Fix over indented code blocks
This commit is contained in:
parent
0824b2d196
commit
752f1d4ddc
|
@ -49,7 +49,9 @@ Security Notes
|
||||||
2. Select `Terminal Emulator`.
|
2. Select `Terminal Emulator`.
|
||||||
3. In the window that opens, enter this command:
|
3. In the window that opens, enter this command:
|
||||||
|
|
||||||
|
```
|
||||||
sudo nano /etc/yum.repos.d/qubes-dom0.repo
|
sudo nano /etc/yum.repos.d/qubes-dom0.repo
|
||||||
|
```
|
||||||
|
|
||||||
4. This opens the nano text editor. Change all four instances of `http` to `https`.
|
4. This opens the nano text editor. Change all four instances of `http` to `https`.
|
||||||
5. Press `CTRL+X`, then `Y`, then `ENTER` to save changes and exit.
|
5. Press `CTRL+X`, then `Y`, then `ENTER` to save changes and exit.
|
||||||
|
@ -61,8 +63,10 @@ Security Notes
|
||||||
2. Select `Template: fedora-26`, then `fedora-26: Terminal`.
|
2. Select `Template: fedora-26`, then `fedora-26: Terminal`.
|
||||||
3. In the window that opens, enter the command for your version:
|
3. In the window that opens, enter the command for your version:
|
||||||
|
|
||||||
|
```
|
||||||
[Qubes 3.2] sudo gedit /etc/yum.repos.d/qubes-r3.repo
|
[Qubes 3.2] sudo gedit /etc/yum.repos.d/qubes-r3.repo
|
||||||
[Qubes 4.0] sudo gedit /etc/yum.repos.d/qubes-r4.repo
|
[Qubes 4.0] sudo gedit /etc/yum.repos.d/qubes-r4.repo
|
||||||
|
```
|
||||||
|
|
||||||
4. This opens the gedit text editor in a window. Change all four instances of `http` to `https`.
|
4. This opens the gedit text editor in a window. Change all four instances of `http` to `https`.
|
||||||
5. Click the "Save" button in the top-right corner of the window.
|
5. Click the "Save" button in the top-right corner of the window.
|
||||||
|
|
|
@ -32,13 +32,17 @@ Inside the TemplateBasedVM.
|
||||||
|
|
||||||
1. Make sure folder `/rw/config/qubes-bind-dirs.d` exists.
|
1. Make sure folder `/rw/config/qubes-bind-dirs.d` exists.
|
||||||
|
|
||||||
|
```
|
||||||
sudo mkdir -p /rw/config/qubes-bind-dirs.d
|
sudo mkdir -p /rw/config/qubes-bind-dirs.d
|
||||||
|
```
|
||||||
|
|
||||||
2. Create a file `/rw/config/qubes-bind-dirs.d/50_user.conf` with root rights.
|
2. Create a file `/rw/config/qubes-bind-dirs.d/50_user.conf` with root rights.
|
||||||
|
|
||||||
3. Edit the file 50_user.conf to append a folder or file name to the `binds` variable.
|
3. Edit the file 50_user.conf to append a folder or file name to the `binds` variable.
|
||||||
|
|
||||||
|
```
|
||||||
binds+=( '/var/lib/tor' )
|
binds+=( '/var/lib/tor' )
|
||||||
|
```
|
||||||
|
|
||||||
4. Save.
|
4. Save.
|
||||||
|
|
||||||
|
|
|
@ -73,9 +73,11 @@ state of the system with the administrator's configuration/desires.
|
||||||
The smallest unit of configuration is a state.
|
The smallest unit of configuration is a state.
|
||||||
A state is written in YAML and looks like this:
|
A state is written in YAML and looks like this:
|
||||||
|
|
||||||
|
```
|
||||||
stateid:
|
stateid:
|
||||||
cmd.run: #this is the execution module. in this case it will execute a command on the shell
|
cmd.run: #this is the execution module. in this case it will execute a command on the shell
|
||||||
- name: echo 'hello world' #this is a parameter of the state.
|
- name: echo 'hello world' #this is a parameter of the state.
|
||||||
|
```
|
||||||
|
|
||||||
The stateid has to be unique throughout all states running for a minion and can
|
The stateid has to be unique throughout all states running for a minion and can
|
||||||
be used to order the execution of the references state.
|
be used to order the execution of the references state.
