Linux (Dual Boot) Workstation Setup: Arch Linux, Windows 11, Encrypted

what's going on everyone it has been a while but it feels good to be back making content again and we're gonna be kicking off my first post in 2022 around a new linux workstation so my old laptop is about seven years old now so it was finally time to upgrade that thing zoom and slack just couldn't hang any longer as unfortunate as that is so i have a new dell xps 15-inch that i'm going to be setting up as my next workstation now i am going to be going through this thing end to end from creating installation media to installing operating systems i'll make sure to keep a table of contents and i will also have all of these details in my blog but if you're just looking for a quick and dirty tutorial that doesn't explain all the things this probably isn't for you it's going to be going to be a long one setting this thing up end to end so this is again a 15-inch dell xps it is using an 11th gen intel i7 processor now at the time of this video the 12th gen intel processors are out these include the p and e or performance and efficiency cores really cool processing architecture but unfortunately at this time the linux kernel isn't quite up to snuff with scheduling on that cpu that's scheduled for 518 and i think at this point my archbox is running 516 or 517 so i didn't really want to take the risk on the new processing architecture it's also got 64 gigabytes of ram which i do spin up a lot of virtual machines using qmu and kvm but otherwise 64 gigs would be pretty much overkill the hard drive is two terabytes and the reason it's two terabytes is because i will be running windows 11 and arch linux on this box i want both to have about a terabyte of disk space arch is my primary os for all of my work all the things i do but i do hop into windows every now and then if i want to try things out or maybe run some software we're building on windows and so on it also has dedicated graphics the rtx 3050 is inside of this thing so i'll be able to switch between integrated intel graphics when i want to save battery and then dedicated graphics if i want to do rendering work or perhaps obs to stream and finally it's using the fhd plus display it's 1920x1200 no touch display now this display is way less nice than the oled that dell has out there and the reason i go with this display is it pools a lot less power than that oled so i don't care about crazy resolutions in my laptop 1920x1200 is fine i'd much rather have the better battery life so i did in fact go with that and maybe the last thing we're saying on this laptop's hardware is this is a dell and i chose it because i'm used to the dell xps i like the keyboard i like the trackpad it works pretty reliably but being dell it's gonna have things that aren't so great with linux like the bios and different things that we have to tune if you're looking for a more linux ready laptop you definitely should be looking at something like system 76 they make amazing machines or i guess repurpose amazing machines that they then tweak to make more linux compatible but again you know for me i stick with xps just because i know it and it's kind of a continuation of a workstation i've already been using now we're going to start creating our installation media so using two usb drives we will put the arch linux install iso and the windows 11 install iso on each of those usb drives for arch linux we can go to archlinux.org forward slash download find a mirror that we want to use and inside of this mirror we'll find the iso file that they have hosted and grab the address then inside of a terminal you'll notice i'm a pseudo user right now i can do wget and download this iso so essentially i'll be creating these installation medias from a different linux box and then putting it on the laptop in just a moment while this is downloading i've gone ahead and plugged in the usb stick that i'll be putting the arch iso on so if i run an ls blk or list block devices i can see under dev sdd i'll be able to cat the contents of that arch iso onto that drive so to do that we can just run cat and we can say arch iso put it onto dev sdd hit enter and then this will go ahead and begin the process of copying that iso onto that usb drive with arch linux on a drive we can now get windows 11 on a different drive it's important from the windows 11 site that we go for the windows 11 disk image iso from here we can choose the multi-edition iso click download it'll then ask us for what language we would like that in we can confirm that and then it's going to provide us with a url to download this and we will grab the iso from here now that it's downloaded i've gone ahead and copied the iso into this temporary directory and the windows install is a little bit different because we want to use a tool called ventoy to actually create the bootable usb drive one of the big perks of ventoy is it allows us to tell the windows 11 install to skip the system pre-rack checks what's good about this is this is going to allow us to disable uefi secure boot during installation we want secure boot off so that we can install arch linux and i'll show that in the bio settings a little bit later to get ventoy it just depends on what distribution or system you're using you can download it from their website but in my case i'm going to grab it from the aur so i can go to ventoy bin and then grab the get url i'll go ahead and git clone that in this temp directory and then once it gets cloned i will grab ventoy bin and run a make package si on it and this will go through the actual installation of ventoy on my system and once ventoy is fully installed which it now is we can see that a couple different ventoy commands are available in the path now i've also gone ahead and installed a new installation medium or usb disk and this is a 29.2 gig at dev sdd so what we'll do here is we'll run ventoy gui to get the drive initially set up it'll ask me to authenticate and with the authentication i can choose dev sdd in here and then run install on ventoy all data will be lost on my disk but then once this goes through i'll have ventoy set up on this usb drive so this gui just sets up the initial ventoy system what i'm going to go ahead and do next is actually make a directory inside of run media josh and i'm going to call this ventoy mount and what i'm going to do is then mount what ventoy just set up so under dev sdd1 in run media josh ventoy mount i am going to mount this location so we'll mount that together and then using ventoy we're actually going to modify via one of its plugins the installation of windows 11 to again skip those prereq checks so we want to do ventoy plug son and then point this at our newly mounted device so i'll do sdd make sure i run a sudo and this will actually spin up a web server we can go to to configure the installation medium i'll go to that web server and it will give me the ventoy configuration portal i'll go to global control plugin and if we scroll down just a bit you'll see an option for ventoy windows 11 bypass check set to not bypass by default we want to choose one here which is going to save the configuration to ventoy that will skip a bunch of checks one of those checks being secure boot which is exactly what we want to skip so we can install linux and windows so that's it for ventoy we can then go back to our terminal exit out and if we just want to do a quick sanity check we can look inside of run media josh ventoy mount and we can see inside of here that ventoy has put a configuration file in place we also want to copy the iso to this location so i'm going to copy the windows iso from here and we'll make sure i'm in the right directory so i will copy the windows iso and then grab that same location run mediaventoy paste it here and make sure i'm running as the correct user and then this will copy the iso over and now the ventoy mount is completely set up as we need it to be to run this so we can then finally do a pseudo u-mount r against run media josh ventoy mount this will unmount ventoy we can pop the usb stick out and we're ready to start the installation in our system before going further let's talk about the disk layout the blue boxes are partitioned set up by the windows 11 install which will happen first the pink boxes are partitioned by the linux install which will happen second when we install windows it'll set up an efi system partition that we'll be able to use additionally you'll set up a required windows recovery partition and that'll leave us about 900 gigabytes for the windows 11 root partition this will be fully encrypted by a tool called veracrypt when we get to the linux install we'll set up a separate partition for boot which will contain some boot loader details and also work with this efi system partition and then lastly we'll have another 900 gigabytes set up for the root partition in linux this will be fully encrypted via a tool called dmcrypt now let's take a look at the bios to set it up for windows and linux installs on dell laptops we can hit the power button and then the f12 key this will bring us into the one time boot setting menu from here we can easily access the bios setup menu there are a few things we need to set up in bios first off we need to go into boot configuration and then find the setting for secure boot secure boot is a uefi feature that enables cryptographic guarantees that the binaries we are triggering on boot have not been tampered with since we got our machine now this is especially complicated for our linux isos and kernel because we would need to actually sign those with that same cryptographic keychain potentially so while there are ways to do this the best thing we can do here is just flip this off and hit yes to disable secure boot and disabling secure boot is one of the primary reasons we needed to alter that windows iso for our install the second thing that we need to change inside of bios is a specific setting around how the nvme drive works the easiest way in the dell bios to get to this is to search and through the search we can type in sata and by searching sato we can see the nvme operation now on this xps it has raid on by default which provides some different functionality using this thing called an intel rapid storage technology requires an extra driver when you're using it now i don't particularly need or want these extra drivers so i'm going to rely on ahci nvme mode now we can install windows 11. we'll start off by plugging the usb drive into the machine and by powering the machine back on we can hold f12 again to get back to the one-time boot settings menu from the boot settings we can easily enter the usb drive once booted we'll see the event toy screen and then we'll just choose the windows 11 installer which will pop up and then boot into the windows installation from the windows 11 installer we'll just go through the normal motions hitting next going to install now and the key thing we need to do here is set up a custom install so we have control over the partitions from the partition menu we can see a bunch of existing partitions set up by dell we're going to go ahead and delete every single one of these partitions and with the partitions deleted we can hit new and specify the size we want for the root partition i'm going to go to 900 gigabytes in this root partition when we apply windows is going to create the other partitions we've discussed such as efi and the recovery partition with this in place we've got some extra buffer for linux and we can hit next and install windows once windows finishes its install it'll boot up and bring you through the normal mode of asking you questions i won't bore you with all these settings or just personal settings you're going to set up but once complete you'll have a bootable windows machine once windows is booted we're ready to set up updates and all the default things we might need to do the first thing i do is run the control panel and i go to the power settings there is an ability to turn off what windows calls fast startup you want to turn this off because it can do some weird stuff with the discs especially in the dual boot scenario so we'll flip that off with fast startup off we're ready to encrypt we can head to veracrypt.fr which is a page for the software i use to encrypt this disk you can download it for free there will be an exe download it install it just like most software on your system once veracrypt is available we can launch the application and we'll be ready to create an encrypted volume on this machine