https://docs.daper.io/install-linux/installation/index.htmlRecent content in Installation on DocumentationHugo -- gohugo.ioen-ushttps://docs.daper.io/install-linux/installation/convert-luks2/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/convert-luks2/index.htmlWhen installing, select the option to install with encryption, this will install Manjaro with LUKS1 encryption. After successful installation, do not restart the system. Instead open a terminal and umount and close the partitions. umount /dev/mapper/luks-* cryptsetup close /dev/mapper/luks-* Then convert both partitions to LUKS2 with # root cryptsetup convert --type luks2 /dev/nvmen0p2 # swap cryptsetup convert --type luks2 /dev/nvmen0p3https://docs.daper.io/install-linux/installation/systemd-boot/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/systemd-boot/index.htmlConvert Grub to Systemd-boot https://saligrama.io/blog/post/upgrading-personal-security-evil-maid/ Now chroot on your new system. cryptsetup open /dev/nvme0n1p2 root mount /dev/mapper/root /mnt cd /mnt mount /dev/nvme0n1p1 efi mount -t proc /proc proc/ mount --rbind /sys sys/ mount --rbind /dev dev/ chroot . And execute pacman -Rc grub to remove grub. Make place for $esp mkdir /efi Create a variable (efidevice) for the terminal session holding the identity of your $esp partition efidevice=$(findmnt /boot/efi -no SOURCE) Unmount $esp from the current mountpointhttps://docs.daper.io/install-linux/installation/yubikey-fido2/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/yubikey-fido2/index.html https://wiki.archlinux.org/title/Universal_2nd_Factor#Data-at-rest_encryption_with_LUKS https://en.opensuse.org/SDB:LUKS2,_TPM2_and_FIDO2#Decryption_using_FIDO2_2 https://saligrama.io/blog/post/upgrading-personal-security-evil-maid/ https://bbs.archlinux.org/viewtopic.php?id=265134 Install Manjaro with disk encryption and boot to the newly installed system. Now install dependencies: yay -S libfido2 This will install also libcbor as dependency. Now enroll both partitions with: systemd-cryptenroll --fido2-device=auto /dev/nvme0n1p2 systemd-cryptenroll --fido2-device=auto /dev/nvme0n1p3 That will prompt to press the yubikey few times. Edit your /etc/kernel/cmdline or create if not exists by copying from /proc/cmdline and add the following parameters: rd.luks.name=f863ebf3-8735-48c7-88b1-e7fe1b0ae8a6=root rd.luks.options=fido2-device=auto root=/dev/mapper/roothttps://docs.daper.io/install-linux/installation/mkinitcpio/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/mkinitcpio/index.htmlhttps://wiki.archlinux.org/title/Universal_2nd_Factor#Data-at-rest_encryption_with_LUKS “Since version 248, systemd can be use to unlock a LUKS partition using a FIDO2 key.” For the current setup, this is what I have. Here it needs to ensure that the modules listed there are really necessary. Also the busybox hooks are completely removed and it depends only on systemd’s ones. # vim:set ft=sh MODULES="usbhid xhci_hcd i915" BINARIES=() FILES="" HOOKS="systemd autodetect block keyboard sd-vconsole sd-encrypt filesystems fsck" Here I created another preset at /etc/mkinitcpio.https://docs.daper.io/install-linux/installation/uki/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/uki/index.htmlhttps://wiki.archlinux.org/title/Unified_kernel_image Create or edit /etc/kernel/cmdline as follows. I have changed the default crypt volumes mapping names. Ensure it has no rd.luks.* or luks.* parameters. lang=en_US keytable=es tz=Europe/Madrid misobasedir=manjaro misolabel=MANJARO_SWAY_2204 quiet loglevel=3 systemd.show_status=auto rd.udev.log_level=3 bgrt_disable systemd.show_status=1 driver=nonfree nouveau.modeset=0 i915.modeset=1 radeon.modeset=1 root=/dev/mapper/root resume=/dev/mapper/swap Now in order to not decrypt twice the volumes. Keep the decryption key stored on /crypto_keyfile.bin. And the /etc/crypttab as follows. # <name> <device> <password> <options> root UUID=<UUID> /crypto_keyfile.https://docs.daper.io/install-linux/installation/splash-logo/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/splash-logo/index.htmlConvert the file to BPM truecolor with convert "$1" -type truecolor "$1.bmp" Add the logo file to the FILES section of the /etc/mkinitcpio.conf. And the vfat module. MODULES="usbhid xhci_hcd i915 vfat" FILES="/home/david/Pictures/logo.bmp" Then edit your preset(s) under /etc/mkinitcpio.d/<preset>.preset. And add the following fallback_options="-S autodetect --splash /home/david/Pictures/logo.bmp" default_options="--splash /home/david/Pictures/logo.bmp"https://docs.daper.io/install-linux/installation/secure-boot/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.daper.io/install-linux/installation/secure-boot/index.htmlhttps://whynothugo.nl/journal/2021/06/11/a-simple-boot-setup-with-secureboot/ Go to the BIOS and enable the option to be able to update the keys. Also, if you have not done it yet, set a password for the BIOS . # Execute the following instructions as root # 2. Install sbctl pacman -S sbctl # 3. Create a keypair # The private key in this keypair is used to sign all # EFI code loaded at boot, which means that without the # signature, you will not be able to boot into Linux.