Creating ISO on a USB

1. Download an Artix Linux ISO Tutorial. We use Runit following Luke Smith’s recommendation.
2. Format USB
   1. For maximum compatibility, we use FAT32.
   2. Use lsblk to identify USB based on system size. Ours is located at /dev/sdc
   3. Format the USB: sudo mkfs.vfat /dev/sdc
   4. Verify formatting: sudo fsck /dev/sdb1
3. Copy ISO with dd:

1sudo dd if=$source of=$out status="progress"

1. Run sync before removing USB.

Install Artix from ISO

Boot menu

1. Insert the USB into your hardware of choice, pressing F2, F10, F11, Del, etc, in order to get into your system’s boot menu.
2. Choose the USB from the boot menu. The system will now reboot into the USB.

Login

1. Choose regional settings, and select ISO installation.

2. At the login prompt enter the following login details to login as superuser:

   user: root password: artix Although the artix installer advises you to login with user “artix”, I advise you login as root for privileges.

UEFI check

Determine whether you are using UEFI; run bash ls /sys/firmware/efi/efivars If the directory is not empty, then you are running a UEFI machine, otherwise, you can use Legacy boot loaders (we will say more later).

Create filesystem

Create filesystem: we will encrypt root partition (but not bootloaders).

1. Run lsblk to determine the name of your installation drive. You probably want to choose the largest partition. We will be installing on nvme0n1. You may be installing on ‘’’sda’’’.

2. Run fdisk /dev/nvme0n1. 4. Enter d to delete partitions (repeatedly), if they exist. 5. Enter n to create a new partition. 6. Select p for primary. 7. Press enter for the partition number. 8. Press enter again for the first sector. 9. For the last sector, we will make it +1G (one full gigabyte). 10. If prompted, enter Y again to remove the signature. 11. Enter n again to create another partition, and enter through all prompts. 12. Save with w. 13. Reboot if prompted (the alert message can easily be missed!!!). 14. Running lsblk, we see that our drive now has two partitions.

3. Format boot partition: we will use FAT32 format for maximum compatibility.

   1mkfs.fat -F32 -I /dev/nvme0n1p1

4. Encrypt root partition

   1cryptsetup luksFormat /dev/nvme0n1p2

5. Decrypt and mount root

   1cryptsetup open /dev/nvme0n1p2 cryptlvm
   2mkfs.btrfs /dev/mapper/cryptlvm
   3mount /dev/mapper/cryptlvm /mnt

6. Mount boot

   1mkdir /mnt/boot
   2mount /dev/nvme0n1p1 /mnt/boot

WiFi connection

1connmanctl
2enable wifi
3scan wifi
4services

Of the wifi networks listed, choose the one you wish to connect to with

1agent on
2connect wifi_*

Enter the password, then enter

1quit

Check with

1ping quantalumin.com

Install packages

1. Change mirror to somewhere close if desired:

   1vi /etc/pacman.d/mirrorlist

   e.g. move UK to default

2. Install packages

   1basestrap -i /mnt base base-devel runit elogind-runit cryptsetup lvm2 lvm2-runit neovim networkmanager networkmanager-runit linux-hardened linux-hardened-headers linux-firmware

Explanation of packages

• base base-devel: TODO
• grub: boot
• os-prober: TODO necessary?
• efibootmgr: for UEFI devices (unneccessary for Legacy boot)
• runit elogind-runit: TODO
• cryptsetup lvm2 lvm2-runit: encryption
• neovim: text-editor –neovim is a rewriting of vim, which in turn is a rewriting of vi. The neovim source-code is clearer than vim, and has a large development community.
• networkmanager networkmanager-runit: wifi network manager and auto-start
• linux-hardened: (we’re installing a security hardened linux kernel)
• linux-hardened-headers: interact with the kernel
• linux-firmware: includes cryptlvmrs for proprietary hardware

Generate fstab

Generate fstab

1fstabgen -U /mnt >> /mnt/etc/fstab

Configure the base system

Begin by chroot’ing in to the system

1artix-chroot /mnt /bin/bash

Set keyboard layout

Check the available layouts

1ls -R /usr/share/kbd/keymaps | grep *

where * can be replaced by the layout you’re looking for e.g. uk, or es. Once you have chosen a layout, load it with e.g.

1loadkeys uk

To make the changes permanent post-reboot, modify the following files

TODO These files are missing. How to add them?

Configure the system clock

1ln -sf /usr/share/zoneinfo/Region/City /etc/localtime

Run hwclock to generate /etc/adjtime

1hwclock --systohc

Localisation

Uncomment the locales you desire

1nvim /etc/locale.gen

We chose en_GB.UTF-8 UTF-8. TODO difference between UTF-8 and ISO Then generate the locales with

1locale-gen

Rewrite

1export LANG="en_GB.UTF-8"
2export LC_COLLATE="C"

TODO what is LC_COLLATE?

Hostname and hosts

Give your local host a name

1echo "desktop" > /etc/hostname

Edit the Hosts file

1127.0.0.1	localhost
2::1		localhost
3127.0.1.1	desktop.localdomain	desktop

Enable network manager

1ln -s /etc/runit/sv/NetworkManager /etc/runit/runsvdir/current

Add user and set passwords

Root user password

1passwd

Create new user, and add password

1useradd -G wheel -m Henry
2passwd Henry

Edit the sudoers file /etc/sudoers, uncommenting the line for the wheel group. This grants the user the privilege to run the command sudo

Autologin

Since we have already encrypted our drive, we can set autologin. Edit the following line

1GETTY_ARGS="--no-clear"

as

1GETTY_ARGS="--no-clear --autologin Henry"

Boot Loader

Add to the line Hooks=(...) encrypt and lvm2, in the following way

1Hooks=(...consolefont block encrypt lvm2 filesystems fsck)

Build the image

1mkinitcpio -p linux-hardened

Build bootloader (GRUB)

In this section, we install the bootloader. In order to do so, we must see the filesystems as seen from the point-of-view of the GRUB, requiring us to exit our chroot.

1lsblk -f >> /etc/default/grub
2exit
3fstabgen -U /mnt >> /mnt/etc/fstab

+++

Why did we exit?

Earlier, we logged in as root into the Artix OS installed on the USB. We then chroot‘ed into the filesystem on the partioned drive. fstabgen is unable to see the paritioning of the drive from inside the filesystem, and therefore requires us to exit it. TODO perhaps include a Mermaid diagram TODO check the vocabulary filesystem +++ Then artix-chroot /mnt bash back into the system and go to the bottom of the GRUB file /etc/default/grub. We want the UUID of the encrypted and uncrypted main parition (we don’t need the UUID of the boot partition). Copy the UUIDS as

1GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quit cryptdevice=UUID=$UUIDCRYPT:cryplvm root=UUID=$UUIDUNENCRYPTED"

where $UUIDCRYPT and $UUIDUNENCRYPTED should be replaced by the UUID of the encrypted and unencrypted partitions, which you copied over with >>. Delete the other text you copied over. Then install the GRUB. For Legacy BIOS, run

1grub-install /dev/nvme0n1

For UEFI BIOS, you will have to use a different command

1grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub

Finally, create the GRUB configuration

1grub-mkconfig -o /boot/grub/grub.cfg

Reboot

You may now reboot your system. If everything worked, you will be prompted for your cryptpassword. Try lsblk as a check. Try echo $LANG, which should return the language configurated

Connect to the internet

Finally, connect to the internet with Network Manager

1nmcli device wifi list
2nmcli device wifi connect $SSID password $PASSWORD
3ping quantalumin.com