reinstall template documentation: recommend qubesctl state.highstate

[adrelanos]

https://www.qubes-os.org/doc/reinstall-template/ - Please consider adding the following.

sudo qubesctl state.highstate

That would invoke salt.
https://www.qubes-os.org/doc/salt/

And thereby in case of Whonix (which is currently used as an example in the replace template documentation) create a TemplateBased ProxyVM sys-whonix.

[andrewdavidwong]

I haven't had a chance to learn how to use salt yet. Is it simply a matter of adding that one line somewhere? Would you consider submitting a PR?

[andrewdavidwong]

I haven't had a chance to learn how to use salt yet. Is it simply a matter of adding that one line somewhere? Would you consider submitting a PR?

[adrelanos]

Can do. Before doing so, I would like to appreciate feedback if this is a sane idea.

It would be the last command to run, i.e. 7.. As far as I understand, it cannot hurt either way.

Do you think this is a sane idea? @marmarek

[adrelanos]

Can do. Before doing so, I would like to appreciate feedback if this is a sane idea.

It would be the last command to run, i.e. 7.. As far as I understand, it cannot hurt either way.

Do you think this is a sane idea? @marmarek

[marmarek]

qubesctl state.highstate will apply whatever configuration is enabled - most likely what was set in firstboot. For example if someone initially created sys-usb, but later removed it, it will be recreated. Same applies to default VMs and others. It will not remove any data (we don't have any formula removing VMs, but technically it would be possible).
So, before running, I'd advise to review what is enabled:

qubesctl top.enabled

And if necessary, disable unneeded entries with qubesctl top.disable.

[marmarek]

qubesctl state.highstate will apply whatever configuration is enabled - most likely what was set in firstboot. For example if someone initially created sys-usb, but later removed it, it will be recreated. Same applies to default VMs and others. It will not remove any data (we don't have any formula removing VMs, but technically it would be possible).
So, before running, I'd advise to review what is enabled:

qubesctl top.enabled

And if necessary, disable unneeded entries with qubesctl top.disable.

[andrewdavidwong]

So, that step would have to say something like:

Run qubesctl top.enabled to see the current configuration. If it looks good, then run qubesctl state.highstate to apply it. If there are unneeded entries, use qubesctl top.disable to disable them.

Right?

The problem I foresee is that most users won't know (at least one of) the following:

• How to read the output of qubesctl top.enabled
• How to read the files in /srv/salt/_tops/base/
• Whether the current configuration is correct for their needs
• Whether any entries are unneeded and should be disabled

We shouldn't expect users to know these things without giving them any way to learn. So, first, we need to document Salt itself from a user's perspective (#1983), or at least point them to some existing documentation elsewhere (does any exist?).

[andrewdavidwong]

So, that step would have to say something like:

Run qubesctl top.enabled to see the current configuration. If it looks good, then run qubesctl state.highstate to apply it. If there are unneeded entries, use qubesctl top.disable to disable them.

Right?

The problem I foresee is that most users won't know (at least one of) the following:

• How to read the output of qubesctl top.enabled
• How to read the files in /srv/salt/_tops/base/
• Whether the current configuration is correct for their needs
• Whether any entries are unneeded and should be disabled

We shouldn't expect users to know these things without giving them any way to learn. So, first, we need to document Salt itself from a user's perspective (#1983), or at least point them to some existing documentation elsewhere (does any exist?).

[tasket]

@adrelanos I reinstalled Whonix from the testing repo, but did not use qubesctl state.highstate to avoid problems with my customizations. There should be a more specific script or entrypoint somewhere that accomplishes the same task for Whonix; I would change the setup instructions to use that approach instead.

[tasket]

@adrelanos I reinstalled Whonix from the testing repo, but did not use qubesctl state.highstate to avoid problems with my customizations. There should be a more specific script or entrypoint somewhere that accomplishes the same task for Whonix; I would change the setup instructions to use that approach instead.

[marmarek]

@ttasket See #2173 . In short, in R3.2 after installation all those states are disabled (after applying the configuration). So if you later run qubesctl state.highstate it will no longer revert any of your changes. If you want to enable creation of Whonix VMs, you need to enable those states explicitly:

qubesctl top.enable qvm.sys-whonix
qubesctl top.enable qvm.anon-whonix
qubesctl state.highstate

But in R3.1, all the states are left enabled after installation.

[marmarek]

@ttasket See #2173 . In short, in R3.2 after installation all those states are disabled (after applying the configuration). So if you later run qubesctl state.highstate it will no longer revert any of your changes. If you want to enable creation of Whonix VMs, you need to enable those states explicitly:

qubesctl top.enable qvm.sys-whonix
qubesctl top.enable qvm.anon-whonix
qubesctl state.highstate

But in R3.1, all the states are left enabled after installation.

[adrelanos]

In Qubes R4 it should be the default and recommended way to install Whonix using salt - otherwise the dom0 setup of Qubes updates proxy qrexec policy gets too cumbersome for most users.

[adrelanos]

In Qubes R4 it should be the default and recommended way to install Whonix using salt - otherwise the dom0 setup of Qubes updates proxy qrexec policy gets too cumbersome for most users.

[tasket]

Re-reading this thread, questions come to mind:

Are the VM setup procedures necessary in a template re-installation guide? Or is this recommendation for the sake of completeness in the case that the setup hasn't been done yet (noting also that the Whonix install doc shows manual setup not qubesctl)? Should both docs be changed?

[tasket]

Re-reading this thread, questions come to mind:

Are the VM setup procedures necessary in a template re-installation guide? Or is this recommendation for the sake of completeness in the case that the setup hasn't been done yet (noting also that the Whonix install doc shows manual setup not qubesctl)? Should both docs be changed?

[marmarek]

Well, since template reinstall is currently completely broken on R4 (#3169), it is hard to say. Depending on how reinstall will work. If it will only replace root (and private?) volume, but preserve other settings - which is how I see it currently, then no.

[marmarek]

Well, since template reinstall is currently completely broken on R4 (#3169), it is hard to say. Depending on how reinstall will work. If it will only replace root (and private?) volume, but preserve other settings - which is how I see it currently, then no.