An installation wizard makes two assumptions:

• It knows all the initial configurations a user may want
• It won’t explode in the user’s face

Arch, Gentoo, and Void Linux have very hand-tunable initial installations, so not only does a wizard become harder to make, but it’s often more worthwhile to have users understand their system and how to read its manuals. Plus, it’s fun to DIY!

That being said, if you have too much fun, then your system will be a shop car that never gets out of the garage.

Let’s install a wizardless Linux.

1. prepare a usb

• Get and verify a disk imagea bit-by-bit copy of a drive (Arch §1.1 - §1.2, Gentoo, Void)
  • If you plan to unload a rootfs tarballa TAR archive of everything under / onto your internal drive, you can use any distro’s disk image
  • Verify the image isn’t corrupted by checking if the image’s sha256sum hash is in your respective sha256sum.txt

    # Linux example
    $ grep "$(sha256sum linux-mint.iso)" sha256sum.txt
    # Windows example
    $ CertUtil -hashfile cool-linux-distro.iso SHA256
    $ find "PASTE_HASH_HERE" sha256sum.txt
    

  • Verify the image is authentic using a key verification (Arch §1.2, Gentoo, Void) (might need GPG4Win or minisign)
• Write the disk image onto a thumb drive, then boot
  • Click-and-drag the .iso image onto a Ventoy-formatted USB, or use Rufus, or see Gentoo § Writing
  • Boot from the thumb drive by either changing your computer’s boot order in the BIOS, or by entering your boot manager’s boot menu (C EXIT <ENTER> in a GRUB menu)

1.5 text

• If you aren’t QWERTY/US or your console font has a poor size, see Arch §1.5

• If needed, double a console font size via setfont -d

• Instead of using alt+arrow or ctrl+alt+function key, consider splitting the console with

  tmux or screen

  C refers to CTRL.

  action	tmux	screen
  split up/down	C-b, “	C-a, S
  split left/right	C-b, %	C-a, |
  change windows*	C-b, arrow keys	C-a, tab
  *initialize new area		C-a, s
  logout of area	C+d	C+a, Q

2. wifi

Unless you’re using ethernet, mobile tethering, or an offline install setup, connect to WiFi with

• Arch §1.7 - §1.8 (uses iwctl), or
• Gentoo § Networking (also introduces networking concepts such as IP, DHCP, DNS), or
• ArchWiki: wpa_supplicant.

For example,

# a. iwctl
$ iwctl station wlan0 connect mySSID

# b. wpa_supplicant (interface assumed to be wlp2s0)
$ wpa_supplicant -B -i wlp2s0 -c \
  <(wpa_passphrase mySSID myPassword)

# c. nmcli (if on some other distro)
$ nmcli dev wifi con mySSID --ask

Note that your system’s time cannot be wonky if you want SSL and HTTPS to work.

$ hwclock --systohc # or
$ chronyd -q # for Gentoo

3. diskpart

Gentoo § Disks introduces x86_64-efi disks immaculately, and ArchWiki: Partitioning also discusses disks for other systems (e.g. non-UEFI BIOS boot systems).

As a format-disk tool, fdisk (and its simpler curses TUI cfdisk) are safer to use for some compared to parted, as fdisk confirms the writing at the end of the total operations rather than at the end of each individual operation.

In general,

• Partition tables: use the more modern GPT instead of MBR whenever possible

• Boot sector (assuming GPT):

  • Check your system type with Arch §1.6
  • On a UEFI system, use a 512MiB-1GiB fat32 EFI partition
    • Mount at /efi or /boot. Gentoo recommends /efi
  • On a BIOS system, add a 1MiB BIOS boot
    • do not format this partition with a filesystem

• Swap partition or file (optional):

  • Pick a size based on your RAM with Gentoo § Disks § What about swap space?
  • Consider using a resizable swapfile or BTRFS’ builtin swap subvolume within your Linux filesystem rather than having a separate swap partition at all.
  • Reddit: Why use swap?

