Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
5c69fa5768 |
No files matched your search
@@ -2,34 +2,40 @@ name: Nightly ISO Build
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "1 0 * * *" # Daily at 00:01 UTC
|
||||
workflow_dispatch: # Allow manual triggering
|
||||
- cron: '1 0 * * *' # Daily at 00:01 UTC
|
||||
workflow_dispatch: # Allow manual triggering
|
||||
|
||||
jobs:
|
||||
build-iso:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
container:
|
||||
image: archlinux/archlinux:latest
|
||||
options: --privileged
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Free Disk Space
|
||||
uses: jlumbroso/free-disk-space@v1.3.1
|
||||
|
||||
- name: Build ISO
|
||||
run: NO_BOOT_OFFER=1 ./bin/omarchy-iso-make
|
||||
|
||||
- name: Delete previously uploaded ISO artifact
|
||||
uses: philips-labs/action-delete-artifacts@v1.0.0
|
||||
with:
|
||||
workflow: nightly-build.yml
|
||||
continue-on-error: true
|
||||
|
||||
- name: Upload newly built ISO artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: omarchy-iso-${{ github.run_number }}
|
||||
path: ./release/*.iso
|
||||
retention-days: 1
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Build ISO in Arch Linux container
|
||||
run: |
|
||||
docker run --rm \
|
||||
--privileged \
|
||||
-v "${{ github.workspace }}:/workspace" \
|
||||
-w /workspace \
|
||||
archlinux:latest \
|
||||
bash -c "
|
||||
pacman -Syu --noconfirm && \
|
||||
chmod +x build_iso.sh && \
|
||||
./build_iso.sh
|
||||
"
|
||||
|
||||
- name: Upload ISO artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: omarchy-iso-${{ github.run_number }}
|
||||
path: out/*.iso
|
||||
retention-days: 30
|
||||
@@ -1,6 +1,6 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 Anton Hvornum
|
||||
Copyright (c) 2025 Anton Hvornum
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
||||
@@ -20,74 +20,10 @@ Despite the local folder name, the first argument is the Omarchy source checkout
|
||||
|
||||
Use `--dev` or `--rc` to build against those package channels. Both `--dev` and `--edge` select the dev packages from the edge mirror.
|
||||
|
||||
## Autoinstall
|
||||
|
||||
The shipped ISO installs itself with no keyboard when it finds its configuration on a second drive. Attach a drive labeled `cidata` alongside the ISO and the installer copies the config off it and skips the configurator; with no such drive, nothing changes and the wizard runs as usual. No rebuild, no extra boot entry.
|
||||
|
||||
`cidata` is the cloud-init `NoCloud` label, so Proxmox, libvirt, and Packer already know how to attach one.
|
||||
|
||||
### Configuration files
|
||||
|
||||
These are the configurator's own output files, so the way to get a starting set is to run one interactive install and copy what it wrote into `/root`.
|
||||
|
||||
| File | Required | Purpose |
|
||||
|------|----------|---------|
|
||||
| `user_configuration.json` | Yes | archinstall config: disk, hostname, timezone, keyboard |
|
||||
| `user_credentials.json` | Yes | Username and password hash |
|
||||
| `user_full_name.txt` | No | Git full name |
|
||||
| `user_email_address.txt` | No | Git email |
|
||||
| `user_encrypt_installation.txt` | No | `true` when `user_configuration.json` carries a `disk_encryption` block; defaults to false |
|
||||
| `authorized_keys` | No | SSH public keys in sshd's own format, one per line |
|
||||
| `tailscale_authkey` | No | Tailscale auth key; the machine joins your tailnet on first boot |
|
||||
|
||||
Both required files must be present or the installer falls back to the configurator. Generate the password hash for `user_credentials.json` with `openssl passwd -6 "yourpassword"`.
|
||||
|
||||
Encryption itself is configured by the `disk_encryption` block inside `user_configuration.json` — which carries the passphrase in plaintext, so treat a drive built from an encrypted install accordingly. The flag file must match it: it drives the encrypted install's SDDM autologin and the final boot validation, not the encryption.
|
||||
|
||||
`authorized_keys` is the same file sshd reads — copy your own or write one key per line:
|
||||
|
||||
```
|
||||
ssh-ed25519 AAAA... you@host
|
||||
```
|
||||
|
||||
When `authorized_keys` is present, autoinstall installs it as the user's `~/.ssh/authorized_keys`, enables `sshd`, and adds a `ufw allow ssh` rule — a stock Omarchy install ships openssh with the service disabled and its firewall opens neither port 22 nor anything else beyond LocalSend. Networking needs nothing extra; NetworkManager is already enabled with DHCP. Password SSH authentication is left at the distro default. An `authorized_keys` with no usable keys fails the install rather than producing a machine nobody can reach.
|
||||
|
||||
When `tailscale_authkey` is present (one key, blank lines and `#` comments ignored), the install adds the `tailscale` package from the ISO's bundled mirror — nothing is fetched from the network at install or boot — and stages the join for first boot: the key lands at `/etc/tailscale/authkey` (root-only), `tailscaled` is enabled, ufw allows traffic in on `tailscale0`, and a background unit runs `tailscale up` once the network is actually up, retrying until it succeeds without holding up the boot. After a successful join the key is deleted and the unit disables itself; until then both survive reboots, so a machine installed offline joins whenever it first gets connectivity. The node appears on the tailnet under the configured hostname. Use a reusable, pre-authorized (tagged) key so one drive image serves many machines — or an ephemeral key for disposable VMs.
|
||||
|
||||
### Building the drive
|
||||
|
||||
```bash
|
||||
mkdir cidata
|
||||
cp user_configuration.json user_credentials.json authorized_keys cidata/
|
||||
genisoimage -output cidata.iso -volid cidata -joliet -rock cidata/
|
||||
```
|
||||
|
||||
### Proxmox example
|
||||
|
||||
```bash
|
||||
qm create 101 --name my-omarchy \
|
||||
--bios ovmf --machine q35 --cpu host --cores 4 --memory 8192 \
|
||||
--ostype l26 --scsihw virtio-scsi-single \
|
||||
--efidisk0 local-lvm:0,efitype=4m,pre-enrolled-keys=0 \
|
||||
--scsi0 local-lvm:40,discard=on,iothread=1 \
|
||||
--net0 virtio,bridge=vmbr0 --vga virtio --serial0 socket \
|
||||
--ide2 local:iso/omarchy.iso,media=cdrom \
|
||||
--ide3 local:iso/cidata.iso,media=cdrom \
|
||||
--boot order='scsi0;ide2'
|
||||
|
||||
qm start 101
|
||||
```
|
||||
|
||||
Boot order is disk first: the empty disk falls through to the ISO on the first boot, and the installed system boots from disk afterwards. The machine reboots into Omarchy on its own when the install finishes.
|
||||
|
||||
Encrypted autoinstalls are not fully unattended — the LUKS passphrase prompt still needs someone at the first boot.
|
||||
|
||||
## Testing the ISO
|
||||
|
||||
Run `./bin/omarchy-iso-boot [release/omarchy.iso]`.
|
||||
|
||||
Run `./test/all` for the unit tests, which cover cidata autoinstall loading and the orchestrator's SSH access phase without needing a built ISO.
|
||||
|
||||
To exercise installation alongside existing Windows-style partitions, run
|
||||
`./bin/omarchy-iso-test-windows-disk [release/omarchy.iso]`. It creates a
|
||||
synthetic disk in `/tmp` with an existing ESP and data partition plus ample
|
||||
|
||||
@@ -143,10 +143,6 @@ if [[ -z "$NO_CACHE" ]]; then
|
||||
OFFLINE_REPO_BUILD_CACHE_DIR="$HOME/.cache/omarchy/iso_${OMARCHY_MIRROR}/airootfs/var/cache/omarchy"
|
||||
mkdir -p "$OFFLINE_REPO_BUILD_CACHE_DIR"
|
||||
DOCKER_ARGS+=(-v "$OFFLINE_REPO_BUILD_CACHE_DIR:/var/cache/airootfs/var/cache/omarchy")
|
||||
else
|
||||
# The locally cached :latest image is a cache too — docker run never
|
||||
# re-checks the registry for it, so refresh it when building cold.
|
||||
DOCKER_ARGS+=(--pull=always)
|
||||
fi
|
||||
|
||||
docker run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
|
||||
@@ -157,5 +153,5 @@ mv -f "$latest_iso" "$iso_ref"
|
||||
|
||||
if [[ -z "${NO_BOOT_OFFER:-}" ]]; then
|
||||
echo
|
||||
gum confirm "Boot $iso_ref?" && "$BUILD_ROOT/bin/omarchy-iso-boot" "$iso_ref"
|
||||
gum confirm "Boot $iso_ref?" && omarchy-iso-boot "$iso_ref"
|
||||
fi
|
||||
@@ -12,4 +12,3 @@ openssh
|
||||
pipewire
|
||||
snapper
|
||||
sof-firmware
|
||||
tailscale
|
||||
+38
-56
@@ -25,11 +25,7 @@ export OMARCHY_RUNTIME_PACKAGE OMARCHY_SETTINGS_PACKAGE OMARCHY_NVIM_PACKAGE
|
||||
# Packages installed into the Arch container used to build the ISO.
|
||||
pacman-key --init
|
||||
pacman --noconfirm -Sy archlinux-keyring
|
||||
# Full upgrade, not just -Sy: docker never re-pulls :latest once it's cached,
|
||||
# so this container can be months behind the mirror it installs from. A plain
|
||||
# -Sy install is then a partial upgrade — new packages linked against a glibc
|
||||
# the container doesn't have yet.
|
||||
pacman --noconfirm -Syu archiso git sudo base-devel jq grub imagemagick neovim nodejs npm tree-sitter-cli
|
||||
pacman --noconfirm -Sy archiso git sudo base-devel jq grub imagemagick neovim nodejs npm tree-sitter-cli
|
||||
|
||||
# Pre-import the omarchy signing key (so pacman trusts our [omarchy] repo
|
||||
# during the build without keyserver lookups).
|
||||
@@ -120,19 +116,6 @@ cp "/tmp/$NODE_FILENAME" "$build_cache_dir/airootfs/opt/packages/"
|
||||
arch_packages=(linux-t2 git gum jq openssl plymouth python-terminaltexteffects tzupdate omarchy-keyring "$OMARCHY_SETTINGS_PACKAGE" lvm2 cryptsetup parted)
|
||||
printf '%s\n' "${arch_packages[@]}" >> "$build_cache_dir/packages.x86_64"
|
||||
|
||||
# The live ISO boots linux-t2 (see airootfs/etc/mkinitcpio.d/linux-t2.preset), so
|
||||
# stock linux is a second kernel nobody boots: ~147MB of ISO, plus its own archiso
|
||||
# initramfs, copied into both the ISO tree and the size-constrained FAT EFI image.
|
||||
#
|
||||
# It cannot just be deleted — releng's broadcom-wl hard-depends on it, and it is
|
||||
# the only releng package that does, so pacman would drag the kernel straight back
|
||||
# in. broadcom-wl is a prebuilt module for stock linux and cannot load on the
|
||||
# kernel we boot, so it has done nothing since we started booting T2 anyway. The
|
||||
# install is entirely offline and the live environment needs no Wi-Fi driver.
|
||||
#
|
||||
# Anchored so linux-t2 and linux-firmware are untouched.
|
||||
sed -i -E '/^(linux|broadcom-wl)$/d' "$build_cache_dir/packages.x86_64"
|
||||
|
||||
# Build the offline mirror: everything pacstrap might want during the target
|
||||
# install. With --local-source, the omarchy* packages we just built are
|
||||
# already in the mirror and we filter them out below. Without it, pacman -Syw
|
||||
@@ -201,49 +184,48 @@ if ! download_offline_packages; then
|
||||
download_offline_packages
|
||||
fi
|
||||
|
||||
# Resolve the exact filenames chosen by the same synced package databases used
|
||||
# for the download. Pruning by this transaction (rather than merely keeping the
|
||||
# newest version of every cached package name) removes packages that have left
|
||||
# the lists or dependency closure, such as an old Electron major version.
|
||||
if ! resolved_package_files="$(
|
||||
pacman --config "/configs/pacman-online-${OMARCHY_MIRROR}.conf" --noconfirm \
|
||||
--dbpath /tmp/offlinedb -S --print --print-format '%f' "${all_packages[@]}"
|
||||
)"; then
|
||||
echo "ERROR: could not resolve the package files required by the offline mirror" >&2
|
||||
exit 1
|
||||
fi
|
||||
mapfile -t required_package_files <<< "$resolved_package_files"
|
||||
prune_stale_package_versions() {
|
||||
local dir="$1"
|
||||
local pkgfile name version cmp
|
||||
local -a stale=()
|
||||
declare -A newest_file=()
|
||||
declare -A newest_version=()
|
||||
|
||||
# The online transaction intentionally excludes packages built from the local
|
||||
# checkouts. Add those exact artifacts back to the keep-set after verifying
|
||||
# that the local build left exactly one file for each selected package name.
|
||||
if [[ -n ${LOCAL_OMARCHY_BUILD:-} ]]; then
|
||||
for local_package_name in \
|
||||
"$OMARCHY_RUNTIME_PACKAGE" "$OMARCHY_SETTINGS_PACKAGE" "$OMARCHY_NVIM_PACKAGE"; do
|
||||
local_package_file=""
|
||||
for candidate in "$offline_mirror_dir/$local_package_name-"*.pkg.tar.*; do
|
||||
[[ -f $candidate && $candidate != *.sig ]] || continue
|
||||
read -r candidate_name _ < <(pacman -Qp "$candidate" 2>/dev/null) || continue
|
||||
[[ $candidate_name == "$local_package_name" ]] || continue
|
||||
if [[ -n $local_package_file ]]; then
|
||||
echo "ERROR: multiple local builds found for $local_package_name" >&2
|
||||
exit 1
|
||||
fi
|
||||
local_package_file="${candidate##*/}"
|
||||
done
|
||||
if [[ -z $local_package_file ]]; then
|
||||
echo "ERROR: local build not found for $local_package_name" >&2
|
||||
exit 1
|
||||
while IFS= read -r pkgfile; do
|
||||
read -r name version < <(pacman -Qp "$pkgfile" 2>/dev/null) || continue
|
||||
[[ -n $name && -n $version ]] || continue
|
||||
|
||||
if [[ -z ${newest_version[$name]+x} ]]; then
|
||||
newest_version[$name]="$version"
|
||||
newest_file[$name]="$pkgfile"
|
||||
continue
|
||||
fi
|
||||
required_package_files+=("$local_package_file")
|
||||
done
|
||||
fi
|
||||
|
||||
printf '%s\n' "${required_package_files[@]}" |
|
||||
bash /builder/prune-offline-mirror.sh "$offline_mirror_dir"
|
||||
cmp=$(vercmp "$version" "${newest_version[$name]}")
|
||||
if (( cmp > 0 )); then
|
||||
stale+=("${newest_file[$name]}")
|
||||
newest_version[$name]="$version"
|
||||
newest_file[$name]="$pkgfile"
|
||||
else
|
||||
stale+=("$pkgfile")
|
||||
fi
|
||||
done < <(find "$dir" -maxdepth 1 -type f -name '*.pkg.tar.*' ! -name '*.sig' -print | sort)
|
||||
|
||||
if (( ${#stale[@]} > 0 )); then
|
||||
echo "Pruning stale package versions from offline mirror:"
|
||||
for pkgfile in "${stale[@]}"; do
|
||||
echo " $(basename "$pkgfile")"
|
||||
rm -f "$pkgfile" "$pkgfile.sig"
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
# Rebuild the offline repo db from scratch so size/checksum/depends entries
|
||||
# always reflect only the package files selected for this build.
|
||||
# always reflect the current package files. The persistent cache can contain
|
||||
# multiple versions of the same package; repo-add keeps the last one it sees,
|
||||
# which is lexical glob order, not version order (e.g. pkgrel -9 can override
|
||||
# -15). Prune to one newest version per package before indexing.
|
||||
prune_stale_package_versions "$offline_mirror_dir"
|
||||
rm -f "$offline_mirror_dir"/offline.db* "$offline_mirror_dir"/offline.files*
|
||||
repo-add "$offline_mirror_dir/offline.db.tar.gz" "$offline_mirror_dir/"*.pkg.tar.zst
|
||||
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
offline_mirror_dir="${1:-}"
|
||||
if [[ -z $offline_mirror_dir ]]; then
|
||||
echo "Usage: prune-offline-mirror.sh <offline-mirror-dir>" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d $offline_mirror_dir ]]; then
|
||||
echo "ERROR: offline mirror directory not found: $offline_mirror_dir" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Read the exact package filenames selected by pacman on stdin. Validate the
|
||||
# complete selection before deleting anything: an empty/partial resolution must
|
||||
# never turn a warm-cache build into a broken mirror.
|
||||
declare -A required=()
|
||||
while IFS= read -r filename; do
|
||||
[[ -n $filename ]] || continue
|
||||
if [[ $filename == */* || $filename != *.pkg.tar.* || $filename == *.sig ]]; then
|
||||
echo "ERROR: invalid required package filename: $filename" >&2
|
||||
exit 1
|
||||
fi
|
||||
required["$filename"]=1
|
||||
done
|
||||
|
||||
if (( ${#required[@]} == 0 )); then
|
||||
echo "ERROR: refusing to prune the offline mirror with an empty package selection" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
missing=()
|
||||
for filename in "${!required[@]}"; do
|
||||
[[ -f "$offline_mirror_dir/$filename" ]] || missing+=("$filename")
|
||||
done
|
||||
if (( ${#missing[@]} > 0 )); then
|
||||
echo "ERROR: refusing to prune; selected packages are missing from the mirror:" >&2
|
||||
printf ' %s\n' "${missing[@]}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
stale=()
|
||||
while IFS= read -r -d '' package_file; do
|
||||
filename="${package_file##*/}"
|
||||
[[ -n ${required[$filename]+x} ]] || stale+=("$package_file")
|
||||
done < <(
|
||||
find "$offline_mirror_dir" -maxdepth 1 -type f \
|
||||
-name '*.pkg.tar.*' ! -name '*.sig' -print0
|
||||
)
|
||||
|
||||
if (( ${#stale[@]} > 0 )); then
|
||||
echo "Pruning package archives not selected for the offline mirror:"
|
||||
for package_file in "${stale[@]}"; do
|
||||
echo " $(basename "$package_file")"
|
||||
rm -f -- "$package_file" "$package_file.sig"
|
||||
done
|
||||
fi
|
||||
|
||||
# A failed or interrupted download can leave a signature without its archive.
|
||||
# It cannot be indexed and only wastes space in the ISO.
|
||||
while IFS= read -r -d '' signature_file; do
|
||||
[[ -f ${signature_file%.sig} ]] || rm -f -- "$signature_file"
|
||||
done < <(
|
||||
find "$offline_mirror_dir" -maxdepth 1 -type f \
|
||||
-name '*.pkg.tar.*.sig' -print0
|
||||
)
|
||||
@@ -1,18 +0,0 @@
|
||||
# mkinitcpio preset file for the 'linux-t2' package on archiso
|
||||
#
|
||||
# The filename is the pkgbase, and that is load-bearing. Kernel packages ship
|
||||
# nothing in /boot — they only install usr/lib/modules/<kver>/vmlinuz — so
|
||||
# mkinitcpio's alpm hook sources /etc/mkinitcpio.d/<pkgbase>.preset and copies
|
||||
# THAT package's kernel to whatever ALL_kver names (is_kernelcopy in
|
||||
# /usr/share/libalpm/scripts/mkinitcpio). Named linux.preset, this pointed the
|
||||
# stock kernel at the T2 filenames, so the ISO booted stock Arch while every
|
||||
# boot entry said linux-t2 and T2 Macs got no keyboard or trackpad.
|
||||
#
|
||||
# releng ships its own linux.preset for the stock kernel; leave it alone.
|
||||
|
||||
PRESETS=('archiso')
|
||||
|
||||
ALL_kver='/boot/vmlinuz-linux-t2'
|
||||
archiso_config='/etc/mkinitcpio.conf.d/archiso.conf'
|
||||
|
||||
archiso_image="/boot/initramfs-linux-t2.img"
|
||||
@@ -0,0 +1,9 @@
|
||||
# mkinitcpio preset file for the 'linux' package on archiso
|
||||
|
||||
PRESETS=('archiso')
|
||||
|
||||
ALL_kver='/boot/vmlinuz-linux-t2'
|
||||
archiso_config='/etc/mkinitcpio.conf.d/archiso.conf'
|
||||
|
||||
archiso_image="/boot/initramfs-linux-t2.img"
|
||||
|
||||
@@ -91,15 +91,7 @@ warm_pid=$!
|
||||
trap 'kill "$warm_pid" 2>/dev/null' EXIT
|
||||
|
||||
cd /root
|
||||
# Autoinstall: a cidata drive carrying the configurator's own output files
|
||||
# stands in for the wizard. omarchy-cidata-load copies them into /root and
|
||||
# everything downstream runs the ordinary path against ordinary inputs.
|
||||
if /usr/local/bin/omarchy-cidata-load; then
|
||||
echo "Autoinstall configuration found on cidata drive; skipping the configurator."
|
||||
export OMARCHY_UI_INTERACTIVE=no
|
||||
else
|
||||
./configurator
|
||||
fi
|
||||
./configurator
|
||||
|
||||
# The foreground dashboard is now the sole visible install UI owner. It starts
|
||||
# the actual installer as a non-interactive child, logs child output, waits for
|
||||
@@ -115,6 +107,4 @@ rm -f /run/omarchy-install/state.json
|
||||
--creds /root/user_credentials.json \
|
||||
--full-name-file /root/user_full_name.txt \
|
||||
--email-file /root/user_email_address.txt \
|
||||
--encrypt-file /root/user_encrypt_installation.txt \
|
||||
--authorized-keys-file /root/authorized_keys \
|
||||
--tailscale-authkey-file /root/tailscale_authkey
|
||||
--encrypt-file /root/user_encrypt_installation.txt
|
||||
@@ -145,11 +145,7 @@ user_form() {
|
||||
username=$(gum input --placeholder "Alphanumeric without spaces (like dhh)" --prompt.foreground="#845DF9" --prompt "Username> ") || abort
|
||||
|
||||
if [[ "$username" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]]; then
|
||||
if [[ "$username" =~ ^(root|bin|daemon|mail|ftp|http|nobody|dbus|systemd-coredump|systemd-network|systemd-oom|systemd-journal-remote|systemd-resolve|systemd-timesync|tss|uuidd|alpm|git|avahi|cups|lp|_talkd|polkitd|rtkit|qemu|brltty|gluster|rpc|libvirt-qemu|pcscd|nvidia-persistenced|sddm)$ ]] ; then
|
||||
notice "Username is reserved for system" 1
|
||||
else
|
||||
break
|
||||
fi
|
||||
break
|
||||
else
|
||||
notice "Username must be alphanumeric with no spaces" 1
|
||||
fi
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Autoinstall: a drive labeled cidata (the cloud-init NoCloud label, so Proxmox,
|
||||
# libvirt and Packer all know how to attach one) carrying the configurator's own
|
||||
# output files stands in for the wizard. Copy those files into /root and
|
||||
# everything downstream runs the ordinary path against ordinary inputs.
|
||||
#
|
||||
# Exits 0 when an autoinstall drive was loaded and the configurator can be
|
||||
# skipped. The required pair is the same one the orchestrator treats as
|
||||
# mandatory; the rest are optional there too, so don't be stricter here.
|
||||
# Anything less than the pair means this isn't an autoinstall drive, and the
|
||||
# caller falls back to the wizard.
|
||||
#
|
||||
# The optional argument prefixes every path the script touches; tests use it to
|
||||
# run against a sandbox instead of the live system.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
root=${1:-}
|
||||
by_label=$root/dev/disk/by-label
|
||||
dest=$root/root
|
||||
mnt=$root/run/cidata
|
||||
|
||||
# The by-label symlinks come from udev, and on a fast boot this can run before
|
||||
# device enumeration has finished. Wait for the queue to drain instead of
|
||||
# racing it and silently dropping a headless install into the wizard.
|
||||
udevadm settle 2>/dev/null || true
|
||||
|
||||
device=""
|
||||
for label in cidata CIDATA; do
|
||||
[[ -e $by_label/$label ]] && { device=$by_label/$label; break; }
|
||||
done
|
||||
[[ -n $device ]] || exit 1
|
||||
|
||||
mkdir -p "$mnt"
|
||||
mount -o ro "$device" "$mnt" || exit 1
|
||||
|
||||
loaded=1
|
||||
if [[ -f $mnt/user_configuration.json && -f $mnt/user_credentials.json ]]; then
|
||||
files=("$mnt"/user_configuration.json "$mnt"/user_credentials.json)
|
||||
for file in user_full_name.txt user_email_address.txt user_encrypt_installation.txt authorized_keys tailscale_authkey; do
|
||||
[[ -f $mnt/$file ]] && files+=("$mnt/$file")
|
||||
done
|
||||
if cp "${files[@]}" "$dest"/; then
|
||||
loaded=0
|
||||
else
|
||||
# A partial copy must not leave files behind: the wizard cleans up only
|
||||
# what it writes itself, so a half-copied authorized_keys would leak into
|
||||
# the interactive install that follows.
|
||||
for file in "${files[@]}"; do
|
||||
rm -f "$dest/${file##*/}"
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
umount "$mnt"
|
||||
exit $loaded
|
||||
@@ -23,12 +23,6 @@ INSTALL_CMD=("$@")
|
||||
|
||||
TTY_PATH="${OMARCHY_DASHBOARD_TTY:-/dev/tty}"
|
||||
LOGO_PATH="${OMARCHY_PATH:-/usr/share/omarchy}/logo.txt"
|
||||
|
||||
# Autoinstall has no one at the keyboard, and every prompt this dashboard owns
|
||||
# reads from the TTY, so each would hang forever. Suppress them here rather than
|
||||
# in the scripts they live in: this process is the only owner of the visible UI.
|
||||
interactive() { [[ ${OMARCHY_UI_INTERACTIVE:-} != "no" ]]; }
|
||||
|
||||
CSI=$'\033['
|
||||
RESET="${CSI}0m"
|
||||
DIM="${CSI}2m"
|
||||
@@ -480,10 +474,6 @@ render_finish() {
|
||||
reboot_prompt() {
|
||||
local prompt_pad
|
||||
|
||||
# Nobody to confirm; the OMARCHY_UI_AUTO_REBOOT check at the call site still
|
||||
# applies, so setting both stops on the finish screen without a keyboard.
|
||||
interactive || return 0
|
||||
|
||||
# Position the cursor one blank line below the title so the button sits right there.
|
||||
printf '%s%d;1H%s' "$CSI" "$((LOGO_HEIGHT + 5))" "$CLEAR_LINE" >"$TTY_PATH"
|
||||
|
||||
@@ -608,9 +598,6 @@ failure_menu() {
|
||||
local choice uploader
|
||||
|
||||
[[ ${OMARCHY_UI_FAILURE_ACTION:-} == "exit" ]] && return 0
|
||||
# The failure screen and log tail have already rendered; exit with the
|
||||
# installer's status instead of blocking on a menu nobody can answer.
|
||||
interactive || return 0
|
||||
|
||||
while true; do
|
||||
uploader=""
