Arch Linux Fresh Install: Bare Metal to Productive Desktop

curl -s https://archlinux.org/download/ | grep -oP 'archlinux-\d{4}\.\d{2}\.\d{2}-x86_64\.iso' | head -1

curl -LO https://geo.mirror.pkgbuild.com/iso/latest/archlinux-x86_64.iso

curl -LO https://geo.mirror.pkgbuild.com/iso/latest/archlinux-x86_64.iso.sig

gpg --keyserver-options auto-key-retrieve --verify archlinux-x86_64.iso.sig archlinux-x86_64.iso

# Plug in USB — identify the DEVICE (sda), NOT a partition (sda1)
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT

# This directory must exist — if not, you're in Legacy mode
ls /sys/firmware/efi/efivars

# Tiny text on 4K screen? Fix it
setfont ter-132b

# Set root password for the live environment
passwd

# Start SSH daemon
systemctl start sshd

# Get the T16g's IP address
ip -4 -o addr show | awk '$2!="lo" {print $2, $4}'

timedatectl set-ntp true

timedatectl status

reflector --country US --age 12 --protocol https --sort rate --save /etc/pacman.d/mirrorlist

lsblk

fdisk -l

# Wipe partition table and create GPT
sgdisk -Z /dev/nvme0n1

# Create EFI partition (512M)
sgdisk -n 1:0:+512M -t 1:ef00 /dev/nvme0n1

# Create /boot partition (2G — holds main + LTS + fallback initramfs)
sgdisk -n 2:0:+2G -t 2:8300 /dev/nvme0n1

# Create root partition (250G)
sgdisk -n 3:0:+250G -t 3:8309 /dev/nvme0n1

# Create home partition (remaining space)
sgdisk -n 4:0:0 -t 4:8309 /dev/nvme0n1

# Verify — should show 4 partitions
sgdisk -p /dev/nvme0n1

# EFI — FAT32
mkfs.fat -F32 /dev/nvme0n1p1

# /boot — ext4
mkfs.ext4 /dev/nvme0n1p2

# Root — Btrfs on LUKS (label for fstab readability)
mkfs.btrfs -L archroot /dev/mapper/cryptroot

# Home — Btrfs on LUKS
mkfs.btrfs -L archhome /dev/mapper/crypthome

# Mount root subvolume with production options
mount -o noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvol=@ /dev/mapper/cryptroot /mnt

# Create mount points
mkdir -p /mnt/{boot/efi,home,.snapshots,var/log}

# Mount remaining root subvolumes
mount -o noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvol=/@snapshots /dev/mapper/cryptroot /mnt/.snapshots
mount -o noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvol=/@var_log /dev/mapper/cryptroot /mnt/var/log

# Mount home from separate LUKS volume
mount -o noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvol=/@home /dev/mapper/crypthome /mnt/home

# Mount /boot (ext4)
mount /dev/nvme0n1p2 /mnt/boot

# Mount EFI
mount /dev/nvme0n1p1 /mnt/boot/efi

# Final verification — all 6 mount points visible
lsblk /dev/nvme0n1

# Detailed mount verification
findmnt -t btrfs,vfat,ext4 --output TARGET,SOURCE,FSTYPE,OPTIONS -n

pacstrap -K /mnt \
    base \
    linux \
    linux-headers \
    linux-lts \
    linux-lts-headers \
    linux-firmware \
    base-devel \
    btrfs-progs \
    git \
    neovim \
    zsh \
    sudo \
    networkmanager \
    openssh \
    intel-ucode \
    iwd \
    wireless_tools \
    zram-generator

genfstab -U /mnt >> /mnt/etc/fstab

# Verify — should show entries for:
#   /         (cryptroot, subvol=/@)
#   /.snapshots (cryptroot, subvol=/@snapshots)
#   /var/log  (cryptroot, subvol=/@var_log)
#   /home     (crypthome, subvol=/@home)
#   /boot     (ext4)
#   /boot/efi (vfat)
cat /mnt/etc/fstab

