add documentation for arch installation

2026-07-23 02:28:59 +02:00
parent 5822020b89
commit e0fad8e6ed
9 changed files with 973 additions and 73 deletions
@@ -0,0 +1 @@
 quarkdown-output
@@ -1,5 +1,10 @@
 ###! System Installation
- [Download Arch Linux](system-installation/001-download-arch-linux.md)
+- [Download Arch Linux](system-installation/001-download-arch-linux.qd)
- [Basic System Installation](system-installation/002-basic-system-installation.md)
+- [Basic System Installation](system-installation/002-basic-system-installation.qd)
 - [System Configuration](system-installation/003-system-configuration.qd)
 - [Graphical Environment](system-installation/004-graphical-environment.qd)
 ###! Hardware Configuration
 - [Thunderbolt](hardware/001-thunderbolt.qd)
@@ -0,0 +1,32 @@
 .docname {Thunderbolt}
 .include {docs}
 To connect a laptop with a thunderbolt docking station and use all its features, the thunderbolt docking station must be
 added as a trusted devoce. Without this, only basic features can be used.
 Install the tool bolt: `sudo pacman -S bolt`
 Then list all available devices with `boltctl list`.
 ## Temporarily Authorizing Devices
 A device can be authorized with `boltctl authorize <device id>`
 .example {Example}
 	```sh
 	boldctl authorize 000b400c-2177-d400-ffff-ffffffffffff
 	```
 ## Permanently Authorizing Devices
 Above command is only a temporary authorization and will be lost upon reboot. To permanently authorize a device,
 it should be enrolled.
 Use the `boltctl enroll <device id>` command to permanently enroll a device.
 .example {Example}
 	```sh
 	boltctl enroll 000b400c-2177-d400-ffff-ffffffffffff
 	```
@@ -39,6 +39,8 @@ A system deployed with fz-stack **will not**:
 >
 > .emoji {warning} Incorrectly executed commands can cause irreversible data loss.
 ## Todos
 [arch-linux]: https://archlinux.org
 [arch-linux-wiki]: https://wiki.archlinux.org/title/Main_page
 [hyprland]: https://hypr.land
@@ -1,71 +0,0 @@
 .docname {Basic System Installation}
 .include {docs}
 This page explains the basic setup of Arch Linux. It was last updated July 2026.
 > Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install],
 > as the instructions on this page might be outdated or no longer complete.
 > Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more.
 > Make sure to understand all commands before you execute them. You will lose data!
 > Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with.
 >
 > Create a backup of all important data that you do not want to lose before you continue with the installation of
 > Arch Linux!
 ## Preparation
 To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so.
 For example:
 - Disable Secure Boot
 - Delete existing Boot Sequences or Boot Entries
 - Enable USB Boot Support
 - Enabled External USB Ports
 .box {DELL XPS 13 9370} type:{note}
    In the UEFI settings:
    - Enable the support to boot from USB devices:
      `System Configuration` -> `USB Configuration` -> `Enable USB Boot Support`
    - Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal`
    Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows
    the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid
    keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images.
    In the UEFI settings:
    - enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable`
    - set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode`
    - enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode`
    To access the boot menu or UEFI, press
    - .keybinding {F2} to access UEFI settings
    - .keybinding {F12} to access one-time boot menu
 ## Setting Keyboard Layout and Console Font
 List available console key maps with `localectl list-keymaps`, then set the desired key map with
 `loadkeys <key map>`.
 Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont <font>`.
 .example
    ```sh
    loadkeys de-latin1
    setfont eurlatgr
    ```
 > Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before
 > the installation is finished and before the settings are persisted, repeat these commands after each boot.
 > Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or
 > `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option,
 > e.g. `setfont ter-118n -m 88591`.
 ## Verify Boot Mode
 [arch-wiki]: https://wiki.archlinux.org/
 [arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide
@@ -0,0 +1,323 @@
 .docname {Basic System Installation}
 .include {docs}
 This page explains the basic setup of Arch Linux. It was last updated July 2026.
 > Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install],
 > as the instructions on this page might be outdated or no longer complete.
 > Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more.
 > Make sure to understand all commands before you execute them. You will lose data!
 > Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with.
 >
 > Create a backup of all important data that you do not want to lose before you continue with the installation of
 > Arch Linux!
 ## Preparation
 To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so.
 For example:
 - Disable Secure Boot
 - Delete existing Boot Sequences or Boot Entries
 - Enable USB Boot Support
 - Enabled External USB Ports
 .box {DELL XPS 13 9370 (2018)} type:{note}
    To access the boot menu or UEFI, press
    - .keybinding {F2} to access UEFI settings
    - .keybinding {F12} to access one-time boot menu
    In the UEFI settings:
    - Enable the support to boot from USB devices:
      `System Configuration` -> `USB Configuration` -> `Enable USB Boot Support`
    - Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal`
    Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows
    the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid
    keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images.
