I've had a couple of people ask me about this. Way back in the forum days, the user Graf Zeppelin made an effort post detailing the process of the perfect "maximum autismo" installation for Gentoo. It was a great guide, but was lost with the forum (still not coming back BTW :smuganimegirl:).
After a couple of people asked, I realized I might as well dig into a backup and pull it out, and put it up for its deserved public consumption. So here the post is in its entirety:
By Graf Zeppelin
Gather round normans, we're setting up a LUKS/LVM anti-CIA niggers maximum autismo machine. This guide is optimized for the xx20 thinkpads (X220, T420 and T520), other laptops will require some modifications to the steps below. Credit where credit is due, this is heavily influenced by a youtube video made by msjche -- https://www.youtube.com/watch?v=IzUf-wFEirQ&t;# lsblk
# sudo dd if=/.../install-amd64-minimal-XXXXXXXX.iso of=/dev/sdX bs=4M status=progress && sync
# lsblk -D
Non-zero values in the DISK-GRAN and DISK-MAX columns indicate TRIM support. If your SSD somehow does not support TRIM, it may be better to skip the SSD-specific steps below.
# fdisk -l
# fdisk /dev/sda
o
n
<enter>
<enter>
<enter>
+500M
a
n
<enter>
<enter>
<enter>
<enter>
t
<enter>
8E
w
# fdisk -l
# fdisk /dev/sdb
o
n
<enter>
<enter>
<enter>
<enter>
w
# cryptsetup -v -y -c aes-xts-plain64 -s 512 -h sha512 -i 5000 --use-random luksFormat /dev/sda2
# dd if=/dev/urandom of=keyfile bs=1024 count=20
# cryptsetup -c aes-xts-plain64 -s 512 -h sha512 -i 5000 --key-file keyfile luksFormat /dev/sdb1
# cryptsetup open --type luks /dev/sda2 lvm
# cryptsetup --key-file keyfile open --type luks /dev/sdb1 hdd
# pvcreate --dataalignment 1m /dev/mapper/lvm
Otherwise ommit it
# pvcreate /dev/mapper/lvm
# vgcreate volgroup0 /dev/mapper/lvm
lvcreate -L 30GB volgroup0 -n lv_root
lvcreate -L 7.69GB volgroup0 -n lv_swap
lvcreate -l 100%FREE volgroup0 -n lv_home
# vgscan
# vgchange -ay
# mkfs.ext2 /dev/sda1
# mkfs.ext4 /dev/volgroup0/lv_root
# mkfs.ext4 /dev/volgroup0/lv_home
# mkswap /dev/volgroup0/lv_swap
# swapon /dev/volgroup0/lv_swap
# mkfs.ext4 /dev/mapper/hdd
# mount /dev/volgroup0/lv_root /mnt/gentoo/
# mkdir /mnt/gentoo/{boot,home}
# mount /dev/sda1 /mnt/gentoo/boot
# mount /dev/volgroup0/lv_home /mnt/gentoo/home
# mkdir -p /mnt/gentoo/mnt/hdd
# mount /dev/mapper/hdd /mnt/gentoo/mnt/hdd
# cd /mnt/gentoo
# links www.gentoo.org/main/en/mirrors.xml
# tar xvjpf stage3-amd64-YYYYMMDD.tar.bz2
OR
# tar xvJpf stage3-amd64-YYYYMMDD.tar.xz
# grep processor /proc/cpuinfo
# grep -m1 -A3 "vendor_id" /proc/cpuinfo
# lspci | grep -i VGA
nano -w /mnt/gentoo/etc/portage/make.conf
# mirrorselect -i -o >> /mnt/gentoo/etc/portage/make.conf
# mkdir /mnt/gentoo/etc/portage/repos.conf
# cp /mnt/gentoo/usr/share/portage/config/repos.conf /mnt/gentoo/etc/portage/repos.conf/gentoo.conf
# cp -L /etc/resolv.conf /mnt/gentoo/etc/
# mount -t proc /proc/ /mnt/gentoo/proc/
# mount --rbind /sys/ /mnt/gentoo/sys/
# mount --rbind /dev/ /mnt/gentoo/dev/
# mkdir /mnt/gentoo/hostrun
# mount --bind /run/ /mnt/gentoo/hostrun/
# cp /root/keyfile /mnt/gentoo/root
# chroot /mnt/gentoo /bin/bash
# source /etc/profile
# export PS1="(chroot) ${PS1}"
# mkdir /run/lvm
# mount --bind /hostrun/lvm /run/lvm
# rm -rf /etc/portage/{package.use,package.mask}
# touch /etc/portage/{package.accept_keywords,package.mask,package.use}
# nano -w /etc/portage/package.mask
sys-apps/systemd
sys-fs/udev
# emerge-webrsync
# eselect profile list
# eselect profile set ${NUM}
# emerge --sync
# emerge -uvDNa @world
# emerge -av sudo vim ntp grub genkernel-next gentoo-sources linux-firmware lvm2 pm-utils gentoolkit networkmanager at xrandr acpi acpid
pm-utils is for suspend and hibernate commands
