sudo openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero | dd of=/dev/sda

sudo gparted

sudo cryptsetup luksFormat --cipher twofish-xts-palin64 --key-size 512 --hash whirlpool --iter-time 200 /dev/sda2

sudo cryptsetup luksOpen /dev/sda lvm

sudo pvcreate /dev/mapper/lvm
sudo vgcreate vg /dev/mapper/lvm
sudo lvcreate -L 25G vg -n root
sudo lvcreate -L 4G vg -n swap
sudo lvcreate -l +100%FREE vg -n home
sudo mkswap -L swap /dev/mapper/vg-swap
sudo mkfs.ext4 /dev/mapper/vg-root
sudo mkfs.ext4 /dev/mapper/vg-home
sudo mount /dev/mapper/vg-root /mnt
sudo mkdir /mnt/home
sudo mount /dev/mapper/vg-home /mnt/home

sudo mount /dev/mapper/vg-root /mnt
sudo mount /dev/mapper/vg-home /mnt/home
sudo mount /dev/sda1 /mnt/boot
sudo mount --bind /dev /mnt/dev
sudo chroot /mnt
mount -t proc proc /proc
mount -t sysfs sys /sys
mount -t devpts devpts /dev/pts

sudo blkid

nano /etc/crypttab

lvm UUID=[THE UUID YOU GET IT FROM blkid COMMAND RESULTS] none,lvm=lvm

nano /etc/initramfs-tools/conf.d/cryptroot

cryptroot=target=lvm,source=/dev/disk/by-uuid/THE UUID YOU GET FOR /dev/sda2

update-initramfs -k all -c

nano /etc/default/grub

GRUB_CMD_LINUX="crypt=target=lvm,source=/dev/disk/by-uuid/THE UUID FOR /dev/sda2,lvm=lvm"

update-grub