-ssh-agent)

4
salt/sys-ssh-agent/files/client/systemd/qubes-ssh-agent-forwarder@.service → salt/sys-ssh-agent/files/client/systemd/qusal-ssh-agent-forwarder@.service
View file

@ -1,9 +1,9 @@
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
[Unit] [Unit]
Description=SSH Agent Forwarder to Qrexec SSH Agent %i Description=Forward SSH Agent %i over Qrexec
[Service] [Service]
User=user User=user

4
salt/sys-ssh-agent/files/server/bin/qvm-ssh-agent
View file

@ -1,12 +1,12 @@
#!/bin/sh #!/bin/sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
set -eu set -eu
service="qubes-ssh-agent" service="qusal-ssh-agent"
usage(){ usage(){
echo "Usage: ${0##*/} [ls|add] <AGENT> echo "Usage: ${0##*/} [ls|add] <AGENT>

2
salt/sys-ssh-agent/files/server/rpc/qusal.SshAgent
View file

@ -24,7 +24,7 @@ if test "${#untrusted_agent}" -gt 128; then
fi fi
agent="${untrusted_agent}" agent="${untrusted_agent}"
socket="/tmp/qubes-ssh-agent/${agent}.sock" socket="/tmp/qusal-ssh-agent/${agent}.sock"
qvm-ssh-agent add "${agent}" >/dev/null qvm-ssh-agent add "${agent}" >/dev/null
exec socat STDIO UNIX-CLIENT:"${socket}" exec socat STDIO UNIX-CLIENT:"${socket}"

3
salt/sys-ssh/README.md
View file

@ -39,7 +39,6 @@ sudo qubesctl top.disable sys-ssh
```sh ```sh
sudo qubesctl state.apply sys-ssh.create sudo qubesctl state.apply sys-ssh.create
sudo qubesctl --skip-dom0 --targets=tpl-sys-ssh state.apply sys-ssh.install sudo qubesctl --skip-dom0 --targets=tpl-sys-ssh state.apply sys-ssh.install
sudo qubesctl --skip-dom0 --targets=sys-ssh state.apply sys-ssh.configure
``` ```
<!-- pkg:end:post-install --> <!-- pkg:end:post-install -->
@ -50,7 +49,7 @@ sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-ssh.install-client
The client qube requires the SSH forwarder service to be enabled: The client qube requires the SSH forwarder service to be enabled:
``` ```
qvm-features QUBE service.ssh-setup 1 qvm-features QUBE service.ssh-client 1
``` ```
## Access Control ## Access Control

30
salt/sys-ssh/configure.sls
View file

@ -1,30 +0,0 @@
{#
SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{% if grains['nodename'] != 'dom0' -%}
include:
- dev.home-cleanup
"{{ slsdotpath }}-start-ssh-on-boot":
file.managed:
- name: /rw/config/rc.local.d/50-sys-ssh.rc
- source: salt://{{ slsdotpath }}/files/server/rc.local.d/50-sys-ssh.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-creates-home-ssh-dir":
file.directory:
- name: /home/user/.ssh
- mode: '0700'
- user: user
- group: user
- makedirs: True
{% endif -%}

9
salt/sys-ssh/configure.top
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
base:
'sys-ssh':
- sys-ssh.configure

1
salt/sys-ssh/create.sls
View file

@ -41,6 +41,7 @@ prefs:
features: features:
- enable: - enable:
- servicevm - servicevm
- service.ssh-server
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

11
salt/sys-ssh/files/client/ssh_config.d/50-qusal-sys-ssh.conf Normal file
View file

@ -0,0 +1,11 @@
# vim: ft=sshconfig
# SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
Host default-qubes-server
Hostname 127.0.0.1
User user
Port 1840
StrictHostKeyChecking no

17
salt/sys-ssh/files/client/systemd/qusal-ssh-forwarder.socket Normal file
View file

