Merge branch 'feature/auto-login'

webpages/vm-operator/pools.md

@@ -0,0 +1,73 @@
+---
+title: "VM-Operator: VM pools — assigning VMs to users dynamically"
+layout: vm-operator
+---
+
+# VM Pools
+
+*Since 4.0.0*
+
+## Prepare the VM
+
+### Shared file system
+
+Mount a shared file system as home file system on all VMs in the pool.
+If you want to use the sample script for logging in a user, the filesystem
+must support POSIX file access control lists (ACLs).
+
+### Restrict access
+
+The VMs should only be accessible via a desktop started by the VM-Operator.
+
+ * Disable the display manager.
+ 
+   ```console
+   # systemctl disable gdm
+   # systemctl stop gdm
+   ```
+   
+ * Disable `getty` on tty1.
+ 
+   ```console
+   # systemctl mask getty@tty1
+   # systemctl stop getty@tty1
+   ```
+
+You can, of course, disable `getty` completely. If you do this, make sure
+that you can still access your master VM through `ssh`, else you have
+locked yourself out.
+
+Strictly speaking, it is not necessary to disable these services, because
+the sample script includes a `Conflicts=` directive in the systemd service
+that starts the desktop for the user. However, this is mainly intended for
+development purposes and not for production.
+   
+The following should actually be configured for any VM.
+   
+ * Prevent suspend/hibernate, because it will lock the VM.
+ 
+   ```console
+   # systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
+   ```
+ 
+### Install the VM-Operator agent
+
+The VM-Operator agent runs as a systemd service. Sample configuration
+files can be found
+[here](https://github.com/mnlipp/VM-Operator/tree/main/dev-example/vmop-agent).
+Copy 
+
+  * `99-vmop-agent.rules` to `/usr/local/lib/udev/rules.d/99-vmop-agent.rules`,
+  * `vmop-agent` to `/usr/local/libexec/vmop-agent` and
+  * `vmop-agent.service` to `/usr/local/lib/systemd/system/vmop-agent.service`.
+
+Note that some of the target directories do not exist by default and have to
+be created first. Don't forget to run `restorecon` on systems with SELinux.
+
+Enable everything:
+
+```console
+# udevadm control --reload-rules
+# systemctl enable vmop-agent
+# udevadm trigger
+ ```

webpages/vm-operator/upgrading.md

@@ -9,16 +9,31 @@ layout: vm-operator
 
 ## To version 4.0.0
 
-The VmViewer conlet has been renamed to VmAccess. This affects the
-[configuration](https://jdrupes.org/vm-operator/user-gui.html). Configuration information using the old path
-"/Manager/GuiHttpServer/ConsoleWeblet/WebConsole/ComponentCollector/VmViewer"
-is still accepted for backward compatibility, but should be updated.
+ * The VmViewer conlet has been renamed to VmAccess. This affects the
+   [configuration](https://jdrupes.org/vm-operator/user-gui.html). Configuration
+   information using the old path
+   `/Manager/GuiHttpServer/ConsoleWeblet/WebConsole/ComponentCollector/VmViewer`
+   is still accepted for backward compatibility until the next major version,
+   but should be updated.
 
-The change of name also causes conlets added to the overview page by
-users to "disappear" from the GUI. They have to be re-added.
+   The change of name also causes conlets added to the overview page by
+   users to "disappear" from the GUI. They have to be re-added.
 
-The latter behavior also applies to the VmConlet conlet which has been
-renamed to VmMgmt.
+   The latter behavior also applies to the VmConlet conlet which has been
+   renamed to VmMgmt.
+   
+ * The configuration property `passwordValidity` has been moved from component
+   `/Manager/Controller/DisplaySecretMonitor` to
+   `/Manager/Controller/Reconciler/DisplaySecretReconciler`. The old path is 
+   still accepted for backward compatibility until the next major version,
+   but should be updated.
+
+ * The standard [template](./runner.html#stand-alone-configuration) used
+   to generate the QEMU command has been updated. Unless you have enabled
+   automatic updates of the template in the VM definition, you have to
+   update the template manually. If you're using your own template, you
+   have to add a virtual serial port (see the git history of the standard
+   template for the required addition).
 
 ## To version 3.4.0
 

webpages/vm-operator/user-gui.md

@@ -131,16 +131,20 @@ of 16 (strong) random bytes (128 random bits). It is valid for
 10 seconds only. This may be challenging on a slower computer
 or if users may not enable automatic open for connection files
 in the browser. The validity can therefore be adjusted in the
-configuration.
+configuration.[^oldPath]
 
 ```yaml
 "/Manager":
   "/Controller":
-    "/DisplaySecretMonitor":
-      # Validity of generated password in seconds
-      passwordValidity: 10
+    "/Reconciler":
+      "/DisplaySecretReconciler":
+        # Validity of generated password in seconds
+        passwordValidity: 10
 ```
 
+[^oldPath]: Before version 4.0, the path for `passwordValidity` was
+  `/Manager/Controller/DisplaySecretMonitor`.
+
 Taking into account that the controller generates a display
 secret automatically by default, this approach to securing
 console access should be sufficient in all cases. (Any feedback