Ben Grande
a380aeb3b6
fix: sys-cacher tag compliance with default tags
...
The default tags start with the capability than the qube name, such as
audiovm-dom0 and guivm-dom0.
2024-01-12 17:30:29 +01:00
Ben Grande
f989908457
fix: zsh state import with relative path
...
Relative path only works well if it is on the salt root.
2024-01-12 17:24:43 +01:00
Ben Grande
efa4013e90
feat: kicksecure minimal template
2024-01-12 17:24:31 +01:00
Ben Grande
cd1786f67d
fix: shellcheck
2024-01-10 14:31:57 +01:00
Ben Grande
3012491615
fix: do not remove created dvm
...
The removal was first implemented to get a clean state of the qube, but
there are side effects, it fails if the user created a named disposable
based on the dvm and also removes the (dvm) entry from the appmenu.
The sys-usb case is a workaround in case the user selected a
non-disposable, an appvm sys-usb during system installation.
2024-01-10 14:27:44 +01:00
Ben Grande
5ec87fe3a8
doc: missing access control for sys-usb
2024-01-10 12:50:02 +01:00
Ben Grande
c76fb42d48
fix: organize sys-usb policy per service
2024-01-10 12:49:20 +01:00
Ben Grande
302460b458
fix: prefer qvm-features for uniformity
2024-01-09 18:48:29 +01:00
Ben Grande
1f42dd26d8
feat: policy support for multiple sys-usb qubes
2024-01-09 18:44:50 +01:00
Ben Grande
e677d9f7e1
doc: cleaner usage sections for qubes-builder
2024-01-08 20:08:54 +01:00
Ben Grande
02e0eb0ece
fix: sys-wireguard compatible with Qubes 4.2
2024-01-08 20:07:20 +01:00
Ben Grande
6e11daa616
fix: rpc service copy to dvm
...
Upstream-commit: 7c37bb7bd65ad3a183790ad07344729504bc0930
2024-01-07 20:20:54 +01:00
Ben Grande
fc37e1b05b
fix: make sys-pihole fully replace sys-firewall
2024-01-05 20:28:27 +01:00
Ben Grande
e8a21ef5a4
feat: allow sys-pihole to use pi-hole for queries
2024-01-05 17:45:04 +01:00
Ben Grande
132431aebd
feat: unattended qubes-builder build
...
Split-gpg2 allows to isolate GPG home directories. In the future,
enforcing this setting via drop-in configuration would be safer, depends
on https://github.com/QubesOS/qubes-issues/issues/8792 .
2024-01-05 17:24:14 +01:00
Ben Grande
6bf6da56fb
feat: passwordless pihole admin interface
...
- Passwordless as it doesn't compromise security;
- Firewall blocks access to the interface in case the pihole is exposed
to the internet;
- setupVars.conf needs to be 644 for non root commands to the pihole
script to work, so the WEB_PASSWORD can be read as normal user,
restricting root on pihole does not make sense, as it can modify the
network setting via pihole web interface.
2024-01-05 16:32:42 +01:00
Ben Grande
d246ff6508
feat: remove extraneous passwordless root
2024-01-05 12:03:23 +01:00
Ben Grande
eff6381f12
fix: add user to mock group
2024-01-05 11:07:27 +01:00
Ben Grande
d88a114db6
feat: default to disposable netvm
...
- Default sys-net and sys-firewall to disposable;
- Set global and per vm preferences by starting the qubes or shutting
down them when necessary; and
- Less manual steps remaining for the user: just rename the net qube, as
it can only be done via Qubes Manager.
2024-01-04 21:59:15 +01:00
Ben Grande
8059435b57
fix: changes default template flavor to Xfce
2024-01-04 18:01:21 +01:00
Ben Grande
e0d62fd12a
fix: do not install net debug tools by default
2024-01-04 17:25:16 +01:00
Ben Grande
2b4fc48cec
doc: sys-audio usage
2024-01-04 15:17:20 +01:00
Ben Grande
a431f4e502
fix: allow to attach mic with sys-audio
2024-01-04 12:20:13 +01:00
Ben Grande
5d00c764bc
refactor: import armored gpg keys instead of db
2024-01-03 21:40:05 +01:00
Ben Grande
5a93e9edda
fix: unconfined qfile-unpacker
...