|
||||
|
||||
@@ -11,14 +11,12 @@ set -eEo pipefail
|
||||
# doesn't choke on flags it doesn't recognize.
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--config) export OMARCHY_INSTALL_CONFIG="$2"; shift 2 ;;
|
||||
--creds) export OMARCHY_INSTALL_CREDS="$2"; shift 2 ;;
|
||||
--full-name-file) export OMARCHY_INSTALL_FULL_NAME_FILE="$2"; shift 2 ;;
|
||||
--email-file) export OMARCHY_INSTALL_EMAIL_FILE="$2"; shift 2 ;;
|
||||
--encrypt-file) export OMARCHY_INSTALL_ENCRYPT_FILE="$2"; shift 2 ;;
|
||||
--authorized-keys-file) export OMARCHY_INSTALL_AUTHORIZED_KEYS_FILE="$2"; shift 2 ;;
|
||||
--tailscale-authkey-file) export OMARCHY_INSTALL_TAILSCALE_AUTHKEY_FILE="$2"; shift 2 ;;
|
||||
*) echo "omarchy-iso-install: unknown arg $1" >&2; exit 2 ;;
|
||||
--config) export OMARCHY_INSTALL_CONFIG="$2"; shift 2 ;;
|
||||
--creds) export OMARCHY_INSTALL_CREDS="$2"; shift 2 ;;
|
||||
--full-name-file) export OMARCHY_INSTALL_FULL_NAME_FILE="$2"; shift 2 ;;
|
||||
--email-file) export OMARCHY_INSTALL_EMAIL_FILE="$2"; shift 2 ;;
|
||||
--encrypt-file) export OMARCHY_INSTALL_ENCRYPT_FILE="$2"; shift 2 ;;
|
||||
*) echo "omarchy-iso-install: unknown arg $1" >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
|
||||
@@ -18,8 +18,6 @@ class InstallContext:
|
||||
full_name: str
|
||||
email: str
|
||||
encrypt: bool
|
||||
authorized_keys_path: Path | None
|
||||
tailscale_authkey_path: Path | None
|
||||
|
||||
user_configuration: dict
|
||||
user_credentials: dict
|
||||
@@ -61,8 +59,6 @@ class InstallContext:
|
||||
full_name=_read_text(os.environ.get("OMARCHY_INSTALL_FULL_NAME_FILE")),
|
||||
email=_read_text(os.environ.get("OMARCHY_INSTALL_EMAIL_FILE")),
|
||||
encrypt=_read_text(os.environ.get("OMARCHY_INSTALL_ENCRYPT_FILE")).lower() in ("true", "yes", "1"),
|
||||
authorized_keys_path=_optional_path(os.environ.get("OMARCHY_INSTALL_AUTHORIZED_KEYS_FILE")),
|
||||
tailscale_authkey_path=_optional_path(os.environ.get("OMARCHY_INSTALL_TAILSCALE_AUTHKEY_FILE")),
|
||||
user_configuration=user_configuration,
|
||||
user_credentials=json.loads(creds_path.read_text()),
|
||||
arch_config_path=arch_config_path,
|
||||
@@ -107,16 +103,6 @@ def _default_omarchy_install(user_configuration: dict) -> dict[str, Any]:
|
||||
}
|
||||
|
||||
|
||||
def _optional_path(path: str | None) -> Path | None:
|
||||
"""A path the caller always passes but that need not exist. The live ISO
|
||||
passes --authorized-keys-file on every install; only autoinstall drives put
|
||||
a file there."""
|
||||
if not path:
|
||||
return None
|
||||
p = Path(path)
|
||||
return p if p.exists() else None
|
||||
|
||||
|
||||
def _read_text(path: str | None) -> str:
|
||||
if not path:
|
||||
return ""
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
"""Offline target keyboard configuration.
|
||||
|
||||
archinstall's set_keyboard_language boots the installed system in a
|
||||
systemd-nspawn container just to run localectl. systemd-firstboot --root
|
||||
produces the part of that output Omarchy actually consumes — KEYMAP for the
|
||||
console plus the XKB* settings in vconsole.conf that omarchy's
|
||||
detect-keyboard-layout.sh copies into Hyprland's kb_layout — without booting
|
||||
anything. The Xorg 00-keyboard.conf that localectl also writes is not
|
||||
generated: nothing on an Omarchy system reads it.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def configure_keyboard(target: Path, language: str) -> bool:
|
||||
"""Write the console keymap into a mounted target without booting it.
|
||||
|
||||
Returns False for layouts localectl doesn't know (the configurator offers
|
||||
two, ba and khmer), matching archinstall: warn and keep the default.
|
||||
"""
|
||||
if not language.strip():
|
||||
return True
|
||||
|
||||
result = subprocess.run(
|
||||
["localectl", "--no-pager", "list-keymaps"],
|
||||
check=False,
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
if result.returncode != 0:
|
||||
detail = result.stderr.strip() or "localectl returned an error"
|
||||
raise RuntimeError(f"Unable to list keyboard layouts: {detail}")
|
||||
if language.lower() not in {layout.lower() for layout in result.stdout.splitlines()}:
|
||||
return False
|
||||
|
||||
# systemd-firstboot --force rewrites vconsole.conf wholesale, dropping the
|
||||
# FONT= line archinstall's set_vconsole wrote earlier.
|
||||
vconsole_path = target / "etc" / "vconsole.conf"
|
||||
font = None
|
||||
if vconsole_path.exists():
|
||||
font = next(
|
||||
(line for line in vconsole_path.read_text().splitlines() if line.startswith("FONT=")),
|
||||
None,
|
||||
)
|
||||
|
||||
result = subprocess.run(
|
||||
["systemd-firstboot", f"--root={target}", f"--keymap={language}", "--force"],
|
||||
check=False,
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
if result.returncode != 0:
|
||||
detail = result.stderr.strip() or "systemd-firstboot returned an error"
|
||||
raise RuntimeError(f"Unable to configure keyboard layout {language}: {detail}")
|
||||
|
||||
if font:
|
||||
vconsole_path.write_text(vconsole_path.read_text() + font + "\n")
|
||||
|
||||
return True
|
||||
@@ -38,8 +38,6 @@ def build_phases(ctx: InstallContext):
|
||||
run_chroot_finalizer,
|
||||
configure_dns_resolver,
|
||||
configure_login,
|
||||
configure_ssh_access,
|
||||
configure_tailscale,
|
||||
validate_boot,
|
||||
)
|
||||
|
||||
@@ -52,8 +50,6 @@ def build_phases(ctx: InstallContext):
|
||||
("Finalizing Limine boot", finalize_limine_boot),
|
||||
("Finalizing user", run_chroot_finalizer),
|
||||
("Configuring login", configure_login),
|
||||
("Configuring SSH access", configure_ssh_access),
|
||||
("Configuring Tailscale", configure_tailscale),
|
||||
("Configuring DNS resolver", configure_dns_resolver),
|
||||
("Validating boot setup", validate_boot),
|
||||
]
|
||||
|
||||
@@ -15,8 +15,6 @@ Phase ordering (full-disk and protected/pre-mounted):
|
||||
finalize_limine_boot → final Limine config/UKI build after hardware drop-ins
|
||||
run_chroot_finalizer → arch-chroot -u user omarchy-finalize-user
|
||||
configure_login → sddm state + encrypted-install autologin
|
||||
configure_ssh_access → authorized_keys for autoinstall; no-op otherwise
|
||||
configure_tailscale → tailnet join staged for first boot; no-op otherwise
|
||||
validate_boot → assert UKI / limine.conf / kernel cmdline are sane
|
||||
"""
|
||||
|
||||
@@ -29,13 +27,11 @@ import shutil
|
||||
import subprocess
|
||||
import textwrap
|
||||
import time
|
||||
from dataclasses import replace
|
||||
from pathlib import Path
|
||||
|
||||
from . import archinstall_adapter as arch
|
||||
from .context import InstallContext
|
||||
from .keyboard import configure_keyboard
|
||||
from .ui import error, info
|
||||
from .ui import info
|
||||
|
||||
|
||||
# Package targets are written by builder/build-iso.sh. Stable ISOs use the
|
||||
@@ -250,10 +246,6 @@ def arch_install_system(ctx: InstallContext) -> None:
|
||||
_mask_mkinitcpio_pacman_hooks(ctx)
|
||||
try:
|
||||
info("› installing base system (mkinitcpio deferred to final Limine UKI build)")
|
||||
# An empty kb_layout makes archinstall's set_keyboard_language skip
|
||||
# booting the target in a container just to run localectl; the
|
||||
# keymap is configured offline right after instead.
|
||||
kb_layout = config.locale_config.kb_layout if config.locale_config else ""
|
||||
installer.minimal_installation(
|
||||
optional_repositories=(
|
||||
config.mirror_config.optional_repositories
|
||||
@@ -261,16 +253,10 @@ def arch_install_system(ctx: InstallContext) -> None:
|
||||
),
|
||||
mkinitcpio=False,
|
||||
hostname=config.hostname,
|
||||
locale_config=(
|
||||
replace(config.locale_config, kb_layout="")
|
||||
if config.locale_config else None
|
||||
),
|
||||
locale_config=config.locale_config,
|
||||
pacman_config=config.pacman_config,
|
||||
)
|
||||
|
||||
if not configure_keyboard(installer.target, kb_layout):
|
||||
error(f"Invalid keyboard language specified: {kb_layout}")
|
||||
|
||||
if config.mirror_config:
|
||||
installer.set_mirrors(mirror_handler, config.mirror_config, on_target=True)
|
||||
|
||||
@@ -291,14 +277,6 @@ def arch_install_system(ctx: InstallContext) -> None:
|
||||
|
||||
info("› installing Omarchy runtime + omarchy-base.packages")
|
||||
installer.add_additional_packages(_runtime_package_list(ctx))
|
||||
|
||||
# Tailscale is bundled in the offline mirror but only installed
|
||||
# when an autoinstall drive staged an auth key; must happen here,
|
||||
# while the mirror is still bind-mounted, not in the phase that
|
||||
# configures the join.
|
||||
if ctx.tailscale_authkey_path is not None:
|
||||
info("› installing tailscale (auth key staged for first boot)")
|
||||
installer.add_additional_packages(["tailscale"])
|
||||
finally:
|
||||
_unmask_mkinitcpio_pacman_hooks(ctx)
|
||||
_unmount_offline_package_cache(ctx)
|
||||
@@ -459,13 +437,7 @@ def _register_limine_efi_entry(
|
||||
raise RuntimeError("efibootmgr --create reported success but no Limine entry found")
|
||||
limine_num = new_limine[0]
|
||||
|
||||
keep = [
|
||||
num
|
||||
for num in pre_state["order"]
|
||||
if num not in stale_limine
|
||||
and num != limine_num
|
||||
and num in pre_state["entries"]
|
||||
]
|
||||
keep = [num for num in pre_state["order"] if num not in stale_limine and num != limine_num]
|
||||
subprocess.run(
|
||||
["efibootmgr", "--bootorder", ",".join([limine_num, *keep])],
|
||||
check=True, capture_output=True,
|
||||
@@ -1314,189 +1286,6 @@ def configure_login(ctx: InstallContext) -> None:
|
||||
)
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# configure_ssh_access: make the installed machine reachable over SSH with the
|
||||
# keys an autoinstall drive supplied. A stock Omarchy install ships openssh but
|
||||
# leaves sshd disabled, and its firewall.sh opens only LocalSend and docker DNS,
|
||||
# so all three pieces -- keys, service, firewall -- have to be done here.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
def configure_ssh_access(ctx: InstallContext) -> None:
|
||||
if ctx.authorized_keys_path is None:
|
||||
return
|
||||
|
||||
keys = _authorized_keys(ctx.authorized_keys_path)
|
||||
info(f"› installing {len(keys)} SSH key(s) for {ctx.username}")
|
||||
|
||||
ssh_dir = ctx.target / "home" / ctx.username / ".ssh"
|
||||
ssh_dir.mkdir(parents=True, exist_ok=True)
|
||||
ssh_dir.chmod(0o700)
|
||||
|
||||
authorized_keys = ssh_dir / "authorized_keys"
|
||||
authorized_keys.write_text("".join(f"{key}\n" for key in keys))
|
||||
authorized_keys.chmod(0o600)
|
||||
|
||||
# Ask the target for the uid rather than assuming the first user is 1000.
|
||||
# Uncaptured so a failure shows up in the install log, and checked because
|
||||
# a root-owned authorized_keys is one sshd refuses to read.
|
||||
subprocess.run(
|
||||
["arch-chroot", str(ctx.target), "chown", "-R",
|
||||
f"{ctx.username}:{ctx.username}", f"/home/{ctx.username}/.ssh"],
|
||||
check=True,
|
||||
)
|
||||
|
||||
info("› enabling sshd")
|
||||
subprocess.run(
|
||||
["arch-chroot", str(ctx.target), "systemctl", "enable", "sshd.service"],
|
||||
check=True,
|
||||
)
|
||||
|
||||
# Open port 22 in the target's ufw, which runs default-deny incoming, so an
|
||||
# enabled sshd is still unreachable -- connections time out rather than
|
||||
# being refused.
|
||||
#
|
||||
# ufw cannot reach netfilter from inside the chroot and exits non-zero
|
||||
# saying so, but it writes the rule to user.rules first, and that file is
|
||||
# what ufw.service loads on first boot. So the exit status is the wrong
|
||||
# thing to check here; the rule landing in the file is the thing that
|
||||
# matters.
|
||||
info("› allowing SSH through ufw")
|
||||
subprocess.run(["arch-chroot", str(ctx.target), "ufw", "allow", "ssh"], check=False)
|
||||
|
||||
rules = ctx.target / "etc" / "ufw" / "user.rules"
|
||||
text = rules.read_text() if rules.exists() else ""
|
||||
if "--dport 22 -j ACCEPT" not in text:
|
||||
raise RuntimeError(f"ufw did not record an allow rule for port 22 in {rules}")
|
||||
|
||||
|
||||
def _authorized_keys(path: Path) -> list[str]:
|
||||
"""Read the autoinstall authorized_keys: sshd's own format, one public key
|
||||
per line, with blank lines and # comments dropped.
|
||||
|
||||
Raise rather than skip on anything unusable. An install that "succeeds"
|
||||
into a machine nobody can log into is worse than one that stops with the
|
||||
reason on screen.
|
||||
"""
|
||||
try:
|
||||
lines = path.read_text().splitlines()
|
||||
except OSError as exc:
|
||||
raise RuntimeError(f"{path} is not readable: {exc}") from exc
|
||||
|
||||
keys = [line.strip() for line in lines]
|
||||
keys = [key for key in keys if key and not key.startswith("#")]
|
||||
if not keys:
|
||||
raise RuntimeError(f"{path} contains no SSH keys")
|
||||
|
||||
return keys
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# configure_tailscale: stage the tailnet join an autoinstall drive asked for.
|
||||
# `tailscale up` needs a running tailscaled and there is no systemd in the
|
||||
# chroot, so the install only stages: the key, the enabled services, and a
|
||||
# oneshot first-boot unit that performs the join once the network is really
|
||||
# there. The package itself was installed from the offline mirror during
|
||||
# arch_install_system -- nothing is fetched at boot.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
TAILSCALE_AUTHKEY_TARGET = "/etc/tailscale/authkey"
|
||||
|
||||
# systemd expands $VAR in ExecStart, so the retry loop avoids `$` entirely.
|
||||
# network-online.target can be reached before there is real connectivity, so
|
||||
# retry inside the boot -- but NOT as a oneshot: target units implicitly gain
|
||||
# After= for their Wants=, so a oneshot in multi-user.target holds the whole
|
||||
# boot (SDDM included) hostage until it finishes. Type=simple counts as
|
||||
# started the moment it forks, letting boot proceed while the join retries in
|
||||
# the background for as long as the boot lasts. Cleanup lives inside the
|
||||
# script because it must only run after a successful join: the key is removed
|
||||
# and the unit disabled on success, while on a boot with no connectivity both
|
||||
# survive -- so a machine installed offline joins on the first boot that can.
|
||||
TAILSCALE_JOIN_UNIT = f"""\
|
||||
[Unit]
|
||||
Description=Join the tailnet with the auth key staged by autoinstall
|
||||
Wants=network-online.target
|
||||
After=network-online.target tailscaled.service
|
||||
Requires=tailscaled.service
|
||||
ConditionPathExists={TAILSCALE_AUTHKEY_TARGET}
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/bin/sh -c 'until tailscale up --auth-key file:{TAILSCALE_AUTHKEY_TARGET}; do sleep 15; done; rm -f {TAILSCALE_AUTHKEY_TARGET}; systemctl disable omarchy-tailscale-join.service'
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
"""
|
||||
|
||||
|
||||
def configure_tailscale(ctx: InstallContext) -> None:
|
||||
if ctx.tailscale_authkey_path is None:
|
||||
return
|
||||
|
||||
key = _tailscale_authkey(ctx.tailscale_authkey_path)
|
||||
|
||||
# An ISO built before tailscale was bundled installs nothing, and a staged
|
||||
# key with no binary would fail silently forever on first boot.
|
||||
if not (ctx.target / "usr" / "bin" / "tailscale").exists():
|
||||
raise RuntimeError("tailscale is not installed on the target; this ISO does not bundle it")
|
||||
|
||||
info("› staging Tailscale auth key")
|
||||
ts_dir = ctx.target / "etc" / "tailscale"
|
||||
ts_dir.mkdir(parents=True, exist_ok=True)
|
||||
ts_dir.chmod(0o700)
|
||||
authkey = ts_dir / "authkey"
|
||||
authkey.write_text(f"{key}\n")
|
||||
authkey.chmod(0o600)
|
||||
|
||||
info("› enabling tailscaled and the first-boot join")
|
||||
unit = ctx.target / "etc" / "systemd" / "system" / "omarchy-tailscale-join.service"
|
||||
unit.parent.mkdir(parents=True, exist_ok=True)
|
||||
unit.write_text(TAILSCALE_JOIN_UNIT)
|
||||
subprocess.run(
|
||||
["arch-chroot", str(ctx.target), "systemctl", "enable",
|
||||
"tailscaled.service", "omarchy-tailscale-join.service"],
|
||||
check=True,
|
||||
)
|
||||
|
||||
# Same dance as configure_ssh_access: ufw cannot reach netfilter from the
|
||||
# chroot and exits non-zero, but it records the rule in user.rules first,
|
||||
# and that file is what ufw.service loads on first boot. Without the rule
|
||||
# the node joins the tailnet and is then unreachable over it.
|
||||
info("› allowing tailnet traffic through ufw")
|
||||
subprocess.run(
|
||||
["arch-chroot", str(ctx.target), "ufw", "allow", "in", "on", "tailscale0"],
|
||||
check=False,
|
||||
)
|
||||
|
||||
rules = ctx.target / "etc" / "ufw" / "user.rules"
|
||||
text = rules.read_text() if rules.exists() else ""
|
||||
if "-i tailscale0 -j ACCEPT" not in text:
|
||||
raise RuntimeError(f"ufw did not record an allow rule for tailscale0 in {rules}")
|
||||
|
||||
|
||||
def _tailscale_authkey(path: Path) -> str:
|
||||
"""Read the autoinstall tailscale_authkey: exactly one key, with blank
|
||||
lines and # comments dropped. No format validation beyond that -- key
|
||||
formats are Tailscale's to change.
|
||||
|
||||
Raise rather than skip on anything unusable, same reasoning as
|
||||
_authorized_keys: a machine that "succeeds" into never joining the
|
||||
tailnet is worse than one that stops with the reason on screen.
|
||||
"""
|
||||
try:
|
||||
lines = path.read_text().splitlines()
|
||||
except OSError as exc:
|
||||
raise RuntimeError(f"{path} is not readable: {exc}") from exc
|
||||
|
||||
keys = [line.strip() for line in lines]
|
||||
keys = [key for key in keys if key and not key.startswith("#")]
|
||||
if not keys:
|
||||
raise RuntimeError(f"{path} contains no auth key")
|
||||
if len(keys) > 1:
|
||||
raise RuntimeError(f"{path} contains {len(keys)} keys; expected exactly one")
|
||||
|
||||
return keys[0]
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# validate_boot: hard checks before reboot. If the install ran but produced a
|
||||
# boot config or UKI that can't actually boot, halt here rather than surprise
|
||||
|
||||
@@ -36,7 +36,6 @@ file_permissions=(
|
||||
["/root/.gnupg"]="0:0:700"
|
||||
["/root/configurator"]="0:0:755"
|
||||
["/usr/local/bin/choose-mirror"]="0:0:755"
|
||||
["/usr/local/bin/omarchy-cidata-load"]="0:0:755"
|
||||
["/usr/local/bin/omarchy-iso-cleanup-disk"]="0:0:755"
|
||||
["/usr/local/bin/omarchy-install-dashboard"]="0:0:755"
|
||||
["/usr/local/bin/omarchy-iso-install"]="0:0:755"
|
||||
|
||||
@@ -3763,6 +3763,7 @@
|
||||
"kservice",
|
||||
"ktextwidgets",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"kwallet",
|
||||
"kwidgetsaddons",
|
||||
"kwindowsystem",
|
||||
@@ -4211,6 +4212,12 @@
|
||||
"qpdf",
|
||||
"qqc2-desktop-style",
|
||||
"qrcodegencpp-cmake",
|
||||
"qt5-base",
|
||||
"qt5-declarative",
|
||||
"qt5-svg",
|
||||
"qt5-translations",
|
||||
"qt5-wayland",
|
||||
"qt5-x11extras",
|
||||
"qt6-5compat",
|
||||
"qt6-base",
|
||||
"qt6-declarative",
|
||||
@@ -4478,7 +4485,7 @@
|
||||
"jq",
|
||||
"kdenlive",
|
||||
"kernel-modules-hook",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"lazydocker",
|
||||
"lazygit",
|
||||
"less",
|
||||
@@ -4524,6 +4531,7 @@
|
||||
"python-poetry-core",
|
||||
"python-terminaltexteffects",
|
||||
"qemu-user-static-binfmt",
|
||||
"qt5-wayland",
|
||||
"quickshell",
|
||||
"ripgrep",
|
||||
"ruby",
|
||||
@@ -4631,7 +4639,7 @@
|
||||
"jq",
|
||||
"kdenlive",
|
||||
"kernel-modules-hook",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"lazydocker",
|
||||
"lazygit",
|
||||
"less",
|
||||
@@ -4677,6 +4685,7 @@
|
||||
"python-poetry-core",
|
||||
"python-terminaltexteffects",
|
||||
"qemu-user-static-binfmt",
|
||||
"qt5-wayland",
|
||||
"quickshell",
|
||||
"ripgrep",
|
||||
"ruby",
|
||||
@@ -5017,6 +5026,7 @@
|
||||
"kservice",
|
||||
"ktextwidgets",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"kwallet",
|
||||
"kwidgetsaddons",
|
||||
"kwindowsystem",
|
||||
@@ -5465,6 +5475,12 @@
|
||||
"qpdf",
|
||||
"qqc2-desktop-style",
|
||||
"qrcodegencpp-cmake",
|
||||
"qt5-base",
|
||||
"qt5-declarative",
|
||||
"qt5-svg",
|
||||
"qt5-translations",
|
||||
"qt5-wayland",
|
||||
"qt5-x11extras",
|
||||
"qt6-5compat",
|
||||
"qt6-base",
|
||||
"qt6-declarative",
|
||||
@@ -5960,6 +5976,7 @@
|
||||
"kservice": "6.26.0-1",
|
||||
"ktextwidgets": "6.26.0-1",
|
||||
"kvantum": "1.1.7-1",
|
||||
"kvantum-qt5": "1.1.7-1",
|
||||
"kwallet": "6.26.0-1",
|
||||
"kwidgetsaddons": "6.26.0-1",
|
||||
"kwindowsystem": "6.26.0-1",
|
||||
@@ -6409,6 +6426,12 @@
|
||||
"qpdf": "12.3.2-2",
|
||||
"qqc2-desktop-style": "6.26.0-1",
|
||||
"qrcodegencpp-cmake": "1.8.0-4",
|
||||
"qt5-base": "5.15.19+kde+r96-1",
|
||||
"qt5-declarative": "5.15.19+kde+r23-1",
|
||||
"qt5-svg": "5.15.19+kde+r5-1",
|
||||
"qt5-translations": "5.15.19-1",
|
||||
"qt5-wayland": "5.15.19+kde+r55-1",
|
||||
"qt5-x11extras": "5.15.19-1",
|
||||
"qt6-5compat": "6.11.1-1",
|
||||
"qt6-base": "6.11.1-1",
|
||||
"qt6-declarative": "6.11.1-2",
|
||||
|
||||
+25
-2
@@ -3016,6 +3016,7 @@
|
||||
"kservice",
|
||||
"ktextwidgets",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"kwallet",
|
||||
"kwidgetsaddons",
|
||||
"kwindowsystem",
|
||||
@@ -3464,6 +3465,12 @@
|
||||
"qpdf",
|
||||
"qqc2-desktop-style",
|
||||
"qrcodegencpp-cmake",
|
||||
"qt5-base",
|
||||
"qt5-declarative",
|
||||
"qt5-svg",
|
||||
"qt5-translations",
|
||||
"qt5-wayland",
|
||||
"qt5-x11extras",
|
||||
"qt6-5compat",
|
||||
"qt6-base",
|
||||
"qt6-declarative",
|
||||
@@ -3731,7 +3738,7 @@
|
||||
"jq",
|
||||
"kdenlive",
|
||||
"kernel-modules-hook",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"lazydocker",
|
||||
"lazygit",
|
||||
"less",
|
||||
@@ -3777,6 +3784,7 @@
|
||||
"python-poetry-core",
|
||||
"python-terminaltexteffects",
|
||||
"qemu-user-static-binfmt",
|
||||
"qt5-wayland",
|
||||
"quickshell",
|
||||
"ripgrep",
|
||||
"ruby",
|
||||
@@ -3884,7 +3892,7 @@
|
||||
"jq",
|
||||
"kdenlive",
|
||||
"kernel-modules-hook",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"lazydocker",
|
||||
"lazygit",
|
||||
"less",
|
||||
@@ -3930,6 +3938,7 @@
|
||||
"python-poetry-core",
|
||||
"python-terminaltexteffects",
|
||||
"qemu-user-static-binfmt",
|
||||
"qt5-wayland",
|
||||
"quickshell",
|
||||
"ripgrep",
|
||||
"ruby",
|
||||
@@ -4270,6 +4279,7 @@
|
||||
"kservice",
|
||||
"ktextwidgets",
|
||||
"kvantum",
|
||||
"kvantum-qt5",
|
||||
"kwallet",
|
||||
"kwidgetsaddons",
|
||||
"kwindowsystem",
|
||||
@@ -4718,6 +4728,12 @@
|
||||
"qpdf",
|
||||
"qqc2-desktop-style",
|
||||
"qrcodegencpp-cmake",
|
||||
"qt5-base",
|
||||
"qt5-declarative",
|
||||
"qt5-svg",
|
||||
"qt5-translations",
|
||||
"qt5-wayland",
|
||||
"qt5-x11extras",
|
||||
"qt6-5compat",
|
||||
"qt6-base",
|
||||
"qt6-declarative",
|
||||
@@ -5213,6 +5229,7 @@
|
||||
"kservice": "6.26.0-1",
|
||||
"ktextwidgets": "6.26.0-1",
|
||||
"kvantum": "1.1.7-1",
|
||||
"kvantum-qt5": "1.1.7-1",
|
||||
"kwallet": "6.26.0-1",
|
||||
"kwidgetsaddons": "6.26.0-1",
|
||||
"kwindowsystem": "6.26.0-1",
|
||||
@@ -5662,6 +5679,12 @@
|
||||
"qpdf": "12.3.2-2",
|
||||
"qqc2-desktop-style": "6.26.0-1",
|
||||
"qrcodegencpp-cmake": "1.8.0-4",
|
||||
"qt5-base": "5.15.19+kde+r96-1",
|
||||
"qt5-declarative": "5.15.19+kde+r23-1",
|
||||
"qt5-svg": "5.15.19+kde+r5-1",
|
||||
"qt5-translations": "5.15.19-1",
|
||||
"qt5-wayland": "5.15.19+kde+r55-1",
|
||||
"qt5-x11extras": "5.15.19-1",
|
||||
"qt6-5compat": "6.11.1-1",
|
||||
"qt6-base": "6.11.1-1",
|
||||
"qt6-declarative": "6.11.1-2",
|
||||
|
||||
@@ -76,9 +76,9 @@ aarch64 has no BIOS — only UEFI. Drop the syslinux path entirely on ARM.
|
||||
|
||||
The cleanest cut: keep one `grub.cfg` shared, strip the x86 shell/memtest fragments at build time when `OMARCHY_ARCH=aarch64`. Don't fork the file.
|
||||
|
||||
### 6. mkinitcpio preset — `configs/airootfs/etc/mkinitcpio.d/linux-t2.preset`
|
||||
### 6. mkinitcpio preset — `configs/airootfs/etc/mkinitcpio.d/linux.preset`
|
||||
|
||||
Names `vmlinuz-linux-t2` and `initramfs-linux-t2.img`. The filename is the pkgbase and the alpm hook keys off it, so aarch64 does not rename this file — it simply does not ship it, and releng's own `linux.preset` covers the stock kernel. Drop `linux-t2` from `arch_packages` on aarch64 and the boot entries point at `vmlinuz-linux` / `initramfs-linux.img`.
|
||||
References `vmlinuz-linux-t2` and `initramfs-linux-t2.img` (lines 5, 8). For aarch64, swap to `vmlinuz-linux` / `initramfs-linux.img`. Generate the file at build time from a template, keyed on arch.
|
||||
|
||||
### 7. Configurator — `configs/airootfs/root/configurator`
|
||||
|
||||
@@ -145,7 +145,7 @@ Code:
|
||||
- `configs/efiboot/loader/loader.conf` — per-arch default entry
|
||||
- `configs/efiboot/loader/entries/01-archiso-x86_64-linux.conf` — generate aarch64 sibling at build time
|
||||
- `configs/grub/grub.cfg`, `loopback.cfg` — strip x86-only fragments on aarch64
|
||||
- `configs/airootfs/etc/mkinitcpio.d/linux-t2.preset` — omit on aarch64 (drop linux-t2 there; releng's linux.preset covers the stock kernel)
|
||||
- `configs/airootfs/etc/mkinitcpio.d/linux.preset` — template by arch (drop linux-t2 on aarch64)
|
||||
- `configs/airootfs/root/configurator` — branch archinstall JSON mirror list on `uname -m`; optionally guard lspci T2 probe
|
||||
- `.github/workflows/nightly-build.yml` — matrix x86_64/aarch64
|
||||
|
||||
|
||||
@@ -1,187 +0,0 @@
|
||||
# Autoinstall Plan
|
||||
|
||||
## Goal
|
||||
|
||||
Let the standard Omarchy ISO install itself with no keyboard present, driven by config files handed to the VM on a second drive. This makes Omarchy usable as a Packer/Proxmox base image for disposable dev environments: create VM, boot, walk away, SSH in.
|
||||
|
||||
## Product Requirements
|
||||
|
||||
- No ISO rebuild. The shipped ISO autoinstalls when config is present and runs the configurator when it is not.
|
||||
- No new menu entry, no new boot parameter, no separate ISO flavor.
|
||||
- Config format is exactly what the configurator already writes — no second schema to maintain.
|
||||
- The installed machine is reachable over SSH with a key supplied at install time.
|
||||
- Interactive installs behave identically to today.
|
||||
|
||||
---
|
||||
|
||||
## Chosen Architecture
|
||||
|
||||
### Trigger: config presence, not a mode flag
|
||||
|
||||
The installer looks for a drive labeled `cidata` at startup. If it is there and carries the configurator's output files, those files are copied into `/root` and `./configurator` is skipped — the rest of the install runs the ordinary path against ordinary inputs. If it is not there, nothing changes.
|
||||
|
||||
This is Ryan Hughes' suggestion from PR #72 and it is what keeps the diff small: the install pipeline can be rewritten freely as long as it keeps reading its five files out of `/root`, and autoinstall follows along for free.
|
||||
|
||||
`cidata` is the cloud-init `NoCloud` label, so Proxmox, libvirt, and Packer all already know how to attach one.
|
||||
|
||||
### What the ISO already does for us
|
||||
|
||||
One thing that would otherwise need building is already true on a stock install: `NetworkManager.service` is enabled and active with DHCP by default, so autoinstall needs no `systemd-networkd` unit — one would contend with NetworkManager.
|
||||
|
||||
Remote access needs three things, all verified against a real install rather than inferred:
|
||||
|
||||
- `authorized_keys` for the user.
|
||||
- `systemctl enable sshd.service`. Omarchy ships `openssh` but leaves the service disabled.
|
||||
- `ufw allow ssh`. `install/config/firewall.sh` opens LocalSend (53317) and docker DNS and nothing else, and ufw runs default-deny incoming.
|
||||
|
||||
Still no loosening of `PasswordAuthentication` — key auth only.
|
||||
|
||||
Do not take `manifests/fresh-4-semantic.json` as the authority on any of this. It claims `sshd.service: enabled` and carries an `allow tcp 22` ufw rule; a real install of this ISO has neither. It is a snapshot of one machine's state, not a contract about stock behavior, and trusting it cost two test cycles.
|
||||
|
||||
### Non-interactivity belongs to the dashboard
|
||||
|
||||
`omarchy-install-dashboard` owns every prompt that survives to the end of an install: the reboot confirm and, on failure, the action menu. Both are `gum` calls reading from the TTY, and both hang forever on a headless VM. Autoinstall therefore sets one env var that the dashboard reads, rather than patching prompts out of scripts after the fact — which is what PR #72 did to `finished.sh`, and what everyone correctly disliked.
|
||||
|
||||
---
|
||||
|
||||
## Non-Goals
|
||||
|
||||
- No config generator, validator, or schema doc. The configurator is the source of truth for the format; users copy its output.
|
||||
- No secret management. Whoever builds the `cidata` drive owns the password hash and the public key on it.
|
||||
- No PXE, no network-fetched config, no cloud-init compatibility beyond reusing the drive label.
|
||||
- No changes to disk selection, encryption, or any install phase behavior.
|
||||
|
||||
---
|
||||
|
||||
## Repo Implementation Plan
|
||||
|
||||
## 1) Detect the cidata drive and skip the configurator
|
||||
|
||||
### Files
|
||||
- `configs/airootfs/usr/local/bin/omarchy-cidata-load`
|
||||
- `configs/airootfs/root/.automated_script.sh`
|
||||
- `configs/profiledef.sh`
|
||||
|
||||
### Changes
|
||||
- Add `omarchy-cidata-load` alongside the other install commands in `/usr/local/bin` (with the matching `file_permissions` entry in `profiledef.sh`). It exits 0 when an autoinstall drive was loaded:
|
||||
- `udevadm settle` first: the by-label symlinks come from udev, and probing before enumeration finishes would silently drop a headless install into the wizard.
|
||||
- Look for `/dev/disk/by-label/cidata` then `/dev/disk/by-label/CIDATA`; exit non-zero if neither exists.
|
||||
- Mount read-only on a temp mountpoint; exit non-zero if the mount fails.
|
||||
- Require both `user_configuration.json` and `user_credentials.json` on the drive — this is the same pair `InstallContext.from_env` treats as mandatory. Missing either means the drive is not an autoinstall drive; unmount and exit non-zero.
|
||||
- Copy the required pair plus, when present, `user_full_name.txt`, `user_email_address.txt`, `user_encrypt_installation.txt`, and `authorized_keys` into `/root` with a single `cp`, and exit non-zero if the copy fails — a "loaded" drive with missing inputs would fail the install later with a worse error.
|
||||
- Unmount before exiting. Leave nothing mounted for the install to trip over.
|
||||
- The script takes an optional path prefix so the unit tests can point it at a sandbox; production callers pass nothing.
|
||||
- Replace the bare `./configurator` call in `.automated_script.sh` with: run `omarchy-cidata-load`; on success export `OMARCHY_UI_INTERACTIVE=no`, on failure run `./configurator`.
|
||||
- Pass `--authorized-keys-file /root/authorized_keys` to `omarchy-iso-install` in the dashboard invocation, alongside the existing five flags. Always pass it; the orchestrator no-ops when the file is absent, which keeps the interactive path on the identical command line.
|
||||
|
||||
### Notes
|
||||
- The three text files are optional by construction: `_read_text` in `context.py` returns `""` for a missing path and `encrypt` falls back to false. Do not add stricter checks here than the orchestrator itself applies.
|
||||
- `omarchy-cidata-load` must not run before `warm_offline_mirror` is backgrounded — the mirror warm should keep its head start.
|
||||
|
||||
### Acceptance criteria
|
||||
- ISO with no `cidata` drive attached: configurator runs, byte-identical UX to today.
|
||||
- ISO with a `cidata` drive carrying the five files: configurator never appears; install starts within seconds of boot.
|
||||
- ISO with a drive labeled `cidata` that is empty or carries only one of the two required files: falls back to the configurator rather than failing the boot.
|
||||
- Nothing remains mounted from `/dev/disk/by-label/cidata` once the install begins.
|
||||
|
||||
---
|
||||
|
||||
## 2) Non-interactive dashboard
|
||||
|
||||
### File
|
||||
- `configs/airootfs/usr/local/bin/omarchy-install-dashboard`
|
||||
|
||||
### Changes
|
||||
- Read `OMARCHY_UI_INTERACTIVE` once near the other env reads at the top.
|
||||
- In `reboot_prompt()` (`:474`): when non-interactive, return 0 immediately instead of calling `gum confirm`. The existing `OMARCHY_UI_AUTO_REBOOT=no` check at `:737` stays in front of the actual `reboot`, so a debug run can set both and stop on the finish screen without a keyboard.
|
||||
- In `failure_menu()` (`:597`): treat non-interactive as equivalent to the existing `OMARCHY_UI_FAILURE_ACTION=exit` early return (`:600`), so a failed autoinstall exits with the installer's status instead of blocking on `gum choose` forever. The failure screen and log tail still render, and the serial console still captures them.
|
||||
|
||||
### Why here and not in the caller
|
||||
The dashboard is the only process that owns the visible UI. Suppressing its prompts anywhere else means editing scripts it invokes — the `finished.sh` `sed` from PR #72 — which breaks the moment those scripts move.
|
||||
|
||||
### Acceptance criteria
|
||||
- Autoinstall run reaches the finish screen and reboots with no input.
|
||||
- Autoinstall run whose install fails renders the failure screen, exits non-zero, and does not hang.
|
||||
- Interactive run still prompts for reboot and still offers the failure menu.
|
||||
- `OMARCHY_UI_INTERACTIVE=no` plus `OMARCHY_UI_AUTO_REBOOT=no` stops at the finish screen without prompting.
|
||||
|
||||
---
|
||||
|
||||
## 3) SSH keys as an orchestrator phase
|
||||
|
||||
### Files
|
||||
- `configs/airootfs/usr/local/bin/omarchy-iso-install`
|
||||
- `configs/airootfs/usr/share/omarchy-iso/orchestrator/context.py`
|
||||
- `configs/airootfs/usr/share/omarchy-iso/orchestrator/main.py`
|
||||
- `configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py`
|
||||
|
||||
### Changes
|
||||
- `omarchy-iso-install`: add `--authorized-keys-file` to the arg loop, exporting `OMARCHY_INSTALL_AUTHORIZED_KEYS_FILE`. Same shape as the five existing flags, ahead of the `unknown arg` catch-all (`:19`).
|
||||
- `context.py`: add an `authorized_keys_path: Path | None` field populated from that variable in `from_env`, `None` when unset or when the file does not exist.
|
||||
- `phases_impl.py`: add `configure_ssh_access(ctx)`:
|
||||
- Return immediately when `ctx.authorized_keys_path` is `None`.
|
||||
- Read the file as sshd's own authorized_keys format, dropping blank lines and # comments; write the keys one per line to `<target>/home/<user>/.ssh/authorized_keys`.
|
||||
- `.ssh` at `0700`, `authorized_keys` at `0600`, both owned by the user via `arch-chroot <target> chown -R <user>:<user>`. Do not hardcode uid 1000 as PR #72 did — ask the target for it.
|
||||
- `arch-chroot <target> systemctl enable sshd.service`. Works cleanly in the chroot.
|
||||
- `arch-chroot <target> ufw allow ssh`. This one exits **non-zero** in a chroot (`ERROR: problem running`) because ufw cannot reach netfilter, but it writes the rule to `/etc/ufw/user.rules` before failing, and that file is what `ufw.service` loads on first boot. So ignore the exit status and assert the rule landed in the file instead. No ufw-presence check: ufw is part of Omarchy's default package set, and the rule assertion already fails loudly if it is somehow missing.
|
||||
- An `authorized_keys` with no usable keys must fail the phase loudly. A machine that installs "successfully" and is then unreachable is worse than one that stops with an error on screen.
|
||||
- `main.py`: register `("Configuring SSH access", configure_ssh_access)` in `build_phases` after `configure_login` (`:52`) and before `validate_boot`.
|
||||
|
||||
### Model to follow
|
||||
`configure_login` (`phases_impl.py:1251`) — direct writes against `ctx.target`, `arch-chroot` reserved for ownership and `systemctl`. Match its structure.
|
||||
|
||||
### Acceptance criteria
|
||||
- Install with `authorized_keys`: `ssh <user>@<vm>` works with the corresponding private key on first boot, no password.
|
||||
- Install without `authorized_keys`: phase runs, does nothing, install unaffected; `~/.ssh` is not created.
|
||||
- `authorized_keys` is `0600` and owned by the install user, not root.
|
||||
- Port 22 is open in ufw on the installed system. Test this by connecting, not by reading the phase log — the rule is written from a chroot that cannot verify it.
|
||||
- Password SSH auth is left at the distro default — autoinstall does not enable it.
|
||||
- Interactive installs are unaffected: the flag is passed but the file never exists.
|
||||
|
||||
---
|
||||
|
||||
## 4) Documentation
|
||||
|
||||
### File
|
||||
- `README.md`
|
||||
|
||||
### Changes
|
||||
- New "Autoinstall" section covering: what the `cidata` drive is, the file table, how to produce the drive, and a Proxmox `qm create` example with disk-first boot order so the empty disk falls through to the ISO on the first boot and boots the installed system afterward.
|
||||
- Show `openssl passwd -6` for the credential hash and the `authorized_keys` format.
|
||||
- State plainly that the config files are the configurator's own output — the documented way to get a starting `user_configuration.json` is to run one interactive install and copy what it wrote.
|
||||
- Do not repeat PR #72's networking claims. NetworkManager comes enabled with DHCP on a stock install; sshd ships disabled, which is why the SSH phase exists.
|
||||
|
||||
---
|
||||
|
||||
## 5) Validation
|
||||
|
||||
### Unit tests
|
||||
`./test/all` runs everything under `test/`: `cidata-load-test.sh` exercises `omarchy-cidata-load` against a sandbox with `mount`/`umount`/`udevadm` stubbed, and `test_configure_ssh_access.py` runs the orchestrator phase against a temp target with `subprocess.run` recorded and ufw's write-the-rule-then-fail chroot behavior simulated. The Python tests run through `unittest` discovery alongside the repo's existing `test_*.py` suites.
|
||||
|
||||
### Manual matrix
|
||||
1. Build the ISO from this branch.
|
||||
2. Interactive control run: boot with no `cidata` drive, install normally, confirm nothing changed.
|
||||
3. Autoinstall run on Proxmox: attach ISO + `cidata` drive, boot, no input; confirm the configurator never renders, the install completes, the machine reboots on its own, and SSH with the key works against the booted system.
|
||||
4. Encrypted autoinstall: `user_encrypt_installation.txt` set true; confirm the LUKS prompt appears on boot (this is the one autoinstall case that still needs a human at first boot — document it).
|
||||
5. Full Packer cycle: build, destroy, rebuild from the same `cidata` drive; confirm reproducibility.
|
||||
|
||||
### Negative tests
|
||||
- Drive labeled `cidata` with no files → configurator runs.
|
||||
- Drive with `user_configuration.json` only → configurator runs.
|
||||
- An `authorized_keys` with no usable keys → install stops in the remote-access phase with a visible error, does not reboot into an unreachable machine.
|
||||
- Install failure under autoinstall (e.g. a disk target that does not exist) → failure screen renders, process exits non-zero, no hang.
|
||||
|
||||
### Regression surface
|
||||
The interactive path shares every line of this change except the `omarchy-cidata-load` branch, so run the standard acceptance harness (`./bin/omarchy-iso-test`) on the built ISO before proposing the PR.
|
||||
|
||||
---
|
||||
|
||||
## Relationship to PR #72
|
||||
|
||||
PR #72 targeted the pre-`quattro` tree and cannot be rebased: `use_omarchy_helpers`, `run_configurator`, `install_arch`, `install_omarchy`, and `chroot_bash` no longer exist. This plan reimplements the same feature against the current tree and drops three things that PR deliberately flagged as questionable:
|
||||
|
||||
- The `finished.sh` `sed` — replaced by section 2. The dashboard renders the reboot prompt now.
|
||||
- The `systemd-networkd` DHCP unit — unnecessary; NetworkManager is already enabled and would contend with it.
|
||||
- The `PasswordAuthentication yes` rewrite — unnecessary and a security downgrade.
|
||||
|
||||
`load_cidata` is the one piece that carries over close to intact. PR #72's `ufw allow ssh` also carries over: it was dropped from the first draft of this plan on the reasoning that an enabled sshd is a reachable sshd, and a test install proved otherwise. That PR was right to include it.
|
||||
@@ -1,124 +0,0 @@
|
||||
# Tailscale Autoinstall Plan
|
||||
|
||||
## Goal
|
||||
|
||||
Let an autoinstall drive carry a Tailscale auth key so the installed machine
|
||||
joins the tailnet on its own. Combined with `authorized_keys`, this completes
|
||||
the disposable-VM story: create VM, boot, walk away, `ssh user@machine` over
|
||||
the tailnet from anywhere — no LAN discovery, no port forwarding.
|
||||
|
||||
## Product Requirements
|
||||
|
||||
- Same trigger philosophy as the rest of autoinstall: presence of a
|
||||
`tailscale_authkey` file on the `cidata` drive, no new mode flag. No file,
|
||||
no change — byte-identical behavior to today.
|
||||
- The join happens when the network is available, not when the installer runs.
|
||||
- No package installs from the network on first boot.
|
||||
- The auth key does not persist on the installed system after a successful join.
|
||||
|
||||
---
|
||||
|
||||
## Chosen Architecture
|
||||
|
||||
### The package is bundled, not fetched
|
||||
|
||||
The `tailscale` package rides in the offline mirror (~10MB on the ISO) and is
|
||||
installed during the ordinary package phase — but only when the auth key file
|
||||
is present, so a stock install stays stock.
|
||||
|
||||
The alternative — installing from the network on first boot — was rejected
|
||||
outright. A bare `pacman -Sy tailscale` on a fresh machine is a partial
|
||||
upgrade waiting to corrupt something, and the "correct" version, `pacman -Syu
|
||||
tailscale`, means an unattended full system upgrade racing the user's first
|
||||
login (potentially swapping the kernel out on a machine that has booted once).
|
||||
It would also fight Omarchy's own update flow and make the join depend on
|
||||
mirror availability. The offline mirror is a coherent snapshot; installing
|
||||
from it keeps the target consistent and the install deterministic and
|
||||
offline-capable.
|
||||
|
||||
### The join is a first-boot unit, not an install step
|
||||
|
||||
`tailscale up` needs a running tailscaled, and there is no systemd in the
|
||||
chroot. So the installer only stages: the key at `/etc/tailscale/authkey`
|
||||
(root, `0600`), `tailscaled.service` enabled, and an
|
||||
`omarchy-tailscale-join.service` that runs `tailscale up --auth-key
|
||||
file:/etc/tailscale/authkey` on first boot.
|
||||
|
||||
"When the network is available" lives in the unit, not the installer:
|
||||
`After=network-online.target` for ordering, plus an in-unit retry loop
|
||||
(`until tailscale up …; do sleep 15; done`), because network-online can be
|
||||
reached before there is real connectivity.
|
||||
|
||||
The unit is `Type=simple`, not oneshot, and that is load-bearing: target
|
||||
units implicitly gain `After=` for their `Wants=`, so a oneshot wanted by
|
||||
`multi-user.target` holds the whole boot — SDDM included — hostage until the
|
||||
join finishes or times out, and once timed out it never retries within that
|
||||
boot. (Caught by review.) Type=simple counts as started the moment it forks:
|
||||
boot proceeds normally while the join retries in the background for as long
|
||||
as the boot lasts.
|
||||
|
||||
Cleanup is sequenced inside the script, after `tailscale up` succeeds — the
|
||||
key is removed and the unit disables itself, so the key never outlives the
|
||||
join and the unit never runs again. On a boot that never gets connectivity
|
||||
both survive (`ConditionPathExists` gates re-runs on the key), so a machine
|
||||
installed offline joins on the first boot that can.
|
||||
|
||||
The machine appears on the tailnet under the hostname from
|
||||
`user_configuration.json` — nothing extra to configure.
|
||||
|
||||
### Firewall
|
||||
|
||||
`ufw allow in on tailscale0`, the same write-the-rule-then-ignore-the-chroot-
|
||||
exit-code dance as `configure_ssh_access` (ufw cannot reach netfilter in a
|
||||
chroot but records the rule in `user.rules`, which is what first boot loads).
|
||||
Without it the node joins and is then unreachable over the tailnet — worse
|
||||
than not joining.
|
||||
|
||||
### Secrets
|
||||
|
||||
Same stance the autoinstall plan takes for the LUKS passphrase: whoever
|
||||
builds the `cidata` drive owns the key on it. Docs recommend a reusable,
|
||||
pre-authorized (tagged) key so one drive image serves N machines, and note
|
||||
that ephemeral keys fit disposable VMs. No validation of the key beyond
|
||||
"exactly one non-comment line" — Tailscale key formats are theirs to change.
|
||||
|
||||
---
|
||||
|
||||
## Implementation
|
||||
|
||||
- `builder/archinstall.packages`: add `tailscale` so it lands in the offline
|
||||
mirror on every build.
|
||||
- `omarchy-cidata-load`: add `tailscale_authkey` to the optional copy list.
|
||||
- `.automated_script.sh`: pass `--tailscale-authkey-file /root/tailscale_authkey`
|
||||
(always; the orchestrator no-ops when the file is absent, like
|
||||
`--authorized-keys-file`).
|
||||
- `omarchy-iso-install`: parse the flag into
|
||||
`OMARCHY_INSTALL_TAILSCALE_AUTHKEY_FILE`.
|
||||
- `context.py`: `tailscale_authkey_path: Path | None` via `_optional_path`.
|
||||
- `phases_impl.py`:
|
||||
- `arch_install_system`: when the key is present, add `tailscale` to the
|
||||
additional packages while the offline mirror is still bind-mounted.
|
||||
- `configure_tailscale(ctx)`: no-op when the path is `None`; otherwise
|
||||
stage key + unit, enable services, open ufw. Fails loudly on an empty or
|
||||
ambiguous key file and when the tailscale binary is missing from the
|
||||
target (an ISO built before the package was bundled).
|
||||
- `main.py`: register `("Configuring Tailscale", configure_tailscale)` after
|
||||
`configure_ssh_access`.
|
||||
- `README.md`: file-table row + a Tailscale paragraph in the Autoinstall
|
||||
section.
|
||||
- Tests: `tailscale_authkey` cases in `cidata-load-test.sh`;
|
||||
`test_configure_tailscale.py` mirroring the SSH phase tests.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Drive with `tailscale_authkey`: machine appears on the tailnet under its
|
||||
configured hostname after first boot with network; `/etc/tailscale/authkey`
|
||||
is gone; `omarchy-tailscale-join.service` is disabled.
|
||||
- First boot without network: no failure surfaced to the user; the join
|
||||
happens on the first boot that has connectivity.
|
||||
- Drive without the file: no tailscale package on the target, no unit, no
|
||||
ufw rule — indistinguishable from today.
|
||||
- Empty or multi-line key file: install stops in the Tailscale phase with a
|
||||
visible error.
|
||||
- Interactive installs: unaffected; the flag is passed but the file never
|
||||
exists.
|
||||
Whitespace-only changes.
@@ -1,13 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
|
||||
|
||||
for test in "$ROOT"/test/*-test.sh; do
|
||||
printf '==> %s\n' "${test#$ROOT/}"
|
||||
bash "$test"
|
||||
done
|
||||
|
||||
printf '==> test/test_*.py\n'
|
||||
python3 -m unittest discover -t "$ROOT" -s "$ROOT/test"
|
||||
@@ -1,172 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Unit tests for omarchy-cidata-load. The script takes a path prefix, so every
|
||||
# case runs against a throwaway sandbox with mount/umount/udevadm stubbed out:
|
||||
# "mounting" copies the fake drive's contents into the mountpoint, and every
|
||||
# stub logs its invocation so the cases can assert what was (not) called.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
|
||||
CIDATA_LOAD="$ROOT/configs/airootfs/usr/local/bin/omarchy-cidata-load"
|
||||
|
||||
pass() {
|
||||
printf 'ok - %s\n' "$1"
|
||||
}
|
||||
|
||||
fail() {
|
||||
local description="$1"
|
||||
local detail="${2:-}"
|
||||
|
||||
[[ -n $detail ]] && printf '%s\n' "$detail" >&2
|
||||
printf 'not ok - %s\n' "$description" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
work=$(mktemp -d)
|
||||
trap 'chmod -R u+w "$work"; rm -rf "$work"' EXIT
|
||||
|
||||
stub_dir="$work/stubs"
|
||||
mkdir -p "$stub_dir"
|
||||
|
||||
cat >"$stub_dir/udevadm" <<'STUB'
|
||||
#!/bin/bash
|
||||
printf 'udevadm %s\n' "$*" >>"$TEST_LOG"
|
||||
STUB
|
||||
|
||||
cat >"$stub_dir/mount" <<'STUB'
|
||||
#!/bin/bash
|
||||
printf 'mount %s\n' "$*" >>"$TEST_LOG"
|
||||
[[ ${MOUNT_FAIL:-} == 1 ]] && exit 32
|
||||
device=$3 mountpoint=$4
|
||||
cp -a "$(readlink -f "$device")"/. "$mountpoint"/
|
||||
STUB
|
||||
|
||||
cat >"$stub_dir/umount" <<'STUB'
|
||||
#!/bin/bash
|
||||
printf 'umount %s\n' "$*" >>"$TEST_LOG"
|
||||
STUB
|
||||
|
||||
chmod +x "$stub_dir"/*
|
||||
|
||||
new_sandbox() {
|
||||
sandbox=$(mktemp -d "$work/sandbox.XXXXXX")
|
||||
mkdir -p "$sandbox/dev/disk/by-label" "$sandbox/root" "$sandbox/media"
|
||||
export TEST_LOG="$sandbox/calls.log"
|
||||
: >"$TEST_LOG"
|
||||
}
|
||||
|
||||
attach_drive() {
|
||||
ln -s "$sandbox/media" "$sandbox/dev/disk/by-label/$1"
|
||||
}
|
||||
|
||||
run_load() {
|
||||
PATH="$stub_dir:$PATH" "$CIDATA_LOAD" "$sandbox"
|
||||
}
|
||||
|
||||
write_required_pair() {
|
||||
echo '{"disk_config": {}}' >"$sandbox/media/user_configuration.json"
|
||||
echo '{"users": []}' >"$sandbox/media/user_credentials.json"
|
||||
}
|
||||
|
||||
# No cidata drive attached: fall back to the wizard without mounting anything.
|
||||
new_sandbox
|
||||
! run_load || fail "no drive exits non-zero"
|
||||
! grep -q '^mount ' "$TEST_LOG" || fail "no drive mounts nothing"
|
||||
pass "no drive falls back to the wizard"
|
||||
|
||||
# The probe must wait for udev to finish enumerating before concluding there
|
||||
# is no drive.
|
||||
grep -q '^udevadm settle$' "$TEST_LOG" || fail "probe settles udev first"
|
||||
pass "probe settles udev first"
|
||||
|
||||
# A drive with the full file set: everything lands in /root and the drive is
|
||||
# unmounted afterwards.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
echo "Jeff" >"$sandbox/media/user_full_name.txt"
|
||||
echo "jeff@example.com" >"$sandbox/media/user_email_address.txt"
|
||||
echo "false" >"$sandbox/media/user_encrypt_installation.txt"
|
||||
echo 'ssh-ed25519 AAAA jeff@host' >"$sandbox/media/authorized_keys"
|
||||
echo 'tskey-auth-kFAKEKEY' >"$sandbox/media/tailscale_authkey"
|
||||
run_load || fail "full file set loads"
|
||||
for file in user_configuration.json user_credentials.json user_full_name.txt user_email_address.txt user_encrypt_installation.txt authorized_keys tailscale_authkey; do
|
||||
[[ -f $sandbox/root/$file ]] || fail "full file set copies $file"
|
||||
done
|
||||
grep -q '^umount ' "$TEST_LOG" || fail "full file set unmounts the drive"
|
||||
pass "full file set loads, copies everything, and unmounts"
|
||||
|
||||
# The uppercase label variant some tools produce works too.
|
||||
new_sandbox
|
||||
attach_drive CIDATA
|
||||
write_required_pair
|
||||
run_load || fail "uppercase CIDATA label loads"
|
||||
pass "uppercase CIDATA label loads"
|
||||
|
||||
# The required pair alone is a valid autoinstall drive; the optional files
|
||||
# stay optional.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
run_load || fail "required pair alone loads"
|
||||
[[ ! -e $sandbox/root/authorized_keys ]] || fail "required pair alone copies no optional files"
|
||||
pass "required pair alone loads without optional files"
|
||||
|
||||
# Optional files are copied individually when present.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
echo 'ssh-ed25519 AAAA jeff@host' >"$sandbox/media/authorized_keys"
|
||||
run_load || fail "required pair plus authorized_keys loads"
|
||||
[[ -f $sandbox/root/authorized_keys ]] || fail "authorized_keys is copied when present"
|
||||
[[ ! -e $sandbox/root/user_full_name.txt ]] || fail "absent optional files are not copied"
|
||||
[[ ! -e $sandbox/root/tailscale_authkey ]] || fail "absent tailscale_authkey is not copied"
|
||||
pass "present optional files are copied, absent ones skipped"
|
||||
|
||||
# Half the required pair is not an autoinstall drive: unmount and fall back.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
echo '{"disk_config": {}}' >"$sandbox/media/user_configuration.json"
|
||||
! run_load || fail "half the required pair exits non-zero"
|
||||
[[ ! -e $sandbox/root/user_configuration.json ]] || fail "half the required pair copies nothing"
|
||||
grep -q '^umount ' "$TEST_LOG" || fail "half the required pair still unmounts"
|
||||
pass "half the required pair falls back and unmounts"
|
||||
|
||||
# An empty drive labeled cidata is not an autoinstall drive either.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
! run_load || fail "empty drive exits non-zero"
|
||||
grep -q '^umount ' "$TEST_LOG" || fail "empty drive still unmounts"
|
||||
pass "empty drive falls back and unmounts"
|
||||
|
||||
# A drive that will not mount falls back rather than failing the boot.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
! MOUNT_FAIL=1 run_load || fail "mount failure exits non-zero"
|
||||
! grep -q '^umount ' "$TEST_LOG" || fail "mount failure has nothing to unmount"
|
||||
pass "mount failure falls back to the wizard"
|
||||
|
||||
# A copy failure must not report a loaded drive: the install would start with
|
||||
# missing inputs. Fall back and let the wizard produce them instead.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
chmod 555 "$sandbox/root"
|
||||
! run_load 2>/dev/null || fail "copy failure exits non-zero"
|
||||
grep -q '^umount ' "$TEST_LOG" || fail "copy failure still unmounts"
|
||||
pass "copy failure falls back and unmounts"
|
||||
|
||||
# A partial copy must clean up after itself: the wizard removes only what it
|
||||
# writes, so anything the loader left behind would leak into the interactive
|
||||
# install that follows.
|
||||
new_sandbox
|
||||
attach_drive cidata
|
||||
write_required_pair
|
||||
echo 'ssh-ed25519 AAAA jeff@host' >"$sandbox/media/authorized_keys"
|
||||
mkdir "$sandbox/root/user_credentials.json"
|
||||
! run_load 2>/dev/null || fail "partial copy exits non-zero"
|
||||
[[ ! -e $sandbox/root/user_configuration.json ]] || fail "partial copy removes what it copied"
|
||||
[[ ! -e $sandbox/root/authorized_keys ]] || fail "partial copy leaves no authorized_keys behind"
|
||||
pass "partial copy cleans up what it copied"
|
||||
@@ -1,153 +0,0 @@
|
||||
"""Unit tests for the orchestrator's configure_ssh_access phase.
|
||||
|
||||
The phase touches the target only through the filesystem and arch-chroot, so
|
||||
the tests run it against a temp directory with subprocess.run recorded and the
|
||||
ufw side effect (writing user.rules) simulated by the fake.
|
||||
"""
|
||||
|
||||
import stat
|
||||
import sys
|
||||
import tempfile
|
||||
import types
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
from subprocess import CompletedProcess
|
||||
from unittest import mock
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "configs/airootfs/usr/share/omarchy-iso"))
|
||||
|
||||
# phases_impl imports the archinstall adapter at module scope, which pulls in
|
||||
# the archinstall library that only exists on the live ISO. configure_ssh_access
|
||||
# never touches it, so stub the adapter out before the import.
|
||||
sys.modules["orchestrator.archinstall_adapter"] = types.ModuleType("orchestrator.archinstall_adapter")
|
||||
|
||||
from orchestrator import phases_impl # noqa: E402
|
||||
|
||||
UFW_RULE = "-A ufw-user-input -p tcp --dport 22 -j ACCEPT\n"
|
||||
|
||||
|
||||
class ConfigureSshAccessTest(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.tmp = tempfile.TemporaryDirectory()
|
||||
self.addCleanup(self.tmp.cleanup)
|
||||
self.target = Path(self.tmp.name)
|
||||
self.calls = []
|
||||
|
||||
info_patch = mock.patch.object(phases_impl, "info")
|
||||
info_patch.start()
|
||||
self.addCleanup(info_patch.stop)
|
||||
|
||||
run_patch = mock.patch.object(phases_impl.subprocess, "run", side_effect=self.fake_run)
|
||||
run_patch.start()
|
||||
self.addCleanup(run_patch.stop)
|
||||
|
||||
self.ufw_writes_rule = True
|
||||
|
||||
def fake_run(self, cmd, **kwargs):
|
||||
self.calls.append(cmd)
|
||||
if cmd[2] == "ufw":
|
||||
if self.ufw_writes_rule:
|
||||
rules = self.target / "etc" / "ufw" / "user.rules"
|
||||
rules.parent.mkdir(parents=True, exist_ok=True)
|
||||
rules.write_text(UFW_RULE)
|
||||
# ufw cannot reach netfilter inside a chroot and exits non-zero
|
||||
# even when it recorded the rule; the phase must not trust this.
|
||||
return CompletedProcess(cmd, 1)
|
||||
return CompletedProcess(cmd, 0)
|
||||
|
||||
def ctx(self, authorized_keys=None):
|
||||
authorized_keys_path = None
|
||||
if authorized_keys is not None:
|
||||
authorized_keys_path = self.target / "authorized_keys"
|
||||
authorized_keys_path.write_text(authorized_keys)
|
||||
return types.SimpleNamespace(target=self.target, username="jeff", authorized_keys_path=authorized_keys_path)
|
||||
|
||||
def configure(self, **kwargs):
|
||||
phases_impl.configure_ssh_access(self.ctx(**kwargs))
|
||||
|
||||
def authorized_keys(self):
|
||||
return self.target / "home" / "jeff" / ".ssh" / "authorized_keys"
|
||||
|
||||
def chrooted(self, program):
|
||||
return [cmd for cmd in self.calls if cmd[:2] == ["arch-chroot", str(self.target)] and cmd[2] == program]
|
||||
|
||||
def test_no_authorized_keys_is_a_no_op(self):
|
||||
self.configure()
|
||||
self.assertEqual(self.calls, [])
|
||||
self.assertFalse((self.target / "home" / "jeff" / ".ssh").exists())
|
||||
|
||||
def test_installs_keys_one_per_line(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\nssh-rsa BBBB jeff@work\n")
|
||||
self.assertEqual(self.authorized_keys().read_text(), "ssh-ed25519 AAAA jeff@host\nssh-rsa BBBB jeff@work\n")
|
||||
|
||||
def test_drops_blank_lines_and_comments(self):
|
||||
self.configure(authorized_keys="# work laptop\n\n ssh-ed25519 AAAA jeff@host \n")
|
||||
self.assertEqual(self.authorized_keys().read_text(), "ssh-ed25519 AAAA jeff@host\n")
|
||||
|
||||
def test_keys_with_options_pass_through(self):
|
||||
key = 'command="/usr/bin/true",no-pty ssh-ed25519 AAAA jeff@host'
|
||||
self.configure(authorized_keys=f"{key}\n")
|
||||
self.assertEqual(self.authorized_keys().read_text(), f"{key}\n")
|
||||
|
||||
def test_ssh_dir_is_private(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
mode = stat.S_IMODE((self.target / "home" / "jeff" / ".ssh").stat().st_mode)
|
||||
self.assertEqual(mode, 0o700)
|
||||
|
||||
def test_authorized_keys_is_private(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
self.assertEqual(stat.S_IMODE(self.authorized_keys().stat().st_mode), 0o600)
|
||||
|
||||
def test_chowns_ssh_dir_to_the_user(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
self.assertEqual(self.chrooted("chown"), [
|
||||
["arch-chroot", str(self.target), "chown", "-R", "jeff:jeff", "/home/jeff/.ssh"],
|
||||
])
|
||||
|
||||
def test_enables_sshd(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
self.assertEqual(self.chrooted("systemctl"), [
|
||||
["arch-chroot", str(self.target), "systemctl", "enable", "sshd.service"],
|
||||
])
|
||||
|
||||
def test_allows_ssh_through_ufw_despite_chroot_exit_status(self):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
self.assertEqual(self.chrooted("ufw"), [
|
||||
["arch-chroot", str(self.target), "ufw", "allow", "ssh"],
|
||||
])
|
||||
|
||||
def test_fails_when_ufw_does_not_record_the_rule(self):
|
||||
self.ufw_writes_rule = False
|
||||
with self.assertRaisesRegex(RuntimeError, "allow rule for port 22"):
|
||||
self.configure(authorized_keys="ssh-ed25519 AAAA jeff@host\n")
|
||||
|
||||
def test_empty_file_fails_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "contains no SSH keys"):
|
||||
self.configure(authorized_keys="")
|
||||
|
||||
def test_blank_only_file_fails_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "contains no SSH keys"):
|
||||
self.configure(authorized_keys="\n \n")
|
||||
|
||||
def test_comment_only_file_fails_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "contains no SSH keys"):
|
||||
self.configure(authorized_keys="# no keys here\n")
|
||||
|
||||
|
||||
class OptionalPathTest(unittest.TestCase):
|
||||
def test_unset_and_missing_paths_are_none(self):
|
||||
from orchestrator.context import _optional_path
|
||||
|
||||
self.assertIsNone(_optional_path(None))
|
||||
self.assertIsNone(_optional_path(""))
|
||||
self.assertIsNone(_optional_path("/does/not/exist/authorized_keys"))
|
||||
|
||||
def test_existing_path_is_returned(self):
|
||||
from orchestrator.context import _optional_path
|
||||
|
||||
with tempfile.NamedTemporaryFile() as f:
|
||||
self.assertEqual(_optional_path(f.name), Path(f.name))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -1,164 +0,0 @@
|
||||
"""Unit tests for the orchestrator's configure_tailscale phase.
