install

Pre-installation

#download arch linux iso
#Verify signature
   gpg --keyserver pgp.mit.edu --keyserver-options auto-key-retrieve --verify archlinux-version-x86_64.iso.sig

#Create UEFI bootable USB {lsblk see where your usb sdb or sdc}
   wipefs --all /dev/sdx
   dd bs=4M if=path/to/archlinux.iso of=/dev/sdx status=progress oflag=sync

#Boot to live environment
#Set the keyboard layout
   loadkeys us

#Verify the boot mode UEFI
   ls /sys/firmware/efi/efivars

#Connect to the Internet
   wifi-menu
   ping -c 5 8.8.8.8

#Update the system clock
   timedatectl set-ntp true
   timedatectl set-timezone Asia/Jakarta

#layout partition disks :
Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048         1050623   512.0 MiB   EF00  EFI System
   2         1050624       839911423   400.0 GiB   8300  Linux filesystem

#Delete all partitions on disk this will delete all data on your hardisk be carefull
   gdisk /dev/sda
   o = blank gpt
   y = yes
   w = write

#setup partition
   gdisk /dev/sda

#create EFI System partitions
   n
   1
   2048
   1050623
   EF00

#Create Linux filesystem
   n
   2
   1050624
   839911423
   8300
   w
   y

#Encrypt System partition root and swap
   cryptsetup --user-random luksFormat --cipher aes-xts-plain64 -h sha512 -s 512 --type luks2 /dev/sda2
   cryptsetup open /dev/sda2 encrypt
   pvcreate /dev/mapper/encrypt
   vgcreate ArchLvm /dev/mapper/encrypt
   lvcreate -L +8G ArchLvm -n swap
   lvcreate -l +100%FREE ArchLvm -n root

#Create filesystems for efi, boot, root and swap
   mkfs.vfat -F 32 /dev/sda1
   mkfs.ext4 /dev/ArchLvm/root
   mkswap /dev/ArchLvm/swap

#Mount for install ArchLinux
   mount /dev/ArchLvm/root /mnt
   mkdir /mnt/boot
   mount /dev/sda1 /mnt/boot
   swapon /dev/ArchLvm/swap

#install Arch linux system (i'm using laptop with broadcom wireless card and intel cpu)
   pacstrap /mnt base base-devel dialog wpa_supplicant zsh linux-headers broadcom-wl-dkms git wget reflector intel-ucode

#generate partition table fstab
   gefstab -U /mnt > /mnt/etc/fstab

#enter chroot
   arch-chroot /mnt /bin/bash

#Set time zone and sync clock
   ln -sf /usr/share/zoneinfo/Asia/Jakarta /etc/localtime
   hwclock --systohc --utc

#set locale
   echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
   echo "LANG=en_us.UTF-8" > /etc/locale.conf
   locale-gen

#set keymap
   echo "KEYMAP=us" > /etc/vconsole.conf

#set hostname
   echo "archlinux" > /etc/hostname

#set hosts
   echo "127.0.0.1		localhost\n127.0.0.1	archlinux.localdomain	archilinux" > /etc/hosts

#Set root Password
   passwd

#create user with sudo access
   ## Uncomment to allow members of group wheel to execute any command
   sed -i '/%wheel ALL=(ALL) ALL/s/^#//' /etc/sudoers
   useradd -m -g wheel -s /usr/bin/zsh userarch
   passwd userarch

#set HOOKS initramfs
   nano /etc/mkinitcpio.conf
   HOOKS="base systemd udev autodetect keyboard sd-vconsole modconf block sd-encrypt sd-lvm2 filesystems fsck"

#Generate initrd image:
   mkinitcpio -P

#install Bootloader systemdboot
   bootctl install

#add entries loader
   nano /boot/loader/entries/arch.conf
   title Arch Linux
   linux /vmlinuz-linux
   initrd /intel-ucode.img
   initrd /initramfs-linux.img
   options rd.luks.name=

#exit save ctrl+x+y+enter

#we need get UUID sda2 encrypt
   blkid -s UUID -o value /dev/sda2 encrypt >> /boot/loader/entries/arch.conf

#edit entries loader
   nano /boot/loader/entries/arch.conf
   title Arch Linux
   linux /vmlinuz-linux
   initrd /intel-ucode.img
   initrd /initramfs-linux.img
   options rd.luks.name=xxxxxxxx-xxxxxxxx-xxxx-xxxxxxxxxxx=cryptlvm root=/dev/ArchLvm/root rw ipv6.disable=1 net.ifnames=0 biosdevname=0

#exit save ctrl+x+y+enter

#exit chroot
   exit
   umount -R /mnt
   swapoff -a
   reboot

############################ Setup system boot to new system ############################
#will ask password for encrypt luks
#login as userarch
#connect to internet
   sudo wifi-menu

#if u forgot ssid profile
   ls /etc/netctl 

#auto connect next boot
   sudo netctl enable wlan0-ssid
   sudo netctl start wlan0-ssid

