This is an instruction on how to setup Linux Mint/LMDE with BTRFS and Full Disk Encryption using LUKS the way that the installer does it with LVM

linux-mint-btrfs-fde.md

Linux Mint and LMDE BTRFS setup guide with Full Disk Encryption using LUKS2

Disclaimer 1

Doing this requires a bit of technical knowledge about filesystems, partitioning and disk labels. If you don't know what UUID is or how to check if your system uses BIOS or UEFI, go learn some more and come back.

Disclaimer 2

Read THE WHOLE instruction first, understand what it does, then try it yourself, first in a VM (I recommend virt-manager). Really, read the whole thing first.

Disclaimer 3

All that is written here, you do at your own risk. I do not take any responsibility for any data or hardware loss (if you somehow manage to damage your hardware...), or any security risks. This workes for me and I feel confident using this, but I am the author. Do your own research, see if it works for you and decide if you want to use it or not. I do not claim this is the best or perfect solution.

Disclaimer 4

I will be using here drives /dev/sda and /dev/sdb. Your drives may (and probably will) be different. Change commands respectively.

Disclaimer 5

It was brought to my attention, that having encrypted data partition and unencrypted SWAP is not very secure, as SWAP can be used as a gateway to bypass the encryption. I have changed the procedure slightly to use ZRAM, which is standard in FDE BTRFS RAID setups (eg. Fedora uses this method). All that is written in Disclaimer 3 is still valid.

---

What we're trying to achieve?

A Linux Mint/LMDE installation with BTRFS and Full Disk Encryption (FDE) in a way that Mint does out of the box with LVM (only one password prompt).

Step 1 - Partitioning

Boot into a Mint or LMDE live environment and open GParted.

Choose a name for your root container. Since I use LMDE, in this instruction it will be lmde_root.

DELETE ALL THE PARTITIONS THAT CURRENTLY EXIST

Partition your /dev/sda drive as described below:

Disk label: GPT

/dev/sda1:

• size: 512 MB
• filesystem: fat32
• label: ESP
• flags: boot,esp

/dev/sda2:

• size: 1024 MB (or 2048 MB if planning to use custom kernels, like xanmod)
• filesystem: ext4
• label: boot
• flags: none

/dev/sda3:

• size: rest of the disk
• filesystem: btrfs
• label: lmde_root
• flags: none

Save the partitioning and close GParted.

Step 2 - Installation

Start installation wizard and go through it as normal. When it asks where to install the system, choose "Manual partitioning"

Edit the options of partitions you just created as follows:

/dev/sda1:

• mount point: /boot/efi
• format: no

/dev/sda2:

• mount point: /boot
• format: no

/dev/sda3:

• mount point: /
• format: btrfs

Click Next and select to install GRUB on /dev/sda. Rest of the installation proceeds as normal.

DO NOT REBOOT THE PC WHEN IT FINISHES INSTALLING!

Step 3 - Encryption

At this point the installed correctly installed the system, GRUB and created two BTRFS subvolumes - @ for root and @home for home. This is standard practice, supported eg. by Timeshift for in-place snapshots.

We will be using cryptsetup's reencrypt command. First we need to make space for LUKS header. To do that we have to mount the @ subvolume and reduce its size by 32 MB. Open the terminal, go into sudo mode (sudo su) and do as follows:

mount /dev/sda3 -o subvol=@ /mnt
btrfs filesystem resize -32m /mnt
umount /mnt

Next we will encrypt the partition. Choose strong and complicated password, that you will remember - this will be the password you have to type in every time your PC boots. It is recommended that the encryption password is different than user account password.

cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/sda3

You will be first asked to type YES in capital letters to confirm, and then to type in your encryption password twice. The process will take some time, depending on your disk size (for 50 GB in a VM it takes about 2 minutes). The partition is now encrypted and closed.

Step 4 - Final touches, encryption and ZRAM configuration in chroot

Next step is to open the partition/LUKS container with the name you chose in the beginning. In this example it's lmde_root. Yours may be different (the label you gave to /dev/sda3).

cryptsetup luksOpen /dev/sda3 lmde_root

You will be asked for the encryption password. Next we will mount all the partitions, so we can chroot into them. Pay close attention to the partitions/drives, mountpoints and the order of mounting, as this is crucial.

mount /dev/mapper/lmde_root -o subvol=@ /mnt
mount /dev/mapper/lmde_root -o subvol=@home /mnt/home
mount /dev/sda2 /mnt/boot
mount /dev/sda1 /mnt/boot/efi
mount --bind /dev /mnt/dev
mount --bind /sys /mnt/sys
mount --bind /proc /mnt/proc
chroot /mnt /bin/bash

