The installer created my sys-firewall, but I built a template for it from Fedora minimal, using this:
Has worked well as a firewall VM since a couple years ago, and i just upgrade the fedoras in it.
It contains qubes-core-agent-dom0-updates, but sys-firewall still can’t be the dom0 UpdateVM if I use my template, but can if i just use a standard fedora-x template.
What else is required in my custom template for it to work as an UpdateVM?
Check your template features in dom0 and compare them with working template:
qvm-features yourtemplate
I can guess that you’re missing some features, maybe supported-service.qubes-updates-proxy. You can add it to your template and check dom0 updates:
qvm-features yourtemplate supported-service.qubes-updates-proxy 1
It seams to have been qubes-menus, which was the only difference from qvm-features that had anything to do with update.