Luks2, new cryptosetup release, new Qubes?

You can manually partition and encrypt the disk from tty (CTRL+ALT+F2), then go back to gui (CTRL+ALT+F6), refresh the drives, select custom, select the partitions and proceed with installation.

Example script below (assumption: the destination drive is /dev/nvme0n1):

# Fill drive with random data
dd if=/dev/urandom of=/dev/nvme0n1 bs=1M status=progress

# Partition drive
sgdisk --zap-all /dev/nvme0n1 
sgdisk --clear /dev/nvme0n1 
sgdisk -n 1:0:+200MiB -t 1:ef00 /dev/nvme0n1 
sgdisk -n 2:0:+1000MiB -t 2:8300 /dev/nvme0n1 
echo "y" | mkfs.ext2 /dev/nvme0n1p2
sgdisk -N 3 -t 3:8300 /dev/nvme0n1

# Check the partitions
sgdisk --print /dev/nvme0n1 

# Encrypt root partition
cryptsetup -c aes-xts-plain64 -h sha512 -s 512 --type luks2 --use-random -q -y --force-password -i 10000 luksFormat /dev/nvme0n1p3
cryptsetup luksOpen /dev/nvme0n1p3 luks-root

# Create LV group
pvcreate /dev/mapper/luks-root
vgcreate qubes_dom0 /dev/mapper/luks-root

lvcreate -L 40G -T qubes_dom0/root-pool
lvcreate -V30G -T qubes_dom0/root-pool -n root

lvcreate -l +90%FREE -T qubes_dom0/vm-pool
# Define vm_lv_size before running the next command
lvcreate -V"${vm_lv_size}"G -T qubes_dom0/vm-pool -n vm
mkfs.ext4 /dev/qubes_dom0/vm

# Check LV
lvs

This guide is more thorough: Qubes OS Installation - Detached encrypted boot and header

1 Like