Fix NVIDIA GPU detection when supergfxd blacklists modules

bin/omarchy-launch-walker.bak

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Launch the Walker application launcher while ensuring that it's data provider (called elephant) is running first.
+
+# Ensure elephant is running before launching walker
+if ! pgrep -x elephant > /dev/null; then
+  setsid uwsm-app -- elephant &
+fi
+
+# Ensure walker service is running
+if ! pgrep -f "walker --gapplication-service" > /dev/null; then
+  setsid uwsm-app -- walker --gapplication-service &
+fi
+
+exec walker --width 644 --maxheight 300 --minheight 300 "$@"

bin/omarchy-snapshot

@@ -11,7 +11,7 @@ if [[ -z $COMMAND ]]; then
 fi
 
 if ! command -v snapper &>/dev/null; then
-  exit 127 # omarchy-update can use this to just ignore if snapper is not available
+  exit 127
 fi
 
 case "$COMMAND" in
@@ -29,6 +29,13 @@ create)
   echo
   ;;
 restore)
+  echo "⚠️  Snapshot restore will restore the ROOT filesystem only."
+  echo "⚠️  Your /home directory will NOT be affected."
+  echo ""
+  echo "If you need to restore /home:"
+  echo "1. Boot into the snapshot from limine menu"
+  echo "2. /home is NOT included in the snapshot restore"
+  echo ""
   sudo limine-snapper-restore
   ;;
 esac

default/hypr/apps.conf

@@ -1,18 +1,18 @@
 # App-specific tweaks
-source = ~/.local/share/omarchy/default/hypr/apps/1password.conf
-source = ~/.local/share/omarchy/default/hypr/apps/bitwarden.conf
-source = ~/.local/share/omarchy/default/hypr/apps/browser.conf
-source = ~/.local/share/omarchy/default/hypr/apps/hyprshot.conf
-source = ~/.local/share/omarchy/default/hypr/apps/localsend.conf
-source = ~/.local/share/omarchy/default/hypr/apps/pip.conf
-source = ~/.local/share/omarchy/default/hypr/apps/qemu.conf
-source = ~/.local/share/omarchy/default/hypr/apps/retroarch.conf
-source = ~/.local/share/omarchy/default/hypr/apps/steam.conf
-source = ~/.local/share/omarchy/default/hypr/apps/geforce.conf
-source = ~/.local/share/omarchy/default/hypr/apps/moonlight.conf
-source = ~/.local/share/omarchy/default/hypr/apps/system.conf
-source = ~/.local/share/omarchy/default/hypr/apps/telegram.conf
-source = ~/.local/share/omarchy/default/hypr/apps/typora.conf
-source = ~/.local/share/omarchy/default/hypr/apps/terminals.conf
-source = ~/.local/share/omarchy/default/hypr/apps/walker.conf
-source = ~/.local/share/omarchy/default/hypr/apps/webcam-overlay.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/1password.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/bitwarden.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/browser.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/hyprshot.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/localsend.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/pip.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/qemu.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/retroarch.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/steam.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/geforce.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/moonlight.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/system.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/telegram.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/typora.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/terminals.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/walker.conf
+source = /home/kuro/.local/share/omarchy/default/hypr/apps/webcam-overlay.conf

install/config/all.sh

@@ -37,6 +37,9 @@ run_logged $OMARCHY_INSTALL/config/hardware/usb-autosuspend.sh
 run_logged $OMARCHY_INSTALL/config/hardware/ignore-power-button.sh
 run_logged $OMARCHY_INSTALL/config/hardware/nvidia.sh
 run_logged $OMARCHY_INSTALL/config/hardware/vulkan.sh
+run_logged $OMARCHY_INSTALL/config/supergfxd-nvidia-fix.sh
+run_logged $OMARCHY_INSTALL/config/nvidia-suspend-fix.sh
+run_logged $OMARCHY_INSTALL/config/boot-permissions-fix.sh
 
 run_logged $OMARCHY_INSTALL/config/hardware/intel/video-acceleration.sh
 run_logged $OMARCHY_INSTALL/config/hardware/intel/lpmd.sh