@ -0,0 +1,17 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward SSH connection over Qrexec
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/ssh-client
[Socket]
ListenStream=127.0.0.1:1840
BindToDevice=lo
Accept=true
[Install]
WantedBy=multi-user.target

4
salt/sys-ssh/files/client/systemd/qubes-ssh-forwarder@.service → salt/sys-ssh/files/client/systemd/qusal-ssh-forwarder@.service
View file

@ -1,9 +1,9 @@
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
[Unit] [Unit]
Description=Forward connection to SSH over Qrexec Description=Forward SSH connection over Qrexec
[Service] [Service]
ExecStart=/usr/bin/qrexec-client-vm @default qusal.Ssh ExecStart=/usr/bin/qrexec-client-vm @default qusal.Ssh

8
salt/sys-ssh/files/server/rc.local.d/50-sys-ssh.rc
View file

@ -1,8 +0,0 @@
#!/bin/sh
# vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
systemctl unmask ssh
systemctl --no-block restart ssh

0
salt/sys-ssh/files/server/sshd_config.d/sys-ssh.conf → salt/sys-ssh/files/server/sshd_config.d/50-qusal-sys-ssh.conf
View file

8
salt/sys-ssh/files/server/systemd/ssh.service.d/50_qusal.conf Normal file
View file

@ -0,0 +1,8 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
# vim: ft=systemd
[Unit]
ConditionPathExists=/var/run/qubes-service/ssh-server
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service

2
salt/sys-ssh/init.top
View file

@ -10,5 +10,3 @@ base:
- sys-ssh.create - sys-ssh.create
'tpl-sys-ssh': 'tpl-sys-ssh':
- sys-ssh.install - sys-ssh.install
'sys-ssh':
- sys-ssh.configure

13
salt/sys-ssh/install-client.sls
View file

@ -28,6 +28,15 @@ include:
- skip_suggestions: True - skip_suggestions: True
- pkgs: {{ pkg.pkg|sequence|yaml }} - pkgs: {{ pkg.pkg|sequence|yaml }}
"{{ slsdotpath }}-ssh-config":
file.managed:
- name: /etc/ssh/ssh_config.d/50-qusal-{{ slsdotpath }}.conf
- source: salt://{{ slsdotpath }}/files/client/ssh_config.d/50-qusal-{{ slsdotpath }}.conf
- mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-client-systemd": "{{ slsdotpath }}-client-systemd":
file.recurse: file.recurse:
- name: /usr/lib/systemd/system/ - name: /usr/lib/systemd/system/
@ -38,8 +47,8 @@ include:
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-client-systemd-start-qubes-ssh-forwarder.socket": "{{ slsdotpath }}-client-systemd-start-qusal-ssh-forwarder.socket":
service.enabled: service.enabled:
- name: qubes-ssh-forwarder.socket - name: qusal-ssh-forwarder.socket
{% endif -%} {% endif -%}

27
salt/sys-ssh/install.sls
View file

@ -20,16 +20,21 @@ include:
- openssh-server - openssh-server
- man-db - man-db
"{{ slsdotpath }}-stop-ssh": "{{ slsdotpath }}-ssh-systemd-service":
service.dead: file.managed:
- name: /usr/lib/systemd/system/ssh.service.d/50_qusal.conf
- source: salt://{{ slsdotpath }}/files/server/systemd/ssh.service.d/50_qusal.conf
- mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-unmask-ssh":
service.unmasked:
- name: ssh - name: ssh
"{{ slsdotpath }}-disable-ssh": "{{ slsdotpath }}-enable-ssh":
service.disabled: service.enabled:
- name: ssh
"{{ slsdotpath }}-mask-ssh":
service.masked:
- name: ssh - name: ssh
"{{ slsdotpath }}-rpc": "{{ slsdotpath }}-rpc":
@ -52,9 +57,9 @@ include:
"{{ slsdotpath }}-sshd-config": "{{ slsdotpath }}-sshd-config":
file.managed: file.managed:
- name: /etc/ssh/sshd_config.d/{{ slsdotpath }}.conf - name: /etc/ssh/sshd_config.d/50-qusal-{{ slsdotpath }}.conf
- source: salt://{{ slsdotpath }}/files/server/sshd_config.d/{{ slsdotpath }}.conf - source: salt://{{ slsdotpath }}/files/server/sshd_config.d/50-qusal-{{ slsdotpath }}.conf
- mode: '0755' - mode: '0644'
- user: root - user: root
- group: root - group: root
- makedirs: True - makedirs: True

