Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
VPN DNS resolution broken due to DNS= override in /etc/systemd/resolved.conf
Reported by PavelAlennikov · filed Sep 8, 2025Closed upstream on 2025-09-09 by dhh; the closing comment says it was fixed by PR basecamp/omarchy#1514. GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Omarchy v2.1.0, FortiClient VPN 7.4.3.1736.
What's wrong?
When connecting to a VPN, the VPN client replaces symlink /etc/resolv.conf with static file with internal DNS servers.
Omarchy’s changes to /etc/systemd/resolved.conf prevent these DNS settings from being applied globally. Instead, systemd-resolved always falls back to the empty values defined in /etc/systemd/resolved.conf.
<img width="1020" height="128" alt="Image" src="https://github.com/user-attachments/assets/d801a1a4-a7be-43fc-9f0a-5342ed72079c" />
As a result, access to internal services via the VPN fails.
Steps to Reproduce
- Replace this symlink
/etc/resolv.confwith a static file, replacing its content with any customnameserverentries. - Run
sudo systemctl restart systemd-networkd systemd-resolved - Run
resolvectl status. - Observe that the servers you set in
/etc/resolv.confdo not appear in the Global section.
Expected behavior
DNS servers provided via /etc/resolv.conf should be used for resolution globally.
Actual behavior systemd-resolved ignores these servers and defaults to empty DNS= and FallbackDNS= values from /etc/systemd/resolved.conf.
Cause
https://github.com/basecamp/omarchy/blame/59c70fdd46f76906fa15650b5f1dbb7511f8cd0c/bin/omarchy-setup-dns#L40
https://github.com/basecamp/omarchy/blame/59c70fdd46f76906fa15650b5f1dbb7511f8cd0c/migrations/1755109182.sh#L18
omarchy-setup-dns and 1755109182.sh migration explicitly writes DNS= and FallbackDNS= into /etc/systemd/resolved.conf.
Workaround
Removing the lines
DNS=
FallbackDNS=
from /etc/systemd/resolved.conf fixes an issue
Suggestion:
@jardahrazdera Perhaps omarchy-setup-dns should avoid writing these keys unless non-empty values are actually needed, to prevent overriding VPN-provided DNS.
View raw text
### System details Omarchy v2.1.0, FortiClient VPN 7.4.3.1736. ### What's wrong? When connecting to a VPN, the VPN client replaces symlink `/etc/resolv.conf` with static file with internal DNS servers. Omarchy’s changes to `/etc/systemd/resolved.conf` prevent these DNS settings from being applied globally. Instead, `systemd-resolved` always falls back to the empty values defined in `/etc/systemd/resolved.conf`. <img width="1020" height="128" alt="Image" src="https://github.com/user-attachments/assets/d801a1a4-a7be-43fc-9f0a-5342ed72079c" /> As a result, access to internal services via the VPN fails. --- **Steps to Reproduce** 1. Replace this symlink `/etc/resolv.conf` with a static file, replacing its content with any custom `nameserver` entries. 2. Run `sudo systemctl restart systemd-networkd systemd-resolved` 2. Run `resolvectl status`. 3. Observe that the servers you set in `/etc/resolv.conf` do not appear in the **Global** section. --- **Expected behavior** DNS servers provided via `/etc/resolv.conf` should be used for resolution globally. **Actual behavior** `systemd-resolved` ignores these servers and defaults to empty `DNS=` and `FallbackDNS=` values from `/etc/systemd/resolved.conf`. --- **Cause** https://github.com/basecamp/omarchy/blame/59c70fdd46f76906fa15650b5f1dbb7511f8cd0c/bin/omarchy-setup-dns#L40 https://github.com/basecamp/omarchy/blame/59c70fdd46f76906fa15650b5f1dbb7511f8cd0c/migrations/1755109182.sh#L18 `omarchy-setup-dns` and `1755109182.sh` migration explicitly writes `DNS=` and `FallbackDNS=` into `/etc/systemd/resolved.conf`. --- **Workaround** Removing the lines > DNS= FallbackDNS= from `/etc/systemd/resolved.conf` fixes an issue --- **Suggestion**: @jardahrazdera Perhaps omarchy-setup-dns should avoid writing these keys unless non-empty values are actually needed, to prevent overriding VPN-provided DNS.
- d801a1a4-a7be-43fc-9f0a-5342ed72079c
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.