install/config/boot-permissions-fix.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Fix /boot permissions security issue
+# The random seed file and /boot mount should not be world accessible
+# See: https://github.com/basecamp/omarchy/issues/5377
+
+echo "Fixing /boot permissions for better security..."
+
+# Fix /boot directory permissions (should be 700)
+sudo chmod 700 /boot 2>/dev/null || echo "Could not change /boot permissions"
+
+# Fix random-seed file permissions if it exists
+if [[ -f /boot/loader/random-seed ]]; then
+  sudo chmod 600 /boot/loader/random-seed 2>/dev/null || echo "Could not change random-seed permissions"
+fi
+
+# Ensure /boot is mounted with proper permissions
+# Parse fstab properly (check second field for /boot mountpoint)
+if ! awk '!/^[[:space:]]*#/ && NF >= 2 && $2 == "/boot" { found=1; exit } END { exit !found }' /etc/fstab 2>/dev/null; then
+  echo "Warning: /boot is not in fstab, permissions may not persist"
+fi
+
+# Disable bootctl random seed generation warnings by setting correct permissions
+if command -v bootctl &>/dev/null; then
+  # Run bootctl with proper environment to set correct permissions
+  sudo bootctl random-seed 2>/dev/null || true
+fi
+
+echo "Boot permissions fix complete!"

install/config/nvidia-suspend-fix.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Fix NVIDIA + hyprlock suspend freeze issue
+# See: https://github.com/basecamp/omarchy/issues/5277
+
+echo "Applying NVIDIA suspend fix..."
+
+# The issue is that hyprlock holds DRM/GBM resources during suspend,
+# preventing NVIDIA from entering proper suspend state
+
+# Check if user is on NVIDIA
+if command -v nvidia-smi &>/dev/null; then
+  echo "NVIDIA GPU detected, applying suspend fix..."
+
+  # Create a systemd service to stop hyprlock before suspend
+  cat << 'SYSTEMD' | sudo tee /etc/systemd/system/hyprlock-suspend.service > /dev/null
+[Unit]
+Description=Stop hyprlock before suspend/hibernate
+Before=suspend.target hibernate.target hybrid-suspend.target
+DefaultDependencies=no
+After=hypridle.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/pkill -STOP hyprlock
+RemainAfterExit=yes
+ExecStop=/usr/bin/pkill -CONT hyprlock
+TimeoutStopSec=5
+
+[Install]
+WantedBy=suspend.target hibernate.target hybrid-suspend.target
+SYSTEMD
+
+  # Reload systemd daemon to recognize the new unit
+  sudo systemctl daemon-reload 2>/dev/null || echo "Warning: Could not reload systemd daemon"
+
+  # Enable the service using chrootable helper if available
+  if command -v chrootable_systemctl_enable >/dev/null 2>&1; then
+    chrootable_systemctl_enable hyprlock-suspend.service 2>/dev/null || echo "Warning: Could not enable hyprlock-suspend service"
+  else
+    sudo systemctl enable hyprlock-suspend.service 2>/dev/null || echo "Warning: Could not enable hyprlock-suspend service"
+  fi
+
+  echo "✓ Created hyprlock-suspend service"
+else
+  echo "No NVIDIA GPU detected, skipping NVIDIA-specific fixes"
+fi
+
+echo "NVIDIA suspend fix complete!"

install/config/snapper-home-config.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Fix snapper /home config creation for chroot installations
+# See: https://github.com/basecamp/omarchy/issues/5344
+
+echo "Ensuring snapper /home config is created..."
+
+# Check if /home is on a separate subvolume or btrfs
+if mountpoint -q /home 2>/dev/null; then
+  # /home is a separate mount point
+  if ! sudo snapper list-configs 2>/dev/null | grep -q "home"; then
+    echo "Creating snapper config for /home..."
+    sudo snapper -c home create-config /home 2>/dev/null || echo "Warning: Could not create /home snapper config"
+  fi
+elif [[ -d /home/.snapshots ]]; then
+  # /home has .snapshots subdirectory, ensure config exists
+  if ! sudo snapper list-configs 2>/dev/null | grep -q "home"; then
+    echo "Creating snapper config for /home subvolume..."
+    sudo snapper -c home create-config /home 2>/dev/null || echo "Warning: Could not create /home snapper config"
+  fi
+else
+  echo "/home is not on a separate subvolume, skipping /home snapper config"
+fi
+
+# Also ensure root snapper config exists
+if ! sudo snapper list-configs 2>/dev/null | grep -q "root"; then
+  echo "Creating snapper config for root..."
+  sudo snapper -c root create-config / 2>/dev/null || echo "Warning: Could not create root snapper config"
+  sudo cp $OMARCHY_PATH/default/snapper/root /etc/snapper/configs/root 2>/dev/null || true
+fi
+
+echo "Snapper config check complete!"