• Main Linux filesystem partition:

  • (optional) cryptsetup a LUKS partition and treat /dev/mapper/cryptroot_partition_name like you would /dev/sdaX. See Gentoo: dm-crypt, ArchWiki: dm-crypt, cht.sh/cryptsetup.

    What is LUKS?

    dm-crypt (frontend: cryptsetup) uses device mapper to map a block device like /dev/sda, and also encrypts the device with the kernel crypto API. source

    Linux Unified Key Setup is a spec that standardizes dm-crypt use. For example, LUKS adds a header that shows the encryption cipher used and contains the key (passwords unlock keys which unlock devices). source

    Back up the header safely. If you don’t like the header, you can either use dm-crypt plain mode (harder) or a detached LUKS header. See ArchWiki: Encrypting an entire system.

  • (optional) LVM — within the LUKS partition or without encryption — can be useful for an ext4 or xfs setup, due to LVM’s resizable partitions and snapshot system.

    • Why use LVM? AskUbuntu; tldp docs: LVM benefits on a small scale
    • How? tldp docs: LVM anatomy; rickellis example setup (snapshot setup excluded)

  • Actual filesystems:

    • Btrfs with compress=zstd is a high-speed disk-space saving common default
      • Btrfs subvolumes create “snapshot barriers”
    • ZFS is a Btrfs alternative that comes with its own encryption and reliable RAID abilities. However, license incompatibilities complicate the setup and may require the addition of a special repository. (Arch, Gentoo, Void)
    • ext4 is often used over xfs
      • easy to format: mkfs.ext4 or mkfs.xfs
      • do NOT support transparent compressionon-the-fly compression: Instead of the user zipping files manually, the filesystem zips and unzips any file upon access, halving space use.
        (usable in ZFS, Btrfs)

As an example, we’ll set up:

• a fat32 EFI partition on /dev/sda1
• Btrfs subvolumes that separate /, /var/log, and /home (and has /.snapshots)
  • /var/log: logfiles shouldn’t be rolled back if we roll back /
  • /home: rolling back user files doesn’t necessitate rolling back root
  • mount options:
    • noatime preserves SSDs by not wasting a write on file access times
    • compress=zstd means compress=zstd:3 (compress at Zstandard level 3)
      • Higher levels denote more CPU cycles spent in hope of deeper compression, though 3 is a well-respected default. One may increase level or consider a more fervent compress-force=zstd.

# Partition disk (assuming EFI system)
#   /dev/sda1  512MiB    EFI System
#   /dev/sda2  the rest  Linux filesystem
cfdisk /dev/sda

# Format boot sector: ESP (EFI System Partition)
#   On a BIOS system, the boot sector must
#   *instead* be /dev/sda1 as a 1MiB BIOS boot
#   partition, without a formatted filesystem
mkfs.fat -F32 /dev/sda1

# I will name my LUKS partition "cryptroot"
#   Name it as you please
#   Note: `--pbkdf pbkdf2` is for
#         LUKS2 + GRUB2 compatibility.
#         See savannah.gnu.org/bugs/?59409
#         and ArchWiki: Dm-crypt/Encrypting_an_entire_system
#                       bottom of § 1
cryptsetup luksFormat --pbkdf pbkdf2 /dev/sda2
cryptsetup luksOpen /dev/sda2 cryptroot

# BTRFS
#   Didn't LUKS? Use /dev/sda2 instead
#   Label this ROOT so you can differentiate
#   entries in lsblk -f (lists blocks with UUIDs)
mkfs.btrfs -L ROOT /dev/mapper/cryptroot
mount -t btrfs -o \
  noatime,compress=zstd \
  /dev/mapper/cryptroot --mkdir /mnt

