Editions, Hyprnux

Same desktop, three ways to take updates. Community and Pro are free; Enterprise is paid, on request. Contact us about Enterprise

Only Community can be installed: Pro and Enterprise machines start from the Hyprnux installer image, which is not published.

Community: for your own computer.
Pro: for work machines that should change less often.
Enterprise: for an organization with many machines, central login or an audit trail.

Hold-back: a wait of some days before an Arch update reaches your computer.

What each edition has
Every edition, on the installer image
	CommunityFree, open source	ProFree, open source	EnterprisePaid, on request
Price	Free.	Free.	Paid, on request. The tools are listed below.
Updates	Arch’s packages, as soon as they are published.	Designed to hold Arch updates back 7 days. Off until you switch it on.	Designed to hold Arch updates back 30 days. Off until you switch it on.
Security	The defaults, listed in the rows below.	Same as Community, plus an optional password rule.	Same as Pro, and the optional password rule also covers the administrator account (root). Plus an audit trail that records changes to the system and commands a person runs as root.
Encryption	The system and its swap are encrypted (LUKS). The small boot partition is not. The installer sets a temporary passphrase, which the first start replaces with yours, unless you choose to keep it. Once replaced, the disk is protected by your passphrase alone.
Firewall	On by default. Incoming connections are refused, except answers to ones your computer opened and a few basic network services. Outgoing traffic is not filtered.
Secure time	The time is set from secure time servers (NTS), which prove their answers are genuine. Ordinary servers take over when NTS is blocked.
Packages	Hyprnux’s own packages come ahead of Arch’s. The Community edition reads them from the `hyprnux-core` repository.
Tools for organizations Paid, on requestNone of these is a package you download. Each is built with you.
Identity
Centralized login	Sign in to every machine with the organization’s accounts.
Strong sign-in	Require a security key or a second factor to sign in.
Data
Centralized storage	Storage shared by the organization’s machines, mounted when someone signs in.
Central logs	Send each machine’s journal and audit trail to the organization’s own log server.
Disk unlock and recovery	Unlock encrypted disks with the organization’s keys, and recover access to those disks.
Fleet and updates
Staged rollout	Roll an update out to a pilot group first, then to everyone.
Fleet deployment	Install and configure many machines the same way, from one description.
Control
Managed settings	Set the desktop’s options for a group of machines, and lock the ones people should not change.
Software allowlist	Choose which applications people can run.
Device control	Allow or block USB storage and other devices.

The Security row above applies to a machine installed from that image; your own Arch gets the signed packages only.

The details of each policy are in the System policies guide. To see how the hold-back works day to day, read the Updates guide.

How the hold-back works

The hold-back is a delay before Arch updates are installed. It is a setting of Pro and Enterprise, off by default.

What it does. When it is on, pacman reads Arch’s packages from the Arch Linux Archive as it was 7 days ago on Pro, 30 days ago on Enterprise, instead of from Arch’s mirrors. A daily timer works out that date and writes it into pacman’s configuration, so a normal sudo pacman -Syu upgrades against one coherent day.
If the archive cannot be reached. The machine never falls back to Arch’s current packages. One that already follows a date keeps it. One that has just switched the hold-back on points at the date it should follow without having checked it, and its updates fail until the archive answers.
How to switch it on. Set GATING_ENABLED=true in /etc/hyprnux/mirror-gating.conf, where the number of days is also set.
The limit. It is off by default, because a delayed Arch also delays Arch’s security fixes. The delay is not a guarantee: it gives other machines time to meet a broken update, and nothing here promises a fix for one.

What is free, what is paid

Free for everyone

The whole desktop, the glass effects, Settings, the launcher, encryption, the firewall, time sync from secure time servers and the signed repositories. All of it is open source.

Paid, on request

Only features built for large organizations, of no use to an individual or a small business, such as centralized login or fleet deployment.

How Enterprise starts

Enterprise is paid and sold on request. The list above names the tools organizations ask for. Each one is set up with you, for your machines. Support terms and price are agreed when you contact us.

You tell us what you need. The tools you want, from the list above or beyond it.
We study them with you. We check them against your machines and your rollout.
You get the tools. We build them in time for your rollout.