Monero Wallet/Daemon Isolation with Qubes + Whonix

Community Guides
41

When I upgraded to 4.1, I had some issues using the original setup method I posted here (and the really helpful tweaks posted on this thread), so I thought to make a working method clear since @Mdogg had issues with his.

The setup here is using this method with a fix for 4.1 here and confirmed here:

We need to create wallet and daemon VMs and get them talking to each other. Just get your copy/paste mojo going:

In this example they are named:
monerod - this will be online to allow sync the blockchain.
monero-wallet - this will be isolated with no network.

1. Creating VMs:

In dom0 terminal:
qvm-create --label purple --property netvm=sys-whonix --template whonix-ws-16 monerod

qvm-create --label black --property netvm='' --template whonix-ws-16 monero-wallet

2. In monerod terminal:

Increase volume size to allow for 150Gb (Dec '22) blockchain:
qvm-volume extend monerod:private 175G

Create a systemd file.
sudo nano /home/user/monerod.service

Paste the following contents:

[Unit] 
Description=Monero Full Node 
After=network.target 

[Service] 
User=user 
Group=user 

Type=forking 
PIDFile=/home/user/.bitmonero/monerod.pid 

ExecStart=/usr/bin/monerod --detach --data-dir=/home/user/.bitmonero \ 
    --no-igd --pidfile=/home/user/.bitmonero/monerod.pid \ 
    --log-file=/home/user/.bitmonero/bitmonero.log --p2p-bind-ip=127.0.0.1 

Restart=always 
PrivateTmp=true 

[Install] 
WantedBy=multi-user.target

Tip:
Editing a nano file:
Ctrl+o = save
ENTER
Ctrl+x = close

Make monerod daemon run on startup by editing the file /rw/config/rc.local:
sudo nano /rw/config/rc.local

Add these lines to the bottom:
cp/home/user/monerod.service /lib/systemd/system/
systemctl start monerod.service

Make file executable:
sudo chmod +x /rw/config/rc.local

Create rpc action file:
sudo mkdir /rw/usrlocal/etc/qubes-rpc
sudo nano /rw/usrlocal/etc/qubes-rpc/user.monerod

Add the line:
socat STDIO TCP:localhost:18081

Shutdown monerod:
sudo shutdown now

3. In monero-wallet terminal:

Edit the file /rw/config/rc.local.
sudo nano /rw/config/rc.local

Add the line:
qvm-connect-tcp ::18081 to rc.local

Make file executable:
sudo chmod +x /rw/config/rc.local

Shutdown monero-wallet:
sudo shutdown now

4. In dom0 terminal:

Create a TCP connect policy file:
sudo nano /etc/qubes-rpc/policy/qubes.ConnectTCP

Add the following line:
monero-wallet @default allow,target=monerod

RESTART your system for good luck

Note:
you’ll have to wait for the 150Gb+ blockchain (as of Dec '22) to sync on your system. If you start your wallet before then, you’ll get errors and your brain may melt. But believe me, it’s worth the wait.

5 Likes