Arch Install with Encrypted Disk and Systemd Boot

Download the arch iso and put it on a USB using:

Boot into the USB by holding the key combination for the boot menu (specific to your device) and select the USB from the list.

For hidpi devices it might be useful to set the font to the largest available size:

This guide is for UEFI systems - check that the /sys/firmware/efi directory is not empty:

Connect to network - plug in ethernet or use wifi:

Where DEVICE is the wireless device, usually wlan0 (check with ip a)

Check network:

Set system time with

List the disks to find the name of the device you want to install arch on:

The device is likely to be something like /dev/sda or /dev/nvme0n1. For the examples I will use /dev/vda but replace this with the disk you are using.

If you have previously had sensitive data on the disk, overwrite it using:

Partition the disk using cfdisk:

Choose gpt as the partition scheme

Here you want to delete any partitions that may already exist and create two partitions for the install:

1 - partition with size of 512MB and type "EFI System" - this will be the boot partition - which the device firmware will use to load the operating system.

2 - partition with the remaining size of the disk, with type "Linux LVM" - this will be the partition which we encrypt and store the filesystem on.

The partition setup in cfdisk should look like the following:

When this is done press write, type yes and hit enter, then press quit.

Format the filesystem for the EFI partition:

This diagram shows the abstractions between our filesystem and the physical disk we are using.

Mount the volumes, using /mnt as the root of our filesystem - this means that what we put in /mnt during the install will end up at / in our final system.

First we mount the root volume to /mnt:

We also need to mount the boot partition so we can install a bootloader:

We can also enable swap memory:

We can now use pacstrap to install arch. Pacstrap acts similar to arch’s package manager - pacman - but it allows us to specify a filesystem root. This means that instead of us installing extra packages on the USB’s operating system that we are using for the install, we can place packages onto another disk. In this case we will give /mnt as the filesystem root - this means that when the installation is finished and we use this as our root partition everything will be in the right place.

The syntax for pacstrap is

First we will install the base filesystem. The arch 'base' package installs necessary programs and filesystem components such as bash, network tools, pacman etc. The 'base-devel' package is optional but is useful if you are likely to be compiling programs from source as it installs programs including gcc and make. We also need the 'lvm2' package as this is needed for the operating system to open the logical volumes we have set up.

Next we will install the kernel and kernel firmware (the firmware package is needed to allow the hardware to work with the operating system). In this case I have used the linux-hardened kernel, but you can use other kernels.

Next you can install any packages you want available immediately after install - one of the most important in this case is iwd - if you only have internet available through wifi you will want to install iwd or another wifi package now, as when you reboot into the operating system you will not be able to install it or any other software. I have also chosen to install neovim, zsh and git but these are optional.

Linux uses a filesystem table stored in /etc/fstab to know which disk devices to mount where. We can use genfstab to generate the table with the currently mounted devices (this includes the boot partition, the root partition and the swap).

To finish setting up the arch operating system we need to chroot into our installation - this changes the apparent root of the filesystem - we will chroot into /mnt as this is where the root of our filesystem is mounted.

Set local time (to find the name of your time zone look in /usr/share/zoneinfo and its subdirectories for the zone appropriate for your location - for example if you’re in New York the zone would be /usr/share/zoneinfo/America/New_York).

Sync the hardware clock with the system (software) clock

Setup locale - this allows programs to appropriately show region specific text such as currency, date and time formats etc.

Uncomment appropriate line(s) in /etc/locale.gen - for example "en_GB.UTF-8 UTF-8" and then run locale-gen.

Create locale config file:

Set system hostname:

Create hosts file - put the following content in /etc/hosts replacing MYCOMPUTER with the hostname you have chosen:

During the boot process, an initial ram filesystem is needed to mount the root filesystem. Our disk is encrypted and uses lvm for logical volumes - but to mount the raw filesystem we need the dm-crypt and lvm2 kernel modules, which are stored on the disk. Therefore we need these to be present in the initramfs image which is placed in the boot partition - which is not encrypted and doesn’t use lvm.

To make sure these modules are in the initramfs we need to change the line beginning with 'HOOKS=' in the file '/etc/mkinitcpio.conf' and add 'encrypt' and 'lvm2' after 'keyboard'. It should look similar to the following:

Then to generate the new initramfs image we can run

Now we can install the boot loader using:

Then we modify the bootloader main config to contain:

/boot/loader/loader.conf

and the config for the arch boot entry:

/boot/loader/entries/arch.conf

To get YOUR_DISK_UUID run blkid /dev/vda2

You are now done! You can exit and reboot.