Omasnatch

Little Snitch for Omarchy — read-only by design. A shield in your bar that shows which apps on this machine are talking to which hosts on the internet — live, with per-app breakdowns, blocked activity, and one click into the full firewall interface. It shows you what OpenSnitch sees and changes nothing behind your back: the only thing it can ever write to OpenSnitch is one opt-in setup button, spelled out in Read-only by design below.

Powered by OpenSnitch. New to OpenSnitch? It's the interactive application firewall for GNU/Linux — the open-source counterpart to macOS's Little Snitch. It watches every outbound connection, knows exactly which application made it, and either asks you or applies a rule. You install it from the official Arch repos; Omasnatch puts its live picture in your bar.

What you get

• Shield in the bar — turns urgent-red the moment the firewall engine stops running, so you notice without opening anything.
• Apps — what's open and talking right now: running apps first (marked with a filled dot), each with the number of connections it has made since midnight (or since your last reset). Click an app to see every host it has contacted, how often, and whether OpenSnitch allowed or denied each one.
• Recent — the latest connections: time, app, destination host and port, and whether each was allowed or blocked.
• Blocked — just the denials, with a live count on the tab.
• Hosts — top destinations by connection count, with proportional bars.
• Resettable window — the little restart glyph next to "connections today" (or press r) restarts the panel from this moment: the headline count, the stat chips, and every tab — Recent, Blocked, Apps, Hosts, and the per-app close-ups — then show only what happened after the reset. Perfect for "what happens when I open this app?" experiments. It only moves a counting baseline — no history is deleted, the full record stays in OpenSnitch — and it rolls back to the normal since-midnight view at midnight.
• Guided setup — if anything in the engine → agent → storage chain isn't ready, the panel shows a live checklist instead of empty tabs: it detects each step, ticks them off as they complete, and offers one-click help for the safe parts.
• One key to the real thing — press o (or click the footer button) to open the full OpenSnitch window for rules, preferences, and history.

Read-only by design

Omasnatch never changes anything on its own. It does not create or edit rules, does not touch OpenSnitch's settings, does not install packages, and does not start, stop, or restart any system service. The event database is opened in SQLite's read-only mode, and when something needs setting up, the panel shows you what to do rather than doing it behind your back.

There is exactly one, clearly-labeled exception: the setup checklist's "Set it up for me" button. It appears only when event storage is not yet a database file, and — when you click it — creates the default ~/.config/opensnitch/events.db, points OpenSnitch's event storage at it, and restarts the prompt agent so it takes effect. It changes nothing else, never runs on its own, and if a database file is already configured its script refuses to touch anything — an existing setup cannot be overwritten, clicked or not. Beyond that, the only file the plugin ever writes is its own counting baseline in ~/.local/state/omasnatch/.

Install

If you already have OpenSnitch on your machine

One command — Omasnatch drops straight on top of your existing setup:

omarchy plugin add https://github.com/weedwhitesandwine/omasnatch.git --enable

Your rules, settings, and history are untouched — the plugin only reads. The one thing the panel needs is event storage in a database file rather than in memory (OpenSnitch's out-of-the-box default is memory). If your history is in memory, the panel's setup checklist offers a one-click switch — or set Preferences → Database → Database type: File yourself in the OpenSnitch window. If you already record events to a file — any path — it is used exactly as-is: the storage step ticks itself, and the checklist only ever appears if something genuinely isn't running (for example the prompt agent).

What changing from memory to file means: by default OpenSnitch keeps its record of connections inside the running prompt agent — it disappears when the agent closes, and no other program can read it. Set to File, the same record is written to a database file on disk instead (~/.config/opensnitch/events.db unless you pick another path): it survives restarts and logouts, the panel can read it, and OpenSnitch otherwise behaves exactly the same. The file grows over time unless you also set the purge-events-older-than-N-days option beside it, which caps it at a rolling window.

If you do not yet have OpenSnitch

(Worth reading this whole section before you start: OpenSnitch's factory settings ask about every new app, and knowing how that behaves — and how to change it — makes the first hour much smoother. Some users may prefer OpenSnitch to run in passive mode instead — no pop-ups, nothing blocked — which is covered in the passive setup section.)

1. Install the plugin:

   omarchy plugin add https://github.com/weedwhitesandwine/omasnatch.git --enable

2. Click the new Omasnatch shield in your bar — it will be red, because there is no engine yet. The panel opens with a setup checklist that walks you through everything and ticks each step off as it completes:

   • Install and start the engine — the checklist shows the two commands to run in a terminal (one package from the official extra repo; this is the only privileged part, and it is always yours to run — the plugin never installs or starts anything itself).
   • Start the prompt agent — one click. This is OpenSnitch's own background program that records events and shows its pop-ups.
   • Store events in a file — one click creates ~/.config/opensnitch/events.db and restarts the agent; nothing else changes.

   When the list is done, the panel comes alive.

If a step stops being true later — say the prompt agent quits — the checklist comes back on its own, showing only what's left.

