LUKS on LVM

If using an old drive

$ fdisk -l
$ fdisk /dev/nvme0n1
# d if existing partitions exist
$ cryptsetup open --type plain -d /dev/urandom /dev/nvme0n1 to_be_wiped
$ dd if=/dev/zero of /dev/mapper/to_be_wiped bs=1M status progress
$ cryptsetup close to_be_wiped

partition with grub

fdisk /dev/nvme0n1
g
n
t
1
n
enter enter enter
w

create encrypted container

cryptsetup luksFormat /dev/nvme0np2

create and enter a password

open the new container

cryptsetup open /dev/nvme0n1p2 cryptlvm

enter your password

prep logical volumes

pvcreate /dev/mapper/cryptlvm 
vgcreate VolGroup /dev/mapper/cryptlvm 
lvcreate -L 10G VolGroup -n swap 
lvcreate -L 128G VolGroup -n root 
lvcreate -l 100%FREE VolGroup -n home

Format the LVM volumes

mkfs.btrfs /dev/VolGroup/root
mkfs.btrfs /dev/VolGroup/home
mkfs.fat -F32 /dev/nvme0n1p1
mkswap /dev/VolGroup/swap

Mount the new volumes to begin os installation

mount /dev/MyVolGroup/root /mnt
mount --mkdir /dev/VolGroup/home /mnt/home 
mount /dev/nvme0n1p1 /mnt/boot 
swapon /dev/VolGroup/swap

installation

do the entire 2. Installation section and 3. Configure the System up to "3.5. Network configuration" from the Arch Wiki

NOTE: if you get the "Fix "invalid or corrupted package (PGP signature)" error then do

pacman -S archlinux-keyring

and rerun the pacstrap command

NOTE: include "btrfs-progs' in the pacstrap command

pacstrap /mnt base linux linux-firmware btrfs-progs lvm2

for "3.6 Initramfs" go back to the dm-crypt article and do 3.4. Configuring mkinitcpio and "3.5 configuring the bootloader"

bootloader

First, install the bootloader, I just use grub.

pacman -S grub

use blkid to get the UUID of the 2nd partition with type "crypt-luks"

nano /etc/defualt/grub

and add the following to the line

"GRUB_CMDLINE_LINUX=" cryptdevice=UUID=<insert your UUID here>:cryptlvm root=/dev/VolGroup/root"

run the grub installer

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Encrypted Arch"

grub-mkconfig -o /boot/grub/grub.cfg