Now we are inside our brand new system. Congrats, we only have a few more steps to go through. First of all, we need to re-extend the filesystem (remember, we shrunk it by 32 MB to fit LUKS header), then we will inform our system, that it has an encrypted partition (giving it the LUKS container name and its UUID, which is different than /dev/sda3 UUID) and should ask as for a password. We will give ourselves 3 tries, before it fails and panics. First we need to find the UUID of the LUKS container lmde_root and then put it in the /etc/crypttab file. The first command will output the UUID, which you then need to paste into the second command where {uuid} is.

btrfs filesystem resize max /
cryptsetup luksUUID /dev/sda3
echo "lmde_root UUID={uuid} none luks,discard,tries=3" >> /etc/crypttab

Next step is to inform GRUB about it, by giving it in turn the UUID of /dev/sda3 partition and again LUKS container name, and also informing it that the root partition is on the LUKS container.

First find the UUID of /dev/sda3 with blkid command. Copy it - you will paste it where {uuid} is. Then create file /etc/default/grub.d/99_fde.cfg and put this in it:

#! /bin/sh
set -e

GRUB_CMDLINE_LINUX="rd.luks.uuid={uuid}"

Save and close. Last step is to install and configure ZRAM. I won't go into the details what it is, tl;dr is that ZRAM is basically SWAP in RAM. To do that we need to enable DNS in chroot, update repos and install systemd-zram-generator, and optionally configure it:

echo "nameserver 1.1.1.1" >> /etc/resolved.conf
apt update
apt install systemd-zram-generator -y

By default zram0 is either RAM / 2 or 4 GB, whichever is smaller. If you want to change this, copy /usr/lib/systemd/zram-generator.conf to /etc/systemd/zram-generator.conf add your config:

echo "zram-size = {your formula or size in MB}" >> /etc/systemd/zram-generator.conf

Normally you'd need systemctl daemon-reload and zramctl for this to take place, but we will be rebooting anyway, so no need for that.

Finally update grub and initramfs:

update-grub
update-initramfs -u

Exit chroot with CTRL+D or exit and unmount all the partitions, EXACTLY IN THIS ORDER. Then close LUKS container.

umount /mnt/dev
umount /mnt/proc
umount /mnt/sys/firmware/efi/efivars
umount /mnt/sys
umount /mnt/home
umount /mnt/boot/efi
umount /mnt/boot
umount /mnt

cryptsetup close lmde_root

Done. Now reboot to your actually installed OS. If everything went right, you should see GRUB menu and after it a nice prompt for lmde_root (or whatever your LUKS contaienr is named) password with Mint logo.

(optional) STEP 5 - Setting up encrypted RAID

First of all, you need a secondary disk. You can add as many disks as you like, following of course requirements of RAID level you want to set up. Here I will be setting up a simple RAID0 for extended disk space with RAID1 for metadata. I will be using one additional disk, this procedure has to be repeated for all the additional disks. For more sophisticated setup or higher RAID levels, you need to do your own research.

First of all, partition the drive. You just need:

1. GPT partition table
2. One partition spanning the entire disk, with no filesystem (here it will be /dev/sdb1).

Since my main LUKS container is named lmde_root, the secondary drive's contaner will be named lmde_root_1.

Encrypt the partition the same way you did with the primary /dev/sda3 partition, then open it:

cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/sdb1
cryptsetup luksOpen /dev/sdb1 lmde_root_1

Now add this new partition to your current BTRFS filesystem and balance it, converting data to single and metadata to raid1:

btrfs device add -f /dev/mapper/lmde_root_1 /
btrfs balance start -dconvert=raid0 -mconvert=raid1 /

Then the procedure of informing the system about a new encrypted drive is basically the same as in our root partition:

cryptsetup luksUUID /dev/sdb1
echo "lmde_root_1 UUID={uuid} none luks,discard,tries=3" >> /etc/crypttab

And for /etc/default/grub.d/99_fde.cfg:

#! /bin/sh
set -e

GRUB_CMDLINE_LINUX="rd.luks.uuid={uuid of /dev/sda3} rd.luks.uuid={uuid of /dev/sdb1}"

Regenerate initramfs and update grub, and you're good to go. Only caveat being - now you have to type passwords for both lmde_root and lmde_root_1 on boot.

---

I hope this helped someone. I spent over a week trying to make this work, learning A LOT about filesystems, partitioning and encryption. Take it, use it and be happy with it!

nice guide ... i followed it to my linux mint installation but good idea to use the arch-install-scripts ... but excellent too

Thanks a lot for sharing this very good and very useful work!
Success on my first test.

thank you, this worked great on regular mint, though i didn't know i was going to write 1TB to my brand new ssd 😅

it might be a good idea to at least warn of this, or i'm thinking you could have the root partition only be 5-10gb, whatever's necessary to install the base OS before encrypting it, then expanding it afterwards. would this work?

