fix: install securedrop-whonix-config into whonix-gateway template, n…

…ot sd-whonix

We can do this safely because the securedrop-whonix-config service is
only run when that service is enabled at the Qubes level: i.e., on
sd-whonix and not on sys-whonix, which doesn't have the necessary
QubesDB keys anyway.

dom0/sd-whonix.sls

@@ -34,6 +34,9 @@ sd-whonix:
       - add:
         - sd-workstation
         - sd-{{ sdvars.distribution }}
+    - features:
+      - enable:
+        - service.securedrop-whonix-config
     - require:
       - sls: sd-upgrade-templates
       - sls: sd-sys-whonix-vms

dom0/sd-workstation.top

@@ -36,8 +36,6 @@ base:
     - sd-gpg-files
   sd-app:
     - sd-mime-handling
-  sd-whonix:
-    - sd-whonix-config
   'sd-fedora-39-dvm,sys-usb':
     - match: list
     - sd-usb-autoattach-add
@@ -47,6 +45,8 @@ base:
     - sd-mime-handling
   sd-proxy:
     - sd-mime-handling
+  whonix-gateway-17:
+    - sd-whonix-config
 
   # "Placeholder" config to trigger TemplateVM boots,
   # so upgrades can be applied automatically via cron.