detached 59830f2

feat(encryption): implement phase 2 with btrfs and optional LUKS encryption using Argon2id

commit
59830f292837e471bf955aa3e1b7e26ead1764f1
author
bnema · · 2025-10-19 07:27 UTC
parent
dc1caf5
signature
unsigned
6 files · +153 -30
Unified
UnifiedSplit
M README.md +20 -13
@@ -6,6 +6,7 @@
66
77 ✅ **Phase 0: Core Infrastructure - COMPLETE**
88 ✅ **Phase 1: Barebone Installer - Basic - COMPLETE**
9+✅ **Phase 2: Add btrfs + LUKS Encryption - COMPLETE**
910
1011 ### Completed
1112 - ✅ Project structure created
@@ -15,11 +16,14 @@
1516 - ✅ Logo designed
1617 - ✅ System guards (vanilla Arch, UEFI, x86_64, Secure Boot checks)
1718 - ✅ Bootloader selection (systemd-boot or limine)
18-- ✅ Auto-partitioning (GPT, EFI + root with ext4)
19+- ✅ Auto-partitioning (GPT, EFI + root)
1920 - ✅ Base system installation (pacstrap + fstab)
2021 - ✅ System configuration (timezone, locale, hostname, user creation)
2122 - ✅ Network configuration (systemd-networkd + iwd)
2223 - ✅ Bootloader installation (systemd-boot with boot entries)
24+- ✅ btrfs filesystem with subvolumes (@ for root, @home for home)
25+- ✅ LUKS encryption with Argon2id (optional, 2000ms iteration)
26+- ✅ Encrypted boot support (mkinitcpio hooks)
2327
2428 ### Project Structure
2529 ```
@@ -123,12 +127,15 @@ sudo ./install.sh
123127
124128 **What the installer does:**
125129 1. Validates system (vanilla Arch ISO, UEFI, x86_64)
126-2. Selects installation disk (auto-partitions with GPT)
127-3. Formats partitions (FAT32 EFI + ext4 root)
128-4. Installs ~15 base packages with pacstrap
129-5. Configures system (timezone, locale, hostname, user)
130-6. Installs systemd-boot bootloader
131-7. Creates bootable minimal Arch system
130+2. Asks for bootloader preference (systemd-boot or limine)
131+3. Asks for encryption preference (optional LUKS with Argon2id)
132+4. Selects installation disk (auto-partitions with GPT)
133+5. Formats partitions (FAT32 EFI + btrfs root with optional LUKS)
134+6. Creates btrfs subvolumes (@ for root, @home for home)
135+7. Installs ~15 base packages with pacstrap (+ cryptsetup if encrypted)
136+8. Configures system (timezone, locale, hostname, user)
137+9. Installs systemd-boot bootloader (with encryption support if enabled)
138+10. Creates bootable minimal Arch system
132139
133140 ## Environment Variables
134141
@@ -138,12 +145,12 @@ sudo ./install.sh
138145
139146 ## Next Steps
140147
141-**Phase 2: Add btrfs + LUKS Encryption** (Week 2-3)
142-- [ ] Replace ext4 with btrfs filesystem
143-- [ ] Add LUKS full-disk encryption option
144-- [ ] Configure Argon2id with 2000ms iteration time
145-- [ ] Create btrfs subvolumes (@ for root, @home for home)
146-- [ ] Update bootloader for encrypted boot
148+**Phase 3: Add Limine Bootloader Option** (Week 3)
149+- [ ] Support Limine as alternative to systemd-boot
150+- [ ] Create install/boot/limine.sh script
151+- [ ] Configure limine.conf for UEFI
152+- [ ] Add encryption support for Limine
153+- [ ] Test both bootloaders with encryption
147154
148155 ## Reference
149156
@@ -6,6 +6,7 @@
6 6
7 ✅ **Phase 0: Core Infrastructure - COMPLETE**7 ✅ **Phase 0: Core Infrastructure - COMPLETE**
8 ✅ **Phase 1: Barebone Installer - Basic - COMPLETE**8 ✅ **Phase 1: Barebone Installer - Basic - COMPLETE**
