iwctl device list
iwctl station wlan0 scan
iwctl station wlan0 get-networks
iwctl --passphrase <passphrase> station wlan0 connect <SSID>

gdisk
cryptsetup luksFormat /dev/<root>
mkfs.ext4 /dev/<boot>
cryptsetup open /dev/<root> <crypt-root>
mkfs.ext4 /dev/mapper/<crypt-root>
mount /dev/mapper/<crypt-root> /mnt
mkdir /mnt/boot
mount /dev/<boot> /mnt/boot
mkdir /mnt/efi
mount /dev/<efi> /mnt/efi
pacstrap -K /mnt base linux linux-firmware vim
genfstab -U /mnt >> /mnt/etc/fstab
arch-chroot /mnt
ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
vim /etc/locale.gen # uncomment en_US entries
locale-gen
vim /etc/hostname
vim /etc/mkinitcpio.conf # add encrypt hook between block and filesystems

Reference https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#Configuring_mkinitcpio

mkinitcpio -P
passwd

pacman -S grub efibootmgr
grub-install --efi-directory=/efi --bootloader-id=GRUB
vim /etc/default/grub
# Add cryptdevice=UUID=<UUID>:<crypt_root>

Reference https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#Configuring_the_boot_loader

To boot Windows, add to /etc/grub.d/40_custom:

menuentry 'Windows' {
  insmod part_gpt
  insmod chain
  search --no-floppy --fs-uuid --set=root ABCD-EFGH
  chainloader /EFI/Microsoft/Boot/bootmgfw.efi
}

To chain to another Linux partition:

menuentry 'Arch Secure' {
  insmod part_gpt
  search --no-floppy --fs-uuid --set=root <UUID>
  configfile ($root)/grub/grub.cfg
}

grub-mkconfig -o /boot/grub/grub.cfg

pacman -S xorg-server xorg-apps sddm sddm-kcm plasma-desktop plasma-x11-session dolphin okular \
  xfce4-terminal firefox vlc kscreen
systemctl enable sddm.service

pacman -S alsa-utils pulseaudio pulseaudio-alsa kmix

pacman -S dhcpcd
systemctl enable dhcpcd.service

pacman -S iwd networkmanager plasma-nm
systemctl enable NetworkManager.service

Create /etc/systemd/network/20-wired.network :

[Match]
Name=enp8s0

[Network]
Address=192.168.16.68/24
Gateway=192.168.16.1
DNS=192.168.16.10

pacman -S sudo
useradd -m josh
passwd josh
visudo # enable wheel line
vim /etc/group # wheel, games

pacman -S openssh x11-ssh-askpass

pacman -S cups print-manager system-config-printer
systemctl enable cups.service

pacman -S which man man-pages rsync kwalletmanager base-devel less

pacman -S kde-gtk-config adw-gtk-theme

pacman -S nfs-utils

In /etc/fstab:

server:/path /path nfs _netdev,noauto,x-systemd.automount,x-systemd.mount-timeout=10,rsize=8192,wsize=8192,timeo=14,intr 0 0

exit
umount -R /mnt
reboot

systemctl --user enable ssh-agent.service

Put in profile:

export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"

Reference https://wiki.archlinux.org/title/SSH_keys#Start_ssh-agent_with_systemd_user