    In the UEFI settings:
    - enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable`
    - set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode`
    - enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode`
 .box {DELL XPS 13 9350 (2024)} type:{note}
    To access the boot menu or UEFI, press
    - .keybinding {F2} to access UEFI settings
    - .keybinding {F12} to access one-time boot menu
    In the UEFI Settings:
    - Enable the support to boot from USB devices:
      enable `Integrated Devices` -> `USB/Thunderbolt Configuration` -> `Enable USB Boot Support`
    Secure Boot should be configured to not use any Microsoft UEFI CA keys and should be prepared for enrollment
    of a custom certificate
    In the UEFI Settings:
    - enable `Boot Configuration` -> `Secure Boot` -> `Enable Secure Boot`
    - disable `Boot Configuration` -> `Secure Boot` -> `Enable Microsoft UEFI CA`
    - set `Boot Configuration` -> `Secure Boot` -> `Secure Boot Mode` to ` Auto Mode`
    - enable `Boot Configuration` -> `Expert Key Management` -> `Enable Custom Mode`
 ## Setting Keyboard Layout and Console Font
 List available console key maps with `localectl list-keymaps`, then set the desired key map with
 `loadkeys <key map>`.
 Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont <font>`.
 .example
    Commonly, I set my systems to
    ```sh
    loadkeys de-latin1-nodeadkeys
    setfont eurlatgr
    ```
 > Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before
 > the installation is finished and before the settings are persisted, repeat these commands after each boot.
 > Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or
 > `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option,
 > e.g. `setfont ter-118n -m 88591`.
 ## Verify Boot Mode
 Verify that the system is booted in UEFI mode.
 ```sh
 cat /sys/firmware/efi/fw_platform_size
 ```
 This command should return `64`. If the command returns `32`, the system is booted in EUFI mode and has a 32-bit IA32
 UEFI. While this is supported by Arch Linux, it is not part of this guide.
 If the file does not exist, the system may be booted in BIOS or CSM mode. In this case, disable CMS Mode and restart
 the computer
 > Important: This guide does not work on systems in BIOS mode, or with IA32 UEFI!
 ## Connect to the Internet
 Make sure that the computer is connected to the internet by running the following commands:
 ```sh
 ip link # check interface link status
 ip a # check for valid IP address assignment
 ```
 For a quick test, you can try to ping the arch linux website
 ```sh
 ping -c3 archlinux.org
 ```
 If you are not yet automatically connected, follow one of these steps, depending on the connection type you want
 to set up.
 1. For wireless lan (WiFi) and WWAN , make sure the wireless network card is not blocked by `rfkill`, check
  ```sh
  rfkill
  list
  ```
 2. Connect to the network:
  - **Ethernet:** Plug in your cable.
  - **Wi-Fi:** Authenticate to the wirless network using [`iwctl`][arch-wiki-iwctl].
  - **Mobile Broadband Modem:** connecto the mobile network with the [`nmcli`][arch-wiki-nmcli] utility.
 3. Configure the network connection:
  - **DHCP**: dynamic IP address and DNS server assignment should work out of the box.
  - **Static IP Address**: See [Network Configuration][arch-wiki-network-configuration]
 ## Update the System Clock
 Once a network connection is established, the system clock should be updated automatically. Check the correct date and
 time has been acquired by running `timedatectl`.
 ## Partition the Disks
 Get an overview of available disks with `lsblk` and / or `fdisk -l`. Make sure to identify the drives you want to
 install Arch Linux to.
 This guide sets up two partitions. The first partition is the EFI system partition. It will be used to boot from a
 unified kernel image. The second partition will be a LUKS encrypted partition. Inside of it will be a LVM2 container
 with SWAP, system, and data partitions as you see fit. The unencrypted EFI partition is required for the system to boot.
 > Note: Even though we use LVM2 inside of the LUKS encrypted partition, this setup does not allow for the LVM2 volume
 > group to span multiple disks. This is a limitation of this setup. If this limitation is unacceptabnle for you, check
 > [LVM on LUKS in the Arch Wiki][arch-wiki-lvm-on-luks] for workarounds or different partition layouts you can use.
 > Important: The following steps will repartition and format the disks you specify in the commands. Double-check all
 > drive paths in all commands before continuing. Specifying the wrong drive paths **will erase data** from drives that
 > you did not intend to erase, and that will be **unrecovarbly** lost!
