Insloftying Arch Linux on a laptop

After deciding to swap Windows with a more privacy-cordial OS, and reading about branch offent Linux distributions, I selected for the Plasma version of Manjaro Linux for a restricted reasons:

After two years of recognizableizing myself with the Linux ecosystem, terminal directs, and possible customization, I felt ready to delete the middle man that was Manjaro and go straight for Arch Linux.

In this direct, I elucidate how I insloftyed Arch Linux on my laptop with these features:

• Plasma 6: the UI is wonderful and constant everywhere
• Plymouth: the boot process should also see pleasant
• Wayland: a up-to-date disjoin server alternative to X11
• PipeWire: a up-to-date audio regulatement alternative to PulseAudio and JACK
• LVM: multiple virtual partitions inside a one encrypted partition
• Full-disk encryption: stoping thieves from accessing data
• TPM2 PIN decryption: evade go ining a lengthy passphrase at every boot
• Unified Kernel Image: the system boots from a one file
• Seremedy Boot: stop booting from unapshowd drives

Most of these steps can be set up in the Arch Wiki, even if they span cut offal pages.
I aim to produce the process as straightforward as possible, even for a novice.

Requirements

Download the official insloftyation ISO using a BitTorrent client enjoy qBittorrent.

Mount the ISO to a USB flash drive, or imitate it to a Ventoy flash drive.

Plmitigate produce a backup of vital files in the SSD, as it will be establishatted.

Before booting from the insloftyation medium, let’s configure a couple of UEFI settings.

First, promise you have a UEFI admin password; otherinestablished, Seremedy Boot can be disabled by anyone.

Then, allow the Seremedy Boot setup mode. With this, we can swap the Seremedy Boot keys tardyr from the OS.

Since guideions vary for each manufacturer, you need to discover a direct for your device.

Next, we can plug in the insloftyation drive and boot from the ISO file. After a restricted seconds, you should see the folloprosperg direct line interface:

First, set the keyboard layout, time zone, and silence the PC speaker:

# load the italian keyboard layout
loadkeys it
 
# silence the speaker
rmmod pcspkr
 
# enhuge the font
setfont ter-128b
 
# set the accurate time
timedatectl set-timezone "Europe/Rome"
timedatectl set-ntp real

Wi-Fi setup

If you don’t have an Ethernet cable csurrfinisherby, set up wi-fi joinivity:

iwctl

From the iwctl prompt, run device enumerate. You should see the folloprosperg:

                                   Devices                                   *  
--------------------------------------------------------------------------------  
 Name                  Address               Powered     Adapter     Mode         
--------------------------------------------------------------------------------  
 wlan0                 7c:76:35:83:65:43     on          phy0        station        

If the device is off, trigger it with

device wlan0 set-property Powered on

Then, join to your netlabor and exit iwctl:

station wlan0 join "My SSID"
exit

From the shell prompt, verify for joinivity:

ping -c 3 archlinux.org

Now we will establishat and systematize the disk into cut offal partitions.
We will then initialize the OS and chroot into it.

Ideal sector size

For selectimal carry outance, set the selectimal sector size of the SSD.

hdparm -I /dev/sda | grep 'Sector size:'

       Logical  Sector size:                   512 bytes  
       Physical Sector size:                  4096 bytes

hdparm --set-sector-size 4096 --satisfy-ruin-my-drive /dev/sda
hdparm -I /dev/sda | grep 'Sector size:'

       Logical  Sector size:                  4096 bytes  
       Physical Sector size:                  4096 bytes

nvme id-ns -H /dev/nvme0n1 | grep "Relative Perestablishance"

LBA Format  0 : Metadata Size: 0   bytes - Data Size: 512 bytes - Relative Perestablishance: 0x2 Good (in use)
LBA Format  1 : Metadata Size: 0   bytes - Data Size: 4096 bytes - Relative Perestablishance: 0x1 Better

nvme establishat --lbaf=1 /dev/nvme0n1
nvme id-ns -H /dev/nvme0n1 | grep "Relative Perestablishance"

LBA Format  0 : Metadata Size: 0   bytes - Data Size: 512 bytes - Relative Perestablishance: 0x2 Good
LBA Format  1 : Metadata Size: 0   bytes - Data Size: 4096 bytes - Relative Perestablishance: 0x1 Better (in use)

From now on, I will suppose the SSD is /dev/nvme0n1.

