feat: default to disposable netvm

- Default sys-net and sys-firewall to disposable;
- Set global and per vm preferences by starting the qubes or shutting
  down them when necessary; and
- Less manual steps remaining for the user: just rename the net qube, as
  it can only be done via Qubes Manager.

salt/sys-firewall/README.md

@@ -11,21 +11,29 @@ Firewall in Qubes OS.
 ## Description
 
 Creates firewall qube, an App qube "sys-firewall" and a Disposable qube
-"disp-sys-firewall". By default, "sys-firewall" will be the "updatevm" and the
-"default_netvm", but you can configure "disp-sys-firewall" to take on these
-roles if you prefer, later instructed in the installation section below.
+"disp-sys-firewall". By default, "disp-sys-firewall" will be the "updatevm",
+the "clockvm" and the "default_netvm".
 
 If you want an easy to configure firewall with ad blocking, checkout
 sys-pihole instead.
 
 ## Installation
 
+Before installation, rename your current `sys-firewall` to another name such
+as `sys-firewall-old`, the old qube will be used to install packages required
+for the minimal template. After successful installation and testing the new
+net qube capabilities, you can remove the old one. If you want the default net
+qube back, just set `sys-firewall` template to the full template you are
+using, such as Debian or Fedora. Before starting, turn on `sys-firewall-old`
+or yours `default_netvm` and check if DNS is working, after that, proceed with
+the installation.
+
 - Top:
 ```sh
 qubesctl top.enable sys-firewall
 qubesctl --targets=tpl-sys-firewall state.apply
 qubesctl top.disable sys-firewall
-qubesctl state.apply sys-firewall.prefs
+qubesctl state.apply sys-firewall.prefs-disp
 ```
 
 - State:
@@ -33,13 +41,13 @@ qubesctl state.apply sys-firewall.prefs
 ```sh
 qubesctl state.apply sys-firewall.create
 qubesctl --skip-dom0 --targets=tpl-sys-firewall state.apply sys-firewall.install
-qubesctl state.apply sys-firewall.prefs
+qubesctl state.apply sys-firewall.prefs-disp
 ```
 <!-- pkg:end:post-install -->
 
-Alternatively, if you prefer to have a disposable firewall:
+Alternatively, if you prefer to have an app qube as the firewall:
 ```sh
-qubesctl state.apply sys-firewall.prefs-disp
+qubesctl state.apply sys-firewall.prefs
 ```
 
 ## Usage

salt/sys-firewall/create.sls

@@ -102,3 +102,20 @@ features:
   - service.cups-browsed
 {%- endload %}
 {{ load(defaults) }}
+
+## Anticipate network usage as sys-firewall is turned off at this step.
+## Starting the machine before let's the network be established with enough
+## time for the package installation in the template to work.
+{% set default_netvm = salt['cmd.shell']('qubes-prefs default_netvm') -%}
+{% if default_netvm -%}
+"{{ slsdotpath }}-start-{{ default_netvm }}-anticipate-network-use":
+  qvm.start:
+    - name: {{ default_netvm }}
+{% endif -%}
+
+{% set template_updatevm = salt['cmd.shell']("qrexec-policy tpl-sys-firewall @default qubes.UpdatesProxy 2>/dev/null | awk -F '=' '/^target=/{print $2}'") -%}
+{% if template_updatevm -%}
+"{{ slsdotpath }}-start-{{ template_updatevm }}-anticipate-network-use":
+  qvm.start:
+    - name: {{ template_updatevm }}
+{% endif -%}

salt/sys-firewall/prefs-disp.sls

@@ -4,23 +4,40 @@ SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
 SPDX-License-Identifier: AGPL-3.0-or-later
 #}
 
-include:
-  - .create
+{% set qube = 'disp-' ~ slsdotpath -%}
 
-"disp-{{ slsdotpath }}-qubes-prefs-updatevm":
+{% set running = 0 -%}
+{% if salt['cmd.shell']('qvm-ls --no-spinner --raw-list --running ' ~ qube) == qube -%}
+  {% set running = 1 -%}
+{% endif -%}
+
+"{{ qube }}-start":
+  qvm.start:
+    - name: {{ qube }}
+
+"{{ qube }}-qubes-prefs-updatevm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.clone
-    - name: qubes-prefs updatevm disp-{{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs updatevm {{ qube }}
 
-"disp-{{ slsdotpath }}-qubes-prefs-default_netvm":
+"{{ qube }}-qubes-prefs-default_netvm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.clone
-    - name: qubes-prefs default_netvm disp-{{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs default_netvm {{ qube }}
 
-"disp-{{ slsdotpath }}-qubes-prefs-clockvm":
+"{{ qube }}-qubes-prefs-clockvm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.create
-    - name: qubes-prefs clockvm disp-{{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs clockvm {{ qube }}
+
+{% if running == 0 -%}
+"{{ qube }}-shutdown":
+  qvm.shutdown:
+    - name: {{ qube }}
+    - flags:
+      - wait
+      - force
+{% endif -%}

salt/sys-firewall/prefs.sls

@@ -4,23 +4,40 @@ SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
 SPDX-License-Identifier: AGPL-3.0-or-later
 #}
 
-include:
-  - .create
+{% set qube = slsdotpath -%}
 
-"{{ slsdotpath }}-qubes-prefs-updatevm":
+{% set running = 0 -%}
+{% if salt['cmd.shell']('qvm-ls --no-spinner --raw-list --running ' ~ qube) == qube -%}
+  {% set running = 1 -%}
+{% endif -%}
+
+"{{ qube }}-start":
+  qvm.start:
+    - name: {{ qube }}
+
+"{{ qube }}-qubes-prefs-updatevm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.create
-    - name: qubes-prefs updatevm {{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs updatevm {{ qube }}
 
-"{{ slsdotpath }}-qubes-prefs-default_netvm":
+"{{ qube }}-qubes-prefs-default_netvm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.create
-    - name: qubes-prefs default_netvm {{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs default_netvm {{ qube }}
 
-"{{ slsdotpath }}-qubes-prefs-clockvm":
+"{{ qube }}-qubes-prefs-clockvm":
   cmd.run:
     - require:
-      - sls: {{ slsdotpath }}.create
-    - name: qubes-prefs clockvm {{ slsdotpath }}
+      - qvm: {{ qube }}-start
+    - name: qubes-prefs clockvm {{ qube }}
+
+{% if running == 0 -%}
+"{{ qube }}-shutdown":
+  qvm.shutdown:
+    - name: {{ qube }}
+    - flags:
+      - wait
+      - force
+{% endif -%}