11
salt/sys-syncthing/README.md
View file

@ -52,9 +52,11 @@ Install Syncthing on the client template:
sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-syncthing.install-client sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-syncthing.install-client
``` ```
The client qube requires the split Syncthing service to be enabled: The client qube requires the split Syncthing and the Syncthing Daemon service
to be enabled:
```sh ```sh
qvm-features QUBE service.syncthing-setup 1 qvm-features QUBE service.syncthing-client 1
qvm-features QUBE service.syncthing-server 1
``` ```
## Access Control ## Access Control
@ -87,8 +89,8 @@ interface. In other words, it has control over the server functions, if the
browser is compromised, it can compromise the server. browser is compromised, it can compromise the server.
To use the service, from the client, add a Remote Device, and copy the To use the service, from the client, add a Remote Device, and copy the
`DeviceID` from the server qube. On the Advanced tab, under Addresses, change `DeviceID` from the server qube. On the `Advanced` tab, under `Addresses`,
`dynamic` to `tcp://127.0.0.1:22001` change `dynamic` to `tcp://127.0.0.1:22001`
If the sender qube has no netvm set, under `Settings`, disable `Enable NAT If the sender qube has no netvm set, under `Settings`, disable `Enable NAT
traversal`, `Local Discovery`, `Global Discovery`, and `Enable Relaying` traversal`, `Local Discovery`, `Global Discovery`, and `Enable Relaying`
@ -119,7 +121,6 @@ Uninstallation procedure:
```sh ```sh
qvm-port-forward -a del -q sys-syncthing -n tcp -p 22000 qvm-port-forward -a del -q sys-syncthing -n tcp -p 22000
qvm-port-forward -a del -q sys-syncthing -n udp -p 22000 qvm-port-forward -a del -q sys-syncthing -n udp -p 22000
sudo qubesctl --skip-dom0 --targets=sys-syncthing state.apply sys-syncthing.cancel
sudo qubesctl state.apply sys-syncthing.clean sudo qubesctl state.apply sys-syncthing.clean
``` ```
<!-- pkg:end:preun-uninstall --> <!-- pkg:end:preun-uninstall -->

9
salt/sys-syncthing/cancel.sls
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
"{{ slsdotpath }}-remove-service-from-rc.local":
file.absent:
- name: /rw/config/rc.local.d/50-sys-syncthing.rc

9
salt/sys-syncthing/cancel.top
View file

@ -1,9 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
base:
'sys-syncthing':
- sys-syncthing.configure

6
salt/sys-syncthing/clean.sls
View file

@ -11,5 +11,11 @@ SPDX-License-Identifier: AGPL-3.0-or-later
- flags: - flags:
- force - force
"{{ slsdotpath }}-stop-syncthing-from-starting":
qvm.features:
- name: {{ slsdotpath }}
- disable:
- service.syncthing-server
{% from 'utils/macros/policy.sls' import policy_unset with context -%} {% from 'utils/macros/policy.sls' import policy_unset with context -%}
{{ policy_unset(sls_path, '80') }} {{ policy_unset(sls_path, '80') }}

9
salt/sys-syncthing/configure-browser.sls
View file

@ -18,6 +18,15 @@ include:
- group: root - group: root
- makedirs: True - makedirs: True
"{{ slsdotpath }}-browser-systemd-services":
file.recurse:
- name: /rw/config/systemd/
- source: salt://{{ slsdotpath }}/files/browser/systemd/
- dir_mode: '0755'
- file_mode: '0644'
- user: root
- group: root
- makedirs: True
"{{ slsdotpath }}-browser-desktop-application": "{{ slsdotpath }}-browser-desktop-application":
file.managed: file.managed:

11
salt/sys-syncthing/configure.sls
View file

@ -1,5 +1,4 @@
{# {#
SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com> SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later SPDX-License-Identifier: AGPL-3.0-or-later
@ -7,12 +6,4 @@ SPDX-License-Identifier: AGPL-3.0-or-later
include: include:
- dotfiles.copy-xfce - dotfiles.copy-xfce
- dotfiles.copy-x11
"{{ slsdotpath }}-rc.local":
file.managed:
- name: /rw/config/rc.local.d/50-sys-syncthing.rc
- source: salt://{{ slsdotpath }}/files/server/rc.local.d/50-sys-syncthing.rc
- mode: '0755'
- user: root
- group: root
- makedirs: True

3
salt/sys-syncthing/create.sls
View file

@ -56,6 +56,7 @@ prefs:
features: features:
- enable: - enable:
- servicevm - servicevm
- service.syncthing-server
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed
@ -83,6 +84,8 @@ prefs:
- autostart: False - autostart: False
- include_in_backups: False - include_in_backups: False
features: features:
- enable:
- service.syncthing-browser
- disable: - disable:
- service.cups - service.cups
- service.cups-browsed - service.cups-browsed

6
salt/sys-syncthing/files/browser/rc.local.d/50-sys-syncthing.rc
View file

@ -1,7 +1,9 @@
#!/bin/sh #!/bin/sh
# vim: ft=sh # vim: ft=sh
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com> # SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
# #
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
qvm-connect-tcp 8384:@default:8384 cp -r /rw/config/systemd/qusal-syncthing-browser-forwarder* /usr/lib/systemd/system/
systemctl daemon-reload
systemctl --no-block restart qusal-syncthing-browser-forwarder.socket

17
salt/sys-syncthing/files/browser/systemd/qusal-syncthing-browser-forwarder.socket Normal file
View file

@ -0,0 +1,17 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward Syncthing Admin Panel connection over Qrexec
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/syncthing-browser
[Socket]
ListenStream=127.0.0.1:8384
BindToDevice=lo
Accept=true
[Install]
WantedBy=multi-user.target

11
salt/sys-syncthing/files/browser/systemd/qusal-syncthing-browser-forwarder@.service Normal file
View file

@ -0,0 +1,11 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward Syncthing Admin Panel connection over Qrexec
[Service]
ExecStart=/usr/bin/qrexec-client-vm @default qubes.ConnectTCP+8384
StandardInput=socket
StandardOutput=inherit

25
salt/sys-syncthing/files/client/systemd/qubes-syncthing-forwarder.service
View file

@ -1,25 +0,0 @@
## SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
## SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
##
## SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Syncthing over Qrexec
After=qubes-sysinit.service
After=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/syncthing-setup
[Service]
ExecStart=/usr/bin/socat TCP4-LISTEN:22001,reuseaddr,fork,end-close EXEC:"qrexec-client-vm @default qusal.Syncthing"
Restart=on-failure
RestartSec=3
# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target

17
salt/sys-syncthing/files/client/systemd/qusal-syncthing-forwarder.socket Normal file
View file

@ -0,0 +1,17 @@
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com
#
# SPDX-License-Identifier: AGPL-3.0-or-later
[Unit]
Description=Forward Syncthing connection over Qrexec
After=qubes-sysinit.service
Before=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/syncthing-client
[Socket]
ListenStream=127.0.0.1:22001
BindToDevice=lo
Accept=true
[Install]
WantedBy=multi-user.target

Some files were not shown because too many files have changed in this diff Show more