arch-chroot /mnt

# Get the UUID of the home LUKS partition (nvme0n1p4, NOT the mapper)
blkid -s UUID -o value /dev/nvme0n1p4

# Create crypttab — replace <HOME-LUKS-UUID> with the UUID above
cat > /etc/crypttab << 'EOF'
# <name>    <device>                          <password>  <options>
crypthome   UUID=<HOME-LUKS-UUID>             none        luks,timeout=90
EOF

ln -sf /usr/share/zoneinfo/America/Los_Angeles /etc/localtime

hwclock --systohc

sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen

locale-gen

echo "LANG=en_US.UTF-8" > /etc/locale.conf

# Replace with your hostname (e.g., modestus-t16g, modestus-legion)
echo "modestus-t16g" > /etc/hostname

cat > /etc/hosts << 'EOF'
127.0.0.1   localhost
::1         localhost
127.0.1.1   modestus-t16g.inside.domusdigitalis.dev modestus-t16g
EOF

cat > /etc/systemd/zram-generator.conf << 'EOF'
[zram0]
zram-size = ram / 2
compression-algorithm = zstd
EOF

passwd

useradd -m -G wheel -s /bin/zsh evanusmodestus

passwd evanusmodestus

# Enable sudo for wheel group
EDITOR=nvim visudo
# Uncomment: %wheel ALL=(ALL:ALL) ALL

systemctl enable NetworkManager

systemctl enable systemd-timesyncd

nvim /etc/mkinitcpio.conf

MODULES=()

HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block encrypt btrfs filesystems fsck)

mkinitcpio -P

bootctl --esp-path=/boot/efi --boot-path=/boot install

cat > /boot/efi/loader/loader.conf << 'EOF'
default arch.conf
timeout 3
console-mode max
editor no
EOF

# LUKS partition UUID for cryptdevice= (the RAW partition, not the mapper)
blkid -s UUID -o value /dev/nvme0n1p3

bootctl list

# Should show 3 entries: Arch Linux, Arch Linux (fallback), Arch Linux LTS
ls /boot/efi/loader/entries/

exit

umount -R /mnt

reboot

# Connect to network
ip addr

nmcli device wifi connect "YourSSID" password "YourPassword"

ping -c 3 archlinux.org

# Enable and start SSH immediately
sudo systemctl enable --now sshd

# Get the new IP (different from live ISO)
ip -4 -o addr show | awk '$2!="lo" {print $2, $4}'

ssh evanusmodestus@<NEW-T16G-IP>

sudo pacman -Syu

git clone https://aur.archlinux.org/yay.git /tmp/yay
cd /tmp/yay && makepkg -si
cd ~

# Uncomment [multilib] section
sudo nvim /etc/pacman.conf

sudo pacman -Syu

sudo pacman -S \
    stow \
    age \
    man-db \
    man-pages \
    htop \
    btop \
    tree \
    wget \
    curl \
    unzip \
    zip \
    p7zip

sudo pacman -S \
    hyprland \
    xdg-desktop-portal-hyprland \
    waybar \
    wofi \
    mako \
    hyprlock \
    hypridle \
    hyprpaper \
    grim \
    slurp \
    wl-clipboard \
    cliphist \
    swappy

sudo pacman -S kitty

yay -S ghostty

sudo pacman -S \
    ttf-jetbrains-mono-nerd \
    ttf-nerd-fonts-symbols \
    ttf-font-awesome \
    noto-fonts \
    noto-fonts-emoji \
    noto-fonts-cjk

sudo pacman -S \
    pipewire \
    pipewire-alsa \
    pipewire-pulse \
    pipewire-jack \
    wireplumber \
    pavucontrol

systemctl --user enable --now pipewire pipewire-pulse wireplumber

sudo pacman -S bluez bluez-utils blueman

sudo systemctl enable --now bluetooth

# SDDM for graphical login, or just use TTY login + Hyprland auto-start
sudo pacman -S sddm
sudo systemctl enable sddm

sudo pacman -S \
    thunar \
    thunar-volman \
    gvfs \
    tumbler \
    ffmpegthumbnailer \
    zathura \
    zathura-pdf-mupdf \
    imv \
    polkit-gnome

