From a6b6ddbdbe56a103374f7600c3c36f55adbad710 Mon Sep 17 00:00:00 2001 From: Casper Date: Mon, 23 Dec 2024 10:30:47 -0700 Subject: implemented split-browser for web qubes --- README.html | 396 ----------------------------------- README.md | 107 ++++++++++ README.org | 87 -------- dots/i3-config | 3 + web/create-web-qubes.top | 9 +- web/qvm-app.sls | 137 ++++++------ web/qvm-tmpl.sls | 5 + web/tmpl-configure-split-firefox.sls | 11 + web/tmpl-pkgs.sls | 35 ++-- web/tmpl-split-pkgs.sls | 13 ++ 10 files changed, 238 insertions(+), 565 deletions(-) delete mode 100644 README.html create mode 100644 README.md delete mode 100644 README.org create mode 100644 web/tmpl-configure-split-firefox.sls create mode 100644 web/tmpl-split-pkgs.sls diff --git a/README.html b/README.html deleted file mode 100644 index 36ea874..0000000 --- a/README.html +++ /dev/null @@ -1,396 +0,0 @@ - - - - - - - -README - - - - -
-

README

-
-

Installation

-
-
-
-

Setup salt user-dirs

-
-
-
# In dom0
-sudo qubesctl state.sls qubes.user-dirs
-
-
- -

-I sometimes run into the issue described here on a new install: https://github.com/QubesOS/qubes-issues/issues/8491. The solution that works consistantly for me is: -

- -
-
# In dom0
-ln -s /srv/salt/qubes/user-dirs.top /srv/salt/_tops/base/user-dirs.top
-
-
-
-
-
-

Clone my repo

-
-

-Open a terminal in some networked app qube (with git installed!), and clone my repository: -

- -
-
# In dispXXXX
-git clone https://git.skylarcloud.xyz/salt-repo.git
-
-
-
-
-
-

Move it to dom0

-
-

-First, we’ll turn the repo into an archive with tar: -

- -
-
# In dispXXXX
-tar -cf /tmp/salt-archive.tar salt-repo
-
-
- -

-Then, in dom0: -

- -
-
# in dom0
-# Pulls the content of the archive from dispXXXX to dom0
-sudo qvm-run --pass-io dispXXXX 'cat /tmp/salt-archive.tar' > /tmp/salt-archive.tar
-
-# Unpack the archive
-sudo cd /tmp && tar -xf salt-archive.tar
-
-# Delete the default /srv/user_salt directory
-# Make sure you haven't put anything important there
-sudo rm -fr /srv/user_salt
-
-# Move the repo to /srv/user_salt
-sudo mv /tmp/salt-repo /srv/user_salt
-
-
-
-
-
-

Change your username

-
-

-There’s a variable in /wm/wm-setup.sls that you should change to match your username. That file needs to write files to your home directory in dom0, and needs the username for those paths. -

-
-
-
-

Apply the configuration

-
-

-There are many directories with .sls and .top files inside of them. You can enable a feature and apply it with just a couple commands: -

- -
-
# In dom0
-sudo qubesctl top.enable wm.wm-setup # This enables the top file at /srv/user_salt/wm/wm-setup.top
-sudo qubesctl state.apply # Applies dom0 states
-sudo qubesctl --targets=tmpl-XXXX # Applies dom0 states and states for tmpl-XXXX
-
-
-
-
-
-
-

Features

-
-
-
-

3isec

-
-

-Sets up the 3isec repository and graphical installer. This has lots of handy states I use for various utilities. -

-
-
-
-

Chromium

-
-

-Creates tmpl-chromium and web-yt. I usually avoid Chromium, but YouTube performs better on it than Librewolf, so I use it for that site. -

- -

-Blueman is installed in tmpl-chromium so it’s easy to pass your bluetooth controller to web-yt and listen with bluetooth headphones. -

-
-
-
-

Emacs

-
-

-Creates tmpl-emacs and two app qubes, emacs-org and emacs-salt, with Doom Emacs’ dependencies. I do all of my personal organization in Emacs org-mode, and emacs-salt is for editing my saltstack configuration. -

- -

-It also places two scripts in dom0, /usr/bin/fetch-salt-from-emacs and /usr/bin/push-salt-to-emacs. Run these as root in dom0 to easily move your repo back and forth as you please. -

-
-
-
-

Email

-
-

-Creates tmpl-email and two app qubes, email-personal and email-work, with Thunderbird. -