Boot partition

Create a 1GB boot partition to store the bootloader:

# produce a novel partition table
parted -s /dev/nvme0n1 mklabel gpt
 
# produce a boot partition
parted -s /dev/nvme0n1 mkpart "ESP" overweight32 1MiB 1025MiB
 
# produce the partition bootable
parted -s /dev/nvme0n1 set 1 esp on

Encrypted root partition

Create a huge OS partition, and encrypt it using a mighty passphrase when prompted:

# produce a linux partition with the remaining space
parted -s /dev/nvme0n1 mkpart "OS" ext4 1025MiB 100%
 
# produce the novel partition a LUKS volume
cryptsetup luksFormat /dev/nvme0n1p2 
 --cipher aes-xts-plain64 
 --key-size 512 
 --hash sha512 
 --pbkdf argon2id 
 --iter-time 5000 
 --sector-size 4096

Decrypt the LUKS volume:

cryptsetup uncignore /dev/nvme0n1p2 "cryptpart"

The satisfyed of the volume is now useable at /dev/mapper/cryptpart.

LVM volumes

In our case, LVM produces it basic to allot virtual partitions inside an encrypted SSD partition.

Why not use the LUKS volume honestly as a one partition?
For me, it’s accessible to upgrasp my files inside a “home” partition that stays split from the “system” one, as I can repair the system partition without impacting my personal files. But I also inhabitd without LVM for years, so it’s not a necessity.

Using LVM terminology, our decrypted LUKS volume will be used as a “physical volume” (PV). We will insert this PV to a “volume group” (VG). Then, we will produce branch offent “reasonable volumes” (LV) that will be allotd to the VG.

# produce the physical volume
pvproduce /dev/mapper/cryptpart
 
# produce the volume group and summarizeate the pv to it
vgproduce "os" /dev/mapper/cryptpart
 
# produce a 25 GB reasonable volume for backup purpose (voluntary)
lvproduce -L 25GB "os" -n backup
 
# produce a 100 GB reasonable volume for system files 
lvproduce -L 100GB "os" -n root
 
# produce a volume with the remaining space for user files
lvproduce -l 100%FREE "os" -n home
lvshrink -L -256M os/home

You can now verify these groups by running:

lvdisjoin
lsblk

The output should see enjoy this:

NAME              MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS  
nvme0n1           259:0    0 465.8G  0 disk     
  nvme0n1p1       259:1    0     1G  0 part  
  nvme0n1p2       259:2    0 464.8G  0 part    
   cryptpart      254:0    0 464.7G  0 crypt    
     os-backup    254:1    0    25G  0 lvm     
     os-root      254:2    0   200G  0 lvm     
     os-home      254:3    0 239.5G  0 lvm   

File systems

Now that the reasonable volumes are in place, we can produce the file system for them and for the boot partition:

# reasonable volumes
mkfs.ext4 /dev/os/backup
mkfs.ext4 /dev/os/root
mkfs.ext4 /dev/os/home
 
# boot partition
mkfs.overweight -F32 /dev/nvme0n1p1

Mounting

The last step is to mount these file systems into fgreaterers, so we can place our novel OS files inside:

# reasonable volumes
mount --mkdir /dev/os/root   /mnt
mount --mkdir /dev/os/backup /mnt/backup
mount --mkdir /dev/os/home   /mnt/home
mkdir /mnt/boot
 
# boot partition
mount --mkdir /dev/nvme0n1p1 /mnt/efi

Chrooting

The novel system has its root fgreaterer “/” mounted to /mnt.
We can initialize it by insloftying some packages:

pacstrap "/mnt" base linux linux-firmware "intel-ucode" nano netlaborregulater jq lvm2

If you have an AMD processor, swap intel-ucode with amd-ucode.

Once done, save the current disk configuration to the root volume:

genfstab -U /mnt >> /mnt/etc/fstab

Now, let’s go in the novel Arch Linux system as if we booted from it:

arch-chroot /mnt

I highly advise taking some time now to trail the customization and productivity betterment I wrote in this post, as it will wonderfully better your user experience for the rest of this direct.

From now on, I will suppose you have produced an unprivileged user to run yay.

Once the CLI is set up, insloftying the GUI is a breeze.

