<?xml version="1.0" encoding="UTF-8"?>
<metadata xmlns="http://linux.duke.edu/metadata/common" xmlns:rpm="http://linux.duke.edu/metadata/rpm" packages="17">
<package type="rpm">
  <name>3isec-qubes-admin</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1" rel="3.fc41"/>
  <checksum type="sha256" pkgid="YES">45353eaf19aa9563f536899463d4f18f674c35ce4631a8e37139012599aa687e</checksum>
  <summary>Prepares an admin qube for use in Qubes</summary>
  <description>This package creates a template cloned from debian-13-minimal which can
be used as the basis for admin qubes. A default sys-admin is created.
A policy file is created which allows sys-admin to control only qubes
created by it - the file contains a commented section for extending
administration to all qubes.</description>
  <packager></packager>
  <url></url>
  <time file="1783949562" build="1783949528"/>
  <size package="10321" installed="6850" archive="7968"/>
  <location href="3isec-qubes-admin-1-3.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-admin-1-3.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="8877"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-admin" flags="EQ" epoch="0" ver="1" rel="3.fc41"/>
      <rpm:entry name="3isec-qubes-admin(x86-64)" flags="EQ" epoch="0" ver="1" rel="3.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-cacher</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.17" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">cd25d1cf6388cd4be387bad7b477bbef9be134b8af6128169f01b0397a33c524</checksum>
  <summary>A caching proxy in Qubes</summary>
  <description>This package provides a caching proxy qube, named cacher.
A caching proxy stores downloaded packages, so that you need only download
a package once for it to be used when updating many templates.
The proxy is preconfigured to work out of the box for Debian, Ubuntu,
Arch, BlackArch, Qubes, and Fedora templates.

When you install this package your Qubes system will be altered to use
the proxy by default.
This is done with an entry in /etc/qubes/policy.d/50-config-updates.policy
in Qubes 4.2
If you want to change the proxy setting for some/all templates, edit
that file, or use the GUI global settings tool.

So that you can use https:// in your repository definitions, the entries
will be changed in the templates.
 https:// becomes http://HTTPS///
This is so that the request to the proxy is plain text, and the proxy
will then make the request via https
This change will be done automatically for every template that exists
when you install this package. NOTE THAT THIS REQUIRES SALTING OF EVERY
TEMPLATE - WHONIX TEMPLATES WILL NOT BE CHANGED.

If you install a new template, you must make this configuration change.
In dom0 run:
 qubesctl --skip-dom0 --targets=TEMPLATE state.apply cacher.change_templates
replacing TEMPLATE with the name of the new template.

If you want to use the standard proxy, you have to revert this change,
as well as editing the policy file.
In dom0 run:
 qubesctl --skip-dom0 --targets=TEMPLATE state.apply cacher.restore_templates
replacing TEMPLATE with the name of the new template.

When this package is installed it will attempt to rewrite repository
definitions in ALL templates.
NOTE THAT THIS REQUIRES STARTING AND SALTING OF EVERY TEMPLATE.
This includes templates that are not under salt control, like Windows
templates.
You must manually shutdown those templates.

No changes are made to Whonix templates, and updates to those templates
will not be cached.

If you want updates to run via Tor, set the netvm for the cacher qube
to be a Tor proxy, like sys-whonix.

Because the cacher qube is listening on port 8082, you can use it from
non-template qubes and qubes that do not have a working qrexec. Use
the native configuration to set the update proxy using the IP address
of cacher.