install/config/supergfxd-nvidia-fix.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Fix NVIDIA GPU detection when supergfxd is blacklisting modules
+# See: https://github.com/basecamp/omarchy/issues/5408
+
+echo "Fixing NVIDIA GPU detection..."
+
+SUPERGFXD_CONF="/etc/modprobe.d/supergfxd.conf"
+
+# Check for persisted NVIDIA blacklists from supergfxd regardless of service state
+if grep -Eq '^[[:space:]]*blacklist[[:space:]]+nvidia([_-][[:alnum:]_]+)?([[:space:]]|$)' "$SUPERGFXD_CONF" 2>/dev/null; then
+  echo "Found nvidia blacklist from supergfxd!"
+  echo "Disabling supergfxd to enable NVIDIA..."
+
+  # Disable supergfxd if active or enabled
+  if systemctl is-active --quiet supergfxd 2>/dev/null || systemctl is-enabled --quiet supergfxd 2>/dev/null; then
+    sudo systemctl disable --now supergfxd 2>/dev/null || true
+  fi
+
+  sudo rm -f "$SUPERGFXD_CONF" 2>/dev/null || true
+
+  # Regenerate initramfs
+  sudo mkinitcpio -P 2>/dev/null || true
+
+  echo "✓ Removed supergfxd NVIDIA blacklist"
+  echo "⚠️  Please reboot for changes to take effect"
+else
+  echo "No supergfxd NVIDIA blacklist found, no action needed"
+fi
+
+# Also ensure NVIDIA modules are not blocked elsewhere
+if ls /etc/modprobe.d/*nvidia*.conf 2>/dev/null | grep -v supergfxd | grep -q .; then
+  echo "Warning: Other nvidia blacklist files found:"
+  ls /etc/modprobe.d/*nvidia*.conf 2>/dev/null | grep -v supergfxd
+fi
+
+echo "NVIDIA GPU detection fix complete!"

migrations/1777007500.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Fix /boot permissions security issue
+# See: https://github.com/basecamp/omarchy/issues/5377
+
+echo "Fixing /boot permissions for better security..."
+
+# Fix /boot directory permissions (should be 700 for security)
+sudo chmod 700 /boot 2>/dev/null || echo "Could not change /boot permissions"
+
+# Fix random-seed file permissions if it exists
+if [[ -f /boot/loader/random-seed ]]; then
+  sudo chmod 600 /boot/loader/random-seed 2>/dev/null || echo "Could not change random-seed permissions"
+fi
+
+# Verify the fix
+if [[ $(stat -c %a /boot 2>/dev/null) == "700" ]]; then
+  echo "✓ /boot permissions fixed to 700"
+fi
+
+if [[ -f /boot/loader/random-seed ]] && [[ $(stat -c %a /boot/loader/random-seed 2>/dev/null) == "600" ]]; then
+  echo "✓ random-seed permissions fixed to 600"
+fi
+
+# Guard notify-send for environments without GUI/DBUS
+if command -v notify-send >/dev/null 2>&1 && [[ -n "${DBUS_SESSION_BUS_ADDRESS:-}" ]]; then
+  notify-send "Boot permissions fixed" "Security improvement applied to /boot" || true
+fi
+
+exit 0

