Debian-minimal template for sys-audio

A few notes:
You can create one sys-audio without using the officially provided script.
In the guide, replace

Then, create sys-audio based on deb11-min-audio.


create appvm “sys-audio”, set its virtualization mode to “HVM”, disable memory balancing, attach appropriate “Devices” to it (those whose names start with “Audio”, etc), configure them with ‘no-strict-reset’ (at the bottom of the “Devices” page)

If you manually create sys-audio, and found that in sys-audio, pavucontrol cannot see your soundcard, but “sudo alsamixer” can, then you need to “sudo adduser user audio” in its template VM.

This thread was really helpful for me to set up an audio qube. I followed some of its steps since I reinstalled QubesOS when R4.1 was realeased and lost the setup described here.

The difference is that I wanted to use Bluetooth and had sys-usb handling it. So in my case I decided to make sys-usb my audiovm – there may be some vulnerabilities associated with that but I was too lazy for searching how I could attach the Bluetooth device with sys-audio, as it was not appearing in the USB drop-down menu. So in the above steps, instead of creating a new VM, all I had done was to perform the steps in the sys-usb VM. Bluetooth headset is working properly and also the keyboard shortcuts described above.

One more hint, I was missing a systray icon from which I could control volume. As I don’t know how to place the xfce4-pulseaudio-plugin for the sys-audio (sys-usb in my case) in the main xfce panel (which runs in dom0), my partial solution was to add a launcher widget to the panel and set its command to qvm-run --pass-io sys-usb "pavucontrol". So now I don’t need to open a terminal in sys-audio and type pavucontrol to open the mixer. There might be a better solution to this, but that’s what I have for now.

PS: I actually took some additional steps to install the required packages to run audio and usb services in a fedora-36-minimal fresh template. From this template I made a disposable template in which the modprobe file was added. The autostart scripts were placed in sys-usb.

1 Like

My bluetooth device is in the devices widget drop-down menu. It has no name, only a XXXX-XXXX serial number.

@whoareyou, I’ve been trying to create a sys-audio by following this thread, specially @dom0 post. I have gotten most of the “milestones”, i.e. appVMs showing on Playback and Built-in Audio Analog Stereo showing on Output Devices.

Problem is, much like it was for you, my videos hang at 0:00. I tried the sudo alsactl init command on sys-audio and got the exact same error as you did. Would you mind explaining where I should create the snd.conf file and what should the contents be?

The snd.conf file should be created in the TemplateVM (deb11-min-audio) and placed in the /etc/modprobe.d/ directory. The contents should be this:

options snd_hda_intel power_save=0

This is the command that I used to create the file in deb11-min-audio TemplateVM:

touch /etc/modprobe.d/snd.conf && echo -e "options snd_hda_intel power_save=0" > /etc/modprobe.d/snd.conf

I have recently noticed that I cannot attach my built-in microphone using my debian-minimal-based sys-audio setup. I experience the same error message described in this post whenever I try to attach the microphone to any AppVM:

Error Attaching device Microphone to AppVM failed. Error: QubesVMError - Failed to attach audio input from dom0 to AppVM: pulseaudio agent is not running.

I think that I forgot to test the microphone after setting up this disposable sys-audio, since I do not use the microphone often, and so I think that there must be some extra step.

Is there anyone that can be of assistance here? Anyone with a Librem 14 setting up a similar sys-audio?

It’s better to open separate topic for the issue. With a better visibility it would better help future readers.

@dom0, it seems I had followed your tutorial quite closely and I already had that file.

I’ve spent some time googling the issue and ended up finding this thread which gave me the answer I needed. Which was to add an extra command to the sys-audio-start script you have in your tutorial. The extra command was qvm-run --pass-io sys-audio “amixer -c0 set ‘Auto-Mute Mode’,0 Disable”.

Regarding the microphone, I tried testing it and had the same issue as you did. Would be good if someone more knowledgeable could shed some light on what could be the cause.

But it seems that, since I have a Librem 14, which has the bluetooth provided by the wireless network card, I will have to redo all of this in my Fedora sys-net, as the reason I went through the trouble of creating a sys-audio was because I want to be able to use a bluetooth headset without compromising dom0.

Would there be any difference in the packages I need to install given that the template will change form Debian to Fedora? My understanding is that sometimes packages have slightly different names in different Linux distributions.

