Partitions

Tables

parted /dev/sda mktable gpt
parted /dev/sdb mktable gpt

Partitions

crypt

parted /dev/sda unit mib mkpart crypt1 33026 11444223
parted /dev/sdb unit mib mkpart crypt2 33026 11444223

boot

parted /dev/sda unit mib mkpart boot1 258 33026
parted /dev/sdb unit mib mkpart boot2 258 33026

bios & esp

parted /dev/sda unit mib mkpart bios 1 258
parted /dev/sda set 3 bios_grub on
parted /dev/sdb unit mib mkpart esp 1 258
parted /dev/sdb set 3 esp on

File Systems

bios & esp

dd \
if=/dev/zero \
of=/dev/sda3
mkfs.vfat \
-n esp \
-i BADA5579 \
/dev/sdb3

boot

mdadm \
--create /dev/md/boot \
--name boot \
--uuid 6234a0eb:29a3a847:1dbd5ec4:bada5579 \
--metadata 1 \
--level 0 \
--raid-devices 2 /dev/sd[ab]2
mkfs.ext4 -L boot \
-U 6234a0eb-29a3-a847-1dbd-5ec4bada5579 \
/dev/md/boot

crypt

mdadm \
--create /dev/md/crypt \
--name crypt \
--uuid 006234a0:eb29a3a8:471dbd5e:c4bada55 \
--metadata 1 \
--level 0 \
--raid-devices 2 /dev/sd[ab]1

RAID

display current configuration

mdadm --detail --brief --scan

make device names persistent

  • /etc/mdadm/mdadm.conf

ARRAY /dev/md/boot  UUID=6234a0eb:29a3a847:1dbd5ec4:bada5579
ARRAY /dev/md/crypt UUID=006234a0:eb29a3a8:471dbd5e:c4bada55
  • rebuild initial RAM disk

update-initramfs -u

Encryption

choose cipher algorithm

cryptsetup benchmark

initialize

cryptsetup \
--verbose \
--verify-passphrase \
--type luks2 \
--pbkdf argon2id \
--cipher aes-xts-plain64 \
--iter-time 8192 \
--key-size 512 \
--hash sha512 \
--use-random \
luksFormat \
/dev/md/crypt

open

cryptsetup luksOpen /dev/md/crypt crypt

zeroize

dd status=progress if=/dev/zero \
of=/dev/mapper/crypt bs=16G

close

cryptsetup luksClose crypt

reinitialize

check information

cryptsetup \
luksDump \
/dev/md/crypt

reopen

LVM

create physical volume

pvcreate /dev/mapper/crypt

create volume group

vgcreate crypt /dev/mapper/crypt

create logical volumes

lvcreate --name swap --size 68719476736b crypt
lvcreate --name data --extents 100%FREE crypt

deactivate volume group

vgchange --activate n crypt

reactivate volume group

vgchange --activate y crypt

File Systems

format swap

mkswap \
--label swap \
-U 06234a0e-b29a-3a84-71db-d5ec4bada557 \
/dev/mapper/crypt-swap

format data

mkfs.ext4 \
-L data \
-U 006234a0-eb29-a3a8-471d-bd5ec4bada55 \
/dev/mapper/crypt-data