View source for Rootfs over encrypted lvm

This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product.  boot is not encrypted.

== Prepare the hard drive and partitions ==
*List the device to be partitioned, mine is on /dev/sdc
{{console|body=
###i## lsblk -o name,size,label,partlabel
}}

==Partition==
{{console|body=
###i## cgdisk /dev/sdc}}

delete everything.

{{console|body=
Command: ##i## new ↵
First sector: ##i##↵
Last sector: ##i##+1M ↵
Hex Code: ##i##EF02 ↵
Enter name: ##i##BIOS Boot ↵
}}

scroll down to large chunk of free space:
{{console|body=
Command: ##i##new ↵
First sector: ##i##↵
Last sector: ##i##+128M ↵
Hex Code: ##i##EF00 ↵
Enter name: ##i##BOOT ↵
}}

scroll down to large chunk of free space:
{{console|body=
Command: ##i##new ↵
First sector: ##i##↵
Last sector: ##i##↵
Hex Code: ##i## 8304 ↵
Enter name: ##i##FUNTOO ↵
}}

{{console|body=

                              Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO
}}

{{console|body=
Command: ##i##write ↵
Command: ##i##quit ↵
}}

== Encrypting the drive ==

{{console|body=
# ##i##cryptsetup luksFormat --type luks2 --label=FUNTOO /dev/sdc3
}}

== Unlock the volume ==
Unlock the volume:
{{console|body=
###i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
}}

== Create logical volumes ==
{{console|body=
###i## pvcreate /dev/mapper/dmcrypt_root
###i## vgcreate vg /dev/mapper/dmcrypt_root          
###i## lvcreate -L2G --name swap vg
###i## lvcreate -l 100%FREE --name root vg 
}}

=== Create a filesystem on volumes ===

{{console|body=
###i## mkfs.vfat -F 32 /dev/sdc2
###i## fatlabel /dev/sdc2 "BOOT"
###i## mkswap /dev/mapper/vg-swap
###i## mkfs.ext4 /dev/mapper/vg-root
}}

=== Mount your partitions ===

{{console|body=
###i## swapon /dev/mapper/vg-swap
###i## mkdir /mnt/funtoo
###i## mount /dev/mapper/vg-root /mnt/funtoo
###i## mkdir  /mnt/funtoo/boot
###i## mount /dev/sdc2 /mnt/funtoo/boot
}}

==Get Funtoo Gnome==
You can pull your [[Subarches]] gnome tarball if you wish:

{{console|body=
###i## cd /mnt/funtoo
###i## wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
###i## tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*
}}

==Load Funtoo==
*expand your run tmpfs to be half of your ram:
{{console|body=
###i## mount -t tmpfs tmpfs /run
}}

=== mount ===
*mount up:
{{console|body=
###i## cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev
mount --rbind /run run
}}

=== chroot ===
*chroot in:
{{console|body=
###i## cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
}}

*Set yo password:
*set yo hostname:
*set cloudflare dns resolution for installing:
*Set yo time zone:

{{console|body=
###i## passwd
###i## echo 'hostname="crypto"' > /etc/conf.d/hostname
###i## echo "nameserver 1.1.1.1" > /etc/resolv.conf
###i## ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
}}

=== fstab ===
*Deploy your fstab:

{{console|body=
###i## cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
EOF
}}

*Deploy your crypttab:

{{console|body=
###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
}}

=== compile in ram ===
*compile in ram:
{{console|body=
###i## echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
}}

*Sync:
{{console|body=
###i## ego sync
}}

*Deploy your ego profile:
{{console|body=
###i## ego profile mix-in encrypted-root
}}

*Deploy your package.use file:
{{console|body=
###i## cat > /etc/portage/package.use << "EOF"
*/* device-mapper lvm luks
sys-kernel/linux-firmware initramfs
EOF
}}

*merge stuff:

{{console|body=
###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
}}

*add required services:
{{console|body=
###i## rc-update add device-mapper sysinit
###i## rc-update add dmcrypt sysinit
###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
}}

*deploy dmtab:
{{console|body=
###i## dmsetup table >> /etc/dmtab
}}

== Bootloader Configuration ==
=== /etc/boot.conf ===

<pre>
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=LABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/vg-root ro rootfstype=ext4 resume=swap:/dev/mapper/vg-swap
}
</pre>

== GRUB ==
*Install grub in legacy mode:
{{console|body=
###i## grub-install --target=i386-pc /dev/sdc 
###i## ego boot update}}

=== EFI from Legacy ===

*manually make efi directory:
*remount /dev/sdc2 to /boot/efi:
*install efi images:
{{console|body=
###i## mkdir /boot/efi
###i## mount /dev/sdc2 /boot/efi
###i## grub-install --target=x86_64-efi /boot/efi
}}

=== EFI from EFI ===

{{console|body=
###i##mount -o remount,rw /sys/firmware/efi/efivars
###i##grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sdc
###i##ego boot update
}}

=== Final steps ===
exit chroot, unmount, and close encrypted drive.

{{console|body=
###i## exit
###i## swapoff /dev/dm-1
###i## cd ..
###i## umount -lR funtoo
###i## vgchange -a n
###i## cryptsetup luksClose dmcrypt_root
}}

==management==
=== Change your LUKs-encrypted drive's passphrase ===
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

{{console|body=
# ##i##cryptsetup luksChangeKey /dev/sdx3
}}

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase.
You will not be asked to confirm your new passphrase, so be careful when running this operation.

== Additional links and information ==
* [https://www.freedesktop.org/software/systemd/man/crypttab.html crypttab]
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
* [https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS arch encrypt entire system]
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]

[[Category:HOWTO]]