Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set menu items for sd-devices and sd-whonix #1112

Merged
merged 1 commit into from
Jul 3, 2024
Merged

Set menu items for sd-devices and sd-whonix #1112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions files/provision-all
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,20 @@ echo "..........................................................................
echo "Provision all SecureDrop Workstation VMs with service-specific configs"
sudo qubesctl --show-output --max-concurrency "$max_concurrency" --skip-dom0 --targets "$all_sdw_vms_target" state.highstate

# Sync appmenus now that all packages are installed
# TODO: this should be done by salt or debs, but we do it manually here because it's
# not straightforward to run a dom0 salt state after VMs run.
# n.b. none of the small VMs are shown in the menu on prod, but nice to have it synced
qvm-start --skip-if-running sd-small-bookworm-template && qvm-sync-appmenus sd-small-bookworm-template \
&& qvm-shutdown sd-small-bookworm-template
qvm-start --skip-if-running sd-large-bookworm-template && qvm-sync-appmenus sd-large-bookworm-template \
&& qvm-shutdown sd-large-bookworm-template
qvm-start --skip-if-running whonix-gateway-17 && qvm-sync-appmenus whonix-gateway-17 \
&& qvm-shutdown whonix-gateway-17
# These are the two ones we show in prod VMs, so sync explicitly
qvm-sync-appmenus --regenerate-only sd-devices
Copy link
Contributor

@rocodes rocodes Jun 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • On systems with 16-24GB of RAM, this could be a lot of running VMs at once (because some of $all_sdw_vms_target are running too); I wonder if we'll run into memory errors. Might be worth it to shut down the templates after, and/or if we have to do this in batches now that we have more dvm templates and named dispvms. Haven't tested, just a thought

  • do we need to check if sd-devices and sd-whonix are running before qvm-sync-appmenus --regenerate-only on them? I know there's no error but I haven't checked if that's a mistake with the script or if it's fine if they're powered off.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be worth it to shut down the templates after

I can add shutdown after each one just in case.

do we need to check if sd-devices and sd-whonix are running before qvm-sync-appmenus --regenerate-only on them? I know there's no error but I haven't checked if that's a mistake with the script or if it's fine if they're powered off.

Because we do --regenerate-only, we don't need to start the VM. My mental model is that this step is just copying the desktop entries from the template VMs list in dom0 (which we just synced) and applying it to the specific AppVM. I'm not sure this is exactly right, but I will add it to the agenda for Tuesday's Qubes sync.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can add shutdown after each one just in case.

I didn't add --wait to qvm-shutdown for speed purposes, if you disagree, I'm totally fine adding it in.

qvm-sync-appmenus --regenerate-only sd-whonix

legoktm marked this conversation as resolved.
Show resolved Hide resolved
echo ".........................................................................."
echo "Add SecureDrop export device handling to sys-usb"
# If sd-fedora-40-dvm exists it's because salt determined that sys-usb was disposable
Expand Down
12 changes: 0 additions & 12 deletions securedrop_salt/sd-app.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,15 +55,3 @@ sd-app-private-volume-size:
qvm-volume resize sd-app:private {{ d.vmsizes.sd_app }}GiB
- require:
- qvm: sd-app

# Ensure the Qubes menu is populated with relevant app entries,
legoktm marked this conversation as resolved.
Show resolved Hide resolved
# so that Nautilus/Files can be started via GUI interactions.
sd-app-template-sync-appmenus:
cmd.run:
- name: >
qvm-start --skip-if-running sd-small-{{ sdvars.distribution }}-template &&
qvm-sync-appmenus --force-root sd-small-{{ sdvars.distribution }}-template
- require:
- qvm: sd-small-{{ sdvars.distribution }}-template
- onchanges:
- qvm: sd-small-{{ sdvars.distribution }}-template
13 changes: 1 addition & 12 deletions securedrop_salt/sd-devices.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,18 +35,6 @@ sd-devices-dvm:
- require:
- qvm: sd-large-{{ sdvars.distribution }}-template

# Ensure the Qubes menu is populated with relevant app entries,
# so that Nautilus/Files can be started via GUI interactions.
sd-devices-template-sync-appmenus:
cmd.run:
- name: >
qvm-start --skip-if-running sd-large-{{ sdvars.distribution }}-template &&
qvm-sync-appmenus --force-root sd-large-{{ sdvars.distribution }}-template
- require:
- qvm: sd-large-{{ sdvars.distribution }}-template
- onchanges:
- qvm: sd-large-{{ sdvars.distribution }}-template

sd-devices-create-named-dispvm:
qvm.vm:
- name: sd-devices
Expand All @@ -64,5 +52,6 @@ sd-devices-create-named-dispvm:
- service.securedrop-mime-handling
- set:
- vm-config.SD_MIME_HANDLING: sd-devices
- menu-items: "org.gnome.Nautilus.desktop org.gnome.DiskUtility.desktop"
- require:
- qvm: sd-devices-dvm
1 change: 1 addition & 0 deletions securedrop_salt/sd-whonix.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,3 +50,4 @@ sd-whonix-config:
- set:
- vm-config.SD_HIDSERV_HOSTNAME: {{ d.hidserv.hostname }}
- vm-config.SD_HIDSERV_KEY: {{ d.hidserv.key }}
- menu-items: "anon_connection_wizard.desktop tor-control-panel.desktop"