Ben Grande
e1aed556ed
feat: port forwarder
...
If persistent rules are chosen, it can deal with disposable sys-net, but
not with disposable sys-firewall, as the qube ip will change, the rule
won't work. Applying the rule to the disposable template is a "try it
all", but it's usage is discouraged.
2024-01-16 00:15:29 +01:00
Ben Grande
fb271dcb90
fix: disposable sys-audio name with disp prefix
2024-01-14 14:05:17 +01:00
Ben Grande
583cad97f4
doc: kicksecure missing minimal flavor
2024-01-14 08:52:24 +01:00
Ben Grande
37db49182e
fix: install less browser packages in reader
...
The state browse.install installs extraneous packages that we won't
need for an untrusted environment, such as USB and audio support.
2024-01-12 19:47:52 +01:00
Ben Grande
8e6554bd01
fix: policy file mode not allowing group to write
2024-01-12 19:44:55 +01:00
Ben Grande
6d23871608
fix: sys-usb hide-usb-from-dom0 in keyboard state
2024-01-12 19:08:56 +01:00
Ben Grande
4b59eab882
fix: sys-cacher policy with the new tag name
2024-01-12 18:34:04 +01:00
Ben Grande
94f0fbe6c2
fix: clone macro support for optional argument
2024-01-12 18:22:33 +01:00
Ben Grande
e2ff679849
fix: sys-usb disposables must have name prefix
2024-01-12 18:22:18 +01:00
Ben Grande
f69d17ad35
fix: update dotfiles module
2024-01-12 18:00:40 +01:00
Ben Grande
5805bd79fb
feat: disposable mirage firewall
2024-01-12 17:58:56 +01:00
Ben Grande
e2f44fba70
fix: separate template formula per flavor
...
Default template flavor is Gnome, installing Xfce when requesting the
template formula without flavor causes confusion.
2024-01-12 17:47:21 +01:00
Ben Grande
a380aeb3b6
fix: sys-cacher tag compliance with default tags
...
The default tags start with the capability than the qube name, such as
audiovm-dom0 and guivm-dom0.
2024-01-12 17:30:29 +01:00
Ben Grande
f989908457
fix: zsh state import with relative path
...
Relative path only works well if it is on the salt root.
2024-01-12 17:24:43 +01:00
Ben Grande
efa4013e90
feat: kicksecure minimal template
2024-01-12 17:24:31 +01:00
Ben Grande
cd1786f67d
fix: shellcheck
2024-01-10 14:31:57 +01:00
Ben Grande
3012491615
fix: do not remove created dvm
...
The removal was first implemented to get a clean state of the qube, but
there are side effects, it fails if the user created a named disposable
based on the dvm and also removes the (dvm) entry from the appmenu.
The sys-usb case is a workaround in case the user selected a
non-disposable, an appvm sys-usb during system installation.
2024-01-10 14:27:44 +01:00
Ben Grande
5ec87fe3a8
doc: missing access control for sys-usb
2024-01-10 12:50:02 +01:00
Ben Grande
c76fb42d48
fix: organize sys-usb policy per service
2024-01-10 12:49:20 +01:00
Ben Grande
302460b458
fix: prefer qvm-features for uniformity
2024-01-09 18:48:29 +01:00
Ben Grande
1f42dd26d8
feat: policy support for multiple sys-usb qubes
2024-01-09 18:44:50 +01:00
Ben Grande
e677d9f7e1
doc: cleaner usage sections for qubes-builder
2024-01-08 20:08:54 +01:00
Ben Grande
02e0eb0ece
fix: sys-wireguard compatible with Qubes 4.2
2024-01-08 20:07:20 +01:00
Ben Grande
6e11daa616
fix: rpc service copy to dvm
...
Upstream-commit: 7c37bb7bd65ad3a183790ad07344729504bc0930
2024-01-07 20:20:54 +01:00
Ben Grande
fc37e1b05b
fix: make sys-pihole fully replace sys-firewall
2024-01-05 20:28:27 +01:00
Ben Grande
e8a21ef5a4
feat: allow sys-pihole to use pi-hole for queries
2024-01-05 17:45:04 +01:00
Ben Grande
132431aebd
feat: unattended qubes-builder build
...
