Add deferred-provisioning install mode and factory snapshots (#98)
* Add OEM install mode and factory snapshots OEM mode installs the entire system but defers user creation to first boot, where the runtime's omarchy-oem-setup asks for the owner and lands them in the already-installed system — and the same machinery arms omarchy-reset-computer. The configurator's install-mode step gains an OEM choice, which required moving the user step after mode selection (OEM skips it entirely). Autoinstall rigs select OEM with an `oem` marker file on the cidata drive, which also replaces the user_credentials.json requirement. In the orchestrator, OEM swaps the user phases for a stage_oem_state phase: it stashes the bundled Node tarball (every install, for offline factory resets), arms omarchy-oem-setup.service in the target, and on encrypted installs stages the throwaway LUKS passphrase — generated by InstallContext when the input carries none — with a keyfile embedded in the UKI so boot auto-unlocks until first-boot setup re-keys to the owner's password. The install fails with a clear error if the bundled runtime lacks OEM support. Every install now also ends with a read-only @factory snapshot of @ at the btrfs top level — outside snapper's reach — which is what makes omarchy-reset-computer a true factory reset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Offer OEM mode only when the bundled runtime supports it The configurator now peeks into the offline mirror's runtime package for omarchy-oem-setup before offering the OEM install mode, so an ISO built against a pre-OEM runtime can't start an install doomed to fail at the staging phase (which still hard-checks as the backstop). Blank disks with no OEM choice to offer skip the mode picker entirely, like the pre-OEM flow. Also keep the test harness QMP socket in /tmp — unix socket paths cap at ~108 bytes, which nested test-run directories can exceed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Isolate the test harness SSH identity from the local ssh-agent A loaded agent offers its keys before the harness identity and can exhaust the server's MaxAuthTries before the right key is ever tried; IdentitiesOnly pins authentication to the per-run key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Make OEM state world-readable for user-context finalization The Node tarball in /var/lib/omarchy/oem/packages is read by omarchy-finalize-user running as the freshly created user; a 0700 directory forced the offline install onto its network fallback. The only secret inside (luks-key) is itself 0600 root. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Keep provisioning credentials out of OEM installs and factory snapshots Review findings from codex and Copilot: - A rig-supplied credentials file in OEM mode now contributes only its LUKS passphrase: preserved users/root_enc_password fields would have created a hidden provisioning account despite OEM promising no user until first boot. - The factory snapshot is taken writable, scrubbed of deployment credentials (staged authorized_keys, tailscale auth key and join unit, the dead OEM LUKS key and its initramfs drop-ins), then set read-only — a reset years later must not authorize the original deployment key or rejoin its tailnet. - The missing-Node-tarball case is a hard install error on every install, not just OEM: the stash is what lets a factory reset finalize offline. - The configurator's OEM gate checks the runtime package for the service unit as well as the setup binary. - The test harness handles the deliberately skipped mode picker on blank disks when the bundled runtime lacks OEM support. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Second review pass: strip account fields, clear stale cidata inputs, await OEM finalization Codex xhigh round 2: - Strip account authentication fields (!users, !root-password, root_enc_password, auth_config account entries) from the archinstall config in OEM mode, not just user_credentials — a combined/legacy config could otherwise have archinstall create a provisioning account before OOBE. - Clear stale OEM inputs (oem marker, credentials, optional files) from /root before copying a cidata drive, so a retried install in the same live session can't force a fresh drive back into OEM mode or reuse an old LUKS passphrase. - The test harness waits for the OEM pending flag to clear before saving the base image, so it never snapshots a half-finalized first boot; it also handles the deliberately skipped mode picker on blank disks built against a pre-OEM runtime. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Reorder configurator: disk before keyboard, skip keyboard for OEM The wizard now opens on disk selection; keyboard moves to after the install mode is chosen and stays before the user step (so the LUKS passphrase is still typed under the chosen layout). OEM installs skip keyboard and user entirely — the machine's owner picks both at first boot — so the emitted config just carries a default 'us' keymap as a placeholder. The QEMU harness drives the new order and the OEM first-boot keyboard step. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Harness: prove the OEM keyboard step applies a non-default layout Drive the OEM first-boot keyboard picker to English (UK) and assert the installed system ends up with KEYMAP=uk and XKBLAYOUT=gb — proving the deferred keyboard step actually applied a layout, not just rendered. UK keeps every letter identical to US so the raw-keycode password still matches, and the email's '@' (Shift+' under UK, not Shift+2) is typed with the UK keycode. The console bootstrap now fetches-then-runs instead of piping, so it survives the non-US layout the keyboard step installs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Update OEM comments to the renamed factory-reset command Reference omarchy-system-factory-reset (was omarchy-reset-computer) in the orchestrator comments and the plan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop the configurator's runtime-support gate for OEM mode Remove oem_supported() and its branches: the configurator always offers OEM install now, rather than scanning the offline mirror's