I want to like liteqube, and in theory I do, but I can’t use it until installation and management is streamlined. I’d love to support and test, but unfortunately I think this would just be the straw that breaks the camel’s back as far as one more thing to do right now when I’m already very busy. I did take a moment to see if I could give feedback as a potential user.
First, @arkenoi, you may want to use ansible and python instead of salt and bash since ansible seems to be the future. Also, the Qubes team uses python, not bash, for cross-OS compatibility (and bash is less secure than python out of the box anyways). I’m not a fan of python per se. In fact I hate that it’s syntax is based on whitespace, but that’s immaterial. But there’s a lot of precedent here.
Second, for the project to be viable for normal use, some things need to be upstreamed to Qubes if possible. The template and RPC calls at least. That would make the project relevant to more than just those wanting the whole package. It would also make installation and maintenance much more manageable as far as trust, updates, and portability go. This is a big deal for me as I can’t think about everything, and I want to avoid trusting extraneous sources unnecessarily. The coding in bash instead of python and ansible as mentioned makes this even harder.
Third, it seems like it’s trying to do too much at once. I understand the idea and have nothing against it, I just think maybe the base functionality should be separate from the features, like mail, storage, and RDP from networking, VPN, audio, and USB. This is admittedly arbitrary though, and mainly a precursor to my last main issue.
Last, the liteqube seems a bit unorganized, like you’re trying to fit too many things in one small box. On one hand I understand this is kind of the point, but I think it could be done with more elegance. My system is complex and I have near 50+ qubes, as I’m sure others do too. But because my main setup is complicated, I need everything that can be to be simple and easily understandable. IMO, the web of RPC and what does what is just a little too tangled for my taste. But that may be improved simply by a move to Salt or Ansible where the configuration is more human-readable.
I’m in no way saying that this is a bad project. In fact, I really like it. I’m glad to see a real effort to harden qubes in a meaningful way by stripping attack surface and adding “now you’re thinking with Qubes” designs like the VM boot protect stuff. I also like the real potential for simplification and ease of understanding because it’s important to understand a system to be secure with it. I just think it’s too early in the design stage for me to be able to work with it because of the existing complexity of my qubes. Hope this was helpful.
