ARCH LINUX: SYSTEMD-BOOT + SECURE BOOT + LUKS + UKI (SBCTL/MKINITCPIO)

###############################################################################
# ARCH LINUX: SYSTEMD-BOOT + SECURE BOOT + LUKS + UKI (SBCTL/MKINITCPIO)
# BASIC PROCEDURE (FOR RECOVERY, MIGRATION, NEW MACHINE, ETC.)
###############################################################################
# Provides:
# - Secure booting via systemd-boot, Secure Boot with custom keys
# - Encrypted root support via LUKS (passphrase prompt during boot)
# - Automatic signing of kernel and loader
# - Ready for dualboot with Windows (optionally preserve MS keys)
#
# Notes:
# 1. Always back up your data and old UEFI keys before modifying Secure Boot!
# 2. In BIOS, set "Clear Secure Boot keys" or "Delete all keys"
#    (see below "BIOS/UEFI Preparation")
###############################################################################

# === BIOS/UEFI PREPARATION ===
# 1. Reboot the PC and enter UEFI/BIOS (usually F2/F10/Del/Esc immediately after startup).
# 2. Find the "Secure Boot" / "Security" section:
#    - Look for: "Clear Secure Boot keys" or "Delete all keys"
#      (sometimes: "Restore Factory Keys" -> DO NOT USE! Must be clear/delete)
#    - Confirm to switch firmware into "Setup Mode" (no Platform Key = keys can be modified)
#    - Leave Secure Boot enabled, or enable it after keys are enrolled.
# 3. Save and reboot into Linux.

# === SYSTEM PROCEDURE ===

# 1. Ensure the system is booting in UEFI mode!
ls /sys/firmware/efi/efivars

# 2. Prepare partitions:
#    - ESP (EFI, type EF00, min. 300 MB, FAT32, mountpoint /efi)
#    - root (e.g., LUKS, BTRFS, EXT4, etc.)
mount /dev/nvme0n1p1 /efi

# 3. Install systemd-boot into the ESP:
bootctl install --esp-path=/efi

# 4. Create Secure Boot keys using sbctl:
sbctl create-keys

# 5. Enroll keys into UEFI firmware:
#    - Recommended: with Microsoft keys for Windows dualboot:
sbctl enroll-keys -m
#    - Without MS keys (only your own, NOT RECOMMENDED if dualbooting Windows):
# sbctl enroll-keys

# 6. Check status:
sbctl status

# 7. Create loader configuration (if missing):
cat > /efi/loader/loader.conf <<EOF
default  arch.conf
timeout  3
console-mode max
EOF

# 8. Create a boot entry for Arch (example with BTRFS, adjust UUIDs accordingly, NOT used for unified kernel):
cat > /efi/loader/entries/arch.conf <<EOF
title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options root=UUID=xxxx-xxxx-xxxx rw rootflags=subvol=@ cryptdevice=UUID=yyyy-yyyy-yyyy-yyyy:luksroot:allow-discards loglevel=3 quiet
EOF

# (for unified kernel image, loader entry is not needed – see below)

# 9. In mkinitcpio preset, enable UKI (unified kernel image) generation:
cat > /etc/mkinitcpio.d/linux.preset <<EOF
ALL_kver="/boot/vmlinuz-linux"
PRESETS=('default' 'fallback')

default_image="/boot/initramfs-linux.img"
default_uki="/efi/EFI/Linux/arch-linux.efi"

fallback_image="/boot/initramfs-linux-fallback.img"
# fallback_uki="/efi/EFI/Linux/arch-linux-fallback.efi"
fallback_options="-S autodetect"
EOF

# 10. If you previously used a keyfile for LUKS unlocking and want to return to passphrase:
#    - Remove FILES=(/root/secrets/crypto_keyfile.bin) from /etc/mkinitcpio.conf -> passphrase will be prompted for disk decryption
#    - Remove cryptkey=... from kernel options (see loader/entries/arch.conf or /etc/kernel/uki.conf)

# 11. Regenerate initramfs and unified kernel image, sign, and verify:
mkinitcpio -P
sbctl sign -s /efi/EFI/Linux/arch-linux.efi  # not strictly needed, mkinitcpio should do this (just to be sure)
sbctl verify

# 12. (If using systemd-boot-update.service, manually sign the loader so it's .efi.signed)
sbctl sign -s -o /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed /usr/lib/systemd/boot/efi/systemd-bootx64.efi
bootctl update

# 13. Add PACMAN HOOK for signing the loader on every systemd update!
mkdir -p /etc/pacman.d/hooks

cat > /etc/pacman.d/hooks/80-secureboot-loader-sign.hook <<EOF
[Trigger]
Operation = Install
Operation = Upgrade
Type = Path
Target = usr/lib/systemd/boot/efi/systemd-boot*.efi

[Action]
Description = Signing systemd-boot EFI binary for Secure Boot
When = PostTransaction
Exec = /usr/bin/sbctl sign -s -o /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed /usr/lib/systemd/boot/efi/systemd-bootx64.efi
Depends = sbctl
NeedsTargets
EOF

# 14. Reboot and test Secure Boot (enable it in UEFI setup), boot, and LUKS passphrase prompt.
reboot

# 15. Check status:
bootctl status
sbctl verify

###############################################################################
# NOTES:
# - Each kernel update automatically regenerates and signs UKI (if pacman hooks/sbctl post hooks are in place).
# - If Secure Boot fails, verify signatures of all EFI binaries!
# - Use sbctl verify to see an overview of signed files.
# - If dualbooting Windows, DO NOT delete MS keys from UEFI!
# - If you want clean LUKS passphrase input, **do not use cryptkey** and omit keyfile in mkinitcpio.
# - If using an XBOOTLDR partition, adjust paths in preset and loader.conf accordingly.
###############################################################################