deploy: install template-from-qubesdb in base template and sd-whonix

dom0/qubesdb-config.sls

@@ -0,0 +1,5 @@
+install-template-from-qubesdb:
+  file.managed:
+    - name: /usr/local/bin/template-from-qubesdb
+    - source: "salt://template-from-qubesdb.py"
+    - mode: 755

dom0/sd-workstation.top

@@ -20,6 +20,7 @@ base:
     - sd-remove-unused-templates
 
   sd-base-bookworm-template:
+    - qubesdb-config
     - sd-base-template-files
     - sd-workstation-template-files
   sd-small-bookworm-template:
@@ -39,6 +40,7 @@ base:
     - sd-app-config
     - sd-mime-handling
   sd-whonix:
+    - qubesdb-config
     - sd-whonix-hidserv-key
   'sd-fedora-39-dvm,sys-usb':
     - match: list

files/template-from-qubesdb.py

@@ -0,0 +1,42 @@
+#!/usr/bin/python3
+import argparse
+import string
+
+from qubesdb import QubesDB
+
+
+def get_env(args):
+    env = {}
+    try:
+        db = QubesDB()
+        for key in args or []:
+            value = db.read(f"/vm-config/{key}")
+            if not value or len(value) == 0:
+                raise KeyError(f"Could not read from QubesDB: {key}")
+            env[key] = (value or "").decode()
+
+    finally:
+        db.close()
+
+    return env
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="The input template will be written to the output file, with each variable "
+        "replaced by its value from QubesDB.  If any variable cannot be read from QubesDB, "
+        "templating will fail.  See the documentation on Python's string.Template for details "
+        "(https://docs.python.org/3/library/string.html#template-strings)",
+    )
+    parser.add_argument("input")
+    parser.add_argument("output")
+    args = parser.parse_args()
+
+    with open(args.input) as input_f:
+        template = string.Template(input_f.read())
+
+    env = get_env(template.get_identifiers())  # type: ignore[attr-defined]
+
+    with open(args.output, "w") as output_f:
+        rendered = template.substitute(env)
+        output_f.write(rendered)

rpm-build/SPECS/securedrop-workstation-dom0-config.spec

@@ -105,6 +105,7 @@ install -m 755 files/sdw-notify.py %{buildroot}/%{_bindir}/sdw-notify
 install -m 755 files/sdw-login.py %{buildroot}/%{_bindir}/sdw-login
 install -m 644 files/sdw-notify.service %{buildroot}/%{_userunitdir}/
 install -m 644 files/sdw-notify.timer %{buildroot}/%{_userunitdir}/
+install -m 755 files/template-from-qubesdb.py %{buildroot}/srv/salt/template-from-qubesdb.py
 
 install -m 755 -d %{buildroot}/etc/qubes/policy.d/
 install -m 644 files/31-securedrop-workstation.policy %{buildroot}/etc/qubes/policy.d/
@@ -129,7 +130,9 @@ install -m 755 -d %{buildroot}/opt/securedrop
 /srv/salt/securedrop-*
 /srv/salt/update-xfce-settings
 /srv/salt/fpf*
+/srv/salt/qubesdb-config.sls
 /srv/salt/press.freedom.SecureDropUpdater.desktop
+/srv/salt/template-from-qubesdb.py
 
 %attr(755, root, root) %{_bindir}/sdw-login
 %attr(755, root, root) %{_bindir}/sdw-notify