btrfs on luks

pacstrapit is meant for provisioning physical hardware. It assumes you have no need for dual-booting Windows, and that you are comfortable working on the command line.

Instructions

1. Burn LiveCD/LiveUSB with latest Arch ISO
2. Boot from LiveCD/LiveUSB
3. Connect to the Internet: wifi-menu -o
4. Download pacstrapit: curl -k https://codeload.github.com/atweiden/{pacstrapit}/{tar.gz}/{0.10.0} -o "#1-#3.#2"
5. Extract: tar xvzf pacstrapit-0.10.0.tar.gz
6. Customize defaults (recommended even if using cmdline flags or environment variables)

WARNING: failure to give appropriate values could cause catastrophic data loss and system instability.

Defaults:

cd pacstrapit-0.10.0 && $EDITOR pacstrapit

Done.

Usage

Run pacstrapit for a capable headless persistent USB installation in /dev/sdb:

./pacstrapit start --bundle    "base"                     \
                   --username  "newusername"              \
                   --userpass  "your new user's password" \
                   --rootpass  "your root password"       \
                   --lukspass  "your LUKS password"       \
                   --hostname  "yourhostname"             \
                   --partition "/dev/sdb"                 \
                   --processor "other"                    \
                   --graphics  "intel"                    \
                   --disk      "usb"                      \
                   --luksname  "infinity"                 \
                   --locale    "en_US"                    \
                   --keymap    "us"                       \
                   --timezone  "America/Los_Angeles"

...use the select option instead of bundle for more control:

./pacstrapit start --select    "base gui python nim"      \
                   --dotfiles                             \
                   --username  "newusername"              \
                   --userpass  "your new user's password" \
                   --rootpass  "your root password"       \
                   --lukspass  "your LUKS password"       \
                   --hostname  "yourhostname"             \
                   --partition "/dev/sdb"                 \
                   --processor "other"                    \
                   --graphics  "intel"                    \
                   --disk      "usb"                      \
                   --luksname  "infinity"                 \
                   --locale    "en_US"                    \
                   --keymap    "us"                       \
                   --timezone  "America/Los_Angeles"

Tip:

Omit --bundle and --select to create a very minimal headless system.

The base bundle adds CLI, vim, grsec and bitcoin pkgs

The lite bundle includes the base bundle plus GUI pkgs and dotfiles

The full bundle includes all pkgs and dotfiles

Run pacstrapit interactively:

./pacstrapit start -i

Tip:

Interactive mode allows you to manually select all important options. Use concealed mode (--concealed | -c) if you're only interested in manually inputting your user password, root password and LUKS password without echoing it to console.

...with ssh access to target machine enabled:

./pacstrapit start -i -s

...with verbose output:

./pacstrapit start -i -s -V

Run pacstrapit using default variables in config section, but with interactive password input:

./pacstrapit start --concealed

...with logging:

./pacstrapit start 2>&1 | tee pacstrapit.log

Run pacstrapit with username and password set from environment variables:

export USERNAME="sky"
export USERPASS="sailing"
./pacstrapit start

Run pacstrapit for a workstation installation:

./pacstrapit start --bundle    "full"                \
                   --username  "newusername"         \
                   --hostname  "yourhostname"        \
                   --partition "/dev/sda"            \
                   --processor "intel"               \
                   --graphics  "nvidia"              \
                   --disk      "ssd"                 \
                   --luksname  "infinity"            \
                   --locale    "en_US"               \
                   --keymap    "us"                  \
                   --timezone  "America/Los_Angeles" \
                   --concealed

If the script exits with an error, it's best to reboot and start fresh with a blank disk (shred -fvz -n 0 /dev/sdX).

Optional: sshd

If you intend to enable SSH access, you'll want to reset the values of _electrum_pubkey_default, _user_pubkey_default, and _user_pubkey_sig_default.

Before setting _ssh to 1...

On the control machine:

Make keys directory.

$ mkdir -p ~/keys

Generate ssh keys.

$ ssh-keygen -t ed25519 -b 521 -f ~/keys/id_ed25519

Get Electrum.

$ sudo pacman -S electrum

Generate an Electrum wallet.

$ electrum create -o

Pick an Electrum address for signing.

$ address_for_signing=$(electrum listaddresses | sed -n '2p' | tr -d '[:punct:]' | awk '{print $1}')

$ echo ${address_for_signing} > ~/keys/id_secp256k1.pub

$ electrum signmessage ${address_for_signing} "$(cat ~/keys/id_ed25519.pub)" > ~/keys/id_ed25519.pub.sig

Upload id_ed25519.pub, id_ed25519.pub.sig and id_secp256k1.pub to GitHub, or any other file hosting service reachable via curl.

Save the exact URL for each keyfile to the corresponding variable (_electrum_pubkey_default, _user_pubkey_default, _user_pubkey_sig_default).

Default packages

Minimum packages installed (excluding dependencies, base and base-devel groups):

Optional packages

Base packages (use --bundle "base" to include):

Additional packages are available.

Selecting all packages (GUI included) adds over 1.1 GB to the download and over 5.5 GB to the system image size. This is something to be aware of if installing on a slow Internet connection or to a small USB stick. An 8GB USB stick should work perfectly well, but free space would be very limited with all GUI packages included.

Optional: dotfiles

Set _dotfiles to 1 for:

Dotfiles

Licensing

This is free and unencumbered public domain software. For more information, see http://unlicense.org/ or the accompanying UNLICENSE file.