|
||||||
|
@ -96,6 +98,7 @@ With these three states you can define most of the configuration of a VM.
|
||||||
|
|
||||||
You can also [order the execution][salt-doc-states-order] of your states:
|
You can also [order the execution][salt-doc-states-order] of your states:
|
||||||
|
|
||||||
|
```
|
||||||
D:
|
D:
|
||||||
cmd.run:
|
cmd.run:
|
||||||
- name: echo 1
|
- name: echo 1
|
||||||
|
@ -114,6 +117,7 @@ You can also [order the execution][salt-doc-states-order] of your states:
|
||||||
cmd.run:
|
cmd.run:
|
||||||
- name: echo 1
|
- name: echo 1
|
||||||
- order: 1
|
- order: 1
|
||||||
|
```
|
||||||
|
|
||||||
The order of execution will be `A, B, C, D`.
|
The order of execution will be `A, B, C, D`.
|
||||||
The official documentation has more details on the
|
The official documentation has more details on the
|
||||||
|
@ -132,10 +136,12 @@ After you have several state files, you need something to assign them to a VM.
|
||||||
This is done by `*.top` files ([official documentation][salt-doc-top]).
|
This is done by `*.top` files ([official documentation][salt-doc-top]).
|
||||||
Their structure looks like this:
|
Their structure looks like this:
|
||||||
|
|
||||||
|
```
|
||||||
environment:
|
environment:
|
||||||
target_matching_clause:
|
target_matching_clause:
|
||||||
- statefile1
|
- statefile1
|
||||||
- folder2.statefile2
|
- folder2.statefile2
|
||||||
|
```
|
||||||
|
|
||||||
In most cases, the environment will be called `base`.
|
In most cases, the environment will be called `base`.
|
||||||
The `target_matching_clause` will be used to select your minions (VMs).
|
The `target_matching_clause` will be used to select your minions (VMs).
|
||||||
|
@ -143,10 +149,12 @@ It can be either the name of a VM or a regular expression.
|
||||||
If you are using a regular expressions, you need to give Salt a hint you are
|
If you are using a regular expressions, you need to give Salt a hint you are
|
||||||
doing so:
|
doing so:
|
||||||
|
|
||||||
|
```
|
||||||
environment:
|
environment:
|
||||||
^app-(work|(?!mail).*)$:
|
^app-(work|(?!mail).*)$:
|
||||||
- match: pcre
|
- match: pcre
|
||||||
- statefile
|
- statefile
|
||||||
|
```
|
||||||
|
|
||||||
For each target you can write a list of state files.
|
For each target you can write a list of state files.
|
||||||
Each line is a path to a state file (without the `.sls` extension) relative to
|
Each line is a path to a state file (without the `.sls` extension) relative to
|
||||||
|
@ -220,6 +228,7 @@ You can also use the `qubes` pillar module to select VMs with a particular
|
||||||
property (see below).
|
property (see below).
|
||||||
If you do so, then you need to pass additional arguments to the `qubesctl` tool:
|
If you do so, then you need to pass additional arguments to the `qubesctl` tool:
|
||||||
|
|
||||||
|
```
|
||||||
usage: qubesctl [-h] [--show-output] [--force-color] [--skip-dom0]
|
usage: qubesctl [-h] [--show-output] [--force-color] [--skip-dom0]
|
||||||
[--targets TARGETS | --templates | --app | --all]
|
[--targets TARGETS | --templates | --app | --all]
|
||||||
...
|
...
|
||||||
|
@ -237,6 +246,7 @@ If you do so, then you need to pass additional arguments to the `qubesctl` tool:
|
||||||
--templates Target all templates
|
--templates Target all templates
|
||||||
--app Target all AppVMs
|
--app Target all AppVMs
|
||||||
--all Target all non-disposable VMs (TemplateVMs and AppVMs)
|
--all Target all non-disposable VMs (TemplateVMs and AppVMs)
|
||||||
|
```
|
||||||
|
|
||||||
To apply a state to all templates, call `qubesctl --templates state.highstate`.
|
To apply a state to all templates, call `qubesctl --templates state.highstate`.
