Add deferred first-boot provisioning and factory reset (#6621)
* Add OEM first-boot setup and factory reset An OEM-mode ISO install (or omarchy-reset-computer) leaves the machine in OEM state: fully installed, no user, /var/lib/omarchy/oem/pending armed. On the next boot omarchy-oem-setup.service runs the configurator's user form on tty1, creates the user with the groups system setup recorded, finalizes it offline from the stashed Node tarball, re-keys LUKS from the throwaway install passphrase to the user's password, and hands off to SDDM. omarchy-reset-computer returns a machine to that state: it swaps the running root for a fresh clone of the @factory snapshot the ISO takes at install time, scrubs machine identity and prior users, and stages omarchy-factory-wipe to drop the old root and recreate @home/@log on the next boot. Machines installed before @factory existed get a degraded reset (current system kept, users and state wiped) with that caveat surfaced in the confirmation. omarchy-setup-system/-hardware gain --oem to run without an install user; the group-granting install scripts now record their groups in /var/lib/omarchy/oem/groups and only call usermod when the user exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Harden OEM setup: correct cryptsetup key-file usage, retry on failure cryptsetup reads --test-passphrase/--key-file inputs byte-for-byte, so feed passphrases through process substitution consistently instead of positional args or stdin (which has different newline semantics). Run each first-boot setup attempt as its own process so a failure offers a retry instead of stranding the machine at a user-less login screen — bash ignores errexit inside `while !` conditions, a child process does not. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Always grant wheel sudo in OEM first-boot setup Detecting an existing %wheel grant by grepping sudoers is error-prone: omarchy ships narrow '%wheel ALL=(ALL) NOPASSWD: <command>' rules (e.g. asdcontrol) that match the naive pattern, which left the OEM-created user matching sudoers entries but unable to run anything. Write the drop-in unconditionally — a duplicate of an existing full grant is harmless. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix LUKS re-key device resolution and OEM state readability archinstall's encrypted installs put cryptdevice=PARTUUID=... on the kernel cmdline, not UUID=, so the first-boot re-key never found its device and silently skipped — leaving the throwaway auto-unlock keyfile in place, i.e. the disk effectively unencrypted. Parse every cryptdevice= source spec form and make any re-key failure abort the attempt loudly: a retry prompt beats a machine that quietly boots without a passphrase forever. The OEM state directory also has to be world-readable (its one secret, luks-key, stays 0600): user finalization reads the stashed Node tarball as the new user, and the 0700 directory forced it onto the network fallback. Step markers now land in /var/log/omarchy-oem-setup.log for debuggability. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Purge stale machine-id boot entries when resetting or re-keying limine-entry-tool keys its limine.conf OS entries by machine-id. A factory reset gives the machine a fresh identity, so the previous system's entry survived every rebuild, sorted first, and made Limine stop at a Blake2b hash-mismatch warning once the UKI was rebuilt. Start limine.conf over from the shipped template (and drop foreign machine-id history directories on the ESP) before any post-reset rebuild: in the staged chroot rebuild, in the first-boot LUKS re-key, and — for unencrypted resets, where nothing else rebuilds — in a dedicated first-boot refresh when foreign entries are found. The staged rebuild also verifies every UKI hash referenced by limine.conf against the file on the ESP before the subvolume swap, and the running system's limine-snapper-sync is runtime-masked during staging so it cannot rewrite the config behind the rebuild. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Harden reset and first-boot setup failure paths Review findings from codex and Copilot: - Generate throwaway passphrases without a trailing head stage: under pipefail, SIGPIPE from the infinite tr failed the substitution and errexit aborted every encrypted reset before it could stage anything. - Stage the fallible parts of a degraded reset (LUKS re-key, boot rebuild) before arming the wipe, so a staging failure leaves the machine untouched instead of scheduling a wipe for a reset that never finished. - Gate first-boot setup on the factory wipe having succeeded (ConditionPathExists=!wipe-pending plus an in-script guard): creating the new user on a half-wiped system would hand their data to the wipe retry. - Abort the wipe (keeping its retry marker) when deleting the old root or recreating @home/@log fails, and abort resets that cannot remove a prior account — a surviving account keeps its password and wheel membership. - Resume a partially-created account on setup retry instead of rejecting the username the failed attempt just created. - Only purge machine-id directories the old limine.conf actually referenced; a shared ESP may hold other installations' boot artifacts. - Recreate the hibernation swapfile (nested subvolume, so never captured by the factory snapshot) inside the factory root before its UKI rebuild, so a reset machine keeps disk-backed swap and a valid resume offset. - Source base-test.sh in the OEM groups test per test conventions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Recreate the hibernation swapfile even when resume drop-ins survive omarchy-hibernation-setup short-circuits as 'already set up' when the resume mkinitcpio drop-in exists — which it always does in a factory root, while the swapfile itself never survives the snapshot (nested subvolume). Drop the marker when the swapfile is gone so setup reconfigures from scratch, and verify the swapfile actually exists before proceeding with the reset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Second review pass: encrypted-config coverage, factory-baseline sanitization, recoverable rekey Codex xhigh round 2: - Detect the LUKS backing device by walking the root's device tree, not only the cmdline cryptdevice=; reset/first-boot now re-key roots reached via rd.luks/crypttab too, instead of silently leaving the seller's slots valid. - Sanitize the retained @factory baseline (accounts, /etc/shadow, machine identity) during a full reset: the new wheel user could otherwise mount it to recover the seller's data, and a second reset would restore the account. - Re-key the disk recoverably: rebuild the no-auto-unlock UKI before killing the throwaway slot or destroying the staged key, and restore the keyfile if that rebuild fails, so a retry with a different password can never leave the disk locked to the first attempt's password. - Roll back a degraded reset's live-root auto-unlock material if its boot rebuild fails, instead of leaving it for a later rebuild to embed. - Treat a missing current-machine limine entry as stale so a retry after a failed rebuild repairs the config instead of clearing OEM state over it. - Erase fingerprint enrollments (/var/lib/fprint) in degraded wipes. - Remove the resume-offset drop-in too when recreating the factory swapfile, so the rebuilt UKI gets a correct offset. - Pin first-boot retries to the account the first attempt created. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Expose factory reset in the Setup menu Add a 'Reset Computer' entry under Setup (Omarchy's Settings menu, where OS factory resets conventionally live), guarded to btrfs roots and launched in a floating terminal. omarchy-reset-computer now self-elevates via sudo so the menu entry needs no sudo prefix, forwarding the caller's gum theme env as env arguments so styling survives an env_reset sudoers. The typed 'reset' confirmation and the sudo password prompt remain as the guards against accidental triggering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Defer keyboard selection to first boot for OEM installs The OEM first-boot setup now runs a keyboard step before the user form, mirroring the ISO configurator: it loads the chosen layout on the live VT so the password (and the LUKS re-key that follows) are typed under it, and persists it with systemd-firstboot so the installed system gets both the console KEYMAP and the XKB layout Hyprland reads — exactly what a normal install writes. Layouts localectl doesn't know keep the default, same as the installer. This lets the OEM operator set nothing user-specific: the machine's owner picks their keyboard alongside their account at first boot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Rename factory-reset commands to omarchy-system-factory-reset[-finish] omarchy-reset-computer -> omarchy-system-factory-reset omarchy-factory-wipe -> omarchy-system-factory-reset-finish (and its systemd unit, log path, and temp mount to match) Pure rename: every reference — the Setup menu action, the first-boot finish service the reset stages and enables, the oem-setup ordering/gating, comments, and the menu test — moves together, with no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Rename OEM vocabulary to provisioning (runtime) Commands unify under the provisioning family: omarchy-oem-setup → omarchy-provision-owner omarchy-finalize-user → omarchy-provision-user omarchy-first-run → omarchy-provision-first-run And the deferred-provisioning state/vocabulary replaces 'OEM': /var/lib/omarchy/oem/ → /var/lib/omarchy/provisioning/ /etc/omarchy/oem.key → /etc/omarchy/provisioning.key install/oem/ → install/provisioning/ OMARCHY_SETUP_CONTEXT=oem-firstboot → provision-owner omarchy-setup-system/-hardware --oem → --defer-provisioning All callers (provision-first-run→provision-user, autostart, factory-reset staging the provisioning units, the group-recording scripts) and comments move together. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop remaining OEM mentions from the provisioning groups test Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Finish the omarchy-first-run rename in the docs Two doc references to omarchy-first-run were missed when the script was renamed to omarchy-provision-first-run; update them to match. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
David Heinemeier Hansson
co-authored by
Claude
Claude
parent
9b03f15b4f
commit
6fa4f78ee1
@@ -7,7 +7,7 @@ set -e
|
||||
|
||||
usage() {
|
||||
cat <<USAGE
|
||||
Usage: omarchy-first-run [--force]
|
||||
Usage: omarchy-provision-first-run [--force]
|
||||
|
||||
Run first-login user setup and notification hooks. By default this only runs
|
||||
once per user. Use --force to rerun the full sequence and refresh user setup.
|
||||
@@ -42,7 +42,7 @@ if omarchy-done check "$FIRST_RUN_DONE" && (( force == 0 )); then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
omarchy-finalize-user "${finalize_user_args[@]}" || true
|
||||
omarchy-provision-user "${finalize_user_args[@]}" || true
|
||||
|
||||
mkdir -p "$state_dir"
|
||||
|
||||
Executable
+564
@@ -0,0 +1,564 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=First-boot provisioning: create the user on a machine installed in deferred provisioning
|
||||
# omarchy:group=setup
|
||||
# omarchy:requires-sudo=true
|
||||
# omarchy:examples=omarchy-provision-owner
|
||||
|
||||
# Runs on tty1 via omarchy-provision-owner.service when /var/lib/omarchy/provisioning/pending
|
||||
# exists — the state a deferred-provisioning ISO install or omarchy-system-factory-reset leaves
|
||||
# behind. Asks for the user (the configurator's Step 2), creates it with the
|
||||
# groups system setup recorded, finalizes it offline from the stashed Node
|
||||
# tarball, re-keys LUKS from the throwaway install passphrase to the user's
|
||||
# password, and hands off to SDDM.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROVISIONING_DIR=/var/lib/omarchy/provisioning
|
||||
OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
|
||||
LOG_FILE=/var/log/omarchy-provision-owner.log
|
||||
|
||||
if (( EUID != 0 )); then
|
||||
echo "Error: omarchy-provision-owner must run as root" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
[[ -f $PROVISIONING_DIR/pending ]] || exit 0
|
||||
|
||||
# Never set up a user on a half-wiped system: while a factory wipe is still
|
||||
# pending (i.e. it failed this boot), stand down and let it retry next boot.
|
||||
if [[ -f $PROVISIONING_DIR/wipe-pending ]]; then
|
||||
echo "omarchy-provision-owner: factory wipe still pending; not running user setup" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PATH="$OMARCHY_PATH/bin:$PATH"
|
||||
|
||||
LOGO_PATH="$OMARCHY_PATH/logo.txt"
|
||||
LOGO_WIDTH=$(awk '{ if (length > max) max = length } END { print max+0 }' "$LOGO_PATH" 2>/dev/null || echo 0)
|
||||
|
||||
export GUM_CONFIRM_PROMPT_FOREGROUND="6"
|
||||
export GUM_CONFIRM_SELECTED_FOREGROUND="0"
|
||||
export GUM_CONFIRM_SELECTED_BACKGROUND="2"
|
||||
export GUM_CONFIRM_UNSELECTED_FOREGROUND="7"
|
||||
export GUM_CONFIRM_UNSELECTED_BACKGROUND="0"
|
||||
|
||||
# Same Tokyo Night VT palette the ISO configurator sets, so the first-boot
|
||||
# form looks like a continuation of the install.
|
||||
set_tokyo_night_colors() {
|
||||
[[ $(tty 2>/dev/null) == /dev/tty* ]] || return 0
|
||||
echo -en "\e]P01a1b26"; echo -en "\e]P1f7768e"; echo -en "\e]P29ece6a"
|
||||
echo -en "\e]P3e0af68"; echo -en "\e]P47aa2f7"; echo -en "\e]P5bb9af7"
|
||||
echo -en "\e]P67dcfff"; echo -en "\e]P7a9b1d6"; echo -en "\e]P8414868"
|
||||
echo -en "\e]P9f7768e"; echo -en "\e]PA9ece6a"; echo -en "\e]PBe0af68"
|
||||
echo -en "\e]PC7aa2f7"; echo -en "\e]PDbb9af7"; echo -en "\e]PE7dcfff"
|
||||
echo -en "\e]PFc0caf5"
|
||||
echo -en "\033[0m"
|
||||
clear
|
||||
}
|
||||
|
||||
measure_terminal() {
|
||||
TERM_WIDTH=$(stty size 2>/dev/null </dev/tty | awk '{print $2}')
|
||||
(( TERM_WIDTH > 0 )) || TERM_WIDTH=${COLUMNS:-80}
|
||||
|
||||
PADDING_LEFT=$(((TERM_WIDTH - LOGO_WIDTH) / 2))
|
||||
(( PADDING_LEFT < 0 )) && PADDING_LEFT=0
|
||||
PADDING_LEFT_SPACES=$(printf "%*s" "$PADDING_LEFT" "")
|
||||
|
||||
local padding="0 0 0 $PADDING_LEFT"
|
||||
export GUM_CHOOSE_PADDING="$padding"
|
||||
export GUM_INPUT_PADDING="$padding"
|
||||
export GUM_SPIN_PADDING="$padding"
|
||||
export GUM_TABLE_PADDING="$padding"
|
||||
export GUM_CONFIRM_PADDING="$padding"
|
||||
}
|
||||
|
||||
clear_logo() {
|
||||
measure_terminal
|
||||
printf "\033[H\033[2J"
|
||||
gum style --foreground 2 --padding "1 0 0 $PADDING_LEFT" "$(<"$LOGO_PATH")"
|
||||
}
|
||||
|
||||
step() {
|
||||
clear_logo
|
||||
echo
|
||||
gum style --padding "0 0 0 $PADDING_LEFT" "$1"
|
||||
echo
|
||||
}
|
||||
|
||||
say() {
|
||||
gum style --padding "0 0 0 $PADDING_LEFT" "$@"
|
||||
}
|
||||
|
||||
notice() {
|
||||
clear_logo
|
||||
echo
|
||||
gum spin --spinner "pulse" --title "$1" -- sleep "${2:-2}"
|
||||
echo
|
||||
}
|
||||
|
||||
log_step() {
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] oem-setup: $1" >>"$LOG_FILE"
|
||||
}
|
||||
|
||||
# The keyboard step the ISO configurator runs — deferred to first boot for OEM
|
||||
# installs, so the machine's owner picks their own layout. Applied immediately
|
||||
# (live VT + persisted) so the password typed next, and the LUKS re-key below,
|
||||
# use the chosen layout.
|
||||
keyboard_form() {
|
||||
step "Let's setup your keyboard..."
|
||||
local keyboards choice
|
||||
keyboards=$'Azerbaijani|azerty
|
||||
Belarusian|by
|
||||
Belgian|be-latin1
|
||||
Bosnian|ba
|
||||
Bulgarian|bg-cp1251
|
||||
Croatian|croat
|
||||
Czech|cz
|
||||
Danish|dk-latin1
|
||||
Dutch|nl
|
||||
English (UK)|uk
|
||||
English (US)|us
|
||||
English (US, Dvorak)|dvorak
|
||||
English (US, Colemak)|colemak
|
||||
Estonian|et
|
||||
Finnish|fi
|
||||
French|fr
|
||||
French (Canada)|cf
|
||||
French (Switzerland)|fr_CH
|
||||
Georgian|ge
|
||||
German|de
|
||||
German (Switzerland)|de_CH-latin1
|
||||
Greek|gr
|
||||
Hebrew|il
|
||||
Hungarian|hu
|
||||
Icelandic|is-latin1
|
||||
Irish|ie
|
||||
Italian|it
|
||||
Japanese|jp106
|
||||
Kazakh|kazakh
|
||||
Khmer (Cambodia)|khmer
|
||||
Kyrgyz|kyrgyz
|
||||
Lao|la-latin1
|
||||
Latvian|lv
|
||||
Lithuanian|lt
|
||||
Macedonian|mk-utf
|
||||
Norwegian|no-latin1
|
||||
Polish|pl
|
||||
Portuguese|pt-latin1
|
||||
Portuguese (Brazil)|br-abnt2
|
||||
Romanian|ro
|
||||
Russian|ru
|
||||
Serbian|sr-latin
|
||||
Slovak|sk-qwertz
|
||||
Slovenian|slovene
|
||||
Spanish|es
|
||||
Spanish (Latin American)|la-latin1
|
||||
Swedish|sv-latin1
|
||||
Tajik|tj_alt-UTF8
|
||||
Turkish|trq
|
||||
Ukrainian|ua'
|
||||
choice=$(printf '%s\n' "$keyboards" | cut -d'|' -f1 | gum choose --height 10 --selected "English (US)" --header "Select keyboard layout") || choice="English (US)"
|
||||
keyboard=$(printf '%s\n' "$keyboards" | awk -F'|' -v c="$choice" '$1==c{print $2; exit}')
|
||||
keyboard_label="$choice"
|
||||
apply_keyboard "$keyboard"
|
||||
}
|
||||
|
||||
# Load the layout on the live VT and persist it for the installed system.
|
||||
# systemd-firstboot writes both the console KEYMAP and the XKB layout Hyprland
|
||||
# reads, matching what the ISO's configure_keyboard does at install time. The
|
||||
# two layouts localectl doesn't know (ba, khmer) keep the default, same as a
|
||||
# normal install.
|
||||
apply_keyboard() {
|
||||
local keymap="$1"
|
||||
[[ $(tty 2>/dev/null) == /dev/tty* ]] && loadkeys "$keymap" 2>/dev/null || true
|
||||
|
||||
if localectl --no-pager list-keymaps 2>/dev/null | grep -qix "$keymap"; then
|
||||
systemd-firstboot --keymap="$keymap" --force >>"$LOG_FILE" 2>&1 || \
|
||||
localectl set-keymap "$keymap" >>"$LOG_FILE" 2>&1 || \
|
||||
log_step "could not persist keymap $keymap"
|
||||
else
|
||||
log_step "keymap $keymap unknown to localectl; keeping the default"
|
||||
fi
|
||||
}
|
||||
|
||||
# The same username/password/name/email form as the ISO configurator's Step 2.
|
||||
user_form() {
|
||||
step "Let's setup your user account..."
|
||||
|
||||
# A prior attempt that already created the account pins the username, so a
|
||||
# retry cannot strand that account by choosing a different name.
|
||||
if [[ -f $PROVISIONING_DIR/setup-user ]]; then
|
||||
username=$(<"$PROVISIONING_DIR/setup-user")
|
||||
say "Continuing setup for user: $username"
|
||||
echo
|
||||
else
|
||||
while true; do
|
||||
username=$(gum input --placeholder "Alphanumeric without spaces (like dhh)" --prompt.foreground="#845DF9" --prompt "Username> ") || continue
|
||||
|
||||
if [[ "$username" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]]; then
|
||||
if [[ "$username" =~ ^(root|bin|daemon|mail|ftp|http|nobody|dbus|systemd-coredump|systemd-network|systemd-oom|systemd-journal-remote|systemd-resolve|systemd-timesync|tss|uuidd|alpm|git|avahi|cups|lp|_talkd|polkitd|rtkit|qemu|brltty|gluster|rpc|libvirt-qemu|pcscd|nvidia-persistenced|sddm)$ ]]; then
|
||||
notice "Username is reserved for system" 1
|
||||
elif getent passwd "$username" >/dev/null; then
|
||||
# provisioning state has no users, so any existing account is off limits;
|
||||
# a pinned resume (above) bypasses this prompt entirely.
|
||||
notice "That username already exists on this machine" 1
|
||||
else
|
||||
break
|
||||
fi
|
||||
else
|
||||
notice "Username must be alphanumeric with no spaces" 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
while true; do
|
||||
password=$(gum input --placeholder "Used for user + root, and disk encryption when enabled" --prompt.foreground="#845DF9" --password --prompt "Password> ") || continue
|
||||
password_confirmation=$(gum input --placeholder "Must match the password you just typed" --prompt.foreground="#845DF9" --password --prompt "Confirm> ") || continue
|
||||
|
||||
if [[ -n "$password" && "$password" == "$password_confirmation" ]]; then
|
||||
break
|
||||
elif [[ -z "$password" ]]; then
|
||||
notice "Your password can't be blank!" 1
|
||||
else
|
||||
notice "Passwords didn't match!" 1
|
||||
fi
|
||||
done
|
||||
|
||||
full_name=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Full name> ") || full_name=""
|
||||
email_address=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Email address> ") || email_address=""
|
||||
}
|
||||
|
||||
confirm_form() {
|
||||
clear_logo
|
||||
echo
|
||||
echo -e "Field,Value
|
||||
Keyboard,${keyboard_label:-English (US)}
|
||||
Username,$username
|
||||
Password,$(printf "%${#password}s" | tr ' ' '*')
|
||||
Full name,${full_name:-[Skipped]}
|
||||
Email address,${email_address:-[Skipped]}" |
|
||||
gum table -s "," -p | sed "s/^/${PADDING_LEFT_SPACES}/"
|
||||
|
||||
echo
|
||||
gum confirm --negative "No, change it" "Does this look right?"
|
||||
}
|
||||
|
||||
# Groups recorded by omarchy-setup-system's scripts at install time
|
||||
# (/var/lib/omarchy/provisioning/groups), filtered to groups that exist on this system.
|
||||
user_groups() {
|
||||
local groups="wheel" group
|
||||
if [[ -f $PROVISIONING_DIR/groups ]]; then
|
||||
while IFS= read -r group; do
|
||||
[[ -n $group ]] || continue
|
||||
getent group "$group" >/dev/null || continue
|
||||
[[ ",$groups," == *",$group,"* ]] || groups+=",$group"
|
||||
done <"$PROVISIONING_DIR/groups"
|
||||
fi
|
||||
echo "$groups"
|
||||
}
|
||||
|
||||
# Resolve the crypto_LUKS partition backing the root, or return non-zero if
|
||||
# the root is not on LUKS. Prefers the cmdline cryptdevice= spec (archinstall
|
||||
# writes PARTUUID=, the pre-mounted path UUID=), and falls back to walking the
|
||||
# device tree for roots reached via rd.luks/crypttab with a plain /dev/mapper
|
||||
# root and no cryptdevice=.
|
||||
luks_device() {
|
||||
local spec
|
||||
spec=$(grep -o 'cryptdevice=[^ :]*' /proc/cmdline | head -1 | cut -d= -f2-)
|
||||
case $spec in
|
||||
UUID=*) echo "/dev/disk/by-uuid/${spec#UUID=}"; return 0 ;;
|
||||
PARTUUID=*) echo "/dev/disk/by-partuuid/${spec#PARTUUID=}"; return 0 ;;
|
||||
LABEL=*) echo "/dev/disk/by-label/${spec#LABEL=}"; return 0 ;;
|
||||
PARTLABEL=*) echo "/dev/disk/by-partlabel/${spec#PARTLABEL=}"; return 0 ;;
|
||||
/dev/*) echo "$spec"; return 0 ;;
|
||||
esac
|
||||
|
||||
# No cryptdevice=: walk the root source's ancestors (lsblk -s inverts the
|
||||
# tree) for the first crypto_LUKS parent.
|
||||
local src part
|
||||
src=$(findmnt -no SOURCE / | sed 's/\[.*//')
|
||||
[[ -n $src ]] || return 1
|
||||
part=$(lsblk -nspo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
|
||||
[[ -n $part ]] && { echo "$part"; return 0; }
|
||||
return 1
|
||||
}
|
||||
|
||||
encrypted_install() {
|
||||
luks_device >/dev/null 2>&1
|
||||
}
|
||||
|
||||
create_user() {
|
||||
# Pin the username so a retry after a later failure resumes this exact
|
||||
# account rather than creating a second privileged one.
|
||||
echo "$username" >"$PROVISIONING_DIR/setup-user"
|
||||
|
||||
if getent passwd "$username" >/dev/null; then
|
||||
# Resuming a partially-completed earlier attempt: refresh what the form
|
||||
# collected this time around.
|
||||
usermod -aG "$(user_groups)" ${full_name:+-c "$full_name"} "$username"
|
||||
else
|
||||
useradd -m -G "$(user_groups)" -s /bin/bash \
|
||||
${full_name:+-c "$full_name"} "$username"
|
||||
fi
|
||||
|
||||
printf '%s:%s\n' "$username" "$password" | chpasswd
|
||||
printf '%s:%s\n' root "$password" | chpasswd
|
||||
|
||||
# deferred-provisioning installs skip archinstall's create_users, which is what normally
|
||||
# uncomments %wheel in /etc/sudoers. Always write the drop-in: detecting an
|
||||
# existing grant is error-prone (omarchy ships narrow %wheel NOPASSWD rules
|
||||
# for specific commands), and a duplicate grant is harmless.
|
||||
echo "%wheel ALL=(ALL:ALL) ALL" >/etc/sudoers.d/00-omarchy-wheel
|
||||
chmod 440 /etc/sudoers.d/00-omarchy-wheel
|
||||
}
|
||||
|
||||
install_authorized_keys() {
|
||||
[[ -f $PROVISIONING_DIR/authorized_keys ]] || return 0
|
||||
|
||||
local ssh_dir="/home/$username/.ssh"
|
||||
mkdir -p "$ssh_dir"
|
||||
cp "$PROVISIONING_DIR/authorized_keys" "$ssh_dir/authorized_keys"
|
||||
chmod 700 "$ssh_dir"
|
||||
chmod 600 "$ssh_dir/authorized_keys"
|
||||
chown -R "$username:$username" "$ssh_dir"
|
||||
}
|
||||
|
||||
configure_login() {
|
||||
mkdir -p /var/lib/sddm
|
||||
printf '[Last]\nSession=omarchy.desktop\nUser=%s\n' "$username" >/var/lib/sddm/state.conf
|
||||
chown -R sddm:sddm /var/lib/sddm 2>/dev/null || true
|
||||
|
||||
# Encrypted installs autologin because the LUKS prompt is the auth boundary.
|
||||
if encrypted_install; then
|
||||
mkdir -p /etc/sddm.conf.d
|
||||
printf '[Autologin]\nUser=%s\nSession=omarchy.desktop\n' "$username" >/etc/sddm.conf.d/autologin.conf
|
||||
fi
|
||||
}
|
||||
|
||||
finalize_user() {
|
||||
local home shell
|
||||
home=$(getent passwd "$username" | cut -d: -f6)
|
||||
shell=$(getent passwd "$username" | cut -d: -f7)
|
||||
|
||||
runuser -u "$username" -- env \
|
||||
HOME="$home" \
|
||||
USER="$username" \
|
||||
LOGNAME="$username" \
|
||||
SHELL="${shell:-/bin/bash}" \
|
||||
OMARCHY_PATH="$OMARCHY_PATH" \
|
||||
OMARCHY_INSTALL="$OMARCHY_PATH/install" \
|
||||
OMARCHY_SETUP_CONTEXT=provision-owner \
|
||||
OMARCHY_USER_NAME="$full_name" \
|
||||
OMARCHY_USER_EMAIL="$email_address" \
|
||||
OMARCHY_LOG_TO_STDOUT=1 \
|
||||
"$OMARCHY_PATH/bin/omarchy-provision-user" --force --first-install
|
||||
}
|
||||
|
||||
# Move the LUKS volume from the throwaway install passphrase to the user's
|
||||
# password: add the user's key, kill every other slot (throwaway + any seller
|
||||
# keys a reset left behind), then rebuild the UKI without the embedded
|
||||
# auto-unlock keyfile.
|
||||
#
|
||||
# Failing here must be LOUD (abort the attempt, offer retry): silently keeping
|
||||
# the staged auto-unlock keyfile would leave the disk effectively unencrypted
|
||||
# forever.
|
||||
rekey_luks() {
|
||||
[[ -f $PROVISIONING_DIR/luks-key ]] || return 0
|
||||
|
||||
local device
|
||||
if ! device=$(luks_device) || [[ ! -e $device ]]; then
|
||||
log_step "cannot locate the LUKS device from /proc/cmdline: $(cat /proc/cmdline)"
|
||||
say --foreground 1 "Could not locate the LUKS device to re-key."
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! cryptsetup open --test-passphrase --key-file "$PROVISIONING_DIR/luks-key" "$device" 2>>"$LOG_FILE"; then
|
||||
log_step "staged LUKS key does not unlock $device"
|
||||
say --foreground 1 "The staged LUKS key no longer unlocks $device."
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Add the user's key (a retry with a different password just adds another
|
||||
# slot; all but the current one are killed once the rebuild succeeds).
|
||||
cryptsetup luksAddKey --key-file "$PROVISIONING_DIR/luks-key" "$device" <(printf '%s' "$password")
|
||||
|
||||
# Rebuild the no-auto-unlock UKI FIRST, keeping the throwaway key and slot as
|
||||
# a fallback. Only once that succeeds do we kill the other slots and destroy
|
||||
# the staged key — so a limine-update failure leaves a recoverable,
|
||||
# still-auto-unlocking state to retry, never a disk locked to a password the
|
||||
# user may have just changed.
|
||||
rm -f /etc/omarchy/provisioning.key \
|
||||
/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf \
|
||||
/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
|
||||
reset_limine_config
|
||||
if ! limine-update >>"$LOG_FILE" 2>&1; then
|
||||
log_step "limine-update failed during re-key; restoring auto-unlock for retry"
|
||||
install -Dm600 "$PROVISIONING_DIR/luks-key" /etc/omarchy/provisioning.key
|
||||
echo 'KERNEL_CMDLINE[default]+=" cryptkey=rootfs:/etc/omarchy/provisioning.key"' \
|
||||
>/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf
|
||||
echo 'FILES+=(/etc/omarchy/provisioning.key)' >/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
|
||||
limine-update >>"$LOG_FILE" 2>&1 || true
|
||||
return 1
|
||||
fi
|
||||
|
||||
local new_slot slot
|
||||
new_slot=$(cryptsetup open --test-passphrase --verbose --key-file <(printf '%s' "$password") "$device" 2>&1 |
|
||||
grep -o 'Key slot [0-9]* unlocked' | grep -o '[0-9]*' | head -1)
|
||||
if [[ -n $new_slot ]]; then
|
||||
for slot in $(cryptsetup luksDump "$device" | awk '/^ +[0-9]+: luks2/ { sub(":", "", $1); print $1 }'); do
|
||||
[[ $slot == "$new_slot" ]] && continue
|
||||
cryptsetup luksKillSlot -q --key-file <(printf '%s' "$password") "$device" "$slot"
|
||||
done
|
||||
fi
|
||||
|
||||
shred -u "$PROVISIONING_DIR/luks-key" 2>/dev/null || rm -f "$PROVISIONING_DIR/luks-key"
|
||||
}
|
||||
|
||||
# Start the ESP's limine.conf over from the shipped template and drop foreign
|
||||
# machine-id state before rebuilding. limine-entry-tool keys OS entries by
|
||||
# machine-id: after a factory reset gave this machine a fresh identity, the
|
||||
# previous system's entry would survive the rebuild with a stale UKI hash,
|
||||
# sort first, and make Limine stop at a hash-mismatch warning.
|
||||
esp_path() {
|
||||
local esp=""
|
||||
if [[ -f /etc/default/limine ]]; then
|
||||
esp=$(sed -n 's/^ESP_PATH=["'\'']\?\([^"'\'']*\).*/\1/p' /etc/default/limine | tail -1)
|
||||
fi
|
||||
echo "${esp:-/boot}"
|
||||
}
|
||||
|
||||
# A factory reset gives the machine a fresh machine-id, but limine-entry-tool
|
||||
# keys its limine.conf entries by machine-id — entries from the previous
|
||||
# identity would linger and go hash-stale on the first UKI rebuild.
|
||||
limine_entries_stale() {
|
||||
local esp machine_id
|
||||
esp=$(esp_path)
|
||||
machine_id=$(cat /etc/machine-id 2>/dev/null || true)
|
||||
[[ -f $esp/limine.conf && -n $machine_id ]] || return 1
|
||||
# Stale if any foreign machine-id entry lingers, OR if this machine has no
|
||||
# entry at all (e.g. a failed earlier rebuild left the entry-less template).
|
||||
grep -o 'machine-id=[0-9a-f]*' "$esp/limine.conf" 2>/dev/null |
|
||||
grep -qv "machine-id=$machine_id" && return 0
|
||||
! grep -q "machine-id=$machine_id" "$esp/limine.conf"
|
||||
}
|
||||
|
||||
reset_limine_config() {
|
||||
local esp template found="" machine_id old_id old_ids=""
|
||||
esp=$(esp_path)
|
||||
|
||||
# Only remove machine-ids the old (Omarchy-managed) limine.conf referenced;
|
||||
# a shared ESP may hold other installations' machine-id directories.
|
||||
if [[ -f $esp/limine.conf ]]; then
|
||||
old_ids=$(grep -o 'machine-id=[0-9a-f]\{32\}' "$esp/limine.conf" | cut -d= -f2 | sort -u)
|
||||
fi
|
||||
|
||||
for template in "$OMARCHY_PATH/install/assets/limine/limine.conf" \
|
||||
"$OMARCHY_PATH/default/limine/limine.conf"; do
|
||||
if [[ -f $template ]]; then
|
||||
cp "$template" "$esp/limine.conf"
|
||||
found=1
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [[ -z $found ]]; then
|
||||
log_step "no limine.conf template found; keeping the existing config"
|
||||
return 0
|
||||
fi
|
||||
|
||||
machine_id=$(cat /etc/machine-id 2>/dev/null || true)
|
||||
for old_id in $old_ids; do
|
||||
[[ $old_id == "$machine_id" ]] && continue
|
||||
rm -rf "${esp:?}/$old_id"
|
||||
done
|
||||
}
|
||||
|
||||
cleanup_oem_state() {
|
||||
# Keep groups + packages: omarchy-system-factory-reset's degraded path (machines
|
||||
# without @factory) re-arms first-boot setup from the live copies.
|
||||
rm -f "$PROVISIONING_DIR/pending" "$PROVISIONING_DIR/authorized_keys" "$PROVISIONING_DIR/setup-user"
|
||||
|
||||
rm -f /etc/systemd/system/multi-user.target.wants/omarchy-provision-owner.service
|
||||
systemctl daemon-reload 2>/dev/null || true
|
||||
}
|
||||
|
||||
run_setup() {
|
||||
while true; do
|
||||
keyboard_form
|
||||
user_form
|
||||
confirm_form && break
|
||||
done
|
||||
|
||||
clear_logo
|
||||
echo
|
||||
say "Setting up your account..."
|
||||
echo
|
||||
|
||||
touch "$LOG_FILE"
|
||||
chmod 600 "$LOG_FILE"
|
||||
|
||||
log_step "creating user $username"
|
||||
create_user
|
||||
install_authorized_keys
|
||||
configure_login
|
||||
|
||||
log_step "finalizing user"
|
||||
say "Finalizing your user (this can take a minute)..."
|
||||
if ! finalize_user >>"$LOG_FILE" 2>&1; then
|
||||
log_step "finalize-user failed (continuing; user can retry after login)"
|
||||
say --foreground 1 "User finalization reported errors (see $LOG_FILE)."
|
||||
say --foreground 1 "Run 'omarchy-provision-user --force' after login to retry."
|
||||
sleep 3
|
||||
fi
|
||||
|
||||
if [[ -f $PROVISIONING_DIR/luks-key ]]; then
|
||||
log_step "re-keying LUKS to the user's password"
|
||||
say "Securing disk encryption with your password..."
|
||||
rekey_luks
|
||||
log_step "LUKS re-key complete"
|
||||
fi
|
||||
|
||||
# After a factory reset on an unencrypted machine nothing above rebuilds the
|
||||
# boot entries, so entries keyed to the previous machine identity would
|
||||
# linger and go hash-stale on the first UKI rebuild. Refresh them now.
|
||||
if limine_entries_stale; then
|
||||
log_step "refreshing boot entries for the new machine identity"
|
||||
say "Refreshing boot entries (this can take a minute)..."
|
||||
reset_limine_config
|
||||
limine-update >>"$LOG_FILE" 2>&1
|
||||
fi
|
||||
|
||||
log_step "cleaning up provisioning state"
|
||||
cleanup_oem_state
|
||||
log_step "first-boot setup complete"
|
||||
|
||||
clear_logo
|
||||
echo
|
||||
gum spin --spinner "pulse" --title "All set. Starting Omarchy..." -- sleep 2
|
||||
}
|
||||
|
||||
# A failed first-boot setup must not strand the machine at a user-less login
|
||||
# screen. Each attempt runs as its own process — bash ignores errexit inside
|
||||
# `while !` conditions, but a child process keeps its own set -e — and failure
|
||||
# offers a retry; create_user and friends are idempotent, so retrying is safe.
|
||||
if [[ ${1:-} == "--attempt" ]]; then
|
||||
run_setup
|
||||
exit 0
|
||||
fi
|
||||
|
||||
main() {
|
||||
set_tokyo_night_colors
|
||||
|
||||
while ! "$0" --attempt; do
|
||||
clear_logo
|
||||
echo
|
||||
say --foreground 1 "Setup hit an error (details in $LOG_FILE)."
|
||||
echo
|
||||
if ! gum confirm --affirmative "Try again" --negative "Drop to console" "Retry first-boot setup?"; then
|
||||
say "Run 'omarchy-provision-owner' as root to retry later."
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
main
|
||||
@@ -25,7 +25,7 @@ USAGE
|
||||
}
|
||||
|
||||
if (( EUID == 0 )); then
|
||||
echo "Error: run omarchy-finalize-user as the user being configured, not as root." >&2
|
||||
echo "Error: run omarchy-provision-user as the user being configured, not as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@@ -67,7 +67,9 @@ export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
|
||||
export OMARCHY_SETUP_CONTEXT="${OMARCHY_SETUP_CONTEXT:-runtime}"
|
||||
export PATH="$OMARCHY_PATH/bin:$PATH"
|
||||
|
||||
if (( first_install )); then
|
||||
if (( first_install )) && [[ $OMARCHY_SETUP_CONTEXT == "runtime" ]]; then
|
||||
# The ISO chroot doesn't set a context; omarchy-provision-owner runs first-install
|
||||
# finalization too but with OMARCHY_SETUP_CONTEXT=provision-owner already set.
|
||||
export OMARCHY_SETUP_CONTEXT=iso-chroot
|
||||
fi
|
||||
|
||||
@@ -10,20 +10,29 @@ set -euo pipefail
|
||||
usage() {
|
||||
cat <<USAGE
|
||||
Usage: omarchy setup hardware --install-user USER
|
||||
omarchy setup hardware --defer-provisioning
|
||||
|
||||
Runs idempotent hardware detection/setup for the installed machine. This is
|
||||
called by omarchy-setup-system during ISO finalization and can be rerun later
|
||||
for diagnostics or after hardware/package updates.
|
||||
|
||||
--defer-provisioning runs without an install user (deferred-provisioning installs create the user at
|
||||
first boot); group grants are recorded in /var/lib/omarchy/provisioning/groups.
|
||||
USAGE
|
||||
}
|
||||
|
||||
install_user="${OMARCHY_INSTALL_USER:-}"
|
||||
defer_provisioning=0
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
--install-user)
|
||||
install_user="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--defer-provisioning)
|
||||
defer_provisioning=1
|
||||
shift
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
@@ -41,14 +50,18 @@ if (( EUID != 0 )); then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z $install_user || $install_user == "root" ]]; then
|
||||
if (( defer_provisioning )); then
|
||||
install_user=""
|
||||
else
|
||||
if [[ -z $install_user || $install_user == "root" ]]; then
|
||||
echo "Error: --install-user must name the target non-root user" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! getent passwd "$install_user" >/dev/null; then
|
||||
if ! getent passwd "$install_user" >/dev/null; then
|
||||
echo "Error: user '$install_user' does not exist" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
export OMARCHY_INSTALL_USER="$install_user"
|
||||
|
||||
@@ -10,16 +10,22 @@ set -euo pipefail
|
||||
usage() {
|
||||
cat <<USAGE
|
||||
Usage: omarchy setup system --install-user USER [--first-install|--upgrade]
|
||||
omarchy setup system --defer-provisioning --first-install
|
||||
|
||||
Runs root-owned Omarchy system setup. The ISO calls this in the target chroot
|
||||
after packages are installed and the target user exists. It also calls
|
||||
omarchy-setup-hardware, so hardware setup cannot be accidentally skipped.
|
||||
|
||||
--defer-provisioning runs without an install user: deferred-provisioning installs create the user at
|
||||
first boot, so scripts that grant group memberships record them in
|
||||
/var/lib/omarchy/provisioning/groups instead of calling usermod.
|
||||
USAGE
|
||||
}
|
||||
|
||||
install_user="${OMARCHY_INSTALL_USER:-}"
|
||||
first_install=0
|
||||
upgrade=0
|
||||
defer_provisioning=0
|
||||
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
@@ -27,6 +33,10 @@ while (($#)); do
|
||||
install_user="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--defer-provisioning)
|
||||
defer_provisioning=1
|
||||
shift
|
||||
;;
|
||||
--first-install)
|
||||
first_install=1
|
||||
shift
|
||||
@@ -52,14 +62,18 @@ if (( EUID != 0 )); then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z $install_user || $install_user == "root" ]]; then
|
||||
if (( defer_provisioning )); then
|
||||
install_user=""
|
||||
else
|
||||
if [[ -z $install_user || $install_user == "root" ]]; then
|
||||
echo "Error: --install-user must name the target non-root user" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! getent passwd "$install_user" >/dev/null; then
|
||||
if ! getent passwd "$install_user" >/dev/null; then
|
||||
echo "Error: user '$install_user' does not exist" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
export OMARCHY_INSTALL_USER="$install_user"
|
||||
@@ -75,7 +89,11 @@ start_install_log
|
||||
|
||||
source "$OMARCHY_INSTALL/config/all.sh"
|
||||
|
||||
omarchy-setup-hardware --install-user "$install_user"
|
||||
if (( defer_provisioning )); then
|
||||
omarchy-setup-hardware --defer-provisioning
|
||||
else
|
||||
omarchy-setup-hardware --install-user "$install_user"
|
||||
fi
|
||||
|
||||
source "$OMARCHY_INSTALL/login/all.sh"
|
||||
source "$OMARCHY_INSTALL/post-install/all.sh"
|
||||
|
||||
Executable
+480
@@ -0,0 +1,480 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Factory-reset this machine back to its freshly-installed state
|
||||
# omarchy:group=setup
|
||||
# omarchy:requires-sudo=true
|
||||
# omarchy:examples=sudo omarchy-system-factory-reset
|
||||
|
||||
# Returns the machine to provisioning state — fully installed, no user, first-boot
|
||||
# setup pending — the state you want before selling or handing the machine on.
|
||||
#
|
||||
# On machines installed with an ISO that created the @factory snapshot, the
|
||||
# running root (@) is swapped for a fresh writable clone of @factory, so
|
||||
# user-installed packages and /etc drift are gone too. Machines without
|
||||
# @factory get a degraded reset: the current system is kept and only user
|
||||
# accounts, home data, and machine identity are wiped.
|
||||
#
|
||||
# The heavy lifting happens on the next boot via omarchy-system-factory-reset-finish, staged
|
||||
# here. On encrypted installs the LUKS volume is re-keyed to a throwaway
|
||||
# passphrase with an auto-unlock keyfile for the provisioning window; first-boot setup
|
||||
# re-keys it to the new owner's password and removes the keyfile.
|
||||
#
|
||||
# Honest limitations:
|
||||
# - On unencrypted disks this is deletion, not forensic erasure. fstrim helps
|
||||
# on SSDs; use blkdiscard + a reinstall if you need certainty.
|
||||
# - LUKS re-keying changes passphrases, not the volume key. Freed extents
|
||||
# remain readable to someone with raw-device access and a valid passphrase.
|
||||
# Use cryptsetup reencrypt or a reinstall if you need certainty.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROVISIONING_DIR=/var/lib/omarchy/provisioning
|
||||
OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
|
||||
TOP_MNT=/run/omarchy-system-factory-reset/top
|
||||
NEXT_NAME=@omarchy-reset-next
|
||||
LOG_FILE=/var/log/omarchy-system-factory-reset.log
|
||||
|
||||
# Self-elevate so the menu entry (and a bare shell invocation) need no sudo
|
||||
# prefix. The caller's gum theme vars are forwarded as `env` arguments rather
|
||||
# than via `sudo -E`, so styling survives even under an env_reset sudoers.
|
||||
if (( EUID != 0 )); then
|
||||
mapfile -t gum_env < <(env | grep '^GUM_' || true)
|
||||
exec sudo env "${gum_env[@]}" "$0" "$@"
|
||||
fi
|
||||
|
||||
export PATH="$OMARCHY_PATH/bin:$PATH"
|
||||
|
||||
log() {
|
||||
echo "$1" | tee -a "$LOG_FILE" >/dev/null
|
||||
gum style --foreground 8 " $1"
|
||||
}
|
||||
|
||||
fail() {
|
||||
gum style --foreground 1 "Error: $1"
|
||||
exit 1
|
||||
}
|
||||
|
||||
root_device() {
|
||||
findmnt -no SOURCE / | sed 's/\[.*\]//'
|
||||
}
|
||||
|
||||
root_is_btrfs_at() {
|
||||
[[ $(findmnt -no FSTYPE /) == btrfs ]] && findmnt -no OPTIONS / | grep -q "subvol=/@\(,\|$\)"
|
||||
}
|
||||
|
||||
# Resolve the crypto_LUKS partition backing the root, or return non-zero if
|
||||
# the root is not on LUKS. Prefers the cmdline cryptdevice= spec (archinstall
|
||||
# writes PARTUUID=, the pre-mounted path UUID=), and falls back to walking the
|
||||
# device tree for roots reached via rd.luks/crypttab with a plain /dev/mapper
|
||||
# root and no cryptdevice=.
|
||||
luks_device() {
|
||||
local spec
|
||||
spec=$(grep -o 'cryptdevice=[^ :]*' /proc/cmdline | head -1 | cut -d= -f2-)
|
||||
case $spec in
|
||||
UUID=*) echo "/dev/disk/by-uuid/${spec#UUID=}"; return 0 ;;
|
||||
PARTUUID=*) echo "/dev/disk/by-partuuid/${spec#PARTUUID=}"; return 0 ;;
|
||||
LABEL=*) echo "/dev/disk/by-label/${spec#LABEL=}"; return 0 ;;
|
||||
PARTLABEL=*) echo "/dev/disk/by-partlabel/${spec#PARTLABEL=}"; return 0 ;;
|
||||
/dev/*) echo "$spec"; return 0 ;;
|
||||
esac
|
||||
|
||||
local src part
|
||||
src=$(findmnt -no SOURCE / | sed 's/\[.*//')
|
||||
[[ -n $src ]] || return 1
|
||||
part=$(lsblk -nspo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
|
||||
[[ -n $part ]] && { echo "$part"; return 0; }
|
||||
return 1
|
||||
}
|
||||
|
||||
encrypted_install() {
|
||||
luks_device >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# No trailing `| head` stage: under pipefail an infinite tr killed by
|
||||
# SIGPIPE fails the substitution and errexit aborts the whole reset.
|
||||
generate_passphrase() {
|
||||
local raw
|
||||
raw=$(head -c 4096 /dev/urandom | tr -dc 'a-zA-Z0-9')
|
||||
printf '%s' "${raw:0:48}"
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
if (( ${swap_done:-0} == 0 )); then
|
||||
rollback_degraded_rekey
|
||||
fi
|
||||
if mountpoint -q "$TOP_MNT" 2>/dev/null; then
|
||||
if [[ -d $TOP_MNT/$NEXT_NAME && ${swap_done:-0} == 0 ]]; then
|
||||
btrfs subvolume delete --recursive "$TOP_MNT/$NEXT_NAME" >/dev/null 2>&1 || true
|
||||
fi
|
||||
umount -R "$TOP_MNT" 2>/dev/null || true
|
||||
fi
|
||||
rmdir "$TOP_MNT" 2>/dev/null || true
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
confirm_reset() {
|
||||
local degraded="$1"
|
||||
|
||||
echo
|
||||
gum style --bold --foreground 1 "Reset this computer to factory state?"
|
||||
echo
|
||||
gum style "This will permanently erase:"
|
||||
gum style " • All user accounts and everything in /home"
|
||||
if [[ $degraded == true ]]; then
|
||||
gum style --foreground 3 " • Machine identity (network connections, host keys, machine-id)"
|
||||
echo
|
||||
gum style --foreground 3 "This machine was installed before factory snapshots existed, so the"
|
||||
gum style --foreground 3 "current system (installed packages, /etc changes) is kept — only user"
|
||||
gum style --foreground 3 "accounts and machine state are wiped."
|
||||
else
|
||||
gum style " • All packages and system changes made since installation"
|
||||
gum style " • Machine identity (network connections, host keys, machine-id)"
|
||||
fi
|
||||
echo
|
||||
gum style "The next boot asks for a new user, exactly like a fresh install."
|
||||
gum style --foreground 8 "Note: on disks without encryption this is deletion, not secure erasure."
|
||||
echo
|
||||
|
||||
local typed
|
||||
typed=$(gum input --placeholder "Type 'reset' to continue" --prompt "> ") || exit 1
|
||||
[[ $typed == "reset" ]] || fail "Reset not confirmed."
|
||||
}
|
||||
|
||||
# Re-key to a throwaway passphrase whose keyfile auto-unlocks boot during the
|
||||
# provisioning window. $1 is the root of the system the staging applies to ("" for the
|
||||
# running root in degraded mode).
|
||||
stage_luks_rekey() {
|
||||
local next="$1" device passphrase
|
||||
|
||||
device=$(luks_device) || fail "encrypted install, but no usable cryptdevice= in /proc/cmdline"
|
||||
[[ -e $device ]] || fail "LUKS device $device not found"
|
||||
|
||||
echo
|
||||
gum style "Confirm your disk encryption passphrase to authorize the re-key."
|
||||
local current
|
||||
while true; do
|
||||
current=$(gum input --password --placeholder "Current disk encryption passphrase" --prompt "Passphrase> ") || exit 1
|
||||
if cryptsetup open --test-passphrase --key-file <(printf '%s' "$current") "$device" 2>/dev/null; then
|
||||
break
|
||||
fi
|
||||
gum style --foreground 1 "That passphrase does not unlock $device. Try again."
|
||||
done
|
||||
|
||||
passphrase=$(generate_passphrase)
|
||||
cryptsetup luksAddKey --key-file <(printf '%s' "$current") "$device" <(printf '%s' "$passphrase")
|
||||
|
||||
install -d -m 755 "$next$PROVISIONING_DIR"
|
||||
printf '%s' "$passphrase" >"$next$PROVISIONING_DIR/luks-key"
|
||||
chmod 600 "$next$PROVISIONING_DIR/luks-key"
|
||||
|
||||
install -d -m 755 "$next/etc/omarchy"
|
||||
printf '%s' "$passphrase" >"$next/etc/omarchy/provisioning.key"
|
||||
chmod 600 "$next/etc/omarchy/provisioning.key"
|
||||
|
||||
install -d "$next/etc/limine-entry-tool.d" "$next/etc/mkinitcpio.conf.d"
|
||||
echo 'KERNEL_CMDLINE[default]+=" cryptkey=rootfs:/etc/omarchy/provisioning.key"' \
|
||||
>"$next/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf"
|
||||
echo 'FILES+=(/etc/omarchy/provisioning.key)' \
|
||||
>"$next/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf"
|
||||
}
|
||||
|
||||
install_provisioning_units() {
|
||||
local next="$1" unit_src="$2"
|
||||
|
||||
install -Dm644 "$unit_src/omarchy-provision-owner.service" \
|
||||
"$next/etc/systemd/system/omarchy-provision-owner.service"
|
||||
install -Dm644 "$unit_src/omarchy-system-factory-reset-finish.service" \
|
||||
"$next/etc/systemd/system/omarchy-system-factory-reset-finish.service"
|
||||
|
||||
install -d "$next/etc/systemd/system/multi-user.target.wants" \
|
||||
"$next/etc/systemd/system/sysinit.target.wants"
|
||||
ln -sf /etc/systemd/system/omarchy-provision-owner.service \
|
||||
"$next/etc/systemd/system/multi-user.target.wants/omarchy-provision-owner.service"
|
||||
ln -sf /etc/systemd/system/omarchy-system-factory-reset-finish.service \
|
||||
"$next/etc/systemd/system/sysinit.target.wants/omarchy-system-factory-reset-finish.service"
|
||||
}
|
||||
|
||||
# Start the ESP's limine.conf over from the shipped template and drop the
|
||||
# previous Omarchy identity's state. limine-entry-tool keys OS entries by
|
||||
# machine-id, so after a reset gives the machine a fresh identity, the
|
||||
# previous system's entry (with the now-stale UKI hash) would survive, sort
|
||||
# first, and make Limine refuse the rebuilt UKI with a hash-mismatch warning.
|
||||
# Only machine-ids the old limine.conf referenced are removed — a shared ESP
|
||||
# may hold other installations' machine-id directories.
|
||||
reset_limine_config() {
|
||||
local root="$1" esp="$2" template found=""
|
||||
|
||||
local old_ids=""
|
||||
if [[ -f $root$esp/limine.conf ]]; then
|
||||
old_ids=$(grep -o 'machine-id=[0-9a-f]\{32\}' "$root$esp/limine.conf" | cut -d= -f2 | sort -u)
|
||||
fi
|
||||
|
||||
for template in "$root/usr/share/omarchy/install/assets/limine/limine.conf" \
|
||||
"$root/usr/share/omarchy/default/limine/limine.conf"; do
|
||||
if [[ -f $template ]]; then
|
||||
cp "$template" "$root$esp/limine.conf"
|
||||
found=1
|
||||
break
|
||||
fi
|
||||
done
|
||||
[[ -n $found ]] || fail "no limine.conf template in $root/usr/share/omarchy"
|
||||
|
||||
local machine_id old_id
|
||||
machine_id=$(cat "$root/etc/machine-id" 2>/dev/null || true)
|
||||
for old_id in $old_ids; do
|
||||
[[ $old_id == "$machine_id" ]] && continue
|
||||
rm -rf "${root:?}$esp/$old_id"
|
||||
done
|
||||
}
|
||||
|
||||
# Every UKI entry in limine.conf carries a #blake2b hash of the file it
|
||||
# points at; a mismatch makes Limine stop at a scary warning. Never hand over
|
||||
# a staged reset in that state.
|
||||
verify_limine_hashes() {
|
||||
local root="$1" esp="$2" line path hash file
|
||||
while IFS= read -r line; do
|
||||
path=${line#*boot():}
|
||||
path=${path%%#*}
|
||||
hash=${line##*#}
|
||||
file="$root$esp$path"
|
||||
[[ -f $file ]] || fail "limine.conf points at missing $path"
|
||||
[[ $(b2sum "$file" | cut -d' ' -f1) == "$hash" ]] ||
|
||||
fail "limine.conf hash for $path does not match the rebuilt file"
|
||||
done < <(grep -o 'boot():/EFI/Linux/[^#]*#[0-9a-f]*' "$root$esp/limine.conf")
|
||||
}
|
||||
|
||||
# Rebuild the UKI from inside the next root so the deployed kernel/initramfs
|
||||
# match the factory root's modules (the seller may have updated kernels since
|
||||
# install) and embed the auto-unlock keyfile on encrypted machines.
|
||||
rebuild_next_boot() {
|
||||
local next="$1"
|
||||
|
||||
local esp_source esp_mount
|
||||
esp_mount=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $2; exit }' "$next/etc/fstab")
|
||||
esp_source=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $1; exit }' "$next/etc/fstab")
|
||||
[[ -n $esp_mount && -n $esp_source ]] || fail "could not find the ESP in $next/etc/fstab"
|
||||
|
||||
local esp_device=$esp_source
|
||||
if [[ $esp_source == UUID=* ]]; then
|
||||
esp_device="/dev/disk/by-uuid/${esp_source#UUID=}"
|
||||
fi
|
||||
[[ -e $esp_device ]] || fail "ESP device $esp_device not found"
|
||||
|
||||
mount "$esp_device" "$next$esp_mount"
|
||||
|
||||
local dir
|
||||
for dir in proc sys dev run; do
|
||||
mount --rbind "/$dir" "$next/$dir"
|
||||
mount --make-rslave "$next/$dir"
|
||||
done
|
||||
|
||||
# Btrfs snapshots do not recurse into nested subvolumes, so the factory
|
||||
# root carries only an empty /swap directory where the hibernation swapfile
|
||||
# lived. Recreate it and refresh the resume offset before the UKI build
|
||||
# bakes the cmdline; the empty placeholder directory has to go first so the
|
||||
# subvolume can be recreated.
|
||||
if [[ -x $next/usr/bin/omarchy-hibernation-setup ]] && grep -q "/swap/swapfile" "$next/etc/fstab"; then
|
||||
log "Recreating the hibernation swapfile in the factory system"
|
||||
if [[ -d $next/swap ]] && ! btrfs subvolume show "$next/swap" >/dev/null 2>&1; then
|
||||
rmdir "$next/swap" 2>/dev/null || true
|
||||
fi
|
||||
# The factory root still carries the resume drop-ins from install, which
|
||||
# make hibernation-setup conclude it has nothing to do; with the swapfile
|
||||
# gone they must go so it reconfigures from scratch. The resume-offset
|
||||
# drop-in especially: hibernation-setup only recomputes the physical
|
||||
# offset when it is absent, so a surviving one bakes the old swapfile's
|
||||
# offset into the rebuilt UKI and breaks resume.
|
||||
if [[ ! -f $next/swap/swapfile ]]; then
|
||||
rm -f "$next/etc/mkinitcpio.conf.d/omarchy_resume.conf" \
|
||||
"$next/etc/limine-entry-tool.d/resume.conf"
|
||||
fi
|
||||
if ! chroot "$next" env OMARCHY_PATH=/usr/share/omarchy \
|
||||
/usr/bin/omarchy-hibernation-setup --force --no-rebuild >>"$LOG_FILE" 2>&1; then
|
||||
fail "hibernation setup failed in the factory root (see $LOG_FILE)"
|
||||
fi
|
||||
[[ -f $next/swap/swapfile ]] ||
|
||||
fail "hibernation setup did not recreate $next/swap/swapfile (see $LOG_FILE)"
|
||||
fi
|
||||
|
||||
reset_limine_config "$next" "$esp_mount"
|
||||
|
||||
log "Rebuilding boot files from the factory system (this can take a minute)"
|
||||
if ! chroot "$next" /usr/bin/limine-update >>"$LOG_FILE" 2>&1; then
|
||||
fail "limine-update failed in the factory root (see $LOG_FILE)"
|
||||
fi
|
||||
|
||||
verify_limine_hashes "$next" "$esp_mount"
|
||||
|
||||
for dir in run dev sys proc; do
|
||||
umount -R "$next/$dir" 2>/dev/null || true
|
||||
done
|
||||
umount "$next$esp_mount"
|
||||
}
|
||||
|
||||
# Remove the seller's account material and machine identity from the retained
|
||||
# @factory baseline so it can neither be mounted for recovery nor restore the
|
||||
# seller's account on a future reset. Idempotent (a scrubbed baseline has no
|
||||
# uid>=1000 accounts left to remove).
|
||||
sanitize_factory_baseline() {
|
||||
local factory="$1" user
|
||||
btrfs property set -ts "$factory" ro false
|
||||
|
||||
for user in $(awk -F: '$3 >= 1000 && $3 < 60000 { print $1 }' "$factory/etc/passwd"); do
|
||||
userdel --root "$factory" "$user" 2>>"$LOG_FILE" || true
|
||||
rm -rf "${factory:?}/home/$user"
|
||||
done
|
||||
passwd --root "$factory" --lock root >>"$LOG_FILE" 2>&1 || true
|
||||
rm -f "$factory"/etc/ssh/ssh_host_*
|
||||
rm -f "$factory"/etc/NetworkManager/system-connections/*
|
||||
rm -rf "$factory"/var/lib/NetworkManager/* "$factory/var/lib/tailscale" "$factory/var/lib/iwd"
|
||||
rm -f "$factory/var/lib/sddm/state.conf" "$factory/etc/sddm.conf.d/autologin.conf"
|
||||
: >"$factory/etc/machine-id"
|
||||
|
||||
btrfs property set -ts "$factory" ro true
|
||||
}
|
||||
|
||||
stage_full_reset() {
|
||||
local top="$TOP_MNT" next="$TOP_MNT/$NEXT_NAME"
|
||||
|
||||
log "Cloning the factory snapshot"
|
||||
[[ -d $next ]] && btrfs subvolume delete --recursive "$next" >/dev/null
|
||||
btrfs subvolume snapshot "$top/@factory" "$next" >>"$LOG_FILE"
|
||||
|
||||
local unit_src="$next/usr/share/omarchy/install/provisioning"
|
||||
[[ -f $unit_src/omarchy-provision-owner.service && -x $next/usr/bin/omarchy-provision-owner ]] ||
|
||||
fail "the factory snapshot predates provisioning support; cannot reset from it"
|
||||
|
||||
log "Scrubbing machine identity from the factory system"
|
||||
systemd-id128 new >"$next/etc/machine-id"
|
||||
rm -f "$next"/etc/ssh/ssh_host_*
|
||||
rm -f "$next"/etc/NetworkManager/system-connections/*
|
||||
rm -rf "$next"/var/lib/NetworkManager/* "$next/var/lib/tailscale" "$next/var/lib/iwd"
|
||||
rm -f "$next/var/lib/sddm/state.conf" "$next/etc/sddm.conf.d/autologin.conf"
|
||||
|
||||
# A factory snapshot from a normal (normal) install contains the original
|
||||
# user account; first-boot setup must start from none. A leftover account
|
||||
# would keep its password hash and group memberships (including wheel), so
|
||||
# failure here has to abort the reset, not be shrugged off.
|
||||
local user
|
||||
for user in $(awk -F: '$3 >= 1000 && $3 < 60000 { print $1 }' "$next/etc/passwd"); do
|
||||
log "Removing user $user from the factory system"
|
||||
userdel --root "$next" "$user" 2>>"$LOG_FILE" ||
|
||||
fail "could not remove user $user from the factory system (see $LOG_FILE)"
|
||||
done
|
||||
passwd --root "$next" --lock root >>"$LOG_FILE" 2>&1 || true
|
||||
|
||||
# @factory itself survives the wipe as the baseline for future resets. If it
|
||||
# came from a normal install it still holds the seller's account and
|
||||
# /etc/shadow, which the new wheel user could mount and read — and a second
|
||||
# reset would restore that account. Scrub it once, in place.
|
||||
sanitize_factory_baseline "$top/@factory"
|
||||
|
||||
# Keep the Node tarball reachable for offline first-boot finalization.
|
||||
if ! compgen -G "$next$PROVISIONING_DIR/packages/node-v*.tar.gz" >/dev/null; then
|
||||
if compgen -G "$PROVISIONING_DIR/packages/node-v*.tar.gz" >/dev/null; then
|
||||
install -d -m 755 "$next$PROVISIONING_DIR/packages"
|
||||
cp "$PROVISIONING_DIR"/packages/node-v*.tar.gz "$next$PROVISIONING_DIR/packages/"
|
||||
fi
|
||||
fi
|
||||
|
||||
install -d -m 755 "$next$PROVISIONING_DIR"
|
||||
touch "$next$PROVISIONING_DIR/pending" "$next$PROVISIONING_DIR/wipe-pending"
|
||||
|
||||
install_provisioning_units "$next" "$unit_src"
|
||||
|
||||
if encrypted_install; then
|
||||
stage_luks_rekey "$next"
|
||||
fi
|
||||
|
||||
rebuild_next_boot "$next"
|
||||
|
||||
log "Activating the factory system"
|
||||
local old="@omarchy-old-$(date +%s)"
|
||||
mv "$top/@" "$top/$old"
|
||||
mv "$next" "$top/@"
|
||||
swap_done=1
|
||||
sync
|
||||
}
|
||||
|
||||
stage_degraded_reset() {
|
||||
local unit_src="$OMARCHY_PATH/install/provisioning"
|
||||
[[ -f $unit_src/omarchy-provision-owner.service && -x /usr/bin/omarchy-provision-owner ]] ||
|
||||
fail "this Omarchy version does not ship provisioning; update first"
|
||||
|
||||
# Fallible staging (re-key, boot rebuild) happens before the wipe is armed:
|
||||
# a failure must leave the machine untouched, not schedule a wipe for a
|
||||
# reset that never finished staging. The degraded path stages into the LIVE
|
||||
# root, so a mid-staging failure must also undo the auto-unlock material it
|
||||
# already wrote — otherwise a later boot rebuild would silently embed it.
|
||||
install -d -m 755 "$PROVISIONING_DIR"
|
||||
if encrypted_install; then
|
||||
degraded_rekey_staged=1
|
||||
stage_luks_rekey ""
|
||||
log "Rebuilding boot files with the provisioning unlock key"
|
||||
if ! limine-update >>"$LOG_FILE" 2>&1; then
|
||||
fail "limine-update failed (see $LOG_FILE)"
|
||||
fi
|
||||
degraded_rekey_staged=0
|
||||
fi
|
||||
|
||||
install_provisioning_units "" "$unit_src"
|
||||
touch "$PROVISIONING_DIR/pending" "$PROVISIONING_DIR/wipe-pending" "$PROVISIONING_DIR/wipe-degraded"
|
||||
|
||||
swap_done=1
|
||||
}
|
||||
|
||||
# Undo the live-root auto-unlock material a failed degraded rekey left behind.
|
||||
rollback_degraded_rekey() {
|
||||
(( ${degraded_rekey_staged:-0} )) || return 0
|
||||
rm -f /etc/omarchy/provisioning.key "$PROVISIONING_DIR/luks-key" \
|
||||
/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf \
|
||||
/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
|
||||
limine-update >>"$LOG_FILE" 2>&1 || true
|
||||
}
|
||||
|
||||
main() {
|
||||
command -v gum >/dev/null || { echo "Error: gum is required" >&2; exit 1; }
|
||||
command -v btrfs >/dev/null || { echo "Error: btrfs-progs is required" >&2; exit 1; }
|
||||
|
||||
root_is_btrfs_at || fail "reset requires the standard Omarchy Btrfs layout (subvol=@)"
|
||||
|
||||
touch "$LOG_FILE"
|
||||
chmod 600 "$LOG_FILE"
|
||||
swap_done=0
|
||||
|
||||
local device
|
||||
device=$(root_device)
|
||||
[[ -n $device ]] || fail "could not determine the root device"
|
||||
|
||||
mkdir -p "$TOP_MNT"
|
||||
mountpoint -q "$TOP_MNT" || mount -o subvolid=5 "$device" "$TOP_MNT"
|
||||
|
||||
local degraded=false
|
||||
[[ -d $TOP_MNT/@factory ]] || degraded=true
|
||||
|
||||
confirm_reset "$degraded"
|
||||
|
||||
# The running system's limine-snapper-sync must not rewrite the ESP's
|
||||
# limine.conf behind the staged rebuild (subvolume changes below can
|
||||
# trigger it). The runtime mask evaporates on the reboot that follows.
|
||||
systemctl mask --runtime --now limine-snapper-sync.service >/dev/null 2>&1 || true
|
||||
systemctl mask --runtime --now limine-snapper-sync.path >/dev/null 2>&1 || true
|
||||
|
||||
if [[ $degraded == true ]]; then
|
||||
stage_degraded_reset
|
||||
else
|
||||
stage_full_reset
|
||||
fi
|
||||
|
||||
umount -R "$TOP_MNT" 2>/dev/null || true
|
||||
|
||||
echo
|
||||
gum style --bold "Reset staged. The wipe finishes on the next boot."
|
||||
if gum confirm --affirmative "Reboot now" --negative "Reboot later" "Reboot to complete the reset?"; then
|
||||
systemctl reboot
|
||||
else
|
||||
gum style --foreground 3 "Do not keep using this machine — changes made now will be lost."
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Executable
+171
@@ -0,0 +1,171 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=First-boot worker that finishes an omarchy-system-factory-reset reset
|
||||
# omarchy:group=setup
|
||||
# omarchy:requires-sudo=true
|
||||
# omarchy:examples=omarchy-system-factory-reset-finish
|
||||
|
||||
# Runs once, early on the first boot after omarchy-system-factory-reset, via
|
||||
# omarchy-system-factory-reset-finish.service (armed by /var/lib/omarchy/provisioning/wipe-pending).
|
||||
# Ordered before home.mount/var-log.mount so @home and @log can be dropped and
|
||||
# recreated as empty subvolumes instead of rm -rf'd file by file.
|
||||
#
|
||||
# Two modes:
|
||||
# - full reset: the root is already a fresh clone of @factory (staged by
|
||||
# omarchy-system-factory-reset); this deletes the previous root (@omarchy-old-*),
|
||||
# recreates @home/@log, and repairs /.snapshots.
|
||||
# - degraded (wipe-degraded marker): machines installed before @factory
|
||||
# existed keep their current root; user accounts and identity state are
|
||||
# scrubbed here instead.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
PROVISIONING_DIR=/var/lib/omarchy/provisioning
|
||||
TOP_MNT=/run/omarchy-system-factory-reset-finish-top
|
||||
|
||||
[[ -f $PROVISIONING_DIR/wipe-pending ]] || exit 0
|
||||
|
||||
if (( EUID != 0 )); then
|
||||
echo "Error: omarchy-system-factory-reset-finish must run as root" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# This runs before var-log.mount, so a log file under /var/log would be
|
||||
# shadowed (and @log is recreated below anyway). stdout goes to the journal,
|
||||
# which is volatile in /run this early and flushed into the fresh @log later.
|
||||
echo "=== Omarchy factory wipe started: $(date '+%Y-%m-%d %H:%M:%S') ==="
|
||||
|
||||
log() {
|
||||
echo "factory-wipe: $1"
|
||||
}
|
||||
|
||||
root_device() {
|
||||
findmnt -no SOURCE / | sed 's/\[.*\]//'
|
||||
}
|
||||
|
||||
abort() {
|
||||
# Keep wipe-pending so the wipe retries next boot, and so provisioning stays
|
||||
# gated (it refuses to create a user on a half-wiped system).
|
||||
log "$1 — aborting; the wipe will retry on the next boot"
|
||||
umount "$TOP_MNT" 2>/dev/null || true
|
||||
rmdir "$TOP_MNT" 2>/dev/null || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
delete_subvolume() {
|
||||
local path="$1"
|
||||
[[ -d $path ]] || return 0
|
||||
|
||||
if ! btrfs subvolume delete --recursive "$path" 2>/dev/null; then
|
||||
# Older btrfs-progs without --recursive: delete nested subvolumes deepest
|
||||
# first, then the subvolume itself.
|
||||
local nested
|
||||
nested=$(btrfs subvolume list -o "$path" 2>/dev/null | awk '{print $NF}')
|
||||
if [[ -n $nested ]]; then
|
||||
local sub
|
||||
while IFS= read -r sub; do
|
||||
delete_subvolume "$TOP_MNT/${sub#<FS_TREE>/}"
|
||||
done <<<"$nested"
|
||||
fi
|
||||
btrfs subvolume delete "$path"
|
||||
fi
|
||||
}
|
||||
|
||||
recreate_subvolume() {
|
||||
local name="$1"
|
||||
delete_subvolume "$TOP_MNT/$name"
|
||||
btrfs subvolume create "$TOP_MNT/$name"
|
||||
}
|
||||
|
||||
scrub_degraded_state() {
|
||||
log "degraded reset: scrubbing user accounts and machine identity in place"
|
||||
|
||||
local user
|
||||
for user in $(awk -F: '$3 >= 1000 && $3 < 60000 { print $1 }' /etc/passwd); do
|
||||
log "removing user $user"
|
||||
rm -rf "/var/lib/fprint/$user" # enrolled fingerprints outlive userdel
|
||||
userdel "$user" 2>/dev/null || abort "could not remove user $user"
|
||||
done
|
||||
|
||||
rm -f /etc/ssh/ssh_host_*
|
||||
rm -f /etc/NetworkManager/system-connections/*
|
||||
rm -rf /var/lib/NetworkManager/* /var/lib/tailscale /var/lib/iwd
|
||||
rm -f /var/lib/sddm/state.conf /etc/sddm.conf.d/autologin.conf
|
||||
|
||||
# Fresh machine identity from the next boot on.
|
||||
systemd-id128 new >/etc/machine-id 2>/dev/null || :>/etc/machine-id
|
||||
}
|
||||
|
||||
repair_snapshots_dir() {
|
||||
# A snapshot of @ carries /.snapshots only as a plain empty directory
|
||||
# (nested subvolumes are not part of snapshots). Snapper needs it to be a
|
||||
# subvolume again.
|
||||
if [[ -d /.snapshots ]] && ! btrfs subvolume show /.snapshots >/dev/null 2>&1; then
|
||||
rm -rf /.snapshots
|
||||
fi
|
||||
if [[ ! -d /.snapshots ]]; then
|
||||
btrfs subvolume create /.snapshots
|
||||
chmod 750 /.snapshots
|
||||
fi
|
||||
}
|
||||
|
||||
wipe_snapper_snapshots() {
|
||||
# Degraded resets keep the current root, so its accumulated snapper
|
||||
# snapshots (nested under /.snapshots) still exist. Full resets already lost
|
||||
# them with the old root.
|
||||
local snapshot
|
||||
for snapshot in /.snapshots/*/snapshot; do
|
||||
[[ -d $snapshot ]] || continue
|
||||
delete_subvolume "$snapshot"
|
||||
rm -rf "$(dirname "$snapshot")"
|
||||
done
|
||||
}
|
||||
|
||||
main() {
|
||||
local device
|
||||
device=$(root_device)
|
||||
if [[ -z $device ]]; then
|
||||
log "could not determine the btrfs root device; aborting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$TOP_MNT"
|
||||
if ! mount -o subvolid=5 "$device" "$TOP_MNT"; then
|
||||
log "could not mount the btrfs top level from $device; aborting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -f $PROVISIONING_DIR/wipe-degraded ]]; then
|
||||
scrub_degraded_state
|
||||
wipe_snapper_snapshots
|
||||
fi
|
||||
|
||||
local old
|
||||
for old in "$TOP_MNT"/@omarchy-old-*; do
|
||||
[[ -d $old ]] || continue
|
||||
log "deleting previous system root $(basename "$old")"
|
||||
delete_subvolume "$old" || abort "could not delete $(basename "$old")"
|
||||
done
|
||||
|
||||
# A wipe that cannot recreate @home has not wiped anything — the seller's
|
||||
# data would survive a "successful" factory reset.
|
||||
log "recreating @home and @log"
|
||||
recreate_subvolume @home || abort "could not recreate @home"
|
||||
recreate_subvolume @log || abort "could not recreate @log"
|
||||
|
||||
repair_snapshots_dir
|
||||
|
||||
umount "$TOP_MNT"
|
||||
rmdir "$TOP_MNT" 2>/dev/null || true
|
||||
|
||||
log "trimming free space"
|
||||
fstrim -a 2>/dev/null || true
|
||||
|
||||
rm -f "$PROVISIONING_DIR/wipe-pending" "$PROVISIONING_DIR/wipe-degraded"
|
||||
rm -f /etc/systemd/system/sysinit.target.wants/omarchy-system-factory-reset-finish.service
|
||||
rm -f /etc/systemd/system/omarchy-system-factory-reset-finish.service
|
||||
|
||||
log "factory wipe complete"
|
||||
}
|
||||
|
||||
main
|
||||
@@ -4,7 +4,7 @@ hl.on("hyprland.start", function()
|
||||
hl.exec_cmd("dbus-update-activation-environment --systemd --all")
|
||||
|
||||
hl.exec_cmd("omarchy-launch-shell")
|
||||
hl.exec_cmd("omarchy-first-run")
|
||||
hl.exec_cmd("omarchy-provision-first-run")
|
||||
hl.exec_cmd("omarchy-powerprofiles-init")
|
||||
hl.exec_cmd(o.launch("omarchy-hyprland-monitor-watch"))
|
||||
hl.exec_cmd(o.launch("udiskie --automount --no-notify --no-tray"))
|
||||
|
||||
@@ -173,6 +173,7 @@
|
||||
"setup.config.hyprsunset": {"icon":"","label":"Hyprsunset","action":"omarchy-launch-config-editor ~/.config/hypr/hyprsunset.conf && omarchy-restart-hyprsunset"},
|
||||
"setup.config.xcompose": {"icon":"","label":"XCompose","action":"omarchy-launch-config-editor ~/.XCompose && omarchy-restart-xcompose"},
|
||||
"setup.direct-boot": {"icon":"","label":"Direct Boot","action":"omarchy-launch-floating-terminal-with-presentation omarchy-setup-direct-boot"},
|
||||
"setup.reset": {"icon":"","label":"Reset Computer","when":"[[ $(findmnt -no FSTYPE /) == btrfs ]]","action":"omarchy-launch-floating-terminal-with-presentation omarchy-system-factory-reset"},
|
||||
|
||||
// Install
|
||||
"install.package": {"icon":"","label":"Package","action":"xdg-terminal-exec --app-id=org.omarchy.terminal omarchy-pkg-install"},
|
||||
|
||||
+1
-1
@@ -219,7 +219,7 @@ files are missing. `omarchy update` runs `omarchy-migrate` after the package
|
||||
transaction in the already-visible update terminal, then runs
|
||||
`omarchy-hook post-update`.
|
||||
|
||||
## First-run (`omarchy-first-run`)
|
||||
## First-run (`omarchy-provision-first-run`)
|
||||
|
||||
Runs once on first interactive login, after the user manager is live. Used
|
||||
for steps that need a running graphical session and/or a working user
|
||||
|
||||
@@ -186,7 +186,7 @@ lock, silencing migration notifications at every login.
|
||||
|
||||
Fallbacks:
|
||||
|
||||
- `omarchy-first-run` enables `omarchy-migrate-notify.service`, which also
|
||||
- `omarchy-provision-first-run` enables `omarchy-migrate-notify.service`, which also
|
||||
covers users created after install: their per-user migration markers are
|
||||
missing, so their first login prompts them to run every shipped migration.
|
||||
- The package ships `omarchy-update-user-notify.service` as a symlink onto
|
||||
|
||||
@@ -1 +1,10 @@
|
||||
usermod -aG docker "$OMARCHY_INSTALL_USER"
|
||||
# Record the docker group for provisioning first-boot user creation and factory reset,
|
||||
# then grant it directly when the install user already exists (deferred-provisioning
|
||||
# installs create the user at first boot instead).
|
||||
provisioning_dir="${OMARCHY_PROVISIONING_DIR:-/var/lib/omarchy/provisioning}"
|
||||
mkdir -p "$provisioning_dir"
|
||||
grep -qxF docker "$provisioning_dir/groups" 2>/dev/null || echo docker >>"$provisioning_dir/groups"
|
||||
|
||||
if [[ -n ${OMARCHY_INSTALL_USER:-} ]] && getent passwd "$OMARCHY_INSTALL_USER" >/dev/null; then
|
||||
usermod -aG docker "$OMARCHY_INSTALL_USER"
|
||||
fi
|
||||
|
||||
@@ -1,2 +1,11 @@
|
||||
# Give this user privileged input access for dictation tools + xbox controllers to work
|
||||
usermod -aG input "$OMARCHY_INSTALL_USER"
|
||||
# Give this user privileged input access for dictation tools + xbox controllers to work.
|
||||
# Recorded for provisioning first-boot user creation and factory reset, granted directly
|
||||
# when the install user already exists (deferred-provisioning installs create the user at
|
||||
# first boot instead).
|
||||
provisioning_dir="${OMARCHY_PROVISIONING_DIR:-/var/lib/omarchy/provisioning}"
|
||||
mkdir -p "$provisioning_dir"
|
||||
grep -qxF input "$provisioning_dir/groups" 2>/dev/null || echo input >>"$provisioning_dir/groups"
|
||||
|
||||
if [[ -n ${OMARCHY_INSTALL_USER:-} ]] && getent passwd "$OMARCHY_INSTALL_USER" >/dev/null; then
|
||||
usermod -aG input "$OMARCHY_INSTALL_USER"
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
# First-boot provisioning: asks for the user on tty1 before SDDM starts.
|
||||
# Armed by /var/lib/omarchy/provisioning/pending (written by a deferred-provisioning ISO install or
|
||||
# omarchy-system-factory-reset); installed to /etc/systemd/system by whichever of
|
||||
# those staged it. Not shipped enabled — a normal install never runs it.
|
||||
|
||||
# plymouth is dismissed via ExecStartPre rather than ordered against
|
||||
# (plymouth-quit-wait), keeping this unit free of ordering-cycle risk with
|
||||
# display-manager.service.
|
||||
# The wipe-pending condition gates against a failed factory wipe: After= is
|
||||
# ordering only, and running user setup on a half-wiped system would create
|
||||
# the new account on state a wipe retry later deletes. While wipe-pending
|
||||
# remains, setup stays down and the wipe retries on the next boot.
|
||||
[Unit]
|
||||
Description=Omarchy provisioning first-boot user setup
|
||||
ConditionPathExists=/var/lib/omarchy/provisioning/pending
|
||||
ConditionPathExists=!/var/lib/omarchy/provisioning/wipe-pending
|
||||
After=systemd-user-sessions.service omarchy-system-factory-reset-finish.service
|
||||
Before=display-manager.service getty@tty1.service
|
||||
Conflicts=getty@tty1.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStartPre=-/usr/bin/plymouth quit
|
||||
ExecStart=/usr/bin/omarchy-provision-owner
|
||||
StandardInput=tty
|
||||
StandardOutput=tty
|
||||
StandardError=tty
|
||||
TTYPath=/dev/tty1
|
||||
TTYReset=yes
|
||||
TTYVHangup=yes
|
||||
TTYVTDisallocate=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,21 @@
|
||||
# Finishes an omarchy-system-factory-reset reset on the first boot after it: drops
|
||||
# the previous root, recreates @home/@log, and scrubs state. Ordered before
|
||||
# home.mount/var-log.mount so those subvolumes can be deleted and recreated
|
||||
# while unmounted. Armed by /var/lib/omarchy/provisioning/wipe-pending; installed to
|
||||
# /etc/systemd/system by omarchy-system-factory-reset.
|
||||
|
||||
[Unit]
|
||||
Description=Omarchy factory reset wipe
|
||||
DefaultDependencies=no
|
||||
ConditionPathExists=/var/lib/omarchy/provisioning/wipe-pending
|
||||
After=systemd-remount-fs.service
|
||||
Before=sysinit.target home.mount var-log.mount var-cache-pacman-pkg.mount shutdown.target
|
||||
Conflicts=shutdown.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/bin/omarchy-system-factory-reset-finish
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
@@ -9,19 +9,35 @@ EOF
|
||||
|
||||
mise trust ~/Work/.mise.toml
|
||||
|
||||
if [[ ${OMARCHY_SETUP_CONTEXT:-runtime} == "iso-chroot" ]]; then
|
||||
NODE_TARBALL=$(find /opt/packages -name "node-v*-linux-x64.tar.gz" -type f 2>/dev/null | head -n1)
|
||||
# Offline installs unpack the Node tarball bundled by the ISO: from
|
||||
# /opt/packages in the ISO chroot, or from the copy staged in provisioning state when
|
||||
# omarchy-provision-owner finalizes the user at first boot.
|
||||
case ${OMARCHY_SETUP_CONTEXT:-runtime} in
|
||||
iso-chroot) NODE_PACKAGE_DIR=/opt/packages ;;
|
||||
provision-owner) NODE_PACKAGE_DIR=/var/lib/omarchy/provisioning/packages ;;
|
||||
*) NODE_PACKAGE_DIR="" ;;
|
||||
esac
|
||||
|
||||
if [[ -n $NODE_PACKAGE_DIR ]]; then
|
||||
NODE_TARBALL=$(find "$NODE_PACKAGE_DIR" -name "node-v*-linux-x64.tar.gz" -type f 2>/dev/null | head -n1)
|
||||
if [[ -z $NODE_TARBALL ]]; then
|
||||
echo "Error: bundled Node.js tarball missing from /opt/packages" >&2
|
||||
if [[ ${OMARCHY_SETUP_CONTEXT:-} == "provision-owner" ]]; then
|
||||
# A degraded reset on an old install may not have the tarball staged.
|
||||
# Leave Node to the network rather than failing the whole first boot.
|
||||
echo "Warning: no bundled Node.js tarball in $NODE_PACKAGE_DIR; trying the network" >&2
|
||||
mise use -g node@latest || echo "Warning: Node.js install deferred (no network)" >&2
|
||||
else
|
||||
echo "Error: bundled Node.js tarball missing from $NODE_PACKAGE_DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
else
|
||||
NODE_VERSION=$(basename "$NODE_TARBALL" | sed 's/node-v\(.*\)-linux-x64.tar.gz/\1/')
|
||||
NODE_INSTALL_DIR="$HOME/.local/share/mise/installs/node/$NODE_VERSION"
|
||||
|
||||
mkdir -p "$NODE_INSTALL_DIR"
|
||||
tar -xzf "$NODE_TARBALL" --strip-components=1 -C "$NODE_INSTALL_DIR"
|
||||
mise use -g node@"$NODE_VERSION"
|
||||
fi
|
||||
else
|
||||
mise use -g node@latest
|
||||
fi
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
mkdir -p ~/.config/omarchy/themes
|
||||
|
||||
if [[ ! -s $HOME/.local/state/omarchy/current/theme.name ]]; then
|
||||
if [[ ${OMARCHY_SETUP_CONTEXT:-runtime} == "iso-chroot" ]]; then
|
||||
# iso-chroot and provision-owner both run without a live session to notify.
|
||||
if [[ ${OMARCHY_SETUP_CONTEXT:-runtime} != "runtime" ]]; then
|
||||
OMARCHY_THEME_HEADLESS=1 omarchy-theme-set "Tokyo Night"
|
||||
rm -f ~/.config/chromium/SingletonLock # otherwise archiso owns the Chromium singleton
|
||||
else
|
||||
|
||||
@@ -12,20 +12,20 @@ cat >"$mock_bin/omarchy-done" <<'SH'
|
||||
#!/bin/bash
|
||||
[[ $1 == "check" && $2 == "first-run-user" ]]
|
||||
SH
|
||||
cat >"$mock_bin/omarchy-finalize-user" <<'SH'
|
||||
cat >"$mock_bin/omarchy-provision-user" <<'SH'
|
||||
#!/bin/bash
|
||||
touch "$OMARCHY_TEST_FINALIZE_CALLED"
|
||||
SH
|
||||
chmod +x "$mock_bin/omarchy-done" "$mock_bin/omarchy-finalize-user"
|
||||
chmod +x "$mock_bin/omarchy-done" "$mock_bin/omarchy-provision-user"
|
||||
|
||||
finalize_called="$test_tmp/finalize-called"
|
||||
HOME="$test_tmp/home" PATH="$mock_bin:$PATH" OMARCHY_TEST_FINALIZE_CALLED="$finalize_called" \
|
||||
bash "$ROOT/bin/omarchy-first-run" >"$test_tmp/output"
|
||||
bash "$ROOT/bin/omarchy-provision-first-run" >"$test_tmp/output"
|
||||
|
||||
[[ ! -e $finalize_called ]] || fail "completed first-run exits before any setup step"
|
||||
grep -F 'First-run already complete' "$test_tmp/output" >/dev/null || fail "completed first-run reports its lifecycle gate"
|
||||
|
||||
if grep -F 'user-migration-notify-watch-enabled' "$ROOT/bin/omarchy-first-run" >/dev/null; then
|
||||
if grep -F 'user-migration-notify-watch-enabled' "$ROOT/bin/omarchy-provision-first-run" >/dev/null; then
|
||||
fail "first-run does not track the migration watcher separately"
|
||||
fi
|
||||
if grep -F 'skip-first-run-update-notification' "$ROOT/install/user/first-run/wifi.sh" >/dev/null; then
|
||||
|
||||
@@ -180,11 +180,15 @@ assert(
|
||||
defaultById['setup.direct-boot'].action.includes('omarchy-setup-direct-boot'),
|
||||
'menu places Direct Boot directly under Setup'
|
||||
)
|
||||
assert(
|
||||
defaultById['setup.reset'].action.includes('omarchy-system-factory-reset'),
|
||||
'menu exposes Reset Computer under Setup'
|
||||
)
|
||||
const setupEntries = defaultItems.filter(item => item.parent === 'setup')
|
||||
assertEqual(
|
||||
setupEntries[setupEntries.length - 1].id,
|
||||
'setup.direct-boot',
|
||||
'menu lists Direct Boot last under Setup'
|
||||
'setup.reset',
|
||||
'menu lists Reset Computer last under Setup'
|
||||
)
|
||||
const expectedAgents = {
|
||||
pi: { icon: '\ue901', iconFont: 'omarchy', label: 'Pi' },
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# The install scripts that grant group memberships must record them in the provisioning
|
||||
# groups file (for first-boot user creation and factory reset) and only call
|
||||
# usermod when the install user actually exists.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
||||
|
||||
TMPDIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TMPDIR"' EXIT
|
||||
|
||||
export OMARCHY_PROVISIONING_DIR="$TMPDIR/provisioning"
|
||||
|
||||
# Stub getent/usermod: the fake system knows only the user "existing".
|
||||
mkdir -p "$TMPDIR/bin"
|
||||
cat >"$TMPDIR/bin/getent" <<'EOF'
|
||||
#!/bin/bash
|
||||
[[ $1 == passwd && $2 == existing ]] && { echo "existing:x:1000:1000::/home/existing:/bin/bash"; exit 0; }
|
||||
exit 2
|
||||
EOF
|
||||
cat >"$TMPDIR/bin/usermod" <<EOF
|
||||
#!/bin/bash
|
||||
echo "\$@" >>"$TMPDIR/usermod.calls"
|
||||
EOF
|
||||
chmod +x "$TMPDIR/bin/getent" "$TMPDIR/bin/usermod"
|
||||
export PATH="$TMPDIR/bin:$PATH"
|
||||
|
||||
# No install user (deferred-provisioning install): groups recorded, usermod not called.
|
||||
OMARCHY_INSTALL_USER="" bash -eE "$ROOT/install/config/docker.sh"
|
||||
OMARCHY_INSTALL_USER="" bash -eE "$ROOT/install/hardware/input-group.sh"
|
||||
|
||||
[[ -f $OMARCHY_PROVISIONING_DIR/groups ]] || fail "groups file written without an install user"
|
||||
grep -qxF docker "$OMARCHY_PROVISIONING_DIR/groups" || fail "docker group recorded"
|
||||
grep -qxF input "$OMARCHY_PROVISIONING_DIR/groups" || fail "input group recorded"
|
||||
[[ ! -f $TMPDIR/usermod.calls ]] || fail "usermod not called without an install user"
|
||||
pass "deferred provisioning records groups without calling usermod"
|
||||
|
||||
# Missing user (defensive): no usermod either.
|
||||
OMARCHY_INSTALL_USER=ghost bash -eE "$ROOT/install/config/docker.sh"
|
||||
[[ ! -f $TMPDIR/usermod.calls ]] || fail "usermod not called for a missing user"
|
||||
pass "missing install user defers group grants"
|
||||
|
||||
# Re-running never duplicates entries.
|
||||
OMARCHY_INSTALL_USER="" bash -eE "$ROOT/install/config/docker.sh"
|
||||
[[ $(grep -cxF docker "$OMARCHY_PROVISIONING_DIR/groups") == 1 ]] || fail "docker group recorded once"
|
||||
pass "group recording is idempotent"
|
||||
|
||||
# Existing user: usermod applies the groups and the record still lands.
|
||||
OMARCHY_INSTALL_USER=existing bash -eE "$ROOT/install/config/docker.sh"
|
||||
OMARCHY_INSTALL_USER=existing bash -eE "$ROOT/install/hardware/input-group.sh"
|
||||
grep -qx -- "-aG docker existing" "$TMPDIR/usermod.calls" || fail "usermod grants docker to the install user"
|
||||
grep -qx -- "-aG input existing" "$TMPDIR/usermod.calls" || fail "usermod grants input to the install user"
|
||||
pass "existing install user still gets direct group grants"
|
||||
Reference in New Issue
Block a user