9+✅ **Phase 2: Add btrfs + LUKS Encryption - COMPLETE**
9 10
10 ### Completed11 ### Completed
11 - ✅ Project structure created12 - ✅ Project structure created
@@ -15,11 +16,14 @@
15 - ✅ Logo designed16 - ✅ Logo designed
16 - ✅ System guards (vanilla Arch, UEFI, x86_64, Secure Boot checks)17 - ✅ System guards (vanilla Arch, UEFI, x86_64, Secure Boot checks)
17 - ✅ Bootloader selection (systemd-boot or limine)18 - ✅ Bootloader selection (systemd-boot or limine)
18-- ✅ Auto-partitioning (GPT, EFI + root with ext4)19+- ✅ Auto-partitioning (GPT, EFI + root)
19 - ✅ Base system installation (pacstrap + fstab)20 - ✅ Base system installation (pacstrap + fstab)
20 - ✅ System configuration (timezone, locale, hostname, user creation)21 - ✅ System configuration (timezone, locale, hostname, user creation)
21 - ✅ Network configuration (systemd-networkd + iwd)22 - ✅ Network configuration (systemd-networkd + iwd)
22 - ✅ Bootloader installation (systemd-boot with boot entries)23 - ✅ Bootloader installation (systemd-boot with boot entries)
24+- ✅ btrfs filesystem with subvolumes (@ for root, @home for home)
25+- ✅ LUKS encryption with Argon2id (optional, 2000ms iteration)
26+- ✅ Encrypted boot support (mkinitcpio hooks)
23 27
24 ### Project Structure28 ### Project Structure
25 ```29 ```
@@ -123,12 +127,15 @@ sudo ./install.sh
123 127
124 **What the installer does:**128 **What the installer does:**
125 1. Validates system (vanilla Arch ISO, UEFI, x86_64)129 1. Validates system (vanilla Arch ISO, UEFI, x86_64)
126-2. Selects installation disk (auto-partitions with GPT)130+2. Asks for bootloader preference (systemd-boot or limine)
127-3. Formats partitions (FAT32 EFI + ext4 root)131+3. Asks for encryption preference (optional LUKS with Argon2id)
128-4. Installs ~15 base packages with pacstrap132+4. Selects installation disk (auto-partitions with GPT)
129-5. Configures system (timezone, locale, hostname, user)133+5. Formats partitions (FAT32 EFI + btrfs root with optional LUKS)
130-6. Installs systemd-boot bootloader134+6. Creates btrfs subvolumes (@ for root, @home for home)
131-7. Creates bootable minimal Arch system135+7. Installs ~15 base packages with pacstrap (+ cryptsetup if encrypted)
136+8. Configures system (timezone, locale, hostname, user)
137+9. Installs systemd-boot bootloader (with encryption support if enabled)
138+10. Creates bootable minimal Arch system
132 139
133 ## Environment Variables140 ## Environment Variables
134 141
@@ -138,12 +145,12 @@ sudo ./install.sh
138 145
139 ## Next Steps146 ## Next Steps
140 147
141-**Phase 2: Add btrfs + LUKS Encryption** (Week 2-3)148+**Phase 3: Add Limine Bootloader Option** (Week 3)
142-- [ ] Replace ext4 with btrfs filesystem149+- [ ] Support Limine as alternative to systemd-boot
143-- [ ] Add LUKS full-disk encryption option150+- [ ] Create install/boot/limine.sh script
144-- [ ] Configure Argon2id with 2000ms iteration time151+- [ ] Configure limine.conf for UEFI
145-- [ ] Create btrfs subvolumes (@ for root, @home for home)152+- [ ] Add encryption support for Limine
146-- [ ] Update bootloader for encrypted boot153+- [ ] Test both bootloaders with encryption
147 154
148 ## Reference155 ## Reference
149 156
M install/base/pacstrap.sh +6 -0
@@ -7,6 +7,12 @@ gum style --padding "0 0 1 $PADDING_LEFT" "This may take a few minutes..."