 ### Transitioning from a Previously Unencrypted System
 Repartitioning the drives and switching to a new encrypted disk will not mask any of your previously unencrypted data.
 The unencrypted data might still be recoverable by data recovery or data forensic tools. If you want to make sure that
 data previously stored on the disk is un-recoverable, you need to overwrite all of the disk with random data.
 Depending on your disk size and write speed, this can take hours.
 If your disk was already encrypted previously, or you do not consider this necessary, you can [skip to the next
 section](#create-partitions).
 Overwriting your disk with data can be achieved by the following commands
 ```sh
 cryptsetup open -q --type plain -d /dev/urandom <drive path> to_be_wiped
 dd bs=4M if=/dev/zero of=/dev/mapper/to_be_wiped conv=fsync oflag=direct status=progress
 cryptsetup close to_be_wiped
 ```
 ### Create Partitions {#create-partitions}
 Create a 1GB EFI partition as the first partition. Use the rest of the disk for the encrypted LUKS partition.
 To format the disk, use `fdisk <drive path>`. Helpful commands:
 - `m` to show help
 - `g` to create a new GPT partition table
 - `n` to create a new partition
 - `t` to change the type of a partition
  - The EFI partition should be type `1: EFI System`
  - The LUKS partition should be type `43: Linuzx RAID`
 - `w` to write the changes and quit
 ### Encrypt the System Partition
 Create a LUKS encrypted system partition and open it
 ```sh
 cryptsetup luksFormat <system partition>
 cryptsetup open <system partition> cryptlvm
 ```
 ### TRIM and Workqueues for SSD Drives
 You can [skip this section](#prepare-lvm) if you are not using a SSD (Solid State Drive).
 You might want to configure TRIM support and disable workqueues to improve performance of SSD Drives.
 > Warning: Enabling TRIM support on an encrypted drive has potential security implications. See [TRIM support for solid
 > state drives][arch-wiki-trim-support]. If this is an issue, you might want to [skip this section](#prepare-lvm).
 Verify your SSD supports TRIM:
 ```sh
 lsblk --discard
 ```
 Enable TRIM support:
 ```sh
 cryptsetup --allow-discards --persistent refresh cryptlvm
 ```
 Drive operation workqueues make sense for slow spinning disks. For SSDs, they usually introduce unnecessary delays.
 Disabling workqueues can double the speed of file operations on SSDs. Disable the workqueues with the following command.
 ```sh
 cryptsetup --perf-no_read_workqueue --perf-no_write_workqueue --persistent refresh cryptlvm
 ```
 ### Preparing the Logical Volumes {#prepare-lvm}
 Inside the encrypted system partition, create the logical volumes.
 ```sh
 pvcreate /dev/mapper/cryptlvm
 vgcreate vgsys /dev/mapper/cryptlvm
 lvcreate -L <swap size> vgsys -n lvswap
 lvcreate -L 64G vgsys -n lvroot
 lvcreate -L 64G vgsys -n lvhome
 lvcreate -L 64G vgsys -n lvopt
 lvcreate -L 64G vgsys -n lvvar
 ```
 > Tip: The SWAP partition can be of any size. You could even go without one if you have enought RAM. The [Arch
 > Wiki][arch-wiki] recommends at least 4GB. If you want to be able to use hibernation, I would recommend two times of
 > your physical RAM size
 >
 > The (estimated) minimum SWAP space (in bytes) for successful hibernation can be found by looking at
 > `cat /sys/power/image_size`. It is usually around 2/5 of the physical RAM.
 ### Create the File Systems
 Create the file system on the EFI partition, the logical volumes, and the SWAP.
 ```sh
 mkfs.fat -F 32 -n EFI <efi partition>
 mkfs.ext4 -L root /dev/vgsys/lvroot
 mkfs.ext4 -L home /dev/vgsys/lvhome
 mkfs.ext4 -L opt /dev/vgsys/lvopt
 mkfs.ext4 -L var /dev/vgsys/lvvar
 mkswap /dev/vgsys/lvswap
 ```
 ### Mount the File Systems
 Mount the created file systems
 ```sh
 swapon /dev/vgsys/lvswap
 mount /dev/vgsys/lvroot /mnt
 mount --mkdir /dev/vgsys/lvhome /mnt/home
 mount --mkdir /dev/vgsys/lvopt /mnt/opt
 mount --mkdir /dev/vgsys/lvvar /mnt/var
 mount --mkdir <efi partition> /mnt/efi
 ```
 ## Install Packages
 Packages are installed from mirror servers, which are defined in `/etc/pacman.d/mirrorlist`. On the ISO, after
 connecting to the internet, `reflector` updates the mirror list by choosing the 20 most recently synchronized HTTPS
 mirrors, sorting them by download speed.
