Arch Linux Setup with Encryption (LVM on LUKS)

Question

I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (Thinkpad X1 Carbon, ~ 500 GB SSD, 16 GB RAM):

0. [alignment gap] 1 MB
1. /boot 256 MB (FAT 32)
2. swap 16 GB (size of memory)
3. / (root) 64 GB (ext4)
4. /var 8 GB (ext4)
5. /tmp 4 GB (ext4)
6. /home ~400 GB (ext4, remainder)

The disk has the name nvme0n1. After booting the installer (September 2020 release) and connecting to the WiFi, I overwrite the disk with random data:

# shred --random-source=/dev/urandom --iterations=3 /dev/nvme0n1

Then I setup a new GPT partition schema:

# parted -s /dev/nvme0n1 mklabel gpt

Next, I create and format a boot partition with a 1 MB alignment gap in front of it.

# parted -s /dev/nvme0n1 mkpart boot fat32 1MiB 257MiB
# parted -s /dev/nvme0n1 set 1 esp on
# mkfs.fat -F 32 /dev/nvme0n1p1

Now comes the part, where the wiki is unclear. (It only mentions that it's possible to have /boot on a different device, which I don't.) I decided to make another partition, on top of which my encrypted volume will be located:

# parted -s /dev/nvme0n1 mkpart cryptlvm 257MiB '100%'

This creates a second partition /dev/nvme0n1p2 with the remainder disk size. (Maybe this step causes the problem.) I continue to setup the encryption:

# cryptsetup luksFormat /dev/nvme0n1p2     # YES, entering passphrase  twice
# cryptsetup open /dev/nvme0n1p2 cryptlvm  # entering passphrase
# pvcreate /dev/mapper/cryptlvm
# vgcreate VolumeGroup /dev/mapper/cryptlvm

Then I create the partitions as described above:

# lvcreate -L 16G VolumeGroup -n swap
# lvcreate -L 64G VolumeGroup -n root
# lvcreate -L 8G VolumeGroup -n var
# lvcreate -L 4G VolumeGroup -n tmp
# lvcreate -l '100%FREE' VolumeGroup -n home

The partitions are now being formatted:

# mkswap /dev/VolumeGroup/swap
# mkfs.ext4 -F /dev/VolumeGroup/root
# mkfs.ext4 -F /dev/VolumeGroup/var
# mkfs.ext4 -F /dev/VolumeGroup/tmp
# mkfs.ext4 -F /dev/VolumeGroup/home

And mounted:

# mount /dev/VolumeGroup/root /mnt

# mkdir /mnt/boot
# mount /dev/nvme0n1p1 /mnt/boot

# mkdir /mnt/var
mount /dev/VolumeGroup/var /mnt/var

# mkdir /mnt/tmp
mount /dev/VolumeGroup/tmp /mnt/tmp

# mkdir /mnt/home
mount /dev/VolumeGroup/home /mnt/home

The system can now be bootstrapped together with lvm2:

# pacstrap /mnt base liux linux-firmware lvm2

I also create and store the fstab:

# genfstab -U /mnt >> /mnt/etc/fstab

I chroot into the bootstrapped system:

# arch-chroot /mnt

As mentioned in the wiki, I add the hooks encrypt and lvm2 in /etc/mkinitcpio.conf:

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block filesystems fsck encrypt lvm2)

I continue with the usual setup tasks (setup root password, install base packages, set timezone, locale, language, hostname):

# passwd
# pacman -S iw wpa_supplicant dialog intel-ucode netctl dhcpcd
# ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime
# timedatectl set-ntp true
# hwclock --systohc
# echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen
# locale-gen
# echo 'LANG=en_US.UTF-8' > /etc/locale.conf
# echo -n 'x1' > /etc/hostname

Now comes the bootloader. Here I traditionally use the systemd bootloader instead of grub. Here's how I set it up:

# systemd-machine-id-setup
# bootctl --path=/boot install

I figure out the UUID (not PARTUUID) of the root partition as follows:

# blkid | grep /dev/VolumeGroup/root | egrep -o 'UUID="[^"]!"'
UUID="6d5b4777-2621-4bec-8bbc-ebd4b5ba9faf"

Then I create the boot entry in /boot/loader/entries/arch.conf:

title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=UUID=6d5b4777-2621-4bec-8bbc-ebd4b5ba9faf:cryptlvm root/dev/VolumeGroup/root

And an accordng /boot/loader/loader.conf:

default arch
timeout 0
editor  0

Last but not least, I run mkinitcpio, before leaving for a fresh boot:

# mkinitcpio -P
# exit
# umount -R /mnt
# shutdown -h now

So that was my setup procedure. I remove the USB dongle and boot the system. The bootloader shows up, but then I get the following screen:

:: running early hook [udev]
Starting version 246.6-1-arch
:: running early hook [lvm2]
:: running hook [udev]
:: Triggering uevents...
:: running hook [encrypt]
Waiting 10 seconds for device /dev/disk/by-uuid/6d5b4777-2621-4bec-8bbc-ebd4b5ba9faf ...
Waiting 10 seconds for device /dev/VolumeGroup/root ...
ERROR: device '/dev/VolumeGroup/root' not found. Skippng fsck.
:: mounting '/dev/VolumeGroup/root' on real root
mount: /new_root: no filesystem type specified.
You are now being dropped into an emergency shell.

Now I'm pretty clueless what I've done wrong. One suspicion is the second partition (/dev/nvme0n1p2) that I needed to create. Another suspicion is that I did something wrong with the bootloader. On regular setups, I always use the PARTUUID instead of the UUID. (However, there's no PARTUUID in the output of blikd, so this probably isn't the issue.)

Answer 1

Since @frostschutz hasn't written his correct solution to the problem as an answer yet, I'll summarize the issue here quickly: I picked the UUID of the wrong partition. The root partition under /dev/VolumeGroup/root is not the one to be chosen, but the actual partition /dev/nvme0n1p2. Here's how to extract that UUID:

# uuid=$(blkid --match-tag UUID -o value /dev/nvme0n1p2)

Which then can be used in the boot loader entry config:

# cat <<EOF >/boot/loader/entries/arch.conf
title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=UUID=${uuid}:cryptlvm root=/dev/volgrp/root
EOF

I summarized the whole procedure on my private website. Thanks also to @Cbhihe for the advice on partition sizes.