Qubes OS Forum

Just published a few (of the non-trivial) salt formulas that I use over the years: GitHub - ra--/ra-qubes-salt-formulas: Salt formulas for Qubes OS · GitHub Maybe they are useful to others here too. 1 post - 1 participant Read full topic

Just published a few (of the non-trivial) salt formulas that I use over the years: GitHub - ra--/ra-qubes-salt-formulas: Salt formulas for Qubes OS · GitHub Maybe they are useful to others here too.

Because the script does: https://git.sr.ht/~solene/qubes-os-nat/tree/master/item/nat.sh @unman

adrelanos: Whonix is based on Kicksecure . Typically there is no need to use Kicksecure through Whonix-Gateway. Ok so that answers the main question Whonix is like ok I want to use tor let me point any cube at the whonix gateway bam I am anon. adrelanos: Tor Browser should be used. See: Other Browsers This I don’t understand because then I will get a tor over tor error, as mentioned. Maybe there is a setting in the tor browser I have wrong? Maybe you can point me to that. I am doing some extra reading in the links you gave, still thanks for the reply

Greetings, In short, I had trouble following Solene’s guide back in the day. The instructions were scattered across various threads, which is a bit tedious for someone who isn’t a programmer or isn’t used to digging around. So, I simply created a straightforward guide updated to the Gnome version at the time. That’s why I clearly stated the guide’s release date. I think this is important because at some point, Gnome Software will likely make significant changes to its functionality, or something might happen that renders this guide invalid or partially invalid. When that happens, I hope someone else will pick up the torch if I’m not around to do it and create a new, updated, and practical guide for integrating Flatpak into Qubes OS. Ultimately, the goal is to provide support documentation for users of this lovely system. That’s all there is to it. Cheers.

hmmmmmm… epic fall xd Hello, dear reader. I firmly believe that the connection required to install and configure Flatpak is a one-time event (via a proxy, to be clear) in the operation of your template. As detailed in this guide, there is a configuration method, which I highly recommend, where the application installation takes place in the user space within the Qube created from the Flatpak template. This means you only need to perform the Flatpak installation process once within the template, enabling internet access through the proxy, following the procedure specified in the guide. Afterward, create your AppQube from that template using the standard QubeOS procedure, and you will be able to open Flatpak and install your applications in the non-immutable user space. This will allow you to update, uninstall, or install new applications without having to modify the template. I do not recommend attempting to find ways to expose your template to the internet in a controlled manner. Best regards.

So I pretty much already have a KDE template already made. I ended up using the Fedora-44-Minimal template and I installed the bare minimum for a functional X-session environment. I did use this, and a response in a different forum to add the .desktop icons. Apparently, they’re in /usr/share/kservices5/ServiceMenus/ , but they were missing their mime types, which I set to all/all; , and that fixed that issue. I might end up adapting to use the Debian 13 template method, but I did want Fedora as the base for more recent packages (as I sometimes code on my system, and I want relevant packages for that application), as well as SELinux support (although that seems unnecessary with QubesOS). I do have to ask, though: does this method make everything truly run as KDE-Plasma, or does it merely just leverage an X-session like the minimal template does, while applying similar functions as the legitimate desktop? Additionally, is it possible to mask unrequired packages with apt? I, sadly, don’t have much experience in fine-grained package management on apt-based systems, but I want to minimize my package count (and attack surface) by removing anything not necessary for my system to run properly in a KDE-Plasma environment. Thanks for the initial reply by the way, much appreciated advice.

Hmm, I see. Some people might still find it confusing even after adding the guide’s objective after the title: Objective: Debian 12/13 - XFCE Template Thanks for the feedback; I’ve already modified the content to be even clearer. Cheers.

Is there any way to run flatpak in the template without giving all apps internet access (via proxy variables)? I understand the idea is that only flatpak will be used, but the proxy was originally only for updates, or advanced users who knew the risks. I’d hope there is a way to limit it to only flatpak, like how DNF/APT are setup. This seems a bit risky to me, but I could be missing something.

Thank you for your question. No, I don’t like to touch dom0 at all; as specified, it’s an installation for the Debian 12/13 template.

Explain to me what your problem is. Why would you want/need to run commands within Mirage-firewall to reach servers in the local network? There’s something you are not saying. I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.