fz-stack/doc
1
0
Fork 0
Code Pull Requests Actions Activity

add documentation for arch installation

Browse Source
This commit is contained in:
Frank Zechert
2026-07-23 02:28:59 +02:00
parent 5822020b89
commit e0fad8e6ed
9 changed files with 973 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -0,0 +1 @@
quarkdown-output
_nav.qd
+7 -2
View File
@@ -1,5 +1,10 @@
###! System Installation
- [Download Arch Linux](system-installation/001-download-arch-linux.md)
- [Basic System Installation](system-installation/002-basic-system-installation.md)
- [Download Arch Linux](system-installation/001-download-arch-linux.qd)
- [Basic System Installation](system-installation/002-basic-system-installation.qd)
- [System Configuration](system-installation/003-system-configuration.qd)
- [Graphical Environment](system-installation/004-graphical-environment.qd)
###! Hardware Configuration
- [Thunderbolt](hardware/001-thunderbolt.qd)
hardware/001-thunderbolt.qd
+32
View File
@@ -0,0 +1,32 @@
.docname {Thunderbolt}
.include {docs}
To connect a laptop with a thunderbolt docking station and use all its features, the thunderbolt docking station must be
added as a trusted devoce. Without this, only basic features can be used.
Install the tool bolt: `sudo pacman -S bolt`
Then list all available devices with `boltctl list`.
## Temporarily Authorizing Devices
A device can be authorized with `boltctl authorize <device id>`
.example {Example}
```sh
boldctl authorize 000b400c-2177-d400-ffff-ffffffffffff
```
## Permanently Authorizing Devices
Above command is only a temporary authorization and will be lost upon reboot. To permanently authorize a device,
it should be enrolled.
Use the `boltctl enroll <device id>` command to permanently enroll a device.
.example {Example}
```sh
boltctl enroll 000b400c-2177-d400-ffff-ffffffffffff
```
main.qd
+2
View File
@@ -39,6 +39,8 @@ A system deployed with fz-stack **will not**:
>
> .emoji {warning} Incorrectly executed commands can cause irreversible data loss.
## Todos
[arch-linux]: https://archlinux.org
[arch-linux-wiki]: https://wiki.archlinux.org/title/Main_page
[hyprland]: https://hypr.land
system-installation/001-download-arch-linux.md → system-installation/001-download-arch-linux.qd
View File
system-installation/002-basic-system-installation.md
-71
View File
@@ -1,71 +0,0 @@
.docname {Basic System Installation}
.include {docs}
This page explains the basic setup of Arch Linux. It was last updated July 2026.
> Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install],
> as the instructions on this page might be outdated or no longer complete.
> Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more.
> Make sure to understand all commands before you execute them. You will lose data!
> Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with.
>
> Create a backup of all important data that you do not want to lose before you continue with the installation of
> Arch Linux!
## Preparation
To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so.
For example:
- Disable Secure Boot
- Delete existing Boot Sequences or Boot Entries
- Enable USB Boot Support
- Enabled External USB Ports
.box {DELL XPS 13 9370} type:{note}
In the UEFI settings:
- Enable the support to boot from USB devices:
`System Configuration` -> `USB Configuration` -> `Enable USB Boot Support`
- Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal`
Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows
the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid
keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images.
In the UEFI settings:
- enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable`
- set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode`
- enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode`
To access the boot menu or UEFI, press
- .keybinding {F2} to access UEFI settings
- .keybinding {F12} to access one-time boot menu
## Setting Keyboard Layout and Console Font
List available console key maps with `localectl list-keymaps`, then set the desired key map with
`loadkeys <key map>`.
Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont <font>`.
.example
```sh
loadkeys de-latin1
setfont eurlatgr
```
> Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before
> the installation is finished and before the settings are persisted, repeat these commands after each boot.
> Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or
> `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option,
> e.g. `setfont ter-118n -m 88591`.
## Verify Boot Mode
[arch-wiki]: https://wiki.archlinux.org/
[arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide
system-installation/002-basic-system-installation.qd
+323
View File
@@ -0,0 +1,323 @@
.docname {Basic System Installation}
.include {docs}
This page explains the basic setup of Arch Linux. It was last updated July 2026.
> Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install],
> as the instructions on this page might be outdated or no longer complete.
> Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more.
> Make sure to understand all commands before you execute them. You will lose data!
> Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with.
