From dd5c53cd3c610610098af3f20f2cac26342f73f9 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Tue, 4 Aug 2026 05:56:33 -0700 Subject: [PATCH] Trust the target to have ufw when opening SSH access ufw is part of Omarchy's default package set, so the presence check was guarding a machine that cannot exist -- and if it somehow did, skipping the firewall would produce an unreachable install, which is exactly what this phase fails loudly to prevent. The user.rules assertion already raises in that case. With the check gone, the helper is small enough to live inline in the phase. Co-Authored-By: Claude Fable 5 --- .../omarchy-iso/orchestrator/phases_impl.py | 28 ++++++------------- 1 file changed, 9 insertions(+), 19 deletions(-) diff --git a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py index ba0a639..4be987c 100644 --- a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py +++ b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py @@ -1343,25 +1343,15 @@ def configure_ssh_access(ctx: InstallContext) -> None: check=True, ) - _allow_ssh_through_firewall(ctx) - - -def _allow_ssh_through_firewall(ctx: InstallContext) -> None: - """Open port 22 in the target's ufw. - - Omarchy's install/config/firewall.sh opens LocalSend and docker DNS and - nothing else, and ufw runs default-deny incoming, so an enabled sshd is - still unreachable -- connections time out rather than being refused. - - ufw cannot reach netfilter from inside the chroot and exits non-zero saying - so, but it writes the rule to user.rules first, and that file is what - ufw.service loads on first boot. So the exit status is the wrong thing to - check here; the rule landing in the file is the thing that matters. - """ - if not (ctx.target / "usr" / "bin" / "ufw").exists(): - info("› no ufw in target, leaving firewall alone") - return - + # Open port 22 in the target's ufw, which runs default-deny incoming, so an + # enabled sshd is still unreachable -- connections time out rather than + # being refused. + # + # ufw cannot reach netfilter from inside the chroot and exits non-zero + # saying so, but it writes the rule to user.rules first, and that file is + # what ufw.service loads on first boot. So the exit status is the wrong + # thing to check here; the rule landing in the file is the thing that + # matters. info("› allowing SSH through ufw") subprocess.run(["arch-chroot", str(ctx.target), "ufw", "allow", "ssh"], check=False)