A pillar is created to hold the caching qube.
This can be referenced from other salt states as needed.</description>
  <packager></packager>
  <url></url>
  <time file="1761292095" build="1761291502"/>
  <size package="28385" installed="50672" archive="55004"/>
  <location href="3isec-qubes-cacher-1.17-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-cacher-1.17-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="12937"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-cacher" flags="EQ" epoch="0" ver="1.17" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-cacher(x86-64)" flags="EQ" epoch="0" ver="1.17" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-common</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.2" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">0e8b1f64f06b997813db337d78f4eb14287ea24b5a332f0556dc926598ff23f3</checksum>
  <summary>Common files for 3isec packages</summary>
  <description>This package provides base sls files for use by other 3isec packages</description>
  <packager></packager>
  <url></url>
  <time file="1761292095" build="1761291687"/>
  <size package="13608" installed="17246" archive="19024"/>
  <location href="3isec-qubes-common-1.2-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-common-1.2-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="8065"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-common" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-common(x86-64)" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/bash"/>
      <rpm:entry name="/usr/bin/xdg-open"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-dnscrypt</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.2" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">8155ab451897391ecf287d44eae69fe121c354757fdf66f36452badcb9461643</checksum>
  <summary>Provides a template and qube providing DNSCrypt in Qubes</summary>
  <description>This package creates a template with dnscrypt-proxy installed.
The template is based on the debian-13-minimal template.
A template based qube, sys-dnscrypt, is created with a vanilla version of dnscrypt-proxy installed.
The new qube is configured to drop in to the Qubes networking model.
It supports qubes-firewall.
However, NO DNS traffic is forwarded, and all such traffic is passed through dnscrypt-proxy.
The installation follows the documentation but the service must be manually started.</description>
  <packager></packager>
  <url></url>
  <time file="1783423174" build="1783422713"/>
  <size package="4748585" installed="4750610" archive="4752972"/>
  <location href="3isec-qubes-dnscrypt-1.2-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-dnscrypt-1.2-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="10409"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-dnscrypt" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-dnscrypt(x86-64)" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-doc</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1" rel="4.fc41"/>
  <checksum type="sha256" pkgid="YES">1183a90dd418027dadacaeec7105c8828530a0b20fac01964f00e667c22a549b</checksum>
  <summary>Prepares qube for building Qubes web site and documentation</summary>
  <description>These salt files can be used to set-up a template for building the Qubes website and documentation.
The template is a clone of the fedora-42 template.
A qubes-doc qube is created and configured to use git and split-gpg.
Helper scripts are included to aid building.</description>
  <packager></packager>
  <url></url>
  <time file="1765199290" build="1765199272"/>
  <size package="24599" installed="40516" archive="42972"/>
  <location href="3isec-qubes-doc-1-4.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-doc-1-4.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="10557"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-doc" flags="EQ" epoch="0" ver="1" rel="4.fc41"/>
      <rpm:entry name="3isec-qubes-doc(x86-64)" flags="EQ" epoch="0" ver="1" rel="4.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/sh"/>
      <rpm:entry name="3isec-qubes-common"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-git</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.04" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">5e3b46c3e8c85035d12ce8c7ce699be51137861817384ce9ac8f20b00532f793</checksum>
  <summary>Create sys-git in Qubes</summary>
  <description>This package provides a central git qube, named sys-git.
By default the qube has no netvm, but you can set one if you wish.

Some configuration is needed.
Repositories must be created under /home/user/repos in sys-git, and
repository names must be common between sys-git and client qubes.




In sys-git, repositories are stored bare under /home/user/repos
First, prepare a repository:
```
mkdir repos/X
cd repos/X
git init --bare
```


Then prepare a qube by running in dom0:
`sudo qubesctl --skip0-dom0 --targets=QUBE state.apply git.install_client`


Configure git, as necessary.
Open a terminal in the qube:
```
mkdir X
cd X
git init
add-remote sg
```
You can then use that repository as usual, making commits.
To push to sys-git you must first:
`git push --set-upstream sg master`

After making more commits:
`git push `




Prepare a qube by running:
`sudo qubesctl --skip0-dom0 --targets=QUBE state.apply git.install_client`


Configure git, as necessary.
Open a terminal in the qube:
```
mkdir X
cd X
git init
add-remote sg
git pull sg master
```


You can then use that repository as usual.
To push to sys-git you must first-
`git push --set-upstream sg master`

After making more commits,
`git push `



Access to sys-git is governed by policy rules in `/etc/qubes/policy/30-user.policy`
The default rule allows access from any qube to sys-git, after a confirmation dialog.
`qubes.Git  *  @anyvm  @anyvm ask default_target=sys-git`

