shawn@home:~/blog >_

Arch Linux UEFI+Encrypted+i3 Minimal Installation

22 Jul 2021

So I finally got around to installing Arch Linux on my Node 202 SFF PC build. There’s still no GPU yet since prices are still pretty high as of writing this, but I figured I might as well install Arch on it while I wait for GPU prices to drop. This post will be documenting how to install Arch Linux on a UEFI system with an encrypted disk and i3/i3-gaps. This will also be using systemd-boot instead of GRUB. I’ll make future posts about my ricing setup soon.

Assumptions

The following assumptions will be made:

1. Secure boot has been disabled.
2. The system is using UEFI.
3. The system is Wi-Fi capable.

Deliverables

By the end of this, the following deliverables will be met:

1. A minimal Arch Linux installation.
2. Separate boot, swap, root, and home partitions.
3. Encrypted swap/root/home partitions.
4. A systemd-boot boot manager.
5. An i3/i3-gaps tiling window manager.

Installation Procedure

1. Load the Arch Linux installation image onto a USB stick or other installation medium and boot to it from the target device.

2. Once you’re booted into the Arch Linux installation medium, make sure that you’re booted in UEFI. The following command should run with no errors. If there are errors, then you’re not booted in UEFI.

$ ls /sys/firmware/efi/efivars/

3. Connect to the internet.

$ iwctl
[iwd]# device list
[iwd]# station <DEVICE> scan
[iwd]# station <DEVICE> get-networks
[iwd]# station <DEVICE> connect <SSID>
[iwd]# quit

4. Enable NTP.

$ timedatectl set-ntp true

5. Find out the name of your drive and start partitioning. This is usually going to be something like sda, sdb, or nvme0n1, in which case the <DEVICE>s would be /dev/sda, /dev/sdb, or /dev/nvme0n1, respectively.

$ lsblk
$ gdisk <DEVICE>

From here, you can enter n to create a new partition. If you’re overwriting whatever data is pre-existing on the drive, then you’ll also want to enter o before you enter n.

We need two partitions at this point: the boot partition, and the LVM partition.

You can then enter p to print out the partitions being made and verify that they are correct, and then enter w to write the partitions.

6. Find out the name of the newly made partitions and format the boot partition.

$ lsblk
$ mkfs.fat -F 32 <BOOT_PARTITION>

7. Create and format the encrypted LVM swap, root, and home partitions.

$ modprobe dm-crypt
$ cryptsetup luksFormat <LVM_PARTITION>
$ cryptsetup open --type luks <LVM_PARTITION> lvm
$ pvcreate /dev/mapper/lvm
$ vgcreate vg0 /dev/mapper/lvm
$ lvcreate -L 4G vg0 -n swap
$ lvcreate -L 64G vg0 -n root
$ lvcreate -l 100%FREE vg0 -n home
$ mkswap /dev/vg0/swap
$ mkfs.ext4 /dev/vg0/root
$ mkfs.ext4 /dev/vg0/home

8. Mount everything.

$ mount /dev/vg0/root /mnt
$ mkdir /mnt/boot /mnt/home
$ mount <BOOT_PARTITION> /mnt/boot
$ mount /dev/vg0/home /mnt/home

9. Enable the swap.

$ swapon /dev/vg0/swap

10. Install essential packages.

$ pacstrap /mnt base base-devel linux linux-firmware lvm2 vim

11. Generate the filesystems table.

$ genfstab -U /mnt >> /mnt/etc/fstab

12. Change root into the install.

$ arch-chroot /mnt

13. Install a network manager.

$ pacman -Sy networkmanager

14. Set the timezone.

$ ln -sf /usr/share/zoneinfo/<REGION> /etc/localtime

<REGION> can be found by hitting tab a few times and going through the suggested responses. For example, mine would be /usr/share/zoneinfo/US/Pacific since I’m in California.

