notes on setting up luks

official guide wasn't very helpful or detailed. i've managed to set this up, perhaps this would be useful to others. unencrypted /boot/efi, unencrypted /boot, encrypted /.

so kernel expects system root uuid (partition within luks) via root= kernel parameter.

system root must be unlocked first via decrypt script within initramfs. dracat does this, and mkinitcpio does this with its encrypt hook. the purpose of initramfs is to mount system root.

those scripts expect luks container uuid, again as kernel parameter. default dracut needs just the following: # cat /etc/dracut.conf.d/00-luks.conf kernel_cmdline+=" rd.luks.uuid=<container-uuid> " # xbps-reconfigure -fa from an unlocked system, this generates initramfs with decrypt script and grub config with all the necessary kernel parameters. again, dracut manages grub, so /etc/default/grub should not contain uuids. you would think dracut would generate all this without any config, but in my install, it could only sense internal root uuid, not container uuid, which is why we're providing it as dracut config.