1 Like

I made a new post here and received a response with the solution:

Someone can correct me if I am wrong on any of this, but here is my thinking of Bluetooth and the Librem 14:

If you want to use the built-in Wifi-Bluetooth module for Bluetooth audio in a sys-audio qube, then you will have to have the device attached to the sys-audio qube. There are a few options here:

  • attach built-in Wifi-Bluetooth to sys-net and use as sys-audio too (one sys-* qube used for both sys-net and sys-audio functions)

  • attach built-in Wifi-Bluetooth to sys-net and use USB Bluetooth device for sys-audio

  • attach built-in Wifi-Bluetooth to sys-audio and use USB Wifi device for sys-net

One thing to consider is that the built-in Wifi-Bluetooth module does not need any drivers installed in order to use the Wifi, but you would need to install a non-free driver in order to use the Bluetooth.

I made a few attempts to get the built-in Bluetooth to work, but I decided to wait and see if anyone else ends up making a good write-up. Bluetooth is not very important to me, but I would be interested in understanding how to use it if the need ever does arise.

Also, I have split my Wifi and Ethernet networking devices into two separate service qubes: sys-net and sys-wifi. You may want to consider whether you want/need your Wifi and Ethernet in the same service qube.

I almost forgot to mention that I use debian-minimal templates for all my service qubes, and you could as well. There is no need for Fedora if you do not want to use it. That is one of the best things about QubesOS: Choice.

1 Like

@dom0, thank you for the info on the mic. I managed to get it working on my comms qube.

The second option you wrote about peaked my interest. I believe in that case I would have to install the Bluetooth binary blob on sys-net, as it is the qube with the “hardware” attached to, and once the USB Bluetooth becames available on Qubes Device manager attach it to sys-audio. Unfortunately, it will be a couple of weeks before I’ll have time to tinker around with that, but I have it on my ToDo list now.

I understand that using non-free binary blob is not a good idea but I’ve become quite attached to my headset. I use it pretty much all the time, as the noise canceling is surprisingly good, making the sound crystal clear. (as you can see I’ve really grown attached to it :smiley: )

I have thought about splitting my WiFi and Ethernet devices, but I plan on adding a sys-vpn qube and in that case I would have to either make 2 of them and connect one to each networking qube or keep switching the networking qube on sys-vpn. Neither option really appeal to me, but I have been thinking about it as I need at least one qube connected in the open (netflix…).

If you don’t mind me asking, why do you pick debian-minimal for your service qubes instead of fedora-minimal? My choice, if it can be called that, was essentially laziness as I left it on the default one.

1 Like

There are a few reasons why I prefer Debian-minimal templates:

  • Debian has fewer updates than Fedora, and so I do not need to change my templates as often.

  • AppVMs based on minimal templates startup and shutdown faster.

  • Debian-minimal templates seem to take up slightly less space than Fedora-minimal templates.

  • I am more familiar with Debian commands.

As for the splitting of Wifi and Ethernet, I made some launcher scripts in my Panel to set any or all firewall and VPN qubes to use either Wifi or Ethernet. This allows me to switch things up on-the-fly, and I can have Whonix through Ethernet and Clearnet or VPN through Wifi, or vice versa. I just wanted to share some ideas, in case you had not considered it yet. There are lots of options available to you.

If you get Bluetooth working, it would be nice if you could share your experience here or in a new post.

1 Like

OK, I know this thread is from August. but everywhere else points me to it as being the “best” sys-audio minimal template setup thread.

I am completely unable to get sys-audio to see my soundcard. Other qubes are sending it sound; I can see the playback trying to happen, but my output is “Dummy Output.” So I think there’s only one missing piece of the puzzle, and that’s the sound card.

sudo alsactl init simply returns alsactl: init:1759: No soundcards found...

The audiovm service is there, the soundcard is properly added as a device to sys-audio.

sudo qvm-start-daemon --all --watch simply says:

sys-audio: GUI connected to dom0. Skipping
sys-audio: AUDIO connected to None. Skipping

Unless I make sys-audio the audiovm of sys-audio, then it reports:

sys-audio: GUI connected to dom0. Skipping.
sys-audio: Starting AUDIO
Loopback vchan connection not supported
libvchan_client_init: No such file or directory

My attempts to “autostart” pulseaudio and the daemon with those desktop files, by the way, failed; pulseaudio has to be manually started, and the daemon may or may not have started. (This time, it didn’t). EDIT–This is fixed

with the exception of alsactl init, all of the alsa commands pointed to in this thread result in command not found, even though they are installed according to apt-get. That is true whether or not I run them as sudo.

