Install Debian Wheezy from rescue CD rather than installer to avoid bullshit

debian install

Create boot (sda1), root (sda3), and swap (sda2) partitions, ensure root partition is "bootable"
mkfs.ext4 /dev/sda{1,3}
mkdir /mnt/rootfs
mount /dev/sda3 /mnt/rootfs
mkdir /mnt/rootfs/boot
mount /dev/sda1 /mnt/rootfs/boot
debootstrap --arch amd64 jessie /mnt/rootfs
LANG=C chroot /mnt/rootfs /bin/bash
export TERM=xterm-color
mount none /proc -t proc
apt-get install makedev
cd /dev
MAKEDEV generic
apt-get install vim extlinux locales console-setup linux-image-amd64 bash-completion memtest86
Edit /etc/fstab if you want, like to add swap
dpkg-reconfigure tzdata
Edit /etc/network/interfaces if you want to setup networking
echo "hostname" > /etc/hostname
Edit /etc/hosts to add "127.0.0.1 hostname"
Configure /etc/apt/sources.list to your liking (I like the http.debian.net "mirror" and security updates)
dpkg-reconfigure locales
cat /usr/lib/extlinux/mbr.bin > /dev/sda
Edit /etc/default/extlinux to edit EXTLINUX_ROOT parameter to tell where to find root file system (root=/dev/sda1)
extlinux-update
passwd
adduser andrew
exit
shutdown -h now

To encrypt root partition, make a /boot partition and a root partition, /boot should be unencrypted. Encrypt the root partition with cryptsetup luksFormat /dev/sda3, then open it with cryptsetup luksOpen /dev/sda3 c1, then format it with mkfs.ext4 /dev/mapper/c1. Then mount your root, mkdir and mount the /boot inside, and proceed as normal.

For bootloader, set the EXTLINUX_ROOT param to something like root=/dev/mapper/rootfs. Be sure you have the cryptsetup software installed and your have a valid /etc/crypttab file telling how to mount the rootfs. Be sure your root is listed in /etc/fstab like /dev/mapper/rootfs if rootfs is the name of your root file system in /etc/crypttab. You may need to regenerate the initramfs with the update-initramfs -u command, this will automatically look at your /etc/fstab and /etc/crypttab and do the right things.

Reasonable /etc/apt/sources.list:

deb http://http.debian.net/debian jessie main contrib non-free
deb-src http://http.debian.net/debian jessie main contrib non-free
deb http://security.debian.org/ jessie/updates main contrib non-free
deb-src http://security.debian.org/ jessie/updates main contrib non-free

extlinux might need to be "installed" manually from outside the chroot, including the mbr.bin file write and extlinux --install /mnt/rootfs/boot to ensure that ldlinux.sys file is created. Apparently if the chroot can't find the actual disks then this might fail.
We don't bind mount /dev into the chroot as we need to run the MAKEDEV in the target.

Disable, especially laptop, beeps by echo "blacklist pcspkr" > /etc/modprobe.d/blacklist-pcspkr.conf and by setting set bell-style visible in /etc/inputrc.

# mount -t proc proc /mnt/gentoo/proc
# mount --rbind /sys /mnt/gentoo/sys
# mount --rbind /dev /mnt/gentoo/dev