You can control access to sys-git by qube, and restrict qubes to specific named repositories:
```
qubes.Git  +REPO  QUBE   @anyvm  ask default_target=sys-git
qubes.Git  *      QUBE2  @anyvm  ask default_target=sys-git
qubes.Git  *      *     sys-git deny
```
These rules will allow QUBE to access the REPO repository on sys-git, but no other.
QUBE2 is allowed to access any repository on sys-git.
No other qube is allowed access at all.</description>
  <packager></packager>
  <url></url>
  <time file="1783423174" build="1783423042"/>
  <size package="12871" installed="5105" archive="6632"/>
  <location href="3isec-qubes-git-1.04-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-git-1.04-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="10829"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-git" flags="EQ" epoch="0" ver="1.04" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-git(x86-64)" flags="EQ" epoch="0" ver="1.04" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/usr/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-mirage-firewall</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="0.9.5" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">d7e746bdf1312e7e9abf6a16e04b78dc55b84445213f2feb5de14d6c3b30f26a</checksum>
  <summary>Create an Mirage firewall in Qubes</summary>
  <description>This package creates a mirage firewall for use in Qubes.
It's a Unikernel qube to replace sys-firewall, which uses minimal system resources.
For full details:
https://github.com/mirage/qubes-mirage-firewall

The package creates a qube called mirage-firewall.
If you want to use this as a firewall, simply change net qube from sys-firewall to mirage-firewall.

Removing this package will remove the mirage-firewall.
Qubes that use it will have their net qube unset.
You will have to change netqube to get those qubes back online.</description>
  <packager></packager>
  <url></url>
  <time file="1761835515" build="1761835473"/>
  <size package="1308017" installed="4321919" archive="4322636"/>
  <location href="3isec-qubes-mirage-firewall-0.9.5-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-mirage-firewall-0.9.5-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="9525"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-mirage-firewall" flags="EQ" epoch="0" ver="0.9.5" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-mirage-firewall(x86-64)" flags="EQ" epoch="0" ver="0.9.5" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-monitor</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="2" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">0937f4e2b98fe35fbf65bcb41b35ddeec961cd6cb563bba987d9b26a49625693</checksum>
  <summary>Prepares qube for network monitoring in Qubes</summary>
  <description>This package creates a template, with tools installed for network monitoring.
An AppVM named sys-monitor, is created from that template.
The template, template-monitor, is cloned from the debian-13-minimal template.
If the debian-13-minimal template is not present, it will be downloaded
and installed - this may take some time depending on your net connection.
sys-monitor is created with `provides_network` set, so you can attach qubes to it, setting it as the netvm.
Wireshark, suricata, tcpdump, and tcpflow are installed and ready to run.
The template has passwordless root installed, so you can run packet captures using `sudo..`.
If you want to run wireshark as an ordinary user, you will have to follow the instructions in `/srv/salt/monitor/README.md` to reconfigure the package.</description>
  <packager></packager>
  <url></url>
  <time file="1769300751" build="1769300672"/>
  <size package="12110" installed="6640" archive="7912"/>
  <location href="3isec-qubes-monitor-2-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-monitor-2-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="9517"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-monitor" flags="EQ" epoch="0" ver="2" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-monitor(x86-64)" flags="EQ" epoch="0" ver="2" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-mullvad-vpn</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="2025.9" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">efdfc7c4357f906f1bb23ce1a514830719a5d9cb3040f2e08c2c25189b52a0b8</checksum>
  <summary>Set up a Mullvad qube and disposable template</summary>
  <description>This package creates a template, loaded with the MullvadVPN GUI and Mullvad Browser.
An AppVM named sys-mullvad, and a disposable template, mullvad-dvm, are
created from that template.

The template, template-mullvad, is based on the debian-13-minimal template.
If the debian-13-minimal template is not present, it will be downloaded
and installed - this may take some time depending on your net connection.