# Already installed grim + slurp above
# For screen recording:
sudo pacman -S wf-recorder

sudo pacman -S \
    qt5-wayland \
    qt6-wayland \
    gtk3 \
    gtk4 \
    nwg-look

yay -S catppuccin-gtk-theme-mocha catppuccin-cursors-mocha

mkdir -p ~/atelier/{_bibliotheca,_projects/personal}

git clone git@github.com:EvanusModestus/dots-quantum.git \
    ~/atelier/_projects/personal/dots-quantum

sudo pacman -S \
    fzf \
    fd \
    ripgrep \
    bat \
    eza \
    jq \
    yq \
    lazygit \
    tmux

yay -S oh-my-posh-bin

cd ~/atelier/_projects/personal/dots-quantum

stow -t ~ \
    zsh bash shell git \
    hyprland waybar wofi mako \
    kitty oh-my-posh \
    bin share \
    btop fastfetch fzf fd ripgrep \
    claude

# Check symlinks were created
ls -la ~/.zshrc
ls -la ~/.config/hypr/hyprland.conf
ls -la ~/.config/waybar/config.jsonc

git clone git@github.com:EvanusModestus/domus-nvim.git \
    ~/atelier/_projects/personal/domus-nvim

# Symlink nvim config
ln -sf ~/atelier/_projects/personal/domus-nvim ~/.config/nvim

# Launch nvim — plugins will auto-install on first run
nvim

cd ~/atelier/_projects/personal/dots-quantum

stow -t ~ \
    tmux vim lazygit \
    vscodium zathura thunar \
    libvirt ghostty

# Check if host-specific directory exists
ls ~/atelier/_projects/personal/dots-quantum/hosts/

# Create host config for new machine if needed
# (monitor layout, GPU settings, etc.)
mkdir -p ~/atelier/_projects/personal/dots-quantum/hosts/modestus-legion

mkdir -p ~/.age/{recipients,identities}
chmod 700 ~/.age/identities

# Copy your age identity from secure backup
# (USB drive, password manager, or SCP from existing machine)
# DO NOT paste identity content here — execute manually

# Verify age can decrypt
age -d -i ~/.age/identities < /dev/null 2>&1 | head -1
# Should show a decryption error, not "no identity file"

mkdir -p ~/.ssh
chmod 700 ~/.ssh

# Option A: Restore from backup (SCP from existing machine)
# scp modestus-razer:~/.ssh/id_ed25519* ~/.ssh/

# Option B: Generate new keypair
ssh-keygen -t ed25519 -C "evanusmodestus@modestus-t16g"

chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

age -d -i ~/.age/identities \
    ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.age \
    > ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config

cd ~/atelier/_projects/personal/dots-quantum
stow -t ~ ssh

# Verify SSH config is symlinked
ls -la ~/.ssh/config

# Copy public key (if new key was generated)
cat ~/.ssh/id_ed25519.pub | wl-copy

ssh -T git@github.com

ssh -T git@gitlab.com

ssh git@gitea-01.inside.domusdigitalis.dev

# Antora runs via npx — no global install needed
# Verify node/npm versions
node --version
npm --version

cd ~/atelier/_bibliotheca

# Hub
git clone git@github.com:EvanusModestus/domus-docs.git

# Core spokes
for repo in domus-captures domus-infra-ops domus-ise-linux domus-secrets-ops domus-linux-ops domus-antora-ui; do
    git clone git@github.com:EvanusModestus/$repo.git
done

# Verify build
cd ~/atelier/_bibliotheca/domus-docs
make

cd ~/atelier/_projects/personal

for repo in netapi netapi-tui domus-cli ise-automation domus-digitalis evanusmodestus-site; do
    git clone git@github.com:EvanusModestus/$repo.git
done

# For each repo that needs GitLab + Gitea mirrors:
# Example for domus-captures
cd ~/atelier/_bibliotheca/domus-captures
git remote add gitlab git@gitlab.com:EvanusModestus/domus-captures.git
git remote add gitea ssh://git@gitea-01.inside.domusdigitalis.dev:2222/evanusmodestus/domus-captures.git

# Install Claude Code CLI
npm install -g @anthropic-ai/claude-code

# Verify (dots-quantum/claude already stowed settings + hooks)
claude --version

sudo pacman -S podman buildah skopeo

sudo pacman -S qemu-full libvirt virt-manager dnsmasq

sudo systemctl enable --now libvirtd

sudo usermod -aG libvirt evanusmodestus

sudo pacman -S \
    httpie \
    tokei \
    dust \
    duf \
    procs \
    bandwhich \
    hyperfine

yay -S rmapi

# Take a btrfs snapshot of the clean install
sudo btrfs subvolume snapshot -r / /.snapshots/fresh-install-$(date +%Y%m%d)