-
-
-
-

IRC

-
-

-Creates tmpl-irc and irc with Hexchat installed, for chatting on IRC over Tor. -

-
-
-
-

SSH

-
-

-Creates tmpl-ssh and ssh-vps, simple qubes to ssh into my VPS with. -

-
-
-
-

Torrenting

-
-

-Creates tmpl-torrenting and bitz with qBitTorrent installed, for torrenting. Route this qube’s traffic through a VPN if you plan on downloading anything illegal. -

-
-
-
-

Web

-
-

-Creates tmpl-web and a few web-XXX qubes, with Librewolf. -

-
-
-
-

WM

-
-

-This does many things to set up a convenient i3 environment. -

-
    -
  • Installs a few packages in dom0
  • -
  • Moves my i3 config into place
  • -
  • Prioritizes xfce4-terminal and st in /usr/bin/qubes-i3-sensible-terminal
  • -
  • Moves my xrandr screenlayout in place
  • -
  • Moves my nitrogen wallpaper files in place
  • -
  • Enables tap-to-click and natural scrolling
  • -
  • Replaces dmenu with rofi
  • -
-
-
-
-
-
-

Created: 2024-12-19 Thu 11:15

-
- - diff --git a/README.md b/README.md new file mode 100644 index 0000000..996e888 --- /dev/null +++ b/README.md @@ -0,0 +1,107 @@ +# Installation + +## Setup salt user-dirs + + # In dom0 + sudo qubesctl state.sls qubes.user-dirs + +I sometimes run into the issue described here on a new install: . The solution that works consistantly for me is: + + # In dom0 + ln -s /srv/salt/qubes/user-dirs.top /srv/salt/_tops/base/user-dirs.top + +## Clone my repo + +Open a terminal in some networked app qube (with git installed!), and clone my repository: + + # In dispXXXX + git clone https://git.skylarcloud.xyz/salt-repo.git + +## Move it to dom0 + +First, we'll turn the repo into an archive with tar: + + # In dispXXXX + tar -cf /tmp/salt-archive.tar salt-repo + +Then, in dom0: + + # in dom0 + # Pulls the content of the archive from dispXXXX to dom0 + sudo qvm-run --pass-io dispXXXX 'cat /tmp/salt-archive.tar' > /tmp/salt-archive.tar + + # Unpack the archive + sudo cd /tmp && tar -xf salt-archive.tar + + # Delete the default /srv/user_salt directory + # Make sure you haven't put anything important there + sudo rm -fr /srv/user_salt + + # Move the repo to /srv/user_salt + sudo mv /tmp/salt-repo /srv/user_salt + +## Change your username + +There's a variable in */wm/wm-setup.sls* that you should change to match your username. That file needs to write files to your home directory in dom0, and needs the username for those paths. + +## Apply the configuration + +There are many directories with .sls and .top files inside of them. You can enable a feature and apply it with just a couple commands: + + # In dom0 + sudo qubesctl top.enable wm.wm-setup # This enables the top file at /srv/user_salt/wm/wm-setup.top + sudo qubesctl state.apply # Applies dom0 states + sudo qubesctl --targets=tmpl-XXXX # Applies dom0 states and states for tmpl-XXXX + +# Features + +## 3isec + +Sets up the 3isec repository and graphical installer. This has lots of handy states I use for various utilities. + +## Chromium + +Creates *tmpl-chromium* and *web-yt*. I usually avoid Chromium, but YouTube performs better on it than Librewolf, so I use it for that site. + +Blueman is installed in *tmpl-chromium* so it’s easy to pass your bluetooth controller to *web-yt* and listen with bluetooth headphones. + +## Emacs + +Creates *tmpl-emacs* and two app qubes, *emacs-org* and *emacs-salt*, with Doom Emacs’ dependencies. I do all of my personal organization in Emacs org-mode, and *emacs-salt* is for editing my saltstack configuration. + +It also places two scripts in dom0, */usr/bin/fetch-salt-from-emacs* and */usr/bin/push-salt-to-emacs*. Run these as root in dom0 to easily move your repo back and forth as you please. + +## Email + +Creates *tmpl-email* and two app qubes, *email-personal* and *email-work*, with Thunderbird. + +## IRC + +Creates *tmpl-irc* and *irc* with Hexchat installed, for chatting on IRC over Tor. + +## SSH + +Creates *tmpl-ssh* and *ssh-vps*, simple qubes I use to ssh into my VPS with. + +## Torrenting + +Creates *tmpl-torrenting* and *bitz* with qBitTorrent installed, for torrenting. Route this qube's traffic through a VPN if you plan on downloading anything frowned upon in your jurisdicion (copyrighted movies for example). + +## Web + +This uses the *split-browser* package to securely store bookmarks and logins for use in disposable qubes. It creates *tmpl-web*, *web-dvm*, *tmpl-split-web*, and *split-web*, then sets them up for use with *split-browser*. + +Instructions on its use are here: https://github.com/rustybird/qubes-app-split-browser + +Other than *split-browser*, Firefox has no modifications. If you want to configure it permanently, for now you'll need to open it in *web-dvm*, make your configurations (themes, extensions, settings), then new disposables will inherit those modifications. + +## WM + +This does many things to set up a convenient i3 environment. + +- Installs a few packages in dom0 +- Moves my i3 config into place +- Prioritizes xfce4-terminal and st in */usr/bin/qubes-i3-sensible-terminal* +- Enables tap-to-click and natural scrolling +- Replaces dmenu with rofi + diff --git a/README.org b/README.org deleted file mode 100644 index fd078e8..0000000 --- a/README.org +++ /dev/null @@ -1,87 +0,0 @@ -#+title: README -#+OPTIONS: num:nil toc:nil -* Installation -** Setup salt user-dirs - #+begin_src bash -# In dom0 -sudo qubesctl state.sls qubes.user-dirs - #+end_src - - I sometimes run into the issue described here on a new install: https://github.com/QubesOS/qubes-issues/issues/8491. The solution that works consistantly for me is: - - #+begin_src bash -# In dom0 -ln -s /srv/salt/qubes/user-dirs.top /srv/salt/_tops/base/user-dirs.top -#+end_src -** Clone my repo -Open a terminal in some networked app qube (with git installed!), and clone my repository: - -#+begin_src bash -# In dispXXXX -git clone https://git.skylarcloud.xyz/salt-repo.git -#+end_src -** Move it to dom0 -First, we'll turn the repo into an archive with tar: - -#+begin_src bash -# In dispXXXX -tar -cf /tmp/salt-archive.tar salt-repo -#+end_src - -Then, in dom0: - -#+begin_src bash -# in dom0 -# Pulls the content of the archive from dispXXXX to dom0 -sudo qvm-run --pass-io dispXXXX 'cat /tmp/salt-archive.tar' > /tmp/salt-archive.tar - -# Unpack the archive -sudo cd /tmp && tar -xf salt-archive.tar - -# Delete the default /srv/user_salt directory -# Make sure you haven't put anything important there -sudo rm -fr /srv/user_salt - -# Move the repo to /srv/user_salt -sudo mv /tmp/salt-repo /srv/user_salt -#+end_src -** Change your username - There's a variable in //wm/wm-setup.sls/ that you should change to match your username. That file needs to write files to your home directory in dom0, and needs the username for those paths. -** Apply the configuration -There are many directories with .sls and .top files inside of them. You can enable a feature and apply it with just a couple commands: - -#+begin_src bash -# In dom0 -sudo qubesctl top.enable wm.wm-setup # This enables the top file at /srv/user_salt/wm/wm-setup.top -sudo qubesctl state.apply # Applies dom0 states -sudo qubesctl --targets=tmpl-XXXX # Applies dom0 states and states for tmpl-XXXX -#+end_src - -* Features -** 3isec -Sets up the 3isec repository and graphical installer. This has lots of handy states I use for various utilities. -** Chromium -Creates /tmpl-chromium/ and /web-yt/. I usually avoid Chromium, but YouTube performs better on it than Librewolf, so I use it for that site. - -Blueman is installed in /tmpl-chromium/ so it's easy to pass your bluetooth controller to /web-yt/ and listen with bluetooth headphones. -** Emacs -Creates /tmpl-emacs/ and two app qubes, /emacs-org/ and /emacs-salt/, with Doom Emacs' dependencies. I do all of my personal organization in Emacs org-mode, and /emacs-salt/ is for editing my saltstack configuration. - -It also places two scripts in dom0, //usr/bin/fetch-salt-from-emacs/ and //usr/bin/push-salt-to-emacs/. Run these as root