Qubes+Salt builder plugin and base packages
Shell Python Makefile SaltStack
Latest commit c437c20 Feb 14, 2017 @marmarek marmarek ssh-wrapper: don't use qvm-copy-to-vm
Since the intention of 'scp' here is to:
 - override target file (if any)
 - place it in specific directory, outside of QubesIncoming
it doesn't make sense to use qvm-copy-to-vm, as it adds more troubles
than good. Simple 'cat' is enough.
This solves problem when QubesIncoming is not cleaned up after failed
salt invocation, preventing further attempts (becuse qvm-copy-to-vm
refuse to override existing files).

Failed to load latest commit information.
debian version 4.0.0 Nov 29, 2016
etc/salt sync default minion.d/f_defaults.conf with final generated one Jun 5, 2016
qubessalt Fix core3 API usage Nov 21, 2016
rpm_spec rpm: don't own salt directories Jan 10, 2017
srv fix default pillar top Jun 3, 2016
template template: Added saltstack key for jessie repo since salt is too old i… Dec 23, 2015
tests Remove unsupported Ubuntu builds Nov 6, 2016
.gitignore Add pkgs directory to .gitignore Jun 10, 2015
.pylintrc Add .pylintrc and setup.cfg Aug 28, 2016
.travis.yml travis: drop debootstrap workaround Jan 10, 2017
FORMULA version 4.0.0 Nov 29, 2016
FORMULA-DEFAULTS Makefile.install: Rename default VARS to better reflect they are defa… Dec 14, 2015
Makefile Extend qubesctl to configure also VMs May 1, 2016
Makefile.builder debian: exclude a little less from "orig" tarball Jun 1, 2016
Makefile.install Makefile.install: Only place README and LICENSE in top_level_dir if f… Dec 14, 2015
README.developer Added a README.developer file which can be used for developers Oct 28, 2015
README.rst README: Updated. Still needs more content Oct 28, 2015
builder.conf Drop +salt template flavor May 8, 2016
components.conf Add note when components.conf is included Dec 25, 2015
debian-quilt Modified repo to contain new packaging elements Jul 5, 2015
qubes.SaltLinuxVM Extend qubesctl to configure also VMs May 1, 2016
qubesctl Migrate qubes-mgmt-base to new core3 api Sep 5, 2016
setup.cfg Add .pylintrc and setup.cfg Aug 28, 2016
setup.py Extend qubesctl to configure also VMs May 1, 2016
ssh-wrapper ssh-wrapper: don't use qvm-copy-to-vm Feb 14, 2017
version version 4.0.0 Nov 29, 2016
yaml-dumper yamldumper: Read input files in order they appear on command line Dec 14, 2015


This README is not complete and is work-in-progress...

In order to utilize the Qubes Management features (qubes-mgmt) two packages first need to be installed in either Dom0 and/or the AppVM. Install salt version 2015.5.0 or greater, then for dom0 qubes-salt-mgmt-dom0 or qubes-mgmt-salt-vm for an AppVM, or have them built into the template by including the +salt template flavor when building.

qubesctl is inter-changeable and an alias for salt-call --local and contains additional code to apply any required patches.

Initial Installation and Setup

  1. Initial Setup: sync any modules, etc

    qubesctl saltutil.sync_all

  2. Highstate will execute all states

    qubesctl state.highstate

  3. Highstate test mode only. Note note all states seem to conform to test mode and may apply state anyway. Needs more testing to confirm or not!

    qubesctl state.highstate test=True

Where are all the configuration files?

All the qubes based configuration files are located in /srv/* directories. The salt minion configuration files are located in `/etc/salt'.

/srv/salt/_tops/** contain all the states that will execute when running a highstate.

Some Useful Commands

qubesctl saltutil.sync_all:

Sync all modules. If a problem exists, one may remove the salt cache directory (rm -r /var/cache/salt) and re-sync the modules

qubesctl top.enable <topname> [saltevn=(base)]:

Enable / disable states to run with highstate. Example:
qubesctl top.enable privacy saltenv=all qubesctl top.disable vim.salt saltenv=all qubesctl top.disable gnupg (no need to enter saltenv for base modules) qubesctl top.disable gnupg pillar=true (disable pillar)

qubesctl top.enabled:

List enabled state files (located within /srv/salt/_tops** and /srv/pillar/_tops**). top.disabled to list disabled, not activated states

qubesctl state.sls config:

Re-run configuration (updates /etc/salt/minion.d/f_defaults.conf)

Examples of running included formulas

qubesctl state.sls policy-qubesbuilder qubesctl state.sls policy-qubesbuilder.absent