#!/bin/bash
# Run in dom0 to allow the "nostr" qube to call n_signer without a Qubes popup.

set -euo pipefail

POLICY_FILE="/etc/qubes/policy.d/40-nsigner.policy"
SIGNER_QUBE="nostr_signer"
CALLER_QUBE="nostr"
SIGNER_TAG="nsigner-signer"

echo "Installing n_signer qrexec policy..."
sudo mkdir -p /etc/qubes/policy.d
sudo tee "$POLICY_FILE" >/dev/null <<EOF
# Qubes OS qrexec policy for nsigner
qubes.NsignerRpc * ai @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
qubes.NsignerRpc * ${CALLER_QUBE} @tag:${SIGNER_TAG} allow target=${SIGNER_QUBE}
qubes.NsignerRpc * @anyvm @tag:${SIGNER_TAG} ask default_target=${SIGNER_QUBE}
qubes.NsignerRpc * @anyvm @anyvm deny
EOF
sudo chmod 0644 "$POLICY_FILE"

echo "Tagging ${SIGNER_QUBE} as ${SIGNER_TAG}..."
qvm-tags "$SIGNER_QUBE" add "$SIGNER_TAG"

echo
echo "Installed policy:"
sudo cat "$POLICY_FILE"
echo
echo "Tags on ${SIGNER_QUBE}:"
qvm-tags "$SIGNER_QUBE" list
echo
echo "Done. Calls from ${CALLER_QUBE} to ${SIGNER_QUBE} are now allowed without a Qubes popup."