Since you already have EndeavourOS installed with Btrfs, adding LUKS encryption requires converting your existing setup into an encrypted one. Unfortunately, you can’t directly encrypt an existing partition without reformatting, but you can migrate your system using the following approach:

⚠️ Important:

1. Backup your data! This process involves moving data, and any mistake could result in data loss.
2. You need a Live USB of EndeavourOS or another Arch-based distro.
3. Ensure you have enough free space to create an encrypted container.

Steps to Encrypt Your Existing Btrfs Setup with LUKS

1. Boot into a Live USB

• Boot from an EndeavourOS/Arch Live USB.
• Open a terminal and check your existing partitions:
  bash

  CopyEdit

  lsblk -f


2. Unlock Your Existing Btrfs Setup

If your root partition is /dev/sdX, mount it:

(Substituting /dev/sdXn with your actual partition)

3. Create a LUKS Encrypted Partition

You’ll need to format and encrypt the current root partition:

4. Create Btrfs Subvolumes

Recreate your Btrfs layout:

5. Restore Your Data

• Mount the encrypted volume:
  bash

  CopyEdit

  mount -o subvol=@ /dev/mapper/cryptroot /mnt
mkdir -p /mnt/{home,var/log,var/cache,boot}
mount -o subvol=@home /dev/mapper/cryptroot /mnt/home
mount -o subvol=@log /dev/mapper/cryptroot /mnt/var/log
mount -o subvol=@cache /dev/mapper/cryptroot /mnt/var/cache

• Restore your backup (rsync or btrfs send/receive if you backed up with snapshots).

6. Update Fstab & Initramfs

• Generate /etc/fstab:
  bash

  CopyEdit

  genfstab -U /mnt >> /mnt/etc/fstab

• Edit /etc/mkinitcpio.conf, adding encrypt to the hooks:
  bash

  CopyEdit

  HOOKS=(base udev autodetect modconf block encrypt btrfs filesystems keyboard fsck)

• Rebuild the initramfs:
  bash

  CopyEdit

  mkinitcpio -P


7. Configure GRUB for LUKS

Edit /etc/default/grub:

Then update GRUB:

8. Reboot into Your Encrypted System

After unmounting and rebooting, you should now be prompted for a LUKS password.

Alternative Approach: Fresh Install

If this process seems too complex, the easiest option is to reinstall EndeavourOS and enable LUKS encryption during installation.

Mr. Arch Brooks, Software Engineer, Brooks Computing Systems, LLC authored this article.