You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm Ezra Snow, a nerdy (extremely) 17 year old guy who may be addicted to computers and Linux (I spend far too much time using and messing with Linux on my computer). I currently live in North Carolina, and I'm a senior in high school. After I graduate, I'm going to study computer science at LeTourneau University. When I'm not doing school or messing with Linux, I'm often playing video games.
22
+
I'm Ezra Snow, a nerdy (extremely) 17 year old guy who may be addicted to computers and Linux (I spend far too much time using and messing with Linux on my computer). I currently live in North Carolina, and I'm a senior in high school. After I graduate, I'm going to study computer science at LeTourneau University (yes, it's far, but I have reasons). When I'm not doing school or messing with Linux, I'm often playing video games.
Documents I have here for future reference. Mainly guides for setting up Linux currently. Just for the record this is for my own personal reference mostly and they're on here just because this is a convenient way of accessing them from anywhere. These mostly aren't general purpose guides; check official documentation (like the [ArchWiki](https://wiki.archlinux.org)) or other locations of good repute for those. ;)
130
+
Things I have for future reference; they're on here because this makes them easy to access from anywhere. These mostly aren't general purpose guides; check official documentation (like the [ArchWiki](https://wiki.archlinux.org)) or other locations of good repute for those. ;)
136
131
137
132
## Linux stuff
138
133
139
-
<section>
140
-
141
-
### Arch Linux Installation (including LUKS encryption with TPM2 and Secure Boot)
142
-
143
-
**Last updated Mar 6, 2026**
144
-
<pstyle="margin-top: 0.5em">A guide documenting my preferred route for installing Arch Linux, including full disk encryption and Secure Boot support. Mostly just in case I ever have to do a full reinstall or I'm setting up a new PC.</p>
<pstyle="margin-top: 0.5em">I recently set up Secure Boot on Twilight (my laptop) and the ArchWiki's documentation was a little confusing so here's a more concise guide that only deals with GRUB. NOTE: I actually switched to systemd-boot but I'm leaving this here in the hopes that this is somewhat useful to someone else :)</p>
Copy file name to clipboardExpand all lines: resources/archlinux-installation.md
+17-12Lines changed: 17 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,19 @@
1
1
---
2
2
layout: page.html
3
-
title: Arch Linux Installation
4
-
created: Jan 31, 2026
3
+
title: Arch Linux Installation (with full disk encryption using TPM2 and Secure Boot)
4
+
date: 2026-01-31
5
5
lastUpdated: Mar 6, 2026
6
6
toc: true
7
+
tags: resource
7
8
---
8
9
10
+
My preferred route for installing Arch Linux including full disk encryption (with TPM2-based automatic unlocking!) and Secure Boot support. This mostly exists just in case I ever have to do a full reinstall/just because I want to fully document my installation route.
11
+
12
+
<!-- excerpt -->
13
+
9
14
**Important:** This is my own personalized installation guide for personal use. I do not recommend following this if you aren't me. Use the [official installation](https://wiki.archlinux.org/title/Installation_guide) guide instead.
10
15
11
-
This setup implements Secure Boot and full disk encryption with automated unlocking provided by the TPM2. The system boots from a signed unified kernel image (UKI) to eliminate complex bootloader configuration (the UKI is stored on the ESP and has the kernel command line embedded).
16
+
This setup uses systemd-boot as the bootloader and boots from a signed unified kernel image (UKI) incorporating the kernel image, initrd, and kernel commandline in one file to reduce complexity (as a side benefit, the initrd and kernel commandline are also validated by Secure Boot).
12
17
13
18
## Warming up
14
19
@@ -178,16 +183,16 @@ And finally my Plasma dotfiles. Follow the instructions on [the repository](http
178
183
179
184
## References
180
185
181
-
I wrote this with the help of MANY ArchWiki pages and a few manpages.
186
+
I wrote this with the help of MANY ArchWiki pages and a few manpages. Seriously the ArchWiki is amazing, go [check it out](https://wiki.archlinux.org).
182
187
183
-
*[The official installation guide](https://wiki.archlinux.org/title/Installation_guide)
188
+
*[The official installation guide](https://wiki.archlinux.org/title/Installation_guide) (The basic skeleton for this page)
184
189
*[This example for encrypting your installation](https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LUKS_on_a_partition_with_TPM2_and_Secure_Boot) (I basically lifted the encryption instructions from there)
*[AMD graphics (AMDGPU)](https://wiki.archlinux.org/title/AMDGPU) (For the required packages table in [#Desktop Environment](#desktop-environment))
196
+
*[Intel graphics](https://wiki.archlinux.org/title/Intel_graphics) (same as above)
197
+
*[Hardware video acceleration](https://wiki.archlinux.org/title/Hardware_video_acceleration) (Same as above lol)
198
+
*[Installing AUR packages](https://wiki.archlinux.org/title/Arch_User_Repository#Installing_and_upgrading_packages) (For installing yay at the very end)
Copy file name to clipboardExpand all lines: resources/using-secure-boot-on-arch.md
+5-8Lines changed: 5 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,15 @@
1
1
---
2
2
layout: page.html
3
-
title: Using Secure Boot on Arch
4
-
created: Feb 25, 2026
3
+
title: Using Secure Boot on Arch Linux with GRUB
4
+
date: 2026-02-25
5
5
lastUpdated: Mar 4, 2026
6
6
toc: true
7
+
tags: resource
7
8
---
8
9
9
-
## Update (Mar 4, 2026)
10
+
I recently set up Secure Boot on Twilight (my laptop). It works well, but the ArchWiki's documentation was a little confusing to follow, so I wrote this guide that targets GRUB. I have changed my setup significantly and I'm using systemd-boot now, but I'm leaving this here in case someone else finds it useful.
10
11
11
-
About a week after I wrote this guide I had the brilliant idea to switch to systemd-boot and also reconfigure my system to boot from a unified kernel image (UKI). This actually greatly simplified the process of encrypting the root partition since the UKI gets placed on the ESP after being assembled, thus I didn't need to worry about the bootloader being able to access `/boot` since the UKI is on the ESP (which is where the bootloader is installed to as well). I also worked up enough courage to directly modify the Secure Boot database so I could eliminate shim from my setup. So for my purposes at least, this guide is no longer relevant. But I'm leaving it up in the hope someone else finds it useful. :)
12
-
13
-
## Introduction
14
-
15
-
Welp guess what? Last week I set up Secure Boot on Twilight, my laptop. It works pretty much fine, the only real issue I had was a skill issue and the documentation on the ArchWiki being kinda messy and spread across a few different pages. This page is supposed to fix that issue at least for GRUB users.
12
+
<!-- excerpt -->
16
13
17
14
Its always slightly bothered me that my systems (especially my laptop) aren't really that secure (I'm not joking, you get full access to them simply by booting up a live Linux image and mounting the internal drive and then you can do basically anything) so I'm taking some steps to *minimize the risks*. This basically just boils down to 1) enabling Secure Boot so only trusted OSes (and Windows) can boot, and 2) encrypting the internal drive so that you can't mount it in a live environment without knowing the secret to unlocking it. I've done Secure Boot first since it's the simpler option to implement and also fairly low-risk (the worst that could happen was nuking my bootloader and that's not that hard to fix).
0 commit comments