Commit Graph

309 Commits

Author SHA1 Message Date
Ben Grande
c84dfea48e
fix: generate RPM Specs for Qubes Builder V2
It doesn't checkout the current directory when querying the spec, so we
provide the already modified version of the spec.
2024-06-21 17:00:06 +02:00
Ben Grande
0e2bb5b40b
fix: update dotfiles module 2024-06-20 22:32:35 +02:00
Ben Grande
7ab3b938f8
fix: correct upstream repository owner
For: https://github.com/ben-grande/qusal/issues/59
2024-06-20 18:09:27 +02:00
Ben Grande
ab56b5f3c8
feat: allow print calls from qubes with tag
Fixes: https://github.com/ben-grande/qusal/issues/63
2024-06-20 10:40:58 +02:00
Ben Grande
97b2496891
fix: start service after Qubes Service setup 2024-06-19 18:08:20 +02:00
Ben Grande
f30bd20f54
fix: Print server without RPC service
- Install RPC service to template;
- Move qube configuration to template configuration;
- Start server after the Qubes Services are created;
- Qrexec policy ask to both app and disposable qube; and
- Rename systemd service to qusal prefix instead of qubes.
2024-06-19 15:40:20 +02:00
Ben Grande
bf0a4bc914
fix: terminate option parsing for qvm commands 2024-06-19 15:12:22 +02:00
Ben Grande
99fb13856c
fix: correct git repository name in policy 2024-06-19 15:12:08 +02:00
Ben Grande
6ec0768f13
fix: clean Wireguard rules
- Remove OpenVPN code comments;
- Reorganize rules for easier reading;
- Server can connect without having client attached;
- Systemd service for easier monitoring of wg-quick; and
- Firewall also restarts wg-quick and apply new endpoint rules.
2024-06-19 15:08:03 +02:00
Ben Grande
f86e30a6b6
fix: add simple-scan to printer appmenus 2024-06-19 08:45:02 +02:00
Ben Grande
49a295dae9
fix: printer formula with conflicting IDs 2024-06-19 08:38:56 +02:00
Ben Grande
8d5c1c9bb4
chore: typo in date command 2024-06-18 10:45:47 +02:00
Ben Grande
43e1e320b3
feat: bump Bitcoin version 2024-06-17 21:52:30 +02:00
Ben Grande
b5ae2219e0
fix: update dotfiles module 2024-06-17 21:46:33 +02:00
Ben Grande
534db9655c
doc: qusal proxy service requires configuration
Fixes: https://github.com/ben-grande/qusal/issues/61
2024-06-17 21:46:21 +02:00
Ben Grande
1a72665a40
feat: add split-gpg2 configuration
Users must migrated their keys from ~/.gnupg to the value of
isolated_gnupg_homedirs.
2024-06-17 14:31:51 +02:00
Ben Grande
59e8fc32a0
fix: GUI Global Config precedes packaged policies 2024-06-17 11:36:39 +02:00
Ben Grande
faa00fbffa
doc: update table of contents 2024-06-16 10:45:42 +02:00
Ben Grande
fcad8cb3e1
feat: update dotfiles module 2024-06-14 19:16:20 +02:00
Ben Grande
ba5b4813f2
fix: signature check breaks qubes-builder update
The state module git.latest does not allow setting environment variable
for us to set the correct GNUPGHOME. The module environ.set does not
work as we call git as the normal user and not as root, but may still be
the problem of git.latest not respecting environment variables.

The problem with always pulling new commits is that it may conflict with
the current work the user has done on the repository locally. It will
also not work in case the last commit is not signed by a trusted key
deployed by the formula, in this case, you should add the key manually
to verify the commit.

Setting the gpg.program only for the required repositories solves the
aforementioned problem and also enhances usability by removing extra
commands that the user needs to learn and remember.