 The higher a mirror is placed in the mirror list, the more priority it is given when downloading a packge. You might
 want to inspect the mirror list to see if it is satisfactory. If it is not, edit the file accordingly or run `reflector`
 to create a new mirror list specifying custom sorting parameters.
 The file `/etc/pacman.d/mirrorlist` of the live ISO image is the only configuration file that will be copied from the
 live ISO to the operating system that is being installed. So investing some time now and getting the mirror list right
 is worth the effort now.
 .example {Reflector Configuration}
    The following command will instruct reflector to select the 10 most up to date https mirrors from Germany, Austria,
    Switzerland, and Netherlands - then sort them by most recently updated.
    ```sh
    reflector \
    --country Germany,Austria,Switzerland,Netherlands \
    --protocol https \
    --latest 10 \
    --sort age \
    --save /etc/pacman.d/mirrorlist
    ```
 Install the essential packages to the system
 > Tip: This list already contains some essential software that is strictly not needed for a minimal system install.
 > If you want to go more minimal, check the Arch Wiki for the minimal set of packages required.
 ```sh
 pacstrap -K /mnt base linux linux-firmware \
 exfatprogs e2fsprogs lvm2 \
 neovim git base-devel man-db man-pages texinfo \
 terminus-font intel-ucode efibootmgr sbctl openssh wget
 ```
 > Important: On AMD CPU based systems, replace `intel-ucode` with `amd-ucode`.
 [arch-wiki]: https://wiki.archlinux.org/
 [arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide
 [arch-wiki-iwctl]: https://wiki.archlinux.org/title/Iwd#iwctl
 [arch-wiki-nmcli]: https://wiki.archlinux.org/title/Mmcli
 [arch-wiki-network-configuration]: https://wiki.archlinux.org/title/Network_configuration
 [arch-wiki-lvm-on-luks]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS
 [arch-wiki-trim-support]: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)
@@ -0,0 +1,483 @@
 .docname {System Configuration}
 .include {docs}
 Configure the system for initial boot.
 ## File System Table
 Generate the file system table.
 ```sh
 genfstab -U /mnt >> /mnt/efc/fstab
 ```
 Check the table that was generated in `/mnt/etc/fstab`.
 ## Change Root
 Change root into the new system
 ```sh
 arch-chroot /mnt
 ```
 > Tip: From this point onwards you will only be able to access programs that we previously installed using the
 > `pacstrap` command. So for editing text files, you will need to use `neovim` with the `nvim` command instead of `vim`.
 > You can install additional programs with `pacman -S <package name>` at any time if you need more tools.
 ## Time Zone
 Configure the correct time zone.
 ```sh
 ln -sf /usr/sahre/zoneinfo/<Region>/<City> /etc/localtime
 ```
 .example {Europe/Berlin}
    ```sh
    ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
    ```
 Then update the system clock with `hwclock --systohc`.
 ## Localization
 Edit the file `/etc/locale.gen` and uncomment all needed locales. Generate the locales afterwards by running
 `locale-gen`.
 .example {Installed Localizations}
    I usually enable the following locales onmy systems:
    - `de_DE.UTF-8 UTF-8`
    - `de_DE ISO-8859-1`
    - `de_DE@euro ISO-8859-15`
    - `en_GB.UTF-8 UTF-8`
    - `en_GB ISO-8859-1`
    - `en_US.UTF-8 UTF-8`
    - `en_US ISO-8859-1`
 Create the file `/etc/locale.conf` and set the `LANG` variable as well as other environment variables accordingly. The
 settings depend on you rlocation and your personal preference
 .example {Localization}
    ```ini
    LANG=en_GB.UTF-8
    LANGUAGE=en_GB.UTF-8
    LC_CTYPE=en_GB.UTF-8
    LC_NUMERIC=en_GB.UTF-8
    LC_TIME=en_GB.UTF-8
    LC_COLLATE=en_GB.UTF-8
    LC_MONETARY=de_DE.UTF-8
    LC_MESSAGES=en_GB.UTF-8
    LC_PAPER=de_DE.UTF-8
    LC_NAME=de_DE.UTF-8
    LC_ADDRESS=de_DE.UTF-8
    LC_TELEPHONE=de_DE.UTF-8
    LC_MEASUREMENT=de_DE.UTF-8
    LC_IDENTIFICATION=de_DE.UTF-8
    ```
 Persist the settings of console keyboard layout and font. Create the file `/etc/vconsole.conf`:
 ```sh
 FONT=eurlatgr
 KEYMAP=de-latin1-nodeadkeys
 ```
 ## Network Configuration
 ### Hostname
 Set a hostname in `/etc/hostname`
 > Tip: For advice on choosing a hostname, see [RFC 1178][rfc-1178]. As explained in [hostname(7)][hostname-7], it must
 > contain from 1 to 63 characters, using only lowercase `a` to `z`, `0` to `9`, and `-`, and must not start with `-`.