I imagine you’ll want more info; please let me know what’s still missing. Thank you in advance.

Also: sudo alsactl restore returns:

alcactl: load_state:1683: Cannot open /var/lib/alsa/asound.state for reading: No such file or directory

I’m beginning to suspect that somehow my alsa stuff isn’t properly installed.

1 Like

My sys-audio displays the same output uness I perform the procedure outlined in my earlier post:

Each time I start QubesOS on my Librem 14, I run the following script:


qvm-start --quiet sys-audio
qvm-shutdown --wait sys-audio
qvm-start --quiet sys-audio
qvm-shutdown --wait sys-audio
qvm-start --quiet sys-audio
sleep 3
qvm-run --pass-io sys-audio "amixer sset Master 0%"

This is also important:

If you have opted for a disposable sys-audio, then I would recommend testing my hypothesis. I did this by starting sys-audio and using the pavucontrol package to check if “Dummy Output” changed to “Built-in Audio Analog Stereo” or not. If not, shutdown sys-audio and try again. If your sys-audio is non-disposable, then it might be unpredictable like my experience.

Hopefully this is helpful. Otherwise, maybe someone else could share their experiences.

1 Like

Thanks for responding.

I basically gave up on debian minimal for this at some point then spent another big long thread trying to get fedora to work (NOT my preference but they seemed to be having better luck with it), with the same result–my machine would pretend to play music, but nothing would come out of my speakers because sys-audio wouldn’t recognize my device. At this point, basically my debian-based sys-audio is long gone.

(Fedora six ring rodeo trying to get that to work: Setting up an audio VM - #28 by logoerthiner)

Nevertheless I tried cycling both a disposable and non-disposable version of that template like you talked about here…with zero success.

It’s just as well, honestly. If I have to do that every time I start it, it’s a broken piece of junk I don’t want on my system. Assuming I went with the disposable, how long would it be before my audio quit working because now it needs to be cycled 5 times instead of 3?

If it won’t work the first time it comes up, it’s crap.

EDIT TO ADD: Recreated my deb11 minimal stuff…same result. No amount of repetition will find the driver I seem to be missing.

1 Like

Ok, I finally resolved the hardware part (making pulseaudio recognize my soundcard).

After a clean installation as post #2, only root has access to audio. You can identify that by running alsamixer and pulseaudio as root, and see the differences from running them as user. To fix this, you need to remove pulseaudio in the template, and reinstall those removed packages. This will make everything happy.

BTW, just a notice, gnome-keyring isn’t necessary for this setup.


I’m probably going to love this…once I figure out exactly what you’re saying!

You’re saying to NOT install pulse audio in the template? Then you say to install “removed packages”. Which removed packages?

I note that two other users have liked this, so they must have understood you and I feel a bit stupid having to ask for clarification.

After following the steps in post #2, you’ll get a sys-audio which correctly receives audio streams from other qubes, but cannot play sound. The reason is that after all of these, in sys-audio , only root has the privilege to talk to the soundcard. So the regular pulseaudio instance running as user doesn’t know your soundcard.

To make the regular user user have access to the soundcard, you have to shutdown sys-audio, boot up its template, remove pulseaudio, and reinstall those removed packages. After this, pulseaudio running as user will see your soundcard in Output devices.

and reinstall those removed packages.

That’s where I’m getting confused.

What “removed packages”? Pulseaudio itself? That’s just one package, I think. (And even if so…I am not sure I can do an apt-install except with sudo.)

Thank you for your patience.

[next task for someone…you? me, if this works for me? Figure out how to install it properly the first time. Ideally this could be done in salt, somehow, without a special go-back-and-fix-it sequence that must be done manually. I have a couple of VMs that have such requirements (e.g. a printer driver that apparently must be configured manually, likewise with a couple of browser qubes) and I really don’t like it.]

Yes, Qubes needs help from the Community for that.