Minimal instructions for installing arch linux on an UEFI system with full system encryption using dm-crypt and luks

arch-linux-install

# Install ARCH Linux with encrypted file-system and UEFI
# The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

# Download the archiso image from https://www.archlinux.org/
# Copy to a usb-drive
dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

# Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

# Set swedish keymap
loadkeys sv-latin1

# This assumes a wifi only system...
wifi-menu

# Create partitions
cgdisk /dev/sdX
1 100MB EFI partition # Hex code ef00
2 250MB Boot partition # Hex code 8300
3 100% size partiton # (to be encrypted) Hex code 8300

mkfs.vfat -F32 /dev/sdX1
mkfs.ext2 /dev/sdX2

# Setup the encryption of the system
cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sdX3
cryptsetup luksOpen /dev/sdX3 luks

# Create encrypted partitions
# This creates one partions for root, modify if /home or other partitions should be on separate partitions
pvcreate /dev/mapper/luks
vgcreate vg0 /dev/mapper/luks
lvcreate --size 8G vg0 --name swap
lvcreate -l +100%FREE vg0 --name root

# Create filesystems on encrypted partitions
mkfs.ext4 /dev/mapper/vg0-root
mkswap /dev/mapper/vg0-swap

# Mount the new system 
mount /dev/mapper/vg0-root /mnt # /mnt is the installed system
swapon /dev/mapper/vg0-swap # Not needed but a good thing to test
mkdir /mnt/boot
mount /dev/sdX2 /mnt/boot
mkdir /mnt/boot/efi
mount /dev/sdX1 /mnt/boot/efi

# Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
# Unless vim and zsh are desired these can be removed from the command
pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant

# 'install' fstab
genfstab -pU /mnt >> /mnt/etc/fstab
# Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)
tmpfs	/tmp	tmpfs	defaults,noatime,mode=1777	0	0
# Change relatime on all non-boot partitions to noatime (reduces wear if using an SSD)

# Enter the new system
arch-chroot /mnt /bin/bash

# Setup system clock
ln -s /usr/share/zoneinfo/Europe/Stockholm /etc/localtime
hwclock --systohc --utc

# Set the hostname
echo MYHOSTNAME > /etc/hostname

# Update locale
echo LANG=en_US.UTF-8 >> /etc/locale.conf
echo LANGUAGE=en_US >> /etc/locale.conf
echo LC_ALL=C >> /etc/locale.conf

# Set password for root
passwd

# Add real user remove -s flag if you don't whish to use zsh
# useradd -m -g users -G wheel,storage,power -s /bin/zsh MYUSERNAME
# passwd MYUSERNAME

# Configure mkinitcpio with modules needed for the initrd image
vim /etc/mkinitcpio.conf
# Add 'ext4' to MODULES
# Add 'encrypt' and 'lvm2' to HOOKS before filesystems

# Regenerate initrd image
mkinitcpio -p linux

# Setup grub
grub-install
In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks:allow-discards" then run:
grub-mkconfig -o /boot/grub/grub.cfg

# Exit new system and go into the cd shell
exit

# Unmount all partitions
umount -R /mnt
swapoff -a

# Reboot into the new system, don't forget to remove the cd/usb
reboot

install-pacaur.sh

#!/bin/sh
#
# The MIT License (MIT)
#
# Copyright (c) 2015-2016 Stefan Tatschner
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.

buildroot="$(mktemp -d)"

# Ask for user passwort once, see sudo(8).
sudo -v

# Fetch Dave Reisner's key to be able to verify cower.
gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 487EACC08557AD082088DABA1EB2638FF56C0C53

# Make sure we can even build packages on arch linux.
sudo pacman -S --needed --noconfirm base-devel git

mkdir -p "$buildroot"
cd "$buildroot" || exit 1

git clone "https://aur.archlinux.org/cower.git"
git clone "https://aur.archlinux.org/pacaur.git"

cd "${buildroot}/cower" || exit 1
makepkg --syncdeps --install --noconfirm

cd "${buildroot}/pacaur" || exit 1
makepkg --syncdeps --install --noconfirm

cd "$HOME" || exit 1
rm -rf "$buildroot"

uefi setup

# **************** READ THIS FIRST ******************
#
# This is not a script for you to run. I repeat, do not download and run this!
#
# This is only a guide to show the required steps for successful UEFI + GRUB2 installation
# Many of the choices are examples or assumptions; don't blindly type shit into your machine
# until/unless you at least read the comments around each command
#
# These steps assume you've booted in UEFI mode by preparing your USB stick per these instructions:
# https://wiki.archlinux.org/index.php/UEFI#Archiso
#
# If you're using an actual CD burned from the official Arch ISO, just make sure you've booted it in UEFI mode

# Assuming /dev/sda is the target disk
parted /dev/sda # or gdisk or cgdisk or etc...
# Make a partition of type EF00 (EFI System Partition, or ESP)
# Might want to name it something useful like "efi"
# Make your other partition(s) as you see fit

# Create ESP filesystem
mkfs.vfat -F32 -n efi /dev/sda1 # -F## is not required on most firmwares; FAT12/16 usually work

# In this example, I'm using btrfs
mkfs.btrfs -KL root /dev/sda2

# Mount the needful -- note the btrfs-specific mount options
mount -o ssd,discard,noatime,compress=lzo /dev/sda2 /mnt
mkdir -p /mnt/boot # Or /mnt/boot/efi if you *only* want the grub binary on the ESP
mount -o noatime /dev/sda1 /mnt/boot # See above

# Networking stuff
# ...

# Install as per usual, but snag grub-efi
pacstrap /mnt base base-devel grub-efi-x86_64

# Facestab needfuls
genfstab -pU /mnt >> /mnt/etc/fstab

# Chroot, and gimme some bash plox
arch-chroot /mnt /bin/bash

# Do other installation needfuls
# ...

# Bootloader install
grub-install

# Can check/modify UEFI firmware entries
efibootmgr # -t 0 for timeout, -b xxxx -B xxxx to delete, etc

# Generate grub.cfg
grub-mkconfig -o /boot/grub/grub.cfg

# Exit chroot
exit

# Rebooten Sie!
reboot