 Install Network Manager to the network interfaces of the system
 ```sh
 pacman -S networkmanager nm-connection-editor network-manager-applet
 ```
 Then enable the systemd services for Network Manager
 ```sh
 systemctl enable NetworkManager
 systemctl enable systemd-resolved
 systemctl enable systemd-timesyncd
 ```
 Create the file `/etc/NetworkManager/conf.d/20-connectivity.conf` with the following content
 ```ini
 [connectivity]
 uri=https://zechert.net/connectivity_check.txt
 ```
 Create the file `/etc/NetworkManager/conf.d/10-dns.conf` with the following content
 ```ini
 [main]
 dns=systemd-resolved
 ```
 ### Use Advertised NTP Servers
 To use the NTP Servers advertised by the DHCP Server, create a new network manager dispatcher script in
 `/etc/NetworkManager/dispatcher.d/10-update-timesyncd` with the following content
 ```sh
 #!/bin/sh
 [ -z "$CONNECTION_UUID" ] && exit 0
 INTERFACE="$1"
 ACTION="$2"
 case $ACTION in
 up | dhcp4-change | dhcp6-change)
    [ -n "$DHCP4_NTP_SERVERS" ] || exit 0
    mkdir -p /etc/systemd/timesyncd.conf.d
    cat <<-THE_END >"/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
        [Time]
        NTP=$DHCP4_NTP_SERVERS
    THE_END
    systemctl restart systemd-timesyncd.service
    ;;
 down)
    rm -f "/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
    systemctl restart systemd-timesyncd.service
    ;;
 esac
 ```
 Make the script executable with `chmod +x /etc/NetworkManager/dispatcher.d/10-update-timesyncd`.
 Create the following file `/etc/systemd/system/networkdown.service`:
 ```ini
 [Unit]
 Wants=network-online.target
 After=network.target network-online.target
 [Service]
 Type=oneshot
 ExecStart=/bin/true
 ExecStop=/bin/sh -c 'rm -f /etc/systemd/timesyncd.conf.d/ntp-*.conf'
 RemainAfterExit=yes
 [Install]
 WantedBy=suspend.target
 ```
 Enable the service with `systemctl enable networkdown`.
 ### Configure MAC Address Randomization
 MAC randomization can be used for increased privacy by not disclosing the real MAC address to the network.
 Create the file `/etc/NetworkManager/conf.d/10-random-mac.conf` with the following content:
 ```ini
 [device]
 wifi.scan-rand-mac-address=yes
 [device-mac-randomization]
 wifi.scan-rand-mac-address=yes
 [connection-mac-randomization]
 ethernet.cloned-mac-address=stable
 wifi.cloned-mac-address=stable
 ```
 ### Enable IPv6 Privacy Extensions
 Create the file `/etc/NetworkManager/conf.d/10-ipv6-privacy.conf` with the following content:
 ```ini
 [connection]
 ipv6.ip6-privacy=2
 ```
 Create the file `/etc/sysctl.d/40-ipv6.conf` with the following content:
 ```ini
 net.ipv6.conf.all.use_tempaddr=2
 net.ipv6.conf.default.use_tempaddr=2
 ```
 ### Configure a unique DUID per connection
 NetworkManager uses DUID-UUID from `/etc/machin-id` for all DHCPv6 connections. This might be a security breach.
 Instead, configure NetworkManager to create unique DUIDs for each connection.
 Create the file `/etc/NetworkManager/conf.d/02-duid.conf` with the following content
 ```ini
 [connection]
 ipv6.dhcp-duid=stable-uuid
 ```
 ### Enable DNSSEC
 Create the file `/etc/systemd/resolved.conf.d/30-dnssec.conf` with the following content
 ```ini
 [Resolve]
 DNSSEC=true
 ```
 > Warning: This will break name resolution for all hostnames that do not offer DNSSEC or that are resolved by
 > nameservers that do not support DNSSEC. This can break resolution to internal hostnames (e.g. Company Intranet) as
 > well es some public sites.
