website/content/post/parabola-install-guide/index.md

title	description	date	image	categories	tags
Parabola Installation Guide	A recap of the commands needed to have an encrypted, openRC Parabola setup.	2024-02-08 00:00:00+0000	parabola.jpg	Linux Parabola	linux parabola systemd

This is a guide on how to install parabola that i created to have a reference for my eventual future installations on a librebooted system. I decided to write this because I found that following the original guide in the Parabola wiki was not sufficient if you want to have an encrypted disk and no systemd in your system. Still, this is to be considered just a recap of what you will need to to if you want to install Parabola this way, do not consider this official (or even unofficial) documentation at all.

some info on Parabola GNU/Linux-libre

I will assume that you already created a bootable drive of some kind with an image of Parabola CLI Edition that you can download from here: download
I won't cover how to do so because there are already hundreds of guides that perfectly teach you how to do it on every system with every image using every technique available.

Check if you have a UEFI machine or not

Type the following command to check if you have a UEFI machine or not, and keep that in mind, we will use this information later

ls /sys/firmware/efi/efivars

Format your drive

The choice of partitions and filesystems is a matter of preference, and beyond the scope of this install guide. You can look at the Parabola wiki to know more. If you already know what do you want and how you want it, you can skip this part.

Proceed to format the drive you be installing Parabola on. I use fdisk, the most basic things you need to know about it are: type d to delete a partition (will ask number), type n to create a partition (will ask usual info), type w to confirm the changes.

Lets target the drive:

fdisk /dev/sdX

Assuming you deleted any existing partition, the next is to create two partitions, the first one will be a 1Gb partition and the second one will be the rest of the disk (or anyhow how much space yo want on your system) This is just the way i do it, you might find your needs are different.

Command (m for help): n
Partition type
   p   primary (0 primary, 0 extended, 4 free)
   e   extended (container for logical partitions)
Select (default p):

Using default response p.
Partition number (1-4, default 1):
First sector (2048-30277631, default 2048):
Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-30277631, default 30277631): +1G

Created a new partition 1 of type 'Linux' and of size 1 GiB.

Then we are gonna create the second partition, you can press enter and use the default values for every option, you will have something similar to this:

Command (m for help): n
Partition type
   p   primary (0 primary, 0 extended, 4 free)
   e   extended (container for logical partitions)
Select (default p):

Using default response p.
Partition number (1-4, default 1):
First sector (2048-30277631, default 2048):
Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-30277631, default 30277631):

Created a new partition 1 of type 'Linux' and of size X.XX GiB.

Modify the last sector if you need a specific amount of memory or leave it blank to take the entire free space of your drive. It might ask you to remote an already present signature, in that case just remote it by pressing Y when asked to.

Filesystem of boot partition

We are now gonna put a filesystem on the first partition, I use FAT partitioning because it is versatile since it's compatible with both legacy boot and UEFI.

mkfs.fat -F32 /dev/sdX1

Encrypt the second partition

To encrypt out partition we run the command:

cryptsetup luksFormat /dev/sdX2

You be ask to confirm the choice by typing YES and you will be asked to insert the passphrase for the partition.

Decrypt sdX2

cryptsetup open /dev/sdX2 partition-name

We now decrypt the partition and assign a name to it (the name can be a random string, it will change later anyhow) If we now run lsblk we should see something like this: `` NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS nvme0n1 259:0 0 476.9G 0 disk ├─nvme0n1p1 259:1 0 1G 0 part
└─nvme0n1p2 259:2 0 475.9G 0 part └─partition-name 254:0 0 475.9G 0 crypt

Create filesystem for partition-name

Create a btrfs partition on the decrypted partition

mkfs.btrfs dev/mapper/partition-name

Mount both partition

Mount the two partitions starting with partition-name:

mount /dev/mapper/partition-name /mnt

Then create a directory called boot:

mkdir /mnt/boot

And then mount the boot partition in the boot folder:

mount /dev/sdX1 /mnt/boot

If you now run lsblk again you should see the partition correctly mounted:

NAME                MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme0n1             259:0    0 476.9G  0 disk
├─nvme0n1p1         259:1    0     1G  0 part  /mnt/boot
└─nvme0n1p2         259:2    0 475.9G  0 part
  └─partition-name  254:0    0 475.9G  0 crypt /mnt

(optional) Change mirrors

You might want to change the mirrors order to make installation of packages faster by going into this file (use your favorite text editor):

/etc/pacman.d/mirrorlist

From the list, move the servers that are closer to you to the top so that they will be the first ones to be chosen.

Install packages into the system

Install the needed packages into the /mnt partition, add what you know you will need:

pacstrap /mnt base base-devel linux-libre linux-libre-firmware btrfs-progs grub networkmanager cryptsetup lvm2 vim neovim

If you're in UEFI then add the following package: efibootmgr

• base and base-devel:
  base is the basic system and all the tools related to it, base-devel is necessary to compile packages and other stuff
• linux-libre:
  the libre version of the linux kernel, with no binary blobs, obfuscated code, or code released under proprietary licenses
• linux-libre-firmware:
  Some hardware devices such as the popular NetGear WNA1100 (aka: Wireless-N 150, aka: Atheros AR9271) require firmware (eg: ath9k_htc) from the linux-libre-firmware package
• grub:
  the boot loader
• networkmanager:
  internet 'n stuff
• cryptsetup and lvm2:
  packages needed for encrypting and decrypting the drive
• vim and neovim:
  i mean you know why

Chroot into your system

arch-chroot /mnt bash

Set the timezone and set the hardware clock

just run:

ln -s /usr/share/zoneinfo/Europe/Rome /etc/localtime

Change country and city based on your correct timezone Then synch the hardware clock with the system clock:

hwclock --systhoc

Setup keyboard layout and language

Edit the locale.gen file:

nvim /etc/locale.gen

Uncomment the your language and layout of choice

Edit the file locale.conf:

nvim /etc/locale.conf

I will add the setup for the US keyboard but you might want a different layout:

export LANG="en_US.UTF-8"
export LC_COLLATE="C"

Run the locale-gen command:

locale-gen

Name your computer

Run:

echo "myhostname" > /etc/hostname

change myhostname with your desired name, then edit the following file:

nvim /etc/hosts

and add the following lines:

127.0.0.1   localhost
::1         localhost
127.0.1.1   myhostname.localdomain myhostname

Enable NetworkManager service

run:

systemctl enable NetworkManager.service

Add a user and set his groups and password

First add a password to your root with:

passwd

Then create a new user:

useradd -G wheel -m user

this way a user by the name of user has been created, added to the wheel group and a home directory has been created for him Set the user user password:

passwd user

Edit the mkinitcpio configuration

Edit the mkinitcpio.conf file:

nvim /etc/mkinitcpio.conf

look for the line in which hooks are declared, it is going be like this:

HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block filesystem fsck)

add to the hooks encrypt and lvm2:

HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block encrypt lvm2 filesystem fsck)

Optionally you can add the following modules to same mkinitcpio.conf file:

hid usbhid hid_generic ohci_pci

If, at the end of the installation, the keyboard is not working during the decryption of the partition\

Update the conf by typing:

mkinitcpio -p linux-libre

Make the system able to decrypt the partition

Start by exiting the partition:

exit

Create an fstab and output it in the correct place:

# genfstab -p /mnt >> /mnt/etc/fstab

use -U or -L to define by UUID or labels, respectively

Take the output of lsblk -f in put it in the following file:

lsblk -f >> /mnt/etc/default/grub

Go back into your system:

arch-chroot /mnt bash

Edit GRUB to make the system able to encrypt and decrypt the partition

Enter the following file:

nvim /etc/default/grub

At the end of the file you will find the output of our lsblk -f command, it will be something similar to this:

NAME         FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sdb
nvme0n1
├─nvme0n1p1                     [UUID_0]      862.4M    16% /boot
└─nvme0n1p2                     [UUID_1]
  └─cryptlvm                    [UUID_2]      431.2G     9% /

You will only need the two UUIDs: [UUID_1] and [UUID_2]

And at the top of this file there will be a line that looks like this:

GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet" 

Now, take the UUID of the encrypted partition (in this case the UUID_1) and add the following to the GRUB_CMDLINE_LINUX_DEFAULT:

cryptdevice=UUID=[UUID_1]:cryptlvm

It will look something like this:

cryptdevice=UUID=33dd1b52-a543-4143-8bf8-004390e411e0:cryptlvm

Take the UUID of the decrypted partition (in this case the UUID_2) and add the following to the GRUB_CMDLINE_LINUX_DEFAULT:

root=UUID=[UUID_2]

It will look something like this:

root=UUID=b720a64e-fdf2-462e-9231-d1a35ae2654e

the GRUB_CMDLINE_LINUX_DEFAULT should look like this:

GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet cryptdevice=UUID=33dd1b52-a543-4143-8bf8-004390e411e0:cryptlvm root=UUID=b720a64e-fdf2-462e-9231-d1a35ae2654e" 

Install Grub bootloader

Install GRUB for UEFI devices:

esp denotes the mountpoint of the EFI system partition

grub-install --target=x86_64-efi --efi-directory=[esp] --bootloader-id=grub

Install GRUB for legacy BIOS devices

grub-install /dev/sdX

Then create the grub configuration:

grub-mkconfig -o /boot/grub/grub.cfg

Now you can unmount your partitions, remove your bootable device and reboot the system. You now a have a fully libre system, you chad.

Migrate to Open-RC

For maximum chad-status you have to remote systemD in favour of Open-RC, the Parabola wiki has a section on how to do so HERE

First, upgrade your currently installed packages from your currently configured repositories:

pacman -Syyuu

Then, add the following lines in /etc/pacman.conf:

[nonsystemd]
Include = /etc/pacman.d/mirrorlist

# Enable [nonsystemd-multilib] only if you have [multilib] enabled
#[nonsystemd-multilib]
#Include = /etc/pacman.d/mirrorlist

Next, replace your currently installed packages with those from the [nonsystem] repo.

pacman -Syyuu