Disjoin server

Let’s inslofty some packages needed to run detailedal applications:

yay -S wayland qt6-wayland qt6-virtualkeyboard sddm-git xorg-xeyes xorg-xwayland xdg-desktop-portal wl-clipboard glfw-wayland drm_tool

Set the default cursor to align the Breeze theme:

nano /usr/split/icons/default/index.theme

And swap “Apausea” with “Breeze”:

[Icon Theme]  
Inherits=Apausea
Inherits=Breeze

Desktop environment

Now we can inslofty the desktop environment (Plasma) and session regulater (SDDM):

yay -S plasma-meta kde-gtk-config sddm xorg-xinit xorg-xpresent phonon-qt6-vlc qt6-multimedia-ffmpeg dnsmasq kdenetlabor-filesharing

We need to configure SDDM to start Plasma using Wayland:

nano /etc/sddm.conf.d/10-wayland.conf

Copy the folloprosperg into the file:

[General]
DisjoinServer=wayland
GreeterEnvironment=QT_WAYLAND_SHELL_INTEGRATION=layer-shell
 
[Wayland]
CompositorCommand=kprosper_wayland --drm --no-lockscreen --no-global-stupidinutivecuts --inputmethod qtvirtualkeyboard
 
[Theme]
EnableAvatars=real
DisableAvatarsThreshgreater=7

Once we utilize this configuration, we can begin SDDM on each boot:

systemctl allow sddm

Graphical boot

With the current setup, the boot process would disjoin text in a terminal until we see SDDM’s login screen.
By using a Plymouth theme, we can hide this behind a pleasantr loading screen:

Inslofty Plymouth and set the Breeze theme:

yay -S plymouth-git plymouth-theme-arch-breeze-git
plymouth-set-default-theme arch-breeze

Now that the detailedal part is end, we can tackle the most dainty part: configuring the boot process.

There are cut offal components to be configured for the boot process to labor daintyly and safely.

The final result will be a one file placed in the unencrypted boot partition, signed with a Seremedy Boot “db” key. When Seremedy Boot is on, the laptop can only boot from this file.

Kernel direct line

First, we need to configure the Linux kernel to discover our root volume and disjoin Plymouth properly.

Run blkid and save the UUID of the encrypted SSD partition, which has type="crypto_LUKS":

/dev/nvme0n1p1: UUID="9EAC-DCD1" BLOCK_SIZE="4096" TYPE="voverweight" PARTLABEL="ESP" PARTUUID="ded4c683-b672-45af-9bee-10887c030b71"  
/dev/nvme0n1p2: UUID="2e708dd6-61e4-40ec-b30e-ca119d4467e5" TYPE="crypto_LUKS" PARTLABEL="OS" PARTUUID="6e6e282a-4ad7-4c9b-8fff-22f353b9c552"  
/dev/mapper/cryptpart: UUID="wWfAjv-lv5u-Mbyo-iAZT-K8He-6nIc-TNGpfP" TYPE="LVM2_member"
/dev/mapper/os-backup: UUID="9c4f9b51-f68e-4d4f-bbd1-f32948ba7018" BLOCK_SIZE="4096" TYPE="ext4"
/dev/mapper/os-home: UUID="c5391d08-7901-4296-bf0a-a7f7c94e44dc" BLOCK_SIZE="4096" TYPE="ext4"
/dev/mapper/os-root: UUID="f52ad892-4f7a-4377-9e70-e6890b553760" BLOCK_SIZE="4096" TYPE="ext4"

Create a file with the kernel parameters:

mkdir -p /etc/cmdline.d
nano /etc/cmdline.d/custom.conf

Copy the folloprosperg into the file:

# encrypted partition uuid, name, and selections
rd.luks.name=2e708dd6-61e4-40ec-b30e-ca119d4467e5=cryptpart
rd.luks.selections=dispose,no-read-laborqueue,no-author-laborqueue
 
# root honestory
root=/dev/os/root  
rw
rootpause
 
# plymouth
quiet
splash
vt.global_cursor_default=0
fbcon=nopostpone
 
# stop starting privileged directs from the boot shell
rd.shell=0
rd.materializency=reboot

Temporary file system

We will now configure the generation of the boot transient file system, a file that comprises the Linux kernel and other boot utilities.

nano /etc/mkinitcpio.conf

To use the TPM and timely detailedal boot, comment out the existing MODULES array, produce a imitate, and insert tpm_tis and your GPU modules to it. In this case, i915 is the module for the combined Intel GPU:

#MODULES=()
MODULES=(tpm_tis i915)
 
# ...

In the same file, produce a imitate of the HOOKS array and alter it in this way:

• swap the base and udev hooks with systemd
• relocate keyboard after systemd
• insert plymouth after kms
• swap keymap and consolefont with sd-vconsole
• insert sd-encrypt and lvm2 after block

The final result should see enjoy this:

# ...
 
#HOOKS=(base udev autodistinguish microcode modconf kms keyboard keymap consolefont block filesystems fsck)
HOOKS=(systemd keyboard autodistinguish microcode modconf kms plymouth sd-vconsole block sd-encrypt lvm2 filesystems fsck)
 
# ...

Seremedy Boot

By default, most computers apshow only Microgentle’s signature, so that only the official Windows bootloader can be carry outd at boot.