15. Set the hardware clock from the system clock and update /etc/adjtime.

$ hwclock --systohc

16. Generate the locale.

$ vim /etc/locale.gen

You’ll want to uncomment whatever your locale is and then save the file. For example, I would uncomment en_US.UTF-8 UTF-8. If you’re from the United States like me, then you would probably uncomment the same thing as well.

$ locale-gen
$ vim /etc/locale.conf

Add LANG=<LOCALE> to /etc/locale.conf and save the file, where <LOCALE> is the first part of what you uncommented earlier. For example, I would write LANG=en_US.UTF-8.

17. Define the hostname.

$ echo <HOSTNAME> > /etc/hostname
$ vim /etc/hosts

Your /etc/hosts file should look something like the following:

# Static table lookup for hostnames.
# See hosts(5) for details.

127.0.0.1  <HOSTNAME>.<DOMAIN>  <HOSTNAME>
::1        <HOSTNAME>.<DOMAIN>  <HOSTNAME>

For example, mine would look like:

# Static table lookup for hostnames.
# See hosts(5) for details.

127.0.0.1  anubis.net  anubis
::1        anubis.net  anubis

18. Configure the hooks.

$ vim /etc/mkinitcpio.conf

You’ll want to find the HOOKS variable and set it to the following values. It is very important that it is in this order, or else you won’t be able to decrypt your drive!

HOOKS="base udev autodetect modconf block keyboard encrypt lvm2 filesystems fsck"

Remember to save your file, and then run:

$ mkinitcpio -p linux

19. Set the root password.

$ passwd

20. Configure the bootloader.

$ bootctl --path=/boot install
$ vim /boot/loader/loader.conf

Your /boot/loader/loader.conf should look something like the following:

default arch
timeout 3
editor 0

Then you need to create the bootloader entry.

$ vim /boot/loader/entries/arch.conf

title Arch Linux
linux /vmlinuz-linux
initrd /initramfs-linux.img
options cryptdevice=UUID=<UUID>:lvm root=/dev/mapper/vg0-root quiet rw

<UUID> can be retrieved by running :r !blkid <LVM_PARTITION> from within vim.

21. Wrap up and power down.

$ exit
$ umount -R /mnt
$ poweroff

Post-Installation Procedure

Now it’s time to set up some basic stuff like networking, a user account, extra display drivers, and i3/i3-gaps.

1. Remove the installation medium from the computer.
2. Boot into the computer. Boot into Arch Linux and enter the decryption password.
3. Log into the root account and enter the root password.
4. Create a user account.

$ useradd -m -G wheel <USERNAME>
$ passwd <USERNAME>

5. Give the user sudo permissions.

$ vim /etc/sudoers

Uncomment the following line in the /etc/sudoers file:

%wheel ALL=(ALL) ALL

6. Log out of the root account and log in as the new user using the configured password.

$ exit

7. Enable networking and connect to a network.

$ systemctl enable NetworkManager
$ systemctl start NetworkManager
$ nmtui

8. Install i3/i3-gaps, fonts, and X.

$ sudo pacman -Sy i3-gaps ttf-dejavu xorg xorg-xinit xterm

9. Install extra display drivers based on your system. You should be picking only one of these three:

$ sudo pacman -Sy xf86-video-intel mesa
$ sudo pacman -Sy xf86-video-amdgpu mesa
$ sudo pacman -Sy nvidia nvidia-utils

10. Configure the xinitrc to automatically start i3. If you installed i3-gaps instead of i3, this is still the same.

$ echo "exec i3" > ~/.xinitrc

11. Configure the Bash profile to automatically start X.

$ vim ~/.bash_profile

#
# ~/.bash_profile
#

[[ -f ~/.bashrc ]] && . ~/.bashrc

if systemctl -q is-active graphical.target && [[ ! $DISPLAY && $XDG_VTNR -eq 1 ]]; then
	exec startx 1>/dev/null 2>&1
fi

12. Reboot.

You should now have an Arch Linux installation with an encrypted disk, i3/i3-gaps, systemd boot, and separate boot, swap, root, and home partitions! I’ll be making another post in the future about ricing up this installation.

Happy hacking!