Hi everyone! I’m new to Manjaro (not new to Linux in general, though). Now that my system is up and running, I’d like to implement full disk encryption with DM-CRYPT/LUKS2 + Argon. Am I right in assuming that this is currently only achievable by using a patched GRUB that supports Argon? I tried th…

[image] cablehub: One question though: You mentioned this integrates nicely with Secure Boot, but there seem to be no instructions on how to actually set that up? I assume you’re asking how to set up Secure Boot in a way that it works with UKIs, right? Well, that’s the beauty of it - you re…

Grub is not the only available boot loader. I take the easy route and have an unencrypted /boot - in that case, the grub limitations don’t matter. But there are other ways which I have not explored myself. dm-crypt/Encrypting an entire system - ArchWiki

I explored (and tested) a couple of options to achieve this myself before migrating to Manjaro about two years ago. In the end, I went with UKIs, which seemed like the most elegant solution back then. Has been working great (without any major issues) ever since.

[image] fonic: I went with UKIs What is a UKI if I may ask??

You may find the answer here: Unified kernel image - ArchWiki

An UKI basically is a single file which contains everything needed to boot Linux (kernel image, initramfs image, microcode patches, etc.). UKIs are EFI binaries by nature that are stored on the ESP (EFI system partition) and can be loaded/executed directly by UEFIs (i.e. no bootloader like GRUB is …

[image] fonic: If you’re interested in going that route, I just recently cleaned up the scripts and hooks I’m using to automate UKI configuration/creation and uploaded them to GitHub. Those UKIs actually seem like a quite interesting approach. Had never heard about that before. Could you pos…

[image] cablehub: Am I right in assuming that this is currently only achievable by using a patched GRUB that supports Argon? If you must use grub then yes [image] cablehub: I tried the encryption option provided by the installer, but that seems to use LUKS1 only. That is also correct. …

[image] cablehub: Could you post the link to your repo? I think I’ll might give it a try. What exactly do your files automate? Here’s the link to the repo: [image] GitHub - fonic/arch-uki-luks2: Hooks for pacman/pamac to automatically configure... Hooks for pacman/pamac to …

[image] [root tip] [Utility Script] Encrypted Manjaro Linux using Verified Boot Clone the script git clone https://codeberg.org/wonky/secure-boot-setup cd secure-boot-setup [image] secure-boot-setup PoC - Boot Manjaro using Secure Boot

[image] [root tip] [Utility Script] Encrypted Manjaro Linux using Verified Boot Clone the script Thanks, I’ll probably test this as well! Currently I’m reading up on the UKI thing.

Manjaro Linux Forum

Full disk encryption with LUKS2 + Argon

Support

ManjaroDevOps 25 July 2025 12:17 10