 ### Disable mDNS
 Create the file `/etc/NetworkManager/conf.d/30-mdns.conf` with the following content
 ```ini
 [connection]
 connection.mdns=0
 ```
 Create the file `/etc/systemd/resolved.conf.d/30-mdns.conf` with the following content
 ```ini
 [Resolve]
 MulticastDNS=no
 ```
 > Warning: Disabling mDNS will break nameserver-less resolution of local hostnames from the same network (DNS via
 > multicast DNS Queries). This can break auto-discovery and access to other local machines like local printers, sambda
 > network drives, other devices, etc.
 >
 > Change this to `connection.mdns=1` to fully enable mDNS, `connection.mdns=2` to enable resolution but not announcement
 > of your own machine to the network. For both of these oiptions, set `MulticastDNS=yes` to enable the functionality in
 > systemd-resolved (or delete the file).
 ### Disabled LLMNR
 Create the file `/etc/NetworkManager/conf.d/30-llmnr.conf` with the following content
 ```ini
 [connection]
 connection.llmnr=0
 ```
 Create the file `/etc/systemd/resolved.conf.d/30-llmnr.conf` with the following content
 ```ini
 [Resolve]
 LLMNR=no
 ```
 ## Mkinitcpio Configuration
 Edit the file `/etc/mkinitcpio.conf` and add the necessary hooks for the system.
 Add the hooks `systemd`, `keyboard`, `sd-vconsole`, `sd-encrypt` to the list of hooks as follows:
 ```ini
 HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck resume)
 ```
 ## Set Kernel Command Line
 Create the file `/etc/cmdline.d/01-cryptlvm.conf` with the following content
 ```ini
 rd.luks.name=<UUID of encrypted partition>=cryptlvm
 ```
 The UUID can be found with the command `ls -all /dev/disk/by-uuid`.
 It can be conveniently copied into the `01-cryptlvm.conf` file with the command
 ```sh
 ls -all /dev/disk/by-uuid | grep "<encrypted partition>" | awk '{print $9}' >> /etc/cmdline.d/01-cryptlvm.conf
 ```
 Create the file `/etc/cmdline.d/02-root.conf` with the following content
 ```ini
 root=/dev/vgsys/lvroot
 ```
 Create the file `/etc/cmdline.d/03-resume.conf` with the following content
 ```ini
 resume=/dev/vgsys/lvswap
 ```
 ## Enable Unified Kernel Image Booting
 UKI creates a single executable that can be directly booted from the UEFI firmware without any bootloader.
 Modify the file `/etc/mkinitcpio.d/linux.preset`.
 - Un-comment (i.e. remove `#`) the `PRESET_uki=` parameter for each item in `PRESETS=`
 - Comment out (i.e. add `#`) `PRESET_image=` to avoid storing a redundant `initramfs-*.img` file
 Create the directory `/efi/EFI/Linux`, then create the initcpio `mkinitcpio -P`.
 Make sure that the generation succeeded and two files have been created (`ls /efi/EFI/Linux`), called
 `arch-linux-fallback.efi` and `arch-linux.efi` (the fallback image might be missing if it is not enabled in the PRESETS).
 ## Create Boot Menu Entries
 With `efibootmgr` check for existing EFI Boot Menu Entries, remove them if required, and create new entries for
 Arch Linux.
 - List all entries `efibootmgr`
 - Automatically remove duplicate entries `efibootmgr -D`
 - Remove a specific boot entry `efibootmgr -b XXXX -B`
 - Change the order of boot entries with `efibootmgr -o XXXX,YYYY,ZZZZ`
 Create the following two new entries
 ```sh
 efibootmgr --create \
 --disk <efi partition> \
 --loader=/EFI/Linux/arch-linux.efi \
 --label "Arch Linux" \
 --verbose
 efibootmgr --create \
 --disk <efi partition> \
 --loader=/EFI/Linux/arch-linux-fallback.efi \
 --label "Arch Linux Fallback" \
 --verbose
 ```
 ## Enable Secureboot
 Unfortunately the UEFI kernel image is not stored on an encrypted disk, and cannot be. Since the EFI firmware needs to
 be able to access the image to boot the system. Therefore, the system is at risk by an attacker that can manipulate the
 kernel image and boot partition. As a remedy to this problem, we will enable secure boot. The boot loader file will be
 cryptographically signed by a secret key that is stored on our encrypted partition.
 We will use the tool `sbctl` for a user friendly way to configure secure boot.
 First, check the current status with `sbctl status`. You should see that sbctl is not installed, and that secure boot
 setup mode is enabled.
 Creeate new keys: `sbctl create-keys`. Then enroll the new keys with `sbctl enroll-keys -m`.