>
> Create a backup of all important data that you do not want to lose before you continue with the installation of
> Arch Linux!
## Preparation
To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so.
For example:
- Disable Secure Boot
- Delete existing Boot Sequences or Boot Entries
- Enable USB Boot Support
- Enabled External USB Ports
.box {DELL XPS 13 9370 (2018)} type:{note}
To access the boot menu or UEFI, press
- .keybinding {F2} to access UEFI settings
- .keybinding {F12} to access one-time boot menu
In the UEFI settings:
- Enable the support to boot from USB devices:
`System Configuration` -> `USB Configuration` -> `Enable USB Boot Support`
- Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal`
Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows
the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid
keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images.
In the UEFI settings:
- enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable`
- set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode`
- enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode`
.box {DELL XPS 13 9350 (2024)} type:{note}
To access the boot menu or UEFI, press
- .keybinding {F2} to access UEFI settings
- .keybinding {F12} to access one-time boot menu
In the UEFI Settings:
- Enable the support to boot from USB devices:
enable `Integrated Devices` -> `USB/Thunderbolt Configuration` -> `Enable USB Boot Support`
Secure Boot should be configured to not use any Microsoft UEFI CA keys and should be prepared for enrollment
of a custom certificate
In the UEFI Settings:
- enable `Boot Configuration` -> `Secure Boot` -> `Enable Secure Boot`
- disable `Boot Configuration` -> `Secure Boot` -> `Enable Microsoft UEFI CA`
- set `Boot Configuration` -> `Secure Boot` -> `Secure Boot Mode` to ` Auto Mode`
- enable `Boot Configuration` -> `Expert Key Management` -> `Enable Custom Mode`
## Setting Keyboard Layout and Console Font
List available console key maps with `localectl list-keymaps`, then set the desired key map with
`loadkeys <key map>`.
Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont <font>`.
.example
Commonly, I set my systems to
```sh
loadkeys de-latin1-nodeadkeys
setfont eurlatgr
```
> Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before
> the installation is finished and before the settings are persisted, repeat these commands after each boot.
> Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or
> `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option,
> e.g. `setfont ter-118n -m 88591`.
## Verify Boot Mode
Verify that the system is booted in UEFI mode.
```sh
cat /sys/firmware/efi/fw_platform_size
```
This command should return `64`. If the command returns `32`, the system is booted in EUFI mode and has a 32-bit IA32
UEFI. While this is supported by Arch Linux, it is not part of this guide.
If the file does not exist, the system may be booted in BIOS or CSM mode. In this case, disable CMS Mode and restart
the computer
> Important: This guide does not work on systems in BIOS mode, or with IA32 UEFI!
## Connect to the Internet
Make sure that the computer is connected to the internet by running the following commands:
```sh
ip link # check interface link status
ip a # check for valid IP address assignment
```
For a quick test, you can try to ping the arch linux website
```sh
ping -c3 archlinux.org
```
If you are not yet automatically connected, follow one of these steps, depending on the connection type you want
to set up.
1. For wireless lan (WiFi) and WWAN , make sure the wireless network card is not blocked by `rfkill`, check
```sh
rfkill
list
```
2. Connect to the network:
- **Ethernet:** Plug in your cable.
- **Wi-Fi:** Authenticate to the wirless network using [`iwctl`][arch-wiki-iwctl].
- **Mobile Broadband Modem:** connecto the mobile network with the [`nmcli`][arch-wiki-nmcli] utility.
3. Configure the network connection:
- **DHCP**: dynamic IP address and DNS server assignment should work out of the box.
- **Static IP Address**: See [Network Configuration][arch-wiki-network-configuration]
## Update the System Clock
Once a network connection is established, the system clock should be updated automatically. Check the correct date and
time has been acquired by running `timedatectl`.
## Partition the Disks
Get an overview of available disks with `lsblk` and / or `fdisk -l`. Make sure to identify the drives you want to
install Arch Linux to.
This guide sets up two partitions. The first partition is the EFI system partition. It will be used to boot from a
unified kernel image. The second partition will be a LUKS encrypted partition. Inside of it will be a LVM2 container
with SWAP, system, and data partitions as you see fit. The unencrypted EFI partition is required for the system to boot.
> Note: Even though we use LVM2 inside of the LUKS encrypted partition, this setup does not allow for the LVM2 volume
> group to span multiple disks. This is a limitation of this setup. If this limitation is unacceptabnle for you, check
> [LVM on LUKS in the Arch Wiki][arch-wiki-lvm-on-luks] for workarounds or different partition layouts you can use.