# BTRFS subvolumes
#   @ is just a subvol naming convention.
#   Later, we'll unmount our BTRFS "holder"
#   thing, then mount the subvolumes
btrfs subvolume create /mnt/@
btrfs sub c /mnt/@home
btrfs sub c /mnt/@var_log
btrfs sub c /mnt/@snapshots
umount /mnt

# BTRFS subvolume mounting
mount -t btrfs -o \
  noatime,compress=zstd,subvol=@ \
  /dev/mapper/cryptroot \
  --mkdir /mnt
mount -t btrfs -o \
  noatime,compress=zstd,subvol=@home \
  /dev/mapper/cryptroot \
  --mkdir /mnt/home
mount -t btrfs -o \
  noatime,compress=zstd,subvol=@var_log \
  /dev/mapper/cryptroot \
  --mkdir /mnt/var/log
mount -t btrfs -o \
  noatime,compress=zstd,subvol=@snapshots \
  /dev/mapper/cryptroot \
  --mkdir /mnt/.snapshots

# Boot sector
mount /dev/sda1 --mkdir /mnt/efi

4. shove the base system in

Arch users using pacstrap should select mirrors now, since it will be copied from the base system to the new system (source):

# Arch example (needs reflector package)
reflector --country US --protocol https \
  > /etc/pacman.d/mirrorlist

To shove in the base system, either use your package manager (pacstrap or xbps):

# Arch example
#   Install btrfs-progs if you used btrfs
#   Consider installing a text editor (nano/vim/neovim)
#   Consider installing man(uals)
#   You may need to run `pacman -Sy archlinux-keyring`
pacstrap -K /mnt base linux linux-firmware man neovim btrfs-progs

# Void example
mkdir -p /mnt/var/db/xbps/keys
cp /var/db/xbps/keys/* /mnt/var/db/xbps/keys
XBPS_ARCH=x86_64-musl
REPO=https://repo-default.voidlinux.org/current/musl
xbps-install -S -r /mnt -R "$REPO" base-system

or verify and use a rootfs tarball (Arch, Gentoo, Void):

# Arch example (get tar.zst, tar.zst.sig, sha256sums.txt)
# NOTE: This is a lazy method unendorsed by the ArchWiki
SOME_MIRROR=https://mirror.rackspace.com/archlinux
LATEST=archlinux-bootstrap-x86_64.tar.zst
wget $SOME_MIRROR/iso/latest/$LATEST{,.sig}
wget https://archlinux.org/iso/latest/sha256sums.txt
sha256sum -c sha256sums.txt | grep --color $LATEST
gpg --keyserver-options auto-key-retrieve --verify \
  $LATEST.sig $LATEST
tar xpvf $LATEST --xattrs-include='*.*' --numeric-owner -C /tmp
# Copy everything lazily
cp --archive /tmp/root.x86_64/* /mnt
# And uncomment a nice mirror
vim /mnt/etc/pacman.d/mirrorlist

# Gentoo example (get .tar.xz, .tar.xz.asc, .tar.xz.sha256,)
SITE=https://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3-amd64-hardened-openrc
LATEST=$(curl -L $SITE \
  | grep -Eo 'stage3-amd64-hardened-openrc-[0-9]{8}T[0-9]{6}Z.tar.xz' \
  | sort | tail -1)
wget $SITE/$LATEST{.sha256,.asc,}
sha256sum -c $LATEST.sha256
wget -O - https://qa-reports.gentoo.org/output/service-keys.gpg \
  | gpg --import
gpg --verify $LATEST{.asc,}
tar xpvf $LATEST --xattrs-include='*.*' --numeric-owner -C /mnt

# Void example
SITE=https://repo-default.voidlinux.org/live/current/
LATEST=$(curl $SITE \
  | grep -Eo 'void-x86_64-musl-ROOTFS-[0-9]{8}.tar.xz' \
  | sort | tail -1)
wget $SITE/{$LATEST,sha256sum.sig,sha256sum.txt}
sha256sum -c sha256sum.txt | grep --color $LATEST
LATEST_DATE=$(echo $LATEST | grep -Eo '[0-9]{8}')
wget https://raw.githubusercontent.com/void-linux/void-packages/master/srcpkgs/void-release-keys/files/void-release-$LATEST_DATE.pub
minisign -V -p void-release-20240314.pub \
  -x sha256sum.sig -m sha256sum.txt
tar xpvf $LATEST --xattrs-include='*.*' --numeric-owner -C /mnt
# Yes, the Void rootfs guide only says tar xvf. They're wrong.

