werkregie/doc/satellite-omarchy.md

Omarchy Satellite in a VM

How sat-werk1 on think became a satellite on 2026-10-14, with Omarchy 4.0.4. The steps were done by hand; #sat.vm and #sat.apply in werkregie.werkbaum automate them. What a satellite needs in general is in satellite-inventory.md.

The VM

• libvirt with qemu:///system; disks and ISOs in the storage pool default, /var/lib/libvirt/images.
• 6 GiB memory, 4 vCPUs, a 64 GiB qcow2 disk, the NAT network default.
• UEFI without Secure Boot; Omarchy does not boot with BIOS.
• virtio video with 3D acceleration and SPICE with OpenGL; without 3D, Hyprland does not start.

Unattended Install

The Omarchy ISO installs without any input when a second drive labeled cidata carries the answers of its setup form (Omarchy Manual: Unattended Installs).

File	Content
user_configuration.json	the full-disk template of the 4.0.4 configurator, filled for /dev/vda
user_credentials.json	user werk1 with sudo, the password hash for the user and for root
user_encrypt_installation.txt	false: no LUKS, so no passphrase at boot
authorized_keys	the SSH key of think; the installer enables sshd and opens the firewall
user_full_name.txt, user_email_address.txt	the git identity claude-code

• The template comes from /root/configurator inside arch/x86_64/airootfs.sfs of the ISO; the default branch quattro of omacom/omarchy-iso has a newer one.
• The values: hostname sat-werk1, time zone Europe/Berlin, keymap de, kernel linux-omarchy, an ESP of 2 GiB and btrfs on the rest of the disk.
• The user makes the hash with openssl passwd -6, so the password never reaches the agent.

genisoimage -output cidata-sat-werk1.iso -volid cidata -joliet -rock cidata-sat-werk1/
virt-install --connect qemu:///system --name sat-werk1 --memory 6144 --vcpus 4 --osinfo archlinux \
  --boot uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no \
  --disk vol=default/sat-werk1.qcow2,bus=virtio,boot.order=1 \
  --disk vol=default/omarchy-4.0.4.iso,device=cdrom,bus=sata,boot.order=2 \
  --disk vol=default/cidata-sat-werk1.iso,device=cdrom,bus=sata \
  --network network=default,model=virtio \
  --graphics spice,gl.enable=yes,listen=none --video virtio,model.acceleration.accel3d=yes \
  --import --noautoconsole

The empty disk falls through to the ISO; after the install the VM boots from the disk. SSH answered after 11 minutes.

Pitfalls:

• Omarchy 4.0.4 ignores custom_commands; everything after the install goes over SSH.
• The live system answers SSH at the same address with another host key; a check with StrictHostKeyChecking=accept-new stores that key, and the installed system is then refused.

After the Install, over SSH

1. sudo without a password: the only step that needs the user's password, typed once on think. /etc/sudoers.d/90-werk1-nopasswd also needs Defaults:werk1 verifypw=any, since omarchy-update calls sudo -v and Omarchy's own rule (ALL) ALL keeps asking otherwise.
2. Every command runs in a login shell, bash -lc; a plain SSH shell lacks OMARCHY_PATH.
3. omarchy-update -y updates without questions.
4. yay -S --noconfirm --answerdiff None --answerclean None --removemake aur/claude-desktop aur/hypr-rdp. The PKGBUILD of claude-desktop repackages Anthropic's .deb; its hash must match Anthropic's apt index, downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages.
5. SDDM: /etc/sddm.conf.d/60-werk-satellite.conf logs werk1 in automatically into omarchy.desktop, because hypr-rdp attaches to a running Hyprland session. The same file points the greeter at /etc/sddm/werk-greeter.lua, a copy of /usr/share/sddm/hyprland.lua with kb_layout = "de"; the greeter of 4.0.4 sets no layout and types US.
6. hypr-rdp: ~/.config/hypr-rdp/config.toml with bind = "0.0.0.0:3389", user werk1 and a password_file that the user writes; the systemd user unit hypr-rdp.service starts with graphical-session.target; ufw admits port 3389 from 192.168.122.1 only.
7. For the SPICE console only: ~/.config/hypr/monitors.lua fixes Virtual-1 at 1920x1080, since virt-viewer cannot pass its window size to Hyprland.

RDP Client on think

Remmina profile ~/.local/share/remmina/sat-werk1.remmina:

[remmina]
name=sat-werk1
protocol=RDP
server=192.168.122.153
username=werk1
security=nla
scale=2
keyboard_grab=1
window_width=1600
window_height=900
window_maximize=1

• hypr-rdp accepts NLA only; with security=tls the server refuses the connection.
• scale=2 sends the window size; hypr-rdp gives its headless output that size.
• keyboard_grab=1 passes the Super key on; GNOME asks once whether Remmina may inhibit its shortcuts.
• A Remmina process left over takes each new remmina -c and writes its own settings back into the profile.
• Remmina can store a window size below 200 pixels; FreeRDP then fails with ERRCONNECT_PRE_CONNECT_FAILED.

Result

Verified: the unattended install, SSH, RDP with a window that resizes, the Super key, the clipboard in both directions, the German keyboard, and Claude Desktop logged in with the user's sessions.

Not yet tried: the Code tab of Claude Desktop with a repository, and the preview of a frontend in the satellite. Omarchy's first login still offers an update, although the system is up to date.