Fixes: https://github.com/ben-grande/qusal/issues/58
2024-06-14 19:11:16 +02:00
Ben Grande
afcb73085f
doc: document usage of qusal TCP proxy 2024-06-14 07:42:18 +02:00
Ben Grande
e1a15d8a7e
fix: pgp template is fedora based without salt fix 2024-06-14 07:36:41 +02:00
Ben Grande
3ece491564
fix: wrong video-companion package name for dom0 2024-06-14 07:35:22 +02:00
Ben Grande
a564b3a703
feat: add TCP proxy for remote hosts
Ideally, it would be a Qrexec socket service, but it doesn't handle DNS,
only accepting IPs. The dev qube is now non-networked and network,
especially to remote git repositories can be acquired via the proxy that
is going to be installed in every netvm.
2024-06-13 18:01:08 +02:00
Ben Grande
7a70535553
fix: Fedora 40 only has wget2
The wget package can be downloaded from the command-line, but as Salt
does not follow DNF package redirects, the package is installed but the
state fails as Salt cannot find a package with the same name installed.
2024-06-13 14:01:35 +02:00
Ben Grande
e65b0bfde9
fix: feature check statement missing key 2024-06-13 14:01:04 +02:00
Ben Grande
75d992b041
fix: use Admin API for fast queries 2024-06-13 13:29:30 +02:00
Ben Grande
13c57939a7
fix: uninstall cacher client with tag in pillar
Targeting only qubes with the tag on the installation instructions is
still useful as it is faster than targeting all qubes.

Fixes: https://github.com/ben-grande/qusal/issues/41
2024-06-13 13:28:24 +02:00
Ben Grande
6e7774a27f
feat: bump Fedora version 2024-06-12 15:00:59 +02:00
Ben Grande
fc22726ee8
feat: build and sign RPM packages
Passing files to Dom0 is always dangerous:

- Passing a git repository is dangerous as it can have ignored modified
  files and signature verification will pass.
- Passing an archive is troublesome for updates.
- Passing an RPM package depends on the RPM verification to be correct,
  some times it is not.
- Passing a RPM repository definition is less troublesome for the user,
  as it is a small file to verify the contents and update mechanism is
  via the package manager. Trust in RPM verification is still required.

Many improvements were made to the build scripts:

- requires-program: Single function to check if program is installed;
- spec-get: Sort project names for the usage message;
- spec-get: Only running commands that are necessary;
- spec-get: Fix empty summary when readme has copyright header;
- spec-gen: Fix grep warning of escaped symbol;
- spec-build: Sign RPM and verify signature;
- spec-build: Only lint the first SPEC for faster runtime;
- yumrepo-gen: Generate a local yum repository with signed metadata;
- qubesbuilder-gen: Generate a .qubesbuilder based on tracked projects;
- release: Build, sign and push all RPMs to repository.

Goal is to be able to build with qubes-builderv2 Qubes Executor.

For: https://github.com/ben-grande/qusal/issues/37
2024-06-12 14:44:04 +02:00
Ben Grande
10200f609e
fix: rpmmacros is unnecessary with split-gpg2 2024-06-12 11:32:43 +02:00
Ben Grande
ffe03ba02a
fix: set global prefs for management_dispvm 2024-06-10 19:39:08 +02:00
Ben Grande
c456af2718
fix: remove duplicated Fedora mirrors 2024-06-10 19:15:14 +02:00
Ben Grande
8ae815de71
fix: run repo rewriter after upstream proxy update
Rewriter depends on the check of qubes-services and must be run after
/usr/lib/qubes/init/misc-post.sh.
2024-06-10 19:02:07 +02:00
Ben Grande
b4de619197
fix: update Debian and Fedora mirrors 2024-06-10 13:57:18 +02:00
Ben Grande
2b181f854a
fix: merge Qubes OS repositories
Only deb and rpm where cached and only if used from the Qubes website
and made to individual directories. Now every package from every package
manager Qubes supports will be cached.