runtime package to decide. Building an ISO against a runtime that ships OEM support is the build's responsibility; the orchestrator still fails an OEM install with a clear error if the staged target somehow lacks omarchy-oem-setup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * OEM mode via Ctrl+C on the first screen, not a mode-picker entry Restore the original screen order (keyboard first, then disk) and make Ctrl+C on the keyboard screen the entry into OEM mode — the same hidden-Ctrl+C idiom the disk-overwrite screen already uses for unencrypted installs. A confirm guards against an accidental Ctrl+C; once confirmed, OEM jumps straight to disk selection and the overwrite confirmation (no keyboard, no user), since OEM is always a full-disk install. The 'OEM install' entry leaves the mode picker. The harness drives the new path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Restore keyboard→user→disk order; drop OEM wording from the configurator UI The normal install flow returns to its original order: keyboard, then the user step, then disk selection and mode. The Ctrl+C shortcut on the first screen and its confirmation now speak only of preparing the machine for another owner — no 'OEM' in any user-facing string (the omarchy_install.oem data contract is unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Only show the mode picker when free space is also an option Restore the pre-OEM behavior: a disk with no unallocated free space has just one viable mode, so the wizard skips the mode picker and goes straight to the overwrite confirmation. The picker appears only when a free-space install is also on offer. Also give the harness's first-boot SSH bootstrap more headroom (360s): an encrypted OEM first boot re-keys LUKS and rebuilds the UKI before sshd settles, which can exceed 180s under parallel VM load. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Tighten the prepare-for-another-owner confirm wording Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Keyboard screen: Ctrl+C hint directly under the header, no blank line Match the disk-overwrite screen, where the unencrypted-install hint sits on the line right below its message. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Rename OEM vocabulary to provisioning (ISO) Matches the runtime rename. The deferred-provisioning install mode replaces 'OEM' everywhere: omarchy_install.oem → omarchy_install.defer_provisioning --oem / --oem-file → --defer-provisioning / --defer-provisioning-file OMARCHY_INSTALL_OEM_FILE → OMARCHY_INSTALL_DEFER_PROVISIONING_FILE cidata 'oem' marker → 'defer-provisioning' /var/lib/omarchy/oem/ → /var/lib/omarchy/provisioning/ /etc/omarchy/oem.key → /etc/omarchy/provisioning.key install/oem/omarchy-oem-setup.service → install/provisioning/omarchy-provision-owner.service stage_oem_state phase → stage_provisioning_state ('Staging provisioning') Orchestrator internals (OEM_STATE_DIR, _validate_oem_state, ctx.oem, …), the configurator, cidata-load, the dashboard phase band, the harness (--oem → --provision), and the tests all move together. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix orchestrator caller of the renamed user-provisioning command run_chroot_finalizer still invoked /usr/bin/omarchy-finalize-user, which the rename moved to omarchy-provision-user — so a normal install died with 'No such file'. (Deferred-provisioning installs skip this phase, so only normal installs were affected.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Wait for the live VT to settle before drawing the first screen tty1 boots as an 80-column console and only widens once the kernel framebuffer/KMS takes over, which lands late — especially in VMs. The configurator's logo is wider than 80 columns, so the very first draw measured against that transient narrow console: the logo wrapped ("smushed") and, with left padding clamped to zero, hugged the left edge. Every later screen re-measures once the console has grown, which is why only the opening keyboard screen looked wrong. Hold the first draw until the width settles at or above the logo width, capped so a console that never widens still proceeds. Terminal emulators (dry runs) are already at final size and are skipped. Co-Authored-By: Claude <noreply@anthropic.com> * Confirm the Start Omarchy Now prompt after provisioning setup (#100) * Confirm the Start Omarchy Now prompt after provisioning setup First-boot account setup now ends on a celebration screen whose Start Omarchy Now button gates the SDDM handoff, so the provisioning test must press it — same as the installer's Reboot Now prompt — once the pending flag clears. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Add a centered greeter before the installer keyboard step Open the ISO configurator with the same greeter the deferred-provisioning first boot uses — vertically centered logo, the Omarchy tagline, and a single button — so install and first boot bookend setup identically. The installer's button reads "Start install"; first boot's reads "Start setup". Co-Authored-By: Claude <noreply@anthropic.com> * Animate the installer greeter logo with a skippable ColorShift Match the first-boot greeter: a looping tte ColorShift over the centered logo with a "Press Return to Start Install" hint instead of a button. Return begins the install at any time. Co-Authored-By: Claude <noreply@anthropic.com> * Theme the installer greeter ColorShift to the Omarchy palette Match the first-boot greeter: sweep the logo ColorShift through the Tokyo Night accent colors instead of tte's default rainbow. Co-Authored-By: Claude <noreply@anthropic.com> * Fix installer greeter ColorShift: green base, no flash, clean handoff Mirror the first-boot greeter fixes: indexed ANSI colors (green base with a cyan accent) because the framebuffer console can't render tte truecolor; one long tte invocation so the loop never flashes; stty sane + clear after Return so the keyboard step starts clean. Co-Authored-By: Claude <noreply@anthropic.com> * Dismiss the greeter in the QEMU test drivers The installer and first-boot flows now open with a greeter (animated logo + tagline). Wait for the tagline and press Return before