arch_install.txt

Thinkpad T14s Gen2 Ryzen 4650U

cat <<EOT > /etc/modprobe.d/sound.conf
options snd_hda_intel enable=1 index=0
options snd_hda_intel enable=0 index=1
EOT

cat <<EOT > /etc/modprobe.d/nobeep.conf
blacklist pcspkr
EOT

cat <<EOT > /etc/modprobe.d/thinkpad_acpi.conf
options thinkpad_acpi fan_control=1
EOT

$ grep GRUB_CMDLINE_LINUX_DEFAULT /etc/default/grub
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash net.ifnames=0 initcall_blacklist=elants_i2c_driver_init"

$ cat /etc/bluetooth/main.conf
AutoEnable=false

# Arch install on Thinkpad T14 AMD Ryzen 4650U

* download the install ISO
* create install USB key
    * `dd bs=4M if=path/to/archlinux-version-x86_64.iso of=/dev/sdX conv=fsync oflag=direct status=progress`
* boot (installing to /dev/sdb)
* configure wifi
    `iwctl`
    `device list`
    `station wlan0 scan`
    `station wlan0 get-networks`
    `station wlan0 connect`
* partitioning
    * https://jherrlin.github.io/posts/arch-install/
    * `gdisk /dev/sdb`
        # Remove all partitions
        # Create two new partitions
        # +1GB           EF00   EFI and boot
        # rest of disk   8300   home and system

        mkfs.fat -F32 /dev/nvmw0n1p1

        rmmod pcspkr

        # Create LUKS device
        # Check the results
        # Create header backup
        # Mount the device
        cryptsetup -v --use-random luksFormat /dev/nvmw0n1p2
        cryptsetup luksDump /dev/nvmw0n1p2
        cryptsetup luksHeaderBackup /dev/nvme0n1p2 --header-backup-file luks_header_backup_`date +%Y-%m-%d`
        cryptsetup luksOpen /dev/nvmw0n1p2 cryptroot

        # Enable trim
        $ cryptsetup --allow-discards --persistent refresh cryptroot
        # Check
        $ cryptsetup luksDump /dev/nvme0n1p2 | grep Flags
        Flags:          allow-discards
        $ systemctl enable --now fstrim.timer

        # Disable automatic update of restic
        $ vim /etc/pacman.conf
        IgnorePkg = restic

        # Create file system on luks device
        mkfs.ext4 /dev/mapper/cryptroot

        # Mount partitions
        mount /dev/mapper/cryptroot /mnt
        mkdir -p /mnt/boot
        mount /dev/nvmw0n1p1 /mnt/boot

        pacstrap /mnt base base-devel linux linux-firmware git emacs sudo networkmanager bash-completion

        genfstab -pU /mnt >> /mnt/etc/fstab

        arch-chroot /mnt /bin/bash

        timedatectl set-timezone Europe/Bratislava

        hwclock --systohc --utc

        echo "neverland" > /etc/hostname

        vim /etc/locale.gen
        # uncomment:
        # en_US.UTF-8 UTF-8
        # sk_SK.UTF-8 UTF-8
        # hu_HU.UTF-8 UTF-8

        locale-gen

        echo LANG=en_US.UTF-8 > /etc/locale.conf
        echo LANGUAGE=en_US >> /etc/locale.conf
        echo LC_ALL=C >> /etc/locale.conf

        passwd

        groupadd davs
        useradd -m -g davs -G wheel,video,disk davs
        passwd davs

        visudo
        # uncomment `%wheel ALL=(ALL:ALL) NOPASSWD: ALL`

        emacs /etc/mkinitcpio.conf
        # Open mkinitcpio.conf and add the following to each section:
        # MODULES=(ext4)
        # On 'HOOKS' add 'encrypt' before 'filesystem'
        # Something like this:
        # HOOKS=(base udev autodetect modconf block encrypt filesystems keyboard fsck)

        mkinitcpio -p linux

        bootctl --path=/boot install

        echo 'default arch' >> /boot/loader/loader.conf
        echo 'timeout 5' >> /boot/loader/loader.conf

        blkid -s PARTUUID -o value /dev/XXX2 >> /boot/loader/entries/arch.conf

        pacman -S vim neovim tree alacritty acpi fwupd htop iotop powertop thuner openssl openssh pass git amd-ucode net-tools
        pacman -S xf86-video-amdgpu libva-mesa-driver mesa-vdpau vlc firefox ttf-liberation ttf-droid noto-fonts ttf-bitstream-vera ttf-dejavu
        pacman -S xorg-server xorg-server-common inetutils
        pacman -S go dmidecode xterm i3-wm tlp xorg-xrdb xorg-apps pasystray network-manager-applet blueman
        pacman -S dmenu xss-lock i3status ripgrep bat fd dust fzf lm_sensors brightnessctl ttf-font-awesome pipewire-pulse pipewire-alsa mpv smplayer ffmpeg acpi jdk11-openjdk reflector
        pacman -S rsync curl redshift scrot
        pacman -S cpupower xdg-user-dirs zathura
        pacman -S gimp alsa-utils
        pacman -S nginx

