diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ff44eb0 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +quarkdown-output diff --git a/_nav.qd b/_nav.qd index 9f3dc4d..69cc1ff 100644 --- a/_nav.qd +++ b/_nav.qd @@ -1,5 +1,10 @@ ###! System Installation -- [Download Arch Linux](system-installation/001-download-arch-linux.md) -- [Basic System Installation](system-installation/002-basic-system-installation.md) +- [Download Arch Linux](system-installation/001-download-arch-linux.qd) +- [Basic System Installation](system-installation/002-basic-system-installation.qd) +- [System Configuration](system-installation/003-system-configuration.qd) +- [Graphical Environment](system-installation/004-graphical-environment.qd) +###! Hardware Configuration + +- [Thunderbolt](hardware/001-thunderbolt.qd) diff --git a/hardware/001-thunderbolt.qd b/hardware/001-thunderbolt.qd new file mode 100644 index 0000000..51855a4 --- /dev/null +++ b/hardware/001-thunderbolt.qd @@ -0,0 +1,32 @@ +.docname {Thunderbolt} +.include {docs} + +To connect a laptop with a thunderbolt docking station and use all its features, the thunderbolt docking station must be +added as a trusted devoce. Without this, only basic features can be used. + +Install the tool bolt: `sudo pacman -S bolt` + +Then list all available devices with `boltctl list`. + +## Temporarily Authorizing Devices + +A device can be authorized with `boltctl authorize ` + +.example {Example} + ```sh + boldctl authorize 000b400c-2177-d400-ffff-ffffffffffff + ``` + +## Permanently Authorizing Devices + +Above command is only a temporary authorization and will be lost upon reboot. To permanently authorize a device, +it should be enrolled. + +Use the `boltctl enroll ` command to permanently enroll a device. + +.example {Example} + ```sh + boltctl enroll 000b400c-2177-d400-ffff-ffffffffffff + ``` + + diff --git a/main.qd b/main.qd index 8e48ad2..ffcd378 100644 --- a/main.qd +++ b/main.qd @@ -39,6 +39,8 @@ A system deployed with fz-stack **will not**: > > .emoji {warning} Incorrectly executed commands can cause irreversible data loss. +## Todos + [arch-linux]: https://archlinux.org [arch-linux-wiki]: https://wiki.archlinux.org/title/Main_page [hyprland]: https://hypr.land diff --git a/system-installation/001-download-arch-linux.md b/system-installation/001-download-arch-linux.qd similarity index 100% rename from system-installation/001-download-arch-linux.md rename to system-installation/001-download-arch-linux.qd diff --git a/system-installation/002-basic-system-installation.md b/system-installation/002-basic-system-installation.md deleted file mode 100644 index 8dd91e2..0000000 --- a/system-installation/002-basic-system-installation.md +++ /dev/null @@ -1,71 +0,0 @@ -.docname {Basic System Installation} -.include {docs} - -This page explains the basic setup of Arch Linux. It was last updated July 2026. - -> Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install], -> as the instructions on this page might be outdated or no longer complete. - -> Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more. -> Make sure to understand all commands before you execute them. You will lose data! -> Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with. -> -> Create a backup of all important data that you do not want to lose before you continue with the installation of -> Arch Linux! - -## Preparation - -To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so. -For example: - -- Disable Secure Boot -- Delete existing Boot Sequences or Boot Entries -- Enable USB Boot Support -- Enabled External USB Ports - -.box {DELL XPS 13 9370} type:{note} - In the UEFI settings: - - - Enable the support to boot from USB devices: - `System Configuration` -> `USB Configuration` -> `Enable USB Boot Support` - - Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal` - - Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows - the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid - keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images. - - In the UEFI settings: - - - enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable` - - set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode` - - enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode` - - To access the boot menu or UEFI, press - - - .keybinding {F2} to access UEFI settings - - .keybinding {F12} to access one-time boot menu - -## Setting Keyboard Layout and Console Font - -List available console key maps with `localectl list-keymaps`, then set the desired key map with -`loadkeys `. - -Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont `. - -.example - ```sh - loadkeys de-latin1 - setfont eurlatgr - ``` - -> Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before -> the installation is finished and before the settings are persisted, repeat these commands after each boot. - -> Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or -> `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option, -> e.g. `setfont ter-118n -m 88591`. - -## Verify Boot Mode - -[arch-wiki]: https://wiki.archlinux.org/ -[arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide diff --git a/system-installation/002-basic-system-installation.qd b/system-installation/002-basic-system-installation.qd new file mode 100644 index 0000000..1ae9da5 --- /dev/null +++ b/system-installation/002-basic-system-installation.qd @@ -0,0 +1,323 @@ +.docname {Basic System Installation} +.include {docs} + +This page explains the basic setup of Arch Linux. It was last updated July 2026. + +> Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install], +> as the instructions on this page might be outdated or no longer complete. + +> Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more. +> Make sure to understand all commands before you execute them. You will lose data! +> Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with. +> +> Create a backup of all important data that you do not want to lose before you continue with the installation of +> Arch Linux! + +## Preparation + +To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so. +For example: + +- Disable Secure Boot +- Delete existing Boot Sequences or Boot Entries +- Enable USB Boot Support +- Enabled External USB Ports + +.box {DELL XPS 13 9370 (2018)} type:{note} + To access the boot menu or UEFI, press + + - .keybinding {F2} to access UEFI settings + - .keybinding {F12} to access one-time boot menu + + In the UEFI settings: + + - Enable the support to boot from USB devices: + `System Configuration` -> `USB Configuration` -> `Enable USB Boot Support` + - Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal` + + Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows + the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid + keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images. + + In the UEFI settings: + + - enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable` + - set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode` + - enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode` + +.box {DELL XPS 13 9350 (2024)} type:{note} + To access the boot menu or UEFI, press + + - .keybinding {F2} to access UEFI settings + - .keybinding {F12} to access one-time boot menu + + In the UEFI Settings: + + - Enable the support to boot from USB devices: + enable `Integrated Devices` -> `USB/Thunderbolt Configuration` -> `Enable USB Boot Support` + + Secure Boot should be configured to not use any Microsoft UEFI CA keys and should be prepared for enrollment + of a custom certificate + + In the UEFI Settings: + + - enable `Boot Configuration` -> `Secure Boot` -> `Enable Secure Boot` + - disable `Boot Configuration` -> `Secure Boot` -> `Enable Microsoft UEFI CA` + - set `Boot Configuration` -> `Secure Boot` -> `Secure Boot Mode` to ` Auto Mode` + - enable `Boot Configuration` -> `Expert Key Management` -> `Enable Custom Mode` + +## Setting Keyboard Layout and Console Font + +List available console key maps with `localectl list-keymaps`, then set the desired key map with +`loadkeys `. + +Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont `. + +.example + Commonly, I set my systems to + ```sh + loadkeys de-latin1-nodeadkeys + setfont eurlatgr + ``` + +> Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before +> the installation is finished and before the settings are persisted, repeat these commands after each boot. + +> Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or +> `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option, +> e.g. `setfont ter-118n -m 88591`. + +## Verify Boot Mode + +Verify that the system is booted in UEFI mode. + +```sh +cat /sys/firmware/efi/fw_platform_size +``` + +This command should return `64`. If the command returns `32`, the system is booted in EUFI mode and has a 32-bit IA32 +UEFI. While this is supported by Arch Linux, it is not part of this guide. + +If the file does not exist, the system may be booted in BIOS or CSM mode. In this case, disable CMS Mode and restart +the computer + +> Important: This guide does not work on systems in BIOS mode, or with IA32 UEFI! + +## Connect to the Internet + +Make sure that the computer is connected to the internet by running the following commands: + +```sh +ip link # check interface link status +ip a # check for valid IP address assignment +``` + +For a quick test, you can try to ping the arch linux website + +```sh +ping -c3 archlinux.org +``` + +If you are not yet automatically connected, follow one of these steps, depending on the connection type you want +to set up. + +1. For wireless lan (WiFi) and WWAN , make sure the wireless network card is not blocked by `rfkill`, check + ```sh + rfkill + list + ``` +2. Connect to the network: + - **Ethernet:** Plug in your cable. + - **Wi-Fi:** Authenticate to the wirless network using [`iwctl`][arch-wiki-iwctl]. + - **Mobile Broadband Modem:** connecto the mobile network with the [`nmcli`][arch-wiki-nmcli] utility. +3. Configure the network connection: + - **DHCP**: dynamic IP address and DNS server assignment should work out of the box. + - **Static IP Address**: See [Network Configuration][arch-wiki-network-configuration] + +## Update the System Clock + +Once a network connection is established, the system clock should be updated automatically. Check the correct date and +time has been acquired by running `timedatectl`. + +## Partition the Disks + +Get an overview of available disks with `lsblk` and / or `fdisk -l`. Make sure to identify the drives you want to +install Arch Linux to. + +This guide sets up two partitions. The first partition is the EFI system partition. It will be used to boot from a +unified kernel image. The second partition will be a LUKS encrypted partition. Inside of it will be a LVM2 container +with SWAP, system, and data partitions as you see fit. The unencrypted EFI partition is required for the system to boot. + +> Note: Even though we use LVM2 inside of the LUKS encrypted partition, this setup does not allow for the LVM2 volume +> group to span multiple disks. This is a limitation of this setup. If this limitation is unacceptabnle for you, check +> [LVM on LUKS in the Arch Wiki][arch-wiki-lvm-on-luks] for workarounds or different partition layouts you can use. + +> Important: The following steps will repartition and format the disks you specify in the commands. Double-check all +> drive paths in all commands before continuing. Specifying the wrong drive paths **will erase data** from drives that +> you did not intend to erase, and that will be **unrecovarbly** lost! + +### Transitioning from a Previously Unencrypted System + +Repartitioning the drives and switching to a new encrypted disk will not mask any of your previously unencrypted data. +The unencrypted data might still be recoverable by data recovery or data forensic tools. If you want to make sure that +data previously stored on the disk is un-recoverable, you need to overwrite all of the disk with random data. + +Depending on your disk size and write speed, this can take hours. + +If your disk was already encrypted previously, or you do not consider this necessary, you can [skip to the next +section](#create-partitions). + +Overwriting your disk with data can be achieved by the following commands + +```sh +cryptsetup open -q --type plain -d /dev/urandom to_be_wiped +dd bs=4M if=/dev/zero of=/dev/mapper/to_be_wiped conv=fsync oflag=direct status=progress +cryptsetup close to_be_wiped +``` + +### Create Partitions {#create-partitions} + +Create a 1GB EFI partition as the first partition. Use the rest of the disk for the encrypted LUKS partition. +To format the disk, use `fdisk `. Helpful commands: + +- `m` to show help +- `g` to create a new GPT partition table +- `n` to create a new partition +- `t` to change the type of a partition + - The EFI partition should be type `1: EFI System` + - The LUKS partition should be type `43: Linuzx RAID` +- `w` to write the changes and quit + +### Encrypt the System Partition + +Create a LUKS encrypted system partition and open it + +```sh +cryptsetup luksFormat +cryptsetup open cryptlvm +``` + +### TRIM and Workqueues for SSD Drives + +You can [skip this section](#prepare-lvm) if you are not using a SSD (Solid State Drive). + +You might want to configure TRIM support and disable workqueues to improve performance of SSD Drives. + +> Warning: Enabling TRIM support on an encrypted drive has potential security implications. See [TRIM support for solid +> state drives][arch-wiki-trim-support]. If this is an issue, you might want to [skip this section](#prepare-lvm). + +Verify your SSD supports TRIM: + +```sh +lsblk --discard +``` + +Enable TRIM support: + +```sh +cryptsetup --allow-discards --persistent refresh cryptlvm +``` + +Drive operation workqueues make sense for slow spinning disks. For SSDs, they usually introduce