install.fairie/home/.chezmoiscripts/universal/run_before_51-install-templates.sh.tmpl
2023-12-25 02:19:52 +00:00

100 lines
4.4 KiB
Cheetah

{{- if (eq .host.distro.id "qubes") -}}
#!/usr/bin/env bash
# @file Qubes Install Templates
# @brief Ensures the templates defined in `.qubes.templates` in the `home/.chezmoidata.yaml` file are installed. It also installs `.qubes.templatesUnofficial`.
# @description
# This script runs in dom0 and ensures the templates defined in `home/.chezmoidata.yaml` are all installed. It also installs `.qubes.templatesUnofficial`.
{{ includeTemplate "universal/profile-before" }}
{{ includeTemplate "universal/logg-before" }}
# @description
# This script first ensures the TemplateVMs are updated and then downloads the Mirage firewall. It configures
# Mirage firewall so it can be used as a unikernel firewall VM.
installMirageFirewall() {
### Ensure mirage-firewall kernel folder setup
if [ ! -d /var/lib/qubes/vm-kernels/mirage-firewall ]; then
logg info 'Creating the /var/lib/qubes/vm-kernels/mirage-firewall directory'
sudo mkdir -p /var/lib/qubes/vm-kernels/mirage-firewall
fi
### Install the mirage-firewall kernel
if [ ! -f /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz ]; then
logg info 'Downloading the pre-compiled mirage firewall kernel in the {{ .qubes.provisionVM }} VM'
qvm-run provision 'curl -sSL {{ .qubes.mirageUrl }} > ~/Downloads/mirage-firewall.tar.gz && tar xjf ~/Downloads/mirage-firewall.tar.gz -C ~/Downloads'
logg info 'Transferring mirage-firewall kernel to dom0 from the {{ .qubes.provisionVM }} VM'
qvm-run --pass-io {{ .qubes.provisionVM }} 'cat /home/user/Downloads/mirage-firewall/vmlinuz' > /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz
fi
### Create dummy initrmfs for the mirage-firewall kernel
if [ ! -f/var/lib/qubes/vm-kernels/mirage-firewall/initramfs ]; then
logg info 'Adding dummy initrmfs file to the mirage-firewall kernel folder'
gzip -n9 < /dev/null > /var/lib/qubes/vm-kernels/mirage-firewall/initramfs
fi
}
# @description
# This script downloads unofficial templates defined in the `.qubes.templatesUnofficial` data key of `home/.chezmoidata.yaml` and then
# installs them in dom0 after transferring the downloads from a temporary Qube used for downloading the templates.
installUnofficialTemplate() {
logg info "Template URL: $1"
TEMPLATE="$(echo "$1" | sed 's/^.*\/\(.*\)-\d+.\d+.\d+-\d+.noarch.rpm$/\1/')"
logg info "Template: $TEMPLATE"
FILE="$(echo "$1" | sed 's/^.*\/\(.*-\d+.\d+.\d+-\d+.noarch.rpm\)$/\1/')"
logg info "File: $FILE"
if [ ! -f "/var/lib/qubes/vm-templates/$TEMPLATE" ]; then
logg info "Downloading the unofficial $TEMPLATE TemplateVM via {{ .qubes.provisionVM }}"
qvm-run --pass-io "{{ .qubes.provisionVM }}" "curl -sSL "$TEMPLATE_URL" -o "/home/Downloads/$FILE""
logg info "Transferring the image to dom0"
qvm-run --pass-io "{{ .qubes.provisionVM }}" "cat /home/Downloads/$FILE" > "/tmp/$FILE"
logg info "Installing the TemplateVM via dnf"
sudo dnf install --nogpgcheck "/tmp/$FILE"
rm -f "/tmp/$FILE"
else
logg info "$TEMPLATE is already installed"
fi
}
# @description
# This script ensures the dom0 Qube VM templates are all up-to-date by using the recommended `qubesctl` command.
# Due to issues with the Whonix Qubes, the update process will timeout after 15 minutes which should be enough time
# for the updates to finish.
updateTemplates() {
### Update TemplateVMs
logg info 'Updating TemplateVMs via qubesctl'
timeout 900 qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm
}
### Ensure Qubes templates exist and download if they are not present
for TEMPLATE of {{ .qubes.templates | toString | replace "[" "" | replace "]" "" }}; do
if [ ! -f "/var/lib/qubes/vm-templates/$TEMPLATE" ]; then
logg info "Installing $TEMPLATE"
if [ -n "$DEBUG" ] || [ -n "$DEBUG_MODE" ]; then
sudo qubes-dom0-update "qubes-template-$TEMPLATE"
else
sudo qubes-dom0-update "qubes-template-$TEMPLATE" &
fi
fi
done
### Ensure unofficial templates are installed
for TEMPLATE_URL of {{ .qubes.templatesUnofficial | toString | replace "[" "" | replace "]" "" }}; do
if [ -n "$DEBUG" ] || [ -n "$DEBUG_MODE" ]; then
installUnofficialTemplate "$TEMPLATE_URL"
else
installUnofficialTemplate "$TEMPLATE_URL" &
fi
done
if [ -n "$DEBUG" ] || [ -n "$DEBUG_MODE" ]; then
installMirageFirewall
else
installMirageFirewall &
fi
wait
logg success 'Finished installing TemplateVMs'
updateTemplates
{{ end -}}