the keyboard step, in both drive paths, so the harness gets past the greeter. Co-Authored-By: Claude <noreply@anthropic.com> * Kill the installer greeter animation cleanly Run tte directly instead of inside a backgrounded `while` subshell, so killing the tracked PID actually stops the effect. Killing the subshell orphaned tte, which kept painting the logo over the keyboard step. Co-Authored-By: Claude <noreply@anthropic.com> * Guard the greeter wait against set -e in the configurator too Harmless today (no set -e), but keeps the greeter's animation teardown robust if that changes. Co-Authored-By: Claude <noreply@anthropic.com> * Also settle the terminal in emulators, not just real VTs wait_for_stable_terminal skipped terminal emulators on the assumption they're already at final size, but a fresh terminal (or sudo's pty) reports a stale 24x80 for a moment at startup too. Drop the VT-only gate so the greeter centers there as well. Co-Authored-By: Claude <noreply@anthropic.com> * Test harness: drive the first-boot timezone step and direct SDDM handoff Match the deferred-provisioning first-boot flow changes: the owner now picks a timezone after the email step, and setup hands straight off to SDDM instead of pausing on a celebration screen with a Start Omarchy Now button. Drive the new Timezone screen (accept the geo-guessed default) and drop the button confirmation. Co-Authored-By: Claude <noreply@anthropic.com> * Don't bake hostname/timezone into deferred installs; set them at first boot Deferred provisioning defers the user step to first boot, so the machine's owner should name the machine and pick the timezone there — not inherit values chosen at install time. Stop setting hostname/timezone in the configurator's deferred branch: the orchestrator already skips an empty timezone (the system stays UTC until first boot), and it now falls back to a neutral "archlinux" hostname for the install so archinstall still succeeds. The first-boot omarchy-provision-owner form collects and applies both. Harness: drive the new Hostname screen and assert both hostname and timezone actually landed on the running system after first boot. Co-Authored-By: Claude <noreply@anthropic.com> * Match the installer greeter: solid green logo, no color animation Same fix as the first-boot greeter — tte's ColorShift judders on the 16-color framebuffer console (truecolor crush). Show the logo in solid green and drop the animation so both greeters look identical and flash-free. Co-Authored-By: Claude <noreply@anthropic.com> * Harden the provision harness: SSH-blip wait, timezone timeout, hostname assert - The pending-flag wait treated an SSH connection failure (rc 255) the same as "flag absent" (rc 1), so a transient blip during finalization would exit early and snapshot the base mid-finalization. Only break on a clean rc 1; keep waiting on 0 or 255. - Bump the first-boot Timezone screen wait 60s -> 180s (tzupdate geo-guess over first-boot networking can lag; matches the installer's headroom). - Make the applied-hostname check a hard failure (it's deterministic — we typed it), so a first-boot apply regression can't pass green; timezone stays a report since it's geo-guessed. Co-Authored-By: Claude <noreply@anthropic.com> * Seed hostname=omarchy/timezone=UTC in deferred install instead of empties Write neutral valid defaults in the configurator's deferred branch rather than empty strings, and drop the orchestrator's `config.hostname or "archlinux"` fallback (hostname is always non-empty now). The first-boot wizard overwrites both. This keeps the "owner sets them at first boot" behavior without depending on archinstall tolerating empty hostname/timezone at config-load time. Co-Authored-By: Claude <noreply@anthropic.com> * Fix set -e regression in the provision pending-wait loop The previous hardening moved `ssh_guest "test -f pending"` out of the `while` condition into a standalone command, but the harness runs `set -euo pipefail` — so the moment the flag cleared (ssh returns 1, the intended "done" signal) it tripped errexit and aborted the whole run right after provisioning, before the session/acceptance phase. Capture the result with `|| rc=$?` so the non-zero is the signal, not a fatal error. Also guard the follow-on hostname/timezone substitutions with `|| got=""` so a transient SSH failure there can't abort either (an empty value then correctly fails the hostname assertion). Co-Authored-By: Claude <noreply@anthropic.com> * Bring back the installer greeter ColorShift animation Match the first-boot greeter: restore the static green logo + looping tte ColorShift overlay. The framebuffer truecolor crush gives it a quick flash, which is acceptable — both greeters keep the animation. Co-Authored-By: Claude <noreply@anthropic.com> * Skip the install celebration on deferred installs; reboot directly A deferred-provisioning install has nothing to celebrate yet — the owner finishes setup (and gets the send-off) at first boot. So the installer's "Installed Omarchy in ..." screen and the Reboot Now prompt now belong to a direct install only: for a deferred install the dashboard clears and reboots on its own. .automated_script.sh detects deferred mode (the config's defer_provisioning flag, or the cidata defer-provisioning marker) and passes OMARCHY_UI_DEFER_PROVISIONING to the dashboard. Harness: a deferred install no longer shows Reboot Now, so wait_for_install recognizes the auto-reboot by the first-boot greeter tagline appearing. Co-Authored-By: Claude <noreply@anthropic.com> * Detect deferred mode with jq, not a line regex The dashboard's deferred detection grepped user_configuration.json for the defer_provisioning boolean on one line; a reformatted config would read as a direct install and wrongly show the celebration. Parse it with jq using the same path the orchestrator reads (.omarchy_install.defer_provisioning). Co-Authored-By: Claude <noreply@anthropic.com> * Drop Bosnian and Khmer from the installer keyboard picker Match the first-boot picker: neither has a console keymap, so both silently fell back to US. Remove them rather than offer a layout that can't apply. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