77 # Read barebone package list
88 mapfile -t packages < <(grep -v '^#' "$ARCHUP_INSTALL/presets/barebone.packages" | grep -v '^$')
99
10+# Add cryptsetup if encryption is enabled
11+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
12+ packages+=("cryptsetup")
13+ echo "Adding cryptsetup for LUKS encryption" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
14+fi
15+
1016 # Install base system
1117 pacstrap /mnt "${packages[@]}"
1218
@@ -7,6 +7,12 @@ gum style --padding "0 0 1 $PADDING_LEFT" "This may take a few minutes..."
7 # Read barebone package list7 # Read barebone package list
8 mapfile -t packages < <(grep -v '^#' "$ARCHUP_INSTALL/presets/barebone.packages" | grep -v '^$')8 mapfile -t packages < <(grep -v '^#' "$ARCHUP_INSTALL/presets/barebone.packages" | grep -v '^$')
9 9
10+# Add cryptsetup if encryption is enabled
11+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
12+ packages+=("cryptsetup")
13+ echo "Adding cryptsetup for LUKS encryption" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
14+fi
15+
10 # Install base system16 # Install base system
11 pacstrap /mnt "${packages[@]}"17 pacstrap /mnt "${packages[@]}"
12 18
M install/boot/systemd-boot.sh +30 -5
@@ -6,8 +6,29 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Installing systemd-boo
66 # Install systemd-boot
77 arch-chroot /mnt bootctl install
88
9-# Get root partition UUID
10-ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")
9+# Determine root device UUID
10+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
11+ # For encrypted setups, we need the root partition UUID (before LUKS)
12+ ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")
13+
14+ # Update mkinitcpio.conf to add encrypt hook
15+ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Configuring initramfs for encryption..."
16+
17+ # Add encrypt hook before filesystems hook
18+ sed -i 's/^HOOKS=.*/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt filesystems fsck)/' /mnt/etc/mkinitcpio.conf
19+
20+ # Regenerate initramfs
21+ arch-chroot /mnt mkinitcpio -P
22+
23+ echo "Updated mkinitcpio.conf with encrypt hook" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
24+
25+ # Kernel parameters for encrypted boot
26+ KERNEL_PARAMS="cryptdevice=UUID=$ROOT_UUID:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw"
27+else
28+ # For non-encrypted setups, use the root partition UUID directly
29+ ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")
30+ KERNEL_PARAMS="root=UUID=$ROOT_UUID rootflags=subvol=@ rw"
31+fi
1132
1233 # Create loader configuration
1334 cat > /mnt/boot/loader/loader.conf <<EOF
@@ -22,7 +43,7 @@ cat > /mnt/boot/loader/entries/arch.conf <<EOF
2243 title Arch Linux
2344 linux /vmlinuz-linux
2445 initrd /initramfs-linux.img
25-options root=UUID=$ROOT_UUID rw
46+options $KERNEL_PARAMS
2647 EOF
2748
2849 # Create fallback boot entry
@@ -30,9 +51,13 @@ cat > /mnt/boot/loader/entries/arch-fallback.conf <<EOF
3051 title Arch Linux (fallback)
3152 linux /vmlinuz-linux
3253 initrd /initramfs-linux-fallback.img
33-options root=UUID=$ROOT_UUID rw
54+options $KERNEL_PARAMS
3455 EOF
3556
3657 gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ systemd-boot installed and configured"
3758
38-echo "Installed systemd-boot with root UUID: $ROOT_UUID" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
59+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
60+ echo "Installed systemd-boot with encrypted root (UUID: $ROOT_UUID)" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
61+else
62+ echo "Installed systemd-boot with root UUID: $ROOT_UUID" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
63+fi
@@ -6,8 +6,29 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Installing systemd-boo
6 # Install systemd-boot6 # Install systemd-boot
7 arch-chroot /mnt bootctl install7 arch-chroot /mnt bootctl install
8 8
9-# Get root partition UUID9+# Determine root device UUID
10-ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")10+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
11+ # For encrypted setups, we need the root partition UUID (before LUKS)
12+ ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")
13+
14+ # Update mkinitcpio.conf to add encrypt hook
15+ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Configuring initramfs for encryption..."