we're going to encrypt the entire system disk here and just do a normal type of encryption encrypt the windows system partition and it'll ask us if we want to do single or multi-boot and even though this will eventually be multi-boot we'll start with single we'll then go in and set up a password for the aes encryption algorithm that we chose and we'll be able to start the encryption process now it'll collect random data just move your mouse around in this pool content to get it as randomized as possible and it'll also ask you to set up a rescue disk you might want to consider doing this but i'm going to skip it it'll go ahead and do a full encryption as well i've skipped over kind of a pre-boot that it will do where it recycled my computer just to save time but with this in place now my machine is fully encrypted if we go ahead and power down the machine and boot it back on we should now see a new menu pop up and this new menu is going to be a very minimal password box in the top left that'll ask us to type in our password we can hit enter to the pim number since we didn't set one and this will decrypt the drive and let us log into windows 11. and now we're ready to install arch linux we'll plug the usb media in just like we'd normally do and similar to windows 11 we will boot the machine on and hit f12 to get into the one-time boot setup menu we'll choose the usb and it'll give us a little grub boot loader that we can choose the first option on this will boot us in uefi mode and arch will take a little bit of time to get some of the initial hooks running and mounting of things but eventually we will get booted into the installer now i never do the actual arch installation on the physical box so what i start off by doing is getting connected to the internet using iwctl this will let us list our devices my wireless card is listed as wlan0 i can then list the networks by doing station w lan scan and by then doing station wlan and listing those stations out i am able to see what's available inside of my network anteater is my network so i will go ahead and do a station wlan zero connect to the anteater network and put in my password now i should be connected to the network so if i exit out at iwd and do an ipas i can see my ip is 192.1683.124. i'll also ping google.com just to make sure i have outbound network connectivity and i'm going to ssh into this machine so with systemctl status sshd i can verify that the ssh daemon is running and i can now ssh into this box before i ssh in i need to set the password for the root user so i'll just type password put in two passwords and we're good to go now from a new linux box one that has a gui i'm going to launch a terminal and then ssh in his route to that same ip address now i can fully complete the install from another machine with copy and paste functionality and a web browser and now we're ready to set up the partitions so if we do a list block devices we can see the disks that are available and i want to grab the nvme 0 and 1 disk not one of the partitions but the disk itself once i run cg disk i'll have this nice interface for creating new partitions we can see the free space at the very bottom for our arch install we're going to start off with that boot partition you might remember before we talked about the pink partition layouts this boot partition is going to be at the first sector which means right at the last partition it will be 512 megabytes in size and it will just be the standard linux file system we will set boot as the name and now we have another chunk of free space at the bottom this new free space will be our root partition that we talked about earlier so we can go down to that free space choose this first in size and sector to cover the full amount so just enter enter same thing linux file system enter here for file type and we're going to call this root now we have and can write our partition table to satisfy all the things we wanted for our linux system partition now as a quick aside you'll notice that i do not put swap space in this is a decision i've made because i do not want swap many laptop users do want swap because swap lets their machine hibernate where the ram contents get rid into disk so that's something you might want to consider as you set this up now with everything written we can quit cg disk and do another list block devices and you'll see the new partitions p5 and p6 are now available for us to start formatting and now we're ready to encrypt p6 our root partition so we'll copy the p6 name here and we'll run crypt setup dash y to interactively ask for the passphrase use random to say devrandom should produce the keys and then put it under the luks format we're going to specify that this should go against our dev nvme partition 6. by hitting enter here it's going to let us know that it will encrypt and ruin all the data we'll hit yes in capital letters and then put in our passphrase twice once we've got our passphrase in it's going to fully encrypt this partition and we'll basically need to use a command to open up that partition going forward in a way that we can write and read from so let's go ahead and open it up we'll start off by running crypt setup luks open against that partition and call it crypt root it'll ask for the password we'll put that in and this is us basically unlocking this partition now what this has done is put it inside of the kind of cryptroop sub mapper directory and we'll use that mapper directory in just a moment but you can see crypt roots sitting here underneath partition 6. so now we'll go ahead and make some file systems we'll make the file system on ext4 with ext4 for dev nvme partition five so this will be for our boot partition we are just setting up the file system for that and then we'll set up the file system for p6 now we can't just point it at p6 with mkfs because it is encrypted so we need to do mkfs ext4 against dev mapper cryptroot which is the actual location where our data can be written and read from when it has been opened up in this way with file systems in place in our partition we're now ready to mount it and start doing installations so we list block devices we see p5 p6 and p1 which will be important for efi we'll start by mounting the devmapper crypt route to the mnt this will