|
||||||
|
|
||||||
|
@ -269,6 +279,7 @@ Beginning with Qubes 4.0 and after [QSB #45], we implemented two changes:
|
||||||
|
|
||||||
Let's start with a quick example:
|
Let's start with a quick example:
|
||||||
|
|
||||||
|
```
|
||||||
my new and shiny VM:
|
my new and shiny VM:
|
||||||
qvm.present:
|
qvm.present:
|
||||||
- name: salt-test # can be omitted when same as ID
|
- name: salt-test # can be omitted when same as ID
|
||||||
|
@ -278,6 +289,7 @@ Let's start with a quick example:
|
||||||
- vcpus: 4
|
- vcpus: 4
|
||||||
- flags:
|
- flags:
|
||||||
- proxy
|
- proxy
|
||||||
|
```
|
||||||
|
|
||||||
It uses the Qubes-specific `qvm.present` state, which ensures that the domain is
|
It uses the Qubes-specific `qvm.present` state, which ensures that the domain is
|
||||||
present (if not, it creates it).
|
present (if not, it creates it).
|
||||||
|
@ -297,9 +309,11 @@ As you will notice, the options are the same (or very similar) to those used in
|
||||||
This should be put in `/srv/salt/my-new-vm.sls` or another `.sls` file.
|
This should be put in `/srv/salt/my-new-vm.sls` or another `.sls` file.
|
||||||
A separate `*.top` file should be also written:
|
A separate `*.top` file should be also written:
|
||||||
|
|
||||||
|
```
|
||||||
base:
|
base:
|
||||||
dom0:
|
dom0:
|
||||||
- my-new-vm
|
- my-new-vm
|
||||||
|
```
|
||||||
|
|
||||||
**Note** The third line should contain the name of the previous state file,
|
**Note** The third line should contain the name of the previous state file,
|
||||||
without the `.sls` extension.
|
without the `.sls` extension.
|
||||||
|
@ -322,15 +336,19 @@ Lets make sure that the `mc` package is installed in all templates.
|
||||||
Similar to the previous example, you need to create a state file
|
Similar to the previous example, you need to create a state file
|
||||||
(`/srv/salt/mc-everywhere.sls`):
|
(`/srv/salt/mc-everywhere.sls`):
|
||||||
|
|
||||||
|
```
|
||||||
mc:
|
mc:
|
||||||
pkg.installed: []
|
pkg.installed: []
|
||||||
|
```
|
||||||
|
|
||||||
Then the appropriate top file (`/srv/salt/mc-everywhere.top`):
|
Then the appropriate top file (`/srv/salt/mc-everywhere.top`):
|
||||||
|
|
||||||
|
```
|
||||||
base:
|
base:
|
||||||
qubes:type:template:
|
qubes:type:template:
|
||||||
- match: pillar
|
- match: pillar
|
||||||
- mc-everywhere
|
- mc-everywhere
|
||||||
|
```
|
||||||
|
|
||||||
Now you need to enable the top file:
|
Now you need to enable the top file:
|
||||||
|
|
||||||
|
@ -354,16 +372,19 @@ As in the example above, it creates a domain and sets its properties.
|
||||||
|
|
||||||
You can set properties of an existing domain:
|
You can set properties of an existing domain:
|
||||||
|
|
||||||
|
```
|
||||||
my preferences:
|
my preferences:
|
||||||
qvm.prefs:
|
qvm.prefs:
|
||||||
- name: salt-test2
|
- name: salt-test2
|
||||||
- netvm: sys-firewall
|
- netvm: sys-firewall
|
||||||
|
```
|
||||||
|
|
||||||
***Note*** The `name:` option will not change the name of a domain, it will only
|
***Note*** The `name:` option will not change the name of a domain, it will only
|
||||||
be used to match a domain to apply the configurations to it.
|
be used to match a domain to apply the configurations to it.
|
||||||
|
|
||||||
### `qvm.service`
|
### `qvm.service`
|
||||||
|
|
||||||
|
```
|
||||||
services in my domain:
|
services in my domain:
|
||||||
qvm.service:
|
qvm.service:
|
||||||
- name: salt-test3
|
- name: salt-test3
|
||||||
|
@ -375,6 +396,7 @@ be used to match a domain to apply the configurations to it.
|
||||||
- service4
|
- service4
|
||||||
- default:
|
- default:
|
||||||
- service5
|
- service5
|
||||||
|
```
|
||||||
|
|
||||||
This enables, disables, or sets to default, services as in `qvm-service`.
|
This enables, disables, or sets to default, services as in `qvm-service`.
