Quick update: this is coming along nicely. As of qubes-mgmt-salt-user-split-ssh-0.2.2-1.fc32.noarch.rpm the Salt formula is behaving the way I expect, and I am satisfied with its structure.
For reference, the configuration file looks like this (and persists between updates):
# /srv/user_pillar/split-ssh/config.yaml
---
vaults:
- name: ssh-vault
template: fedora-32
label: black
mem: 400
vcpus: 2
autostart: True
clients:
- name: work
template: fedora-32
label: blue
mem: 400
vcpus: 2
autostart: False
- name: another-ssh-client
template: fedora-32
label: blue
mem: 400
vcpus: 2
autostsart: True
Beyond a few limitations (e.g. I haven’t looked into supporting other templates than fedora-based ones though it is certainly possible; I don’t personally need more than one vault and left support for multiple vaults incomplete) the formula covers what I believe are the most common uses cases.
There are a couple of things that I’d like to refine in the way the RPM packages / installation behave (e.g. the package currently includes a workaround for this issue that is not very elegant) but I think at this point the next step is writing some documentation.
If you’re able to follow along the code (Salt formula, RPM packaging, or RPM publishing, linked in earlier updates) and have thoughts on what would be most valuable to explain, please let me know here! 