Reproducible and declarative configuration in QubesOS

[Waltz5]

I’m looking for ways to achieve reproducibility in QubesOS, similar to NixOS. I’ve considered using Timeshift to create snapshots of my system at various points in time, allowing me to track and replicate configurations. Are there any other approaches or tools that can help me achieve this goal?

[ludovic]

Hi @Waltz5 ,
If you don’t know it, the below post is an entry point for you :

Improvements in testing and building: GitLab CI and reproducible builds

[Waltz5]

Hi @ludovic,
I’m not looking to modify the Qubes OS source code to achieve reproducibility. Instead, I’m looking for a way to achieve a declarative and reproducible configuration of my QubesOS system, similar to what NixOS provides.

In NixOS, the global configuration file (/etc/nixos/configuration.nix) defines the entire system state, including installed packages, services, and system settings. This allows for a declarative approach to system management, making it easy to reproduce configurations across different installations/machines.

I’m looking for a similar approach in Qubes OS. So far, the closest thing I’ve thought of is using a bash script that uses Qubes management tools like qvm-create, qvm-clone, qvm-prefs, etc. to apply configurations to the system after installation, based on the original ISO. This script would be the key to achieving reproducibility, as it would define the exact configuration of my system. To mitigate any unwanted behavior the script could cause, I would use Timeshift to create snapshots of my system before running the script.

I want to emphasize that I’m not looking to modify the Qubes OS source code or build a custom ISO, I think that would be overly complex for what I want to achieve. Is there a better way to achieve declarative and reproducible configuration management in Qubes OS?

[ludovic]

@Waltz5

I’m not looking to modify the Qubes OS source code to achieve reproducibility.

In fact I misunderstood your needs…

@Waltz5

Instead, I’m looking for a way to achieve a declarative and reproducible configuration of my QubesOS system, similar to what NixOS provides.

@Waltz5

the closest thing I’ve thought of is using a bash script that uses Qubes management tools like qvm-create, qvm-clone, qvm-prefs, etc.

Yes Bash script is a way to do it. The other ways are Salt and Ansible (presently very alpha).

[unman]

I’m looking for a similar approach in Qubes OS. So far, the closest thing I’ve thought of is using a bash script that uses Qubes management tools like qvm-create, qvm-clone, qvm-prefs, etc. to apply configurations to the system after installation, based on the original ISO. This script would be the key to achieving reproducibility, as it would define the exact configuration of my system.

Salt is the simplest way to configure whole systems, down to individual
qube configuration. bash scripts are dreadful for that.
An advantage of using salt is that you can easily rebuild subsets of
your system at will.

To mitigate any unwanted behavior the script could cause, I would use Timeshift to create snapshots of my system before running the script.

I have used various means for this, not Timeshift.
I use zapqfranz for backups of system and config files, but in the past
have used classic rsync timemachine. Anything to keep config and system
restorable to known working state.
In the years I’ve been using Qubes I dont think I have ever had to use
this.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.