Rc file / configuration automatin inheritance from template to app vms

General Discussion
1

/rw/config/rc.conf.d contains scripts that should be run during vm start.
This folder is persistent for each vm.

I’m curious if there is a recommended way to create rc scripts that will be located in Template vm and will be executed in each AppVM on the start.

I see something like this to be very handy for config file update. If I use one common TemplateVM to work on many different projects in separate AppVM, I need simple way to update my vim config file without copying same config into 5-10 VM individually.

Just placing files in TemplateVM will not work for me, ass some apps wants configs in /home/user/.<fancy app name> or in other user folder.

1 Like
2

Not in the template vm, but you can keep your scripts in a configuration management system, such as salt or ansible.

For example, you could write your vim configuration as a state in /srv/user_salt/, control its application in the top file:

app-devel:
  - configure_vim

and then apply it using qubesctl:

# qubesctl --skip-dom0 --targets app-devel state.apply

Regarding this specifically you can put files in /etc/skel, but that is only applied on AppVM creation.

3 Likes
3

I have a not-so-clean way of doing it via a systemd unit in the TemplateVM (enabled for the Template and all AppVMs) that launches this script:

#!/bin/bash

set -x

RC_ARCHIVE=/usr/share/rc.tgz

su user -c "cd; tar -xvf $RC_ARCHIVE"

And I store my dotfiles in /usr/share/rc.tgz on the Template.

2 Likes
4

There’s also the “vm-config” way, see this guide.

Note that the payload can be base64/base32 encoded (or uuencoded, old-school; or xxd etc.) so you can transfer anything up to a few hundreds of kilobytes** and decode on the target AppVM/DispVM.

** if memory serves well. I tested and used this method in R4.2 and did not re-use the trick in R4.3

EDIT: fixed typo and added base64 because that’s what I meant and used.

2 Likes
5

I would like to learn how to use ansible to automate qubes vm management.
I did several attempts to do it, yet not a single one succeeded.
Even watched https://www.youtube.com/watch?v=Mqa-LBxObdY but it did not helped much. Probably I need to dig into forum for a few days to find out more about it or may be some merciful people can give me a link to a guide to go with.

6

I’ve ended up with systemd method.
Sims to be the simplest one.

/etc/systemd/system/config-my-system.service

[Unit]
Description=Configure my aps
After=local-fs.target

[Service]
User=<qubes user name>
Type=oneshot
ExecStart=<path to config script>

RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Also one important thing for the future generations.
Moving service file or script might make selinux unhappy on Fedora.
If you are not able to enable service with systemctl enable config-my-system try to do
sudo restorecon -v /etc/systemd/system/config-my-system.service
sudo systemctl daemon-reload might be helpful as well.

1 Like
7

Indeed. It’s also good practice to move and copy files with the -Z flag when SELinux is enabled, so e.g. cp -rZ source dest

1 Like
8

recommended - theoretically, one could provide a single rc file in a app-vm that executes all other rc files, located in another directory.

If you point it towards /usr/share, or anything else provided by the template, you’d have your central, template managed, rc scripts.

2 Likes
9

Hey! I am working on a simple to use salt module that does this exact thing (and does it in a clean fashion)! To my surprise the implementation was a bit trickier but manageable (I got a beta version implemented already working on my machine).

Right now it would be great if you could give it a look and tell me what you think!

1 Like
10

And the cool thing about this idea is that it can be implemented both in salt and in ansible

11

Not sure what you tried, repository readme and examples seem sufficient at the first glance:

What problems did you encounter?

2 Likes
12

Thanks for sharing.
I saw README, but as I remember, it was half a year or year ago, I got stuck on Management VM.
I did not figure out how to make it and gave up.

I will try one more time. Probably I should have not gave up so easily.