David Heinemeier HanssonandClaude authored and GitHub committed
1 parent
6004e80485
commit
6b2f8a6ac7
13 files changed
+1397
-103
No files matched your search
@@ -101,6 +101,16 @@ else
|
||||
./configurator
|
||||
fi
|
||||
|
||||
# Deferred-provisioning installs skip the celebration/reboot prompt and reboot on
|
||||
# their own — the owner completes setup at first boot. Signalled by the config's
|
||||
# defer_provisioning flag (interactive) or the defer-provisioning marker (cidata).
|
||||
# Parse the flag with jq (the same JSON semantics the orchestrator uses) rather
|
||||
# than a line regex, so a reformatted config can't read as a direct install.
|
||||
if [[ -f /root/defer-provisioning ]] ||
|
||||
[[ "$(jq -r '.omarchy_install.defer_provisioning // false' /root/user_configuration.json 2>/dev/null)" == "true" ]]; then
|
||||
export OMARCHY_UI_DEFER_PROVISIONING=yes
|
||||
fi
|
||||
|
||||
# The foreground dashboard is now the sole visible install UI owner. It starts
|
||||
# the actual installer as a non-interactive child, logs child output, waits for
|
||||
# completion, then renders the final installed-time/reboot prompt itself.
|
||||
@@ -117,4 +127,5 @@ rm -f /run/omarchy-install/state.json
|
||||
--email-file /root/user_email_address.txt \
|
||||
--encrypt-file /root/user_encrypt_installation.txt \
|
||||
--authorized-keys-file /root/authorized_keys \
|
||||
--tailscale-authkey-file /root/tailscale_authkey
|
||||
--tailscale-authkey-file /root/tailscale_authkey \
|
||||
--defer-provisioning-file /root/defer-provisioning
|
||||
@@ -38,12 +38,111 @@ measure_terminal() {
|
||||
}
|
||||
measure_terminal
|
||||
|
||||
# The live VT resizes late during boot: tty1 starts as the 80-column boot
|
||||
# console and only grows once the kernel framebuffer/KMS takes over (noticeably
|
||||
# late in VMs). The logo is wider than 80 columns, so a first draw against that
|
||||
# transient narrow console wraps the logo ("smushed") and can't center it
|
||||
# (padding clamps to 0, so it hugs the left). A terminal emulator (or sudo's
|
||||
# pty) has the same problem the other way: it reports a stale 24x80 for a few
|
||||
# hundred ms after start before its real winsize is set. Either way, hold the
|
||||
# first draw until the width settles at (or above) the logo width. A real VT
|
||||
# that never widens (e.g. nomodeset) still proceeds after the cap.
|
||||
wait_for_stable_terminal() {
|
||||
local width last="" stable=0 waited=0
|
||||
while (( waited < 5000 )); do
|
||||
width=$(stty size 2>/dev/null </dev/tty | awk '{print $2}')
|
||||
[[ $width =~ ^[0-9]+$ ]] || width=0
|
||||
if [[ $width == "$last" ]] && (( width >= LOGO_WIDTH )); then
|
||||
(( ++stable >= 3 )) && break
|
||||
else
|
||||
stable=0
|
||||
fi
|
||||
last=$width
|
||||
sleep 0.2
|
||||
(( waited += 200 ))
|
||||
done
|
||||
}
|
||||
|
||||
clear_logo() {
|
||||
measure_terminal
|
||||
printf "\033[H\033[2J"
|
||||
gum style --foreground 2 --padding "1 0 0 $PADDING_LEFT" "$(<"$LOGO_PATH")"
|
||||
}
|
||||
|
||||
# Vertically-centered welcome shown once before the keyboard step — the same
|
||||
# frame the deferred-provisioning first boot opens on, so install and first boot
|
||||
# bookend the setup identically. Logo, the Omarchy tagline, and a single button,
|
||||
# centered like the boot logo. No animation.
|
||||
greeter() {
|
||||
measure_terminal
|
||||
|
||||
local rows logo_h content_h top cols logo_row tagline_row hint_row
|
||||
local tagline hint tpad hpad anim
|
||||
cols=$TERM_WIDTH
|
||||
rows=$(stty size 2>/dev/null </dev/tty | awk '{print $1}')
|
||||
[[ $rows =~ ^[0-9]+$ ]] || rows=${LINES:-24}
|
||||
logo_h=$(wc -l <"$LOGO_PATH")
|
||||
|
||||
# logo + blank + tagline + blank + hint
|
||||
content_h=$((logo_h + 4))
|
||||
top=$(((rows - content_h) / 2))
|
||||
(( top < 0 )) && top=0
|
||||
logo_row=$((top + 1))
|
||||
tagline_row=$((top + logo_h + 2))
|
||||
hint_row=$((top + logo_h + 4))
|
||||
|
||||
printf '\033[?25l\033[H\033[2J'
|
||||
|
||||
printf '\033[%d;1H' "$logo_row"
|
||||
gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "$(<"$LOGO_PATH")"
|
||||
|
||||
tagline="Beautiful, Modern & Opinionated Linux by DHH"
|
||||
tpad=$(((cols - ${#tagline}) / 2)); (( tpad < 0 )) && tpad=0
|
||||
printf '\033[%d;%dH%s' "$tagline_row" "$((tpad + 1))" "$tagline"
|
||||
|
||||
hint="Press Return to Start Install"
|
||||
hpad=$(((cols - ${#hint}) / 2)); (( hpad < 0 )) && hpad=0
|
||||
printf '\033[%d;%dH\033[2m%s\033[0m' "$hint_row" "$((hpad + 1))" "$hint"
