Qubes OS Salt Formulas

A collection of Salt formulas that have evolved through regular use since Qubes OS 4.0 and are currently maintained for Qubes OS 4.3.

The formulas cover networking, updates, time synchronization, USB devices, browsers, applications, hardware wallets, development environments, and legacy virtualization. Each formula includes a README with configuration and deployment instructions.

Formulas

Formula	Purpose
sys-net	Disposable PCI network Qube with persistent NetworkManager profiles and randomized hostname and MAC addresses
sys-fw-mirage	Mirage firewall Qubes
sys-tor	Disposable transparent Tor gateway
sys-update	Disposable UpdateVM
sys-clock	Disposable onion-based ClockVM
sys-vpn	Configurable disposable SSHuttle gateways
sys-usb	Disposable USB and input-proxy Qube with optional CTAP, YubiKey tools, Trezor Bridge, and fingerprint enrollment
torbrowser	Disposable Tor Browser using the shared transparent sys-tor gateway; bundled Tor is not started
mullvadbrowser	Mullvad Browser installation for disposable browsing
signal	Persistent Signal Desktop Qube
syncthing	Persistent Syncthing Qube on the official v1 channel
trezor	Trezor client Qube using Bridge in sys-usb
ledger	Configurable Ledger client Qubes
pi	Configurable Pi coding-agent Qubes
vbox	Legacy VirtualBox 5.2.34 standalone HVM

Installation

Place the repository in dom0 at:

/srv/user_salt/ra-qubes-salt-formulas

The directory name is part of the Salt source paths and should remain ra-qubes-salt-formulas. Follow the commands in each formula's README to configure and apply it.

Copying the repository to dom0

In a networked Qube, clone the repository:

git clone https://github.com/ra--/ra-qubes-salt-formulas.git

Then create an archive of the committed files:

git -C /home/user/ra-qubes-salt-formulas archive \
  --prefix=ra-qubes-salt-formulas/ \
  -o /home/user/formulas.tar HEAD

Then run this single command in dom0:

qvm-run -p <source-qube> 'cat /home/user/formulas.tar' | sudo tar -xf - -C /srv/user_salt

Replace <source-qube> with the Qube containing the archive. The archive contains only files committed to Git.

Configuration

Some formulas expose configurable options under user-data, including support for one or more Qube instances. Each formula's README describes the available settings and expected file formats.

License

Unless otherwise noted, this repository is licensed under the MIT License. Third-party materials retain their respective licenses and attribution.