Both the AppVM and the disposable template have the Mullvad GUI to
set up a VPN, and the Mullvad browser. You can run the Mullvad Browser
independently of the VPN.
The sys-mullvad AppVM can be used as a standard AppVM or as a vpn gateway
- set the netvm of client qubes to mullvad, and they will use the VPN. No
traffic will pass except through the VPN.

If you remove this package, the salt files will be removed, but the qubes will not.
You can manually remove them if you wish.

You can, of course, use template-mullvad to create other qubes for
separate VPN connections, or a qube where you will just use the Mullvad browser.

Remember that each qube that creates a VPN will count toward the maximum of 6 clients.
Log out and close the VPN when you have finished with it: if you do  not,
you will be prompted to log out other clients from the GUI.</description>
  <packager></packager>
  <url></url>
  <time file="1761292095" build="1761291593"/>
  <size package="19059" installed="14645" archive="17572"/>
  <location href="3isec-qubes-mullvad-vpn-2025.9-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-mullvad-vpn-2025.9-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="11565"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-mullvad-vpn" flags="EQ" epoch="0" ver="2025.9" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-mullvad-vpn(x86-64)" flags="EQ" epoch="0" ver="2025.9" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/sh"/>
      <rpm:entry name="/usr/sbin/nft"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-mullvad-vpn</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="2025.9" rel="2.fc41"/>
  <checksum type="sha256" pkgid="YES">34addd513f9ffb9cfa04eb72c3ec30fb3c4a818e3329df629bca604ce4d3a3e9</checksum>
  <summary>Set up a Mullvad qube and disposable template</summary>
  <description>This package creates a template, loaded with the MullvadVPN GUI and Mullvad Browser.
An AppVM named sys-mullvad, and a disposable template, mullvad-dvm, are
created from that template.

The template, template-mullvad, is based on the debian-13-minimal template.
If the debian-13-minimal template is not present, it will be downloaded
and installed - this may take some time depending on your net connection.

Both the AppVM and the disposable template have the Mullvad GUI to
set up a VPN, and the Mullvad browser. You can run the Mullvad Browser
independently of the VPN.
The sys-mullvad AppVM can be used as a standard AppVM or as a vpn gateway
- set the netvm of client qubes to mullvad, and they will use the VPN. No
traffic will pass except through the VPN.

If you remove this package, the salt files will be removed, but the qubes will not.
You can manually remove them if you wish.

You can, of course, use template-mullvad to create other qubes for
separate VPN connections, or a qube where you will just use the Mullvad browser.

Remember that each qube that creates a VPN will count toward the maximum of 6 clients.
Log out and close the VPN when you have finished with it: if you do  not,
you will be prompted to log out other clients from the GUI.</description>
  <packager></packager>
  <url></url>
  <time file="1761820712" build="1761820692"/>
  <size package="20196" installed="14634" archive="17560"/>
  <location href="3isec-qubes-mullvad-vpn-2025.9-2.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-mullvad-vpn-2025.9-2.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="12709"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-mullvad-vpn" flags="EQ" epoch="0" ver="2025.9" rel="2.fc41"/>
      <rpm:entry name="3isec-qubes-mullvad-vpn(x86-64)" flags="EQ" epoch="0" ver="2025.9" rel="2.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/sh"/>
      <rpm:entry name="/usr/sbin/nft"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-pihole</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.5" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">a6766f8314d701384a544b56f8557e2188a88f9fc1a341eb0ef5d56841f1ee64</checksum>
  <summary>Creates Pi-hole server for Qubes</summary>
  <description>This is Pi-hole.
It blocks advertisements and internet trackers by providing a DNS sinkhole.

The package will create a new standalone qube, sys-pihole.
It is a drop in replacement for sys-firewall.
Sys-pihole is attached to sys-net.
If you have sys-firewall as the default netvm, this will be changed to sys-pihole.
The installation will try to move all qubes with netvm of sys-firewall to sys-iphole.
sys-firewall will *not* be removed, so you can still use it for some qubes if you want.