Very nice, my friend!
Just tested with success on Mint LMDE 7.
Then, I piped your page to Grok and asked it to convert into a shell script to automate the whole thing! :))
Let's test it!

EDIT #1: it worked! has a small bug (not show stopper) but it worked!
EDIT #2: bug fixed! testing more!
EDIT #3: tested, retested, fully working!
EDIT #4: didn't test on regular (Ubuntu) Mint, but it should work there also... But then, it's not needed there, you can get the whole ubuntu btrfs layout and full disk encryption with its native installer (as of version 22.x)!

=================================
DISCLAIMER: Written by Grok, following instructions from OP!
I've tweaked some small details, mainly formatting and instructed Grok to fix two small bugs.
TESTED FIVE TIMES on a virtual machine successfully!
=======> USE AT YOUR OWN RISK! <=======

====================//====================
WARNING #1: The OP procedure (and this script) will encrypt the WHOLE system drive, so it may take some time if the disk is too big...
I recommend installing with manual partitioning to a smaller partition (25 GB is enough, that's what I used in my testing) and resizing it after encryption completes!

WARNING #2: If you install the system to a smaller partition to speed up encryption you MUST resize it MANUALLY after completion using GParted (or whatever tool you prefer), cause the script won't do it automatically.
I tried, but the solution Grok proposed didn't work.
Since it does its job correctly, successfully encrypting the disk, I just don't care if I have to make a final manual adjustment! :)
====================//====================

==============//==============
LICENSE: PUBLIC DOMAIN
Use it as you see fit! Change it, redistribute!
KNOWLEDGE WANTS TO BE FREE! :)
==============//==============

#!/bin/bash
# #================================================================================#
# #                                                                                #
# # Automation Script: Linux Mint / LMDE with BTRFS + Full Disk Encryption (LUKS2) #
# # Based on: https://gist.github.com/Leniwcowaty/4b2c239ca74629cad60d4718f79ff600 #
# #                                                                                #
# #================================================================================#

set -e  # Exit immediately if a command fails

echo ""
echo "=========== BTRFS + LUKS2 Setup Script for Linux Mint/LMDE ==========="
echo ""
echo "WARNING: This script performs dangerous operations (disk encryption)."
echo "         Make sure you understand what it does before running."
echo ""
echo "======================================================================"

## ====================== SAFETY CHECKS ======================

## 1. Must be run as root
if [[ $EUID -ne 0 ]]; then
    echo "ERROR: This script must be run as root (use sudo)."
    exit 1
fi

## 2. Check if required tools are installed
for cmd in cryptsetup btrfs mount umount chroot update-grub update-initramfs; do
    if ! command -v "$cmd" >/dev/null 2>&1; then
        echo "ERROR: Required command '$cmd' not found. Install it before continuing."
        exit 1
    fi
done

## ====================== CONFIGURATION ======================
## CHANGE THESE VARIABLES according to your hardware!

DISK="/dev/sda"                    # Main disk (example: /dev/nvme0n1)
ROOT_PART="${DISK}3"               # Root partition (the one formatted as btrfs)
BOOT_PART="${DISK}2"               # /boot partition
EFI_PART="${DISK}1"                # EFI partition

LUKS_NAME="lmde_root"              # LUKS container name (you can change it)

## =============================================================

echo "Using the following configuration:"
echo "   Disk          : $DISK"
echo "   Root Partition: $ROOT_PART"
echo "   Boot Partition: $BOOT_PART"
echo "   EFI Partition : $EFI_PART"
echo "   LUKS Name     : $LUKS_NAME"
echo ""

## 3. Confirmation of variables
read -p "Are the variables above correct? (y/N): " confirm
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
    echo "Script aborted by user."
    exit 1
fi

## 4. Critical confirmation - prevents accidental encryption
echo ""
echo -e "\n=== CRITICAL SAFETY CHECK ==="
echo "This script will ENCRYPT the partition $ROOT_PART using LUKS2."
echo "All data on this partition will be encrypted. This operation is IRREVERSIBLE without the passphrase."
echo ""
read -p "Type 'YES' in uppercase to confirm you want to proceed: " final_confirm

if [[ "$final_confirm" != "YES" ]]; then
    echo "Operation cancelled. No changes were made."
    exit 1
fi

## 5. Check if partitions exist
if [[ ! -b "$ROOT_PART" ]]; then
    echo "ERROR: Root partition $ROOT_PART does not exist!"
    exit 1
fi

if [[ ! -b "$BOOT_PART" ]] || [[ ! -b "$EFI_PART" ]]; then
    echo "ERROR: Boot or EFI partition not found!"
    exit 1
fi

echo ""
echo -e "\n=== Step 3: PREPARING FOR ENCRYPTION ==="