Update according to upstream.
2024-06-10 13:56:59 +02:00
Ben Grande
fcf7fe9623
fix: guarantee a fully updated system on bootstrap
If user just installed Qubes, the full templates can have updates
available. If user restored backups of templates and standalones, they
could also have updates available. Available updates can contain fixes
that if not applied, can make the states fail, such as a buggy salt
package and Qrexec service that can make a state fail in case the
full outdated templates and standalones are responsible for the
functionality specially of management_dispvm, updatevm, default_netvm
and qubes.UpdatesProxy service.
2024-06-09 12:55:48 +02:00
Ben Grande
d2771d5dd6
fix: guarantee states order dependent on browser 2024-06-09 12:50:53 +02:00
Ben Grande
899f7e49b1
fix: add Fedora 40 Firefox desktop file to appmenu
Fixes: https://github.com/ben-grande/qusal/issues/52
2024-06-09 12:36:39 +02:00
Ben Grande
1003d62995
fix: KDE with outdated require id 2024-06-08 06:17:09 +02:00
Ben Grande
c7c85fbcb4
fix: more restrictive Qrexec audio policy 2024-06-07 16:51:43 +02:00
Ben Grande
efc3984df3
feat: allow terminal and file manager choice
The gnome-terminal can't start as root, related to dbus.
2024-06-07 15:27:44 +02:00
Ben Grande
bb384403ad
feat: revive caching of Fedora qubes
- Update with cacher upstream changes;
- Fix README command typos;
- Restore Fedora functionality;
- Update mirror list;
- Move repository definitions to separate files for readability; and
- Add Tailscale and Blackarch repository.
2024-06-07 15:01:16 +02:00
Ben Grande
29601d8df8
doc: refer to video-companion for sys-usb webcam 2024-06-04 19:59:45 +02:00
Ben Grande
8d9ad740a8
fix: correct man-db typo
Fixes: https://github.com/ben-grande/qusal/issues/56
2024-06-04 19:58:36 +02:00
Ben Grande
7873dd8673
fix: remove undesired appmenus from builder qubes 2024-06-04 13:54:48 +02:00
Ben Grande
6e8541672f
feat: add disposable qubes to bitcoin clients 2024-06-04 11:00:06 +02:00
Ben Grande
a4848e1932
fix: update dotfiles module 2024-06-04 10:59:32 +02:00
Ben Grande
34d5d36518
feat: add state for desktop i3 and AwesomeWM 2024-06-04 10:43:16 +02:00
Ben Grande
0c9b173e2c
feat: add Qubes Video Companion formula
Fixes: https://github.com/ben-grande/qusal/issues/49
2024-05-30 16:07:53 +02:00
Ben Grande
bb4dcbbe8f
fix: cacher: restrict install to supported clients
- Enforce uninstall in Fedora, it has been too problematic due to zchunk
  checksum mismatch errors;
- Skip tagging and installing on unsupported qubes, before it tagged
  every template that did not have the tag 'whonix-updatevm', this is
  error prone as it would fail the installation on unsupported clients
  such as Gentoo, Mirage.

Fixes: https://github.com/ben-grande/qusal/issues/54
2024-05-29 18:29:27 +02:00
Ben Grande
9cb7d72044
fix: cacher: use systemd service drop-in directory 2024-05-29 13:56:46 +02:00
Ben Grande
df698b499f
fix: bump Ansible repository codename 2024-05-29 11:35:37 +02:00
Ben Grande
8accc47d99
fix: remove old deb repository list format 2024-05-29 11:34:17 +02:00
Ben Grande
a2e1972389
fix: cache Mozilla and Element repository 2024-05-29 09:55:38 +02:00
Ben Grande
bc8213b8ce
fix: split-gpg2 fedora clashes with debian agent
Fixes: https://github.com/ben-grande/qusal/issues/53
2024-05-28 15:04:20 +02:00
Ben Grande
44ea4c5db2
feat: add manual page reader
Ability to read the program's manual from the terminal is much better
than to ask the user to search the manual page on the internet, we
already trust the installed program and documentation, but we should not
trust every manual page on the internet.
2024-05-28 11:00:04 +02:00
Ben Grande
26a35b838f
feat: add Element formula 2024-05-28 09:57:55 +02:00
Ben Grande
efcf8c7723
fix: unify screenshot tool existence logic
Fixes: https://github.com/ben-grande/qusal/issues/51
2024-05-24 23:30:43 +02:00
Ben Grande
444672e999
fix: prefer maim for screenshot
- Maim causes no errors and has region and window capabilities;
- Scrot region capture puts some weird borders when dragging the mouse;
- Spectacle allows editing but is too feature rich (complicated); and
- Xfce4-screenshooter does not allow selecting both region and window.