 > Warning: The parameter `-m` in the command `sbctl enroll-keys -m` will enroll your own keys alongside with the default
 > microsoft keys. The microsoft keys might be required by any option roms or some firmware in the system. You can omit
 > the option `-m` to only enroll your own keys without Microsoft's. But you might create a system that can no longer
 > boot! Only do this if you know the risk and know what you are doing. If you want to do this, replace `-m` by
 > `--yes-this-might-brick-my-machine`.
 ## Signing EFI Images
 `sbctl` comes with the necessary hooks pre-installed to automatically sign images when needed. Since we have created new
 and fresh keys, we need to trigger this now manually once. Run `mkinitcpio -P` to recreate images and trigger `sbctl`
 into signing the new images.
 ## Create a User Account
 Set the password for the user `root`, then create a normal user account.
 Modify the sudoers file, so that the group sudo has access to the `sudo` command.
 ```sh
 passwd root
 groupadd -r sudo
 EDITOR=nvim visudo
 useradd -c "<full user name"> -m -s /bin/bash <username>
 usermod -aG adm,log,rfkill,sys,wheel,sudo,video,input <username>
 chfn <username>
 passwd <username>
 ```
 Confirm the new user can successfully use `sudo` to elevate permission.
 1. Switch to the created user account `su - <username>`. (.keybinding {ctrl+d} can be used to exit the user account and
   go back to root)
 2. Enter `sudo whoami`, check if sudo works. The output should be `root`
 3. Exit the user account with .keybinding {ctrl+d} or `exit`.
 For increased security, disable login as root with `passwd --lock root`.
 ## Configure Pacman and Yay
 Switch to the user account you just created with `su - <username>`.
 Run the following commands to install `yay`, a AUR package helper.
 ```sh
 cd ~
 sudo pacman -S git base-devel go
 git clone https://aur.archlinux.org/yay.git
 cd yay
 makepkg -si
 yay -S yay
 cd ~
 rm -rf yay
 exit
 ```
 Change the configuration of pacman in `/etc/pacman.conf`. Enable the options you want to set, e.g. `Color`,
 `VerbosePkgList`, `ParallelDownloads`.
 Then install the package `pacman -S pacman-contrib` and enable the service `systemctl enable paccache.timer`.
 ## Enable TRIM
 For SSDs only, enable periodic trim.
 ```sh
 systemctl enable fstrim.timer
 ```
 > Warning: Enabling TRIM can leak some information about the encrypted system, e.g. presence of encrypted file systems,
 > or even file system types. If this is a concern to you, or you want to achieve plausable deniability, do not enable
 > TRIM on your system.
 ## Recurring Automatic Mirror Selection
 Install reflector with `pacman -S reflector`
 Edit the options in `/etc/xdg/reflector/reflector.conf`. Then enable the timer service `systemctl enable reflector`.
 ## Reboot the System
 Reboot the system into the installed Arch Linux.
 ```sh
 # exit chroot environment with
 exit
 # unmount all partitions
 umount -R /mnt
 # reboot
 reboot
 ```
 Remove your installation media.
 ## Activate systemd-resolved Stub Resolver
 After the system rebooted, make sure to set the following symlink!
 ```sh
 sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 ```
 ## Connect to the network
 Use `nmtui` to connect to a wireless network, if required.
 ## Create a New Keypair
 Create a new ssh keyapair. Alternatively copy an existing one.
 ```sh
 ssh-keygen -t ed25519 -C "$(whoami)@$(uname -n)-$(date -I)"
 ```
 ## Update the System#
 Run a full system upgrade with `pacman -Syu`.
 [rfc-1178]: https://tools.ietf.org/html/rfc1178
 [hostname-7]: https://man.archlinux.org/man/hostname.7
@@ -0,0 +1,125 @@
 .docname {Graphical Environment}
 .include {docs}
 The steps necessary to install graphics drivers are very dependent on your device. This guide details the settings I use
 for my own hardware.
 For general instructions, consult the [Arch Linux Wiki: Graphics][arch-wiki-graphics].
 ## Intel Graphics i915 / xe / Arc
 Since Intel provides and supports open source drivers, Intel graphics are essentially plug-and-play. This guide details
 some customized and improved settings, based on my personal preferences.
 ### Installation
 Install (`sudo pacman -S ...`) the following packages
 - `mesa`: open source OpenGL implementation for most modern drivers, including intel i915 3rd gen hardware
 - `mesa-utils`: Utilities for `mesa`
 - `vulkan-intal`: Vulkan support for intel hardware
 - `vulkan-tools`: Vulkan utilities
 - `intel-media-driver`: for VA-API support
 - `libva-utils`: Utilities for VA-API
 - `vdpauinfo`: Utilities for VDPAU
 - `nvtop` Utility to show graphics card usage
 Then reboot the computer.
