105 lines
5.7 KiB
Markdown
105 lines
5.7 KiB
Markdown
# Omarchy Satellite in a VM
|
|
|
|
How `sat-werk1` on `think` became a satellite on 2026-10-14, with Omarchy 4.0.4.
|
|
The steps were done by hand; `#sat.vm` and `#sat.apply` in [werkregie.werkbaum](werkregie.werkbaum) automate them.
|
|
What a satellite needs in general is in [satellite-inventory.md](satellite-inventory.md).
|
|
|
|
## The VM
|
|
|
|
- libvirt with `qemu:///system`; disks and ISOs in the storage pool `default`, `/var/lib/libvirt/images`.
|
|
- 6 GiB memory, 4 vCPUs, a 64 GiB qcow2 disk, the NAT network `default`.
|
|
- UEFI without Secure Boot; Omarchy does not boot with BIOS.
|
|
- `virtio` video with 3D acceleration and SPICE with OpenGL; without 3D, Hyprland does not start.
|
|
|
|
## Unattended Install
|
|
|
|
The Omarchy ISO installs without any input when a second drive labeled `cidata` carries the answers of its setup form
|
|
([Omarchy Manual: Unattended Installs](https://omarchy.org/manual/unattended-installs/)).
|
|
|
|
| File | Content |
|
|
|---------------------------------|---------------------------------------------------------------------------------|
|
|
| `user_configuration.json` | the full-disk template of the 4.0.4 configurator, filled for `/dev/vda` |
|
|
| `user_credentials.json` | user `werk1` with `sudo`, the password hash for the user and for root |
|
|
| `user_encrypt_installation.txt` | `false`: no LUKS, so no passphrase at boot |
|
|
| `authorized_keys` | the SSH key of `think`; the installer enables `sshd` and opens the firewall |
|
|
| `user_full_name.txt`, `user_email_address.txt` | the git identity `claude-code` |
|
|
|
|
- The template comes from `/root/configurator` inside `arch/x86_64/airootfs.sfs` of the ISO;
|
|
the default branch `quattro` of `omacom/omarchy-iso` has a newer one.
|
|
- The values: hostname `sat-werk1`, time zone `Europe/Berlin`, keymap `de`, kernel `linux-omarchy`,
|
|
an ESP of 2 GiB and btrfs on the rest of the disk.
|
|
- The user makes the hash with `openssl passwd -6`, so the password never reaches the agent.
|
|
|
|
```bash
|
|
genisoimage -output cidata-sat-werk1.iso -volid cidata -joliet -rock cidata-sat-werk1/
|
|
virt-install --connect qemu:///system --name sat-werk1 --memory 6144 --vcpus 4 --osinfo archlinux \
|
|
--boot uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no \
|
|
--disk vol=default/sat-werk1.qcow2,bus=virtio,boot.order=1 \
|
|
--disk vol=default/omarchy-4.0.4.iso,device=cdrom,bus=sata,boot.order=2 \
|
|
--disk vol=default/cidata-sat-werk1.iso,device=cdrom,bus=sata \
|
|
--network network=default,model=virtio \
|
|
--graphics spice,gl.enable=yes,listen=none --video virtio,model.acceleration.accel3d=yes \
|
|
--import --noautoconsole
|
|
```
|
|
|
|
The empty disk falls through to the ISO; after the install the VM boots from the disk.
|
|
SSH answered after 11 minutes.
|
|
|
|
Pitfalls:
|
|
|
|
- Omarchy 4.0.4 ignores `custom_commands`; everything after the install goes over SSH.
|
|
- The live system answers SSH at the same address with another host key;
|
|
a check with `StrictHostKeyChecking=accept-new` stores that key, and the installed system is then refused.
|
|
|
|
## After the Install, over SSH
|
|
|
|
1. `sudo` without a password: the only step that needs the user's password, typed once on `think`.
|
|
`/etc/sudoers.d/90-werk1-nopasswd` also needs `Defaults:werk1 verifypw=any`,
|
|
since `omarchy-update` calls `sudo -v` and Omarchy's own rule `(ALL) ALL` keeps asking otherwise.
|
|
2. Every command runs in a login shell, `bash -lc`; a plain SSH shell lacks `OMARCHY_PATH`.
|
|
3. `omarchy-update -y` updates without questions.
|
|
4. `yay -S --noconfirm --answerdiff None --answerclean None --removemake aur/claude-desktop aur/hypr-rdp`.
|
|
The PKGBUILD of `claude-desktop` repackages Anthropic's `.deb`; its hash must match Anthropic's apt index,
|
|
`downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages`.
|
|
5. SDDM: `/etc/sddm.conf.d/60-werk-satellite.conf` logs `werk1` in automatically into `omarchy.desktop`,
|
|
because hypr-rdp attaches to a running Hyprland session.
|
|
The same file points the greeter at `/etc/sddm/werk-greeter.lua`, a copy of `/usr/share/sddm/hyprland.lua`
|
|
with `kb_layout = "de"`; the greeter of 4.0.4 sets no layout and types US.
|
|
6. hypr-rdp: `~/.config/hypr-rdp/config.toml` with `bind = "0.0.0.0:3389"`, user `werk1` and a `password_file`
|
|
that the user writes; the systemd user unit `hypr-rdp.service` starts with `graphical-session.target`;
|
|
`ufw` admits port 3389 from `192.168.122.1` only.
|
|
7. For the SPICE console only: `~/.config/hypr/monitors.lua` fixes `Virtual-1` at 1920x1080,
|
|
since virt-viewer cannot pass its window size to Hyprland.
|
|
|
|
## RDP Client on `think`
|
|
|
|
Remmina profile `~/.local/share/remmina/sat-werk1.remmina`:
|
|
|
|
```ini
|
|
[remmina]
|
|
name=sat-werk1
|
|
protocol=RDP
|
|
server=192.168.122.153
|
|
username=werk1
|
|
security=nla
|
|
scale=2
|
|
keyboard_grab=1
|
|
window_width=1600
|
|
window_height=900
|
|
window_maximize=1
|
|
```
|
|
|
|
- hypr-rdp accepts NLA only; with `security=tls` the server refuses the connection.
|
|
- `scale=2` sends the window size; hypr-rdp gives its headless output that size.
|
|
- `keyboard_grab=1` passes the Super key on; GNOME asks once whether Remmina may inhibit its shortcuts.
|
|
- A Remmina process left over takes each new `remmina -c` and writes its own settings back into the profile.
|
|
- Remmina can store a window size below 200 pixels; FreeRDP then fails with `ERRCONNECT_PRE_CONNECT_FAILED`.
|
|
|
|
## Result
|
|
|
|
Verified: the unattended install, SSH, RDP with a window that resizes, the Super key, the clipboard in both directions,
|
|
the German keyboard, and Claude Desktop logged in with the user's sessions.
|
|
|
|
Not yet tried: the Code tab of Claude Desktop with a repository, and the preview of a frontend in the satellite.
|
|
Omarchy's first login still offers an update, although the system is up to date.
|