$ ls -l /sbin/unix_chkpwd
-rwsr-sr-x 1 user arch 26640 Apr 11 04:47 /sbin/unix_chkpwd

$ ls -l /sbin/unix_chkpwd
-rwxr-xr-x 1 user arch 26640 Apr 11 04:47 /sbin/unix_chkpwd

5. configure before boot

Now, based on Arch §3, we need to look at:

• Arch §3.1 file system table/etc/fstab says what filesystem should mount where

  • Remember currently mounted filesystems via UUID with the arch-install-scripts package’s command:

    $ genfstab -U /mnt > /mnt/etc/fstab
    

  • Or, copy things manually (why?) after splitting the screen. See Gentoo § Configuring the system § Filesystem information and ArchWiki: fstab.

• Arch §3.2 change rootCommands will treat /mnt, or whatever directory, as /

  • Use a wrapper (arch-chroot from arch-install-scripts, or Void’s xchroot)

    $ arch-chroot /mnt
    

  • or manually chroot. See Gentoo § Installing a base system § Chrooting
  • /etc/resolv.conf may need to be copied to the new environment beforehand

    $ cp --dereference /etc/resolv.conf /mnt/etc/
    

• If you untar’d a rootfs earlier, update your system.

  # Arch
  pacman-key --init
  pacman-key --populate
  pacman -Syu base linux linux-firmware man neovim
  # Void
  xbps-install -Su xbps
  xbps-install -u
  xbps-install base-system
  xbps-remove base-container-full
  # Gentoo
  # emerge-webrsync may be needed depending on firewall
  emerge --sync
  

  (command sources: Arch, Gentoo, Void)

• Arch §2.1/Gentoo/Void (optional) Configure mirrors

  • For Gentoo’s mirrorselect, space enables/disables a selection, enter hits OK
  • See above (start of section 4. shove system) for Arch reflector example

• Arch §3.3 - §3.4 localize timezone, locale

  # TIMEZONE =============
  # First:
  #   Find closest REGION/CITY by tab completion
  ls -l /usr/share/zoneinfo/REGION/CITY
  # Second:
  #   Declare timezone to your init system
  #   A: systemd (Arch) or runit (Void)
  ln -sf /usr/share/zoneinfo/REGION/CITY /etc/localtime
  hwclock --systohc
  #   B: OpenRC (Gentoo)
  echo "REGION/CITY" > /etc/timezone
  emerge --config sys-libs/timezone-data
  # Third:
  #   Init your time sync daemon
  #   A: systemd
  systemctl enable systemd-timesyncd
  #   B: OpenRC
  emerge --ask chrony
  rc-update add chronyd default
  #   C: runit
  xbps-install -y chrony
  sudo ln -sv /etc/sv/chronyd /var/service
  
  # LOCALE (e.g. US) =====
  # In /etc/locale.gen, uncomment:
  #   "en_US.UTF-8 UTF-8"
  #   and other locales. Then run:
  locale-gen
  # In /etc/locale.conf, set the LANG variable
  echo "LANG=en_US.UTF-8" > /etc/locale.conf
  

  sources: Gentoo § Installing base system § Timezone and Configure locales; Gentoo § Tools § Time synchronization; Void: Locales and Translations; Void: Date and Time

• Build confs

  • Gentoo (/etc/portage/make.conf)