be the root directory then we'll then create a directory in mnt called boot now boot needs to be mounted to our partition 5 which is our boot partition so we'll mount p5 against mount boot and we'll make one more directory in mount boot called efi now we know that partition 1 from windows is the efi partition so we'll go ahead and mount partition 1 to mnt boot efi so essentially we have p6 set as root p5 set as boot and then p1 set is root boot efi we're almost ready to bootstrap arch linux but first we're going to set the mirrorless by editing etsy pac-man d forward slash mirror list now the reflector has auto set the servers it thinks will work for us but we're actually going to go to the mirror list on the archlinux.org website choose https only mirrors and find some known good mirrors that i happen to know work pretty fast for my region of the world so i usually use mit as the top one we're gonna copy and paste these mirrors into the file and make sure they're uncommented so that they get used setting this mirror list is important not only for your install but this mirror list will be copied over and used for all package installs going forward now we're ready to bootstrap the system we'll use a tool called packstrap that is going to install packages to a new root directory it's designed for new system installs and then we're going to install these packages now these packages are curated based on packages that i know i want out of the gate on my system you'll notice that linux is there in linux firmware there's also base devel and base which provides some developer tools grub will be our boot loader efi boot manager supports that and then i also bring in vim to edit get to do source control intel ucode to grab those drivers and then network manager to give me an initial networking setup now as these install i will say that these are definitely just a very small subset of the packages i use every day but this is my base system that i'll eventually use to install those other packages as a final step now we're ready to generate the file system table and we'll use gen fstab to do this we can run gen fstab for mount put it at mount etsy fstab the dash u flag sets it up so it uses uuids to identify the partitions and if we look inside this file this just makes sense of how devmapper crypt root is our root partition how dev partition 5 is our boot and then how partition 1 is our efi partition now we're ready to launch our new system we can get into it by using arch to root and point it at mount this moves us over or moves our route over to mount we'll then create a symbolic link from user share zone info and we'll choose the region of the world we're in i go with america in denver because we have this silly thing called daylight savings time here so this will map the time or time zone into etsy local time and then that will set my time zone settings i'll then make sure to sync the hardware clock by doing hw clock dash dash system and now i'm all synced up from a time zone perspective we now want to edit etsy local dot gen this has a bunch of different encodings and languages that we want to set as our local or locale we'll delete this comment on nusutf8 save it up and then we're going to go ahead and copy a similar setting by doing localigen which will actually take those settings and set it up configure our locals locales and finally we want to actually edit a file that is going to store the locale information specifically for our initial boot up and then just some system settings that we can read as well so what we'll do here is we'll just put lang equals and then that same locality setting we uncommented into a new file called etsy locali.conf with this we're all set up from a language perspective and ready to start going and now the most fun sap we can set our host name we edit etsy hostname and go in and just name our computer so i'll name mine taco save it up and the host's name is good now we're gonna set up the initial ram disk which is going to be available at etsy mkinitcpio.conf we'll edit this file and then find the hooks section now the reason we need to change this is because we're using an encrypted file system so we need to do here is add encrypt to this list of hooks these are in an important order and then we want to move keyboard before encrypt so we'll put keyboard right bef after auto detect drop keyboard in and now we've got our hook set up for the init ram fs now all we've got to do is run mk init cpio dash p and type in linux and this will reconfigure or rebuild the initial ram fs that our machine is going to use as it boots up now that we've got the init ramf set up we're ready to go in and set up our bootloader grub so we'll start off by getting a list of the ids of our different partitions we need to grab the id for our encrypted partition six it'll be important for us to reference this in the grub configuration we'll then edit etsy default grub and you'll find a line in here that is grub command line linux and it should be empty what i'll do is just paste in this uuid below it so i can store it for later and i'm going to grab a little snippet of text here that i put in and i'll explain it here in a moment the snippet of text is basically going to give different instructions to grub it's going to first identify that this uuid which we're going to copy from below since this is an old uuid we're going to put this new one in here this uuid is a cryptid encrypted device we are then going to specify that the crypt route it should open up should be at dev mapper crypt root which is where we have been setting it and it is consistent with our f-stab record or file system table record so this will give grub what it needs to do to set up that encrypted partition by default grub will have a record for linux but we also need a record for windows so we can edit etsy grub d and go into 40 underscore custom this is where we can put a custom configuration in that will be generated and included in the grub config now i have a big chunk of text in my blog that i'm going to be using here the blog is in the description of this video if you want to grab the same but if you're setting up a windows partition like me what i do is i copy the content of this grub menu item for what used to be windows 10 in