Install Archlinux on LUKS encrypted BTRFS filesystem with subvolumes

In this post I will go through the system installation. Second post will be about btrfs snapshots, namely how to create and restore snapshot.

ArchLinux installation is very well documented on Archlinux Wiki. My tutorial basically follows all the necessary steps from the wiki page with some additional configuration to achieve:

• LUKS encryption (this will be applied to all partitions except /boot)
• btrfs formatted filesystem, with use of subvolumes with flat layout

First prerequisite is to have bootable Arch installation medium.

Disk structure:

• 450MB partition for /boot (will hold rEFInd and kernel)
• rest of the disk space for subvolumes
• / will hold 2 subvolumes - root for / and home for /home mountpoint

Following step-by-step guide with comments goes through the installation process:

# check internet connection
ping archlinux.org
# sync time
timedatectl set-ntp true

# create partitions
cfdisk /dev/sda
# 450MB; type EFI System (sda1)
# rest of disk; type Linux filesystem (sda2)

# LUKS: encrypt and open sda2 partition
cryptsetup luksFormat /dev/sda2
cryptsetup open /dev/sda2 zotacroot

# create filesystems
mkfs.fat -F32 /dev/sda1
mkfs.btrfs -L archroot /dev/mapper/zotacroot

# select mirrors
vim /etc/pacman.d/mirrorlist

# now we'll mount our root partition (sda2) and create subvolumes
mkdir /mnt/{subvolumes,arch-root}
mount /dev/mapper/zotacroot /mnt/subvolumes

# subvolumes
btrfs subvolume create /mnt/subvolumes/home
btrfs subvolume create /mnt/subvolumes/root

# mount the subvolumes + boot
mount -o subvol=root /dev/mapper/zotacroot /mnt/arch-root
mkdir /mnt/arch-root/{boot,home}
mount -o subvol=home /dev/mapper/zotacroot /mnt/arch-root/home
mount /dev/sda1 /mnt/arch-root/boot

# install base system
pacstrap /mnt/arch-root base vim openssh btrfs-progs base-devel refind-efi intel-ucode

# generate fstab and chroot to new arch system
genfstab -U /mnt/arch-root >> /mnt/arch-root/etc/fstab
arch-chroot /mnt/arch-root


ln -sf /usr/share/zoneinfo/Region/City /etc/localtime
hwclock --systohc

# Uncomment en_US.UTF-8 UTF-8 and other needed locales in /etc/locale.gen
# and generate with
vim /etc/locale.gen
locale-gen

# add LANG=en_US.UTF-8
vim /etc/locale.conf

# set hostname and hosts
vim /etc/hostname
vim /etc/hosts

# add "encrypt" hook in /etc/mkninitcpio.conf after block
vim /etc/mkinitcpio.conf

mkinitcpio -p linux
passwd

# install and configure rEFInd
refind-install
cd /boot/EFI
mkdir boot
cp refind/refind_x64.efi boot/bootx64.efi

# rEFInd configuration
# UUID:
ls -l /dev/disk/by-uuid/ | grep sda2

# refind.conf
menuentry "Arch Linux" {
    icon     /EFI/refind/icons/os_arch.png
    volume   "ESP"
    loader   /vmlinuz-linux
    initrd   /intel-ucode.img
    initrd   /initramfs-linux.img
    options  "cryptdevice=UUID=bde363f5-7de6-4794-83da-0dd56ff89bfa:zotacroot root=/dev/mapper/zotacroot rootflags=subvol=root rw add_efi_memmap"
    submenuentry "Boot to terminal" {
        add_options "systemd.unit=multi-user.target"
    }
    enabled
}

# in order to mount encrypted drive during boot add to /etc/crypttab
zotacroot    UUID=bde363f5-7de6-4794-83da-0dd56ff89bfa    none                    luks,timeout=180

# review fstab, you can replace UUID with disk label from /dev/disk/by-label
# I've also added transparent zstd compression for my data
LABEL=archroot     /           btrfs    rw,relatime,ssd,space_cache,subvolid=257,subvol=root,compress=zstd         0 0

# exit and reboot
exit
umount -R /mnt/arch-root
umount -R /mnt/subvolumes

reboot

Changing rEFInd boot order:

Changing the order is important if you want to boot directly to rEFInd bootloader.
Use efibootmgr -v to list current EFI options. Then you can adjust the boot order with: efibootmgr -o 000A,0001,0003
In case you get No space left on device error add efi_no_storage_paranoia to the kernel parameters.