|
||||
|
||||
# ColorShift the logo: a green base (indexed color 2) with a cyan accent (6)
|
||||
# drifting through, settling on green. Indexed ANSI colors, not hex — the
|
||||
# framebuffer console can't render tte's truecolor faithfully (it crushes the
|
||||
# palette to a muddy lavender), but the 16 indexed colors map to the Tokyo
|
||||
# Night palette and render true. One long-running invocation (many cycles) so
|
||||
# it never restarts — a restart is what flashed. The effect reads from
|
||||
# /dev/null so it never swallows the Return; --reuse-canvas paints upward from
|
||||
# the saved cursor, anchored one row below the logo.
|
||||
if command -v tte >/dev/null 2>&1; then
|
||||
printf '\033[%d;1H\0337' "$((logo_row + logo_h))"
|
||||
# Run tte directly (not inside a `while` subshell) so $anim is tte's own
|
||||
# PID: killing a wrapping subshell would orphan tte, which then keeps
|
||||
# painting the logo over the keyboard step. --cycles is high enough that it
|
||||
# never ends on its own before Return.
|
||||
tte -i "$LOGO_PATH" \
|
||||
--canvas-width "$cols" \
|
||||
--anchor-text c \
|
||||
--frame-rate 60 \
|
||||
--reuse-canvas \
|
||||
colorshift \
|
||||
--gradient-stops 2 10 6 10 \
|
||||
--gradient-frames 3 \
|
||||
--cycles 1000 \
|
||||
--final-gradient-stops 2 \
|
||||
</dev/null >/dev/tty 2>/dev/null &
|
||||
anim=$!
|
||||
fi
|
||||
|
||||
IFS= read -r _ </dev/tty || true
|
||||
# Tolerate tte's kill signal in `wait` so a future `set -e` here can't abort.
|
||||
[[ -n ${anim:-} ]] && { kill "$anim" 2>/dev/null; wait "$anim" 2>/dev/null || true; }
|
||||
# tte leaves the tty in raw/no-echo mode when killed; restore it or the gum
|
||||
# prompts in the keyboard step that follows silently die.
|
||||
stty sane </dev/tty 2>/dev/null || true
|
||||
# Reset the screen so the leftover animation frame doesn't linger under the
|
||||
# keyboard step that follows.
|
||||
printf '\033[0m\033[H\033[2J\033[?25h'
|
||||
}
|
||||
|
||||
abort() {
|
||||
gum style "${1:-Aborted installation}"
|
||||
echo
|
||||
@@ -73,11 +172,22 @@ notice() {
|
||||
# STEP 1: KEYBOARD LAYOUT
|
||||
|
||||
keyboard_form() {
|
||||
step "Let's setup your machine..."
|
||||
# The Ctrl+C hint sits directly under the header (no blank line between),
|
||||
# matching the disk-overwrite screen's unencrypted offer. Ctrl+C on the first
|
||||
# screen is the hidden entry into deferred provisioning; $1 is "true" only for that first
|
||||
# invocation, so the review-loop re-edit can't flip a user install into it.
|
||||
local allow_defer_provisioning="${1:-false}"
|
||||
clear_logo
|
||||
echo
|
||||
say "Let's setup your machine..."
|
||||
if $allow_defer_provisioning; then
|
||||
say --foreground 8 "Press Ctrl+C to prepare this machine for another owner."
|
||||
fi
|
||||
echo
|
||||
|
||||
keyboards=$'Azerbaijani|azerty
|
||||
Belarusian|by
|
||||
Belgian|be-latin1
|
||||
Bosnian|ba
|
||||
Bulgarian|bg-cp1251
|
||||
Croatian|croat
|
||||
Czech|cz
|
||||
@@ -103,7 +213,6 @@ Irish|ie
|
||||
Italian|it
|
||||
Japanese|jp106
|
||||
Kazakh|kazakh
|
||||
Khmer (Cambodia)|khmer
|
||||
Kyrgyz|kyrgyz
|
||||
Lao|la-latin1
|
||||
Latvian|lv
|
||||
@@ -124,7 +233,19 @@ Swedish|sv-latin1
|
||||
Tajik|tj_alt-UTF8
|
||||
Turkish|trq
|
||||
Ukrainian|ua'
|
||||
choice=$(printf '%s\n' "$keyboards" | cut -d'|' -f1 | gum choose --height 10 --selected "English (US)" --header "Select keyboard layout") || abort
|
||||
choice=$(printf '%s\n' "$keyboards" | cut -d'|' -f1 | gum choose --height 10 --selected "English (US)" --header "Select keyboard layout")
|
||||
local status=$?
