omarchy-moonlight

Idempotent install scripts that set up Sunshine (host) and Moonlight (client) on Omarchy / Arch Linux / Hyprland / Wayland machines.

Designed so the same script runs on:

• a primary NVIDIA desktop (host + client)
• a Framework AMD laptop (host + client)
• any other Omarchy box

After install, the machine can both stream out (via Sunshine) and view streams (via Moonlight). A Macbook can install Moonlight separately and connect to either Linux host.

Quick start

git clone <this-repo> ~/omarchy-moonlight
cd ~/omarchy-moonlight
./install.sh

Then:

1. Log out and back in if you weren't already in the input group (the installer adds you; the group only takes effect on a fresh login).
2. Open https://localhost:47990 and set a Sunshine username + password.
3. On a Moonlight client (Mac / phone / the other Linux box), add this host by LAN IP and enter the PIN that Sunshine's web UI shows during pairing.

What it does

• Installs sunshine and moonlight-qt from the AUR via yay
• Adds your user to the input group
• Drops a /etc/udev/rules.d/60-uinput.rules if no equivalent rule exists (so Sunshine can use /dev/uinput for virtual gamepad/keyboard/mouse)
• Runs setcap cap_sys_admin+p on the sunshine binary so KMS screen capture works without root
• Installs GPU-vendor encoder packages:
  • NVIDIA: nvidia-utils, libva-nvidia-driver
  • AMD: libva-mesa-driver, mesa-vdpau, vulkan-radeon
  • Intel: intel-media-driver, vulkan-intel
• Opens Sunshine's LAN ports on firewalld / ufw if either is active (skips silently otherwise)
• Enables sunshine.service under systemd --user and turns on loginctl enable-linger so the host is reachable without a graphical login

Re-running is safe — every step is "check, then act."

Flags

./install.sh --no-autostart   # install but don't enable the user service
./install.sh --no-firewall    # skip firewall rules
./install.sh --no-moonlight   # host-only (no client)
./install.sh --no-sunshine    # client-only (no host)

Use the precompiled Sunshine package

The default uses sunshine from the AUR, which builds from source (slow on first install). To use the precompiled sunshine-bin instead:

SUNSHINE_PKG=sunshine-bin ./install.sh

Uninstall

./uninstall.sh             # remove packages + udev rule, keep user data
./uninstall.sh --purge     # also delete ~/.config/sunshine

How streaming works once it's set up

• Host (Sunshine) ports (auto-opened if a firewall is active):
  • TCP: 47984 47989 47990 48010
  • UDP: 47998 47999 48000 48010
• Pairing: on first connect, Moonlight shows a PIN. Type it into Sunshine's web UI (https://localhost:47990 → PIN tab) within a few seconds.
• Capture mode: this script configures KMS capture, which streams whatever is on the host's real monitor. A virtual-display mode (so streaming doesn't take over the desk) is a future addition — see remote/ notes when it lands.

Diagnostics

systemctl --user status sunshine
journalctl --user -u sunshine -f
getcap "$(readlink -f "$(command -v sunshine)")"   # should include cap_sys_admin
id -nG | tr ' ' '\n' | grep -x input               # confirm group membership

If Moonlight pairs but the stream is black:

• Confirm you're in the input group in a freshly logged-in session (not just listed in /etc/group).
• Confirm getcap shows cap_sys_admin on the sunshine binary.
• Check journalctl --user -u sunshine for KMS / DRM errors. On NVIDIA, ensure the proprietary driver is active (nvidia-smi).

Remote access (planned)

LAN-only for now. Remote access will be added later via one of: Tailscale, WireGuard, or Cloudflare. See remote/ (stub) when implemented.

Layout

omarchy-moonlight/
├── install.sh
├── uninstall.sh
├── README.md
├── lib/
│   ├── common.sh         # logging, sudo, idempotency helpers
│   ├── detect.sh         # GPU vendor, session type, hostname
│   ├── packages.sh       # yay -S sunshine moonlight-qt + GPU encoders
│   ├── permissions.sh    # input group, uinput udev, setcap cap_sys_admin
│   ├── firewall.sh       # ufw/firewalld detection + port opening
│   └── service.sh        # systemctl --user enable + loginctl enable-linger
└── files/                # (reserved — drop-in config files if needed later)