    • Required for graphics: VIDEO_CARDS

      # AMD: 'amdgpu radeonsi'
      # Nvidia: 'nouveau' or proprietary 'nvidia'
      # Generic: 'intel' or ancient 'intel i915'
      VIDEO_CARDS="intel nouveau"
      

    • Safe: COMMON_FLAG “-march=native” for CPU-specific compilation (source)

      # Resolve "-march=native" if using distcc
      gcc -v -E -x c /dev/null -o \
        /dev/null -march=native 2>&1 | \
        grep /cc1 | grep mtune
      

      • There is also a RUSTFLAGS entry for this

    • Safe: Parallel jobs in MAKEOPTS

      • Minimum between free -h --giga and nproc

    • Safe: Tell packages what kind of assembly code your system can use via CPU_FLAGS_<ARCH>

    • Less safe: Changing -O

      • In general, higher -O values use more runtime memory/space. Hence, -O3 might lead to cache misses.
      • -O2 is the “recommended default”, though Rust’s default RUSTFLAGS compiles Rust programs at opt-level=3.

    • Wrangling required: LTO

      • Runtime RAM and performance may improve; compiling is slower and may be buggier

      • Some packages will have to be specifically excluded from LTO:

        # /etc/portage/env/no-lto
        USE="${USE} -lto"
        

        # /etc/portage/package.env
        # Uses /etc/portage/env files
        dev-build/cmake no-lto
        sys-libs/slang no-lto
        

        (source of example above)
        Note: package.env can be a directory or folder.
        Note: Don’t confuse package.env (individual package envs) with package.use (individual package override flags); see man 5 portage for file descriptions

    • More involved: PGO (for package-by-package use)

      • Some binary packages use this upstream, such as Firefox.

    • Not recommended: directly hardening make.conf (source)

      • Instead of make.conf, profiles are responsible for adding custom gcc hardening flags. See Gentoo: Hardened/Toolchain#Changes

    • Optional: Change your “profile”. The default profile is based on the rootfs image used — changing may not be necessary.

      eselect profile list
      eselect profile set TARGET
      

      Profiles configure default USE flags, CFLAGS, etc. outside of make.conf.

    • Optional: ACCEPT_LICENSE

      • Don’t care about licensing? Use all of them:

        ACCEPT_LICENSE="*"
        

    • Required: Kernel

      • Often, manual kernel setups add support for rare situations or remove “unneeded” software (which isn’t loaded until you need it anyway).
      • Get firmware. The odd-licensed linux-firmware is needed for much hardware; sof-firmware depends on your chip (search your model as shown in cat /proc/cpuinfo). Microcode exists too.

        mkdir /etc/portage/package.license
        echo sys-kernel/linux-firmware @BINARY-REDISTRIBUTABLE \
          > /etc/portage/package.license/linux-firmware
        emerge --ask linux-firmware
        

      • Kernel method 1: gentoo-kernel-bin (depends on installkernel)

        # dracut and grub are common choices
        # to aid booting the kernel
        echo sys-kernel/installkernel dracut grub \
          > /etc/portage/package.use/installkernel
        emerge --ask gentoo-kernel-bin
        

      • Kernel method 2: genkernel
      • Kernel method 3: via Makefile (like true cavemen)

  • (optional) Arch users (/etc/makepkg.conf) should see ArchWiki: makepkg §3

    • §3.2 Consider “-march=native” in CFLAGS
    • §3.4.2 Consider multithreading zstd and/or reducing compression level

      COMPRESSZST=(zstd -c -T0 --auto-threads=logical -15 -)
      

    • §3.3.1 Consider compiling with more cores

      MAKEFLAGS="--jobs=$(nproc)"
      

    • §3.3.5 Consider disabling debug

• Arch §3.5 network (NetworkManager)

  • $ echo "nice-hostname" > /etc/hostname
    # alternatively, after getting NetworkManager
    nmcli general hostname "nice-hostname"
    

