Security

Upstream’s security page lists five things Omarchy does for you. Here is how each of them lands on NixOS.

The firewall

There is no ufw on NixOS. nixarchy sets

networking.firewall.enable = lib.mkDefault true;
networking.firewall.allowedTCPPorts = [ 53317 ];
networking.firewall.allowedUDPPorts = [ 53317 ];

which is a port of upstream’s install/config/firewall.sh (ufw default deny incoming, then ufw allow 53317 on both protocols for LocalSend). Discovery over mDNS was never the missing part; services.avahi already opens 5353. Only the transfer port was.

The enable is mkDefault, so a configuration that turns the firewall off wins. The port lists are not, deliberately: list options merge, so a port you open is added to LocalSend’s rather than replacing it.

To open a port, add it in your flake and rebuild:

networking.firewall.allowedTCPPorts = [ 8080 ];

sudo ufw allow 8080 does not exist here, and a port opened by hand with iptables or nft is gone on the next rebuild, which is the point.

Nixarchy defaults to virtualisation.docker.enable = false and virtualisation.docker.rootless.enable = true: Docker runs as a rootless user daemon. Upstream’s ufw-docker lockdown is not ported because it is a ufw script. Check the bind address and network reachability of each published container service. See Docker, rootless for the default and how to opt into the root-owned daemon.

SSH

Setup > Security > SSHD in the menu is upstream’s script, and it cannot finish here: its first step is omarchy-pkg-add openssh, which exits 1 by design (see the philosophy), and the script runs under set -e. Declare it instead:

services.openssh.enable = true;
users.users.you.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... you@host" ];

services.openssh.openFirewall defaults to true, so port 22 opens with it. Upstream rate-limits port 22 with ufw limit; nothing equivalent is set here, so keep password authentication off (settings.PasswordAuthentication = false) rather than relying on rate limiting.

Remote desktop

Serving the Hyprland session over RDP is off, and turning it on is a security decision with more than one part — what listens, on which interface, and where the password comes from. Remote desktop is that page.

Fingerprint and FIDO2

Setup > Security > Fingerprint and FIDO2 do the enrolment they always did: fprintd-enroll really enrols a print, and pamu2fcfg really writes a credential to /etc/fido2/fido2. What they cannot do is edit /etc/pam.d, because on NixOS PAM is built, not edited. So the last step prints the lines to add and exits non-zero:

security.pam.u2f.enable = true;
security.pam.u2f.settings.authfile = "/etc/fido2/fido2";
security.pam.u2f.settings.cue = true;
security.pam.services.sudo.u2fAuth = true;
security.pam.services.polkit-1.u2fAuth = true;

or, for fingerprint, services.fprintd.enable = true plus security.pam.services.sudo.fprintAuth = true and the same for polkit-1. Rebuild, and the enrolled key or print is accepted.

Passwordless sudo

Not a toggle here, on purpose. Upstream’s omarchy-sudo-passwordless (Setup > Security > Passwordless Sudo) writes /etc/sudoers.d/99-omarchy-nopasswd-$USER and a timer removes it after 15 minutes. NixOS’s /etc/sudoers has no #includedir, so that file would never be read, and upstream would still print that it was enabled. nixarchy replaces the command with one that says so, prints the options below, and exits non-zero. In Omarchy’s newer releases the row becomes a toggle that writes sudoers and tmpfiles rules; nixarchy hides it there, rather than offer passwordless root one click away (#1280).

If you want it, declare it, for your user only:

security.sudo.extraRules = [{
  users = [ "you" ];
  commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
}];

or for the whole wheel group, security.sudo.wheelNeedsPassword = false;. There is no timer: it stays until you remove it and rebuild. While it is on, anything running as your user is root.

Changing your passwords

Your login password is passwd, or Update > Password > User in the menu. The drive passphrase, if you encrypted, is cryptsetup luksChangeKey on the LUKS device; NixOS does not manage that for you either.

If you declared users.users.you.hashedPassword or initialPassword in your flake, that value is reapplied at every rebuild unless users.mutableUsers is true (the default). Check before wondering why a password change did not stick.

Passing on a machine, and signing keys

Setup > Reset Computer restores the baseline snapshot the Omarchy ISO takes, so it needs an ISO install and does not work here. Hand a machine over by reinstalling NixOS, or by deleting the user and their home from your flake and rebuilding. Upstream’s ISO and package signing key does not apply; nixarchy has no packages to sign, and the flake lock pins the source by hash.