Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add --configure to sdw-admin script, to replace manual key and config.json configuration steps #942

Open
zenmonkeykstop opened this issue Feb 8, 2024 · 0 comments

Comments

@zenmonkeykstop
Copy link
Contributor

(I think there was talk of GUI installers and such before, but can't see any relevant issues. This is a suggestion for a more lightweight approach.)

Currently prod SDW configuration and installation involves manual attachments of USB keys along with "qvm-run --pass-io" commands to copy files to dom0. The rough flow is as follows:

  1. configure a network-attached VM to download the dom0 rpm, copy and install it
  2. attach the SVS to a non-networked VM, copy the privkey to dom0
  3. attach the JW/AW, copy the JI service details to dom0
  4. (optionally copy the JW/AW keepassxc vault to a vault VM)
  5. copy the key into place and retrieve its fingerprint
  6. create config.json and add in the fingerprint and service details via a text editor
    7 run sdw-admin --validate, then sdw-admin--apply

There is plenty of opportunity for error and frustration in the above, and it should be scriptable. I'd propose something more like:

  1. configure a network-attached VM to download the dom0 rpm, copy and install it (this could be simplified a little but some variation is probably unavoidable as a bootstrapping step)
  2. Run sdw-admin --configure which will:
  3. check for the existence of a valid privkey, and either prompt the user to change it if found or prompt the user to add a new key (guiding through device attachment and validating that the VM chosen is non-networked) directly under /usr/share/...
  4. read config.json if it exists and prompt the user to confirm the values found, or prompt the user to provide new ones (guiding attachment and then reading from the expected location directly)
  5. validate the new values and give the user the option to save and optionally apply them

Desired behaviours (attaching sticks to non-networked VMs etc) could be checked and enforced by the script.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants