Move install-time plumbing out of the setup namespace

setup is where a user goes to configure something: direct boot, security
keys, hibernation. These three are not that. omarchy-apply-system is the
ISO's entry point in the target chroot, omarchy-apply-hardware is what it
calls for device quirks, and omarchy-apply-lock is called by
install/config/lockscreen-pam.sh.

apply is the verb they already used to describe themselves, and it carries
the contract: declared state under install/ converged onto the machine,
idempotent, safe to repeat.

The group gets no GROUP_DESCRIPTIONS entry on purpose. That table drives the
top-level group list on its own, so an entry would put apply back in front of
users even with every command in it hidden, the way provision already stays
out. A test covers it.

The ISO installs the runtime from the mirror it ships with, so it moves to
the new names in lockstep and no compatibility route is needed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
David Heinemeier Hansson
2026-08-10 14:14:57 -07:00
co-authored by Claude Opus 5
parent 477284f002
commit 536fcd5c6c
11 changed files with 40 additions and 34 deletions
+3 -3
View File
@@ -183,7 +183,7 @@ Idempotency marker: `~/.local/state/omarchy/done/finalize-user`, managed
by `omarchy-done`.
The ISO calls it as `omarchy-finalize-user --force --first-install` in the
target chroot as the install user, after `omarchy-setup-system` has finished
target chroot as the install user, after `omarchy-apply-system` has finished
the root-side work.
## Migrations (`omarchy-migrate`)
@@ -255,13 +255,13 @@ the legacy finalization marker from `~/.local/state/omarchy/` into `done/`.
## Root-side install orchestration
`omarchy-setup-system` (root, in chroot) runs target-side setup at ISO
`omarchy-apply-system` (root, in chroot) runs target-side setup at ISO
finalization. It sources:
- `install/config/all.sh` — theme links, lockout limits, lockscreen PAM,
powerprofilesctl shebang fix, docker setup, Snapper retention, locate
index tuning, service enablement, firewall.
- `install/hardware/all.sh` via `omarchy-setup-hardware` — vendor- and
- `install/hardware/all.sh` via `omarchy-apply-hardware` — vendor- and
device-specific kernel modules, udev rules, microcode, wireless regdom,
ASUS / Framework / Intel / Apple / Lenovo quirks.
- `install/login/all.sh` — SDDM theme/session config.