  • Install and enable (Arch, Gentoo, Void) the NetworkManager daemon. Other network daemons may need to be disabled.
    • Gentoo: Consider enabling its highly common “dbus” use flag globally.
    • Daemons (services) are typically handled with:
      • Arch: systemd (cht.sh/systemctl)
        • systemctl enable --now SERVICE is the same as systemctl enable SERVICE && systemctl start SERVICE
      • Gentoo: OpenRC
        • See Alpine Linux Wiki: OpenRC and the manpages for openrc, rc-update, and rc-status
      • Void: runit (sv and ln)

• Arch §3.7 users and root (sudo or doas)

  • Create a root password, or don’t
  • Add users. See Gentoo § Finalizing § Adding a user for daily use

  # Root user
  #   password should be very secure
  #   leave password empty to disable
  passwd
  # Normal user (joe)
  #   lowercase is a good idea
  useradd -m -G users,wheel,audio joe
  passwd joe
  #   use "groups" to check groups
  
  # Installing and using sudo?
  #   Uncomment "%sudo ALL=(ALL) ALL"
  #     Lets users in the sudo group use sudo.
  #     Using "%wheel ALL=(ALL) ALL" exists too
  EDITOR=nano visudo
  groupadd sudo # in case it isn't there
  usermod -aG sudo joe
  # Installing and using doas?
  echo "permit :wheel" > /etc/doas.conf
  chmod -c 0400 /etc/doas.conf
  

• Arch §3.8 preparing to boot

  • Gentoo OpenRC guys need: a logger (e.g. sysklogd)
  • Get programs relating to your filesystems, e.g. btrfs-progs. See Gentoo § Tools § Filesystem tools
  • and install a bootloaderUEFI or MBR firmware load a tiny binary that loads a bootloader (GRUB) that finds out how to shove an initramfs (a tiny Linux) into RAM. Then, the initramfs mounts your storage stuff via fstab, and switches root to it, among other things.. See ArchWiki: GRUB § Installation and Gentoo § Bootloader
    • Gentoo OpenRC Dracut+GRUB example:
      • EFI System partition? /etc/portage/make.conf needs:

        GRUB_PLATFORMS="efi-64"
        

      • LUKS? /etc/default/grub needs cryptomount (GNU manual agrees) and UUID kernel parameters
        • kernel parameters: cryptdevice, maybe root (unneeded with grub), maybe swapfile resume, perhaps lvm, and usefully dracut safety stuff

        GRUB_ENABLE_CRYPTODISK=y
        GRUB_CMDLINE_LINUX=" cryptdevice=UUID=<use lsblk -f>:cryptroot rd.auto rd.luks=1 "
        

        and the system will need GRUB with the device-mapper USE flag, and cryptsetup (source)

        echo "sys-boot/grub:2 device-mapper" \
          > /etc/portage/package.use/sys-boot
        emerge --ask cryptsetup
        

        and /etc/dracut.conf needs to tell the initramfs what modules they need to decrypt LUKS during boot

        add_dracutmodules+=" crypt dm rootfs-block "
        

        and if /boot is part of the LUKS partition (encrypted), add a keyfile to the initramfs, using dracut install_items and rd.luks.key with :/ at the end

        # With OpenRC/dracut, it doesn't matter where you
        # store or name the key, as long as it is consistent
        mkdir /etc/cryptsetup-keys.d
        dd bs=512 count=4 if=/dev/random \
          of=/etc/cryptsetup-keys.d/cryptroot.key iflag=fullblock
        chmod 600 /etc/cryptsetup-keys.d/cryptroot.key
        cryptsetup luksAddKey /dev/sda2 --pbkdf pbkdf2 \
          /etc/cryptsetup-keys.d/cryptroot.key
        # Add to /etc/dracut.conf
        install_items+=" /etc/cryptsetup-keys.d/cryptroot.key "
        # Add to kernel parameters, e.g. in
        # /etc/default/grub
        GRUB_CMDLINE_LINUX_DEFAULT=" rd.luks.key=/etc/cryptsetup-keys.d/cryptroot.key:/ "
        

        and of course, due to dracut changes, rebuild the initramfs.