this picture but it's now windows 11 and i paste that into this extra config file now that this is pasted in there are a couple things that i need to change here actually the menu entry says windows 10 and i actually should have set this to windows 11 but that's just a cosmetic item for now if we look in here we now need to set the uuid for the partition 1 or the efis partition so this is a key thing to check for a bunch of ways that we can do this but what i'll do is just save this file go back to blk id and then grab the uuid for p1 or partition 1 that represents our efi partition so i'll grab that onto my clipboard and then i will edit this file again and update fsuuid with that partition 1 uuid you'll notice the chain loader is not pointed towards windows but it is pointed towards veracrypt because we want to call and boot veracrypt to unencrypt windows so that then veracrypt can launch windows itself in an unencrypted fashion so we'll save this up again and now grub is pretty good with grub set up it's now just a matter of generating this grub configuration file so there's a couple steps to this that we're gonna do the first step we're going to do is we're going to run a grub install to set up grub on the system now that grub has been installed we can do a grub make config and we want to push it against boot grub grub dot cfg this is the main config file now what this did if we edit and look inside of this file is it took those menu entries and configurations and made this massive file that contains all of the pieces again it should say windows 11 there now we can just save up this grub menu and or really just quit because it did save it and we're good to go with grub finally we can set up our user so we'll set up password for root again this is on our again arch system so we have to do this again we'll do a password for root then we want to create a user so we'll use our ad under the group wheel in my case naming it josh and then we want to set the password for josh so similarly we'll do password with josh and then put in the password for the user now i want the user josh to be able to run pseudo commands when prompted so we're going to run vi sudo which will open up the sudoers file we'll then go down and find where wheel is specified and the setting i like to uncomment here is to allow members of wheel to execute any command this will prompt them for the root password which is what i want if i'm running a route-based command now let's also set up networking so we'll use systemctl enable network manager to enable the network manager unit which basically turns on networking by default this will let me connect to wireless networks without any additional packages and we pretty much have a base system ready to go so we'll exit out of our charute we will unmount from the mount directory our partitions and we are ready to reboot the system and validate that we can boot into windows and linux once the machine reboots we'll see the grub menu here really tiny in the far left you'll see windows 10 which again should say 11 and then we'll put in our password for veracrypt password goes in the pim remains blank we'll hit enter and now if we unencrypt successfully we should boot right into windows 11. now that windows 11 is back up we can log in and we're good to go now let's see if we can boot into the arch install similar to windows we'll see the grub menu pop up and we can choose arch linux once it boots up it'll ask us for the password of our encrypted partition p6 we'll put that password in and then we'll be asked to put in our username and password so we'll enter those and now we're in the linux system granted it needs packages for a gui but what we can do first is go into nmtui connect as a pseudo user and we can put in the password for the network we want to connect to this will get us initial wireless connections so that we can go in install packages and ideally get to a user interface i'll just double check to make sure i now am able to access the outbound internet and i'll set up a d directory where i'm going to clone a repo so i have a repo i maintain at github.com octets and this repo is linux-desktop this contains a list and automation for installing all the base packages i use when i set up a linux desktop you'll see my make file here and most importantly make install dash packages is key that's where i maintain a list of all the packages i use every day and it will set it up and install all of these packages for me on my system now i won't have you watch every single package install from these make install packages but i do have a blog post and video on how i set up the desktop environment with these scripts once it's done all the installs for all the packages i'm expecting i then just go ahead and run make install term which compiles and sets up simple terminal on my machine you can use any terminal of course and i do make configure and that brings over some of my dot files and some different configuration like i make the grub menu a bigger font and small little tweaks here and there but the key thing is all my package isn't configured in place and now if i look inside of the file dot x init rc we can see some config here most importantly at the bottom that start xfc4 is there so if we run start x boom we're in a linux desktop environment now i'm just going to skip ahead after a couple minutes of configuration and show you the end state so now we're in the desktop environment i have my keys mapped d menu is set up to give me a list of apps i can launch my terminal with my key bindings web browser with my key bindings move windows around and rearrange them i am good to go so i left the desktop environment setup out again because i do have a blog post on it but i hope you found this post and video really interesting a full setup end to end of a laptop using linux and windows if you liked it feel free to subscribe let me know in the comments and i'll see you next time

In this video, we'll walk-through all the things you need to do to create a modern Linux workstation you can take with you on the go. post: https://octetz.com/p/xps-arch-w11 1. Hardware Overview: 00:00:00 2. Installation Media: 00:03:16 3. Disk (Partition) Layout: 00:08:56 4. Windows 11 Install: 00:11:22 5. Linux Install: 00:14:45