|
||||
|
||||
if $allow_defer_provisioning && (( status == 130 )); then
|
||||
if confirm_prepare_for_another_owner; then
|
||||
defer_provisioning=true
|
||||
return 0
|
||||
fi
|
||||
keyboard_form true # declined: back to the keyboard picker
|
||||
return
|
||||
fi
|
||||
(( status == 0 )) || abort
|
||||
|
||||
keyboard=$(printf '%s\n' "$keyboards" | awk -F'|' -v c="$choice" '$1==c{print $2; exit}')
|
||||
|
||||
# Only attempt to load keyboard layout if we're on a real console
|
||||
@@ -134,9 +255,22 @@ Ukrainian|ua'
|
||||
fi
|
||||
}
|
||||
|
||||
keyboard_form
|
||||
# Ctrl+C on the first screen offers to prepare the machine for another owner.
|
||||
# Confirm it before committing, so an accidental Ctrl+C doesn't silently switch
|
||||
# the whole install.
|
||||
confirm_prepare_for_another_owner() {
|
||||
clear_logo
|
||||
echo
|
||||
say "This prepares the machine for another owner."
|
||||
say --foreground 8 "The system installs now, but setup is delayed until first boot."
|
||||
echo
|
||||
gum confirm --affirmative "Yes, prepare for another owner" --negative "No, keep setting up" \
|
||||
"Prepare this machine for another owner?"
|
||||
}
|
||||
|
||||
# STEP 2: USER
|
||||
# The user step. Deferred-provisioning installs skip it entirely — the machine's first owner
|
||||
# picks their keyboard and creates their user in the first-boot setup, so the
|
||||
# operator sets nothing user-specific.
|
||||
|
||||
user_form() {
|
||||
step "Let's setup your user account..."
|
||||
@@ -197,11 +331,12 @@ user_form() {
|
||||
fi
|
||||
}
|
||||
|
||||
user_form
|
||||
user_step() {
|
||||
user_form
|
||||
|
||||
while true; do
|
||||
# Add manual padding since gum table -p doesn't respect padding
|
||||
echo -e "Field,Value
|
||||
while true; do
|
||||
# Add manual padding since gum table -p doesn't respect padding
|
||||
echo -e "Field,Value
|
||||
Username,$username
|
||||
Password,$(printf "%${#password}s" | tr ' ' '*')
|
||||
Full name,${full_name:-[Skipped]}
|
||||
@@ -209,16 +344,17 @@ Email address,${email_address:-[Skipped]}
|
||||
Hostname,$hostname
|
||||
Timezone,$timezone
|
||||
Keyboard,$keyboard" |
|
||||
gum table -s "," -p | sed "s/^/${PADDING_LEFT_SPACES}/"
|
||||
gum table -s "," -p | sed "s/^/${PADDING_LEFT_SPACES}/"
|
||||
|
||||
echo
|
||||
if gum confirm --negative "No, change it" "Does this look right?"; then
|
||||
break
|
||||
else
|
||||
keyboard_form
|
||||
user_form
|
||||
fi
|
||||
done
|
||||
echo
|
||||
if gum confirm --negative "No, change it" "Does this look right?"; then
|
||||
break
|
||||
else
|
||||
keyboard_form
|
||||
user_form
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# STEP 3: DISK
|
||||
|
||||
@@ -347,11 +483,22 @@ wait_for_device() {
|
||||
|
||||
# Save the configurator answers the installer consumes: git identity and
|
||||
# encryption choice as plain files, account details as archinstall credentials.
|
||||
# Deferred-provisioning installs defer the user to first boot: no credentials, and on encrypted
|
||||
# targets the orchestrator generates a throwaway LUKS passphrase itself.
|
||||
write_user_files() {
|
||||
echo "$full_name" >user_full_name.txt
|
||||
echo "$email_address" >user_email_address.txt
|
||||
printf '%s\n' "$encrypt_installation" >user_encrypt_installation.txt
|
||||
|
||||
if $defer_provisioning; then
|
||||
cat <<-_EOF_ >user_credentials.json
|
||||
{
|
||||
"users": []
|
||||
}
|
||||
_EOF_
|
||||
return
|
||||
fi
|
||||
|
||||
local password_escaped password_hash_escaped username_escaped
|
||||
password_escaped=$(echo -n "$password" | jq -Rsa)
|
||||
password_hash_escaped=$(echo -n "$password_hash" | jq -Rsa)
|
||||
@@ -413,10 +560,10 @@ not_enough_space() {
|
||||
return 1
|
||||
}
|
||||
|
||||
run_partition_install() {
|
||||
local dry=false
|
||||
[[ "${1:-}" == "dry" ]] && dry=true
|
||||
|
||||
# Decide half of the free-space install: checks, free-space analysis, and the
|
||||
# encryption confirm. Sets the globals run_partition_execute needs. Returns 1
|
||||
# to fall back to the install-mode picker.
|
||||
run_partition_decide() {
|
||||
step "Checking for BitLocker on $disk"
|
||||
local bl_part
|
||||
bl_part=$(detect_bitlocker || true)