Split-gpg2 allows to isolate GPG home directories. In the future,
enforcing this setting via drop-in configuration would be safer, depends
on https://github.com/QubesOS/qubes-issues/issues/8792 .
2024-01-05 17:24:14 +01:00
Ben Grande
6bf6da56fb
feat: passwordless pihole admin interface
...
- Passwordless as it doesn't compromise security;
- Firewall blocks access to the interface in case the pihole is exposed
to the internet;
- setupVars.conf needs to be 644 for non root commands to the pihole
script to work, so the WEB_PASSWORD can be read as normal user,
restricting root on pihole does not make sense, as it can modify the
network setting via pihole web interface.
2024-01-05 16:32:42 +01:00
Ben Grande
d246ff6508
feat: remove extraneous passwordless root
2024-01-05 12:03:23 +01:00
Ben Grande
eff6381f12
fix: add user to mock group
2024-01-05 11:07:27 +01:00
Ben Grande
d88a114db6
feat: default to disposable netvm
...
- Default sys-net and sys-firewall to disposable;
- Set global and per vm preferences by starting the qubes or shutting
down them when necessary; and
- Less manual steps remaining for the user: just rename the net qube, as
it can only be done via Qubes Manager.
2024-01-04 21:59:15 +01:00
Ben Grande
8059435b57
fix: changes default template flavor to Xfce
2024-01-04 18:01:21 +01:00
Ben Grande
e0d62fd12a
fix: do not install net debug tools by default
2024-01-04 17:25:16 +01:00
Ben Grande
2b4fc48cec
doc: sys-audio usage
2024-01-04 15:17:20 +01:00
Ben Grande
a431f4e502
fix: allow to attach mic with sys-audio
2024-01-04 12:20:13 +01:00
Ben Grande
5d00c764bc
refactor: import armored gpg keys instead of db
2024-01-03 21:40:05 +01:00
Ben Grande
5a93e9edda
fix: unconfined qfile-unpacker
...
Upstream-commit: 0648b2329f0d142a2e24ecf376b28603fb04abb4
2024-01-03 14:35:06 +01:00
Ben Grande
ddb2775d52
fix: remove old split-gpg from qubes-builder
2024-01-03 14:29:49 +01:00
Ben Grande
3103100999
fix: sys-audio policy and autostart pacat daemon
2024-01-03 11:47:13 +01:00
Ben Grande
eca10ad7e7
fix: signal state uses idempotent state
2024-01-02 23:03:10 +01:00
Ben Grande
fa22308200
fix: autostart volumeicon
2024-01-02 23:01:58 +01:00
Ben Grande
a434aead8f
feat: qubes-vm-update global settings
2024-01-02 18:04:54 +01:00
Ben Grande
f6cb322f5a
fix: customize sys-whonix
...
- autostart set to false;
- lower vcpus available;
- lower total memory; and
- use state provided by upstream;
2023-12-31 07:52:38 +01:00
Ben Grande
624be831c5
style: client state ID must conform to order
2023-12-31 07:50:03 +01:00
Ben Grande
575691ecdf
fix: pci regain with invalid syntax
2023-12-31 07:49:25 +01:00
Ben Grande
403504da55
fix: install missing packages to audio client
2023-12-31 07:48:29 +01:00
Ben Grande
c3e8baecb7
fix: update dotfiles module
2023-12-28 12:29:09 +01:00
Ben Grande
3d93badbf7
doc: better usage of split-gpg2 in qubes-builder
2023-12-28 12:26:37 +01:00
Ben Grande
9772b2140d
fix: strict split-gpg2 service
...
Split-gpg V1 allowed for querying public keys, but as split-gpg2 is
running as an agent, public keys are not queried. Allowing connection to
the server to query only public parts of the key exposes the server more
than needed to the client.
All clients now have to hold the public key they need locally in order
to do GPG operations.
2023-12-28 11:47:41 +01:00
Ben Grande
47f927f88a
fix: wrong source paths
2023-12-27 23:45:06 +01:00
