From e6e6328db7c25a023aec656420b053c3d8b91bab Mon Sep 17 00:00:00 2001 From: Ryan Hughes Date: Wed, 20 May 2026 14:54:42 -0400 Subject: [PATCH] Add etc/ source tree for package-shipped /etc files This tree is the source for omarchy-settings to install into /etc (for paths Omarchy fully owns) or stage at /usr/share/omarchy/etc-overrides (for paths upstream packages own, which the post_install copies into place). Package-owned drop-ins (no upstream conflict): - etc/docker/daemon.json - etc/systemd/system/docker.service.d/no-block-boot.conf - etc/systemd/resolved.conf.d/20-docker-dns.conf - etc/systemd/resolved.conf.d/10-disable-multicast.conf - etc/systemd/system.conf.d/10-faster-shutdown.conf - etc/systemd/system/user@.service.d/10-faster-shutdown.conf (renamed from .../faster-shutdown.conf for consistency) - etc/systemd/logind.conf.d/10-ignore-power-button.conf (replaces the previous in-place sed-edit of logind.conf) - etc/gnupg/dirmngr.conf - etc/sysctl.d/99-omarchy-sysctl.conf (renamed from the 99-sysctl.conf appendage; a migration cleans up the old path on existing installs) - etc/sysctl.d/90-omarchy-file-watchers.conf - etc/modprobe.d/omarchy-usb-autosuspend.conf (renamed from disable-usb-autosuspend.conf) - etc/sudoers.d/omarchy-asdcontrol (renamed from asdcontrol; $USER -> %wheel for packaging) - etc/sudoers.d/omarchy-tzupdate - etc/sudoers.d/omarchy-passwd-tries (renamed from passwd-tries for namespacing) Etc-overrides (upstream-owned paths; staged by the PKGBUILD at /usr/share/omarchy/etc-overrides/ and cp'd in by post_install): - etc/security/faillock.conf (owned by pam) - etc/nsswitch.conf (owned by filesystem) - etc/cups/cups-browsed.conf (owned by cups-browsed) - etc/plymouth/plymouthd.conf (owned by plymouth) All sudoers files validate with visudo -cf. The install scripts that previously wrote these files are updated or removed in follow-up commits. --- etc/cups/cups-browsed.conf | 4 ++++ etc/docker/daemon.json | 6 ++++++ etc/gnupg/dirmngr.conf | 7 +++++++ etc/modprobe.d/omarchy-usb-autosuspend.conf | 1 + etc/nsswitch.conf | 19 +++++++++++++++++++ etc/plymouth/plymouthd.conf | 2 ++ etc/security/faillock.conf | 7 +++++++ etc/sudoers.d/omarchy-asdcontrol | 1 + etc/sudoers.d/omarchy-passwd-tries | 1 + etc/sudoers.d/omarchy-tzupdate | 1 + etc/sysctl.d/90-omarchy-file-watchers.conf | 3 +++ etc/sysctl.d/99-omarchy-sysctl.conf | 2 ++ .../logind.conf.d/10-ignore-power-button.conf | 2 ++ .../resolved.conf.d/10-disable-multicast.conf | 2 ++ .../resolved.conf.d/20-docker-dns.conf | 2 ++ .../system.conf.d/10-faster-shutdown.conf | 2 ++ .../docker.service.d/no-block-boot.conf | 2 ++ .../user@.service.d/10-faster-shutdown.conf | 2 ++ 18 files changed, 66 insertions(+) create mode 100644 etc/cups/cups-browsed.conf create mode 100644 etc/docker/daemon.json create mode 100644 etc/gnupg/dirmngr.conf create mode 100644 etc/modprobe.d/omarchy-usb-autosuspend.conf create mode 100644 etc/nsswitch.conf create mode 100644 etc/plymouth/plymouthd.conf create mode 100644 etc/security/faillock.conf create mode 100644 etc/sudoers.d/omarchy-asdcontrol create mode 100644 etc/sudoers.d/omarchy-passwd-tries create mode 100644 etc/sudoers.d/omarchy-tzupdate create mode 100644 etc/sysctl.d/90-omarchy-file-watchers.conf create mode 100644 etc/sysctl.d/99-omarchy-sysctl.conf create mode 100644 etc/systemd/logind.conf.d/10-ignore-power-button.conf create mode 100644 etc/systemd/resolved.conf.d/10-disable-multicast.conf create mode 100644 etc/systemd/resolved.conf.d/20-docker-dns.conf create mode 100644 etc/systemd/system.conf.d/10-faster-shutdown.conf create mode 100644 etc/systemd/system/docker.service.d/no-block-boot.conf create mode 100644 etc/systemd/system/user@.service.d/10-faster-shutdown.conf diff --git a/etc/cups/cups-browsed.conf b/etc/cups/cups-browsed.conf new file mode 100644 index 00000000..ed1bdbad --- /dev/null +++ b/etc/cups/cups-browsed.conf @@ -0,0 +1,4 @@ +# Omarchy override of cups-browsed's shipped config. The only behavioural +# change vs the upstream default (all-commented) is enabling auto-registration +# of remote IPP printers discovered via Avahi/mDNS. +CreateRemotePrinters Yes diff --git a/etc/docker/daemon.json b/etc/docker/daemon.json new file mode 100644 index 00000000..f1097647 --- /dev/null +++ b/etc/docker/daemon.json @@ -0,0 +1,6 @@ +{ + "log-driver": "json-file", + "log-opts": { "max-size": "10m", "max-file": "5" }, + "dns": ["172.17.0.1"], + "bip": "172.17.0.1/16" +} diff --git a/etc/gnupg/dirmngr.conf b/etc/gnupg/dirmngr.conf new file mode 100644 index 00000000..8d327907 --- /dev/null +++ b/etc/gnupg/dirmngr.conf @@ -0,0 +1,7 @@ +keyserver hkps://keyserver.ubuntu.com +keyserver hkps://pgp.surfnet.nl +keyserver hkps://keys.mailvelope.com +keyserver hkps://keyring.debian.org +keyserver hkps://pgp.mit.edu + +connect-quick-timeout 4 diff --git a/etc/modprobe.d/omarchy-usb-autosuspend.conf b/etc/modprobe.d/omarchy-usb-autosuspend.conf new file mode 100644 index 00000000..b66d637e --- /dev/null +++ b/etc/modprobe.d/omarchy-usb-autosuspend.conf @@ -0,0 +1 @@ +options usbcore autosuspend=-1 diff --git a/etc/nsswitch.conf b/etc/nsswitch.conf new file mode 100644 index 00000000..15b6555d --- /dev/null +++ b/etc/nsswitch.conf @@ -0,0 +1,19 @@ +# Name Service Switch configuration file. +# See nsswitch.conf(5) for details. + +passwd: files systemd +group: files [SUCCESS=merge] systemd +shadow: files systemd +gshadow: files systemd + +publickey: files + +hosts: mymachines mdns_minimal [NOTFOUND=return] resolve files myhostname dns +networks: files + +protocols: files +services: files +ethers: files +rpc: files + +netgroup: files diff --git a/etc/plymouth/plymouthd.conf b/etc/plymouth/plymouthd.conf new file mode 100644 index 00000000..8bd07aed --- /dev/null +++ b/etc/plymouth/plymouthd.conf @@ -0,0 +1,2 @@ +[Daemon] +Theme=omarchy diff --git a/etc/security/faillock.conf b/etc/security/faillock.conf new file mode 100644 index 00000000..431f5e75 --- /dev/null +++ b/etc/security/faillock.conf @@ -0,0 +1,7 @@ +# Omarchy override of /etc/security/faillock.conf (upstream owned by `pam`). +# The only behavioural change vs upstream defaults is raising `deny` from 3 to +# 10 so users get more attempts before lockout. +# +# All other settings remain at upstream defaults (commented out). See +# faillock.conf(5) for the full option list. +deny = 10 diff --git a/etc/sudoers.d/omarchy-asdcontrol b/etc/sudoers.d/omarchy-asdcontrol new file mode 100644 index 00000000..a8483b62 --- /dev/null +++ b/etc/sudoers.d/omarchy-asdcontrol @@ -0,0 +1 @@ +%wheel ALL=(ALL) NOPASSWD: /usr/bin/asdcontrol diff --git a/etc/sudoers.d/omarchy-passwd-tries b/etc/sudoers.d/omarchy-passwd-tries new file mode 100644 index 00000000..b87e3573 --- /dev/null +++ b/etc/sudoers.d/omarchy-passwd-tries @@ -0,0 +1 @@ +Defaults passwd_tries=10 diff --git a/etc/sudoers.d/omarchy-tzupdate b/etc/sudoers.d/omarchy-tzupdate new file mode 100644 index 00000000..61e43d8b --- /dev/null +++ b/etc/sudoers.d/omarchy-tzupdate @@ -0,0 +1 @@ +%wheel ALL=(root) NOPASSWD: /usr/bin/tzupdate, /usr/bin/timedatectl diff --git a/etc/sysctl.d/90-omarchy-file-watchers.conf b/etc/sysctl.d/90-omarchy-file-watchers.conf new file mode 100644 index 00000000..4d5e4e8a --- /dev/null +++ b/etc/sysctl.d/90-omarchy-file-watchers.conf @@ -0,0 +1,3 @@ +# Raise inotify limits so VS Code, webpack, and similar dev tools don't hit the +# default 8192 ceiling. +fs.inotify.max_user_watches=524288 diff --git a/etc/sysctl.d/99-omarchy-sysctl.conf b/etc/sysctl.d/99-omarchy-sysctl.conf new file mode 100644 index 00000000..b8845467 --- /dev/null +++ b/etc/sysctl.d/99-omarchy-sysctl.conf @@ -0,0 +1,2 @@ +# Solve common flakiness with SSH (MTU discovery on flaky links). +net.ipv4.tcp_mtu_probing=1 diff --git a/etc/systemd/logind.conf.d/10-ignore-power-button.conf b/etc/systemd/logind.conf.d/10-ignore-power-button.conf new file mode 100644 index 00000000..d86b8662 --- /dev/null +++ b/etc/systemd/logind.conf.d/10-ignore-power-button.conf @@ -0,0 +1,2 @@ +[Login] +HandlePowerKey=ignore diff --git a/etc/systemd/resolved.conf.d/10-disable-multicast.conf b/etc/systemd/resolved.conf.d/10-disable-multicast.conf new file mode 100644 index 00000000..523ed7c9 --- /dev/null +++ b/etc/systemd/resolved.conf.d/10-disable-multicast.conf @@ -0,0 +1,2 @@ +[Resolve] +MulticastDNS=no diff --git a/etc/systemd/resolved.conf.d/20-docker-dns.conf b/etc/systemd/resolved.conf.d/20-docker-dns.conf new file mode 100644 index 00000000..2c7f5276 --- /dev/null +++ b/etc/systemd/resolved.conf.d/20-docker-dns.conf @@ -0,0 +1,2 @@ +[Resolve] +DNSStubListenerExtra=172.17.0.1 diff --git a/etc/systemd/system.conf.d/10-faster-shutdown.conf b/etc/systemd/system.conf.d/10-faster-shutdown.conf new file mode 100644 index 00000000..90dce4f6 --- /dev/null +++ b/etc/systemd/system.conf.d/10-faster-shutdown.conf @@ -0,0 +1,2 @@ +[Manager] +DefaultTimeoutStopSec=5s diff --git a/etc/systemd/system/docker.service.d/no-block-boot.conf b/etc/systemd/system/docker.service.d/no-block-boot.conf new file mode 100644 index 00000000..911bbfa0 --- /dev/null +++ b/etc/systemd/system/docker.service.d/no-block-boot.conf @@ -0,0 +1,2 @@ +[Unit] +DefaultDependencies=no diff --git a/etc/systemd/system/user@.service.d/10-faster-shutdown.conf b/etc/systemd/system/user@.service.d/10-faster-shutdown.conf new file mode 100644 index 00000000..449242ce --- /dev/null +++ b/etc/systemd/system/user@.service.d/10-faster-shutdown.conf @@ -0,0 +1,2 @@ +[Service] +TimeoutStopSec=5s