Arch Linux

7thCore

Member

Registered: 2018-06-09

Posts: 75

[ssd, hdd, lvm, luks] Swap partition & ssd trim

Hello again,

this time Im working on encrypting my entire laptop due to traveling and it containing some material i don't want getting into the wrong hands (home server passwords, openvpn certificates and so on).

The setup i have in mind is as follows:

SSD: -/boot (EFI, unencrypted)
         -lvm
             -encrypted luks volume
                 -/root (btrfs)
                 -/home (btrfs)

HDD: -lvm
             -encrypted luks volume
                 -swap
                 -/data (ext4)

I want the swap on the hard drive to prevent any additional ssd ware and tare. Now the question in mind is how do i set this up? I mean I have the filesystems created and everything but how can i set up the swap so i can hibernate the system.
Also how can i set up that when i enter the passphrase it unlocks both drives.

Another question i have is TRIM support on the ssd by the lvm and/or the encrypted luks volume. How do i set that up? Do i add the discard and ssd flags to the fstab for btrfs mounts also?

The script i am working on to enable this (don't mind the missing gui and stuff like that. I just have to solve these problems first. Everything else is child's play):

#!/bin/bash

read -p "Enter boot partition: " BOOTPARTITION

read -p "Enter partition for root and home LVM: " LVMA

read -p "Enter partition for swap and data LVM: " LVMB 

read -p "Enter passphrase for sda: " CRYPTSETUPSDA
echo "$CRYPTSETUPSDA" > /cryptsetup-sda.key

read -p "Enter passphrase for sdb: " CRYPTSETUPSDB
echo "$CRYPTSETUPSDB" > /cryptsetup-sdb.key

#Prepare efi boot partition

mkfs.fat -F32 /dev/$BOOTPARTITION

#Prepare disks for dm-crypt encryption

#create encrypted sda
cryptsetup -q -v luksFormat --type luks2 /dev/$LVMA /cryptsetup-sda.key #Create encrypted partition
cryptsetup --key-file /cryptsetup-sda.key luksOpen /dev/$LVMA lvmsda #Open encrypted partition

pvcreate /dev/mapper/lvmsda #Create lvm partition
vgcreate cryptvol_lvma /dev/mapper/lvmsda #Create lvm group
lvcreate -L110G cryptvol_lvma -n root #Create lvm logical volume
lvcreate -l 100%FREE cryptvol_lvma -n home  #Create lvm logical volume with all free space available

mkfs.btrfs -f -L "Root" /dev/mapper/cryptvol_lvma-root #Create root filesystem
mkfs.btrfs -f -L "Home" /dev/mapper/cryptvol_lvma-home #Create home filesystem

#create encrypted sdb
cryptsetup -q -v luksFormat --type luks2 /dev/$LVMB /cryptsetupsdb.key #Create encrypted partition
cryptsetup --key-file /cryptsetup-sdb.key luksOpen /dev/$LVMB lvmsdb #Open encrypted partition

pvcreate /dev/mapper/lvmsdb #Create lvm partition
vgcreate cryptvol_lvmb /dev/mapper/lvmsdb #Create lvm group
lvcreate -L32G cryptvol_lvmb -n swap #Create lvm logical volume
lvcreate -l 100%FREE cryptvol_lvmb -n data  #Create lvm logical volume with all free space available

mkswap /dev/mapper/cryptvol_lvmb-swap
mkfs.ext4 /dev/mapper/cryptvol_lvmb-data

#Create subvolumes root

mount /dev/mapper/cryptvol_lvma-root /mnt

cd /mnt
btrfs subvolume create _active
btrfs subvolume create _active/rootvol
btrfs subvolume create _snapshots

#Unmount
cd
umount /mnt

#Create subvolumes home
mount /dev/mapper/cryptvol_lvma-home /mnt
cd /mnt
btrfs subvolume create _active
btrfs subvolume create _active/homevol
btrfs subvolume create _snapshots

