Henrik Pingel knowhy

Arch Linux Full-Disk Encryption Installation Guide

This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS, booting a signed unified kernel image with systemd-boot on UEFI systems.

Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and a self-signed boot loader and kernel image.

Tested in October 2026 on an HP ZBook Ultra G1a and in a QEMU/OVMF virtual machine: systemd 262, mkinitcpio 42.2, cryptsetup 2.8.8, linux 7.2.9, sbctl 0.18.

Preface

You will find most of this information pulled from the Arch Wiki and other resources linked thereof.

Requirements

no upfront installation/agents on remote/slave machines - ssh should be enough
application components should use third-party software, e.g. HDFS, Spark's cluster, deployed separately
configuration templating
environment requires/asserts, i.e. we need a JVM in a given version before doing deployment
deployment process run from Jenkins

Solution

About

When using ArchLinux, I typically prefer to use an AUR helper like pacaur or yaourt to automate away the process of installing a community package.

Ansible's pacman module is great, but it doesn't support AUR packages or pacman's -U flag. Installing AUR packages with Ansible seemed to be left as an exercise to the user, and since AUR helpers do not come with a fresh Arch install, I

	#! /usr/bin/env python3

	import argparse
	import datetime
	import influxdb
	import sqlite3


	if __name__ == "__main__":
	parser = argparse.ArgumentParser()

	Uninstall a bundle (use http://localhost:4505/system/console/bundles to access the Apache Felix web console)
	curl -u admin:admin -daction=uninstall http://localhost:4505/system/console/bundles/"name of bundle"

	Install a bundle
	curl -u admin:admin -F action=install -F bundlestartlevel=20 -F
	bundlefile=@"name of jar.jar" http://localhost:4505/system/console/bundles

	Build a bundle
	curl -u admin:admin -F bundleHome=/apps/centrica/bundles/name of bundle -F
	descriptor=/apps/centrica/bundles/com.centrica.cq.wcm.core-bundle/name_of_bundle.bnd