# Verify
sudo btrfs subvolume list /.snapshots

# Post-install: check hardware detection
lspci | grep -E "(VGA|Network|Audio)"

# HiDPI scaling (add to hyprland.conf if text is tiny on 3.2K OLED)
# monitor=,preferred,auto,1.5

# ThinkPad battery charge thresholds (via TLP)
sudo pacman -S tlp tlp-rdw
sudo systemctl enable --now tlp
# Edit /etc/tlp.conf:
#   START_CHARGE_THRESH_BAT0=40
#   STOP_CHARGE_THRESH_BAT0=80

# Brightness control (laptop screens)
sudo pacman -S brightnessctl

# Backlight for keyboard
brightnessctl -d *kbd* set 50%

# Power profiles
sudo pacman -S power-profiles-daemon
sudo systemctl enable --now power-profiles-daemon

# Check current power profile
powerprofilesctl get

# Partition layout with sizes and mount points
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT

# Partition layout with UUIDs and labels
lsblk -f

# GPT partition table details
sgdisk -p /dev/nvme0n1

# Disk usage summary for key mount points
df -h / /home /boot /boot/efi

# List all open LUKS mappings
dmsetup ls --target crypt

# LUKS header details (cipher, key slots, UUID)
sudo cryptsetup luksDump /dev/nvme0n1p3

# Status of an open LUKS container
sudo cryptsetup status cryptroot

# Verify crypttab (additional LUKS volumes opened at boot)
cat /etc/crypttab

# List subvolumes on root
sudo btrfs subvolume list /

# List subvolumes on home (if separate LUKS)
sudo btrfs subvolume list /home

# Detailed space usage (data, metadata, system)
sudo btrfs filesystem usage /

# Allocation profile (single, DUP, etc.)
sudo btrfs filesystem df /

# Device error stats (corruption detection)
sudo btrfs device stats /

# Scrub status (last integrity check)
sudo btrfs scrub status /

# List snapshots
sudo btrfs subvolume list /.snapshots

# All btrfs + vfat + ext4 mounts with full options (the master view)
findmnt -t btrfs,vfat,ext4 --output TARGET,SOURCE,FSTYPE,OPTIONS -n

# fstab contents (persistent mounts)
cat /etc/fstab

# Verify all fstab entries are mounted
findmnt --verify

# systemd-boot status (ESP path, entries, default)
bootctl status

# List boot entries
bootctl list

# Loader configuration
cat /boot/efi/loader/loader.conf

# All boot entry files
cat /boot/efi/loader/entries/*.conf

# mkinitcpio MODULES and HOOKS
grep -E '^(MODULES|HOOKS)=' /etc/mkinitcpio.conf

# Kernel versions installed
ls /boot/vmlinuz-*

# Running kernel
uname -r

# zram device status (size, compression, algorithm)
zramctl

# All swap devices
swapon --show

# zram-generator config
cat /etc/systemd/zram-generator.conf

# Boot time breakdown
systemd-analyze

# Slowest services at boot
systemd-analyze blame | head -20

# Failed services
systemctl --failed

# Hardware detection (GPU, network, audio)
lspci | grep -E "(VGA|Network|Audio)"

# GPU status (NVIDIA)
nvidia-smi

# NVIDIA driver and kernel module version
nvidia-smi --query-gpu=driver_version --format=csv,noheader
cat /proc/driver/nvidia/version 2>/dev/null | head -1

# IPv4 addresses (concise)
ip -4 -o addr show | awk '{print $2, $4}'

# Network device status
nmcli device status

# DNS resolver status
resolvectl status

# Listening ports (what services are exposed)
ss -tlnp | awk '{print $4}' | sort -u

# UFW status and rules
sudo ufw status verbose

# List installed models with sizes
ollama list

# Verify bind mount for model storage
findmnt /var/lib/ollama/.ollama/models

# Ollama service status
systemctl status ollama