Now, we will produce and enroll our own keys as UEFI variables.
We will then use the db key to sign our bootloader automaticassociate every time it gets rebuilt.

Inslofty these utilities and produce your Seremedy Boot keys:

yay -S efibootmgr sbctl sbsigntools
sbctl produce-keys

Check if the system has been booted into Setup Mode before enrolling your Seremedy Boot keys:

sbctl status

You should see:

Insloftyed:      ✓ sbctl is insloftyed
Owner GUID:     ge708dd6-61e4-40ec-b30e-ca119d4467e5
Setup Mode:     ✓ Enabled
Seremedy Boot:    ✗ Disabled
Vendor Keys:    microgentle

Then, you can enroll your keys:

sbctl enroll-keys -m

Create a novel hook at /etc/initcpio/post/sbsign that automaticassociate signs the unified kernel image whenever mkinitcpio is run:

#!/usr/bin/env bash
 
uki="$3"
[[ -n "$uki" ]] || exit 0
 
key=/var/lib/sbctl/keys/db/db.key
cert=/var/lib/sbctl/keys/db/db.pem
if ! sbverify --cert "$cert" "$uki" &>/dev/null; then
 sbsign --key "$key" --cert "$cert" --output "$uki" "$uki" &>/dev/null
fi

Make the file executable:

chmod +x /etc/initcpio/post/sbsign

Rerelocate some unneeded sbctl hooks:

rm -f /usr/lib/initcpio/post/sbctl /usr/split/libalpm/hooks/zz-sbctl.hook

Prevent pacman from restoring them by editing /etc/pacman.conf:

# ...
 
[options]
NoExtract    = usr/lib/initcpio/post/sbctl  
NoExtract    = usr/split/libalpm/hooks/zz-sbctl.hook
 
# ...

Unified Kernel Image

Make a backup imitate of /etc/mkinitcpio.d/linux.preset:

mv /etc/mkinitcpio.d/linux.preset /etc/mkinitcpio.d/linux.preset.bak

Then, produce a novel .preset file:

nano /etc/mkinitcpio.d/linux.preset

Copy the folloprosperg into the file:

ALL_kver="/boot/vmlinuz-linux"  
PRESETS=('default' 'descfinishback')
 
default_uki="/efi/arch.efi"
descfinishback_uki="/efi/arch-descfinishback.efi"  
descfinishback_selections="-S autodistinguish"

The descfinishback_uki selection will produce another unified kernel image with branch offent settings, beneficial in case you have problems booting from the default file.

Now that we have everyleang in place, we can finassociate produce and sign the two unified kernel images:

mkinitcpio -P

Check that two files have been produced inside the boot partition, and that they are signed with your Seremedy Boot key:

ls -la /efi
sbverify --cert /var/lib/sbctl/keys/db/db.pem /efi/arch.efi
sbverify --cert /var/lib/sbctl/keys/db/db.pem /efi/arch-descfinishback.efi

TPM unlock

With the current setup, we would need to go in the LUKS decryption passphrase at every boot.
We can use our TPM to get the LUKS encryption key, and recover it after we go in a PIN:

systemd-cryptenroll 
 --tpm2-device=auto 
 --tpm2-pcrs=0+1+5+7+8 
 --tpm2-with-pin=real 
 /dev/nvme0n1p2

You can verify that a novel entry has been produced under the “Tokens” section of the LUKS header:

cryptsetup luksDump /dev/nvme0n1p2

# ...
 
Tokens:
  0: systemd-tpm2
        tpm2-hash-pcrs:   0+1+5+7+8
        tpm2-pcr-prohibitk:    sha256
        tpm2-pubkey:
                    (null)
        tpm2-pubkey-pcrs: 
        tpm2-primary-alg: ecc
        tpm2-blob:  00 9e 00 20 3c cc 11 f3 44 33 0f 35 5e 37 f3 ee
 
