Minimal instructions for installing arch linux on an UEFI system with full system encryption using dm-crypt and luks

arch-linux-install

# Install ARCH Linux with encrypted file-system and UEFI
# The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

# Download the archiso image from https://www.archlinux.org/
# Copy to a usb-drive
dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

# Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

# Set swedish keymap
loadkeys sv-latin1

# This assumes a wifi only system...
wifi-menu

# Create partitions
cgdisk /dev/sdX
1 100MB EFI partition # Hex code ef00
2 250MB Boot partition # Hex code 8300
3 100% size partiton # (to be encrypted) Hex code 8300

mkfs.vfat -F32 /dev/sdX1
mkfs.ext2 /dev/sdX2

# Setup the encryption of the system
cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sdX3
cryptsetup luksOpen /dev/sdX3 luks

# Create encrypted partitions
# This creates one partions for root, modify if /home or other partitions should be on separate partitions
mkfs.ext4 /dev/mapper/luks

# Mount the new system 
mount -t ext4 /dev/mapper/luks /mnt
mkdir /mnt/boot
mount /dev/sdX2 /mnt/boot
mkdir /mnt/boot/efi
mount /dev/sdX1 /mnt/boot/efi

# Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
# Unless vim and zsh are desired these can be removed from the command
pacstrap /mnt base base-devel grub-efi-x86_64 zsh nvim git efibootmgr dialog wpa_supplicant

# 'install' fstab
genfstab -pU /mnt >> /mnt/etc/fstab
# Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)
tmpfs	/tmp	tmpfs	defaults,noatime,mode=1777	0	0
# Change relatime on all non-boot partitions to noatime (reduces wear if using an SSD)

# Enter the new system
arch-chroot /mnt /bin/bash

# Setup system clock
ln -s /usr/share/zoneinfo/Europe/Stockholm /etc/localtime
hwclock --systohc --utc

# Set the hostname
echo MYHOSTNAME > /etc/hostname

# Update locale
sed -i 's/#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/g' /etc/locale.gen
locale-gen

echo LANG=en_US.UTF-8 >> /etc/locale.conf
echo LANGUAGE=en_US >> /etc/locale.conf
echo LC_ALL=C >> /etc/locale.conf
export LANG=en_US.UTF-8

# Set password for root
passwd

# Add real user remove -s flag if you don't whish to use zsh
# useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME
# passwd MYUSERNAME

# Configure mkinitcpio with modules needed for the initrd image
vim /etc/mkinitcpio.conf
# Add 'ext4' to MODULES
# Add 'encrypt' and 'lvm2' to HOOKS before filesystems

# Regenerate initrd image
mkinitcpio -p linux

# Setup grub
grub-install
In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks:allow-discards" then run:
grub-mkconfig -o /boot/grub/grub.cfg

# Exit new system and go into the cd shell
exit

# Unmount all partitions
umount -R /mnt
swapoff -a

# Reboot into the new system, don't forget to remove the cd/usb
reboot

# Enable dhcpcd
sudo systemctl start dhcpcd
sudo systemctl enable dhcpcd

# Enable multilib repo's
Comment out [multilib] section in /etc/pacman.conf

# Update everything
sudo pacman -Syu

# X11
sudo pacman -S xorg-server xorg-server-utils xorg-xinit mesa
cp /etc/X11/xinit/xinitrc ~/.xinitrc

# Nvidia
sudo pacman -S nvidia lib32-nvidia-utils
sudo mkdir /etc/pacman.d/hooks

nvim /etc/pacman.d/hooks/nvidia.hook
```
[Trigger]
Operation=Install
Operation=Upgrade
Operation=Remove
Type=Package
Target=nvidia

[Action]
Depends=mkinitcpio
When=PostTransaction
Exec=/usr/bin/mkinitcpio -P
```

# Aur installer
mkdir ~/git && cd git
git clone https://github.com/polygamma/aurman.git
cd aurman
makepkg -Acs
sudo pacman -U *.pkg.tar.xz

# Window Manager
aurman -S rake ruby-rdoc ruby-archive-tar-minitar xorg-fonts-100dpi rxvt-unicode mercurial

cd ~/git
hg clone http://hg.subforge.org/subtle
rake
sudo rake install

add `exec subtle` to `.xinitrc`

reboot -> startx after login

======================
RANDOM POST-INSTALL NOTES
======================

silent boot:
use grub-silent instead of grub to disable console output when running plymouth

remove fsck from HOOKS=(...) in /etc/mkinitcpio.conf
mkinitcpio -p linux
copy systemd-fsck-root.service and systemd-fsck@.service from /usr/lib/systemd/system/ to /etc/systemd/system/
edit them and set StandardOutput and StandardError like this:

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/lib/systemd/systemd-fsck
StandardOutput=null
StandardError=journal+console
TimeoutSec=0

remove blinking cursor: set vt.global_cursor_default=0
restore on TTY: setterm -cursor on >> /etc/issue

edit /etc/sysctl.d/20-quiet-printk.conf
add 'kernel.printk = 3 3 3 3'

kernel: linux-ck
https://wiki.archlinux.org/index.php/Unofficial_user_repositories/Repo-ck
https://project.altservice.com/issues/620#Install-Linux-ck-from-Repo-ck

add to /etc/pacman.conf:
[repo-ck]
Server = http://repo-ck.com/$arch
Server = http://repo-ck.com/$arch
Server = http://repo-ck.com/$arch
Server = http://repo-ck.com/$arch
Server = http://repo-ck.com/$arch

pacman-key -r 5EE46C4C && pacman-key --lsign-key 5EE46C4C
pacman -Syy

pacman -S linux-ck-<version> linux-ck-<version>-headers
check above link for relevant kernel version to install (kernel+header, for graphics maybe dkms version?)

to enable the BFQ scheduler:
sudo vi /etc/tmpfiles.d/set_IO_scheduler.conf
add following:
w /sys/block/sdX(=hdd_to_enable_for)/queue/scheduler - - - - bfq


disable watchdog: add 'modprobe.blacklist=iTCO_wdt nowatchdog' to grub parameters

keybase:
aurman -S keybase-bin

enable service: systemctl --user enable keybase.service
start manually: run_keybase

plymouth:
guide from arch wiki
aurman -S plymouth plymouth-theme-monoarch
plymouth-set-default-theme -R monoarch


autologin: use xlogin-git
https://github.com/joukewitteveen/xlogin

custom fonts: move to /usr/share/fonts/<font folder>
run 'fc-cache'

lock TTY when running i3lock:
install physlock

physlock -l
i3lock with -n option
physlock -L

======================
PACKAGE LIST
======================
uncomment multilib in /etc/pacman.conf
pacman -Syy

aurman (build from source)

papirus-icon-theme arc-gtk-theme
alsa-lib alsa-utils alsa-plugins pamixer pulseaudio pulseaudio-alsa (lookup pulseaudio install instructions)
chromedriver
elixir erlang
feh
ffmpeg
vivaldi/firefox/opera
grub-silent
i3lock-color
imagemagick
keybase-bin(install from keybase site instructions)
lxappearance
neovim neovim-qt python-neovim
(nvidia-dkms nvidia-settings nvidia-utils) < if running nvidia
pa-applet-git && nm-applet
pcmanfm
physlock
plymouth plymouth-theme-monoarch
ranger
rofi
ripgrep
ruby ruby-archive-tar-minitar ruby-rake ruby-rdoc rubygems
rxvt-unicode
subtle-git (build from source)
w3m
xlogin-git
yarn
zsh zplug