timedatectl set-ntp true
parted -s /dev/sda mklabel msdos
parted -s /dev/sda mkpart primary 2048s 100%

cryptsetup luksFormat /dev/sda1
cryptsetup luksOpen /dev/sda1 lvm
pvcreate /dev/mapper/lvm
vgcreate arch /dev/mapper/lvm
lvcreate -L 8G arch -n swap
lvcreate -L 30G arch -n root
lvcreate -l +100%FREE arch -n home
lvdisplay
mkswap -L swap /dev/mapper/arch-swap
mkfs.ext4 /dev/mapper/arch-root
mkfs.ext4 /dev/mapper/arch-home
mount /dev/mapper/arch-root /mnt
mkdir /mnt/home
mount /dev/mapper/arch-home /mnt/home
swapon /dev/mapper/arch-swap

pacstrap -i /mnt base base-devel net-tools wireless_tools dialog wpa_supplicant git grub ansible

genfstab -U -p /mnt >> /mnt/etc/fstab
# less /mnt/etc/fstab

arch-chroot /mnt /bin/bash
export LANG=en_US.UTF-8
echo $LANG UTF-8 >> /etc/locale.gen
locale-gen
echo LANG=$LANG > /etc/locale.conf
ln -s /usr/share/zoneinfo/America/New_York /etc/localtime
hwclock --systohc --utc
echo cibo > /etc/hostname
systemctl enable dhcpcd.service
passwd



sed -i 's/^HOOKS=.*/HOOKS="base udev autodetect modconf block keyboard encrypt lvm2 resume filesystems fsck"/' /etc/mkinitcpio.conf
mkinitcpio -p linux

dd bs=512 count=8 if=/dev/urandom of=/crypto_keyfile.bin
cryptsetup luksAddKey /dev/sda1 /crypto_keyfile.bin
chmod 000 /crypto_keyfile.bin
sed -i 's/^FILES=.*/FILES="\/crypto_keyfile.bin"/' /etc/mkinitcpio.conf
mkinitcpio -p linux


echo GRUB_ENABLE_CRYPTODISK=y >> /etc/default/grub

# BIOS mode - set the UUID of the encrypted root device
ROOTUUID=$(blkid /dev/sda1 | awk '{print $2}' | cut -d '"' -f2)
sed -i "s/^GRUB_CMDLINE_LINUX=.*/GRUB_CMDLINE_LINUX=\"cryptdevice=UUID="$ROOTUUID":lvm:allow-discards resume=\/dev\/mapper\/arch-swap\"/" /etc/default/grub
grub-mkconfig -o /boot/grub/grub.cfg
grub-install /dev/sda
chmod -R g-rwx,o-rwx /boot

exit
umount -R /mnt
echo "You may now reboot."