unnecessary delays. +Disabling workqueues can double the speed of file operations on SSDs. Disable the workqueues with the following command. + +```sh +cryptsetup --perf-no_read_workqueue --perf-no_write_workqueue --persistent refresh cryptlvm +``` + +### Preparing the Logical Volumes {#prepare-lvm} + +Inside the encrypted system partition, create the logical volumes. + +```sh +pvcreate /dev/mapper/cryptlvm +vgcreate vgsys /dev/mapper/cryptlvm +lvcreate -L vgsys -n lvswap +lvcreate -L 64G vgsys -n lvroot +lvcreate -L 64G vgsys -n lvhome +lvcreate -L 64G vgsys -n lvopt +lvcreate -L 64G vgsys -n lvvar +``` + +> Tip: The SWAP partition can be of any size. You could even go without one if you have enought RAM. The [Arch +> Wiki][arch-wiki] recommends at least 4GB. If you want to be able to use hibernation, I would recommend two times of +> your physical RAM size +> +> The (estimated) minimum SWAP space (in bytes) for successful hibernation can be found by looking at +> `cat /sys/power/image_size`. It is usually around 2/5 of the physical RAM. + +### Create the File Systems + +Create the file system on the EFI partition, the logical volumes, and the SWAP. + +```sh +mkfs.fat -F 32 -n EFI +mkfs.ext4 -L root /dev/vgsys/lvroot +mkfs.ext4 -L home /dev/vgsys/lvhome +mkfs.ext4 -L opt /dev/vgsys/lvopt +mkfs.ext4 -L var /dev/vgsys/lvvar +mkswap /dev/vgsys/lvswap +``` + +### Mount the File Systems + +Mount the created file systems + +```sh +swapon /dev/vgsys/lvswap +mount /dev/vgsys/lvroot /mnt +mount --mkdir /dev/vgsys/lvhome /mnt/home +mount --mkdir /dev/vgsys/lvopt /mnt/opt +mount --mkdir /dev/vgsys/lvvar /mnt/var +mount --mkdir /mnt/efi +``` + +## Install Packages + +Packages are installed from mirror servers, which are defined in `/etc/pacman.d/mirrorlist`. On the ISO, after +connecting to the internet, `reflector` updates the mirror list by choosing the 20 most recently synchronized HTTPS +mirrors, sorting them by download speed. + +The higher a mirror is placed in the mirror list, the more priority it is given when downloading a packge. You might +want to inspect the mirror list to see if it is satisfactory. If it is not, edit the file accordingly or run `reflector` +to create a new mirror list specifying custom sorting parameters. + +The file `/etc/pacman.d/mirrorlist` of the live ISO image is the only configuration file that will be copied from the +live ISO to the operating system that is being installed. So investing some time now and getting the mirror list right +is worth the effort now. + +.example {Reflector Configuration} + The following command will instruct reflector to select the 10 most up to date https mirrors from Germany, Austria, + Switzerland, and Netherlands - then sort them by most recently updated. + + ```sh + reflector \ + --country Germany,Austria,Switzerland,Netherlands \ + --protocol https \ + --latest 10 \ + --sort age \ + --save /etc/pacman.d/mirrorlist + ``` + +Install the essential packages to the system + +> Tip: This list already contains some essential software that is strictly not needed for a minimal system install. +> If you want to go more minimal, check the Arch Wiki for the minimal set of packages required. + +```sh +pacstrap -K /mnt base linux linux-firmware \ +exfatprogs e2fsprogs lvm2 \ +neovim git base-devel man-db man-pages texinfo \ +terminus-font intel-ucode efibootmgr sbctl openssh wget +``` + +> Important: On AMD CPU based systems, replace `intel-ucode` with `amd-ucode`. + +[arch-wiki]: https://wiki.archlinux.org/ +[arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide +[arch-wiki-iwctl]: https://wiki.archlinux.org/title/Iwd#iwctl +[arch-wiki-nmcli]: https://wiki.archlinux.org/title/Mmcli +[arch-wiki-network-configuration]: https://wiki.archlinux.org/title/Network_configuration +[arch-wiki-lvm-on-luks]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS +[arch-wiki-trim-support]: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD) + diff --git a/system-installation/003-system-configuration.qd b/system-installation/003-system-configuration.qd new file mode 100644 index 0000000..be77fec --- /dev/null +++ b/system-installation/003-system-configuration.qd @@ -0,0 +1,483 @@ +.docname {System Configuration} +.include {docs} + +Configure the system for initial boot. + +## File System Table + +Generate the file system table. + +```sh +genfstab -U /mnt >> /mnt/efc/fstab +``` + +Check the table that was generated in `/mnt/etc/fstab`. + +## Change Root + +Change root into the new system + +```sh +arch-chroot /mnt +``` + +> Tip: From this point onwards you will only be able to access programs that we