Arch Linux security hardening, debloat, and theming pipeline for Omarchy.
omasec automates system-level security hardening, deployment of host-based intrusion prevention tooling, package debloating, and desktop theming integrations for the Omarchy desktop environment. The suite relies exclusively on native Bash scripts and standard Linux system utilities to guarantee predictable, idempotent execution.
The repository is structured into functional components located under dedicated paths. The scripts/ directory contains modular root provisioning (scripts/modules/), verification, compatibility testing, and launcher scripts. The tests/ directory houses exhaustive modular test suites validating syntax integrity, desktop services, lockscreen regression prevention, kernel parameters, PAM authentication, firewall isolation, debloat theming, hardware power policies, modular pipeline architecture, and automation safety, orchestrated by tests/run-all.sh. CI pipelines defined under .github/workflows/ci.yml automate syntax linting and multi-job regression testing on pull requests and commits. The hooks/ directory contains Omarchy desktop integration hooks for automatic icon and folder color switching alongside dynamic Micro editor theme generation. The zedconf/ and microconf/ directories contain native configuration modules and installers for the Zed and Micro editors. Operational runbooks reside in .skills/ while project workflows are exposed through the Makefile. Root knowledge bases for automated agents are defined in AGENTS.md and GEMINI.md.
System operations are executed through the standard Makefile targets. Running make setup initiates the full hardening and provisioning pipeline as root. Running make verify checks the system security posture against expected kernel, service, and package assertions. Running make test executes the comprehensive modular test suite (bash tests/run-all.sh). Running make hook installs the desktop theme hook for the current user, make icons forces an immediate color update for the active theme, and make theme triggers both folder icon and Micro editor theme synchronization. Running make zed or make micro installs editor configurations (or make editors for both). Running make clean purges local execution logs.
Kernel security is enforced via /etc/sysctl.d/99-security.conf with full Address Space Layout Randomization, restricted kernel pointers, restricted dmesg buffers, disabled unprivileged eBPF execution, restricted ptrace debugging, and SysRq limited to emergency sync operations. Filesystem protection is hardened by disabling setuid core dumps and enforcing strict ownership checks on symlinks, hardlinks, FIFOs, and regular files in sticky directories. Network protections include reverse path filtering, disabled ICMP redirects, disabled source routing, ignore broadcast echo requests, and active TCP SYN cookies alongside RFC 1337 TIME-WAIT protections.
Authentication security is enforced through PAM configuration in /etc/security/faillock.conf which locks accounts after five consecutive failed attempts for fifteen minutes. Password complexity is required via pwquality.conf and core dumps are disabled globally via limits configuration. SSH security is managed via drop-ins disabling root login and password authentication while enforcing modern ciphers. System services such as sshd are isolated using systemd unit drop-ins that mount system files read-only, hide home directories, and drop kernel privileges. The UFW firewall operates with default deny incoming and default allow outgoing rules. Host security tooling integrates AppArmor mandatory access control, auditd rule logging, fail2ban jail monitoring, USBGuard device authorization, ClamAV scanning, and weekly automated Lynis security audits.
Omarchy desktop theming automatically synchronizes Yaru folder colors to match the active theme palette via GSettings, and dynamically generates custom colorschemes for the Micro terminal editor via hooks/theme-set.d/micro-theme. The pipeline debloats unneeded default packages including Chromium, Neovim, MPV, Kdenlive, OBS Studio, LibreOffice, and Obsidian, replacing them with lightweight native defaults such as Micro and Brave. To guarantee persistence across future system updates, debloated packages are pinned in /etc/pacman.conf under IgnorePkg, and obsolete web application shortcuts are cleaned from system application directories.
Battery degradation prevention enforces a perpetual 75% charging threshold limit defined in /etc/omasec/power.conf. The policy is enforced across all present and future batteries (BAT*, BATT*) and persists through boot, suspend/resume, hotplugs, and system updates using triple-layer system integration: Udev subsystem rules (/etc/udev/rules.d/98-battery-charge-threshold.rules), systemd-tmpfiles initialization (/etc/tmpfiles.d/battery-charge-threshold.conf), and a native systemd target hook service (battery-charge-threshold.service).