at is used in udev rules to lauch scripts, such as automatic monitor detection upon vga/displayport plugging/unplugging (more on this later). And yes, you can use udev rules as per usual even if you masked udev in the steps above (gentoo automatically replaces it with some other more stallman-y replacement)
acpi and acpid is for powermanagement
# vim /etc/lvm/lvm.conf
issue_discards = 1
# vim /etc/crypttab
# # vim /etc/fstab
Either adapt to what you currently have in your brainlet distro or do something along the lines of the example below:
#
# /dev/mapper/volgroup0-lv_root
UUID= / ext4 rw,noatime,data=ordered 0 1
# /dev/sdb1
UUID= /boot ext2 rw,relatime,block_validity,barrier,user_xattr,acl 0 2
# /dev/mapper/volgroup0-lv_home
UUID= /home ext4 rw,noatime,data=ordered 0 2
# /dev/mapper/hdd
UUID= /mnt/hdd ext4 rw,relatime,data=ordered 0 2
# /dev/mapper/volgroup0-lv_swap
UUID= none swap defaults 0 0
Again, use :read !blkid to get UUIDs. There are no quotes or anything around the numbers, syntax is just something like UUID=32422ads-asdfaf32
# genkernel --makeopts=-j4 --menuconfig --lvm --luks all
General setup --->
(-${KERNEL_SUFFIX}) Local version - append to kernel release
Device Drivers --->
- Multiple devices driver support (RAID and LVM) --->
<*> Device mapper support
<*> Crypt target support
<*> Snapshot target
<*> Mirror target
<*> Multipath target
<*> I/O Path Selector based on the number of in-flight I/Os
<*> I/O Path Selector based on the service time
- Cryptographic API --->
<*> XTS support
<*> SHA1 digest algorithm
<*> SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)
<*> SHA512 digest algorithm (SSSE3/AVX/AVX2)
<*> SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)
<*> SHA512 digest algorithm (x86_64 Multi-Buffer, Experimental)
-*- AES cipher algorithms
-*- AES cipher algorithms (x86_64)
<*> AES cipher algorithms (AES-NI)
<*> Serpent cipher algorithm
<*> Twofish cipher algorithm
<*> User-space interface for hash algorithms
<*> User-space interface for symmetric key cipher algorithms
<*> User-space interface for random number generator algorithms
<*> User-space interface for AEAD cipher algorithms
Device Drivers --->
- USB support --->
{*} Support for Host-side USB
<*> EHCI HCD (USB 2.0) support
- Root Hub Transaction Translators
- Improved Transaction Translator scheduling
{*} Generic EHCI driver for a platform device
Device Drivers --->
- Network device support --->
- Wireless LAN
< > * - Disable all other drivers
Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi)
Intel Wireless WiFi DVM Firmware support
Intel Wireless WiFi MVM Firmware support
Generic Driver Options --->
-*- Userspace firmware loading support
- Include in-kernel firmware blobs in kernel binary
(iwlwifi-6000g2a-6.ucode) External firmware blobs in kernel binary
(/lib64/firmware) Firmware blobs root directory
Processor type and features --->
<*> /dev/cpu/*/msr - Model-specific register support
Power management and ACPI options --->
- ACPI (Advanced Configuration and Power Interface) Support --->
<*> AC Adapter
<*> Battery
<*> Button
<*> Fan
<*> Processor
<*> Thermal Zone
Device Drivers --->
{*} Hardware Monitoring support --->
<*> Intel Core/Core2/Atom temperature sensor
Device Drivers --->
<*> Sound card support --->
Advanced Linux Sound Architecture --->
HD-Audio --->
Build HDMI/DisplayPort HD-audio codec support
(2048) Pre-allocated buffer size for HD-audio driver
# vim /etc/default/grub
GRUB_PRELOAD_MODULES=lvm
GRUB_ENABLE_CRYPTODISK=y
GRUB_DEVICE=/dev/ram0
GRUB_CMDLINE_LINUX="crypt_root=UUID=${/dev/sda2} real_root=UUID={/dev/mapper/volgroup0-lv_root} rootfstype=ext4 resume=UUID=${SWAP_UUID} dolvm quiet"
Again, :read !blkid for UUIDs.
