## Copyright (C) 2018 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Display manager startup is handled by sysmaint-boot.service.

[Unit]
Description=Sysmaint user session
DefaultDependencies=no

## Core dependencies
## basic.target provides a basic functional system.
Requires=basic.target
## systemd-user-sessions allows users to log in.
Requires=systemd-user-sessions.service

## Normal dependencies
## sysinit gives us all essential system services.
Wants=sysinit.target

## Networking and Tor is needed to run system updates.
## NetworkManager
Wants=network.target
Wants=NetworkManager.service
Wants=detect-ipv6-enabled-in-kernel.service
## ifupdown
Wants=ifupdown-pre.service
Wants=networking.service
## systemd-networkd
Wants=systemd-networkd.service
## Tor
Wants=tor.service
Wants=tor@default.service

## sdwdate and privleapd are required for systemcheck to work.
Wants=sdwdate.service
Wants=sdwdate-gui-shutdown-notify.service
Wants=sdwdate-pre.service
Wants=sdwdate-start-anondate-set-file-watcher.service
Wants=bootclockrandomization.service
Wants=timesanitycheck.service
Wants=privleapd.service
## Do NOT:
## Wants=leapctl@.service

## rads is needed to launch the sysmaint desktop session.
Wants=rads.service
Wants=rads-block-display-manger.service

## Qubes-specific dependencies
## getty is required for the Qubes debug console to work.
Wants=getty.target

## Basics.
Wants=console-setup.service
Wants=dist-skel-first-boot.service
Wants=udisks2.service
Wants=upower.service
Wants=systemd-fsckd.socket
Wants=sysfsutils.service
Wants=swap-file-creator.service
Wants=live-mode-apparmor.service
Wants=livecheck-lsblk.service
Wants=orca-kill-at-shutdown.service
Wants=legacy-dist.service
Wants=mnt-shared-vbox.service
Wants=mnt-shared-kvm.service

## Might be intentionally turned off by the user.
#Wants=panic-on-oops.service

## Users should not be using VMs in Whonix-Host while booted in sysmaint session.
#Wants=libvirt-dist-install.service
#Wants=libvirt-dist-set-live-to-readonly.service
#Wants=libvirt-dist-set-persistent-mode-to-read-write.service

## Do not.
## Not needed. Already has: 'WantedBy=sysmaint-boot.target'
## Wants=repository-dist-initializer.service
##
## Do not.
## Not needed. Already has: 'WantedBy=basic.target'
## Wants=sysmaint-boot-unrestricted-qubes.service
## Wants=check-unrestricted-admin.service

## Enables remount-secure, possibly other system setup tasks.
Wants=sysinit-post.target

## security-misc-shared
#Wants=hide-hardware-info.service
#Wants=permission-hardener.service
#Wants=harden-module-loading.service

## security-misc-shared
Wants=remove-system-map.service
Wants=kill-vboxdrmclient-on-shutdown.service

## Useful during USER session.
## Not so useful in SYSMAINT session as it breaks pkexec.
#Wants=proc-hidepid.service

## Users should get warrant canary updates even in sysmaint session.
Wants=canary.service

## VirtualBox
Wants=virtualbox-guest-utils.service

## KVM
Wants=spice-vdagentd.socket
Wants=spice-vdagentd.service

## qrexec is required for many Qubes features, and also is mandatory to
## prevent the VM from being powered off after 60 seconds
Wants=qubes-qrexec-agent.service

## qubes-gui-agent lets us open graphical programs like the sysmaint panel
Wants=qubes-gui-agent.service

## qubes-sysinit provides essential Qubes-specific system services.
Wants=qubes-sysinit.service

Wants=qubes-updates-proxy.service

Wants=qubes-bind-dirs.service

## Proxy tooling is required for software updates.
Wants=qubes-updates-proxy-forwarder.socket

## qubes-mount-dirs.service is required to format the user disk on QubesOS
## StandaloneVMs.
Wants=qubes-mount-dirs.service

## qubes-misc-post.service is required to prevent apt from trying to use an
## updates proxy if a StandaloneVM is initially booted in sysmaint session.
Wants=qubes-misc-post.service

## qubes-firewall.service is a security feature
Wants=qubes-firewall.service

## qubes-update-check.timer is the Qubes equivalent of updatecheck, necessary
## to get software update notifications
Wants=qubes-update-check.timer

## Misc important Qubes services that could break things if not active
Wants=qubes-network-uplink.service
Wants=qubes-rootfs-resize.service

## May be necessary for hardware passthrough to work in some instances
Wants=xendriverdomain.service

## Does some Xen-related setup (mounting /proc/xen, loading Xen-related kernel
## modules
Wants=xen.service

Wants=tb-updater-dispvm.service
Wants=tb-updater-first-boot.service

## Whonix
Wants=anon-gw-anonymizer-config.service
Wants=whonix-firewall-restarter.service
Wants=whonix-firewall.service
Wants=onion-grater.service
Wants=kloak.service

## Qubes-Whonix
Wants=qubes-whonix-network.service
Wants=qubes-whonix-qubes-updates-proxy-enable-maybe.service
Wants=qubes-whonix-torified-updates-proxy-check.service
Wants=qubes-whonix-redirect-9050.socket
#Wants=qubes-whonix-remote-support.service
Wants=qubes-whonix-redirect-9050.service
Wants=qubes-whonix-postinit.service
Wants=qubes-meminfo-writer.service

## ram-wipe
Wants=ram-wipe-kexec-prepare.service

Before=rads.service
After=basic.target network.target systemd-user-sessions.service