Upstream-commit: 0648b2329f0d142a2e24ecf376b28603fb04abb4
2024-01-03 14:35:06 +01:00
Ben Grande
ddb2775d52
fix: remove old split-gpg from qubes-builder
2024-01-03 14:29:49 +01:00
Ben Grande
3103100999
fix: sys-audio policy and autostart pacat daemon
2024-01-03 11:47:13 +01:00
Ben Grande
eca10ad7e7
fix: signal state uses idempotent state
2024-01-02 23:03:10 +01:00
Ben Grande
fa22308200
fix: autostart volumeicon
2024-01-02 23:01:58 +01:00
Ben Grande
a434aead8f
feat: qubes-vm-update global settings
2024-01-02 18:04:54 +01:00
Ben Grande
f6cb322f5a
fix: customize sys-whonix
...
- autostart set to false;
- lower vcpus available;
- lower total memory; and
- use state provided by upstream;
2023-12-31 07:52:38 +01:00
Ben Grande
624be831c5
style: client state ID must conform to order
2023-12-31 07:50:03 +01:00
Ben Grande
575691ecdf
fix: pci regain with invalid syntax
2023-12-31 07:49:25 +01:00
Ben Grande
403504da55
fix: install missing packages to audio client
2023-12-31 07:48:29 +01:00
Ben Grande
c3e8baecb7
fix: update dotfiles module
2023-12-28 12:29:09 +01:00
Ben Grande
3d93badbf7
doc: better usage of split-gpg2 in qubes-builder
2023-12-28 12:26:37 +01:00
Ben Grande
9772b2140d
fix: strict split-gpg2 service
...
Split-gpg V1 allowed for querying public keys, but as split-gpg2 is
running as an agent, public keys are not queried. Allowing connection to
the server to query only public parts of the key exposes the server more
than needed to the client.
All clients now have to hold the public key they need locally in order
to do GPG operations.
2023-12-28 11:47:41 +01:00
Ben Grande
47f927f88a
fix: wrong source paths
2023-12-27 23:45:06 +01:00
Ben Grande
7cb1d4b605
fix: update dotfiles module
2023-12-27 20:05:41 +01:00
Ben Grande
c6a0dcc8de
fix: modify package names to match Qubes 4.2
2023-12-27 20:00:15 +01:00
Ben Grande
83f7584596
fix: regain pci script not managed
2023-12-27 19:58:01 +01:00
Ben Grande
c6bbf095e9
fix: port forwarder script with custom rc
2023-12-26 20:15:57 +01:00
Ben Grande
09f65ddcfe
fix: browser cli install tool switches to fetcher
2023-12-26 19:53:59 +01:00
Ben Grande
a622960296
refactor: pihole nft rules for Qubes 4.2
2023-12-26 19:50:31 +01:00
Ben Grande
6eb63057ec
fix: pihole lighttpd link
2023-12-24 21:23:29 +01:00
Ben Grande
7e93d5aa04
feat: clockvm also present in sys-pihole
2023-12-23 21:05:24 +01:00
Ben Grande
a663616583
feat: move clockvm out of sys-net to sys-firewall
2023-12-21 23:38:39 +01:00
Ben Grande
f161fbf49f
fix: dom0 qrexec call target qube
2023-12-21 22:38:32 +01:00
Ben Grande
b6c5298cb9
refactor: git Qrexec helper with drop-in commands
...
Drop-in scripts can complement the remote-helper ability.
Basic trace of the communication of git with the helper.
2023-12-21 15:38:16 +01:00
Ben Grande
f8e21e9ee2
fix: update dotfiles module
2023-12-21 15:09:52 +01:00