If installing on a xx20 add the following after quiet:
pcie_aspm=force i915.i915_enable_rc6=1 i915.i915_enable_fbc=1 i915.lvds_downclock=1 i915.semaphores=1
# vim /etc/pm/config.d/gentoo
SLEEP_MODULE="kernel"
# grub-install --modules="linux crypto search_fs_uuid luks lvm" --target=i386-pc --recheck /dev/sda
# cp /usr/share/locale/en\\@quot/LC_MESSAGES/grub.mo /boot/grub/locale/en.mo
# grub-mkconfig -o /boot/grub/grub.cfg
# passwd
# useradd -m -G users,wheel,audio -s /bin/bash terryadavis
# passwd terryadavis
# vim /etc/locale.gen
Burgers uncomment en_US.UTF-8 UTF-8 and en_US ISO_8859-1.
# locale-gen
# echo LANG=en_US.UTF-8 > /etc/locale.conf
# export LANG=en_US.UTF-8
# vim /root/.profile
EDITOR=vim
# export EDITOR=vim
# visudo
Uncomment the following lines and add power-related commands to NOPASSWD
%wheel ALL=(ALL) ALL
%wheel ALL=(ALL) NOPASSWD: /sbin/shutdown, /sbin/reboot, /usr/sbin/pm-hibernate, /usr/sbin/pm-suspend
# chown -R terryadavis:terryadavis /mnt/hdd
# vim /etc/conf.d/hostname
hostname="${HOSTNAME}"
# vim /etc/hosts
# IPv4 and IPv6 localhost aliases
... ${HOSTNAME} ...
`# vim /etc/dhcp/dhclient.conf`
send hostname "${HOSTNAME}";
supersede hostname "${HOSTNAME}";
# vim /etc/sysctl.d/99-sysctl.conf
vm.swappiness=10
# ln -sf /usr/share/zoneinfo/.../... /etc/localtime
hwclock --systohc --utc
# vim /etc/ntp.conf
Delete all entries under # Pools for Gentoo users and add appropriate entry from pool.ntp.org
ntpd -gq
# rm stage3-amd64-??????.tar.{bz2,xz}
# umount /hostrun
# rm -rf /hostrun
# rc-update add lvm boot
# rc-update add acpid default
# rc-update add atd default
# rc-update add NetworkManager default
atd is the service from the udev at package mentioned above
# umount /run/lvm
# cd /
# exit
# cd /
# umount -R /mnt/gentoo
# nmtui
From here you can start recreating your desktop environment, but this is papa luke's house so we'll do it the senpai way.
# emerge -av eselect-repository dev-vcs/git
(If this command complains about use flags or keywords, read the item below.)
Gentoo's official repos contain i3wm but not i3-gaps. Heading over to zugaina.org, searching for i3-gaps reveals a couple of repos with it. Repos from zugaina can be enabled with
# eselect repository enable ${REPO_NAME}
# emerge --sync
# emerge -av newsboat
The following keyword changes are necessary to proceed:
# required by newsboat (argument)
=net-news/newsboat-2.10.2 ~amd64
In this case you would need to add
=net-news/newsboat-2.10.2 ~amd64
to /etc/portage/package.accept_keywords.
You may also want to use the testing, rather than stable, version of some packages. To emerge the testing version of R, you would add
dev-lang/R
to package.accept_keywords.
