3 ms·

This is the step-by-step process I followed to install Arch Linux on my laptop with the following features: - Wayland - Plasma 6 - Plymouth - PipeWire - LVM on

This is the step-by-step process I followed to install Arch Linux on my laptop with the following features: - Wayland - Plasma 6 - Plymouth - PipeWire - LVM on LUKS - Unified Kernel Image - TPM PIN unlock - Secure Boot Let me know what you think!

saghm 2y ago
Nice write-up! My install process is slightly different (I suspect everyone who uses Arch ends up having their own little procedure built up over the years that varies slightly, since the flexibility is part of the appeal), so I'll try to focus on substantive feedback rather than feedback on hyper-specific choices that don't matter: * For something as nebulous as specific cryptographic settings, I think it's worth elaborating on _why_ you pick the settings you did for `cryptosetup`. I'd imagine it's probably very possible for someone to pick a bad set of arguments that either degrade security or don't improve it but make it much slower. I suspect you didn't do this though, so as someone who just uses the defaults that `cryptsetup luksFormat` uses, I'd be super interested to hear how you decided on the options you used! * It looks like you linked to another post explaining your use of `yay` as a pacman wrapper/AUR helper, but I'd worry that a lot of people this guide would be useful too (i.e. newer people to Arch) would be confused when they try to follow it and suddenly run into the issue where they don't have anything called `yay` installed or know how to install it (since it's not something you can get from the default repos). From what I can tell, the only two AUR packages you reference in this post are `plymouth-git` and `plymouth-theme-arch-breeze-git`. Maybe for the purposes of this post, you could stick with `plymouth` and `breeze-plymouth` in the main repos (and possibly link to the section of your other article where you detail AUR stuff)? * The stuff about how to configure secure boot is super interesting; I've never found it worth the hassle and just turn it off on all of my machines, so I wasn't aware of all of the tooling available like `sbctl` and `sbsigntools`. A standalone post on how to configure secure boot on Linux would definitely be worthwhile! * I love the section on the specific packages for each GPU combination. This is definitely something where a lot of people will benefit from a concise list rather than having to comb through the details in the wiki (which are useful when you need them! but often you just want the packages to install) * For unmounting all of the stuff post-install, you can use `umount -a /mnt` to recursively unmount all of the nested mounts. Super small change, but it's nice not to have to type all of it!
- Iku_Tri 2y ago
  Not OP, but thank you for real feedback. Most of these posts are just noise to the less-informed.
- AlphaJack 2y ago
  Thank you for the valuable feedback! I applied your suggestions, in particular sticking with pacman and explaning my encryption and PCRs values.
3np 2y ago
Thanks for sharing! Leaning on and only waving to yay might do the reader a disservice and cause more confusion by making the context very easy to skip over, and without that it will probably just be frustrating to keep using Arch and keep treating yay like a traditional pacman-style package manager... Doing it via makepkg first gets you some understanding of "what's going on under the hood" and what's basically the same regardless of which wrapper you use. Might be a game-changer in X years whenever the community moves on to the next wrapper. You have some cases where yay is being used to actually install repository packages (not AUR). Would recommend changing these from yay to pacman. Like from: yay -S mesa mesa-demos mesa-utils vulkan-intel intel-media-driver intel-gpu-tools to pacman -S mesa mesa-demos mesa-utils vulkan-intel intel-media-driver intel-gpu-tools It looks like aside from the nvidia drivers, the post is not actually installing anything from the AUR? Could consider instead an approach like "There's this thing called AUR ([Link]). [Brief explainer]. Some people use a helper like yay([current link]) aurutils or aurch. [Proceed to show manual build-and-installation via git-clone and makepkg, as well as how to rebuild/update later]"
- AlphaJack 2y ago
  Thank you for the feedback! As you and other have suggested, I removed the "yay" requirement and added a brief explanation that its install instruction can be found in the other guide
everybodyknows 2y ago
Great attention to security -- but what is your strategy for backup, as preparation for recovery from loss of the hardware?
- AlphaJack 2y ago
  I wrote my own python wrapper around Rustic and RClone to achieve 3-2-1 file-level backups: https://github.com/AlphaJack/rusticlone/ https://github.com/AlphaJack/rusticlone/. I first tried Rustic's native RClone support, but performance were awful. Backups are automated and run on a daily basis. To restore all my repo (or just one) I run a single command, if I have the repo configs in place. To backup the repo configs I manually make a second backup by putting them, among all other configurations for my devices, in an encrypted .7z archive, which I upload in a remote cloud storage. To reinstall Arch, I turned my notes into an automated script that does that in few minutes. The guide in the post derives from it, so it's quite up-to-date.

