Qubes OS workstation configuration

Documenting the configuration of my Qubes OS workstation through config-as-code with salt

Mirrors:

---

Usage

First time set up

• In a guest VM, clone the repo into /usr/local/src (this avoids username conflicts later)

  git clone ssh://git@codeberg.org/xyhhx/qubes-mgmt-salt-user.git /usr/local/src/qubes-mgmt-salt-user
  

• From dom0, run the first-time set up script

  (
    export GUEST=development-qube SRC_DIR=/usr/local/src/qubes-mgmt-salt-user; \
    qvm-run -p "${GUEST}" "cat ${SRC_DIR}/bin/install" | envsubst
  ) | bash
  

Using the Make tasks

Note

The Make tasks requires a GUEST variable to be set. It should be the name of the guest domain that holds the repo's source code. You can either pass it directly (GUEST=my-dev-qube make...)

Tip

You can export the GUEST variable to the environment to make life easier

Warning

While the Make tasks try to ensure that commands are only ran in the appropriate domains (i.e. dom0 or guests), the checks are frail. Be mindful of what you're running!

Enabling/disabling top files

Make is used to interact with qubesctl and offers a few helper tasks to make working with top files a bit easier:

• Enabling/disabling top file(s):

  # Enable a top
  make enable dvm-trivalent
  
  # Enable multiple tops
  make enable on-fedora-42-minimal provides-app-trivalent dvm-trivalent
  
  # Disabling top(s) work the same
  make disable on-fedora-42-minimal
  

• Enabling/disabling all tops

  # Enable all tops
  make enable-all
  
  # Disable all tops
  make disable-all
  

  Tip

  This is handy when first setting the repo up. You can run make enable-all to quickstart the repo

• Enable only some tops:

  # Enable only a few tops
  make enable-only dom0 uses-stack-dev dvm-dev
  

  Note

  This will disable all tops in this repo, then enable the ones provided

Running state.apply

The makefile also has helper tasks for running qubesctl state.apply

• Applying a state to a few targets:

  # Apply Trivalent states
  make apply uses-app-trivalent dvm-trivalent
  

• Applying "batch targets" (i.e. --all, --templates, --standalones, --apps):

  # Apply all template states
  make apply templates
  

• These can be used together:

  # Apply all templates and a few other tops
  make apply templates dvm-trivalent app-thunderbird
  

Pulling updates to dom0

Bundling changes and lifting them to dom0 is also easily done with the available Make tasks:

# In dom0
make pull-bundle

Render a statefile

You can check what the Jinja renderer outputs by with the render task:

# in dom0
make render $(pwd)/qubes-mgmt-salt-user/common/hardening/kmods.sls

Note

The parameter must be an absolute path

---

Acknowledgments

The following resources were very useful for learning Salt, especially in the context of Qubes OS; and for getting inspiration about how to design my own states (thanks!):

• https://github.com/ben-grande/qusal
• https://git.drkhsh.at/salt-n-pepper/file/README.md.html
• https://github.com/gonzalo-bulnes/qubes-mgmt-salt-user
• https://github.com/unman/shaker
• https://github.com/freedomofpress/securedrop-workstation
• https://forum.qubes-os.org/t/qubes-salt-beginners-guide/20126