> Important: The following steps will repartition and format the disks you specify in the commands. Double-check all
> drive paths in all commands before continuing. Specifying the wrong drive paths **will erase data** from drives that
> you did not intend to erase, and that will be **unrecovarbly** lost!
### Transitioning from a Previously Unencrypted System
Repartitioning the drives and switching to a new encrypted disk will not mask any of your previously unencrypted data.
The unencrypted data might still be recoverable by data recovery or data forensic tools. If you want to make sure that
data previously stored on the disk is un-recoverable, you need to overwrite all of the disk with random data.
Depending on your disk size and write speed, this can take hours.
If your disk was already encrypted previously, or you do not consider this necessary, you can [skip to the next
section](#create-partitions).
Overwriting your disk with data can be achieved by the following commands
```sh
cryptsetup open -q --type plain -d /dev/urandom <drive path> to_be_wiped
dd bs=4M if=/dev/zero of=/dev/mapper/to_be_wiped conv=fsync oflag=direct status=progress
cryptsetup close to_be_wiped
```
### Create Partitions {#create-partitions}
Create a 1GB EFI partition as the first partition. Use the rest of the disk for the encrypted LUKS partition.
To format the disk, use `fdisk <drive path>`. Helpful commands:
- `m` to show help
- `g` to create a new GPT partition table
- `n` to create a new partition
- `t` to change the type of a partition
- The EFI partition should be type `1: EFI System`
- The LUKS partition should be type `43: Linuzx RAID`
- `w` to write the changes and quit
### Encrypt the System Partition
Create a LUKS encrypted system partition and open it
```sh
cryptsetup luksFormat <system partition>
cryptsetup open <system partition> cryptlvm
```
### TRIM and Workqueues for SSD Drives
You can [skip this section](#prepare-lvm) if you are not using a SSD (Solid State Drive).
You might want to configure TRIM support and disable workqueues to improve performance of SSD Drives.
> Warning: Enabling TRIM support on an encrypted drive has potential security implications. See [TRIM support for solid
> state drives][arch-wiki-trim-support]. If this is an issue, you might want to [skip this section](#prepare-lvm).
Verify your SSD supports TRIM:
```sh
lsblk --discard
```
Enable TRIM support:
```sh
cryptsetup --allow-discards --persistent refresh cryptlvm
```
Drive operation workqueues make sense for slow spinning disks. For SSDs, they usually introduce unnecessary delays.
Disabling workqueues can double the speed of file operations on SSDs. Disable the workqueues with the following command.
```sh
cryptsetup --perf-no_read_workqueue --perf-no_write_workqueue --persistent refresh cryptlvm
```
### Preparing the Logical Volumes {#prepare-lvm}
Inside the encrypted system partition, create the logical volumes.
```sh
pvcreate /dev/mapper/cryptlvm
vgcreate vgsys /dev/mapper/cryptlvm
lvcreate -L <swap size> vgsys -n lvswap
lvcreate -L 64G vgsys -n lvroot
lvcreate -L 64G vgsys -n lvhome
lvcreate -L 64G vgsys -n lvopt
lvcreate -L 64G vgsys -n lvvar
```
> Tip: The SWAP partition can be of any size. You could even go without one if you have enought RAM. The [Arch
> Wiki][arch-wiki] recommends at least 4GB. If you want to be able to use hibernation, I would recommend two times of
> your physical RAM size
>
> The (estimated) minimum SWAP space (in bytes) for successful hibernation can be found by looking at
> `cat /sys/power/image_size`. It is usually around 2/5 of the physical RAM.
### Create the File Systems
Create the file system on the EFI partition, the logical volumes, and the SWAP.
```sh
mkfs.fat -F 32 -n EFI <efi partition>
mkfs.ext4 -L root /dev/vgsys/lvroot
mkfs.ext4 -L home /dev/vgsys/lvhome
mkfs.ext4 -L opt /dev/vgsys/lvopt
mkfs.ext4 -L var /dev/vgsys/lvvar
mkswap /dev/vgsys/lvswap
```
### Mount the File Systems
Mount the created file systems
```sh
swapon /dev/vgsys/lvswap
mount /dev/vgsys/lvroot /mnt
mount --mkdir /dev/vgsys/lvhome /mnt/home
mount --mkdir /dev/vgsys/lvopt /mnt/opt
mount --mkdir /dev/vgsys/lvvar /mnt/var
mount --mkdir <efi partition> /mnt/efi
```
## Install Packages
Packages are installed from mirror servers, which are defined in `/etc/pacman.d/mirrorlist`. On the ISO, after
connecting to the internet, `reflector` updates the mirror list by choosing the 20 most recently synchronized HTTPS
mirrors, sorting them by download speed.
The higher a mirror is placed in the mirror list, the more priority it is given when downloading a packge. You might
want to inspect the mirror list to see if it is satisfactory. If it is not, edit the file accordingly or run `reflector`
to create a new mirror list specifying custom sorting parameters.
The file `/etc/pacman.d/mirrorlist` of the live ISO image is the only configuration file that will be copied from the
live ISO to the operating system that is being installed. So investing some time now and getting the mirror list right
is worth the effort now.
.example {Reflector Configuration}
The following command will instruct reflector to select the 10 most up to date https mirrors from Germany, Austria,
Switzerland, and Netherlands - then sort them by most recently updated.
```sh
reflector \
--country Germany,Austria,Switzerland,Netherlands \
--protocol https \
--latest 10 \
--sort age \
--save /etc/pacman.d/mirrorlist
```
Install the essential packages to the system
> Tip: This list already contains some essential software that is strictly not needed for a minimal system install.
> If you want to go more minimal, check the Arch Wiki for the minimal set of packages required.
```sh
pacstrap -K /mnt base linux linux-firmware \
exfatprogs e2fsprogs lvm2 \
neovim git base-devel man-db man-pages texinfo \
terminus-font intel-ucode efibootmgr sbctl openssh wget
```
> Important: On AMD CPU based systems, replace `intel-ucode` with `amd-ucode`.
[arch-wiki]: https://wiki.archlinux.org/
[arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide
[arch-wiki-iwctl]: https://wiki.archlinux.org/title/Iwd#iwctl
[arch-wiki-nmcli]: https://wiki.archlinux.org/title/Mmcli
[arch-wiki-network-configuration]: https://wiki.archlinux.org/title/Network_configuration
[arch-wiki-lvm-on-luks]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS
[arch-wiki-trim-support]: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)
system-installation/003-system-configuration.qd
+483
View File
@@ -0,0 +1,483 @@
.docname {System Configuration}
.include {docs}
Configure the system for initial boot.
## File System Table
Generate the file system table.
```sh
genfstab -U /mnt >> /mnt/efc/fstab
```
Check the table that was generated in `/mnt/etc/fstab`.
## Change Root
Change root into the new system
```sh
arch-chroot /mnt
```
> Tip: From this point onwards you will only be able to access programs that we previously installed using the
> `pacstrap` command. So for editing text files, you will need to use `neovim` with the `nvim` command instead of `vim`.
> You can install additional programs with `pacman -S <package name>` at any time if you need more tools.
## Time Zone
Configure the correct time zone.
```sh
ln -sf /usr/sahre/zoneinfo/<Region>/<City> /etc/localtime
```
.example {Europe/Berlin}
```sh
ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
```
Then update the system clock with `hwclock --systohc`.
## Localization
Edit the file `/etc/locale.gen` and uncomment all needed locales. Generate the locales afterwards by running
`locale-gen`.
.example {Installed Localizations}
I usually enable the following locales onmy systems:
- `de_DE.UTF-8 UTF-8`
- `de_DE ISO-8859-1`
- `de_DE@euro ISO-8859-15`
- `en_GB.UTF-8 UTF-8`
- `en_GB ISO-8859-1`
- `en_US.UTF-8 UTF-8`
- `en_US ISO-8859-1`
Create the file `/etc/locale.conf` and set the `LANG` variable as well as other environment variables accordingly. The
settings depend on you rlocation and your personal preference
.example {Localization}
```ini
LANG=en_GB.UTF-8
LANGUAGE=en_GB.UTF-8
LC_CTYPE=en_GB.UTF-8
LC_NUMERIC=en_GB.UTF-8
LC_TIME=en_GB.UTF-8
LC_COLLATE=en_GB.UTF-8
LC_MONETARY=de_DE.UTF-8
LC_MESSAGES=en_GB.UTF-8
LC_PAPER=de_DE.UTF-8
LC_NAME=de_DE.UTF-8
LC_ADDRESS=de_DE.UTF-8
LC_TELEPHONE=de_DE.UTF-8
LC_MEASUREMENT=de_DE.UTF-8
LC_IDENTIFICATION=de_DE.UTF-8
```
Persist the settings of console keyboard layout and font. Create the file `/etc/vconsole.conf`:
```sh
FONT=eurlatgr
KEYMAP=de-latin1-nodeadkeys
```
## Network Configuration
### Hostname
Set a hostname in `/etc/hostname`
> Tip: For advice on choosing a hostname, see [RFC 1178][rfc-1178]. As explained in [hostname(7)][hostname-7], it must
> contain from 1 to 63 characters, using only lowercase `a` to `z`, `0` to `9`, and `-`, and must not start with `-`.
Install Network Manager to the network interfaces of the system
```sh
pacman -S networkmanager nm-connection-editor network-manager-applet
```
Then enable the systemd services for Network Manager
```sh
systemctl enable NetworkManager
systemctl enable systemd-resolved
systemctl enable systemd-timesyncd
```
Create the file `/etc/NetworkManager/conf.d/20-connectivity.conf` with the following content
```ini
[connectivity]
uri=https://zechert.net/connectivity_check.txt
```
Create the file `/etc/NetworkManager/conf.d/10-dns.conf` with the following content
```ini
[main]
dns=systemd-resolved
```
### Use Advertised NTP Servers
To use the NTP Servers advertised by the DHCP Server, create a new network manager dispatcher script in
`/etc/NetworkManager/dispatcher.d/10-update-timesyncd` with the following content
```sh
#!/bin/sh
[ -z "$CONNECTION_UUID" ] && exit 0
INTERFACE="$1"
ACTION="$2"
case $ACTION in
up | dhcp4-change | dhcp6-change)
[ -n "$DHCP4_NTP_SERVERS" ] || exit 0
mkdir -p /etc/systemd/timesyncd.conf.d
cat <<-THE_END >"/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
[Time]
NTP=$DHCP4_NTP_SERVERS
THE_END
systemctl restart systemd-timesyncd.service
;;
down)
rm -f "/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
systemctl restart systemd-timesyncd.service
;;
esac
```
Make the script executable with `chmod +x /etc/NetworkManager/dispatcher.d/10-update-timesyncd`.
Create the following file `/etc/systemd/system/networkdown.service`:
```ini
[Unit]
Wants=network-online.target
After=network.target network-online.target
[Service]
Type=oneshot
ExecStart=/bin/true
ExecStop=/bin/sh -c 'rm -f /etc/systemd/timesyncd.conf.d/ntp-*.conf'
RemainAfterExit=yes
[Install]
WantedBy=suspend.target
```
Enable the service with `systemctl enable networkdown`.
### Configure MAC Address Randomization
MAC randomization can be used for increased privacy by not disclosing the real MAC address to the network.
Create the file `/etc/NetworkManager/conf.d/10-random-mac.conf` with the following content:
```ini
[device]
wifi.scan-rand-mac-address=yes
[device-mac-randomization]
wifi.scan-rand-mac-address=yes
[connection-mac-randomization]
ethernet.cloned-mac-address=stable
wifi.cloned-mac-address=stable
```
### Enable IPv6 Privacy Extensions
Create the file `/etc/NetworkManager/conf.d/10-ipv6-privacy.conf` with the following content:
```ini
[connection]
ipv6.ip6-privacy=2
```
Create the file `/etc/sysctl.d/40-ipv6.conf` with the following content:
```ini
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
```
### Configure a unique DUID per connection
NetworkManager uses DUID-UUID from `/etc/machin-id` for all DHCPv6 connections. This might be a security breach.
Instead, configure NetworkManager to create unique DUIDs for each connection.
Create the file `/etc/NetworkManager/conf.d/02-duid.conf` with the following content
```ini
[connection]
ipv6.dhcp-duid=stable-uuid
```
### Enable DNSSEC
Create the file `/etc/systemd/resolved.conf.d/30-dnssec.conf` with the following content
```ini
[Resolve]
DNSSEC=true
```
> Warning: This will break name resolution for all hostnames that do not offer DNSSEC or that are resolved by
> nameservers that do not support DNSSEC. This can break resolution to internal hostnames (e.g. Company Intranet) as
> well es some public sites.
### Disable mDNS
Create the file `/etc/NetworkManager/conf.d/30-mdns.conf` with the following content
```ini
[connection]
connection.mdns=0
```
Create the file `/etc/systemd/resolved.conf.d/30-mdns.conf` with the following content
```ini
[Resolve]
MulticastDNS=no
```
> Warning: Disabling mDNS will break nameserver-less resolution of local hostnames from the same network (DNS via
> multicast DNS Queries). This can break auto-discovery and access to other local machines like local printers, sambda
> network drives, other devices, etc.
>
> Change this to `connection.mdns=1` to fully enable mDNS, `connection.mdns=2` to enable resolution but not announcement
> of your own machine to the network. For both of these oiptions, set `MulticastDNS=yes` to enable the functionality in
> systemd-resolved (or delete the file).
### Disabled LLMNR
Create the file `/etc/NetworkManager/conf.d/30-llmnr.conf` with the following content
```ini
[connection]
connection.llmnr=0
```
Create the file `/etc/systemd/resolved.conf.d/30-llmnr.conf` with the following content
```ini
[Resolve]
LLMNR=no
```
## Mkinitcpio Configuration
Edit the file `/etc/mkinitcpio.conf` and add the necessary hooks for the system.
Add the hooks `systemd`, `keyboard`, `sd-vconsole`, `sd-encrypt` to the list of hooks as follows:
```ini
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck resume)
```
## Set Kernel Command Line
Create the file `/etc/cmdline.d/01-cryptlvm.conf` with the following content
```ini
rd.luks.name=<UUID of encrypted partition>=cryptlvm
```
The UUID can be found with the command `ls -all /dev/disk/by-uuid`.
It can be conveniently copied into the `01-cryptlvm.conf` file with the command
```sh
ls -all /dev/disk/by-uuid | grep "<encrypted partition>" | awk '{print $9}' >> /etc/cmdline.d/01-cryptlvm.conf
```
Create the file `/etc/cmdline.d/02-root.conf` with the following content
```ini
root=/dev/vgsys/lvroot
```
Create the file `/etc/cmdline.d/03-resume.conf` with the following content
```ini
resume=/dev/vgsys/lvswap
```
## Enable Unified Kernel Image Booting
UKI creates a single executable that can be directly booted from the UEFI firmware without any bootloader.
Modify the file `/etc/mkinitcpio.d/linux.preset`.
- Un-comment (i.e. remove `#`) the `PRESET_uki=` parameter for each item in `PRESETS=`
- Comment out (i.e. add `#`) `PRESET_image=` to avoid storing a redundant `initramfs-*.img` file
Create the directory `/efi/EFI/Linux`, then create the initcpio `mkinitcpio -P`.
Make sure that the generation succeeded and two files have been created (`ls /efi/EFI/Linux`), called
`arch-linux-fallback.efi` and `arch-linux.efi` (the fallback image might be missing if it is not enabled in the PRESETS).
## Create Boot Menu Entries
With `efibootmgr` check for existing EFI Boot Menu Entries, remove them if required, and create new entries for
Arch Linux.
- List all entries `efibootmgr`
- Automatically remove duplicate entries `efibootmgr -D`
- Remove a specific boot entry `efibootmgr -b XXXX -B`
- Change the order of boot entries with `efibootmgr -o XXXX,YYYY,ZZZZ`
Create the following two new entries
```sh
efibootmgr --create \
--disk <efi partition> \
--loader=/EFI/Linux/arch-linux.efi \
--label "Arch Linux" \
--verbose
efibootmgr --create \
--disk <efi partition> \
--loader=/EFI/Linux/arch-linux-fallback.efi \
--label "Arch Linux Fallback" \
--verbose
```
## Enable Secureboot
Unfortunately the UEFI kernel image is not stored on an encrypted disk, and cannot be. Since the EFI firmware needs to
be able to access the image to boot the system. Therefore, the system is at risk by an attacker that can manipulate the
kernel image and boot partition. As a remedy to this problem, we will enable secure boot. The boot loader file will be
cryptographically signed by a secret key that is stored on our encrypted partition.
We will use the tool `sbctl` for a user friendly way to configure secure boot.
First, check the current status with `sbctl status`. You should see that sbctl is not installed, and that secure boot
setup mode is enabled.
Creeate new keys: `sbctl create-keys`. Then enroll the new keys with `sbctl enroll-keys -m`.
> Warning: The parameter `-m` in the command `sbctl enroll-keys -m` will enroll your own keys alongside with the default
> microsoft keys. The microsoft keys might be required by any option roms or some firmware in the system. You can omit
> the option `-m` to only enroll your own keys without Microsoft's. But you might create a system that can no longer
> boot! Only do this if you know the risk and know what you are doing. If you want to do this, replace `-m` by
> `--yes-this-might-brick-my-machine`.
## Signing EFI Images
`sbctl` comes with the necessary hooks pre-installed to automatically sign images when needed. Since we have created new
and fresh keys, we need to trigger this now manually once. Run `mkinitcpio -P` to recreate images and trigger `sbctl`
into signing the new images.
## Create a User Account
Set the password for the user `root`, then create a normal user account.
Modify the sudoers file, so that the group sudo has access to the `sudo` command.
```sh
passwd root
groupadd -r sudo
EDITOR=nvim visudo
useradd -c "<full user name"> -m -s /bin/bash <username>
usermod -aG adm,log,rfkill,sys,wheel,sudo,video,input <username>
chfn <username>
passwd <username>
```
Confirm the new user can successfully use `sudo` to elevate permission.
1. Switch to the created user account `su - <username>`. (.keybinding {ctrl+d} can be used to exit the user account and
go back to root)
2. Enter `sudo whoami`, check if sudo works. The output should be `root`
3. Exit the user account with .keybinding {ctrl+d} or `exit`.
For increased security, disable login as root with `passwd --lock root`.
## Configure Pacman and Yay
Switch to the user account you just created with `su - <username>`.
Run the following commands to install `yay`, a AUR package helper.
```sh
cd ~
sudo pacman -S git base-devel go
git clone https://aur.archlinux.org/yay.git
cd yay
makepkg -si
yay -S yay
cd ~
rm -rf yay
exit
```
Change the configuration of pacman in `/etc/pacman.conf`. Enable the options you want to set, e.g. `Color`,
`VerbosePkgList`, `ParallelDownloads`.
Then install the package `pacman -S pacman-contrib` and enable the service `systemctl enable paccache.timer`.
## Enable TRIM
For SSDs only, enable periodic trim.
```sh
systemctl enable fstrim.timer
```
> Warning: Enabling TRIM can leak some information about the encrypted system, e.g. presence of encrypted file systems,
> or even file system types. If this is a concern to you, or you want to achieve plausable deniability, do not enable
> TRIM on your system.
## Recurring Automatic Mirror Selection
Install reflector with `pacman -S reflector`
Edit the options in `/etc/xdg/reflector/reflector.conf`. Then enable the timer service `systemctl enable reflector`.
## Reboot the System
Reboot the system into the installed Arch Linux.
```sh
# exit chroot environment with
exit
# unmount all partitions
umount -R /mnt
# reboot
reboot
```
Remove your installation media.
## Activate systemd-resolved Stub Resolver
After the system rebooted, make sure to set the following symlink!
```sh
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
```
## Connect to the network
Use `nmtui` to connect to a wireless network, if required.
## Create a New Keypair
Create a new ssh keyapair. Alternatively copy an existing one.
```sh
ssh-keygen -t ed25519 -C "$(whoami)@$(uname -n)-$(date -I)"
```
## Update the System#
Run a full system upgrade with `pacman -Syu`.
[rfc-1178]: https://tools.ietf.org/html/rfc1178
[hostname-7]: https://man.archlinux.org/man/hostname.7
system-installation/004-graphical-environment.qd
+125
View File
@@ -0,0 +1,125 @@
.docname {Graphical Environment}
.include {docs}
The steps necessary to install graphics drivers are very dependent on your device. This guide details the settings I use
for my own hardware.
For general instructions, consult the [Arch Linux Wiki: Graphics][arch-wiki-graphics].
## Intel Graphics i915 / xe / Arc
Since Intel provides and supports open source drivers, Intel graphics are essentially plug-and-play. This guide details
some customized and improved settings, based on my personal preferences.
### Installation
Install (`sudo pacman -S ...`) the following packages
- `mesa`: open source OpenGL implementation for most modern drivers, including intel i915 3rd gen hardware
- `mesa-utils`: Utilities for `mesa`
- `vulkan-intal`: Vulkan support for intel hardware
- `vulkan-tools`: Vulkan utilities
- `intel-media-driver`: for VA-API support
- `libva-utils`: Utilities for VA-API
- `vdpauinfo`: Utilities for VDPAU
- `nvtop` Utility to show graphics card usage
Then reboot the computer.