|
||||
@@ -448,7 +595,8 @@ run_partition_install() {
|
||||
|
||||
# An unlabeled disk has no partition table for parted to scan, so we
|
||||
# synthesize a whole-disk free region and mklabel gpt before mkpart.
|
||||
local FREE_SPACE_INFO needs_mklabel=false pt_type disk_size_b
|
||||
local FREE_SPACE_INFO pt_type disk_size_b
|
||||
needs_mklabel=false
|
||||
pt_type=$(lsblk -dno PTTYPE "$disk" 2>/dev/null)
|
||||
if [[ -z "$pt_type" ]]; then
|
||||
disk_size_b=$(lsblk -bdno SIZE "$disk" 2>/dev/null)
|
||||
@@ -491,7 +639,6 @@ run_partition_install() {
|
||||
local EFI_SIZE_B=$((2 * gib))
|
||||
local MIN_INSTALL_B=$((32 * gib)) # Minimum total Omarchy allocation
|
||||
|
||||
local EFI_START_B EFI_END_B ROOT_START_B ROOT_END_B
|
||||
EFI_START_B=$(( (FREE_START_B + ALIGN - 1) / ALIGN * ALIGN ))
|
||||
EFI_END_B=$((EFI_START_B + EFI_SIZE_B))
|
||||
ROOT_START_B=$(( (EFI_END_B + 1 + ALIGN - 1) / ALIGN * ALIGN ))
|
||||
@@ -554,7 +701,6 @@ run_partition_install() {
|
||||
esac
|
||||
done
|
||||
|
||||
local esp_mount_in_target
|
||||
if [[ "$encrypt_installation" == "true" ]]; then
|
||||
esp_mount_in_target=/boot
|
||||
else
|
||||
@@ -563,12 +709,11 @@ run_partition_install() {
|
||||
|
||||
kernel_choice=$(detect_kernel)
|
||||
|
||||
local last_part efi_part_num root_part_num
|
||||
local last_part
|
||||
last_part=$(lsblk -n -o PARTN "$disk" 2>/dev/null | grep -E '^[0-9]+$' | sort -n | tail -1)
|
||||
efi_part_num=$(( ${last_part:-0} + 1 ))
|
||||
root_part_num=$(( efi_part_num + 1 ))
|
||||
|
||||
local efi_dev root_partition_device root_mapper
|
||||
efi_dev=$(partition_path "$disk" "$efi_part_num")
|
||||
root_partition_device=$(partition_path "$disk" "$root_part_num")
|
||||
if [[ "$encrypt_installation" == "true" ]]; then
|
||||
@@ -576,6 +721,14 @@ run_partition_install() {
|
||||
else
|
||||
root_mapper="$root_partition_device"
|
||||
fi
|
||||
}
|
||||
|
||||
# Execute half of the free-space install: partition, format, mount, and write
|
||||
# the pre-mounted (protected) install configuration. Runs after the user step
|
||||
# so LUKS can be formatted with the user's password.
|
||||
run_partition_execute() {
|
||||
local dry=false
|
||||
[[ "${1:-}" == "dry" ]] && dry=true
|
||||
|
||||
if $dry; then
|
||||
$needs_mklabel && say "[dry] would initialize GPT on $disk"
|
||||
@@ -634,10 +787,6 @@ run_partition_install() {
|
||||
mount "$efi_dev" /mnt"$esp_mount_in_target"
|
||||
fi
|
||||
|
||||
clear
|
||||
|
||||
write_user_files
|
||||
|
||||
local luks_uuid_json="null" luks_uuid
|
||||
if [[ "$encrypt_installation" == "true" ]]; then
|
||||
if $dry; then
|
||||
@@ -716,10 +865,6 @@ run_partition_install() {
|
||||
"version": "3.0.9"
|
||||
}
|
||||
_EOF_
|
||||
|
||||
if $dry; then
|
||||
print_dry_run_files
|
||||
fi
|
||||
}
|
||||
|
||||
disk_form() {
|
||||
@@ -771,8 +916,7 @@ open_partition_tool() {
|
||||
}
|
||||
|
||||
# If the disk has no partition table or no unallocated free space, the only
|
||||
# viable path is a full-disk install. Skip the install-mode picker and go
|
||||
# straight to confirmation.
|
||||
# viable paths write the whole disk, so the free-space mode is not offered.
|
||||
requires_full_disk_install() {
|
||||
local pt_type free_space_b
|
||||
pt_type=$(lsblk -dno PTTYPE "$disk" 2>/dev/null)
|
||||
@@ -799,7 +943,7 @@ install_mode_form() {
|
||||
|
||||
# The free-space/protected path registers an EFI boot entry and is UEFI-only.
|
||||
# Full-disk installs still support BIOS through the orchestrator's BIOS branch.
|
||||
if [[ -d /sys/firmware/efi ]]; then
|
||||
if [[ -d /sys/firmware/efi ]] && ! $full_disk_only; then
|
||||
choices+=("Free space install (alongside existing data)")
|
||||
fi
|
||||
choices+=("Choose a different disk")
|
||||
@@ -846,30 +990,43 @@ confirm_disk_overwrite() {
|
||||
done
|
||||
}
|
||||
|
||||
# Decide what and how to install: sets install_target (full_disk|free_space),
|
||||
# install_target and encrypt_installation. Nothing is written to disk yet —
|
||||
# the user step runs between this and the execution below. (deferred provisioning never
|
||||
# reaches here; it's armed by Ctrl+C on the first screen and goes straight to
|
||||
# disk selection.)
|
||||
select_installation() {
|
||||
local full_disk_only
|
||||
|
||||
while true; do
|
||||
if requires_full_disk_install; then
|
||||
full_disk_only=true
|
||||
install_mode="Full disk install"