 If you want to use Tor, then you should reconfigure your system like this:
 qubes -&gt; sys-pihole -&gt;Tor-gateway -&gt; sys-firewall -&gt; sys-net

You can clone sys-pihole.
If you do you must manually change the IP address of the clone.

Pi-hole will be installed with these default settings:
 The DNS provider is Quad9 (filtered, DNSSEC)
 StevenBlack's Unified Hosts List is included
 The web interface is availble at http://localhost/admin
 Query logging is enabled to show everything.

You can change these settings by logging in to the admin interface at http://localhost/admin
The default Admin Webpage login password is UpSNQsy4
You should change this on first use, by running:
`pihole -a -p`

Removing this package will only remove the salt files from /srv/salt.
It will NOT remove the sys-pihole qube.
It will NOT change Qubes networking.
You will have to make any changes as you wish.</description>
  <packager></packager>
  <url></url>
  <time file="1762385031" build="1762384499"/>
  <size package="13523" installed="7083" archive="8776"/>
  <location href="3isec-qubes-pihole-1.5-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-pihole-1.5-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="10705"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-pihole" flags="EQ" epoch="0" ver="1.5" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-pihole(x86-64)" flags="EQ" epoch="0" ver="1.5" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/bash"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-reader</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.2" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">6b798bd00e5f93be2d7f5f5113bbd8756f5ac080b2517ff099625dea9a312e81</checksum>
  <summary>Prepares useful software in Qubes</summary>
  <description>This package creates a template configured with a range of useful software, of particular use to terminal users.
The template is based on the debian-12-xfce template.
The new template is set as the default template and as template for the global disposable template.

Removing this package does NOT revert these changes.
It only removes the salt files.
You must manually set another template as the default using
qubes-global-settings, and qubes-template-manager.</description>
  <packager></packager>
  <url></url>
  <time file="1761833890" build="1761833801"/>
  <size package="9544" installed="1703" archive="2392"/>
  <location href="3isec-qubes-reader-1.2-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-reader-1.2-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="8709"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-reader" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-reader(x86-64)" flags="EQ" epoch="0" ver="1.2" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-store</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.02" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">c942690d58c5ec640691ae044a179afaa4b83b33917982dda76034d12347a3e5</checksum>
  <summary>A storage template using thunar</summary>
  <description>This package creates a template with thunar installed, for use by offline storage qubes.
The template is based on the debian-13-minimal template.

Removing this package only removes the salt files, not the template.</description>
  <packager></packager>
  <url></url>
  <time file="1783423174" build="1783422932"/>
  <size package="9024" installed="1532" archive="2224"/>
  <location href="3isec-qubes-store-1.02-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-store-1.02-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="8269"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-store" flags="EQ" epoch="0" ver="1.02" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-store(x86-64)" flags="EQ" epoch="0" ver="1.02" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-syncthing</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.4" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">ddbf8dcb5b33609981efc01cd38d3396d3c993f50ba12e88bd4dbe1de817f2d0</checksum>
  <summary>Syncthing in Qubes</summary>
  <description>Creates a syncthing template and active syncthing qube.
By default the syncthing qube will be attached to sys-firewall, or sys-pihole if that qube exists.
It makes no sense to run this with syncthing attached to a VPN or Tor proxy.

A qubes.Syncthing service is created, to allow use of syncthing over qrexec.
A default policy is set in /etc/qubes/policy.d/30-user.policy to deny all.
If you want to allow syncthing between qubes, insert a line at the top of the policy file to allow. E.g:
  qubes.Syncthing  *  FROM  TO  allow

A script is provided in /srv/salt/3isec-common/.in.sh to allow for inbound connections.
This script opens up the qubes-firewall, so that the syncthing qube is accessible externally.
If sys-net has more than one network card the FIRST external interface will be used by default.
(If this is incorrect, you must change it manually. In dom0:
  /srv/salt/syncthing/in.sh delete syncthing tcp 22000 -a -p
  /srv/salt/syncthing/in.sh delete syncthing udp 22000 -a -p
  /srv/salt/syncthing/in.sh add syncthing tcp 22000 -p
  /srv/salt/syncthing/in.sh add syncthing udp 22000 -p
This will let you choose the NIC.)

