Hi, I am new to Arch, but am familiar with Debian, which is my daily driver (personal laptop). I just built a gaming/ML PC, and I picked Arch for the OS, and opted for LVM on LUKS. My goal is to have the root filesystem encrypted with LUKS2 and /boot with LUKS1 (for now, to match my Debian setup).
I have done this with Ubuntu and Debian before, so I thought I'd implement a mix of the following two guides (but perhaps that's where things went sideways):
Basically, I am prompted by GRUB for the password to unlock the boot partition, then the GRUB menu appears and when I try booting Arch the timeout happens and everything kind of stops there (I don't even get dropped into an emergency shell). Here are a couple of the error messages:
[ TIME ] timed out waiting for device /dev/mapper/vg-root
Cannot open access to console, the root account is locked.
Anyway, here's my target filesystem as seen from a live USB.
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
loop0 7:0 0 2.7G 1 loop /usr/lib/live/mount/rootfs/filesystem.squashfs
/run/live/rootfs/filesystem.squashfs
sdb 8:16 1 14.5G 0 disk
├─sdb1 8:17 1 3.2G 0 part /usr/lib/live/mount/medium
│ /run/live/medium
└─sdb2 8:18 1 5M 0 part
nvme0n1 259:0 0 1.8T 0 disk
├─nvme0n1p1 259:1 0 1G 0 part
│ └─LUKS_BOOT 253:0 0 1022M 0 crypt /mnt/boot
├─nvme0n1p2 259:2 0 2M 0 part
├─nvme0n1p3 259:3 0 128M 0 part /mnt/boot/efi
└─nvme0n1p5 259:4 0 1.8T 0 part
└─nvme0n1p5_crypt 253:1 0 1.8T 0 crypt
├─vg-swap_1 253:2 0 10G 0 lvm [SWAP]
└─vg-root 253:3 0 1.8T 0 lvm /mnt
And some relevant lines from the config files:
/etc/default/grub:
GRUB_CMDLINE_DEFAULT_LINUX="loglevel=3"
GRUB_CMDLINE_LINUX="rd.luks.name=88c898af-1425-494a-9ae5-677062b9cbc4=nvme0n1p5_crypt"
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
GRUB_ENABLE_CRYPTODISK=y
/etc/mkinitcpio.conf:
FILES=(/etc/cryptsetup-keys.d/cryptlvm.key)
HOOKS=(base systemd autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems fsck)
/etc/crypttab (unclear to me if this is required, but I put the following lines in anyway):
LUKS_BOOT UUID=d83d6143-ca41-482e-babe-254ac17a6895 /etc/cryptsetup-keys.d/cryptlvm.key luks,discard
nvme0n1p5_crypt UUID=88c898af-1425-494a-9ae5-677062b9cbc4 /etc/cryptsetup-keys.d/cryptlvm.key luks,discard
/etc/fstab:
# /dev/mapper/vg-root
UUID=c8d7f46f-22e3-452e-b43c-0365dbadd185 / ext4 rw,relatime0 1
# /dev/mapper/LUKS_BOOT LABEL=boot
UUID=34ce7fe9-e53c-4718-af92-e46a08d65a94 /boot ext4 rw,relatime0 2
# /dev/nvme0n1p3 LABEL=EFI_SP
UUID=ECFE-5A4C /boot/efi vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro0 2
# /dev/mapper/vg-swap_1
UUID=3531654d-a349-40e7-8299-8b7470bb43a6none swap defaults 0 0
I have already regenerated both initramfs and grub.cfg multiple times. As a reminder, I encrypted the LUKS_BOOT partition as LUKS1 (cryptsetup luksFormat --type=luks1 /dev/nvme0n1p1
), and /dev/mapper/nvme0n1p5_crypt as LUKS2.
Please let me know if I should post any other info; thanks for reading!
PS: whilst chroot-ed into my target filesystem, I ran the following command:
[root@archiso /]# lsinitcpio /boot/initramfs-linux.img | grep cryptlvm
etc/cryptsetup-keys.d/cryptlvm.key
I'm genuinely stumped at this point, but I bet I'm overlooking something stupidly simple.