Block Whonix templates from repository rewriting.

Assumes that whonix templates all have nodename 'host'.

cacher/change_templates.sls

@@ -3,6 +3,7 @@
 #
 #
 {% if grains['os_family']|lower == 'debian' %}
+{% if grains['nodename']|lower != 'host' %}
 {% for repo in salt['file.find']('/etc/apt/sources.list.d/', name='*list') %}
   {{ repo }}_baseurl:
       file.replace:
@@ -21,6 +22,7 @@
       - repl: 'http://HTTPS/'
       - flags: [ 'IGNORECASE', 'MULTILINE' ]
       - backup: False
+{% endif %}
 
 {% elif grains['os_family']|lower == 'arch' %}
   pacman:

cacher/change_templates.top

@@ -0,0 +1,4 @@
+base:
+  I@qubes:type:template and not P@nodename:host and not P@nodename:whonix.*:
+  - match: compound
+    - cacher.change_templates