The package can be uninstalled using:
  sudo dnf remove 3isec-qubes-syncthing
The syncthing qube will NOT be removed, but the Syncthing service on that qube will be stopped.
N.B. If you have manually set firewall rules you must manually revert them.
The qrexec policy will be reverted to stop Syncthing between qubes.

The package includes qubes-rsyncthing.service.
This enables use of syncthing between qubes over qrexec - the service must be enabled to be used:
  qubes-features QUBE service.qubes-syncthing 1
By default the service will connect to the syncthing qube.
To use the service, add a Remote Device, and copy the DeviceID from the target qube.
On the Advanced tab, under Addresses, change "dynamic" to "tcp://127.0.0.1:22001"

If the sender qube has no netvm set, under "Settings", disable "Enable NAT traversal", "Local Discovery",
"Global Discovery", and "Enable Relaying"</description>
  <packager></packager>
  <url></url>
  <time file="1763919237" build="1763919183"/>
  <size package="15915" installed="6184" archive="8544"/>
  <location href="3isec-qubes-syncthing-1.4-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-syncthing-1.4-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="12377"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-syncthing" flags="EQ" epoch="0" ver="1.4" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-syncthing(x86-64)" flags="EQ" epoch="0" ver="1.4" rel="1.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="3isec-qubes-common"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-syncthing</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.4" rel="2.fc41"/>
  <checksum type="sha256" pkgid="YES">aa94a62395dfc21b59ed6966fec2828735765d44a333689d95946ac360a9b7dd</checksum>
  <summary>Syncthing in Qubes</summary>
  <description>Creates a syncthing template and active syncthing qube.
By default the syncthing qube will be attached to sys-firewall, or sys-pihole if that qube exists.
It makes no sense to run this with syncthing attached to a VPN or Tor proxy.

A qubes.Syncthing service is created, to allow use of syncthing over qrexec.
A default policy is set in /etc/qubes/policy.d/30-user.policy to deny all.
If you want to allow syncthing between qubes, insert a line at the top of the policy file to allow. E.g:
  qubes.Syncthing  *  FROM  TO  allow

A script is provided in /srv/salt/3isec-common/.in.sh to allow for inbound connections.
This script opens up the qubes-firewall, so that the syncthing qube is accessible externally.
If sys-net has more than one network card the FIRST external interface will be used by default.
(If this is incorrect, you must change it manually. In dom0:
  /srv/salt/syncthing/in.sh delete syncthing tcp 22000 -a -p
  /srv/salt/syncthing/in.sh delete syncthing udp 22000 -a -p
  /srv/salt/syncthing/in.sh add syncthing tcp 22000 -p
  /srv/salt/syncthing/in.sh add syncthing udp 22000 -p
This will let you choose the NIC.)

The package can be uninstalled using:
  sudo dnf remove 3isec-qubes-syncthing
The syncthing qube will NOT be removed, but the Syncthing service on that qube will be stopped.
N.B. If you have manually set firewall rules you must manually revert them.
The qrexec policy will be reverted to stop Syncthing between qubes.

The package includes qubes-rsyncthing.service.
This enables use of syncthing between qubes over qrexec - the service must be enabled to be used:
  qubes-features QUBE service.qubes-syncthing 1
By default the service will connect to the syncthing qube.
To use the service, add a Remote Device, and copy the DeviceID from the target qube.
On the Advanced tab, under Addresses, change "dynamic" to "tcp://127.0.0.1:22001"