Many packages will also complain about use flags, simply repeat the procedure above adding the necessary lines to /etc/portage/package.use
You might come accross more complicated scenarios (qutebrowser's flag requirements are a pain to figure out at the time of this writing), but in most cases the steps above will suffice.
# emerge -av i3-gaps feh i3lock xf86-video-intel rxvt-unicode xinit xorg-server
$ sudo PORTAGE_BINHOST="https://cloveros.ga" emerge -avG tlp
Emerge may or may not pull all the dependencies automatically, if it doesn't you may have to emerge the dependencies one by one from the official repo.
$ sudo rc-update add tlp default
$ sudo tlp recalibrate BAT0
$ sudo emerge -av thinkfan
#sensor /sys/devices/virtual/hwmon/hwmon1/temp1_input
sensor /sys/devices/platform/coretemp.0/hwmon/hwmon0/temp1_input
sensor /sys/devices/platform/coretemp.0/hwmon/hwmon0/temp2_input
sensor /sys/devices/platform/coretemp.0/hwmon/hwmon0/temp3_input
(0, 0, 40)
(1, 32, 55)
(2, 54, 66)
(3, 65, 76)
(4, 75, 80)
(5, 78, 85)
(6, 82, 88)
(7, 85, 32767)
Check if all the directories are as above in your system, you may have hwmon1 instead of hwmon0 for instance
$ sudo sh -c 'echo "options thinkpad_acpi fan_control=1" >> /etc/modprobe.d/thinkfan.conf'
$ sudo rc-update add thinkfan default
cat /proc/acpi/ibm/fan
If the 'level' field shows a number instead of 'auto', you're good to go
$ sudo vim /etc/acpi/default.sh
case "$group" in
button)
case "$action" in
power)
/etc/acpi/actions/powerbtn.sh
;;
lid)
/usr/local/bin/lid.sh
;;
*) log_unhandled $* ;;
esac
;;
Then create lid.sh
$ sudo vim /usr/local/bin/lid.sh
#!/bin/sh
DP_STATUS=$(</sys/class/drm/card0/card0-DP-1/status )
HDMI_STATUS=$(</sys/class/drm/card0/card0-HDMI-A-1/status )
VGA_STATUS=$(</sys/class/drm/card0/card0-VGA-1/status )
if [ "connected" == "$DP_STATUS" ] || [ "connected" == "$HDMI_STATUS" ] || [ "connected" == "$VGA_STATUS" ]; then
exit 1
else
if grep -q closed /proc/acpi/button/lid/LID/state
then
/usr/local/bin/lock.sh
if [ ! -e /tmp/.lock ]
then
/usr/sbin/pm-suspend
fi
fi
fi
lid.sh will suspend the laptop only if no external monitors are connected. It will also check for a lock file created by the next script.
Finally, create lock.sh
$ sudo vim /usr/local/bin/lock.sh
#!/bin/bash
LOCK_FILE=/tmp/.lock
USR=$(users)
mpc pause
pkill -u $USR -USR1 dunst
setxkbmap us
sudo -u $USR touch $LOCK_FILE
sudo -u $USR DISPLAY=:0 i3lock -d -c 000000; rm -f $LOCK_FILE
pkill -u $USR -USR2 dunst
The script above pauses your music player and disables notifications while the system is locked. This of course assumes your music player is mpd and that dunst is your notification daemon, omit or replace as required. I also use a lock file to let lid.sh know whether or not the computer is locked or unlocked upon lid close, but I'm not 100% sure if that works as intended or if it is even required at all.
Still to do: use xrandr to shut off LVDS1 if lid is closed while external monitor is plugged in.
