Minor nitpicks: The wording for the first line makes it sound like
you’ll need to installqubes-usb-proxy
on every vm you intend to
mount
USB on–this is not the case. This is most likely not what
you intended, but I just wanted to clarify something that might
confuse a complete newbie.
In my experience this package is needed in every VM you want to assign
USB devices to (e.g. printer, USB microphone, iPhone, Kindle etc.). This
is different from assigning a USB stick as a block device.
I’ve never had to install
exfat-fuse
orntfs-3g
in my sys-usb
since drives are never mounted there–those packages are installed
in the app-vms. Since my drives work fine, it’s likely this is
unnecessary (but of minimal impact in terms of security). I haven’t
tried mounting encrypting drives but I suspect it’s the same.
I usually mount drives in sys-usb and then send/receive files from/to
there via the respective Qubes OS function. And obviously I mount my
encrypted backup drive in sys-usb. Just different uses than yours.
Maybe I’m confusing this with, but> for PCI HVMs I switch off meminfo
writer (qvm-services [qube] meminfo-writer off
) and addiommu=soft swiotlb=8192
to kernelopts (on top of what’s already there).
I do to, however not to the template with is always PVH. My post
concentrated on templates, but I can share similar scripts for setting
up qubes. However, the basic tools are the same so it would be
repetitive to post it here.
Also: I am aware I am supposed to do all of this with salt. But I
haven’t had the time/energy yet to learn how.