Configuration

SecureDrop Workstation applications are configured in production via QubesDB's /vm-config hierarchy. For convenience in development, the QubesDB value at /vm-config/FOO can also be provided as the environment variable FOO.

Currently:

• Rust programs (e.g., securedrop-proxy) built with the qubesdb feature MUST read from QubesDB. Without this feature, they MUST fall back to environment variables.
• Python programs (e.g., securedrop-client) MUST try to load qubesdb at runtime (from the python3-qubesdb Debian package from the Qubes repository; unavailable from PyPI). If it's not available, they MUST fall back to environment variables.
• template-from-qubesdb always reads from QubesDB and never falls back to environment variables.