If the sender qube has no netvm set, under "Settings", disable "Enable NAT traversal", "Local Discovery",
"Global Discovery", and "Enable Relaying"</description>
  <packager></packager>
  <url></url>
  <time file="1769923565" build="1769923545"/>
  <size package="16676" installed="7000" archive="9360"/>
  <location href="3isec-qubes-syncthing-1.4-2.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-syncthing-1.4-2.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="12345"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-syncthing" flags="EQ" epoch="0" ver="1.4" rel="2.fc41"/>
      <rpm:entry name="3isec-qubes-syncthing(x86-64)" flags="EQ" epoch="0" ver="1.4" rel="2.fc41"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="3isec-qubes-common"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-sys-multimedia</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="2.4" rel="1.fc41"/>
  <checksum type="sha256" pkgid="YES">1df0630efa3de8a28b2e5c1bec2595fa2e0843dd78b3855fcf0e54bdc35dbebb</checksum>
  <summary>creates multimedia template and qubes</summary>
  <description> This package sets up qubes to work mith multimedia files in Qubes.
 By default a qube named "media" is created, and configured so that any
 multimedia files are opened in a named disposable called "multimedia".
 This provides some measure of protection when working with untrusted files.

The media qube is offline by default.
The multimedia disposable is offline by default.
You can change this if you wish, but be aware that this may result in
data leakage.

Organise and store media files in the media qube. The media qube has thunar
installed and is based on a minimal template. This reduces the risk of opening
a file in the storage qube itself.
Opening a file in the media qube will open the multimedia disposable and play
the file there.
The multimedia disposable will shut down automatically when all active windows
are closed.
You can also use the multimedia disposable from any other qube, or use the
disposable template to create more disposables with different settings -
perhaps online, or restricted to certain IP addresses.
Access to the multimedia qube is controlled from the policy file in
/etc/qubes/policy.d/30-user.policy</description>
  <packager></packager>
  <url></url>
  <time file="1761292095" build="1761291764"/>
  <size package="33778" installed="85117" archive="87172"/>
  <location href="3isec-qubes-sys-multimedia-2.4-1.fc41.x86_64.rpm"/>
  <format>
    <rpm:license>GPLv3+</rpm:license>
    <rpm:vendor></rpm:vendor>
    <rpm:group>Unspecified</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-sys-multimedia-2.4-1.fc41.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="10757"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-sys-multimedia" flags="EQ" epoch="0" ver="2.4" rel="1.fc41"/>
      <rpm:entry name="3isec-qubes-sys-multimedia(x86-64)" flags="EQ" epoch="0" ver="2.4" rel="1.fc41"/>
      <rpm:entry name="libdvdcss.so.2()(64bit)"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="3isec-qubes-common"/>
      <rpm:entry name="rtld(GNU_HASH)"/>
      <rpm:entry name="libc.so.6(GLIBC_2.7)(64bit)"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>3isec-qubes-task-manager</name>
  <arch>x86_64</arch>
  <version epoch="0" ver="1.0" rel="1"/>
  <checksum type="sha256" pkgid="YES">4afdc5be870497341271c62f50d46150e5bd50bb3cafbaadb42af1c9a5bc9a31</checksum>
  <summary>Qubes task manager</summary>
  <description>Qubes task manager</description>
  <packager></packager>
  <url>http://www.qubes-os.org</url>
  <time file="1769869635" build="1769869552"/>
  <size package="10512" installed="12604" archive="13000"/>
  <location href="3isec-qubes-task-manager-1.0-1.x86_64.rpm"/>
  <format>
    <rpm:license>GPL</rpm:license>
    <rpm:vendor>Invisible Things Lab</rpm:vendor>
    <rpm:group>Qubes</rpm:group>
    <rpm:buildhost>localhost</rpm:buildhost>
    <rpm:sourcerpm>3isec-qubes-task-manager-1.0-1.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="5112" end="7649"/>
    <rpm:provides>
      <rpm:entry name="3isec-qubes-task-manager" flags="EQ" epoch="0" ver="1.0" rel="1"/>
      <rpm:entry name="3isec-qubes-task-manager(x86-64)" flags="EQ" epoch="0" ver="1.0" rel="1"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="python3"/>
    </rpm:requires>
    <file>/usr/bin/qubes-task</file>
    <file>/usr/bin/qubes-task-gui</file>
  </format>
</package>
</metadata>