Minimal instructions for installing arch linux on an UEFI NVMe system with full system encryption using dm-crypt and luks

Jul 17, 2018 · Forked from: binaerbaum/arch-linux-install

Installing Arch Linux with Full-Disk Encryption and UEFI (LUKS + LVM)

This guide turns the official installation steps into a practical, copy‑pasteable walkthrough for a UEFI system with an encrypted root volume using LUKS and LVM. It assumes you are comfortable working in a live environment and want a clean, minimal Arch install with swap and root on encrypted storage.

If you want a more exhaustive reference, consult the Arch Installation Guide (official wiki).

1) Prepare installation media

  1. Download the Arch ISO from the official Arch Linux site.
  2. Write it to a USB stick:
# On Linux
sudo dd if=archlinux.img of=/dev/sdX bs=16M && sync

Replace /dev/sdX with your USB device. Double‑check with lsblk before writing.

2) Boot and set up networking

  • Boot from the USB drive. If it fails, disable Secure Boot in BIOS/UEFI.
  • Set Swiss‑French keyboard layout (optional):
loadkeys fr_CH-latin1
  • Connect to Wi‑Fi (for Wi‑Fi‑only systems):
wifi-menu

3) Partition the disk (UEFI)

We’ll create:

  • 512 MB EFI System Partition (ESP)
  • One large partition for LUKS encryption
cfdisk /dev/nvme0n1

Suggested layout:

  1. 512MB EFI — type ef00
  2. Rest of disk — type 8300 (to be encrypted)

4) Format the EFI partition

mkfs.vfat -F32 /dev/nvme0n1p1

5) Encrypt the system partition (LUKS)

cryptsetup -c aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 3000 -y --use-random luksFormat /dev/nvme0n1p2
cryptsetup luksOpen /dev/nvme0n1p2 luks

6) Create LVM volumes inside the encrypted container

pvcreate /dev/mapper/luks
vgcreate vg0 /dev/mapper/luks
lvcreate --size 16G vg0 --name swap
lvcreate -l +100%FREE vg0 --name root

7) Create filesystems and mount

mkfs.ext4 /dev/mapper/vg0-root
mkswap /dev/mapper/vg0-swap

mount /dev/mapper/vg0-root /mnt
swapon /dev/mapper/vg0-swap

mkdir /mnt/boot
mount /dev/nvme0n1p1 /mnt/boot

8) Install base system

pacstrap /mnt base base-devel zsh vim git sudo efibootmgr dialog wpa_supplicant

9) Generate fstab

genfstab -pU /mnt >> /mnt/etc/fstab

Optional: make /tmp a RAM disk. Add this line to /mnt/etc/fstab:

tmpfs  /tmp  tmpfs  defaults,noatime,mode=1777  0  0

You can also change relatime to noatime for SSD longevity.

10) Chroot into the new system

arch-chroot /mnt /bin/bash

11) Configure time, locale, and hostname

ln -s /usr/share/zoneinfo/Europe/Zurich /etc/localtime
hwclock --systohc --utc

echo MYHOSTNAME > /etc/hostname

Edit /etc/locale.gen, uncomment desired locales, then:

locale-gen
localectl set-locale LANG=en_US.UTF-8

To avoid terminal issues (e.g. in GNOME Terminal), set system‑wide locale:

echo LANG=en_US.UTF-8 >> /etc/locale.conf
echo LC_ALL= >> /etc/locale.conf

12) Set root password and create a user

passwd

Create a user (remove -s /bin/zsh if you prefer another shell):

useradd -m -g users -G wheel,storage,power -s /bin/zsh MYUSERNAME
passwd MYUSERNAME

13) Configure mkinitcpio for encryption + LVM

Edit /etc/mkinitcpio.conf:

  • Add ext4 to MODULES
  • Add encrypt and lvm2 to HOOKS before filesystems
  • Add resume after lvm2 (and after udev)

Then regenerate:

mkinitcpio -p linux

14) Install systemd‑boot (UEFI)

bootctl --path=/boot install

Create /boot/loader/loader.conf:

default arch
timeout 5

Create /boot/loader/entries/arch.conf:

title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=UUID=<UUID>:vg0 root=/dev/mapper/vg0-root resume=/dev/mapper/vg0-swap rw intel_pstate=no_hwp

Replace <UUID> with the UUID of /dev/nvme0n1p2 (the raw encrypted partition). You can find it using blkid.

15) Finish up

exit
umount -R /mnt
swapoff -a
reboot

Remove the USB drive, and your encrypted Arch system should boot.