How to theme LUKS?

I am using Plasma Desktop. I have encrypted my boot drive during setup. Now this LUKS unlock screen shows up.

I want this login screen to look pretty. I want to theme it. Like this.

I found some topics discussing this suggesting me to install plymouth. So, I did. Plymouth works well. But LUKS screen is still based on tty. How can I make it look prettier?

/etc/mkinitcpio.conf

# vim:set ft=sh
# MODULES
# The following modules are loaded before any boot hooks are
# run.  Advanced users may wish to specify all system modules
# in this array.  For instance:
#     MODULES=(piix ide_disk reiserfs)
MODULES="i915"

# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image.  This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=()

# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way.  This is useful for config files.
FILES="/crypto_keyfile.bin"

# HOOKS
# This is the most important setting in this file.  The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
##   This setup specifies all modules in the MODULES setting above.
##   No raid, lvm2, or encrypted root is needed.
#    HOOKS=(base)
#
##   This setup will autodetect all modules for your system and should
##   work as a sane default
#    HOOKS=(base udev autodetect block filesystems)
#
##   This setup will generate a 'full' image which supports most systems.
##   No autodetection is done.
#    HOOKS=(base udev block filesystems)
#
##   This setup assembles a pata mdadm array with an encrypted root FS.
##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
#    HOOKS=(base udev block mdadm encrypt filesystems)
#
##   This setup loads an lvm2 volume group on a usb device.
#    HOOKS=(base udev block lvm2 filesystems)
#
##   NOTE: If you have /usr on a separate partition, you MUST include the
#    usr, fsck and shutdown hooks.
HOOKS="base udev plymouth plymouth-encrypt autodetect modconf block keyboard keymap filesystems fsck"

# COMPRESSION
# Use this to compress the initramfs image. By default, gzip compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"
#COMPRESSION="zstd"

# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=()
/etc/default/grub

GRUB_DEFAULT=saved
GRUB_TIMEOUT=0
GRUB_TIMEOUT_STYLE=hidden
GRUB_DISTRIBUTOR="Manjaro"
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash vt.global_cursor_default=0 cryptdevice=UUID=59d0c689-5f9f-40f0-af8f-6575a34b55a6:luks-59d0c689-5f9f-40f0-af8f-6575a34b55a6 root=/dev/mapper/luks-59d0c689-5f9f-40f0-af8f-6575a34b55a6 apparmor=1 security=apparmor udev.log_priority=3"
GRUB_CMDLINE_LINUX=""

# If you want to enable the save default function, uncomment the following
# line, and set GRUB_DEFAULT to saved.
GRUB_SAVEDEFAULT=true

# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"

# Uncomment to enable booting from LUKS encrypted devices
#GRUB_ENABLE_CRYPTODISK=y

# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console

# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command 'videoinfo'
GRUB_GFXMODE=auto

# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep

# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true

# Uncomment this option to enable os-prober execution in the grub-mkconfig command
GRUB_DISABLE_OS_PROBER=false

# Uncomment and set to the desired menu colors.  Used by normal and wallpaper
# modes only.  Entries specified as foreground/background.
GRUB_COLOR_NORMAL="light-gray/black"
GRUB_COLOR_HIGHLIGHT="green/black"

# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/usr/share/grub/background.png"
GRUB_THEME="/usr/share/grub/themes/manjaro/theme.txt"

# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"

# Uncomment to ensure that the root filesystem is mounted read-only so that
# systemd-fsck can run the check automatically. We use 'fsck' by default, which
# needs 'rw' as boot parameter, to avoid delay in boot-time. 'fsck' needs to be
# removed from 'mkinitcpio.conf' to make 'systemd-fsck' work.
# See also Arch-Wiki: https://wiki.archlinux.org/index.php/Fsck#Boot_time_checking
#GRUB_ROOT_FS_RO=true
GRUB_ENABLE_CRYPTODISK=y

plymouth themes

plymouth-set-default-theme -l
bgrt
details
fade-in
glow
manjaro-circle
manjaro-elegant
manjaro-extra-elegant
manjaro
manjaro-very-elegant
script
solar
spinfinity
spinner
text
tribar

Everything looks already in place so just set a default plymouth theme with sudo plymouth-set-default-theme -R bgrt and reboot then.

It doesn’t work. I only see tty screen.

You did remember to regenerate your initramfs’ after changing the mkinitcpio.conf file, right?

If not, execute this after you are logged in:

sudo mkinitcpio -P

yes, I did.

Ah, I see now. Your first screenshot shows grub prompt, not tty’s one.
There’s no way to theme grub password prompt, at least that I know of.

In short, you need to reconfigure your system to have your /boot partition unencrypted.
Another option is rather stupid but anyways: delete /crypto_keyfile.bin file and do mkinitcpio -R, and you will have your fancy passphrase prompt after selecting Manjaro entry in Grub menu. But you still will be greeted by an ugly text-only Grub prompt before you see any boot menu. So it basically will just make you enter your password twice, but the second time will be a nice-looking one lol

If you still want it but in a sane and secure way then you need to install systemd-boot and sbupdate (AUR), and read respective wiki articles on how to set up these things properly. This includes Secure Boot verification of your kernels and bootloader to provide better security. I had already shared some bits of related info before. Side-effect is that you won’t be able to edit kernel cmdline before you boot as it would be a part of the whole unified boot image.

1 Like

Hi everyone.
Does anyone know how to help me with this?