$ sudo chmod +x /usr/local/bin/lid.sh
$ sudo chmod +x /usr/local/bin/lock.sh
$ sudo vim /etc/udev/rules.d/95-display-hotplug.rules
KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/${USER}/.Xauthority", RUN+="/usr/local/bin/display_hotplug.sh"
Remember to change your username in the script above.
udev can only launch simple one-liner scripts, so we need to create an intermediate script (this is why we installed the 'at' package above)
$ sudo vim /usr/local/bin/display_hotplug.sh
#!/bin/bash
echo /usr/local/bin/display_detect.sh | at now
Create the main script
$ sudo vim /usr/local/bin/display_detect.sh
#!/bin/sh
USR=$(users)
export DISPLAY=:0
export XAUTHORITY=/home/$USR/.Xauthority
DP_STATUS=$(</sys/class/drm/card0/card0-DP-1/status )
HDMI_STATUS=$(</sys/class/drm/card0/card0-HDMI-A-1/status )
VGA_STATUS=$(</sys/class/drm/card0/card0-VGA-1/status )
WIFI_SSID=$(/sbin/iwgetid -r)
if [ "worknetwork1" == "$WIFI_SSID" ] || [ "worknetwork2" == "$WIFI_SSID" ]; then
DISP_LOC=(--left-of )
elif [ "homenetwork1" == "$WIFI_SSID" ] || [ "homenetwork2" == "$WIFI_SSID" ]; then
DISP_LOC=(--right-of )
else
DISP_LOC=(--right-of )
fi
WALLPAPER=$(ls /home/$USR/Pictures/Wallpapers/ | shuf -n 1)
if [ "connected" == "$DP_STATUS" ] && [ "disconnected" == "$VGA_STATUS" ]; then
/usr/bin/xrandr --output LVDS1 --auto --output DP1 --primary --auto $DISP_LOC LVDS1 --output VGA1 --off
PRIMARY="DP1"
feh --bg-scale /home/$USR/Pictures/Wallpapers/$WALLPAPER
pacmd set-card-profile 0 "output:hdmi-stereo"
elif [ "connected" == "$HDMI_STATUS" ] && [ "disconnected" == "$VGA_STATUS" ]; then
/usr/bin/xrandr --output LVDS1 --auto --output HDMI1 --primary --auto $DISP_LOC LVDS1 --output VGA1 --off
PRIMARY="HDMI1"
feh --bg-scale /home/$USR/Pictures/Wallpapers/$WALLPAPER
pacmd set-card-profile 0 "output:hdmi-stereo"
elif [ "connected" == "$VGA_STATUS" ] && [ "disconnected" == "$DP_STATUS" ]; then
/usr/bin/xrandr --output LVDS1 --auto --output VGA1 --primary --auto $DISP_LOC LVDS1 --output DP1 --off
PRIMARY="VGA1"
feh --bg-scale /home/$USR/Pictures/Wallpapers/$WALLPAPER
else
if grep -q closed /proc/acpi/button/lid/LID/state
then
/usr/local/bin/lock.sh
if [ ! -e /tmp/.lock ]
then
/usr/sbin/pm-suspend
fi
else
/usr/bin/xrandr --output LVDS1 --auto --primary --output DP1 --off --output VGA1 --off
/usr/local/bin/power_detect.sh
feh --bg-scale /home/$USR/Pictures/Wallpapers/$WALLPAPER
pacmd set-card-profile 0 "output:analog-stereo"
fi
fi
A lot of stuff going on here. First, the script checks for which wifi network the computer is connected to. I place my laptop on the left or right of the external monitor depending on whether I'm at work or at home -- by feeding the network's SSID you can automate xrandr's monitor placement. Keep in mind that the iwgetid command requires the wireless-tools package.
Next, the script shuffles a random file in a wallpaper folder. This seems to work poorly for dual monitors since feh just streches out the same wallpaper across both monitors, still a WiP.
xrandr is then called to activate whatever monitor was plugged. This implementation works great if you only use one type of output, because you can assign workspaces to that specific output in i3/config (e.g. workspace $ws1 output VGA1). However, if you have say an HDMI monitor at home and a VGA monitor at work, I know of no elegant way to make them jump around correctly from the laptop display to the external display. Setting 'workspace $ws1 output primary' only detects the primary ouput set by xrandr upon i3's first launch, it doesn't update if a new xrandr command redefines the primary output. Would greatly appreciate if someone has any suggestion on how to get this going properly. Sound is also diverted to the HDMI audio passthrough sound card if connected to either a displayport or hdmi monitor, adjust for your needs.
When the monitor is unplugged, the laptop will lock and suspend if the lid id closed.
Don't email me (Luke) with questions since I haven't gone through this process myself.