<!--- Before asking, did you search first? Press š at the upper right to search. ---->
user@comp2:~$ sudo service --status-all
[ - ] alsa-utils
[ + ] apparmor
[ - ] avahi-daemon
[ - ] console-setup.sh
[ - ] cron
[ - ] cryptdisks
[ - ] cryptdisks-early
[ + ] cups
[ - ] cups-browsed
[ + ] dbus
[ - ] exim4
[ + ] haveged
[ - ] hwclock.sh
[ - ] keyboard-setup.sh
[ + ] kmod
[ - ] lvm2
[ - ] lvm2-lvmpolld
[ + ] networking
[ + ] openvpn
[ - ] pcscd
[ + ] procps
[ - ] pulseaudio-enable-autospawn
[ + ] rsyslog
[ - ] saned
[ - ] sudo
[ - ] tinyproxy
[ + ] udev
[ - ] x11-common
[ + ] xen
[ + ] xendomains
this is just the standard template based appvm output, Iām not using openvpn, but installed it in case I want it for some old pre-existing configurated AppVMs, I have a separate deb-10 minimal I just updated to -11, that I used for printing, so is there some Cups packages to remove or others ;
or shall I just do https://www.qubes-os.org/doc/templates/debian/#release-specific-notes
Starting services
The Debian way (generally) is to start daemons if they are installed. This means that if you install (say) ssh-server in a template, all the qubes that use that template will run a ssh server when they start. (They will, naturally, all have the same server key.) This may not be what you want.
So be very careful when installing software in Templates - if the daemon spawns outbound connections then there is a serious security risk.
In general, a reasonable approach would be, (using ssh as example):
Install the ssh service.
systemctl stop ssh
systemctl disable ssh
systemctl mask ssh
Close down template
Now the ssh service will NOT start in qubes based on this template.