Add BIOS update instructions.

docs/index.rst

@@ -82,6 +82,7 @@ anonymous sources.
    kernel_troubleshooting
    getting_support
    v3_services
+   update_bios
 
 .. toctree::
    :caption: Upgrade SecureDrop

docs/update_bios.rst

@@ -0,0 +1,53 @@
+BIOS Updates
+============
+
+Below are the steps for updating the BIOS on the app and mon servers. You can also follow these steps to update the BIOS on your computer, such as the Admin Workstation Computer.
+
+What you need
+~~~~~~~~~~~~~
+
+  #. A clean USB device to download the ``.bio`` file
+  #. An internet-connected workstation, such as the *Admin Workstation*
+  #. A UPS (uninterrupted power supply), such as a surge-protecting power supply with a backup battery
+  #. A keyboard and mouse to plug into the servers (you can skip this if you are updating a laptop.)
+
+Perform Backups
+~~~~~~~~~~~~~~~
+
+Before performing any updates on the servers, we recommend you :doc:`back up the app server <backup_and_restore>`.
+
+Preparing the USB Stick
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Using the Disks program, delete existing partitions on the USB device, if applicable, and reformat the entire device with one EXT4 partition. You do not need to set a passphrase or encryption on this device. Note that you will lose access to all existing data on this USB stick.
+
+Download and Verify Appropriate .bio Files
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+  .. note:: We will be following the F7 BIOS update method, `as documented by Intel (available as a PDF)`_.
+
+Check the make and model of your servers and proceed to the Intel Download Centre to download the correct file. Each make and model of Intel NUC will offer various file types; select the ``.bio`` option.
+
+  .. warning:: Do not download BIOS updates from anywhere other than the manufacturer's website. Be sure that you are `on the correct website`_ and that it has a valid SSL Certificate. Intel's SSL Certificate is issued to \*.intel.com and signed by DigiCert. Be sure you download the files specific to the model of your servers.
+
+Intel provides an md5 checksum on the download page. Once you have downloaded the ``.bio file``, using the **Files** application, browse to the file, right click and select **Properties** ▸ **Digests**, select MD5, and click Hash. Compare the result in the Digest column to the md5 sum listed on Intel's website. If these two values do not match, do not proceed, and contact [email protected]. Tails `provides a detailed explanation of this process`_.
+
+Copy the .bio file to your USB device using ``dd if=/path/to/bio/file of=/path/to/usb/device``. Be very careful to select the correct path to your USB device, which you can verify by looking in the Disks application.
+
+.. _`as documented by Intel (available as a PDF)`: https://www.intel.com/content/dam/support/us/en/documents/mini-pcs/Visual-BIOS-Update-NUC.pdf
+
+.. _`provides a detailed explanation of this process`: https://tails.boum.org/doc/encryption_and_privacy/checksums/index.en.html
+
+.. _`on the correct website`: https://downloadcenter.intel.com/
+
+Update the BIOS
+~~~~~~~~~~~~~~~
+
+Power off the mon server, and ensure that it is plugged into an uninterrupted power supply (UPS). Plug in the keyboard, mouse, and USB key, and power on the server, then immediately press F7 to enter the BIOS Update tool.
+
+Select the USB device and navigate to the ``.bio`` file you have downloaded, then hit enter. The update will take several minutes--do not interrupt the update or unplug the server during this time.
+
+Repeat these steps on the app server. These steps are also available `on Intel's website (PDF)`_.
+
+
+.. _`on Intel's website (PDF)`: https://www.intel.com/content/dam/support/us/en/documents/mini-pcs/Visual-BIOS-Update-NUC.pdf