## Shrink the BTRFS filesystem by 32 MiB to make room for LUKS header
echo ""
echo "Mounting @ subvolume and shrinking by 32 MiB..."
mount "$ROOT_PART" -o subvol=@ /mnt || { echo "Failed to mount root subvolume."; exit 1; }
btrfs filesystem resize -32m /mnt || { echo "Failed to resize filesystem."; umount /mnt; exit 1; }
umount /mnt

echo ""
echo "Encrypting the partition with LUKS2 (this may take several minutes)..."
echo "Do not interrupt this process!"
cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m "$ROOT_PART"

echo ""
echo -e "\nEncryption completed successfully!\n"

## ====================== Step 4 ======================
echo ""
echo "=== Step 4: FINAL CONFIGURATION IN CHROOT ==="
echo ""

echo "Opening LUKS container..."
cryptsetup luksOpen "$ROOT_PART" "$LUKS_NAME" || { echo "Failed to open LUKS container."; exit 1; }

echo ""
echo "Mounting filesystems..."
mount /dev/mapper/"$LUKS_NAME" -o subvol=@ /mnt || { echo "Failed to mount root."; exit 1; }
mount /dev/mapper/"$LUKS_NAME" -o subvol=@home /mnt/home 2>/dev/null || true
mount "$BOOT_PART" /mnt/boot || { echo "Failed to mount /boot."; exit 1; }
mount "$EFI_PART" /mnt/boot/efi || { echo "Failed to mount EFI."; exit 1; }

mount --bind /dev /mnt/dev
mount --bind /sys /mnt/sys
mount --bind /proc /mnt/proc

echo "Entering chroot and running final configurations..."

cat << 'CHROOT_SCRIPT' | chroot /mnt /bin/bash

echo "=== Inside chroot ==="

## Re-expand BTRFS to use all available space
btrfs filesystem resize max / || echo "Warning: Failed to resize BTRFS"

## Get LUKS UUID and add it to crypttab
LUKS_UUID=$(cryptsetup luksUUID /dev/sda3)
echo "lmde_root UUID=$LUKS_UUID none luks,discard,tries=3" >> /etc/crypttab
echo "Added to /etc/crypttab with UUID: $LUKS_UUID"

## Create GRUB configuration file
cat > /etc/default/grub.d/99_fde.cfg << 'EOF'
#!/bin/sh
set -e
GRUB_CMDLINE_LINUX="rd.luks.uuid=$LUKS_UUID"
EOF
echo "File /etc/default/grub.d/99_fde.cfg created."

## Configure ZRAM (no disk swap)
echo "nameserver 1.1.1.1" >> /etc/resolv.conf
apt update || echo "Warning: apt update failed"
apt install -y systemd-zram-generator || echo "Warning: Failed to install systemd-zram-generator"

## Update GRUB and initramfs
update-grub || echo "Warning: update-grub failed"
update-initramfs -u || echo "Warning: update-initramfs failed"

echo "=== Configuration inside chroot completed successfully! ==="
CHROOT_SCRIPT

echo ""
echo -e "\nExiting chroot..."

## Safe unmount
echo ""
echo "Unmounting filesystems..."
umount -R /mnt 2>/dev/null || true

echo -e "\n========================= SCRIPT COMPLETED SUCCESSFULLY! ========================="
echo ""
echo "You can now reboot the computer."
echo "During boot, you will be asked for only ONE password (the LUKS passphrase)."
echo ""
echo "Remember to adjust the LUKS name and device names if they differ from the defaults."
echo ""
echo "==================================================================================="

exit 0

nice guide ... i followed it to my linux mint installation but good idea to use the arch-install-scripts ... but excellent too

I guess it will work on any Linux system with BTRFS and if you happen to have the ubuntu layout (@ and @home subvol) you can enable Timeshift easily!

EDIT: if doing it on non Debian/Ubuntu systems, the user will have to adjust the final commands to update Grub and the initramfs, obviously!

thank you, this worked great on regular mint, though i didn't know i was going to write 1TB to my brand new ssd 😅

it might be a good idea to at least warn of this, or i'm thinking you could have the root partition only be 5-10gb, whatever's necessary to install the base OS before encrypting it, then expanding it afterwards. would this work?

YES, installing to a small partition (I tried with 25 GB) and expanding to the full disc size after encryption WILL work!
Just tested successfully! :))

I keep running into a snag halfway through Step 4:

On multiple attempts on different VMs, the result from cryptsetup luksUUID /dev/sda3 and the blkid for /dev/sda3 are identical.

In other words, it seems the luksUUID and the partition's UUID are the same, which of course doesn't make sense to me and conflicts with the earlier note of:

(giving it the LUKS container name and its UUID, which is different than /dev/sda3 UUID)

I copy+pasted line-by-line in sequential order with the obvious exception of plugging in the result from cryptsetup luksUUID /dev/sda3 into the subsequent echo command as instructed: