doc/system-installation/003-system-configuration.qd

.docname {System Configuration}
.include {docs}

Configure the system for initial boot.

## File System Table

Generate the file system table.

```sh
genfstab -U /mnt >> /mnt/efc/fstab
```

Check the table that was generated in `/mnt/etc/fstab`.

## Change Root

Change root into the new system

```sh
arch-chroot /mnt
```

> Tip: From this point onwards you will only be able to access programs that we previously installed using the
> `pacstrap` command. So for editing text files, you will need to use `neovim` with the `nvim` command instead of `vim`.
> You can install additional programs with `pacman -S <package name>` at any time if you need more tools.

## Time Zone

Configure the correct time zone.

```sh
ln -sf /usr/sahre/zoneinfo/<Region>/<City> /etc/localtime
```

.example {Europe/Berlin}
    ```sh
    ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
    ```

Then update the system clock with `hwclock --systohc`.

## Localization

Edit the file `/etc/locale.gen` and uncomment all needed locales. Generate the locales afterwards by running
`locale-gen`.

.example {Installed Localizations}
    I usually enable the following locales onmy systems:
    - `de_DE.UTF-8 UTF-8`
    - `de_DE ISO-8859-1`
    - `de_DE@euro ISO-8859-15`
    - `en_GB.UTF-8 UTF-8`
    - `en_GB ISO-8859-1`
    - `en_US.UTF-8 UTF-8`
    - `en_US ISO-8859-1`

Create the file `/etc/locale.conf` and set the `LANG` variable as well as other environment variables accordingly. The
settings depend on you rlocation and your personal preference

.example {Localization}
    ```ini
    LANG=en_GB.UTF-8
    LANGUAGE=en_GB.UTF-8
    LC_CTYPE=en_GB.UTF-8
    LC_NUMERIC=en_GB.UTF-8
    LC_TIME=en_GB.UTF-8
    LC_COLLATE=en_GB.UTF-8
    LC_MONETARY=de_DE.UTF-8
    LC_MESSAGES=en_GB.UTF-8
    LC_PAPER=de_DE.UTF-8
    LC_NAME=de_DE.UTF-8
    LC_ADDRESS=de_DE.UTF-8
    LC_TELEPHONE=de_DE.UTF-8
    LC_MEASUREMENT=de_DE.UTF-8
    LC_IDENTIFICATION=de_DE.UTF-8
    ```

Persist the settings of console keyboard layout and font. Create the file `/etc/vconsole.conf`:

```sh
FONT=eurlatgr
KEYMAP=de-latin1-nodeadkeys
```

## Network Configuration

### Hostname

Set a hostname in `/etc/hostname`

> Tip: For advice on choosing a hostname, see [RFC 1178][rfc-1178]. As explained in [hostname(7)][hostname-7], it must
> contain from 1 to 63 characters, using only lowercase `a` to `z`, `0` to `9`, and `-`, and must not start with `-`.

Install Network Manager to the network interfaces of the system

```sh
pacman -S networkmanager nm-connection-editor network-manager-applet
```

Then enable the systemd services for Network Manager

```sh
systemctl enable NetworkManager
systemctl enable systemd-resolved
systemctl enable systemd-timesyncd
```

Create the file `/etc/NetworkManager/conf.d/20-connectivity.conf` with the following content

```ini
[connectivity]
uri=https://zechert.net/connectivity_check.txt
```

Create the file `/etc/NetworkManager/conf.d/10-dns.conf` with the following content

```ini
[main]
dns=systemd-resolved
```

### Use Advertised NTP Servers

To use the NTP Servers advertised by the DHCP Server, create a new network manager dispatcher script in
`/etc/NetworkManager/dispatcher.d/10-update-timesyncd` with the following content

```sh
#!/bin/sh

[ -z "$CONNECTION_UUID" ] && exit 0
INTERFACE="$1"
ACTION="$2"

case $ACTION in
up | dhcp4-change | dhcp6-change)
    [ -n "$DHCP4_NTP_SERVERS" ] || exit 0
    mkdir -p /etc/systemd/timesyncd.conf.d
    cat <<-THE_END >"/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
        [Time]
        NTP=$DHCP4_NTP_SERVERS
    THE_END
    systemctl restart systemd-timesyncd.service
    ;;
down)
    rm -f "/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
    systemctl restart systemd-timesyncd.service
    ;;
esac
```

Make the script executable with `chmod +x /etc/NetworkManager/dispatcher.d/10-update-timesyncd`.

Create the following file `/etc/systemd/system/networkdown.service`:

```ini
[Unit]
Wants=network-online.target
After=network.target network-online.target

[Service]
Type=oneshot
ExecStart=/bin/true
ExecStop=/bin/sh -c 'rm -f /etc/systemd/timesyncd.conf.d/ntp-*.conf'
RemainAfterExit=yes

[Install]
WantedBy=suspend.target
```

Enable the service with `systemctl enable networkdown`.

### Configure MAC Address Randomization

MAC randomization can be used for increased privacy by not disclosing the real MAC address to the network.

Create the file `/etc/NetworkManager/conf.d/10-random-mac.conf` with the following content:

```ini
[device]
wifi.scan-rand-mac-address=yes

[device-mac-randomization]
wifi.scan-rand-mac-address=yes

[connection-mac-randomization]
ethernet.cloned-mac-address=stable
wifi.cloned-mac-address=stable
```

### Enable IPv6 Privacy Extensions

Create the file `/etc/NetworkManager/conf.d/10-ipv6-privacy.conf` with the following content:

```ini
[connection]
ipv6.ip6-privacy=2
```

Create the file `/etc/sysctl.d/40-ipv6.conf` with the following content:

```ini
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
```

### Configure a unique DUID per connection

NetworkManager uses DUID-UUID from `/etc/machin-id` for all DHCPv6 connections. This might be a security breach.
Instead, configure NetworkManager to create unique DUIDs for each connection.

Create the file `/etc/NetworkManager/conf.d/02-duid.conf` with the following content

```ini
[connection]
ipv6.dhcp-duid=stable-uuid
```

### Enable DNSSEC

Create the file `/etc/systemd/resolved.conf.d/30-dnssec.conf` with the following content

```ini
[Resolve]
DNSSEC=true
```

> Warning: This will break name resolution for all hostnames that do not offer DNSSEC or that are resolved by
> nameservers that do not support DNSSEC. This can break resolution to internal hostnames (e.g. Company Intranet) as
> well es some public sites.

### Disable mDNS

Create the file `/etc/NetworkManager/conf.d/30-mdns.conf` with the following content

```ini
[connection]
connection.mdns=0
```

Create the file `/etc/systemd/resolved.conf.d/30-mdns.conf` with the following content

```ini
[Resolve]
MulticastDNS=no
```

> Warning: Disabling mDNS will break nameserver-less resolution of local hostnames from the same network (DNS via
> multicast DNS Queries). This can break auto-discovery and access to other local machines like local printers, sambda
> network drives, other devices, etc.
>
> Change this to `connection.mdns=1` to fully enable mDNS, `connection.mdns=2` to enable resolution but not announcement
> of your own machine to the network. For both of these oiptions, set `MulticastDNS=yes` to enable the functionality in
> systemd-resolved (or delete the file).

### Disabled LLMNR

Create the file `/etc/NetworkManager/conf.d/30-llmnr.conf` with the following content

```ini
[connection]
connection.llmnr=0
```

Create the file `/etc/systemd/resolved.conf.d/30-llmnr.conf` with the following content

```ini
[Resolve]
LLMNR=no
```

## Mkinitcpio Configuration

Edit the file `/etc/mkinitcpio.conf` and add the necessary hooks for the system.

Add the hooks `systemd`, `keyboard`, `sd-vconsole`, `sd-encrypt` to the list of hooks as follows:

```ini
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck resume)
```

## Set Kernel Command Line

Create the file `/etc/cmdline.d/01-cryptlvm.conf` with the following content

```ini
rd.luks.name=<UUID of encrypted partition>=cryptlvm
```

The UUID can be found with the command `ls -all /dev/disk/by-uuid`.
It can be conveniently copied into the `01-cryptlvm.conf` file with the command

```sh
ls -all /dev/disk/by-uuid | grep "<encrypted partition>" | awk '{print $9}' >> /etc/cmdline.d/01-cryptlvm.conf
```

Create the file `/etc/cmdline.d/02-root.conf` with the following content

```ini
root=/dev/vgsys/lvroot
```

Create the file `/etc/cmdline.d/03-resume.conf` with the following content

```ini
resume=/dev/vgsys/lvswap
```

## Enable Unified Kernel Image Booting

UKI creates a single executable that can be directly booted from the UEFI firmware without any bootloader.

Modify the file `/etc/mkinitcpio.d/linux.preset`.

- Un-comment (i.e. remove `#`) the `PRESET_uki=` parameter for each item in `PRESETS=`
- Comment out (i.e. add `#`) `PRESET_image=` to avoid storing a redundant `initramfs-*.img` file

Create the directory `/efi/EFI/Linux`, then create the initcpio `mkinitcpio -P`.

Make sure that the generation succeeded and two files have been created (`ls /efi/EFI/Linux`), called
`arch-linux-fallback.efi` and `arch-linux.efi` (the fallback image might be missing if it is not enabled in the PRESETS).

## Create Boot Menu Entries

With `efibootmgr` check for existing EFI Boot Menu Entries, remove them if required, and create new entries for
Arch Linux.

