QMBAdmin

Scripts for building and managing qubes from within an AppVM.

matrix room: #qubism:c-base.org

qmbadmin-gen0

This qube is for creating and managing other qubes.

• read all templates for cloning
• do any operation on qubes created by ourself

bootstrap.0

run in dom0

NOTE: If you start with a minimal template install qubes-core-agent-passwordless-root and git

qvm-clone fedora-42-xfce qmbadmin-f42-xfce
qvm-tags qmbadmin-f42-xfce add created-by-qmbadmin-gen0
qvm-create --label purple --class AppVM --template qmbadmin-f42-xfce qmbadmin-gen0
qvm-tags qmbadmin-gen0 add created-by-qmbadmin-gen0

rpc policy

Create a policy file at /etc/qubes/policy.d/30-qmbadmin-gen0.policy:

admin.vm.Create.AppVM * qmbadmin-gen0 dom0 allow
admin.vm.Create.StandaloneVM * qmbadmin-gen0 dom0 allow
admin.vm.Create.TemplateVM * qmbadmin-gen0 dom0 allow
admin.vm.Remove * qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow target=dom0
qubes.Filecopy * qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow
qubes.WaitForSession * qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow
qubes.VMShell * qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow
qubes.VMRootShell * qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow

Append the following lines to /etc/qubes/policy.d/include/admin-local-rwx:

qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow target=dom0
qmbadmin-gen0 qmbadmin-gen0 allow target=dom0

Append the following lines to /etc/qubes/policy.d/include/admin-local-ro:

qmbadmin-gen0 @type:TemplateVM allow target=dom0

Append the following lines to /etc/qubes/policy.d/include/admin-global-ro:

qmbadmin-gen0 @adminvm allow target=dom0
qmbadmin-gen0 @tag:created-by-qmbadmin-gen0 allow target=dom0
qmbadmin-gen0 qmbadmin-gen0 allow target=dom0
qmbadmin-gen0 @type:TemplateVM allow target=dom0

bootstrap.1

open terminal in qmbadmin-gen0

create project dir and obtain this repository

mkdir -p ~/projekt/qubes/qmbadmin
cd ~/projekt/qubes/qmbadmin
git clone https://codeberg.org/saces/qmbadmin.git .

Now generate a new template qmbadmin-gen0-template derived from qmbadmin-f42-xfce and complete the template configuration.

gen0/fedora/bootstrap.0.sh

Shut down qmbadmin-gen0-template and qmbadmin-gen0, switch qmbadmin-gen0s template to qmbadmin-gen0-template.

Start qmbadmin-gen0.
Ready.