|
||||
else
|
||||
full_disk_only=false
|
||||
fi
|
||||
|
||||
# With no free-space option to offer, a full-disk install is the only
|
||||
# mode, so skip the picker and go straight to the overwrite confirm.
|
||||
if $full_disk_only; then
|
||||
install_mode="Full disk install"
|
||||
else
|
||||
install_mode_form
|
||||
fi
|
||||
|
||||
case "$install_mode" in
|
||||
"Full disk install")
|
||||
if confirm_disk_overwrite; then
|
||||
install_target="full_disk"
|
||||
return 0
|
||||
fi
|
||||
if $full_disk_only; then
|
||||
disk_form
|
||||
fi
|
||||
# When the picker was skipped, declining the overwrite means the user
|
||||
# wants a different disk.
|
||||
$full_disk_only && disk_form
|
||||
;;
|
||||
"Free space install (alongside existing data)")
|
||||
if run_partition_install "$@"; then
|
||||
exit 0
|
||||
"Free space install"*)
|
||||
if run_partition_decide; then
|
||||
install_target="free_space"
|
||||
return 0
|
||||
fi
|
||||
;;
|
||||
"Choose a different disk")
|
||||
@@ -879,13 +1036,64 @@ select_installation() {
|
||||
done
|
||||
}
|
||||
|
||||
disk_form
|
||||
select_installation "$@"
|
||||
# STEP 1: KEYBOARD (Ctrl+C here arms deferred provisioning and jumps to disk selection)
|
||||
|
||||
defer_provisioning=false
|
||||
install_target="full_disk"
|
||||
|
||||
# Let the live VT reach its settled width before the first screen so the logo
|
||||
# isn't measured against the transient 80-column boot console.
|
||||
wait_for_stable_terminal
|
||||
|
||||
greeter
|
||||
|
||||
keyboard_form true
|
||||
|
||||
if $defer_provisioning; then
|
||||
# Deferred provisioning: no user setup, and the keyboard is deferred to the machine's first
|
||||
# boot. A defined default keymap so it boots before then; the owner picks
|
||||
# their real layout in the OOBE, which re-keys the console and, on encrypted
|
||||
# installs, rebuilds the initramfs so the LUKS prompt matches.
|
||||
keyboard="us"
|
||||
username=""
|
||||
password=""
|
||||
password_hash=""
|
||||
full_name=""
|
||||
email_address=""
|
||||
# Neutral defaults for the install; the owner overwrites both in the
|
||||
# first-boot OOBE (omarchy-provision-owner).
|
||||
hostname="omarchy"
|
||||
timezone="UTC"
|
||||
|
||||
# Jump straight to disk selection + overwrite confirmation (encrypted by
|
||||
# default, Ctrl+C toggles unencrypted). deferred provisioning is always a full-disk install.
|
||||
disk_form
|
||||
until confirm_disk_overwrite; do
|
||||
disk_form
|
||||
done
|
||||
install_target="full_disk"
|
||||
else
|
||||
# Normal install: keyboard (done above) → user → disk → install mode. The
|
||||
# keyboard chosen above is already loaded, so the LUKS passphrase entered in
|
||||
# the user step is typed under the right layout.
|
||||
user_step
|
||||
disk_form
|
||||
select_installation
|
||||
fi
|
||||
|
||||
clear
|
||||
|
||||
write_user_files
|
||||
|
||||
if [[ $install_target == "free_space" ]]; then
|
||||
run_partition_execute "$@"
|
||||
|
||||
if [[ ${1:-} == "dry" ]]; then
|
||||
print_dry_run_files
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Setup partition layout
|
||||
disk_size=$(lsblk -bdno SIZE "$disk")
|
||||
mib=$((1024 * 1024))
|
||||
@@ -902,14 +1110,21 @@ main_partition_size=$((disk_size_in_mib - main_partition_start - gpt_backup_rese
|
||||
kernel_choice=$(detect_kernel)
|
||||
|
||||
if [[ $encrypt_installation == true ]]; then
|
||||
# Deferred-provisioning installs carry no password: the orchestrator generates a throwaway
|
||||
# LUKS passphrase and stages it for the first-boot re-key.
|
||||
if $defer_provisioning; then
|
||||
encryption_password_line=""
|
||||
else
|
||||
encryption_password_line=",
|
||||
\"encryption_password\": $(echo -n "$password" | jq -Rsa)"
|
||||
fi
|
||||
disk_encryption_config=$(cat <<-_EOF_
|
||||
,
|
||||
"disk_encryption": {
|
||||
"encryption_type": "luks",
|
||||
"lvm_volumes": [],
|
||||
"iter_time": 2000,
|
||||
"partitions": [ "8c2c2b92-1070-455d-b76a-56263bab24aa" ],
|
||||
"encryption_password": $(echo -n "$password" | jq -Rsa)
|
||||
"partitions": [ "8c2c2b92-1070-455d-b76a-56263bab24aa" ]$encryption_password_line
|
||||
}
|
||||
_EOF_
|
||||
)
|
||||
@@ -927,6 +1142,7 @@ cat <<-_EOF_ >user_configuration.json
|
||||
"custom_commands": [],
|
||||
"omarchy_install": {
|
||||
"mode": "full_disk",
|
||||
"defer_provisioning": $defer_provisioning,
|
||||
"target_mount": "/mnt",
|
||||
"boot": {
|
||||
"esp_mount": "/boot",
|
||||
|
||||
Reference in new issue
Block a user