|
||||||
|
|
||||||
|
@ -382,9 +404,11 @@ This enables, disables, or sets to default, services as in `qvm-service`.
|
||||||
|
|
||||||
Ensures the specified domain is running:
|
Ensures the specified domain is running:
|
||||||
|
|
||||||
|
```
|
||||||
domain is running:
|
domain is running:
|
||||||
qvm.running:
|
qvm.running:
|
||||||
- name: salt-test4
|
- name: salt-test4
|
||||||
|
```
|
||||||
|
|
||||||
## Virtual Machine Formulae
|
## Virtual Machine Formulae
|
||||||
|
|
||||||
|
@ -567,9 +591,11 @@ Having the `-p` flag is important when using a state with `cmd.run`.
|
||||||
If you install multiple templates you may encounter this error.
|
If you install multiple templates you may encounter this error.
|
||||||
The solution is to shut down the updateVM between each install:
|
The solution is to shut down the updateVM between each install:
|
||||||
|
|
||||||
|
```
|
||||||
install template and shutdown updateVM:
|
install template and shutdown updateVM:
|
||||||
cmd.run:
|
cmd.run:
|
||||||
- name: sudo qubes-dom0-update -y fedora-24; qvm-shutdown {% raw %}{{ salt.cmd.run(qubes-prefs updateVM) }}{% endraw %}
|
- name: sudo qubes-dom0-update -y fedora-24; qvm-shutdown {% raw %}{{ salt.cmd.run(qubes-prefs updateVM) }}{% endraw %}
|
||||||
|
```
|
||||||
|
|
||||||
## Further Reading
|
## Further Reading
|
||||||
|
|
||||||
|
|
|
@ -30,10 +30,12 @@ When backing up dom0 using the Qubes backup tool (explained below), only the hom
|
||||||
Therefore, if there are files outside of the home directory you wish to save, you should copy them into the home directory prior to creating a backup.
|
Therefore, if there are files outside of the home directory you wish to save, you should copy them into the home directory prior to creating a backup.
|
||||||
Here is an example of how to back up Qubes config files and RPC policies:
|
Here is an example of how to back up Qubes config files and RPC policies:
|
||||||
|
|
||||||
|
```
|
||||||
$ mkdir -p ~/backup/etc/qubes/
|
$ mkdir -p ~/backup/etc/qubes/
|
||||||
$ cp -a /etc/qubes/* ~/backup/etc/qubes/
|
$ cp -a /etc/qubes/* ~/backup/etc/qubes/
|
||||||
$ mkdir ~/backup/etc/qubes-rpc/
|
$ mkdir ~/backup/etc/qubes-rpc/
|
||||||
$ cp -a /etc/qubes-rpc/* ~/systemfiles/etc/qubes-rpc/
|
$ cp -a /etc/qubes-rpc/* ~/systemfiles/etc/qubes-rpc/
|
||||||
|
```
|
||||||
|
|
||||||
To restore these files, move them from the restored directory in dom0's home back to their appropriate locations in `/etc/`.
|
To restore these files, move them from the restored directory in dom0's home back to their appropriate locations in `/etc/`.
|
||||||
Please note that any packages installed via the package manager in dom0 will not be backed up.
|
Please note that any packages installed via the package manager in dom0 will not be backed up.
|
||||||
|
|
|
@ -15,6 +15,7 @@ Passwordless Root Access in VMs
|
||||||
|
|
||||||
Background (`/etc/sudoers.d/qubes` in VM):
|
Background (`/etc/sudoers.d/qubes` in VM):
|
||||||
|
|
||||||
|
```
|
||||||
user ALL=(ALL) NOPASSWD: ALL
|
user ALL=(ALL) NOPASSWD: ALL
|
||||||
|
|
||||||
# WTF?! Have you lost your mind?!
|
# WTF?! Have you lost your mind?!
|
||||||
|
@ -60,6 +61,7 @@ Background (`/etc/sudoers.d/qubes` in VM):
|
||||||
# be seen by the xinput program...)
|
# be seen by the xinput program...)
|
||||||
#
|
#
|
||||||
# joanna.
|
# joanna.
|
||||||
|
```
|
||||||
|
|
||||||
Below is a complete list of configuration made according to the above statement, with (not necessary complete) list of mechanisms depending on each of them:
|
Below is a complete list of configuration made according to the above statement, with (not necessary complete) list of mechanisms depending on each of them:
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user