Convenience script for arch setup

2026-10-02

Arch isn't as hard to install as the memes might make it seem, but it still contains a bunch of steps that aren't just clicking obvious buttons. I don't install arch as often as i used to, so i also forget how exactly i did set it up. For this reason i'm making a personal script to help me set up my archlinux.

STATUS: WIP

not actually made into a proper script yet

Starting point

Minimal requirement is a running Archiso live system conntected to the internet. Since i use my personal, customized archiso image (insert link to blog post here) i might rely on certain files being present from there.

Data gathering

• cpu type for microcode: lscpu | grep -i vendor (AuthenticAMD or GenuineIntel for now)
• Hostname
• Disk to install on
• Disk (usb stick?) to put the LUKS key on if needed

Partitioning

Not sure if the script should do this, but if it should:

• EFI partition: 1 gb, type "uefi" (when done manually with fdisk, parted uses other)
• Data partition: rest of disk, type "linux" (again fdisk, idk about parted)
• NO swap partition (we'll set up a swap file)

in my first attempt, the disk may be partitioned already. might update later if neeeded.

LUKS setup (encrypted root partition)

cryptsetup -v luksFormat /dev/ cryptsetup open /dev/ cryptroot

Note: this is the point where we should likely add a keyfile on any system that should be able to boot unattended (link other blogpost here)

Filesystems

• mkfs.fat -F 32 /dev/
• mkfs.ext4 /dev/mapper/cryptroot

Mounting

• mount /dev/mapper/cryptroot /mnt
• mkdir /mnt/efi
• mount /dev/efiparttion /mnt/efi

Note: we don't use /boot on our efi partition. using UKI for booting, we want ONLY the finished UKI image on the efi partition, anything in /boot is "trusted" input we use to build that UKI. /boot SHOULD be on our encrypted root partition in this case.

Pacstrap

pacstrap -K /mnt base linux linux-firmware vim neovim openssh

Note: networking will be done by systemd-networkd and systemd-resolved, which should ship with systemd package. remember to enable the services.

Fstab

genfstab -U /mnt >> /mnt/ect/fstab

Copy useful files

cp /etc/locale.gen /mnt/etc/locale.gen cp /etc/locale.conf /mnt/etc/locale.conf cp /etc/vconsole.conf /mnt/etc/vconsole.conf

cp /etc/ssh/sshd_config /mnt/etc/ssh/sshd_config mkdir /mnt/root/.ssh chmod 700 /mnt/root/.ssh cp /root/.ssh/authorized_keys /mnt/root/.ssh

Chroot

arch-chroot /mnt

Swap file

mkswap -U clear --size 4G --file /swapfile echo "/swapfile none swap defaults 0 0" >> /etc/fstab

more setup

ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime hwclock --systohc locale-gen echo "" > /etc/hostname

enable services

systemctl enable systemd-timesyncd systemctl enable systemd-networkd systemctl enable systemd-resolved systemctl enable sshd

UKI

(specify in /etc/kernel/cmdline, mkinitcpio SHOULD automatically use that) rd.luks.name=UUID-of-LUKS-part=cryptroot rd.luks.key=UUID-of-LUKS-part=/keyfile:UUID=UUID-of-USB-stick-part root=/dev/mapper/cryptroot rw specify the /etc/kernel/cmdline in theprofile too, be explicit: default_options="--cmdline /etc/kernel/cmdline" edit the mkinitcpio preset: uncommend uki, comment others set uki path to /efi/EFI/BOOT/BOOTx64.EFI mkdir -p /efi/EFI/BOOT (ensure efi is mounted) mkinitcpio.conf adjust hooks to add systemd sd-encrypt ensure /efi is mounted and mkinitcpio -p linux and ensure the BOOTx64.EFI gets made HOPEFULLY bios auto finds it, otherwise use efibootmgr