### Enable GuC / HuC Firmware Loading
Depending on the hardware support, GuC and HuC should be en abled by default. You can check this by running the
following commands
```sh
cat /sys/kernel/debug/dri/0/gt0/uc/guc_info
cat /sys/kernel/debug/dri/0/gt0/uc/huc_info
```
> Tip: `0` might need to be replaced by a different number in the commands above. The files will only exist if GuC /
> HuC are enabled during boot. A reboot might be required if you cannot see them, or GuC / HuC is disabled in the
> system.
If GuC / HuC is disabled, you can manually enable it. Create the file `/etc/modprobe.d/i915.conf`
```txt
option i915 enable_guc=2
```
Possible options:
- `1`: Enable GuC but not HuC
- `2`: Enable Huc, but not GuC
- `3`: Enable HuC and GuC
.example {Dell XPS 13 9370 (2018)}
Supported option is `option i915 enable_guc=2`
.example {DELL XPS 13 9350 (2024)}
The xe driver is still experimental. Once it becomes mainline, GuC/HuC will be enabled by default.
Then regenerate and sign the initramfs with `mkinictpio -P`
> Warning: Manually enabling GuC or HuC firmware loading taints the kernel even when the feature is not supported.
> Moreover, enabling Guc / HuC firmware loading can cause issues on some systems; disable it if you experience freezing
> (for example, after resuming from hibernation).
### Intel ARC
Intel ARC GPUs support hardware raytracing support through onboard TSUs. Current performance is mixed.
For intel ARC, `linux-firmware-intel` should be installed on the system. It likely is from the base install already.
## AMD Graphics
AMD releases their drivers as open source. There are also closed source drivers available for special usecases. This
guide will only focus on the open source drivers.
Install (`sudo pacman -S ...`) the following packages
- `mesa` modern OpenGL drivers for most hardware
- `mesa-utils` utility programs for mesa
- `vulkan-radeon` vulkan support
- `vulkan-tools` utility programs for vulkan
- `libva-mesa-driver` to support accelerated video decoding using VA-API
- `libva-utils` utility programs for VA-API
- `mesa-vdpau` support for VDPAU
- `vdpauinfo` utility programs for VDPAU
- `nvtop` to monitor temparature, clock speed, and usage of the graphics card
Then reboot the system.
## Reboot
Do not forget to reboot the system after changes to the graphics drivers have been made.
## Install Hyprland
To install Hyprland, install the following packages that will include some necessary utilities for the system
```sh
yay -S --needed \
hyprland hyprpaper hypridle hyprlock waybar wofi kitty nemo gvfs gvfs-mtp gvfs-smb \
xdg-desktop-portal xdg-desktop-portal-hyprland xdg-desktop-portal-gtk xdg-utils \
wl-clipboard grim slurp swaync network-manager-applet polkit polkit-gnome chezmoi \
wev btop qt5-wayland qt6-wayland qt5ct qt6ct gtk-engine-murrine \
colloid-catppuccin-gtk-theme papirus-icon-theme breeze-icons \
pipewire pipewire-audio pipewire-alsa pipewire-pulse pipewire-jack wireplumber \
pavucontrol alsa-utils \
ttf-bitstream-vera ttf-croscore ttf-dejavu ttf-droid gnu-free-fonts ttf-libreation \
ttf-libertinus otf-libertinus noto-fonts ttf-roboto ttf-ubuntu-font-family \
ttf-anonymous-pro ttf-cascadia-code ttf-fira-mono otf-fira-mono inter-font \
ttf-ms-fonts ttf-vista-fonts ttf-roboto-mono-nerd ttf-firacode-nerd \
otf-firamono-nerd otf-font-awesome \
noto-fonts-emoji noto-fonts-cjk noto-fonts-extra ttf-jetbrains-mono \
ttf-jetbrains-mono-nerd \
firefox librewolf-bin thunderbird \
git make gcc curl ripgrep fzf jq tar unzip inotify-tools socat brightnessctl \
xdg-user-dirs fastfetch figlet openssh tmux man-db man-pages usbutils pciutils \
uwsm libnewt
```
You can now start hyprland with `uwsm start hyprland.desktop`.
[arch-wiki-graphics]: https://wiki.archlinux.org/title/Category:Graphics