MengChen. Huang Menchen

## full-disk-encryption-arch-uefi.md

      
              1 file
            
          
              84 forks
            
          
                50 comments
              
            
              413 stars
            
          
                huntrar
                / full-disk-encryption-arch-uefi.md
            
            
              Last active
              December 11, 2025 09:48
            
              
                Arch Linux Full-Disk Encryption Installation Guide [Encrypted Boot, UEFI, NVMe, Evil Maid]
              
          
    Arch Linux Full-Disk Encryption Installation Guide

This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS and an encrypted boot partition (GRUB) for UEFI systems.
Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and self-signed kernel and bootloader.
Preface

You will find most of this information pulled from the Arch Wiki and other resources linked thereof.
Note: The system was installed on an NVMe SSD, substitute /dev/nvme0nX with /dev/sdX or your device as needed.

  
## services-start.sh
#!/bin/sh

# multi SSID with VLAN script, for ASUS AC86U with merlin
#
# setup before hand:
#       set "router" to "AP Mode"
#               this will put all ports and wireless in br0
#       create 2 guest network
#       enable Administration => System => Enable JFFS custom scripts and configs
#       put this script in /jffs/scripts/, name should be "services-start"

## add2books.html
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
    <title>Add to Google Books</title>

    <script src="//www.google.com/jsapi"></script>
    <script src="//apis.google.com/js/client.js"></script>
    <script type="text/javascript">
	#!/bin/sh

	# multi SSID with VLAN script, for ASUS AC86U with merlin
	#
	# setup before hand:
	# set "router" to "AP Mode"
	# this will put all ports and wireless in br0
	# create 2 guest network
	# enable Administration => System => Enable JFFS custom scripts and configs
	# put this script in /jffs/scripts/, name should be "services-start"
	<!DOCTYPE html>
	<html xmlns="http://www.w3.org/1999/xhtml">
	<head>
	<meta http-equiv="content-type" content="text/html; charset=utf-8"/>
	<title>Add to Google Books</title>

	<script src="//www.google.com/jsapi"></script>
	<script src="//apis.google.com/js/client.js"></script>
	<script type="text/javascript">