# Omarchy Satellite in a VM

How `sat-werk1` on `think` became a satellite on 2026-10-14, with Omarchy 4.0.4.
The steps were done by hand; `#sat.vm` and `#sat.apply` in [werkregie.werkbaum](werkregie.werkbaum) automate them.
What a satellite needs in general is in [satellite-inventory.md](satellite-inventory.md).

## The VM

- libvirt with `qemu:///system`; disks and ISOs in the storage pool `default`, `/var/lib/libvirt/images`.
- 6 GiB memory, 4 vCPUs, a 64 GiB qcow2 disk, the NAT network `default`.
- UEFI without Secure Boot; Omarchy does not boot with BIOS.
- `virtio` video with 3D acceleration and SPICE with OpenGL; without 3D, Hyprland does not start.

## Unattended Install

The Omarchy ISO installs without any input when a second drive labeled `cidata` carries the answers of its setup form
([Omarchy Manual: Unattended Installs](https://omarchy.org/manual/unattended-installs/)).

| File                            | Content                                                                         |
|---------------------------------|---------------------------------------------------------------------------------|
| `user_configuration.json`       | the full-disk template of the 4.0.4 configurator, filled for `/dev/vda`         |
| `user_credentials.json`         | user `werk1` with `sudo`, the password hash for the user and for root           |
| `user_encrypt_installation.txt` | `false`: no LUKS, so no passphrase at boot                                      |
| `authorized_keys`               | the SSH key of `think`; the installer enables `sshd` and opens the firewall     |
| `user_full_name.txt`, `user_email_address.txt` | the git identity `claude-code`                                   |

- The template comes from `/root/configurator` inside `arch/x86_64/airootfs.sfs` of the ISO;
  the default branch `quattro` of `omacom/omarchy-iso` has a newer one.
- The values: hostname `sat-werk1`, time zone `Europe/Berlin`, keymap `de`, kernel `linux-omarchy`,
  an ESP of 2 GiB and btrfs on the rest of the disk.
- The user makes the hash with `openssl passwd -6`, so the password never reaches the agent.

```bash
genisoimage -output cidata-sat-werk1.iso -volid cidata -joliet -rock cidata-sat-werk1/
virt-install --connect qemu:///system --name sat-werk1 --memory 6144 --vcpus 4 --osinfo archlinux \
  --boot uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no \
  --disk vol=default/sat-werk1.qcow2,bus=virtio,boot.order=1 \
  --disk vol=default/omarchy-4.0.4.iso,device=cdrom,bus=sata,boot.order=2 \
  --disk vol=default/cidata-sat-werk1.iso,device=cdrom,bus=sata \
  --network network=default,model=virtio \
  --graphics spice,gl.enable=yes,listen=none --video virtio,model.acceleration.accel3d=yes \
  --import --noautoconsole
```

The empty disk falls through to the ISO; after the install the VM boots from the disk.
SSH answered after 11 minutes.

Pitfalls:

- Omarchy 4.0.4 ignores `custom_commands`; everything after the install goes over SSH.
- The live system answers SSH at the same address with another host key;
  a check with `StrictHostKeyChecking=accept-new` stores that key, and the installed system is then refused.

## After the Install, over SSH

1. `sudo` without a password: the only step that needs the user's password, typed once on `think`.
   `/etc/sudoers.d/90-werk1-nopasswd` also needs `Defaults:werk1 verifypw=any`,
   since `omarchy-update` calls `sudo -v` and Omarchy's own rule `(ALL) ALL` keeps asking otherwise.
2. Every command runs in a login shell, `bash -lc`; a plain SSH shell lacks `OMARCHY_PATH`.
3. `omarchy-update -y` updates without questions.
4. `yay -S --noconfirm --answerdiff None --answerclean None --removemake aur/claude-desktop aur/hypr-rdp`.
   The PKGBUILD of `claude-desktop` repackages Anthropic's `.deb`; its hash must match Anthropic's apt index,
   `downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages`.
5. SDDM: `/etc/sddm.conf.d/60-werk-satellite.conf` logs `werk1` in automatically into `omarchy.desktop`,
   because hypr-rdp attaches to a running Hyprland session.
   The same file points the greeter at `/etc/sddm/werk-greeter.lua`, a copy of `/usr/share/sddm/hyprland.lua`
   with `kb_layout = "de"`; the greeter of 4.0.4 sets no layout and types US.
6. hypr-rdp: `~/.config/hypr-rdp/config.toml` with `bind = "0.0.0.0:3389"`, user `werk1` and a `password_file`
   that the user writes; the systemd user unit `hypr-rdp.service` starts with `graphical-session.target`;
   `ufw` admits port 3389 from `192.168.122.1` only.
7. For the SPICE console only: `~/.config/hypr/monitors.lua` fixes `Virtual-1` at 1920x1080,
   since virt-viewer cannot pass its window size to Hyprland.

## RDP Client on `think`

Remmina profile `~/.local/share/remmina/sat-werk1.remmina`:

```ini
[remmina]
name=sat-werk1
protocol=RDP
server=192.168.122.153
username=werk1
security=nla
scale=2
keyboard_grab=1
window_width=1600
window_height=900
window_maximize=1
```

- hypr-rdp accepts NLA only; with `security=tls` the server refuses the connection.
- `scale=2` sends the window size; hypr-rdp gives its headless output that size.
- `keyboard_grab=1` passes the Super key on; GNOME asks once whether Remmina may inhibit its shortcuts.
- A Remmina process left over takes each new `remmina -c` and writes its own settings back into the profile.
- Remmina can store a window size below 200 pixels; FreeRDP then fails with `ERRCONNECT_PRE_CONNECT_FAILED`.

## Result

Verified: the unattended install, SSH, RDP with a window that resizes, the Super key, the clipboard in both directions,
the German keyboard, and Claude Desktop logged in with the user's sessions.

Not yet tried: the Code tab of Claude Desktop with a repository, and the preview of a frontend in the satellite.
Omarchy's first login still offers an update, although the system is up to date.