My Arch Encrypted, BTRFS with Snapper Install Notes

encrypted_btrfs_snapper_notes.sh

# This is mostly here for my reference. If someone on the internet finds this, I hope it's
# helpful, but don't trust it! I'm pretty new at this, which is why I have to keep exhaustive
# notes like this. The corollary then, is that if you're a pro at this, and notice something
# dumb I'm doing, please let me know.
#
# The idea here is to end up with an ecrypted BTRFS filesystem running Snapper in a way that
# makes rollbacks super easy. I tried to keep things simple, so the swap is a file, not a
# partition (that would have to be encryped separately). The subvolume layout is totally flat,
# to make rollbacks a simple matter of moving the volumes around. When this is all done, a
# simple ls of either .snapshots directory will show you your live filesystem right alongside
# every snapshot.

curl -L tinyurl.com/arch-btrfs > notes.sh

# Get internet any way you can:
# https://wiki.archlinux.org/index.php/Iwd
# https://wiki.archlinux.org/index.php/Systemd-resolved
#
# and maybe this, if you need to manage multiple interfaces:
# https://wiki.archlinux.org/index.php/systemd-networkd

timedatectl set-ntp true

# Figure out what you're working with
lsblk

# Format with a single EFI boot partion, and the rest BTRFS
fdisk /dev/vda
# g
# n <enter> <enter> +500M t 1
# n <enter> <enter> <enter>
# w

# Make sure your didn't screw up (too late now, though)
lsblk

# After this, you'll have a new view of your partion that
# encrypts on the way in, and decrypts on the way out. So
# make sure you never mount the raw partion again!
cryptsetup -y -v luksFormat /dev/vda2
cryptsetup open /dev/vda2 cryptroot

mkfs.fat -F32 /dev/vda1
mkfs.btrfs /dev/mapper/cryptroot

# Notice we mount the "view", not the actual partition
mount /dev/mapper/cryptroot /mnt

btrfs su cr /mnt/@hometop
btrfs su cr /mnt/@roottop
btrfs su cr /mnt/@vlogtop
btrfs su cr /mnt/@vcchtop

mkdir /mnt/@hometop/live
mkdir /mnt/@roottop/live

btrfs su cr /mnt/@hometop/live/snapshot
btrfs su cr /mnt/@roottop/live/snapshot

umount /mnt

# Now mount everything in. Bit brain-hurting, but it makes sense if you stare long enough.
mount -o noatime,compress-force=zstd,autodefrag,subvol=@roottop/live/snapshot /dev/mapper/cryptroot /mnt
mkdir -p /mnt/{boot,home,var/log,var/cache,.snapshots}
mount -o noatime,compress-force=zstd,autodefrag,subvol=@hometop/live/snapshot /dev/mapper/cryptroot /mnt/home
mount -o noatime,compress-force=zstd,autodefrag,subvol=@roottop /dev/mapper/cryptroot /mnt/.snapshots
mkdir -p /mnt/home/.snapshots
mount -o noatime,compress-force=zstd,autodefrag,subvol=@hometop /dev/mapper/cryptroot /mnt/home/.snapshots

mount -o noatime,compress-force=zstd,autodefrag,subvol=@vlogtop /dev/mapper/cryptroot /mnt/var/log
mount -o noatime,subvol=@vcchtop /dev/mapper/cryptroot /mnt/var/cache

# make the swapfile
cd /mnt/var/cache
truncate -s 0 swapfile
chattr +C swapfile
btrfs property set swapfile compression none
dd if=/dev/zero of=swapfile bs=1M count=2048 status=progress
chmod 600 swapfile
mkswap swapfile
swapon swapfile
cd /

mount /dev/vda1 /mnt/boot

pacstrap /mnt base base-devel linux-zen linux-zen-headers linux-firmware amd-ucode neovim iwd

genfstab -U /mnt >> /mnt/etc/fstab

# Get rid of the subvol ids and dupe paths. You don't need to, since it seems
# like if there's a path and a subvod id, and they are in conflict, btrfs will
# go with the path, but why tempt fate when we roll back and the ids change?
vim /mnt/etc/fstab

arch-chroot /mnt

ln -s /usr/share/zoneinfo/US/Pacific /etc/localtime
hwclock --systohc
vim /etc/locale.gen
locale-gen
echo "LANG=en_US.UTF-8" >> /etc/locale.conf
echo "fry" >> /etc/hostname

vim /etc/hosts
# 127.0.0.1	localhost
# ::1		localhost
# 127.0.1.1	fry.localdomain	fry

passwd

pacman -S grub efibootmgr os-prober mtools dosfstools

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB

useradd -mG wheel phil
passwd phil

visudo

vim /etc/mkinitcpio.conf # add "keyboard" after "autodetect" and "encrypt" after "block" in "HOOKS"
mkinitcpio -p linux-zen

vim /etc/default/grub
# GRUB_ENABLE_CRYPTODISK=y
# add to GRUB_CMDLINE_LINUX_DEFAULT: "cryptdevice=/dev/vda2:cryptroot:allow-discards root=/dev/mapper/cryptroot"
# (allow-discards is for SSDs)

grub-mkconfig -o /boot/grub/grub.cfg

exit
umount -a

reboot # and pray

# Post Arch Install

sudo su

systemctl enable systemd-resolvd
systemctl start systemd-resolvd
ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

vim /etc/iwd/main.conf
# [General]
# EnableNetworkConfiguration=true
#
# [Network]
# EnableIPv6=true
# NameResolvingService=systemd

systemctl enable iwd
systemctl start iwd

# No one ever tells you to do this, and then your clock is off by
# 20 minutes in a couple weeks.
timedatectl set-ntp on

pacman -S snapper
cd /etc/snapper/config-templates/
cp default ../configs/root
cp default ../configs/home # edit both
vim /etc/conf.d/snapper # spaces, not commas

systemctl start snapper-timeline.timer
systemctl enable snapper-timeline.timer
systemctl start snapper-cleanup.timer
systemctl enable snapper-cleanup.timer

pacman -S snap-pac

# Enable and start paccache.timer to discard unused packages weekly. 

exit

# All my goodies

pacman -S sway swayidle alacritty cage waybar xorg-server-xwayland wl-clipboard fish pipewire pipewire-pulse xdg-desktop-portal-wlr git otf-font-awesome noto-fonts noto-fonts-cjk noto-fonts-emoji noto-fonts-extra playerctl pavucontrol mesa libva-mesa-driver xf86-video-amdgpu vulkan-radeon rsync zathura zathura-pdf-mupdf imv mpv youtube-dl firefox libnotify ttf-ubuntu-font-family element-desktop qt5-wayland mako grim slurp papirus-icon-theme python-cssselect python-requests python-lxml python-pip fuse fzf sshfs gocryptfs jdk11-openjdk pacman-contrib htop wf-recorder mlocate

git clone https://aur.archlinux.org/paru.git
cd paru
makepkg -si

paru -S ulauncher redshift-wayland-git spotify ant-dracula-gtk-theme lf dragon-drag-and-drop z.lua neovim-symlinks autotiling-git

# Fix Firefox Insane Scroll Speed
mousewheel.default.delta_multiplier_y = 25

I've been trying to figure out how to get snapper working with grub-btrfs for a while now. Was unable to run snapper in the installer, ran into issues with .snapshots being under root, and grub-btrfs.path issues too. Your method works flawlessly, thanks!

Oh man, sorry I missed you first comment months ago. Didn't even notice it for some reason. Glad this worked out for you!

I actually took this to even the next level and turned it into a fully-automated install script, if you ever have to do it again:

https://github.com/pkulak/arch-install