16+
17+ # Add encrypt hook before filesystems hook
18+ sed -i 's/^HOOKS=.*/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt filesystems fsck)/' /mnt/etc/mkinitcpio.conf
19+
20+ # Regenerate initramfs
21+ arch-chroot /mnt mkinitcpio -P
22+
23+ echo "Updated mkinitcpio.conf with encrypt hook" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
24+
25+ # Kernel parameters for encrypted boot
26+ KERNEL_PARAMS="cryptdevice=UUID=$ROOT_UUID:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw"
27+else
28+ # For non-encrypted setups, use the root partition UUID directly
29+ ROOT_UUID=$(blkid -s UUID -o value "$ARCHUP_ROOT_PART")
30+ KERNEL_PARAMS="root=UUID=$ROOT_UUID rootflags=subvol=@ rw"
31+fi
11 32
12 # Create loader configuration33 # Create loader configuration
13 cat > /mnt/boot/loader/loader.conf <<EOF34 cat > /mnt/boot/loader/loader.conf <<EOF
@@ -22,7 +43,7 @@ cat > /mnt/boot/loader/entries/arch.conf <<EOF
22 title Arch Linux43 title Arch Linux
23 linux /vmlinuz-linux44 linux /vmlinuz-linux
24 initrd /initramfs-linux.img45 initrd /initramfs-linux.img
25-options root=UUID=$ROOT_UUID rw46+options $KERNEL_PARAMS
26 EOF47 EOF
27 48
28 # Create fallback boot entry49 # Create fallback boot entry
@@ -30,9 +51,13 @@ cat > /mnt/boot/loader/entries/arch-fallback.conf <<EOF
30 title Arch Linux (fallback)51 title Arch Linux (fallback)
31 linux /vmlinuz-linux52 linux /vmlinuz-linux
32 initrd /initramfs-linux-fallback.img53 initrd /initramfs-linux-fallback.img
33-options root=UUID=$ROOT_UUID rw54+options $KERNEL_PARAMS
34 EOF55 EOF
35 56
36 gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ systemd-boot installed and configured"57 gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ systemd-boot installed and configured"
37 58
38-echo "Installed systemd-boot with root UUID: $ROOT_UUID" | tee -a "$ARCHUP_INSTALL_LOG_FILE"59+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
60+ echo "Installed systemd-boot with encrypted root (UUID: $ROOT_UUID)" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
61+else
62+ echo "Installed systemd-boot with root UUID: $ROOT_UUID" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
63+fi
M install/partitioning/format.sh +61 -6
@@ -1,15 +1,70 @@
11 #!/bin/bash
2-# Format partitions (ext4 for Phase 1, btrfs comes in Phase 2)
2+# Format partitions with btrfs and optional LUKS encryption
33
44 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Formatting partitions..."
55
66 # Format EFI partition as FAT32
77 mkfs.fat -F32 -n EFI "$ARCHUP_EFI_PART"
8+echo "Formatted $ARCHUP_EFI_PART as FAT32" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
89
9-# Format root partition as ext4
10-mkfs.ext4 -F -L ROOT "$ARCHUP_ROOT_PART"
10+# Handle root partition - with or without encryption
11+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
12+ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up LUKS encryption..."