Fixes: https://github.com/ben-grande/qusal/issues/51
2024-05-24 22:56:32 +02:00
Ben Grande
b09ecdceb9
feat: add Print formula 2024-05-24 15:39:22 +02:00
Ben Grande
cbf61e674e
feat: add Firefox browser from Mozilla repository 2024-05-24 13:53:17 +02:00
Ben Grande
c8b9bb3198
feat: bump Electrs version 2024-05-23 12:05:12 +02:00
Ben Grande
b2c9479e50
fix: enforce https on repository installation
Previously was just http to allow for caching and non-caching of
packages. Currently, a client tool exists to rewrite repository
definitions.
2024-05-16 18:57:59 +02:00
Ben Grande
d4c3fb11d3
feat: add terraform and chrome fedora repositories 2024-05-16 18:24:03 +02:00
Ben Grande
3adc241500
fix: renew keys and delete expired ones
For: https://github.com/ben-grande/qusal/issues/46
2024-05-15 17:06:26 +02:00
Ben Grande
d1485990e4
doc: nested list indentation 2024-05-14 18:43:07 +02:00
Ben Grande
72f61bbbd9
fix: install fwupd qubes plugin to updatevm 2024-05-11 03:31:49 +02:00
Ben Grande
bfb3026dc1
fix: update mirage firewall version 2024-05-11 02:54:52 +02:00
Ben Grande
972ac77bc2
fix: install libpci by default on sys-net
It is not possible to troubleshoot network module loading without
pciutils. Although it is a troubleshooting tools, it is not
troubleshooting the network, but to make the system itself be able to
load kernel modules and reach the network, therefore necessary.
2024-05-02 19:33:32 +02:00
Ben Grande
18204da1a2
fix: import jinja template to dom0 kde state
Fixes: https://github.com/ben-grande/qusal/issues/50
2024-05-01 03:23:19 +02:00
Ben Grande
5722a25779
fix: discover non-root username at runtime
Useful when Dom0 has the non-default username, less useful for DomUs.

Fixes: https://github.com/ben-grande/qusal/issues/43
2024-04-30 16:04:40 +02:00
Ben Grande
e84959bebb
fix: update fedora mirror list with upstream
Experiment with setting zchunk to false in DNF for Fedora.

Fixes: https://github.com/ben-grande/qusal/issues/47
2024-04-30 14:53:21 +02:00
Ben Grande
760fdd9625
doc: cacher documentation duplicates sections
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-30 14:07:03 +02:00
Ben Grande
bfd7b228c5
fix: incorrect path to repo rewriter service
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-29 23:10:08 +02:00
Ben Grande
234afc3df8
doc: update cacher table of contents 2024-04-26 19:27:52 +02:00
Ben Grande
1ede2e1a1e
fix: allow update check to work on cacher clients
Qubes that have the updates-proxy-service enabled will have the
repository definitions set to work with the proxy, being it a TemplateVM
or another type of qube. Qubes that have that same service disabled and
are based on templates that are being cached, will have the repository
definitions corrected for it to work like normal systems via the
networking instead of caching proxy.

Optimizations were done for a faster runtime, previously it would call
sed 38 times on Fedora-39, now it only calls sed 2 times for Fedora
repositories (one extra for rpmfusion) and some more for PackageKit and
dnf.conf markers. Inexpensive runtime is a must for a script that may
run multiple times, such as when being called by a tool monitoring the
filesystem such as inotify.

Code from /usr/lib/qubes/update-proxy-configs was used for the NetVM use
case of the cacher, thus the license had to be changed.

