{"id":26417669,"url":"https://github.com/sidicer/arch-install-luks-uefi","last_synced_at":"2025-03-18T01:15:48.078Z","repository":{"id":148740231,"uuid":"373162477","full_name":"Sidicer/Arch-Install-LUKS-UEFI","owner":"Sidicer","description":"Step by step guide on how to install arch linux on your machine and configure it with full disk encryption using LUKS and LVM2. As well as using systemd-boot for boot.","archived":false,"fork":false,"pushed_at":"2024-04-06T06:33:17.000Z","size":35,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-04-06T14:45:42.736Z","etag":null,"topics":["archlinux","guide","luks-encryption","lvm2","systemd-boot","tutorial","uefi"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Sidicer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-06-02T12:37:26.000Z","updated_at":"2024-04-06T06:36:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"fcd92215-ab1c-4b83-9fc6-90ae5c22e9a2","html_url":"https://github.com/Sidicer/Arch-Install-LUKS-UEFI","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sidicer%2FArch-Install-LUKS-UEFI","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sidicer%2FArch-Install-LUKS-UEFI/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sidicer%2FArch-Install-LUKS-UEFI/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sidicer%2FArch-Install-LUKS-UEFI/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Sidicer","download_url":"https://codeload.github.com/Sidicer/Arch-Install-LUKS-UEFI/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244135916,"owners_count":20403798,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archlinux","guide","luks-encryption","lvm2","systemd-boot","tutorial","uefi"],"created_at":"2025-03-18T01:15:47.504Z","updated_at":"2025-03-18T01:15:48.069Z","avatar_url":"https://github.com/Sidicer.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Arch Linux Installation\nwith UEFI, full disk encryption using LUKS and LVM2 for volume managament.\n\n---\n\n## Prepare your bootable USB drive\n[Download](https://archlinux.org/download) Arch Linux and `dd` it onto your USB drive\n```sh\n# /dev/sdX - replace with your USB Flash Drive letter (lsblk; fdisk -l)\nsudo dd bs=4M if=/archlinux-2024.04.01-x86_64.iso of=/dev/sdX \u0026\u0026 sync\n```\n\n---\n\n# Installation\n\nCheck if you have network connectivity and sync your system clock\n```sh\nping -c 3 google.com\n```\n\n```sh\ntimedatectl set-ntp true\n```\n\n## Disk partitioning\n\nConfirm your storage layout and note the drive you will be installing to\n```sh\nfdisk -l # or\nlsblk\n# /dev/nvme0n1\n```\n\nPartition the drive to have a 1GB partition for boot and then the rest do Linux Filesystem (as we will be encrypting it)\n```sh\ncfdisk /dev/nvme0n1\n\n# Select Label Type: GPT\n# 1G Partition /boot TYPE=EFI\n# 100%FREE /root TYPE=LINUX_86_64\n```\n\nYou should now have two `/dev/nvme0n1p1` \u0026 `/dev/nvme0n1p2` partitions\n\nFormat the first `1G` partition to `VFAT32`\n```sh\nmkfs.vfat -F32 /dev/nvme0n1p1\n```\nAnd now we can encrypt and setup the our partition\n\n## Disk Encryption\n\nEncrypt the full partition\n```sh\ncryptsetup luksFormat /dev/nvme0n1p2\n# You will have to type \"YES\" to confirm formatting\n```\n\nAfter that succeeds we can open that encrypted partition to work with it\n```sh\ncryptsetup luksOpen /dev/nvme0n1p2 cryptroot\n# You can change \"cryptroot\" to whatever you like, but you will have to\n# remember and use your name instead of cryptroot for the rest of the install\n```\n\n## LVM Creation\n\nA logical volume needs a volume group which in turn needs a physical volume. So lets set those up\n```sh\n# Create your physical volume\npvcreate /dev/mapper/cryptroot\n\n# Create a volume group (I will call it \"vg0\")\nvgcreate vg0 /dev/mapper/cryptroot\n\n# Create the logical volumes (root, home, swap)\n# Notice -L and -l, one is for fixed size, the other is percentage\nlvcreate -L 32G vg0 -n swap # If you plan to use hybernation - set the same size as your RAM\nlvcreate -L 120G vg0 -n root # Modify \"120G\" to what ever size you think fits your root setup\nlvcreate -l 100%FREE vg0 -n home # Fill the rest of the volume group for home\n```\n\nFormat and mount the newly