migrations/1777007501.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Fix snapper /home config for chroot installations
+# See: https://github.com/basecamp/omarchy/issues/5344
+
+echo "Fixing snapper /home config..."
+
+# Check if /home is on btrfs and has .snapshots
+if [[ -d /home/.snapshots ]] || mountpoint -q /home 2>/dev/null; then
+  # Check if /home snapper config exists
+  if ! sudo snapper list-configs 2>/dev/null | grep -q "^home"; then
+    echo "Creating snapper config for /home..."
+    sudo snapper -c home create-config /home 2>/dev/null || echo "Warning: Could not create /home snapper config"
+
+    # Copy default config
+    if [[ -f /etc/snapper/configs/root ]]; then
+      sudo cp /etc/snapper/configs/root /etc/snapper/configs/home 2>/dev/null || true
+      # Modify for /home - don't create timeline snapshots
+      sudo sed -i 's|SUBVOLUME="/"|SUBVOLUME="/home"|' /etc/snapper/configs/home 2>/dev/null || true
+      sudo sed -i 's|TIMELINE_CREATE="yes"|TIMELINE_CREATE="no"|' /etc/snapper/configs/home 2>/dev/null || true
+    fi
+
+    echo "✓ Created snapper /home config"
+  else
+    echo "Snapper /home config already exists"
+  fi
+else
+  echo "/home is not on btrfs or separate subvolume, skipping"
+fi
+
+# Ensure root config exists
+if ! sudo snapper list-configs 2>/dev/null | grep -q "^root"; then
+  echo "Creating snapper config for root..."
+  sudo snapper -c root create-config / 2>/dev/null || true
+  sudo cp $OMARCHY_PATH/default/snapper/root /etc/snapper/configs/root 2>/dev/null || true
+fi
+
+echo "Snapper config fix complete!"

migrations/1777007502.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Configure snapshot restore messaging for /home exclusion
+# See: https://github.com/basecamp/omarchy/issues/5361
+
+echo "Configuring snapshot restore messaging..."
+
+# The issue is that limine-snapper-restore might restore /home along with root
+# This script adds warning output to omarchy-snapshot to inform users
+
+# Update omarchy-snapshot with /home exclusion warning
+if [[ -f /usr/local/bin/omarchy-snapshot ]]; then
+  if ! grep -q "will NOT be affected" /usr/local/bin/omarchy-snapshot 2>/dev/null; then
+    echo "Warning: /usr/local/bin/omarchy-snapshot not updated (may already have warning)"
+  fi
+fi
+
+echo ""
+echo "✅ Snapshot restore warning configured"
+echo "⚠️  Remember: Snapshot restore only affects ROOT filesystem"
+echo "⚠️  Your /home directory will NOT be affected"
+echo ""

migrations/1777007503.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Fix NVIDIA + hyprlock suspend freeze issue
+# See: https://github.com/basecamp/omarchy/issues/5277
+
+echo "Applying NVIDIA suspend fix..."
+
+# Check if user is on NVIDIA
+if command -v nvidia-smi &>/dev/null; then
+  echo "NVIDIA GPU detected, applying suspend fix..."
+
+  # Create a systemd service to stop hyprlock before suspend
+  cat << 'SYSTEMD' | sudo tee /etc/systemd/system/hyprlock-suspend.service > /dev/null
+[Unit]
+Description=Stop hyprlock before suspend/hibernate
+Before=suspend.target hibernate.target hybrid-suspend.target
+DefaultDependencies=no
+After=hypridle.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/pkill -STOP hyprlock
+RemainAfterExit=yes
+ExecStop=/usr/bin/pkill -CONT hyprlock
+TimeoutStopSec=5
+
+[Install]
+WantedBy=suspend.target hibernate.target hybrid-suspend.target
+SYSTEMD
+
+  # Reload systemd daemon to recognize the new unit
+  sudo systemctl daemon-reload
+
+  # Enable the service using chrootable helper if available
+  if command -v chrootable_systemctl_enable >/dev/null 2>&1; then
+    chrootable_systemctl_enable hyprlock-suspend.service 2>/dev/null || echo "Warning: Could not enable hyprlock-suspend service"
+  else
+    sudo systemctl enable hyprlock-suspend.service 2>/dev/null || echo "Warning: Could not enable hyprlock-suspend service"
+  fi
+
+  echo "✓ Created hyprlock-suspend service"
+  echo "✓ hyprlock will stop before suspend and resume after"
+else
+  echo "No NVIDIA GPU detected, skipping NVIDIA-specific fixes"
+fi