1113
12-gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions formatted"
14+ # Prompt for encryption password
15+ while true; do
16+ LUKS_PASSWORD=$(gum input --password --placeholder "Enter encryption password" --padding "0 0 0 $PADDING_LEFT")
17+ LUKS_PASSWORD_CONFIRM=$(gum input --password --placeholder "Confirm encryption password" --padding "0 0 0 $PADDING_LEFT")
1318
14-echo "Formatted $ARCHUP_EFI_PART as FAT32" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
15-echo "Formatted $ARCHUP_ROOT_PART as ext4" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
19+ if [ "$LUKS_PASSWORD" = "$LUKS_PASSWORD_CONFIRM" ]; then
20+ break
21+ else
22+ gum style --foreground 1 --padding "1 0 1 $PADDING_LEFT" "Passwords do not match. Try again."
23+ fi
24+ done
25+
26+ # Setup LUKS with Argon2id and 2000ms iteration time
27+ echo "$LUKS_PASSWORD" | cryptsetup luksFormat \
28+ --type luks2 \
29+ --pbkdf argon2id \
30+ --iter-time 2000 \
31+ --label ARCHUP_LUKS \
32+ "$ARCHUP_ROOT_PART"
33+
34+ # Open the encrypted container
35+ echo "$LUKS_PASSWORD" | cryptsetup open "$ARCHUP_ROOT_PART" cryptroot
36+
37+ # Export the mapped device path
38+ export ARCHUP_CRYPT_ROOT="/dev/mapper/cryptroot"
39+
40+ # Format the encrypted container with btrfs
41+ mkfs.btrfs -f -L ROOT "$ARCHUP_CRYPT_ROOT"
42+
43+ echo "Created LUKS container on $ARCHUP_ROOT_PART" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
44+ echo "Formatted $ARCHUP_CRYPT_ROOT as btrfs" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
45+
46+ # Mount temporarily to create subvolumes
47+ mount "$ARCHUP_CRYPT_ROOT" /mnt
48+
49+else
50+ # No encryption - format directly with btrfs
51+ mkfs.btrfs -f -L ROOT "$ARCHUP_ROOT_PART"
52+ echo "Formatted $ARCHUP_ROOT_PART as btrfs" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
53+
54+ # Mount temporarily to create subvolumes
55+ mount "$ARCHUP_ROOT_PART" /mnt
56+fi
57+
58+# Create btrfs subvolumes
59+gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Creating btrfs subvolumes..."
60+
61+btrfs subvolume create /mnt/@
62+btrfs subvolume create /mnt/@home
63+
64+echo "Created btrfs subvolume: @" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
65+echo "Created btrfs subvolume: @home" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
66+
67+# Unmount temporary mount
68+umount /mnt
69+
70+gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions formatted and subvolumes created"
@@ -1,15 +1,70 @@
1 #!/bin/bash1 #!/bin/bash
2-# Format partitions (ext4 for Phase 1, btrfs comes in Phase 2)2+# Format partitions with btrfs and optional LUKS encryption
3 3
4 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Formatting partitions..."4 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Formatting partitions..."
5 5
6 # Format EFI partition as FAT326 # Format EFI partition as FAT32
7 mkfs.fat -F32 -n EFI "$ARCHUP_EFI_PART"7 mkfs.fat -F32 -n EFI "$ARCHUP_EFI_PART"
8+echo "Formatted $ARCHUP_EFI_PART as FAT32" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
8 9
9-# Format root partition as ext410+# Handle root partition - with or without encryption
10-mkfs.ext4 -F -L ROOT "$ARCHUP_ROOT_PART"11+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
12+ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up LUKS encryption..."
