Qubes

Note: after restoring from a backup make sure to recreate the templates from the base again to save disk space because of copy-on-write.

VMs

• DD (km-d11)
• fpf (km-f37)
  • flatpak: Signal, Wire, Flatseal, Xournal++
• dev (km-f37)
  • flatpak: Element, nheko, Flatseal, Kdenlive
• gpg (km-f37)
  • no network
• vault (km-f37)
• vault-gpg (fedora-37)
  • no network
• sd-kernel-builder (km-d11)
• sd-dev11
• sd-dev12
• sd-ssh (km-f37)
• sys-mullvad-vpn (fedora-37)
  • see Micah's setup guide
• wm-ssh (km-f37)

Template VMs

• km-d11: fork:
  • (from backports) devscripts git-buildpackage dput-ng lintian
  • command-not-found gitk git-cola webext-ublock-origin webext-https-everywhere dh-php php-dev dh-buildinfo apache2-dev ack webext-privacy-badger ubuntu-dev-tools pkg-kde-tools dh-python cython3 python3-setuptools neomutt vlc gnome-system-monitor curl php-mbstring php-intl php-sqlite3 php-apcu python3-isort python3-sphinx
• fedora-37: upstream
• km-f37 fork: (outdated)
  • enabled rpmfusion
    • sudo dnf config-manager --set-enabled rpmfusion-free
    • sudo dnf config-manager --set-enabled rpmfusion-free-updates
  • enabled pycharm-community, vscodium
  • fuse-exfat exfat-utils chromium ffmpeg vlc pcsc-tools mozilla-privacy-badger filezilla shotwell youtube-dl libreoffice libgnome-keyring tree ack nano mozilla-https-everywhere mozilla-ublock-origin nextcloud-client-nautilus quassel-client mosh mono-core mono-devel mono-locale-extras mediainfo curl transmission-gtk fish python3 python3.6 python3.7 python3.8 python3.9 python3.10 composer php-cli php-mysqli git-cola gitk podman pycharm-community codium nano keepassxc qubes-gpg-split pinentry-gtk tokei sqlite jq git-lfs tox poetry php-devel bind-utils gh mtr traceroute httpd-devel devscripts mariadb
  • other tweaks:
    • systemctl mask packagekit
    • echo "vm.swappiness = 1" | sudo tee systemctl.conf

Config

• /etc/qubes-rpc/policy/qubes.InputKeyboard
  • sys-usb dom0 ask,default_target=dom0
• /etc/qubes-rpc/policy/qubes.InputTablet
  • sys-usb dom0 allow
• /etc/qubes-rpc/policy/qubes.Gpg
  • dev gpg allow
  • fpf gpg allow
• /etc/qubes-rpc/policy/qubes.GpgImportKey
  • dev gpg allow
  • fpf gpg allow

Follow https://github.com/Qubes-Community/Contents/blob/master/docs/customization/dpi-scaling.md for getting it to work with my 4k display. Went back to a non-4k display.

dom0

Appearance -> Style -> Adwaita-dark

Change global copy/paste (source):

$ qvm-features dom0 gui-default-secure-copy-sequence 'Mod4-c'
$ qvm-features dom0 gui-default-secure-paste-sequence 'Mod4-v'

Create /usr/local/bin/vault, mapped to ctrl+shift+x

#!/bin/sh
exec qvm-run vault keepassxc

Clock format: %a %F %r

Redshift, following https://www.bryceguinta.me/install-configure-and-autostart-redshift-on-qubes-40.html, except place the config file at ~/redshift.conf so it gets included in dom0 backups and use Settings -> Session and Startup to add the autostart entry.

TODO: Document using the new beta qubes app menu

Advanced debugging

Boot a Qubes installer USB, select rescue mode. Select option #1, enter your decryption password. Ignore the error which says "You have no Linux partitions...", it's wrong and a known issue.

If you run e.g. fdisk -l, you should see your disks and VMs. You should be able to mount dom0 with e.g. mkdir /mnt/dom0 && mount /dev/qubes_dom0/root /mnt/dom0. To do stuff in dom0, you might chroot /mnt/dom0.

If you need /proc, /sys, etc. inside the chroot, see this post for how to mount them.