saghm 2y ago

Nice write-up! My install process is slightly different (I suspect everyone who uses Arch ends up having their own little procedure built up over the years that varies slightly, since the flexibility is part of the appeal), so I'll try to focus on substantive feedback rather than feedback on hyper-specific choices that don't matter: * For something as nebulous as specific cryptographic settings, I think it's worth elaborating on _why_ you pick the settings you did for `cryptosetup`. I'd imagine it's probably very possible for someone to pick a bad set of arguments that either degrade security or don't improve it but make it much slower. I suspect you didn't do this though, so as someone who just uses the defaults that `cryptsetup luksFormat` uses, I'd be super interested to hear how you decided on the options you used! * It looks like you linked to another post explaining your use of `yay` as a pacman wrapper/AUR helper, but I'd worry that a lot of people this guide would be useful too (i.e. newer people to Arch) would be confused when they try to follow it and suddenly run into the issue where they don't have anything called `yay` installed or know how to install it (since it's not something you can get from the default repos). From what I can tell, the only two AUR packages you reference in this post are `plymouth-git` and `plymouth-theme-arch-breeze-git`. Maybe for the purposes of this post, you could stick with `plymouth` and `breeze-plymouth` in the main repos (and possibly link to the section of your other article where you detail AUR stuff)? * The stuff about how to configure secure boot is super interesting; I've never found it worth the hassle and just turn it off on all of my machines, so I wasn't aware of all of the tooling available like `sbctl` and `sbsigntools`. A standalone post on how to configure secure boot on Linux would definitely be worthwhile! * I love the section on the specific packages for each GPU combination. This is definitely something where a lot of people will benefit from a concise list rather than having to comb through the details in the wiki (which are useful when you need them! but often you just want the packages to install) * For unmounting all of the stuff post-install, you can use `umount -a /mnt` to recursively unmount all of the nested mounts. Super small change, but it's nice not to have to type all of it!

Iku_Tri 2y ago
Not OP, but thank you for real feedback. Most of these posts are just noise to the less-informed.
AlphaJack 2y ago
Thank you for the valuable feedback! I applied your suggestions, in particular sticking with pacman and explaning my encryption and PCRs values.

3np 2y ago

Thanks for sharing! Leaning on and only waving to yay might do the reader a disservice and cause more confusion by making the context very easy to skip over, and without that it will probably just be frustrating to keep using Arch and keep treating yay like a traditional pacman-style package manager... Doing it via makepkg first gets you some understanding of "what's going on under the hood" and what's basically the same regardless of which wrapper you use. Might be a game-changer in X years whenever the community moves on to the next wrapper. You have some cases where yay is being used to actually install repository packages (not AUR). Would recommend changing these from yay to pacman. Like from: yay -S mesa mesa-demos mesa-utils vulkan-intel intel-media-driver intel-gpu-tools to pacman -S mesa mesa-demos mesa-utils vulkan-intel intel-media-driver intel-gpu-tools It looks like aside from the nvidia drivers, the post is not actually installing anything from the AUR? Could consider instead an approach like "There's this thing called AUR ([Link]). [Brief explainer]. Some people use a helper like yay([current link]) aurutils or aurch. [Proceed to show manual build-and-installation via git-clone and makepkg, as well as how to rebuild/update later]"

AlphaJack 2y ago
Thank you for the feedback! As you and other have suggested, I removed the "yay" requirement and added a brief explanation that its install instruction can be found in the other guide

everybodyknows 2y ago

Great attention to security -- but what is your strategy for backup, as preparation for recovery from loss of the hardware?

AlphaJack 2y ago
I wrote my own python wrapper around Rustic and RClone to achieve 3-2-1 file-level backups: https://github.com/AlphaJack/rusticlone/ https://github.com/AlphaJack/rusticlone/. I first tried Rustic's native RClone support, but performance were awful. Backups are automated and run on a daily basis. To restore all my repo (or just one) I run a single command, if I have the repo configs in place. To backup the repo configs I manually make a second backup by putting them, among all other configurations for my devices, in an encrypted .7z archive, which I upload in a remote cloud storage. To reinstall Arch, I turned my notes into an automated script that does that in few minutes. The guide in the post derives from it, so it's quite up-to-date.