gaschz/ansible-qubes
1
0
Fork 0
mirror of https://github.com/Rudd-O/ansible-qubes.git synced 2025-10-31 03:28:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

Explain better and add steps to the Ansible Qubes setup process.

Browse Source
This commit is contained in:
Manuel Amador (Rudd-O) 2017-03-03 15:57:48 +01:00
parent 570cee1204
commit 4bfa9f0121
1 changed files with 51 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
doc/Enhance your Ansible with Ansible Qubes.md
View File

@ -1,8 +1,16 @@
# Enhance your Ansible with Ansible Qubes
This set of instructions assumes that you:
* are running within a Qubes OS system
* have an AppVM already set up (we'll call it `managevm`)
* have cloned this repository into that VM
* have Ansible installed in that VM
* have an Ansible setup already going on within that VM
## Deploy the software to the right places
Integrate this software into your Ansible setup by:
Integrate this software into your Ansible setup (within your `managevm`) VM) by:
1. setting up a `connections_plugin = <directory>` in your `ansible.cfg`
file, pointing it to a directory you control, then
@ -14,6 +22,46 @@ Integrate this software into your Ansible setup by:
* Anywhere on your Ansible machine's `PATH`.
* In a `../../bin` directory relative to the `qubes.py` file.
## Set up the policy file for `qubes.VMShell`
Edit (as `root`) the file `/etc/qubes-rpc/policy/qubes.VMShell`
located on the file system of your `dom0`.
At the top of the file, add the following two lines:
```
managevm $anyvm allow
```
This first line lets `managevm` execute any commands on any VM on your
system. You can also supply an `ask` policy instead of the `allow`
policy specified above. Note that `ask` will make Qubes OS bother you
every time you run commands (and Ansible plays) with the standard
security prompt to allow `qubes.VMShell` on the target VM you're managing.
Now save that file, and exit your editor.
### Optional: allow `managevm` to manage `dom0`
Before the line you added in the previous step, add this line:
```
managevm dom0 allow
```
This line lets `managevm` execute any commands in `dom0`. Be sure you
understand the security implications of such a thing.
The next step is to add the RPC service proper. Edit the file
`/etc/qubes-rpc/qubes.VMShell` to have a single line that contains:
```
exec bash
```
That is it. `dom0` should work now.
## Test `qrun` works
Test that `qrun` does the job. In the VM where you integrated your
@ -25,7 +73,7 @@ path/to/qrun <some VM> hostname
This should immediately return with the hostname of `<some VM>`,
indicating that `qrun` successfully invoked `bombshell-client` on it,
requesting the execution of `hostname` on `exp-net`.
requesting the execution of `hostname` in `<some VM>`.
## Register VMs on your Ansible inventory
@ -43,8 +91,4 @@ vmonremotehost ansible_connection=qubes management_proxy=1.2.3.4
You are now free to run `ansible-playbook` or `ansible` against those hosts.
So long as those programs can find your `ansible.cfg` file, and your `hosts`
file, it will work. Note that Qubes OS will bother you every time you run
commands with the prompt to allow `qubes.VMShell` on the target VM you're
managing, unless you set said permission to default to yes (the pertinent
file to edit is in the `dom0` of the target Qubes OS machine, path
`/etc/qubes-rpc/policy/qubes.VMShell`).
file, it will work.