View / Edit on GitHub: home/.chezmoiscripts/qubes/run_before_52-ensure-minimal-vms-passwordless.sh.tmpl

Qubes Passwordless Templates

Ensures the minimal templates defined in .qubes.templates in the home/.chezmoidata.yaml file are configured to be passwordless

Overview

This script runs in dom0 and ensures the templates defined in the .qubes.templates data key of home/.chezmoidata.yaml all have the qubes-core-agent-passwordless-root package installed so that they can be provisioned headlessly.

Source Code

{{- if (eq .host.distro.id "qubes") -}}
#!/usr/bin/env bash
# @file Qubes Passwordless Templates
# @brief Ensures the minimal templates defined in `.qubes.templates` in the `home/.chezmoidata.yaml` file are configured to be passwordless
# @description
#     This script runs in dom0 and ensures the templates defined in the `.qubes.templates` data key of `home/.chezmoidata.yaml` all have
#     the `qubes-core-agent-passwordless-root` package installed so that they can be provisioned headlessly.

{{ includeTemplate "universal/profile-before" }}
{{ includeTemplate "universal/logg-before" }}

debianPasswordlessRoot() {
  logg info "Installing qubes-core-agent-passwordless-root on $1"
  qvm-run -u root "$1" apt-get update
  qvm-run -u root "$1" apt-get install -y qubes-core-agent-passwordless-root
  logg success "Successfully installed qubes-core-agent-passwordless-root on $1"
}

fedoraPasswordlessRoot() {
  logg info "Installing qubes-core-agent-passwordless-root on $1"
  qvm-run -u root "$1" dnf install -y qubes-core-agent-passwordless-root
  logg success "Successfully installed qubes-core-agent-passwordless-root on $1"
}

### Ensure Qubes minimal templates have passwordless sudo
for TEMPLATE of {{ .qubes.templates | toString | replace "[" "" | replace "]" "" }}; do
  if [[ "$TEMPLATE" == *'-minimal' ]]; then
    if [[ "$TEMPLATE" == 'debian'* ]] || [[ "$TEMPLATE" == 'ubuntu'* ]]; then
      if [ -n "$DEBUG" ] || [ -n "$DEBUG_MODE" ]; then
        debianPasswordlessRoot "$TEMPLATE"
      else
        debianPasswordlessRoot "$TEMPLATE" &
      fi
    elif [[ "$TEMPLATE" == 'fedora'* ]]; then
      if [ -n "$DEBUG" ] || [ -n "$DEBUG_MODE" ]; then
        fedoraPasswordlessRoot "$TEMPLATE"
      else
        fedoraPasswordlessRoot "$TEMPLATE" &
      fi
    fi
  fi
done

wait
logg success 'Finished installing qubes-core-agent-passwordless-root on minimal templates'
{{ end -}}