Arch Linux install guide

Introduction#

The goal of this guide is to set up a minimal installation of Arch Linux with full disk encryption on an UEFI system. This guide is meant to be read alongside the Arch wiki. It does not cover implementing Secure Boot

Preliminary steps#

Check that we are in UEFI mode#

If this command prints 64 or 32 then you are in UEFI

cat /sys/firmware/efi/fw_platform_size

Update the system clock#

# Check if ntp is active and if the time is right
timedatectl

# In case it's not active you can do
timedatectl set-ntp true

Partition the disk#

Throughout this guide nvme0n1 will be used as the target install drive. The drive will be separated into two partitions:

1. Run gdisk

gdisk /dev/nvme0n1

2. Press x to enter expert mode. Then press z to zap our drive. Then hit y when prompted about wiping out GPT and blanking out MBR.

3. Run gdisk

gdisk /dev/nvme0n1

2. Delete any existing partitions. Repeat until none are left.

Command (m for help): d

3. Create a boot partition

Command (m for help): n
Partition number (1-128, default 1):
First sector (...):
Last sector (...): +512M
Hex code or GUID (...): ef00

4. Create a root partition

Command (m for help): n
Partition number (2-128, default 1):
First sector (...):
Last sector (...):
Hex code or GUID (...): 8300

5. Write the changes

Command (m for help): w
Do you want to proceed? (Y/N): y

6. Verify partitioning

lsblk

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
nvme0n1     259:0    0 465,8G  0 disk
├─nvme0n1p1 259:1    0   512M  0 part
└─nvme0n1p2 259:2    0 465,3G  0 part

Encrypt root partition#

1. Encrypt your root partition

cryptsetup luksFormat /dev/nvme0n1p2
Are you sure (Type `yes` in capital letters): YES

2. Open the encrypted partition

cryptsetup open /dev/nvme0n1p2 root

Create filesystems#

1. Create the boot file system

mkfs.fat -F32 /dev/nvme0n1p1

1. Create the root file system

mkfs.ext4 /dev/mapper/root

Mount file systems#

1. Mount the root file system

mount /dev/mapper/root /mnt

2. Mount the boot file system

mount -m /dev/nvme0n1p1 /mnt/boot -o dmask=0077,fmask=0077

3. Verify mounting

lsblk

NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme0n1     259:0    0 465,8G  0 disk
├─nvme0n1p1 259:1    0   512M  0 part  /mnt/boot
└─nvme0n1p2 259:2    0 465,3G  0 part
  └─root    254:0    0 465,2G  0 crypt /mnt

Install essentials#

Install the base system, kernel, init system and other essential packages.

pacstrap /mnt base base-devel linux linux-firmware efibootmgr doas neovim

Microcode#

AMD CPU

pacstrap /mnt amd-ucode

Intel CPU

pacstrap /mnt intel-ucode

Generate file system table#

genfstab -U /mnt >> /mnt/etc/fstab

Now edit /mnt/etc/fstab and change fmask=0022,dmask=0022 to fmask=0077,dmask=0077.

Switch to new Installation#

arch-chroot /mnt

Network stack#

pacman -S networkmanager iwd
systemctl enable NetworkManager

1
[device]
2
wifi.backend=iwd

Localization#

Set the locale#

1. Uncomment en_US.UTF-8

1
#en_US.UTF-8 UTF-8
2
en_US.UTF-8 UTF-8

2. Generate locales

echo 'LANG=en_US.UTF-8' > /etc/locale.conf
locale-gen

Set the timezone#

ln -sf /usr/share/zoneinfo/YourRegion/YourCity /etc/localtime

Set hardware clock from system clock#

hwclock --systohc

Hostname#

Set your preferred hostname, I will be using MYHOSTNAME throughout this guide.

echo 'MYHOSTNAME' > /etc/hostname

1
# Static table lookup for hostnames.
2
# See hosts(5) for details.
3

4
127.0.0.1     localhost
5
::1           localhost
6
127.0.1.1     MYHOSTNAME.localdomain     MYHOSTNAME

Initramfs#

In the HOOKS array, add encrypt between block and filesystems

HOOKS=(... block encrypt filesystems ...)

Generate initramfs images

mkinitcpio -P

Add a user#

1. Set the root password.

passwd

2. Create a user and set his password.

useradd -m MYUSERNAME
passwd MYUSERNAME

Configure doas#

1. Create the config file and set the appropriate permissions

touch /etc/doas.conf
chown -c root:root /etc/doas.conf
chmod -c 0400 /etc/doas.conf

2. Add the following

1
permit MYUSERNAME as root
2
permit nopass MYUSERNAME as root cmd pacman

Boot loader#

Get the UUID of your root partition

blkid -s UUID -o value /dev/nvme0n1p2

EFISTUB#

efibootmgr -c -d /dev/nvme0n1 -p 1 -l /vmlinuz-linux -L "Arch Linux" -u "cryptdevice=UUID=xxxx:root root=/dev/mapper/root rw initrd=\amd-ucode.img initrd=\initramfs-linux.img loglevel=3 quiet"

Systemd-boot#

Initramfs#

Replace the HOOKS array with the following one

1
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole sd-encrypt block filesystems fsck)

Regenerate initramfs images

mkinitcpio -P

Installation#

bootctl install

1
title   Arch Linux
2
linux   /vmlinuz-linux
3
initrd  /amd-ucode.img
4
initrd  /initramfs-linux.img
5
options rd.luks.name=xxxx=root root=/dev/mapper/root rw loglevel=3 quiet

1
#timeout 3
2
timeout 3
3
#console-mode keep

Reboot#

1. You can now reboot and enter into your new installation

exit
umount -R /mnt
reboot now

Post install#

You will now be greeted with a similar screen as when you first booted from the flash drive. Login using the credentials that you set, if you followed the example your username would be MYUSERNAME.

Swap#

doas fallocate -l 4G /swapfile
doas chmod 600 /swapfile
doas mkswap /swapfile
doas swapon /swapfile
doas cp /etc/fstab /etc/fstab.bak
echo '/swapfile none swap sw 0 0' | doas tee -a /etc/fstab

Video drivers#

AMD#

1
doas pacman -S mesa linux-firmware-amdgpu vulkan-radeon

Intel#

1
doas pacman -S mesa linux-firmware-intel vulkan-intel

Nvidia#

https://wiki.archlinux.org/title/NVIDIA

https://wiki.hypr.land/Nvidia

Sort for fastest mirrors#

doas pacman -Syu reflector
doas reflector --verbose -p https -l 30 -f 5 --sort rate --save /etc/pacman.d/mirrorlist

AUR#

Add Chaotic-AUR#

doas pacman-key --recv-key 3056513887B78AEB --keyserver keyserver.ubuntu.com
doas pacman-key --lsign-key 3056513887B78AEB
doas pacman -U 'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst'
doas pacman -U 'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'

[chaotic-aur]
Include = /etc/pacman.d/chaotic-mirrorlist

Install paru#

doas pacman -Syu
doas pacman -S paru

Replace sudo with doas#

doas pacman -Rdd sudo
doas ln -s /usr/bin/doas /usr/bin/sudo

Laptop power profiles#

Install and enable the powerprofiles daemon

pacman -S power-profiles-daemon
systemctl enable power-profiles-daemon
systemctl start power-profiles-daemon start

MAC randomization#

[device-mac-randomization]
wifi.scan-rand-mac-address=yes

[connection-mac-randomization]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random