        # Specify --kver kernel-name if kernel is new
        dracut -f
        

      • Finally, GRUB it up
        • Reminder: LUKS2 can work with GRUB2 if pbkdf2 is used, rather than argon2id (source)

        emerge --ask sys-boot/grub
        # Setup (BIOS uses `grub-install /dev/sda`)
        grub-install --efi-directory=/efi
        grub-mkconfig -o /boot/grub/grub.cfg
        

    • Arch Linux mkinitcpio+GRUB example:
      • Arch Linux by default uses BusyBox, though it can use a systemd initramfs as well (not necessarily faster). With mkinitcpio, you can easily switch to systemd by flipping these bold words (with or without “encrypt”).
      • The Arch docs are straightforward as long as you don’t incorrectly copy a UUID:
        • LUKS?
          • Specify encryption in /etc/mkinitcpio.conf HOOKS
            • If you used LVM, specify lvm2 as well
          • then add kernel parameters (cryptdevice or rd.luks.name, and maybe swap), as well as GRUB cryptomounting ability

            # /etc/default/grub (busybox example)
            GRUB_ENABLE_CRYPTODISK=y
            GRUB_CMDLINE_LINUX="cryptdevice=UUID=<use lsblk -o name,uuid>:cryptroot"
            

            • Pick the LUKS partition ID, not the cryptroot that LUKS mapped to, as we’re telling the bootloader to cryptomount /dev/sda2 or whichever to /dev/mapper/cryptroot here. And again, GRUB auto-specifies where root= will be. source
          • If /boot is inside the LUKS partition, add a keyfile into the initramfs. See ArchWiki: Dm-crypt/Device encryption § With a keyfile embedded in the initramfs.
            • As mentioned, GRUB doesn’t support argon2id yet (code architecturing reasons), so either use pbkdf2

              ... (previous 3 cmds)
              # Name the key cryptroot.key to match what we have so far
              cryptsetup luksAddKey --pbkdf pbkdf2 \
                /dev/sda2 /etc/cryptsetup-keys.d/cryptroot.key
              

              or use a GRUB patch.
        • Generate the initramfs and install GRUB (perhaps for MBR). Don’t forget to grub-mkconfig.
          • Rootfs-style installers may get annoyed here due to /etc/vconsole.conf KEYMAP=us being missing or linux not being installed

          # Use your kernel package e.g. pacman -S linux-zen
          mkinitcpio -p linux
          pacman -S grub efibootmgr # may fail without efibootmgr
          grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=archlinux
          grub-mkconfig -o /boot/grub/grub.cfg
          

    • Consider password protection of GRUB menu.
    • If you screw up your LUKS password during boot:
      • A: GRUB rescue: cryptomount hd0,gpt2, insmod normal, normal
      • B: Dracut rescue: fix initramfs stuff then type exit to continue boot process

6. configure after boot

Add a community repo (Gentoo), especially if you’re on Arch Linux.

# Arch: AUR (use `yay` or `paru`)
#   base-devel is the build essentials
#   NOTE: Always audit your makepkg files
pacman -S base-devel git
git clone https://aur.archlinux.org/yay
cd yay
makepkg -si
# or `makepkg -s` then `pacman -U <some.pkg.tar.zst>`

Consider using a package management help utility set such as pacman-contrib+pacutils or gentoolkit.

Afterwards, get a display working. Download a GUI (Xorg or a Wayland compositor).

• We already have the linux-firmware package (and, for Gentoo, VIDEO_CARDS) set up.

