From 37bf73a3ab251f60837a233ee6c3a73bc760c185 Mon Sep 17 00:00:00 2001
From: mustard <sussybaka@homelab0ne.xyz>
Date: Mon, 20 Oct 2025 15:44:13 +0200
Subject: [PATCH] wip: test salts based off of
 https://theguardian.engineering/blog/info-2024-apr-04-when-security-matters-working-with-qubes-os-at-the-guardian
 for practice

---
 Makefile                  |  7 +++++++
 guardian/guardian-vms.sls | 18 ++++++++++++++++++
 guardian/guardian.top     |  3 +++
 3 files changed, 28 insertions(+)
 create mode 100644 guardian/guardian-vms.sls
 create mode 100644 guardian/guardian.top

diff --git a/Makefile b/Makefile
index b199293..5f00601 100644
--- a/Makefile
+++ b/Makefile
@@ -44,3 +44,10 @@ pull/%:
 	qvm-run -p $(GUEST) "cd $(GUEST_REPO) && git update-ref refs/remotes/dom0/$* $*" </dev/null
 
 	@echo "updated branch $* from $(GUEST)"
+
+apply:
+	echo "Applying salt states"
+	pushd ./guardian
+	sudo qubesctl top.enable guardian
+	sudo qubesctl --show-output --all state.apply
+	popd
diff --git a/guardian/guardian-vms.sls b/guardian/guardian-vms.sls
new file mode 100644
index 0000000..6e64d1c
--- /dev/null
+++ b/guardian/guardian-vms.sls
@@ -0,0 +1,18 @@
+create-guardian-template:
+  qvm.vm:
+    - name: guardian-template
+    - clone: 
+      - source: fedora-42
+      - label: black
+    - prefs:
+      - netvm: ""
+
+create-app:
+  qvm.vm:
+    - name: app
+    - present:
+      - template: guardian-template
+      - label: green
+    - prefs:
+      - template: guardian-template
+      - netvm: ""
diff --git a/guardian/guardian.top b/guardian/guardian.top
new file mode 100644
index 0000000..72f7269
--- /dev/null
+++ b/guardian/guardian.top
@@ -0,0 +1,3 @@
+base:
+  dom0:
+    - guardian-vms