Update .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_12-update-dom0, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_11-update-timezone, .local/share/chezmoi/system/etc/yum.repos.d/qubes-dom0.repo, .local/share/chezmoi/system/etc/qubes/repo-templates/qubes-templates.repo, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_13-install-official-templates, .local/share/chezmoi/home/.chezmoidata.yaml, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_14-ensure-minimal-vms-passwordless, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_15-install-unofficial-templates, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_16-update-template-vms, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_17-install-mirage-firewall, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_18-configure-sys-usb, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_19-setup-sys-gui, .local/share/chezmoi/system/etc/grub.d/31-hold-shift, .local/share/chezmoi/system/etc/default/modify_grub, .local/share/chezmoi/system/.chezmoidata.yaml, .local/share/chezmoi/system/.chezmoiexternal.toml, .local/share/chezmoi/system/usr/share/run_onchange_after_setup-share-folder, .local/share/chezmoi/system/boot/efi/EFI/qubes/modify_grubenv, .local/share/chezmoi/system/etc/sddm.conf, .local/share/chezmoi/system/etc/modify_environment
2022-12-06 00:59:10 -08:00
|
|
|
#!/usr/bin/env bash
|
2023-04-12 18:44:59 -07:00
|
|
|
# @file Qubes Mirage Firewall
|
|
|
|
|
# @brief Ensures the Mirage firewall kernel VM is installed in dom0
|
|
|
|
|
# @description
|
|
|
|
|
# This script first ensures the TemplateVMs are updated and then downloads the Mirage firewall. It configures
|
|
|
|
|
# Mirage firewall so it can be used as a unikernel firewall VM.
|
|
|
|
|
|
|
|
|
|
### Update TemplateVMs
|
|
|
|
|
logg info 'Updating TemplateVMs via `qubesctl`'
|
|
|
|
|
timeout 900 qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm
|
Update .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_12-update-dom0, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_11-update-timezone, .local/share/chezmoi/system/etc/yum.repos.d/qubes-dom0.repo, .local/share/chezmoi/system/etc/qubes/repo-templates/qubes-templates.repo, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_13-install-official-templates, .local/share/chezmoi/home/.chezmoidata.yaml, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_14-ensure-minimal-vms-passwordless, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_15-install-unofficial-templates, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_16-update-template-vms, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_17-install-mirage-firewall, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_18-configure-sys-usb, .local/share/chezmoi/home/.chezmoiscripts/qubes/run_onchange_before_19-setup-sys-gui, .local/share/chezmoi/system/etc/grub.d/31-hold-shift, .local/share/chezmoi/system/etc/default/modify_grub, .local/share/chezmoi/system/.chezmoidata.yaml, .local/share/chezmoi/system/.chezmoiexternal.toml, .local/share/chezmoi/system/usr/share/run_onchange_after_setup-share-folder, .local/share/chezmoi/system/boot/efi/EFI/qubes/modify_grubenv, .local/share/chezmoi/system/etc/sddm.conf, .local/share/chezmoi/system/etc/modify_environment
2022-12-06 00:59:10 -08:00
|
|
|
|
|
|
|
|
### Ensure mirage-firewall kernel folder setup
|
|
|
|
|
if [ ! -d /var/lib/qubes/vm-kernels/mirage-firewall ]; then
|
|
|
|
|
logg info 'Creating the /var/lib/qubes/vm-kernels/mirage-firewall directory'
|
|
|
|
|
sudo mkdir -p /var/lib/qubes/vm-kernels/mirage-firewall
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
### Install the mirage-firewall kernel
|
|
|
|
|
if [ ! -f /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz ]; then
|
|
|
|
|
logg info 'Downloading the pre-compiled mirage firewall kernel in the {{ .qubes.provisionVM }} VM'
|
|
|
|
|
qvm-run provision 'curl -sSL {{ .qubes.mirageUrl }} > ~/Downloads/mirage-firewall.tar.gz && tar xjf ~/Downloads/mirage-firewall.tar.gz -C ~/Downloads'
|
|
|
|
|
logg info 'Transferring mirage-firewall kernel to dom0 from the {{ .qubes.provisionVM }} VM'
|
|
|
|
|
qvm-run --pass-io {{ .qubes.provisionVM }} 'cat /home/user/Downloads/mirage-firewall/vmlinuz' > /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
### Create dummy initrmfs for the mirage-firewall kernel
|
|
|
|
|
if [ ! -f/var/lib/qubes/vm-kernels/mirage-firewall/initramfs ]; then
|
|
|
|
|
logg info 'Adding dummy initrmfs file to the mirage-firewall kernel folder'
|
|
|
|
|
gzip -n9 < /dev/null > /var/lib/qubes/vm-kernels/mirage-firewall/initramfs
|
|
|
|
|
fi
|