Doing it by hand instead — the checklist's manual equivalents, in the order that avoids doing anything twice:

1. Install and start the engine:

   omarchy pkg add opensnitch
   sudo systemctl enable --now opensnitchd

2. Configure event storage first: open the OpenSnitch window by running opensnitch-ui in a terminal, then open Preferences → Database and change Database type to File. A file button appears: click it, and in the save dialog name the new file OpenSnitch should create — it doesn't exist yet. Go to your ~/.config/opensnitch/ folder and type events.db as the filename (the conventional spot; any path works). Optionally tick the purge-events-older-than-N-days option to cap its size. Click Apply.

3. OpenSnitch will say the GUI needs a restart for the change to take effect — and that restart is simply starting the prompt agent the way it should run from now on, in the background:

   pkill -f opensnitch-ui && sleep 2 && opensnitch-ui --background

   To start it at every login, add this to ~/.config/hypr/autostart.lua:

   o.launch_on_start("opensnitch-ui --background")

Two important things about OpenSnitch's factory ask-mode — what a fresh install runs until you change it:

• Answer every pop-up rather than ignoring it. Careful: an ignored pop-up denies that app for 12 hours when its countdown runs out — a suddenly quiet browser is the classic symptom, and the Blocked tab will show it. If that happens, sudo systemctl restart opensnitchd clears the temporary deny.
• Would you rather never see a pop-up at all? Set up the fully passive watch-only mode below.

Prefer a fully passive, watch-only setup?

If you only want to see what's phoning home — no pop-ups, nothing ever blocked by default, no interruptions — set it up in OpenSnitch itself. Open OpenSnitch (press o in the panel), click the settings icon, and on the Pop-ups tab set it up like this — pop-ups disabled, default action allow:

Click Apply. Then on the UI tab, open Desktop notifications and untick Enable:

Click Apply, then Save. OpenSnitch now records everything, allows anything no rule matches, and never interrupts you. The panel's status line confirms it: "Watch-only · everything auto-allowed". (With Duration set to forever, OpenSnitch also saves a permanent allow rule for each new app — harmless, and you can prune them any time in its Rules tab.) Omasnatch itself never changes the mode — these settings are yours.

One last check after going passive: if OpenSnitch ran in ask-mode for a while first, a deny may have slipped in along the way — an ignored pop-up, or a hasty click on one. Open OpenSnitch's Rules tab and look for any rule with action deny that you didn't create on purpose: right-click it and choose Delete. Deny rules keep working in passive mode (rules always outrank the default action), so a stray one means some app stays silently blocked while everything else is auto-allowed.

Summon with a hotkey

Add to ~/.config/hypr/bindings.lua:

o.bind("SUPER + SHIFT + S", "Toggle Omasnatch", "omarchy-shell shell toggle io.github.weedwhitesandwine.omasnatch")

(Pick any free key combination you like.)

Panel keys

Key	Action
1–4	Jump to tab
← / →	Switch tab
↑ / ↓	Scroll
click an app	Show every host it contacted, with verdicts
o	Open the full OpenSnitch window
r	Restart the connection count from now
Esc	Back out of an app close-up, or close the panel

How it works

• Panel.qml runs collector.py only while the panel is open. The collector reads the event database strictly read-only (SQLite URI mode=ro), asks systemctl is-active opensnitchd (a read-only query), and checks process names in /proc to mark which apps are currently running. It writes nothing, anywhere.
• Between opens, the bar icon's only activity is deciding its color: the same read-only systemctl is-active opensnitchd query, once every 30 seconds.
• The reset control runs reset.py, which writes a timestamp in the plugin's own state directory and never touches OpenSnitch.
• The setup checklist's storage button runs setupdb.py — the one piece of code in the plugin that can write an OpenSnitch setting. It fills in event storage only when none is configured, refuses to run at all if a database file is already set, restarts the prompt agent so the change takes effect, and never runs without the click. The edit is written atomically — staged under an exclusively-created temporary name and renamed over the file — and follows a symlinked settings.conf only to a target you own, so a config managed by a dotfile tool still works while a link pointing elsewhere is refused rather than written through.
• There is no background service. The plugin does not keep the prompt agent alive and does not restart anything on its own: if the agent isn't running the panel says so, and the checklist's buttons act only when you click them.
• Nothing in this plugin runs privileged. The privileged steps — installing the engine and enabling the system daemon — are commands you run yourself, shown above and in the panel.

A note on what you're seeing: everything in the panel — counts, lists, and per-app close-ups — shows activity since midnight, or since you last pressed reset. OpenSnitch's event store keeps one row per unique flow (app + destination + port), so identical connections aren't repeated, and whatever retention/purge settings you chose in OpenSnitch apply to what the panel can read. The complete history lives in OpenSnitch itself — press o.

Uninstall

omarchy plugin remove io.github.weedwhitesandwine.omasnatch

Optionally remove the engine and its data:

sudo systemctl disable --now opensnitchd
sudo pacman -Rns opensnitch
rm -f ~/.config/opensnitch/events.db*

Credits

Built by weedwhitesandwine with Claude Code as a contributor.

License

MIT