previously installed using the +> `pacstrap` command. So for editing text files, you will need to use `neovim` with the `nvim` command instead of `vim`. +> You can install additional programs with `pacman -S ` at any time if you need more tools. + +## Time Zone + +Configure the correct time zone. + +```sh +ln -sf /usr/sahre/zoneinfo// /etc/localtime +``` + +.example {Europe/Berlin} + ```sh + ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime + ``` + +Then update the system clock with `hwclock --systohc`. + +## Localization + +Edit the file `/etc/locale.gen` and uncomment all needed locales. Generate the locales afterwards by running +`locale-gen`. + +.example {Installed Localizations} + I usually enable the following locales onmy systems: + - `de_DE.UTF-8 UTF-8` + - `de_DE ISO-8859-1` + - `de_DE@euro ISO-8859-15` + - `en_GB.UTF-8 UTF-8` + - `en_GB ISO-8859-1` + - `en_US.UTF-8 UTF-8` + - `en_US ISO-8859-1` + +Create the file `/etc/locale.conf` and set the `LANG` variable as well as other environment variables accordingly. The +settings depend on you rlocation and your personal preference + +.example {Localization} + ```ini + LANG=en_GB.UTF-8 + LANGUAGE=en_GB.UTF-8 + LC_CTYPE=en_GB.UTF-8 + LC_NUMERIC=en_GB.UTF-8 + LC_TIME=en_GB.UTF-8 + LC_COLLATE=en_GB.UTF-8 + LC_MONETARY=de_DE.UTF-8 + LC_MESSAGES=en_GB.UTF-8 + LC_PAPER=de_DE.UTF-8 + LC_NAME=de_DE.UTF-8 + LC_ADDRESS=de_DE.UTF-8 + LC_TELEPHONE=de_DE.UTF-8 + LC_MEASUREMENT=de_DE.UTF-8 + LC_IDENTIFICATION=de_DE.UTF-8 + ``` + +Persist the settings of console keyboard layout and font. Create the file `/etc/vconsole.conf`: + +```sh +FONT=eurlatgr +KEYMAP=de-latin1-nodeadkeys +``` + +## Network Configuration + +### Hostname + +Set a hostname in `/etc/hostname` + +> Tip: For advice on choosing a hostname, see [RFC 1178][rfc-1178]. As explained in [hostname(7)][hostname-7], it must +> contain from 1 to 63 characters, using only lowercase `a` to `z`, `0` to `9`, and `-`, and must not start with `-`. + +Install Network Manager to the network interfaces of the system + +```sh +pacman -S networkmanager nm-connection-editor network-manager-applet +``` + +Then enable the systemd services for Network Manager + +```sh +systemctl enable NetworkManager +systemctl enable systemd-resolved +systemctl enable systemd-timesyncd +``` + +Create the file `/etc/NetworkManager/conf.d/20-connectivity.conf` with the following content + +```ini +[connectivity] +uri=https://zechert.net/connectivity_check.txt +``` + +Create the file `/etc/NetworkManager/conf.d/10-dns.conf` with the following content + +```ini +[main] +dns=systemd-resolved +``` + +### Use Advertised NTP Servers + +To use the NTP Servers advertised by the DHCP Server, create a new network manager dispatcher script in +`/etc/NetworkManager/dispatcher.d/10-update-timesyncd` with the following content + +```sh +#!/bin/sh + +[ -z "$CONNECTION_UUID" ] && exit 0 +INTERFACE="$1" +ACTION="$2" + +case $ACTION in +up | dhcp4-change | dhcp6-change) + [ -n "$DHCP4_NTP_SERVERS" ] || exit 0 + mkdir -p /etc/systemd/timesyncd.conf.d + cat <<-THE_END >"/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf" + [Time] + NTP=$DHCP4_NTP_SERVERS + THE_END + systemctl restart systemd-timesyncd.service + ;; +down) + rm -f "/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf" + systemctl restart systemd-timesyncd.service + ;; +esac +``` + +Make the script executable with `chmod +x /etc/NetworkManager/dispatcher.d/10-update-timesyncd`. + +Create the following file `/etc/systemd/system/networkdown.service`: + +```ini +[Unit] +Wants=network-online.target +After=network.target network-online.target + +[Service] +Type=oneshot +ExecStart=/bin/true +ExecStop=/bin/sh -c 'rm -f /etc/systemd/timesyncd.conf.d/ntp-*.conf' +RemainAfterExit=yes + +[Install] +WantedBy=suspend.target +``` + +Enable the service with `systemctl enable networkdown`. + +### Configure MAC Address Randomization + +MAC randomization can be used for increased privacy by not disclosing the real MAC address to the network. + +Create the file `/etc/NetworkManager/conf.d/10-random-mac.conf` with the following content: + +```ini +[device] +wifi.scan-rand-mac-address=yes + +[device-mac-randomization] +wifi.scan-rand-mac-address=yes + +[connection-mac-randomization] +ethernet.cloned-mac-address=stable +wifi.cloned-mac-address=stable +``` + +### Enable IPv6 Privacy Extensions + +Create the file `/etc/NetworkManager/conf.d/10-ipv6-privacy.conf` with the following content: + +```ini +[connection] +ipv6.ip6-privacy=2 +``` + +Create the file `/etc/sysctl.d/40-ipv6.conf` with the following content: + +```ini +net.ipv6.conf.all.use_tempaddr=2 +net.ipv6.conf.default.use_tempaddr=2 +``` + +### Configure a unique DUID per connection + +NetworkManager uses DUID-UUID from `/etc/machin-id` for all DHCPv6 connections. This might be a security breach. +Instead, configure NetworkManager to create unique DUIDs for each connection. + +Create the file `/etc/NetworkManager/conf.d/02-duid.conf` with the following content + +```ini +[connection] +ipv6.dhcp-duid=stable-uuid +``` + +### Enable DNSSEC + +Create the file `/etc/systemd/resolved.conf.d/30-dnssec.conf` with the following content + +```ini +[Resolve] +DNSSEC=true +``` + +> Warning: This will break name resolution for all hostnames that do not offer DNSSEC or that are resolved by +> nameservers that do not support DNSSEC. This can break resolution to internal hostnames (e.g. Company Intranet) as +> well es some public sites. + +### Disable mDNS + +Create the file `/etc/NetworkManager/conf.d/30-mdns.conf` with the following content + +```ini +[connection] +connection.mdns=0 +``` + +Create the file `/etc/systemd/resolved.conf.d/30-mdns.conf` with the following content + +```ini +[Resolve] +MulticastDNS=no +``` + +> Warning: Disabling mDNS will break nameserver-less resolution of local hostnames from the same network (DNS via +> multicast DNS Queries). This can break auto-discovery and access to other local machines like local printers, sambda +> network drives, other devices, etc. +> +> Change this to `connection.mdns=1` to fully enable mDNS, `connection.mdns=2` to enable resolution but not announcement +> of your own machine to the network. For both of these oiptions, set `MulticastDNS=yes` to enable the functionality in +> systemd-resolved (or delete the file). + +### Disabled LLMNR + +Create the file `/etc/NetworkManager/conf.d/30-llmnr.conf` with the following content + +```ini +[connection] +connection.llmnr=0 +``` + +Create the file `/etc/systemd/resolved.conf.d/30-llmnr.conf` with the following content + +```ini +[Resolve] +LLMNR=no +``` + +## Mkinitcpio Configuration + +Edit the file `/etc/mkinitcpio.conf` and add the necessary hooks for the system. + +Add the hooks `systemd`, `keyboard`, `sd-vconsole`, `sd-encrypt` to the list of hooks as follows: + +```ini +HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck resume) +``` + +## Set Kernel Command Line + +Create the file `/etc/cmdline.d/01-cryptlvm.conf` with the following content + +```ini +rd.luks.name==cryptlvm +``` + +The UUID can be found with the command `ls -all /dev/disk/by-uuid`. +It can be conveniently copied into the `01-cryptlvm.conf` file with the command + +```sh +ls -all /dev/disk/by-uuid | grep "" | awk '{print $9}' >> /etc/cmdline.d/01-cryptlvm.conf +``` + +Create the file `/etc/cmdline.d/02-root.conf` with the following content + +```ini +root=/dev/vgsys/lvroot +``` + +Create the file `/etc/cmdline.d/03-resume.conf` with the following content + +```ini +resume=/dev/vgsys/lvswap +``` + +## Enable Unified Kernel Image Booting + +UKI creates a single executable that can be directly booted from the UEFI firmware without any bootloader. + +Modify the file `/etc/mkinitcpio.d/linux.preset`. + +- Un-comment (i.e. remove `#`) the `PRESET_uki=` parameter for each item in `PRESETS=` +- Comment out (i.e. add `#`) `PRESET_image=` to avoid storing a redundant `initramfs-*.img` file + +Create the directory `/efi/EFI/Linux`, then create the initcpio `mkinitcpio -P`. + +Make sure that the generation succeeded and two files have been created (`ls /efi/EFI/Linux`), called +`arch-linux-fallback.efi` and `arch-linux.efi` (the fallback image might be missing if it is not enabled in the PRESETS). + +## Create Boot Menu Entries + +With `efibootmgr` check for existing EFI Boot Menu Entries, remove them if required, and create new entries for +Arch Linux. + +- List all entries `efibootmgr` +- Automatically remove duplicate entries `efibootmgr -D` +- Remove a specific boot entry `efibootmgr -b XXXX -B` +- Change the order of boot entries with `efibootmgr -o XXXX,YYYY,ZZZZ` + +Create the following two new entries + +```sh +efibootmgr --create \ +--disk \ +--loader=/EFI/Linux/arch-linux.efi \ +--label "Arch Linux" \ +--verbose + +efibootmgr --create \ +--disk \ +--loader=/EFI/Linux/arch-linux-fallback.efi \ +--label "Arch Linux Fallback" \ +--verbose +``` + +## Enable Secureboot + +Unfortunately the UEFI kernel image is not stored on an encrypted disk, and cannot be. Since the EFI firmware needs to +be able to access the image to boot the system. Therefore, the system is at risk by an attacker that can manipulate the +kernel image and boot partition. As a remedy to this