Mirage-firewall - drop in kernel *before* provisioning qube

mirage/install.sls

@@ -10,6 +10,11 @@
     - mode: 755
     - makedirs: True
 
+mirage-firewall-kernel:
+  file.managed:
+    - name: /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz
+    - source: salt://mirage/qubes-firewall.xen
+
 mirage-firewall:
   qvm.present:
     - name: mirage-firewall
@@ -38,9 +43,4 @@ mirage-firewall-features:
       - qubes-firewall
       - no-default-kernelopts
 
-mirage-firewall-kernel:
-  file.managed:
-    - name: /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz
-    - source: salt://mirage/qubes-firewall.xen
-
 {% endif %}