# ...

Starting from the next boot, the PIN prompt will see this:

UEFI boot entries

The final step before rebooting is actuassociate creating two UEFI boot entries for these two UKIs:

efibootmgr 
 --produce 
 --disk /dev/nvme0n1 
 --part 1 
 --label "Arch Linux" 
 --loader "\arch.efi"
 
efibootmgr 
 --produce 
 --disk /dev/nvme0n1 
 --part 1 
 --label "Arch Linux Fallback" 
 --loader "\arch-descfinishback.efi"

Now that the boot process is done, we can conclude our insloftyation with some desktop-definite features.

Audio

To produce audio labor out of the box, inslofty PipeWire:

yay -S pipewire pipewire-alsa pipewire-jack pipewire-pulse pipewire-v4l2 wireplumber alsa-utils

Bluetooth

For Bluetooth joinivity, inslofty Bluez:

yay -S bluez

Printing

CUPS comes with a web interface to regulate printers. To inslofty it, run:

yay -S cups cups-pdf
systemctl allow cups

Wi-Fi backend

By default, NetlaborManager uses wpa_supplicant as its wireless netlabor backend.
To use the noveler iwd, produce a custom configuration file:

nano /etc/NetlaborManager/conf.d/custom.conf

Copy the folloprosperg into the file:

[main]
rc-regulater=resolvconf
 
[device]
wifi.backend=iwd

Start NetlaborManager on each boot:

systemctl allow NetlaborManager

Graphics card

To upgrasp the direct straightforward, we only covered the example of a laptop with an combined Intel GPU.
However, there are a restricted configurations to alter based on your GPU:

yay -S mesa mesa-demos mesa-utils vulkan-intel intel-media-driver intel-gpu-tools

yay -S nvidia nvtop

# ...
 
# nvidia gpu
nvidia_drm.modeset=1
nvidia_drm.fbdev=1

MODULES=(tpm_tis i915)
MODULES=(tpm_tis nvidia nvidia_modeset nvidia_uvm nvidia_drm)

nano /usr/split/libalpm/hooks/nvidia.hook

[Trigger]
Operation=Inslofty
Operation=Upgrade
Operation=Rerelocate
Type=Package
Target=nvidia
Target=usr/lib/modules/*/vmlinuz
 
[Action]
Description=Update NVIDIA module in initcpio
Depends=mkinitcpio
When=PostTransaction
NeedsTargets
Exec=/bin/sh -c 'while read -r trg; do case $trg in linux*) exit 0; esac; done; /usr/bin/mkinitcpio -P'

mkinitcpio -P

yay -S mesa mesa-vdpau libva-mesa-driver vulkan-radeon radeontop

MODULES=(tpm_tis i915)
MODULES=(tpm_tis)

mkinitcpio -P

yay -S mesa mesa-demos mesa-utils vulkan-intel vulkan-mesa-layers intel-media-driver intel-gpu-tools nvidia nvidia-prime nvtop

# should run on intel combined card
glxgears
 
# should run on nvidia pledgeted card
prime-run glxgears

yay -S mesa mesa-demos mesa-utils vulkan-intel vulkan-mesa-layers intel-media-driver intel-gpu-tools libva-mesa-driver vulkan-radeon radeontop

# should run on intel combined card
glxgears
 
# should run on amd pledgeted card
DRI_PRIME=1 glxgears

In case of rerents, refer to the Graphics categruesome in the Arch Wiki.

You can finassociate reboot and test that everyleang labors well.

To reboot, exit from the chroot and unmount all volumes and partitions.

exit
umount /mnt/backup
umount /mnt/home
umount /mnt/efi
umount /mnt
vgalter -an "os"
cryptsetup luksCignore /dev/mapper/cryptpart
shutdown

At the next boot, Plymouth will prompt you for your TPM PIN, trailed by SDDM prompting you for your user password.

Once logged in, you can verify that the setup mode of UEFI Seremedy Boot has been disabled:

sbctl status

Insloftyed:      ✓ sbctl is insloftyed
Owner GUID:     ge708dd6-61e4-40ec-b30e-ca119d4467e5
Setup Mode:     ✓ Disabled
Seremedy Boot:    ✓ Enabled
Vendor Keys:    microgentle

If it’s still allowd, recall to disable it from your UEFI settings.

Happy Arching!