problem, we will enable secure boot. The boot loader file will be +cryptographically signed by a secret key that is stored on our encrypted partition. + +We will use the tool `sbctl` for a user friendly way to configure secure boot. + +First, check the current status with `sbctl status`. You should see that sbctl is not installed, and that secure boot +setup mode is enabled. + +Creeate new keys: `sbctl create-keys`. Then enroll the new keys with `sbctl enroll-keys -m`. + +> Warning: The parameter `-m` in the command `sbctl enroll-keys -m` will enroll your own keys alongside with the default +> microsoft keys. The microsoft keys might be required by any option roms or some firmware in the system. You can omit +> the option `-m` to only enroll your own keys without Microsoft's. But you might create a system that can no longer +> boot! Only do this if you know the risk and know what you are doing. If you want to do this, replace `-m` by +> `--yes-this-might-brick-my-machine`. + +## Signing EFI Images + +`sbctl` comes with the necessary hooks pre-installed to automatically sign images when needed. Since we have created new +and fresh keys, we need to trigger this now manually once. Run `mkinitcpio -P` to recreate images and trigger `sbctl` +into signing the new images. + +## Create a User Account + +Set the password for the user `root`, then create a normal user account. +Modify the sudoers file, so that the group sudo has access to the `sudo` command. + +```sh +passwd root +groupadd -r sudo +EDITOR=nvim visudo +useradd -c " -m -s /bin/bash +usermod -aG adm,log,rfkill,sys,wheel,sudo,video,input +chfn +passwd +``` + +Confirm the new user can successfully use `sudo` to elevate permission. + +1. Switch to the created user account `su - `. (.keybinding {ctrl+d} can be used to exit the user account and + go back to root) +2. Enter `sudo whoami`, check if sudo works. The output should be `root` +3. Exit the user account with .keybinding {ctrl+d} or `exit`. + +For increased security, disable login as root with `passwd --lock root`. + +## Configure Pacman and Yay + +Switch to the user account you just created with `su - `. +Run the following commands to install `yay`, a AUR package helper. + +```sh +cd ~ +sudo pacman -S git base-devel go +git clone https://aur.archlinux.org/yay.git +cd yay +makepkg -si +yay -S yay +cd ~ +rm -rf yay +exit +``` + +Change the configuration of pacman in `/etc/pacman.conf`. Enable the options you want to set, e.g. `Color`, +`VerbosePkgList`, `ParallelDownloads`. + +Then install the package `pacman -S pacman-contrib` and enable the service `systemctl enable paccache.timer`. + +## Enable TRIM + +For SSDs only, enable periodic trim. + +```sh +systemctl enable fstrim.timer +``` + +> Warning: Enabling TRIM can leak some information about the encrypted system, e.g. presence of encrypted file systems, +> or even file system types. If this is a concern to you, or you want to achieve plausable deniability, do not enable +> TRIM on your system. + +## Recurring Automatic Mirror Selection + +Install reflector with `pacman -S reflector` + +Edit the options in `/etc/xdg/reflector/reflector.conf`. Then enable the timer service `systemctl enable reflector`. + +## Reboot the System + +Reboot the system into the installed Arch Linux. + +```sh +# exit chroot environment with +exit + +# unmount all partitions +umount -R /mnt + +# reboot +reboot +``` + +Remove your installation media. + + +## Activate systemd-resolved Stub Resolver + +After the system rebooted, make sure to set the following symlink! + +```sh +sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf +``` + +## Connect to the network + +Use `nmtui` to connect to a wireless network, if required. + +## Create a New Keypair + +Create a new ssh keyapair. Alternatively copy an existing one. + +```sh +ssh-keygen -t ed25519 -C "$(whoami)@$(uname -n)-$(date -I)" +``` + +## Update the System# + +Run a full system upgrade with `pacman -Syu`. + +[rfc-1178]: https://tools.ietf.org/html/rfc1178 +[hostname-7]: https://man.archlinux.org/man/hostname.7 + diff --git a/system-installation/004-graphical-environment.qd b/system-installation/004-graphical-environment.qd new file mode 100644 index 0000000..5757972 --- /dev/null +++ b/system-installation/004-graphical-environment.qd @@ -0,0 +1,125 @@ +.docname {Graphical Environment} +.include {docs} + +The steps necessary to install graphics drivers are very dependent on your device. This guide details the settings I use +for my own hardware. + +For general instructions, consult the [Arch Linux Wiki: Graphics][arch-wiki-graphics]. + +## Intel Graphics i915 / xe / Arc + +Since Intel provides and supports open source drivers, Intel graphics are essentially plug-and-play. This guide details +some customized and improved settings, based on my personal preferences. + +### Installation + +Install (`sudo pacman -S ...