Automated Qubes OS Installation using Kickstart and/or PXE Network Boot

Community Guides
10

Thank you.

Hang in there, regardless of what life throws at you.

It’s a very interesting adaptation of Saltstack for Qubes OS. It took me a while to get my head around it, but once I did, I realised that it’s genius.

Salt was designed as a way to make other computers configured, set up, maintained, provisioned, fixed, or otherwise manipulated remotely. Think “IT sysadmin wants to install libreoffice on all work machines, accounting software on machines in the accounting department, change all the root passwords, install new SSH certificates, etc. on 1000+ machines remotely with a single click”, and that’ll tell you what Salt was designed to do.

In Qubes OS, the “work machines” are your VMs (and to some extent, dom0 too…).

It’s a nice way to have a kind of “assembly line” for VM creation, configuring, provisioning, and similar actions.

You should be able to build PXE boot into your Coreboot ROM.

Basically:

  1. The BIOS on the machine you want to boot (client machine) tells the Ethernet NIC to ask for an IP address
  2. sys-pxe responds with “Why hello there. Your IP address is 192.168.100.2. Do you need a PXE binary as well?”
  3. The client machine says “Oh yes please. UEFI, if you don’t mind.” (just like booting from a local drive, some NICs only support Legacy PXE boot, and sys-pxe is able to dish out both)
  4. sys-pxe serves out the GRUB menu
    • Two options. “Automated Install” and “Manual Install”
    • 10 second timer
    • Default option as “Automated Install”
  5. GRUB then loads the custom PXE xen.gz, vmlinuz and initrd.img, and then tells the kernel that the root filesystem is the Qubes ISO
  6. The client machine then loads the Qubes ISO via NFS (I’m working on an option to get the client machine to load the entire ISO into local RAM, which would take 60-90 seconds depending on Ethernet and RAM speed, so the client machine wouldn’t need to stay connected via Ethernet for the entire install, and would reduce load on sys-pxe).
  7. After this point, there is absolutely no difference between booting the Qubes ISO from sys-pxe, and booting the Qubes ISO from a USB drive.
  8. If “Automated Install” was selected (and your Kickstart file doesn’t have errors in it…), Qubes OS should immediately start the installation process, and reboot once it’s completed successfully.

To be fair, it probably is working, and it’s more likely that I have either made a mistake in the config files, or there are functions/options in Salt that I’m not aware of that better achieve what I want the Salt config files to do…

———

DISCLAIMER: I deeply apologise in advance to anyone for any potential offence caused by this next paragraph. It is not my intent to appear as ignorant or to not acknowledge the amazing work that you have done incorporating Saltstack into Qubes OS :see_no_evil:

———

From what I can tell, there is currently two Salt branches in the current Qubes OS install, the “base” branch and the “test” branch.

There is a function in the “test” branch that accounts for cloning templates (which @unman’s fantastic Salt Shaker makes really good use of, by the way, GitHub - unman/shaker ), but as of yet I haven’t been able to get that function to call successfully. Hence why I commented my hacky workaround out.

Salt is very similar to cron in that respect, in that it doesn’t usually allow any output of commands performed. In any case,

Well, I haven’t really designed this for that purpose…

…yet…:wink:

But I could see that as a potential version of this:

Bear in mind that that idea would still need A LOT of work :laughing: