Skip to content

exploring systemd hooks to enable pam_luks keyring integration #3014

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
d-cas wants to merge 3 commits into
base: dev
Choose a base branch
from
Draft

exploring systemd hooks to enable pam_luks keyring integration #3014

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
964d02c
Modernize initramfs to systemd-based hooks for UKI compatibility
d-cas Oct 31, 2025
d0720eb
Fix systemd hooks in installer and complete migration script
d-cas Nov 3, 2025
b3958da
Add rd.luks.options=tries=0 to match busybox unlimited retry behavior
d-cas Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion install/login/limine-snapper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ if command -v limine &>/dev/null; then
sudo pacman -S --noconfirm --needed limine-snapper-sync limine-mkinitcpio-hook

sudo tee /etc/mkinitcpio.conf.d/omarchy_hooks.conf <<EOF >/dev/null
HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
HOOKS=(base systemd plymouth keyboard autodetect microcode modconf kms sd-vconsole block sd-encrypt filesystems fsck btrfs-overlayfs)
Copy link
Copy Markdown
Contributor

@dharmavagabond dharmavagabond Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, from limine-snapper-sync docs:

Note: For systemd hooks, use sd-btrfs-overlayfs, since btrfs-overlayfs is incompatible.

Copy link
Copy Markdown
Contributor Author

@d-cas d-cas Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch on the btrfs-overlayfs hook! Will update to use sd-btrfs-overlayfs for systemd compatibility.

EOF

[[ -f /boot/EFI/limine/limine.conf ]] || [[ -f /boot/EFI/BOOT/limine.conf ]] && EFI=true
Expand Down
26 changes: 26 additions & 0 deletions migrations/1761874000.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
echo "Modernize initramfs hooks to systemd-based for UKI compatibility"

HOOKS_CONF="/etc/mkinitcpio.conf.d/omarchy_hooks.conf"

# Only apply migration if the hooks config exists and contains old-style hooks
if [[ -f "$HOOKS_CONF" ]]; then
if grep -q "base udev.*keymap consolefont.*encrypt" "$HOOKS_CONF"; then
echo "Updating initramfs hooks from legacy udev-based to systemd-based..."

# Replace legacy hooks with systemd equivalents:
# - udev → systemd (systemd-based initramfs)
# - keymap consolefont → sd-vconsole (systemd console with Plymouth integration)
# - encrypt → sd-encrypt (systemd LUKS unlock with better FIDO2 support)
sudo sed -i 's/base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt/base systemd plymouth keyboard autodetect microcode modconf kms sd-vconsole block sd-encrypt/' "$HOOKS_CONF"

echo "Regenerating initramfs with new hooks..."
sudo mkinitcpio -P

echo "Initramfs hooks updated successfully."
echo "Benefits: Better UKI integration, improved Plymouth support, enhanced FIDO2 compatibility"
else
echo "Hooks already modernized or config format unexpected. Skipping migration."
fi
else
echo "Omarchy hooks config not found. Skipping migration."
fi