#speedup mirrorlist
   sudo reflector --score 100 --fastest 25 --sort rate --save /etc/pacman.d/mirrorlist --verbose  

#Enable multilib if you need, uncomment the [multilib] section in /etc/pacman.conf
   sudo nano /etc/pacman.conf
   [multilib]
   Include = /etc/pacman.d/mirrorlist

#refresh db multilib
   sudo pacman -Syu

#install yay
   git clone https://aur.archlinux.org/yay.git
   cd yay
   makepkg -si

#install all my setup Awesome + lightdm 
   wget https://raw.githubusercontent.com/clisys/Arch-Linux-systemd-boot/master/pkglist.txt
   wget https://raw.githubusercontent.com/clisys/Arch-Linux-systemd-boot/master/aurpkglist.txt

   sudo pacman -S --needed $(comm -12 <(pacman -Slq|sort) <(sort pkglist.txt) )
   yay S --noedit --noconfirm --needed aurpkglist.txt

#Setup lightdm for awesome xsessions
   sudo nano /etc/lightdm/lightdm.conf
   [LightDM]
   run-directory=/run/lightdm
   sessions-directory=/usr/share/xsessions
   [Seat:*]
   greeter-session=lightdm-mini-greeter
   greeter-allow-guest=false
   session-wrapper=/etc/lightdm/Xsession

#add user to mini-greeter
   sudo nano /etc/lightdm/lightdm-mini-greeter.conf
   user = userarch

#enable lightdm to next boot
   sudo systemctl enable lightdm.service

#Dotfile Setup
   git clone https://github.com/clisys/Arch-Linux-systemd-boot.git
   cd Arch-Linux-systemd-boot
   mv .* ~/
   chmod +x screenshot && sudo mv screenshot /usr/local/bin
   sudo mv etc/X11/xorg.conf.d/30-touchpad.conf /etc/X11/xorg.conf.d/

#allow the MPD user to use PulseAudio
   sudo nano /etc/pulse/client.conf
   change the autospawn option to yes

#Enable mpd service
   systemctl --user enable mpd.service

#allow user to shutdown add alias to /etc/sudoers
   sudo nano /etc/sudoers
   userarch archlinux =NOPASSWD: /usr/bin/systemctl poweroff,/usr/bin/systemctl halt,/usr/bin/systemctl reboot
 
   #This config is especially add to /etc/sudoers :
   Defaults !requiretty, !tty_tickets, !umask
   Defaults visiblepw, path_info, insults, lecture=always
   Defaults loglinelen=0, logfile =/var/log/sudo.log, log_year, log_host, syslog=auth
   Defaults passwd_tries=3, passwd_timeout=1
   Defaults env_reset, always_set_home, set_home, set_logname
   Defaults !env_editor, editor="/usr/bin/vim:/usr/bin/vi:/usr/bin/nano"
   Defaults timestamp_timeout=15
   Defaults passprompt="[sudo] password for %u: "
   Defaults lecture=never

#enable tlp apparmor service
   sudo systemctl enable tlp.service
   sudo systemctl enable tlp-sleep.service
   sudo systemctl mask systemd-rfkill.service
   sudo systemctl mask systemd-rfkill.socket
   sudo systemctl enable apparmor.service

#enable AppArmor as default security model on every boot set the following kernel parameters:
   nano /boot/loader/entries/arch.conf
   apparmor=1 security=apparmor

#Setup Uncomplicated Firewall
   sudo ufw status verbose
   sudo ufw disable

   #and set the default rules to deny incoming and allow outgoing connections;
      sudo ufw default deny incoming
      sudo ufw default allow outgoing

   #Disable remote ping
      sudo nano /etc/ufw/before.rules
         # ok icmp codes for INPUT
         -A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP
         -A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP
         -A ufw-before-input -p icmp --icmp-type parameter-problem -j DROP
         -A ufw-before-input -p icmp --icmp-type echo-request -j DROP

   #Disable UFW logging
      ufw logging off
       
#Enable Ufw
   sudo ufw enable

#setup dnscrypt-proxy
   sudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.toml
   listen_addresses = ['127.0.0.1:53']

   #setup resolv.conf
      sudo nano /etc/resolv.conf
      nameserver 127.0.0.1

   #make resolv.conf unchangeable by anyone on your system
      sudo chattr +i /etc/resolv.conf

#enable dnscrypt-proxy
   sudo systemctl enable dnscrypt-proxy

#reboot
   sudo systemctl reboot

#boot to Arch linux With lightdm and awesome wm
#open terminal super+enter
#open file manager super+/
#open browser super+i
#for download mp3
   Super+enter
   cd Music
   dlmp3 https://www.youtube.com/watch?v=Jpfevl5k7k4

#Show all command Super+s
#show all alias super+enter type alias {dlmp3 is my custom alias, musix for play ncmpcpp}
#poweroff open rofi
   Super+p
   type poweroff