qusal/salt/sys-cacher/create.sls
Ben Grande 422b01e0f6 feat: remove audiovm setting when unnecessary
Decrease audio attack surface to qubes that will never need to use it.
2024-01-20 19:34:39 +01:00

105 lines
2.2 KiB
Plaintext

{#
SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{%- from "qvm/template.jinja" import load -%}
include:
- .clone
{% load_yaml as defaults -%}
name: tpl-{{ slsdotpath }}
force: True
require:
- sls: {{ slsdotpath }}.clone
prefs:
- audiovm: ""
- vcpus: 1
- memory: 300
- maxmem: 500
- autostart: False
- include_in_backups: False
features:
- disable:
- service.cups
- service.cups-browsed
- service.tracker
- service.evolution-data-server
- set:
- menu-items: "cacher-browser.desktop qubes-run-terminal.desktop qubes-start.desktop"
- default-menu-items: "cacher-browser.desktop qubes-run-terminal.desktop qubes-start.desktop"
{%- endload %}
{{ load(defaults) }}
{% load_yaml as defaults -%}
name: {{ slsdotpath }}
force: True
require:
- sls: {{ slsdotpath }}.clone
present:
- template: tpl-{{ slsdotpath }}
- label: gray
prefs:
- template: tpl-{{ slsdotpath }}
- label: gray
- audiovm: ""
## Disable memory balooning because of HTTP 503: Cannot allocate memory
- maxmem: 0
- memory: 500
- vcpus: 1
- provides-network: true
- autostart: False
- include_in_backups: True
features:
- enable:
- servicevm
- disable:
- service.cups
- service.cups-browsed
- service.tinyproxy
- service.meminfo-writer
- set:
- menu-items: "cacher-browser.desktop qubes-run-terminal.desktop qubes-start.desktop"
{%- endload %}
{{ load(defaults) }}
{% load_yaml as defaults -%}
name: {{ slsdotpath }}-browser
force: true
require:
- sls: {{ slsdotpath }}.clone
present:
- template: tpl-browser
- label: gray
prefs:
- template: tpl-browser
- label: gray
- netvm: ""
- audiovm: ""
- vcpus: 1
- memory: 300
- maxmem: 500
- autostart: False
- include_in_backups: False
features:
- disable:
- service.cups
- service.cups-browsed
- service.tracker
- service.evolution-data-server
- set:
- menu-items: "cacher-browser.desktop qubes-run-terminal.desktop qubes-start.desktop"
{%- endload %}
{{ load(defaults) }}
{% from 'utils/macros/policy.sls' import policy_set with context -%}
{{ policy_set(sls_path, '75') }}
"{{ slsdotpath }}-extend-volume":
cmd.run:
- name: qvm-volume extend {{ slsdotpath }}:private 20Gi
- require:
- qvm: {{ slsdotpath }}