I don’t know how far you have gotten in getting Whonix working as an appvm but I thought I would share my code to build it as a appvm / proxyvm if you were interested.
I couldn’t figure out how to get the HVM to go full screen (greater than 1280x800 or something like that) and was also having the same issue of TorTransport not reachable so I decided to build Whonix as an AppVM and set the Gateway up as a Qubes Proxy VM using the Qubes template builder.
I have successfully been able to build both the workstation and gateway as an AppVM which can then be used to create a ProxyVM.
To build, just clone my repo git@github.com:nrgaway/qubes-builder.gitin a fedora appvm (with lots of private user space… I used 40GB; 15-20 may work) and run ./wheezy-install in the qubes-builder directory. It should set up all the fedora depends you need and start building. I tried to make the build process as simple as possible for myself and it will patch qubes and whonix where needed.
The original template builder had issues build a wheezy template, so I added tweaks to make it build a wheezy template. The Whonix gateway / workstation build options are as follows:
sudo ~/Whonix/whonix_build \
--build "$1" \
--64bit-linux \
--current-sources \
--enable-whonix-apt-repository \
--whonix-apt-repository-distribution stable \
--bare-metal \
--skip-verifiable \
--skip-sanity-tests
The build process is still WIP. For instance, when Whonix is building, you have to manually interject twice at this point. The first time it will fail on grub-pc even though I marked it as a held package, so you need to uninstall grub-pc at that point (instructions in wheezy-install.README). Also for some reason I cant umount the directory after installing Whonix (working on that issue today) so you may need to shutdown the development appvm (or umount -l /qubes-builder/qubes-src/linux-template-builder/mnt) and comment out the part in Makefile that calls qubeize.
Once the template is built, install it in dom0 (instructions in README). Run it as a normal VM (not custom). Also, at least for now, when creating your AppVM or ProxyVM from the template, choose as a standalone, as it is easier to debug. The first time you start the appvm/proxyvm, wait until the vm stops (look in logs for this indication) since thats when Whonix does its initialization thing. Then restart it again and use Terminal to access (All Whonix programs also available from menu).
I am now currently working on configuring the ProxyVM so it actually works This will take tweaking since it expects to have a eth0 of 10.152.152.x and ProxyVM has one of 10.137.X.X (most likely 10.137.3.X if this is the 3rd netvm you installed). I already wrote a script for torrc as follows that needs to be run, and have to search the Whonix code to see where it is relying on an interface of eth0 (proxyvm creates a new interface (vifX.0) for each appvm connecting.
I am unsure at this point what else needs to be tweaked, but will dig into it further over the weekend.
#!/bin/bash
# TODO: Obtain automatically
IP=10.137.3.1
cp /usr/share/tor/tor-service-defaults-torrc /etc/tor/torrc
sed -i 's/10.152.152.10/'$IP'/g' /etc/tor/torrc
cat /etc/tor/torrc
service tor restart
Anyway, I can be available on IRC or here to help you though the build process if you are interested. I only started using Qubes a few weeks ago after learning about your release of Whonix on it so there may be better ways of doing things than what I have done. Since I only started coding this three days ago, expect build errors; although I have been able to build with only manually interject 3 times. Will get better as time progresses.
I also am going to be adding encryption the the workstation appvm as part of the Whonix build process so it will be available to other platforms as well.