`) the following packages + +- `mesa`: open source OpenGL implementation for most modern drivers, including intel i915 3rd gen hardware +- `mesa-utils`: Utilities for `mesa` +- `vulkan-intal`: Vulkan support for intel hardware +- `vulkan-tools`: Vulkan utilities +- `intel-media-driver`: for VA-API support +- `libva-utils`: Utilities for VA-API +- `vdpauinfo`: Utilities for VDPAU +- `nvtop` Utility to show graphics card usage + +Then reboot the computer. + +### Enable GuC / HuC Firmware Loading + +Depending on the hardware support, GuC and HuC should be en abled by default. You can check this by running the +following commands + +```sh +cat /sys/kernel/debug/dri/0/gt0/uc/guc_info +cat /sys/kernel/debug/dri/0/gt0/uc/huc_info +``` + +> Tip: `0` might need to be replaced by a different number in the commands above. The files will only exist if GuC / +> HuC are enabled during boot. A reboot might be required if you cannot see them, or GuC / HuC is disabled in the +> system. + +If GuC / HuC is disabled, you can manually enable it. Create the file `/etc/modprobe.d/i915.conf` + +```txt +option i915 enable_guc=2 +``` + +Possible options: + +- `1`: Enable GuC but not HuC +- `2`: Enable Huc, but not GuC +- `3`: Enable HuC and GuC + +.example {Dell XPS 13 9370 (2018)} + Supported option is `option i915 enable_guc=2` + +.example {DELL XPS 13 9350 (2024)} + The xe driver is still experimental. Once it becomes mainline, GuC/HuC will be enabled by default. + +Then regenerate and sign the initramfs with `mkinictpio -P` + +> Warning: Manually enabling GuC or HuC firmware loading taints the kernel even when the feature is not supported. +> Moreover, enabling Guc / HuC firmware loading can cause issues on some systems; disable it if you experience freezing +> (for example, after resuming from hibernation). + +### Intel ARC + +Intel ARC GPUs support hardware raytracing support through onboard TSUs. Current performance is mixed. +For intel ARC, `linux-firmware-intel` should be installed on the system. It likely is from the base install already. + +## AMD Graphics + +AMD releases their drivers as open source. There are also closed source drivers available for special usecases. This +guide will only focus on the open source drivers. + +Install (`sudo pacman -S ...`) the following packages + +- `mesa` modern OpenGL drivers for most hardware +- `mesa-utils` utility programs for mesa +- `vulkan-radeon` vulkan support +- `vulkan-tools` utility programs for vulkan +- `libva-mesa-driver` to support accelerated video decoding using VA-API +- `libva-utils` utility programs for VA-API +- `mesa-vdpau` support for VDPAU +- `vdpauinfo` utility programs for VDPAU +- `nvtop` to monitor temparature, clock speed, and usage of the graphics card + +Then reboot the system. + + +## Reboot + +Do not forget to reboot the system after changes to the graphics drivers have been made. + +## Install Hyprland + +To install Hyprland, install the following packages that will include some necessary utilities for the system + +```sh +yay -S --needed \ +hyprland hyprpaper hypridle hyprlock waybar wofi kitty nemo gvfs gvfs-mtp gvfs-smb \ +xdg-desktop-portal xdg-desktop-portal-hyprland xdg-desktop-portal-gtk xdg-utils \ +wl-clipboard grim slurp swaync network-manager-applet polkit polkit-gnome chezmoi \ +wev btop qt5-wayland qt6-wayland qt5ct qt6ct gtk-engine-murrine \ +colloid-catppuccin-gtk-theme papirus-icon-theme breeze-icons \ +pipewire pipewire-audio pipewire-alsa pipewire-pulse pipewire-jack wireplumber \ +pavucontrol alsa-utils \ +ttf-bitstream-vera ttf-croscore ttf-dejavu ttf-droid gnu-free-fonts ttf-libreation \ +ttf-libertinus otf-libertinus noto-fonts ttf-roboto ttf-ubuntu-font-family \ +ttf-anonymous-pro ttf-cascadia-code ttf-fira-mono otf-fira-mono inter-font \ +ttf-ms-fonts ttf-vista-fonts ttf-roboto-mono-nerd ttf-firacode-nerd \ +otf-firamono-nerd otf-font-awesome \ +noto-fonts-emoji noto-fonts-cjk noto-fonts-extra ttf-jetbrains-mono \ +ttf-jetbrains-mono-nerd \ +firefox librewolf-bin thunderbird \ +git make gcc curl ripgrep fzf jq tar unzip inotify-tools socat brightnessctl \ +xdg-user-dirs fastfetch figlet openssh tmux man-db man-pages usbutils pciutils \ +uwsm libnewt +``` + +You can now start hyprland with `uwsm start hyprland.desktop`. + + +[arch-wiki-graphics]: https://wiki.archlinux.org/title/Category:Graphics