For: https://github.com/ben-grande/qusal/issues/44
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-26 19:23:14 +02:00
Ben Grande
a6f7d23819
doc: wrong cacher header position 2024-04-25 11:53:47 +02:00
Ben Grande
648bdad04b
fix: remove updatevm tag after DomU uninstallation
For: https://github.com/ben-grande/qusal/issues/41
2024-04-25 11:25:42 +02:00
Ben Grande
7ec71ccf1b
feat: bump Mirage Firewall version 2024-04-24 13:52:20 +02:00
Ben Grande
69745df512
fix: update dotfiles module 2024-04-23 18:37:45 +02:00
Ben Grande
ec7f62f23b
feat: bump Bitcoin version 2024-04-17 09:37:18 +02:00
Ben Grande
63e93be1d4
fix: GUI policy precedes sys-cacher policy
Fixes: https://github.com/ben-grande/qusal/issues/45
2024-04-13 16:17:49 +02:00
Ben Grande
a8e918829d
feat: bump Pi-Hole and Bitcoin version 2024-04-12 18:13:55 +02:00
Ben Grande
084d08f7c5
doc: uninstall cacher client based on tag
For: https://github.com/ben-grande/qusal/issues/41
2024-03-25 12:34:59 +01:00
Ben Grande
fb7db5dc45
fix: browser requires a state and not a package
For: https://github.com/ben-grande/qusal/issues/40
2024-03-25 11:04:54 +01:00
Ben Grande
fcc155f5c7
feat: optional state to autostart AudioVM
Not the default because it is unnecessary to autostart AudioVM as audio
is not necessary for everyone on every boot.

Fixes: https://github.com/ben-grande/qusal/issues/39
2024-03-23 22:18:45 +01:00
Ben Grande
cf88ad1ed4
fix: install salt depends in fedora-39-minimal
Fixes: https://github.com/ben-grande/qusal/issues/38
2024-03-23 22:09:49 +01:00
Ben Grande
81bf77cabe
fix: missing load import
Fixes: https://github.com/ben-grande/qusal/issues/36
2024-03-22 16:45:29 +01:00
Ben Grande
4ac0ec9613
fix: cacher jinja fails to split words
Fixes: https://github.com/ben-grande/qusal/issues/35
2024-03-21 21:52:02 +01:00
Ben Grande
7faf944964
feat: apply URI changes in qube
Very useful for template based qubes to uninstall the cacher definition
to reach remote repository definitions with direct connection.

https://github.com/ben-grande/qusal/issues/31
2024-03-21 21:50:02 +01:00
Ben Grande
9e96d80b52
fix: add missing archlinux mirror 2024-03-21 16:30:36 +01:00
Ben Grande
af27eb131d
fix: wrong port in rsync client forwarder
Fixes: https://github.com/ben-grande/qusal/issues/34
2024-03-21 12:26:00 +01:00
Ben Grande
004cb73dbf
fix: restrict supported screenshot tools 2024-03-20 10:29:44 +01:00
Ben Grande
4097af2aa5
fix: update dotfiles module 2024-03-19 19:59:41 +01:00
Ben Grande
cb59a9a5b3 feat: fetch mirage tarball
Fixes: https://github.com/ben-grande/qusal/issues/32
2024-03-19 17:19:54 +01:00
Ben Grande
f9ead06408 fix: remove extraneous package repository updates
Updates happens multiple times, normally 2 to 3, even if we consider a
state without includes. On states with multiple includes, it could
easily get approximately 10 updates being ran. This behavior leads to
unnecessary network bandwidth being spent and more time to run the
installation state. When the connection is slow and not using the
cacher, such as torified connections on Whonix, the installation can
occurs much faster.

Adding external repositories has to be done prior to update to ensure it
is also fetched.

Fixes: https://github.com/ben-grande/qusal/issues/29
2024-03-18 17:51:36 +01:00
Ben Grande
fc2af9b619 fix: remove colors from output of backup file 2024-03-18 15:26:05 +01:00
Ben Grande
db86c2dc64 feat: bump electrs version 2024-03-15 17:12:14 +01:00
Ben Grande
425748ab9e fix: install screenshot dependencies
Provided in the default Dom0 installation as it brings a much better
usability and small packages.

KDE ships with kdialog but without a screenshot utility.
Xfce ships with xfce4-screenshooter but without a dialog utility.
Scrot and Zenity are minimal tools that works on both DEs and are very
small packages.

Fixes: https://github.com/ben-grande/qusal/issues/22
2024-03-15 11:03:00 +01:00