11 13
12-gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions formatted"14+ # Prompt for encryption password
15+ while true; do
16+ LUKS_PASSWORD=$(gum input --password --placeholder "Enter encryption password" --padding "0 0 0 $PADDING_LEFT")
17+ LUKS_PASSWORD_CONFIRM=$(gum input --password --placeholder "Confirm encryption password" --padding "0 0 0 $PADDING_LEFT")
13 18
14-echo "Formatted $ARCHUP_EFI_PART as FAT32" | tee -a "$ARCHUP_INSTALL_LOG_FILE"19+ if [ "$LUKS_PASSWORD" = "$LUKS_PASSWORD_CONFIRM" ]; then
15-echo "Formatted $ARCHUP_ROOT_PART as ext4" | tee -a "$ARCHUP_INSTALL_LOG_FILE"20+ break
21+ else
22+ gum style --foreground 1 --padding "1 0 1 $PADDING_LEFT" "Passwords do not match. Try again."
23+ fi
24+ done
25+
26+ # Setup LUKS with Argon2id and 2000ms iteration time
27+ echo "$LUKS_PASSWORD" | cryptsetup luksFormat \
28+ --type luks2 \
29+ --pbkdf argon2id \
30+ --iter-time 2000 \
31+ --label ARCHUP_LUKS \
32+ "$ARCHUP_ROOT_PART"
33+
34+ # Open the encrypted container
35+ echo "$LUKS_PASSWORD" | cryptsetup open "$ARCHUP_ROOT_PART" cryptroot
36+
37+ # Export the mapped device path
38+ export ARCHUP_CRYPT_ROOT="/dev/mapper/cryptroot"
39+
40+ # Format the encrypted container with btrfs
41+ mkfs.btrfs -f -L ROOT "$ARCHUP_CRYPT_ROOT"
42+
43+ echo "Created LUKS container on $ARCHUP_ROOT_PART" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
44+ echo "Formatted $ARCHUP_CRYPT_ROOT as btrfs" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
45+
46+ # Mount temporarily to create subvolumes
47+ mount "$ARCHUP_CRYPT_ROOT" /mnt
48+
49+else
50+ # No encryption - format directly with btrfs
51+ mkfs.btrfs -f -L ROOT "$ARCHUP_ROOT_PART"
52+ echo "Formatted $ARCHUP_ROOT_PART as btrfs" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
53+
54+ # Mount temporarily to create subvolumes
55+ mount "$ARCHUP_ROOT_PART" /mnt
56+fi
57+
58+# Create btrfs subvolumes
59+gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Creating btrfs subvolumes..."
60+
61+btrfs subvolume create /mnt/@
62+btrfs subvolume create /mnt/@home
63+
64+echo "Created btrfs subvolume: @" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
65+echo "Created btrfs subvolume: @home" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
66+
67+# Unmount temporary mount
68+umount /mnt
69+
70+gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions formatted and subvolumes created"
M install/partitioning/mount.sh +22 -6
@@ -1,16 +1,32 @@
11 #!/bin/bash
2-# Mount partitions to /mnt
2+# Mount btrfs subvolumes to /mnt
33
44 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Mounting partitions..."
55
6-# Mount root partition
7-mount "$ARCHUP_ROOT_PART" /mnt
6+# Determine which device to mount (encrypted or not)
7+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
8+ MOUNT_DEVICE="$ARCHUP_CRYPT_ROOT"
9+else
10+ MOUNT_DEVICE="$ARCHUP_ROOT_PART"
11+fi
12+
13+# Mount @ subvolume as root with optimal btrfs options
14+mount -o noatime,compress=zstd,subvol=@ "$MOUNT_DEVICE" /mnt
15+
16+echo "Mounted @ subvolume to /mnt" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
17+
18+# Create home directory
19+mkdir -p /mnt/home
20+
21+# Mount @home subvolume
22+mount -o noatime,compress=zstd,subvol=@home "$MOUNT_DEVICE" /mnt/home
23+
24+echo "Mounted @home subvolume to /mnt/home" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
825
926 # Create and mount EFI directory
1027 mkdir -p /mnt/boot
1128 mount "$ARCHUP_EFI_PART" /mnt/boot
1229
13-gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions mounted"
14-
15-echo "Mounted $ARCHUP_ROOT_PART to /mnt" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
1630 echo "Mounted $ARCHUP_EFI_PART to /mnt/boot" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
31+
32+gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions mounted"
@@ -1,16 +1,32 @@
1 #!/bin/bash1 #!/bin/bash
2-# Mount partitions to /mnt2+# Mount btrfs subvolumes to /mnt
3 3
4 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Mounting partitions..."4 gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Mounting partitions..."