|
||||
|
||||
Same harness as the SSH access tests: the phase touches the target only
|
||||
through the filesystem and arch-chroot, so it runs against a temp directory
|
||||
with subprocess.run recorded and the ufw side effect (writing user.rules)
|
||||
simulated by the fake.
|
||||
"""
|
||||
|
||||
import stat
|
||||
import sys
|
||||
import tempfile
|
||||
import types
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
from subprocess import CompletedProcess
|
||||
from unittest import mock
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "configs/airootfs/usr/share/omarchy-iso"))
|
||||
|
||||
# phases_impl imports the archinstall adapter at module scope, which pulls in
|
||||
# the archinstall library that only exists on the live ISO. configure_tailscale
|
||||
# never touches it, so stub the adapter out before the import.
|
||||
sys.modules["orchestrator.archinstall_adapter"] = types.ModuleType("orchestrator.archinstall_adapter")
|
||||
|
||||
from orchestrator import phases_impl # noqa: E402
|
||||
|
||||
UFW_RULE = "-A ufw-user-input -i tailscale0 -j ACCEPT\n"
|
||||
|
||||
|
||||
class ConfigureTailscaleTest(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.tmp = tempfile.TemporaryDirectory()
|
||||
self.addCleanup(self.tmp.cleanup)
|
||||
self.target = Path(self.tmp.name)
|
||||
self.calls = []
|
||||
|
||||
info_patch = mock.patch.object(phases_impl, "info")
|
||||
info_patch.start()
|
||||
self.addCleanup(info_patch.stop)
|
||||
|
||||
run_patch = mock.patch.object(phases_impl.subprocess, "run", side_effect=self.fake_run)
|
||||
run_patch.start()
|
||||
self.addCleanup(run_patch.stop)
|
||||
|
||||
self.ufw_writes_rule = True
|
||||
|
||||
def fake_run(self, cmd, **kwargs):
|
||||
self.calls.append(cmd)
|
||||
if cmd[2] == "ufw":
|
||||
if self.ufw_writes_rule:
|
||||
rules = self.target / "etc" / "ufw" / "user.rules"
|
||||
rules.parent.mkdir(parents=True, exist_ok=True)
|
||||
rules.write_text(UFW_RULE)
|
||||
# ufw cannot reach netfilter inside a chroot and exits non-zero
|
||||
# even when it recorded the rule; the phase must not trust this.
|
||||
return CompletedProcess(cmd, 1)
|
||||
return CompletedProcess(cmd, 0)
|
||||
|
||||
def ctx(self, authkey=None, tailscale_installed=True):
|
||||
authkey_path = None
|
||||
if authkey is not None:
|
||||
authkey_path = self.target / "tailscale_authkey"
|
||||
authkey_path.write_text(authkey)
|
||||
if tailscale_installed:
|
||||
binary = self.target / "usr" / "bin" / "tailscale"
|
||||
binary.parent.mkdir(parents=True, exist_ok=True)
|
||||
binary.touch()
|
||||
return types.SimpleNamespace(target=self.target, tailscale_authkey_path=authkey_path)
|
||||
|
||||
def configure(self, **kwargs):
|
||||
phases_impl.configure_tailscale(self.ctx(**kwargs))
|
||||
|
||||
def staged_key(self):
|
||||
return self.target / "etc" / "tailscale" / "authkey"
|
||||
|
||||
def unit(self):
|
||||
return self.target / "etc" / "systemd" / "system" / "omarchy-tailscale-join.service"
|
||||
|
||||
def chrooted(self, program):
|
||||
return [cmd for cmd in self.calls if cmd[:2] == ["arch-chroot", str(self.target)] and cmd[2] == program]
|
||||
|
||||
def test_no_authkey_is_a_no_op(self):
|
||||
self.configure()
|
||||
self.assertEqual(self.calls, [])
|
||||
self.assertFalse((self.target / "etc" / "tailscale").exists())
|
||||
|
||||
def test_stages_the_key(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
self.assertEqual(self.staged_key().read_text(), "tskey-auth-kFAKEKEY\n")
|
||||
|
||||
def test_drops_blank_lines_and_comments(self):
|
||||
self.configure(authkey="# reusable, tagged\n\n tskey-auth-kFAKEKEY \n")
|
||||
self.assertEqual(self.staged_key().read_text(), "tskey-auth-kFAKEKEY\n")
|
||||
|
||||
def test_key_dir_and_file_are_root_private(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
self.assertEqual(stat.S_IMODE((self.target / "etc" / "tailscale").stat().st_mode), 0o700)
|
||||
self.assertEqual(stat.S_IMODE(self.staged_key().stat().st_mode), 0o600)
|
||||
|
||||
def test_installs_the_join_unit(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
text = self.unit().read_text()
|
||||
self.assertIn("ConditionPathExists=/etc/tailscale/authkey", text)
|
||||
# The key must not outlive a successful join, the unit must not run
|
||||
# again after one, and cleanup must be sequenced after the join
|
||||
# succeeds -- inside the script, not in ExecStartPost.
|
||||
self.assertIn(
|
||||
"ExecStart=/usr/bin/sh -c 'until tailscale up --auth-key file:/etc/tailscale/authkey;"
|
||||
" do sleep 15; done; rm -f /etc/tailscale/authkey;"
|
||||
" systemctl disable omarchy-tailscale-join.service'",
|
||||
text,
|
||||
)
|
||||
|
||||
def test_join_unit_does_not_hold_up_boot(self):
|
||||
# A Type=oneshot wanted by multi-user.target holds the whole boot
|
||||
# (SDDM included) hostage until the join finishes or times out --
|
||||
# target units implicitly gain After= for their Wants=.
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
text = self.unit().read_text()
|
||||
self.assertIn("Type=simple", text)
|
||||
self.assertNotIn("Type=oneshot", text)
|
||||
self.assertNotIn("TimeoutStartSec", text)
|
||||
|
||||
def test_unit_avoids_systemd_variable_expansion(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
self.assertNotIn("$", self.unit().read_text())
|
||||
|
||||
def test_enables_tailscaled_and_the_join(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
self.assertEqual(self.chrooted("systemctl"), [
|
||||
["arch-chroot", str(self.target), "systemctl", "enable",
|
||||
"tailscaled.service", "omarchy-tailscale-join.service"],
|
||||
])
|
||||
|
||||
def test_allows_tailnet_traffic_through_ufw_despite_chroot_exit_status(self):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
self.assertEqual(self.chrooted("ufw"), [
|
||||
["arch-chroot", str(self.target), "ufw", "allow", "in", "on", "tailscale0"],
|
||||
])
|
||||
|
||||
def test_fails_when_ufw_does_not_record_the_rule(self):
|
||||
self.ufw_writes_rule = False
|
||||
with self.assertRaisesRegex(RuntimeError, "allow rule for tailscale0"):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n")
|
||||
|
||||
def test_fails_when_tailscale_is_not_on_the_target(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "not installed on the target"):
|
||||
self.configure(authkey="tskey-auth-kFAKEKEY\n", tailscale_installed=False)
|
||||
|
||||
def test_empty_file_fails_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "contains no auth key"):
|
||||
self.configure(authkey="")
|
||||
|
||||
def test_comment_only_file_fails_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "contains no auth key"):
|
||||
self.configure(authkey="# no key here\n")
|
||||
|
||||
def test_multiple_keys_fail_the_phase(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "expected exactly one"):
|
||||
self.configure(authkey="tskey-auth-kONE\ntskey-auth-kTWO\n")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -1,70 +0,0 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
import importlib.util
|
||||
import re
|
||||
import tempfile
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
MODULE_PATH = ROOT / "configs/airootfs/usr/share/omarchy-iso/orchestrator/keyboard.py"
|
||||
SPEC = importlib.util.spec_from_file_location("installer_keyboard", MODULE_PATH)
|
||||
KEYBOARD = importlib.util.module_from_spec(SPEC)
|
||||
assert SPEC.loader
|
||||
SPEC.loader.exec_module(KEYBOARD)
|
||||
|
||||
CONFIGURATOR = (ROOT / "configs/airootfs/root/configurator").read_text()
|
||||
KEYBOARD_BLOCK = re.search(r"keyboards=\$'(.*?)'\n choice=", CONFIGURATOR, re.DOTALL)
|
||||
assert KEYBOARD_BLOCK
|
||||
SUPPORTED_KEYMAPS = [
|
||||
line.split("|", 1)[1]
|
||||
for line in KEYBOARD_BLOCK.group(1).splitlines()
|
||||
]
|
||||
UNSUPPORTED_KEYMAPS = {"ba", "khmer"}
|
||||
|
||||
|
||||
class KeyboardConfigurationTest(unittest.TestCase):
|
||||
def target(self, directory: str) -> Path:
|
||||
target = Path(directory)
|
||||
(target / "etc").mkdir()
|
||||
(target / "etc/vconsole.conf").write_text(
|
||||
"KEYMAP=us\nFONT=default8x16\n"
|
||||
)
|
||||
return target
|
||||
|
||||
def test_writes_keymap_and_xkb_settings_and_preserves_font(self):
|
||||
# XKBLAYOUT is load-bearing: omarchy's detect-keyboard-layout.sh copies
|
||||
# it into Hyprland's kb_layout on the installed system.
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
target = self.target(directory)
|
||||
self.assertTrue(KEYBOARD.configure_keyboard(target, "us"))
|
||||
lines = (target / "etc/vconsole.conf").read_text().splitlines()
|
||||
self.assertIn("KEYMAP=us", lines)
|
||||
self.assertIn("XKBLAYOUT=us", lines)
|
||||
self.assertEqual(lines.count("FONT=default8x16"), 1)
|
||||
|
||||
def test_all_configurator_keymaps_are_known_to_localectl(self):
|
||||
for keymap in SUPPORTED_KEYMAPS:
|
||||
with self.subTest(keymap=keymap), tempfile.TemporaryDirectory() as directory:
|
||||
target = self.target(directory)
|
||||
configured = KEYBOARD.configure_keyboard(target, keymap)
|
||||
self.assertEqual(configured, keymap not in UNSUPPORTED_KEYMAPS)
|
||||
if configured:
|
||||
lines = (target / "etc/vconsole.conf").read_text().splitlines()
|
||||
self.assertIn(f"KEYMAP={keymap}", lines)
|
||||
self.assertEqual(lines.count("FONT=default8x16"), 1)
|
||||
|
||||
def test_unknown_and_empty_keymaps_match_archinstall_behavior(self):
|
||||
for keymap, expected in (("definitely-not-a-keymap", False), ("", True)):
|
||||
with self.subTest(keymap=keymap), tempfile.TemporaryDirectory() as directory:
|
||||
target = self.target(directory)
|
||||
self.assertEqual(KEYBOARD.configure_keyboard(target, keymap), expected)
|
||||
self.assertEqual(
|
||||
(target / "etc/vconsole.conf").read_text(),
|
||||
"KEYMAP=us\nFONT=default8x16\n",
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -1,79 +0,0 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
import subprocess
|
||||
import tempfile
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
PRUNER = ROOT / "builder/prune-offline-mirror.sh"
|
||||
|
||||
|
||||
class OfflineMirrorPruningTest(unittest.TestCase):
|
||||
def run_pruner(self, mirror: Path, required: list[str]):
|
||||
return subprocess.run(
|
||||
["bash", str(PRUNER), str(mirror)],
|
||||
input="".join(f"{filename}\n" for filename in required),
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
|
||||
def add_file(self, mirror: Path, filename: str):
|
||||
(mirror / filename).write_bytes(b"package")
|
||||
|
||||
def test_keeps_only_exactly_selected_package_archives(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
mirror = Path(directory)
|
||||
keep = "keep-2.0-1-x86_64.pkg.tar.zst"
|
||||
other = "other-1.0-1-any.pkg.tar.zst"
|
||||
stale_version = "keep-1.0-1-x86_64.pkg.tar.zst"
|
||||
removed_package = "removed-1.0-1-x86_64.pkg.tar.zst"
|
||||
orphan_signature = "interrupted-1.0-1-x86_64.pkg.tar.zst.sig"
|
||||
|
||||
for filename in (keep, other, stale_version, removed_package):
|
||||
self.add_file(mirror, filename)
|
||||
for filename in (keep, stale_version, removed_package):
|
||||
self.add_file(mirror, f"{filename}.sig")
|
||||
self.add_file(mirror, orphan_signature)
|
||||
self.add_file(mirror, "offline.db.tar.gz")
|
||||
|
||||
result = self.run_pruner(mirror, [keep, other])
|
||||
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.assertEqual(
|
||||
{path.name for path in mirror.iterdir()},
|
||||
{keep, f"{keep}.sig", other, "offline.db.tar.gz"},
|
||||
)
|
||||
self.assertIn(stale_version, result.stdout)
|
||||
self.assertIn(removed_package, result.stdout)
|
||||
|
||||
def test_missing_selection_aborts_before_deleting_anything(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
mirror = Path(directory)
|
||||
cached = "cached-1.0-1-x86_64.pkg.tar.zst"
|
||||
self.add_file(mirror, cached)
|
||||
|
||||
result = self.run_pruner(
|
||||
mirror, ["missing-1.0-1-x86_64.pkg.tar.zst"]
|
||||
)
|
||||
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertTrue((mirror / cached).exists())
|
||||
self.assertIn("selected packages are missing", result.stderr)
|
||||
|
||||
def test_empty_selection_aborts_before_deleting_anything(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
mirror = Path(directory)
|
||||
cached = "cached-1.0-1-x86_64.pkg.tar.zst"
|
||||
self.add_file(mirror, cached)
|
||||
|
||||
result = self.run_pruner(mirror, [])
|
||||
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertTrue((mirror / cached).exists())
|
||||
self.assertIn("empty package selection", result.stderr)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in new issue
Block a user