100 lines
3.0 KiB
Bash
Executable File
100 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 01-dom0-create-proxyvm.sh
|
|
#
|
|
# Run this script in dom0 to create the sys-fips ProxyVM.
|
|
#
|
|
# Usage (in dom0):
|
|
# sudo bash 01-dom0-create-proxyvm.sh [template] [upstream_netvm]
|
|
#
|
|
# Arguments:
|
|
# template TemplateVM to base on (default: debian-12)
|
|
# upstream_netvm Upstream NetVM (default: sys-firewall, can be sys-vpn)
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
TEMPLATE="${1:-debian-12}"
|
|
UPSTREAM_NETVM="${2:-sys-firewall}"
|
|
VM_NAME="sys-fips"
|
|
VM_LABEL="blue"
|
|
|
|
echo "=== sys-fips ProxyVM Creation ==="
|
|
echo ""
|
|
echo " VM Name: $VM_NAME"
|
|
echo " Template: $TEMPLATE"
|
|
echo " Upstream NetVM: $UPSTREAM_NETVM"
|
|
echo " Label: $VM_LABEL"
|
|
echo ""
|
|
|
|
# Check if VM already exists
|
|
if qvm-check "$VM_NAME" 2>/dev/null; then
|
|
echo "⚠ VM '$VM_NAME' already exists."
|
|
echo " To recreate, first remove it:"
|
|
echo " qvm-shutdown $VM_NAME"
|
|
echo " qvm-remove $VM_NAME"
|
|
exit 1
|
|
fi
|
|
|
|
# Verify template exists
|
|
if ! qvm-check "$TEMPLATE" 2>/dev/null; then
|
|
echo "✗ Template '$TEMPLATE' does not exist."
|
|
echo " Available templates:"
|
|
qvm-ls --raw-list --fields name,klass | grep TemplateVM | awk '{print " " $1}'
|
|
exit 1
|
|
fi
|
|
|
|
# Verify upstream netvm exists
|
|
if ! qvm-check "$UPSTREAM_NETVM" 2>/dev/null; then
|
|
echo "✗ Upstream NetVM '$UPSTREAM_NETVM' does not exist."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Creating ProxyVM..."
|
|
|
|
# Create as AppVM + provides_network=True => ProxyVM behavior
|
|
qvm-create "$VM_NAME" \
|
|
--class AppVM \
|
|
--template "$TEMPLATE" \
|
|
--label "$VM_LABEL" \
|
|
--prop provides_network=True \
|
|
--prop netvm="$UPSTREAM_NETVM"
|
|
|
|
echo "✓ Created $VM_NAME"
|
|
|
|
# Memory defaults (lightweight baseline)
|
|
qvm-prefs "$VM_NAME" memory 512
|
|
qvm-prefs "$VM_NAME" maxmem 2048
|
|
echo "✓ Memory: 512MB initial, 2048MB max"
|
|
|
|
# Ensure networking prefs
|
|
qvm-prefs "$VM_NAME" netvm "$UPSTREAM_NETVM"
|
|
qvm-prefs "$VM_NAME" provides_network True
|
|
echo "✓ NetVM: $UPSTREAM_NETVM"
|
|
echo "✓ provides_network: True"
|
|
|
|
echo ""
|
|
echo "=== sys-fips Created Successfully ==="
|
|
echo ""
|
|
echo "Network chain examples:"
|
|
echo " AppVM -> sys-fips -> sys-firewall -> sys-net -> Internet"
|
|
echo " AppVM -> sys-fips -> sys-vpn -> sys-firewall -> sys-net -> Internet"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo ""
|
|
echo " 1) Start the VM:"
|
|
echo " qvm-start $VM_NAME"
|
|
echo ""
|
|
echo " 2) Copy FIPS binaries (from your build AppVM):"
|
|
echo " qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fips"
|
|
echo " qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fipsctl"
|
|
echo " qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fipstop"
|
|
echo ""
|
|
echo " 3) Copy this setup directory:"
|
|
echo " qvm-copy-to-vm $VM_NAME /home/user/anvil/fips_setup/"
|
|
echo ""
|
|
echo " 4) In sys-fips terminal run:"
|
|
echo " cd ~/QubesIncoming/*/fips_setup/scripts/"
|
|
echo " sudo bash 02-install-fips.sh"
|
|
echo " bash 03-configure-identity.sh"
|
|
echo " sudo bash 04-start-fips.sh"
|