        # https://github.com/Jguer/yay
        cd /tmp; pacman -S --needed git base-devel && git clone https://aur.archlinux.org/yay.git && cd yay && makepkg -si
        cd

        yay -S dex seahorse gnome-keyring polkit-gnome oxygen-icons ibus strace fstrim rofi
        yay -S python-pynvim gnome-session dunst
        yay -S yarn jq docker-compose docker docker-buildx run-parts networkmanager-openvpn python-i3ipc xclip direnv python-poetry bash-completion symlinks geeqie perl-json perl-json-xs thunar-archive-plugin xarchiver

        vi /boot/loader/entries/arch.conf
        # Add the following content to arch.conf
        # The partition <PARTUUID> is already in the file.
        title Arch Linux
        linux /vmlinuz-linux
        initrd /amd-ucode.img
        initrd /initramfs-linux.img
        options cryptdevice=PARTUUID=<PARTUUID>:cryptroot root=/dev/mapper/cryptroot net.ifnames=0 initcall_blacklist=elants_i2c_driver_init rw

        vi /boot/loader/entries/arch-lts.conf
        # Add the following content to arch.conf
        # The partition <PARTUUID> is already in the file.
        title Arch Linux LTS
        linux /vmlinuz-linux-lts
        initrd /amd-ucode.img
        initrd /initramfs-linux-lts.img
        options cryptdevice=PARTUUID=<PARTUUID>:cryptroot root=/dev/mapper/cryptroot net.ifnames=0 initcall_blacklist=elants_i2c_driver_init rw

        # Exit new system and go into the cd shell
        exit

        # Unmount all
        umount -R /mnt

        # Reboot system
        shutdown -r now
* after reboot
systemctl start NetworkManager
systemctl enable NetworkManager
nmcli device wifi connect <SSID|BSSID> password <password>

https://wiki.archlinux.org/title/Ryzen
https://wiki.archlinux.org/title/AMDGPU

pacman -S xf86-video-amdgpu vulkan-radeon libva-mesa-driver mesa-vdpau
pacman -S vlc firefox ttf-liberation ttf-droid ttf-bitstream-vera ttf-dejavu noto-fonts
pacman -S lightdm-gtk-greeter
systemctl enable lightdm
groupadd -r autologin
gpasswd -a davs autologin

# In firefox set in about:config
layout.css.devPixelsPerPx = 1.3
full-screen-api.ignore-widgets = true

yay -S accountsservice # for dbus/pam/keyring
yay -S xinit-xsession gvfs thunar-volman
yay -S dex nitrogen i3lock dhcpcd

systemctl start bluetooth
systemctl enable bluetooth

systemctl start avahi-daemon
systemctl enable avahi-daemon

systemctl start nginx
systemctl enable nginx

systemctl start docker
systemctl enable docker

systemctl start tlp
systemctl enable tlp

vim /etc/lightdm/lightdm.conf
# autologin-user=davs
# autologin-session=xinitrc

vim /etc/pam.d/lightdm-autologin
# at the end of auth section
auth optional pam_gnome_keyring.so
# at the end of session section
session optional pam_gnome_keyring.so auto_start

yay -S gnome-keyring polkit-gnome seahorse  # change keyring password

vim gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
NoDisplay=true

# check /etc/xdg/autostart directory (nm-applet pasystray blueman-applet)

# Run as user to disable bluetooth by default
gsettings set org.blueman.plugins.powermanager auto-power-on false

# Use ibus for layout switching. Start with `ibus-daemon`

# Passwords:
# secret-tool store --label='My label' password my_service
Password: *input*
# secret-tool lookup password my_service
*input*

# To use different SSH key for a project in git:
git config core.sshCommand "ssh -i ~/.ssh/id_rsa_example -F /dev/null"

yay -S programmer-calculator # pcalc
yay -S pamixer
yay -S upower
yay -S gron

Use KeepassXC as system keyring
https://wiki.chucknemeth.com/linux/security/keyring/keepassxc-keyring
# Enable SecretService in KeeypassXC
$ systemctl --user disable gnome-keyring-daemon.service
$ systemctl --user disable gnome-keyring-daemon.socket
$ sudo systemctl --global disable gnome-keyring-daemon.socket
$ clear them in /etc/xdg/autostart
$ create files ~/.config/autostart/{gnome-keyring-pkcs11.desktop,gnome-keyring-secrets.desktop,gnome-keyring-ssh.desktop} with the content:
[Desktop entry]
Hidden=true

Emoji in fonts
yay -S ttf-twemoji
# then make the symlink into /etc/fonts/conf.d it wants

# Decrypt luks via USB
https://gabmus.org/posts/full-disc-encryption-with-usb-unlock/

- mkfs.vfat -F 32 -n ENC /dev/sdX1
- create key dd if=/dev/urandom of=/mnt/key.lek bs=4096 count=1
- cryptsetup luksAddKey /dev/sdx2 /mnt/key.lek
- add 'vfat' to MODULES in /etc/mkinitcpio.conf
- regenerate initramfs 'mkinitcpio -P'
- add 'cryptkey=UUID=*PARTITION-UUID*:vfat:/key.lek' to /boot/loader/entries/* . Also add 'rootdelay=3' so that there is no 10 second delay without key

# subuid

sudo usermod --add-subuids 100000-165535 davs
sudo usermod --add-subgids 100000-165535 davs