- List all entries `efibootmgr`
- Automatically remove duplicate entries `efibootmgr -D`
- Remove a specific boot entry `efibootmgr -b XXXX -B`
- Change the order of boot entries with `efibootmgr -o XXXX,YYYY,ZZZZ`

Create the following two new entries

```sh
efibootmgr --create \
--disk <efi partition> \
--loader=/EFI/Linux/arch-linux.efi \
--label "Arch Linux" \
--verbose

efibootmgr --create \
--disk <efi partition> \
--loader=/EFI/Linux/arch-linux-fallback.efi \
--label "Arch Linux Fallback" \
--verbose
```

## Enable Secureboot

Unfortunately the UEFI kernel image is not stored on an encrypted disk, and cannot be. Since the EFI firmware needs to
be able to access the image to boot the system. Therefore, the system is at risk by an attacker that can manipulate the
kernel image and boot partition. As a remedy to this problem, we will enable secure boot. The boot loader file will be
cryptographically signed by a secret key that is stored on our encrypted partition.

We will use the tool `sbctl` for a user friendly way to configure secure boot.

First, check the current status with `sbctl status`. You should see that sbctl is not installed, and that secure boot
setup mode is enabled.

Creeate new keys: `sbctl create-keys`. Then enroll the new keys with `sbctl enroll-keys -m`.

> Warning: The parameter `-m` in the command `sbctl enroll-keys -m` will enroll your own keys alongside with the default
> microsoft keys. The microsoft keys might be required by any option roms or some firmware in the system. You can omit
> the option `-m` to only enroll your own keys without Microsoft's. But you might create a system that can no longer
> boot! Only do this if you know the risk and know what you are doing. If you want to do this, replace `-m` by
> `--yes-this-might-brick-my-machine`.

## Signing EFI Images

`sbctl` comes with the necessary hooks pre-installed to automatically sign images when needed. Since we have created new
and fresh keys, we need to trigger this now manually once. Run `mkinitcpio -P` to recreate images and trigger `sbctl`
into signing the new images.

## Create a User Account

Set the password for the user `root`, then create a normal user account.
Modify the sudoers file, so that the group sudo has access to the `sudo` command.

```sh
passwd root
groupadd -r sudo
EDITOR=nvim visudo
useradd -c "<full user name"> -m -s /bin/bash <username>
usermod -aG adm,log,rfkill,sys,wheel,sudo,video,input <username>
chfn <username>
passwd <username>
```

Confirm the new user can successfully use `sudo` to elevate permission.

1. Switch to the created user account `su - <username>`. (.keybinding {ctrl+d} can be used to exit the user account and
   go back to root)
2. Enter `sudo whoami`, check if sudo works. The output should be `root`
3. Exit the user account with .keybinding {ctrl+d} or `exit`.

For increased security, disable login as root with `passwd --lock root`.

## Configure Pacman and Yay

Switch to the user account you just created with `su - <username>`.
Run the following commands to install `yay`, a AUR package helper.

```sh
cd ~
sudo pacman -S git base-devel go
git clone https://aur.archlinux.org/yay.git
cd yay
makepkg -si
yay -S yay
cd ~
rm -rf yay
exit
```

Change the configuration of pacman in `/etc/pacman.conf`. Enable the options you want to set, e.g. `Color`,
`VerbosePkgList`, `ParallelDownloads`.

Then install the package `pacman -S pacman-contrib` and enable the service `systemctl enable paccache.timer`.

## Enable TRIM

For SSDs only, enable periodic trim.

```sh
systemctl enable fstrim.timer
```

> Warning: Enabling TRIM can leak some information about the encrypted system, e.g. presence of encrypted file systems,
> or even file system types. If this is a concern to you, or you want to achieve plausable deniability, do not enable
> TRIM on your system.

## Recurring Automatic Mirror Selection

Install reflector with `pacman -S reflector`

Edit the options in `/etc/xdg/reflector/reflector.conf`. Then enable the timer service `systemctl enable reflector`.

## Reboot the System

Reboot the system into the installed Arch Linux.

```sh
# exit chroot environment with
exit

# unmount all partitions
umount -R /mnt

# reboot
reboot
```

Remove your installation media.


## Activate systemd-resolved Stub Resolver

After the system rebooted, make sure to set the following symlink!

```sh
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
```

## Connect to the network

Use `nmtui` to connect to a wireless network, if required.

## Create a New Keypair

Create a new ssh keyapair. Alternatively copy an existing one.

```sh
ssh-keygen -t ed25519 -C "$(whoami)@$(uname -n)-$(date -I)"
```

## Update the System#

Run a full system upgrade with `pacman -Syu`.

[rfc-1178]: https://tools.ietf.org/html/rfc1178
[hostname-7]: https://man.archlinux.org/man/hostname.7