created volumes\n```sh\nmkfs.ext4 /dev/mapper/vg0-root\nmkfs.ext4 /dev/mapper/vg0-home\nmkswap /dev/mapper/vg0-swap\n\nmount /dev/mapper/vg0-root /mnt\n\nmkdir /mnt/home\nmount /dev/mapper/vg0-home /mnt/home\n\nmkdir /mnt/boot\nmount /dev/nvme0n1p1 /mnt/boot\n\nswapon -s /dev/mapper/vg0-swap\n```\n\n## Install the system\n\nInstalls linux kernel, base dependencies and text editor\n```sh\npacstrap -i /mnt base base-devel linux linux-firmware lvm2 vim\n```\n\nI usually install other required packages now rather than after chroot'ing into the system\n```sh\npacstrap -i /mnt networkmanager zsh git curl openssh sysstat intel-ucode\n# If you're on AMD replace \"intel-ucode\" with \"amd-ucode\"\n```\n\n## Generate fstab\n\n```sh\ngenfstab -U /mnt \u003e\u003e /mnt/etc/fstab\n```\n\nCheck if swap was written also\n```sh\ncat /mnt/etc/fstab\n```\nAnd if not find your `vg0-swap` UUID with `blkid /dev/mapper/vg0-swap` and add it at the end of the fstab\n```cfg\nUUID=SWAP_UUID none swap defaults 0 0\n```\n\n##  Chroot into your new system\n```sh\narch-chroot /mnt\n```\n\n### Setup the bootloader (`systemd-boot`)\n\n```sh\nbootctl --path=/boot install\n```\n\nGet the partition UUID which the bootloader will need to load (it should be the partition you encrypted and not the actual LVM)\n```\n# We write it to a file to have it on hand when writing the bootloader entry\nblkid /dev/nvme0n1p2 \u003e /boot/loader/entries/arch.conf\n```\n\nEdit the entry file and add the required info\n```sh\n# vim /boot/loader/entries/arch.conf\n# replace intel-ucode with amd-ucode if AMD\n# replace PARTITION_ID with the UUID that we entered here with blkid in the previous step\n```\n```\ntitle Arch Linux\nlinux /vmlinuz-linux\ninitrd /intel-ucode.img\ninitrd /initramfs-linux.img\noptions cryptdevice=UUID=PARTITION_ID:vg0 root=/dev/mapper/vg0-root quiet splash rw\n```\n\nSave and exit with `:wq` and update bootloader\n```sh\nbootctl update\n```\n\n### Add modules to mkinitpcio\n`vim /etc/mkinitpcio.conf`\nUpdate `HOOKS` to have `encrypt lvm2` between `keymap filesystems`\n```sh\nHOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems fsck)\n```\nIf you have an NVME drive like in this tutorial add it to modules\n```\nMODULES=(nvme)\n```\n\nSave the file with `:wq` and update initramfs\n```sh\nmkinitpcio -p linux\n```\n\n### Miscellaneous configuration \n\nEnable NetworkManager\n```sh\nsystemctl enable NetworkManager\n```\n\nChange your region and localtime, sync clock\n```sh\nln -sf /usr/share/zoneinfo/REGION/CITY /etc/localtime\nhwclock --systohc\n```\n\n```sh\n# Edit /etc/locale.gen and uncomment en_US.UTF-8 UTF-8 and other needed locales. Generate the locales by running:\nlocale-gen\n\necho \"LANG=en_US.UTF-8\" \u003e /etc/locale.conf\n```\n\nSetup your hostname\n```bash\necho Archlinux \u003e /etc/hostname\n```\n\nSetup root password:\n```bash\npasswd\n```\n\nExit chroot, unmount partitions and reboot\n```bash\nexit #(ctrl+d)\numount -R /mnt\nreboot\n```\n\n## After Booting up\n\nJust in case, update everything:\n```bash\npacman -Syy\npacman -Syu\n```\n\nCreate another user (DO NOT USE ROOT FOR DAILY USE!)\n```bash\nvisudo\n# Find where it says \"root ALL=(ALL) ALL\".\n# Type \"o\" to insert a new line below it.\n# Now type what you want to insert, eg \"username ALL=(ALL) ALL\".\n# Hit esc to exit insert-mode.\n# Type \":x\" to save and exit.\n```\n```bash\nuseradd -m -g users -G wheel -s /bin/bash USERNAME\npasswd USERNAME\n```\n\n## Setup SSH\n\n```bash\n# Whenever changing the configuration, use sshd in test mode before restarting the service to ensure it will be able to start cleanly. Valid configurations produce no output.\n# use: sshd -t\n```\nSetup SSH Welcome Banner:\n```bash\nsudo vim /etc/ssh/sshd_config\n# Uncomment # Banner /etc/issue\n# :wq\n```\n```bash\nsudo vim /etc/issue\n# Add a welcome message\n# :wq\n```\n```bash\nsudo systemctl start sshd\nsudo systemctl enable sshd\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsidicer%2Farch-install-luks-uefi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsidicer%2Farch-install-luks-uefi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsidicer%2Farch-install-luks-uefi/lists"}