• If you don’t have systemd-logind (e.g. Void, Gentoo), setup elogind or prepare the following manually:

  • Setup XDG_RUNTIME_DIR via .zshrc or .bashrc
  • Setup seatd for some backends (source)
    • this may also apply to Hyprland
    • Why seatd?

• Gentoo: Organize make.conf

  • Add normal use flags: X, wayland, dbus, pulseaudio and/or pipewire, etc.

    # example (with elogind)
    LOGINUSE="-systemd elogind"
    DESKTOPUSE="X wayland gtk gtk3 pulseaudio pipewire introspection"
    USE="dbus lto ${DESKTOPUSE} ${LOGINUSE}"
    

  • Set INPUT_DEVICES (default=libinput)
  • Consider using sets.

• Install a desktop environmenta full-fledged desktop with a taskbar, startmenu, file manager, etc.
  - GNOME
  - KDE Plasma Desktop
  - XFCE4 or window managera minimal GUI that only handles app windows, leaving the startmenu and others to user setup
  - Hyprland
  - Sway

  • Find your distro’s package name for your DE/WM
  • Read the relevant ArchWiki/Gentoo Wiki article
  • Desktop Environments may need a “display manager” i.e. a login greeter such as SDDM or lightdm.
    • Can be replaced with startx, dbus-launch, or sometimes running the DE/WM manually
  • Get fonts, such as Source Han Sans for languages, ancient fonts for cuneiform, or Noto Sans for large Unicode coverage

• Set up sound.

  • PipeWire (Arch, Gentoo) is newer and backwards compatible with PulseAudio clients (e.g. Firefox) via pipewire-pulse.
    • Gentoo: be liberal with these USE flags.
    • Don’t forget to start the user unit for pipewire-pulse.service.

      # Arch
      systemctl enable --now --user pipewire-pulse
      

    • If using a WM, pavucontrol may be useful.
  • PulseAudio (Arch, Gentoo) is older.

• GPUs may require further configuration, especially with Intel/Nvidia.

  • For Intel/Nvidia hybrids, it is recommended (source) to use PRIME

    • Arch Linux’s /usr/bin/prime-run utility is just a shell wrapper to set these environment variables:

      #!/bin/bash
      __NV_PRIME_RENDER_OFFLOAD=1 \
      __VK_LAYER_NV_optimus=NVIDIA_only \
      __GLX_VENDOR_LIBRARY_NAME=nvidia "$@"
      

      The nouveau driver’s environment variable is simply DRI_PRIME=1.

  • CUDA requires the proprietary Nvidia driver (source).

  • Nvidia implements its own kernel mode setting (source). If you remove the kms HOOK as shown in the Nvidia guide, you may need to manually set up early or late KMS start, such as for your iGPU, to avoid errors such as Electron error code 512.

    Add the required module… to the initramfs configuration file

    See ArchWiki: mkinitcpio § MODULES or Gentoo: Dracut § Adding modules.

  • Make sure your GPU is actually helping your computer run via glxinfo, or lsmod | grep <driver name>, or a relevant monitoring tool (Intel, Nvidia, AMD)

• Manage flags and environment variables

  • Example: Firefox on X11 may need the env var MOZ_USE_XINPUT2=1
  • Example: Electron apps might run on XWayland, not Wayland

6.5 fluffy tweaks

• Make the CLI easier with bash-completions or zsh+ohmyzsh.
  • Arch: Add ILoveCandy and Color to /etc/pacman.conf options
    • Using paru? Uncomment BottomUp in /etc/paru.conf options
• Set up shortcuts in your ~/.zshrc or ~/.bashrc:

  alias neofetch='fastfetch --config neofetch.jsonc'
  alias py=python
  tldr() {
    # e.g. `tldr emerge`
    curl "cht.sh/$1"
  }
  

• Set up WINE or flatpaks or nix
• Make the console beep noise shut up
• Set envvars, e.g. for touchpads on Firefox
• Install and enable the tlp power management daemon

further reading (annotated)