5 5
6-# Mount root partition6+# Determine which device to mount (encrypted or not)
7-mount "$ARCHUP_ROOT_PART" /mnt7+if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then
8+ MOUNT_DEVICE="$ARCHUP_CRYPT_ROOT"
9+else
10+ MOUNT_DEVICE="$ARCHUP_ROOT_PART"
11+fi
12+
13+# Mount @ subvolume as root with optimal btrfs options
14+mount -o noatime,compress=zstd,subvol=@ "$MOUNT_DEVICE" /mnt
15+
16+echo "Mounted @ subvolume to /mnt" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
17+
18+# Create home directory
19+mkdir -p /mnt/home
20+
21+# Mount @home subvolume
22+mount -o noatime,compress=zstd,subvol=@home "$MOUNT_DEVICE" /mnt/home
23+
24+echo "Mounted @home subvolume to /mnt/home" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
8 25
9 # Create and mount EFI directory26 # Create and mount EFI directory
10 mkdir -p /mnt/boot27 mkdir -p /mnt/boot
11 mount "$ARCHUP_EFI_PART" /mnt/boot28 mount "$ARCHUP_EFI_PART" /mnt/boot
12 29
13-gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions mounted"
14-
15-echo "Mounted $ARCHUP_ROOT_PART to /mnt" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
16 echo "Mounted $ARCHUP_EFI_PART to /mnt/boot" | tee -a "$ARCHUP_INSTALL_LOG_FILE"30 echo "Mounted $ARCHUP_EFI_PART to /mnt/boot" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
31+
32+gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "✓ Partitions mounted"
M install/preflight/begin.sh +14 -0
@@ -28,4 +28,18 @@ ARCHUP_BOOTLOADER=$(gum choose \
2828 export ARCHUP_BOOTLOADER
2929 echo "Selected bootloader: $ARCHUP_BOOTLOADER" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
3030
31+# Ask for encryption preference (Phase 2)
32+echo
33+gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption"
34+gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)"
35+echo
36+
37+if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then
38+ export ARCHUP_ENCRYPTION="enabled"
39+ echo "Encryption: enabled" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
40+else
41+ export ARCHUP_ENCRYPTION="disabled"
42+ echo "Encryption: disabled" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
43+fi
44+
3145 gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "✓ Configuration saved"
@@ -28,4 +28,18 @@ ARCHUP_BOOTLOADER=$(gum choose \
28 export ARCHUP_BOOTLOADER28 export ARCHUP_BOOTLOADER
29 echo "Selected bootloader: $ARCHUP_BOOTLOADER" | tee -a "$ARCHUP_INSTALL_LOG_FILE"29 echo "Selected bootloader: $ARCHUP_BOOTLOADER" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
30 30
31+# Ask for encryption preference (Phase 2)
32+echo
33+gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption"
34+gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)"
35+echo
36+
37+if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then
38+ export ARCHUP_ENCRYPTION="enabled"
39+ echo "Encryption: enabled" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
40+else
41+ export ARCHUP_ENCRYPTION="disabled"
42+ echo "Encryption: disabled" | tee -a "$ARCHUP_INSTALL_LOG_FILE"
43+fi
44+
31 gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "✓ Configuration saved"45 gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "✓ Configuration saved"

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 1

Tags 0

    ↑↓ moveenter openesc close