 ### Enable GuC / HuC Firmware Loading
 Depending on the hardware support, GuC and HuC should be en abled by default. You can check this by running the
 following commands
 ```sh
 cat /sys/kernel/debug/dri/0/gt0/uc/guc_info
 cat /sys/kernel/debug/dri/0/gt0/uc/huc_info
 ```
 > Tip: `0` might need to be replaced by a different number in the commands above. The files will only exist if GuC /
 > HuC are enabled during boot. A reboot might be required if you cannot see them, or GuC / HuC is disabled in the
 > system.
 If GuC / HuC is disabled, you can manually enable it. Create the file `/etc/modprobe.d/i915.conf`
 ```txt
 option i915 enable_guc=2
 ```
 Possible options:
 - `1`: Enable GuC but not HuC
 - `2`: Enable Huc, but not GuC
 - `3`: Enable HuC and GuC
 .example {Dell XPS 13 9370 (2018)}
    Supported option is `option i915 enable_guc=2`
 .example {DELL XPS 13 9350 (2024)}
    The xe driver is still experimental. Once it becomes mainline, GuC/HuC will be enabled by default.
 Then regenerate and sign the initramfs with `mkinictpio -P`
 > Warning: Manually enabling GuC or HuC firmware loading taints the kernel even when the feature is not supported.
 > Moreover, enabling Guc / HuC firmware loading can cause issues on some systems; disable it if you experience freezing
 > (for example, after resuming from hibernation).
 ### Intel ARC
 Intel ARC GPUs support hardware raytracing support through onboard TSUs. Current performance is mixed.
 For intel ARC, `linux-firmware-intel` should be installed on the system. It likely is from the base install already.
 ## AMD Graphics
 AMD releases their drivers as open source. There are also closed source drivers available for special usecases. This
 guide will only focus on the open source drivers.
 Install (`sudo pacman -S ...`) the following packages
 - `mesa` modern OpenGL drivers for most hardware
 - `mesa-utils` utility programs for mesa
 - `vulkan-radeon` vulkan support
 - `vulkan-tools` utility programs for vulkan
 - `libva-mesa-driver` to support accelerated video decoding using VA-API
 - `libva-utils` utility programs for VA-API
 - `mesa-vdpau` support for VDPAU
 - `vdpauinfo` utility programs for VDPAU
 - `nvtop` to monitor temparature, clock speed, and usage of the graphics card
 Then reboot the system.
 ## Reboot
 Do not forget to reboot the system after changes to the graphics drivers have been made.
 ## Install Hyprland
 To install Hyprland, install the following packages that will include some necessary utilities for the system
 ```sh
 yay -S --needed \
 hyprland hyprpaper hypridle hyprlock waybar wofi kitty nemo gvfs gvfs-mtp gvfs-smb \
 xdg-desktop-portal xdg-desktop-portal-hyprland xdg-desktop-portal-gtk xdg-utils \
 wl-clipboard grim slurp swaync network-manager-applet polkit polkit-gnome chezmoi \
 wev btop qt5-wayland qt6-wayland qt5ct qt6ct gtk-engine-murrine \
 colloid-catppuccin-gtk-theme papirus-icon-theme breeze-icons \
 pipewire pipewire-audio pipewire-alsa pipewire-pulse pipewire-jack wireplumber \
 pavucontrol alsa-utils \
 ttf-bitstream-vera ttf-croscore ttf-dejavu ttf-droid gnu-free-fonts ttf-libreation \
 ttf-libertinus otf-libertinus noto-fonts ttf-roboto ttf-ubuntu-font-family \
 ttf-anonymous-pro ttf-cascadia-code ttf-fira-mono otf-fira-mono inter-font \
 ttf-ms-fonts ttf-vista-fonts ttf-roboto-mono-nerd ttf-firacode-nerd \
 otf-firamono-nerd otf-font-awesome \
 noto-fonts-emoji noto-fonts-cjk noto-fonts-extra ttf-jetbrains-mono \
 ttf-jetbrains-mono-nerd \
 firefox librewolf-bin thunderbird \
 git make gcc curl ripgrep fzf jq tar unzip inotify-tools socat brightnessctl \
 xdg-user-dirs fastfetch figlet openssh tmux man-db man-pages usbutils pciutils \
 uwsm libnewt
 ```
 You can now start hyprland with `uwsm start hyprland.desktop`.
 [arch-wiki-graphics]: https://wiki.archlinux.org/title/Category:Graphics