#Unmount
cd
umount /mnt

#Mount file systems for instal
mount -o rw,relatime,ssd,discard,space_cache,subvol=_active/rootvol /dev/mapper/cryptvol_lvma-root /mnt
mkdir /mnt/{boot,data,home}
mount -o rw,relatime,ssd,discard,space_cache,subvol=_active/homevol /dev/mapper/cryptvol_lvma-home /mnt/home
mount /dev/$BOOTPARTITION /mnt/boot
mount -o rw,defaults /dev/mapper/cryptvol_lvmb-data /mnt/data

#Install Arch Linux
pacstrap /mnt base base-devel btrfs-progs

#Generate fstab
genfstab -U /mnt >> /mnt/etc/fstab

#Set language and time config
arch-chroot /mnt /bin/bash << EOF
#Set language config
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
echo "LANG=en_US.UTF-8" > /etc/locale.conf
locale-gen
echo "KEYMAP=slovene" >> /etc/vconsole.conf

rm -rf /etc/localtime
ln -s /usr/share/zoneinfo/Europe/Ljubljana /etc/localtime
EOF

#Set hostname and enable DHCP
arch-chroot /mnt /bin/bash << EOF
echo "$HOSTNAME" > /etc/hostname

sed -i 's/localhost/$HOSTNAME/g' /etc/hosts
sed -i 's/$HOSTNAME.localdomain/localhost.localdomain/g' /etc/hosts

systemctl enable dhcpcd
EOF

sed -i 's/HOOKS=*/HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt sd-lvm2 btrfs filesystems fsck)/g' /etc/mkinitcpio.conf
mkinitcpio -p linux

#Install systemd-boot
arch-chroot /mnt /bin/bash << EOF
bootctl --path=/boot install
EOF

mkdir -p  /mnt/boot/loader/entries

cat > /boot/loader/loader.conf << EOF
default arch
timeout 3
editor no
EOF

CRYPTROOTUUID=$(blkid -s PARTUUID -o value /dev/$LVMA)

cat > /boot/loader/entries/arch.conf  << EOF
title Arch Linux
linux /vmlinuz-linux
initrd /intel-ucode.img
initrd /initramfs-linux.img
options cryptdevice=UUID=$CRYPTROOTUUID:volume root=/dev/mapper/cryptvol_lvma-root quiet rw
EOF

I've seen somewhere that enabling trim for lvm is set like so:

pvcreate --dataalignment 1m /dev/mapper/cryptvol_lvma

Again is anything else needed (btrfs, luks and so forth)?

Any help is welcome!

Last edited by 7thCore (2018-06-27 05:19:50)

---

The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do it yourself'. Yes, that's it.

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [ssd, hdd, lvm, luks] Swap partition & ssd trim

Swap_encryption#mkinitcpio_hook unless you change the location of the swap partition on the same device as root.

7thCore

Member

Registered: 2018-06-09

Posts: 75

Re: [ssd, hdd, lvm, luks] Swap partition & ssd trim

Thanks. Sorry i missed that.

Btw the ssd trim. Wich one shoukd i enable?

Lvm:

pcvcreate --dataalignment lm /dev/mapper/lvm

Dm-crypt

cryptsetup --allowdiscards --persistent

Or btrfs flags

ssd, discard

Or all 3?

Last edited by 7thCore (2018-06-26 22:20:40)

---

The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do it yourself'. Yes, that's it.

DasRohr

Member

Registered: 2018-06-21

Posts: 9

Re: [ssd, hdd, lvm, luks] Swap partition & ssd trim

from what I know, it is recommended to use a Periodic Trim rather then a Continuous to reduce ssd wear:
https://wiki.archlinux.org/index.php/So … iodic_TRIM

7thCore

Member

Registered: 2018-06-09

Posts: 75

Re: [ssd, hdd, lvm, luks] Swap partition & ssd trim

@DasRohr

that i know however from past experience i had a bit of a problem with it. My system came to a grinding halt with it.

The ssd in question however is new. A samsung 860 pro 250GB.

Last edited by 7thCore (2018-06-27 07:09:47)

---

The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do it yourself'. Yes, that's it.

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,435

Re: [ssd, hdd, lvm, luks] Swap partition & ssd trim

There have also been lots of improvements in how it is implemented on the kernel side, I used to have the to "a halt grinding" due to fstrim, but it's a faint memory now and I couldn't even pinpoint at which kernel version that was resolved.