Clear Linux install LVM on LUKS

Hello,

I want to share quick guide how to create following setup with Clear Linux:

/dev/vda1 #boot partition
/dev/vda2 #LUKS encrypted root partition
/dev/vda3 #LUKS encrypted LVM containing swap, home and win logical volumes

Here /dev/vda1 is systemd-boot partition. Root file system resides on /dev/vda2 (as far as I know in CL the rootfs can not be on LVM). Home and swap reside on /dev/vda3 on LVM logical volumes. Win is the LVM logical volume which I use to install Windows VM. Both partitions /dev/vda2 and /dev/vda3 are encrypted with LUKS. What are advantages of these scheme? You can easily resize (except for root fs) and manage LVM volumes according to your needs and all of this is secured with LUKS.

To create this setup you first should boot CL live iso and start terminal. Execute following commands with sudo:

#vda is block device where I'll install CL
gdisk /dev/vda

#using the gdisk create 3 partitions:
#/dev/vda1 - size 256M, type ef00 - EFI System
#/dev/vda2 - size 40GB, type 8304 - Linux 86-64 root (/)
#/dev/vda3 - remaining size of device, type 8309 - Linux LUKS

#create boot fs
mkfs.vfat -F32 /dev/vda1

#create LUKS encrypted volumes on /dev/vda2 and /dev/vda3, you should enter the same password for both
cryptsetup luksFormat /dev/vda2 --type luks2
cryptsetup luksFormat /dev/vda3 --type luks2`

#it is good idea to backup luks headers
cryptsetup luksHeaderBackup /dev/vda2 --header-backup-file root-header.backup
cryptsetup luksHeaderBackup /dev/vda3 --header-backup-file lvm-header.backup

#open LUKS volumes, they can be accessed under /dev/mapper/root and /dev/mapper/lvm
cryptsetup open /dev/vda2 root
cryptsetup open /dev/vda3 lvm

#create fs on root
mkfs.ext4 /dev/mapper/root

#create LVM device on /dev/vda3
pvcreate /dev/mapper/lvm

#create LVM group clr
vgcreate clr /dev/mapper/lvm

#create logical volumes for swap, win and home
lvcreate -C y -L 244M -n swap clr
lvcreate -L 160G -n win clr
lvcreate -l 100%FREE -n home clr

#create file system on home and swap
mkfs.ext4 /dev/mapper/clr-home
mkswap /dev/mapper/clr-swap

#mount root, boot and home  
mount /dev/mapper/root /mnt
mkdir /mnt/boot
mount /dev/vda1 /mnt/boot
mkdir /mnt/home
mount /dev/mapper/clr-home /mnt/home

#install CL
swupd os-install /mnt --bundles=os-core,os-core-update,kernel-native,NetworkManager,bootloader-extras,boot-encrypted --statedir=/mnt/var/lib/swupd

#create crypttab to decrypt /dev/vda3 on boot and map it to /dev/mapper/lvm
echo "lvm /dev/vda3" > /mnt/etc/crypttab

#create fstab to mount home and swap on boot
echo "/dev/mapper/clr-home /home ext4 defaults 0 2" > /mnt/etc/fstab
echo "/dev/mapper/clr-swap none  swap defaults 0 0" >> /mnt/etc/fstab

#unmount
umount /mnt/boot
umount /mnt/home
umount /mnt

#close root LUKS volume
cryptsetup close root

#deactivate LVM group
vgchange -a n clr

#close lvm LUKS volume
cryptsetup close lvm

Thats it. Now you can boot your new CL install and login as root.
Now you can further setup your CL install. You can change hostname with hostnamectl set-hostname . Install GNOME with swupd add-bundle desktop and run it with systemctl start gdm.service. You can install Windows VM on /dev/clr/win.

Hope this will be useful for someone.

2 Likes

Thanks for sharing. It would help make it easier to read if you format the commands in your post with the backtick (`) for single line or triple backticks (```) for a codeblock.