in dom0 to easily move your repo back and forth as you please. -** Email -Creates /tmpl-email/ and two app qubes, /email-personal/ and /email-work/, with Thunderbird. -** IRC -Creates /tmpl-irc/ and /irc/ with Hexchat installed, for chatting on IRC over Tor. -** SSH -Creates /tmpl-ssh/ and /ssh-vps/, simple qubes to ssh into my VPS with. -** Torrenting -Creates /tmpl-torrenting/ and /bitz/ with qBitTorrent installed, for torrenting. Route this qube's traffic through a VPN if you plan on downloading anything illegal. -** Web -Creates /tmpl-web/ and a few /web-XXX/ qubes, with Librewolf. -** WM -This does many things to set up a convenient i3 environment. -- Installs a few packages in dom0 -- Moves my i3 config into place -- Prioritizes xfce4-terminal and st in //usr/bin/qubes-i3-sensible-terminal/ -- Enables tap-to-click and natural scrolling -- Replaces dmenu with rofi diff --git a/dots/i3-config b/dots/i3-config index 616b756..8c0de8a 100644 --- a/dots/i3-config +++ b/dots/i3-config @@ -275,6 +275,9 @@ bar { # Avoids screen size fingerprinting for_window [title="Tor Browser"] floating enable +# Make any instance of rofi float +for_window [title="rofi"] floating enable + # Make sure all xdg autostart entries are started, this is (among other things) # necessary to make sure transient vm's come up exec --no-startup-id qubes-i3-xdg-autostart diff --git a/web/create-web-qubes.top b/web/create-web-qubes.top index 445ebc1..7d134e9 100644 --- a/web/create-web-qubes.top +++ b/web/create-web-qubes.top @@ -1,6 +1,9 @@ user: dom0: - - web.qvm-app - - web.qvm-tmpl + - web.qvm-tmpl # Creates tmpl-web, tmpl-split-web + - web.qvm-app # Creates web-dvm, split-web tmpl-web: - - web.tmpl-pkgs + - web.tmpl-pkgs # Installs tmpl-web pkgs + - web.tmpl-configure-split-firefox # Configures split-browser for FF + tmpl-split-web: + - web.tmpl-split-pkgs # Installs tmpl-split-web pkgs diff --git a/web/qvm-app.sls b/web/qvm-app.sls index 0d77f90..6d49a07 100644 --- a/web/qvm-app.sls +++ b/web/qvm-app.sls @@ -1,6 +1,6 @@ -web--create-browsing-qube: +web--create-web-qube: qvm.vm: - - name: browsing-dvm + - name: web-dvm - present: - template: tmpl-web - label: yellow @@ -8,87 +8,94 @@ web--create-browsing-qube: - template_for_dispvms: True - features: - set: - - menu-items: librewolf.desktop + - menu-items: xfce4-terminal.desktop - require: - qvm: web--create-template -browsing-features_dvm: +web-features_dvm: qvm.features: - - name: browsing-dvm + - name: web-dvm - disable: - service.cups - service.cups-browsed - service.tinyproxy - set: - - menu-items: librewolf.desktop + - menu-items: xfce4-terminal.desktop - appmenus-dispvm: True -web--create-vps-admin-qube: +split-web--create-qube: qvm.vm: - - name: web-vps-admin + - name: split-web - present: - - template: tmpl-web - - label: blue + - template: tmpl-split-web + - label: gray - prefs: - - label: blue + - default-dispvm: web-dvm + - netvm: none - features: - set: - - menu-items: librewolf.desktop + - menu-items: split-browser.desktop xterm.desktop - require: - - qvm: web--create-template + - web--create-split-template -web--create-home-admin-qube: - qvm.vm: - - name: web-home-admin - - present: - - template: tmpl-web - - label: blue - - prefs: - - label: blue - - features: - - set: - - menu-items: librewolf.desktop - - require: - - qvm: web--create-template +# web--create-vps-admin-qube: +# qvm.vm: +# - name: web-vps-admin +# - present: +# - template: tmpl-web +# - label: blue +# - features: +# - set: +# - menu-items: librewolf.desktop +# - require: +# - qvm: web--create-template -web--create-banking-qube: - qvm.vm: - - name: web-banking - - present: - - template: tmpl-web - - label: blue - - prefs: - - label: blue - - features: - - set: - - menu-items: librewolf.desktop - - require: - - qvm: web--create-template +# web--create-home-admin-qube: +# qvm.vm: +# - name: web-home-admin +# - present: +# - template: tmpl-web +# - label: blue +# - features: +# - set: +# - menu-items: librewolf.desktop +# - require: +# - qvm: web--create-template -web--create-work-qube: - qvm.vm: - - name: web-work - - present: - - template: tmpl-web - - label: blue - - prefs: - - label: blue - - features: - - set: - - menu-items: librewolf.desktop - - require: - - qvm: web--create-template +# web--create-banking-qube: +# qvm.vm: +# - name: web-banking +# - present: +# - template: tmpl-web +# - label: blue +# - features: +# - set: +# - menu-items: librewolf.desktop +# - require: +# - qvm: web--create-template -web--create-shopping-qube: - qvm.vm: - - name: web-shopping - - present: - - template: tmpl-web - - label: blue - - prefs: - - label: blue - - features: - - set: - - menu-items: librewolf.desktop - - require: - - qvm: web--create-template +# web--create-work-qube: +# qvm.vm: +# - name: web-work +# - present: +# - template: tmpl-web +# - label: blue +# - mem: 6000 +# - vcpus: 4 +# - features: +# - set: +# - menu-items: librewolf.desktop +# - require: +# - qvm: web--create-template + +# web--create-shopping-qube: +# qvm.vm: +# - name: web-shopping +# - present: +# - template: tmpl-web +# - label: blue +# - features: +# - set: +# - menu-items: librewolf.desktop +# - require: +# - qvm: web--create-template diff --git a/web/qvm-tmpl.sls b/web/qvm-tmpl.sls index 1a06153..4aa9730 100644 --- a/web/qvm-tmpl.sls +++ b/web/qvm-tmpl.sls @@ -2,3 +2,8 @@ web--create-template: qvm.clone: - name: tmpl-web - source: debian-12-minimal + +web--create-split-template: + qvm.clone: + - name: tmpl-split-web + - source: debian-12-xfce # TODO make this a minimal template diff --git a/web/tmpl-configure-split-firefox.sls b/web/tmpl-configure-split-firefox.sls new file mode 100644 index 0000000..f740622 --- /dev/null +++ b/web/tmpl-configure-split-firefox.sls @@ -0,0 +1,11 @@ +# Split-browser tries to use torbrowser by default, so we'll disable it +split-web--disable-tor-browser: + cmd.run: + - name: 'mv /etc/split-browser-disp/21-tor-browser.bash /etc/split-browser-disp/21-tor-browser.bash.EXAMPLE' + - creates: '/etc/split-browser-disp/21-tor-browser.bash.EXAMPLE' + +# Enabling the firefox config so split-browser knows where to find the executable +split-web--enable-firefox: + cmd.run: + - name: 'mv /etc/split-browser-disp/22-firefox.bash.EXAMPLE /etc/split-browser-disp/22-firefox.bash' + - creates: '/etc/split-browser-disp/22-firefox.bash' diff --git a/web/tmpl-pkgs.sls b/web/tmpl-pkgs.sls index f02112a..245d7ee 100644 --- a/web/tmpl-pkgs.sls +++ b/web/tmpl-pkgs.sls @@ -1,3 +1,8 @@ +web--tmpl-split-browser-pkgs: + pkg.installed: + - pkgs: + - qubes-repo-contrib + web--tmpl-pkgs: pkg.installed: - pkgs: @@ -6,25 +11,27 @@ web--tmpl-pkgs: - qubes-core-agent-networking - qubes-core-agent-thunar - pulseaudio-qubes + - qubes-split-browser-disp + - firefox-esr -{% if grains['os_family']|lower == 'debian' %} +# {% if grains['os_family']|lower == 'debian' %} -extrepo: - pkg.installed +# extrepo: +# pkg.installed -'http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable librewolf': - cmd.run +# 'http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable librewolf': +# cmd.run -{% else %} +# {% else %} -'dnf config-manager --add-repo https://rpm.librewolf.net/librewolf-repo.repo': - cmd.run +# 'dnf config-manager --add-repo https://rpm.librewolf.net/librewolf-repo.repo': +# cmd.run -{% endif %} +# {% endif %} -librewolf-updated: - pkg.uptodate: - - refresh: True +# librewolf-updated: +# pkg.uptodate: +# - refresh: True -librewolf: - pkg.installed +# librewolf: +# pkg.installed diff --git a/web/tmpl-split-pkgs.sls b/web/tmpl-split-pkgs.sls new file mode 100644 index 0000000..9903014 --- /dev/null +++ b/web/tmpl-split-pkgs.sls @@ -0,0 +1,13 @@ +split-web--contrib-repo: + pkg.installed: + - pkgs: + - qubes-repo-contrib + +split-web--pkgs: + pkg.installed: + - pkgs: + - qubes-split-browser + # - qubes-core-agent-passwordless-root + # - qubes-mgmt-salt-vm-connector + # - qubes-core-agent-thunar + # - qubes-desktop-linux-common -- cgit v1.2.3