# HOWTO - GPT/UEFI install with full disk encryption: BTRFSonLUKS with separate root, home and pkg subvolumes; hibernation with a swapfile; auto-snapshots with easy system rollback (GUI); boot into snapshots **URL:** \ **Category:** EndeavourOS installation\ **Created:** [March 3, 2020, 3:54pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782 "2020-03-03T15:54:48Z")\ **Posts on this page:** 20\ **Page:** 13
**Author:** ![2000](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/2/ee59a6/32.png) [@2000](https://forum.endeavouros.com/u/2000)\ **Post date:** [December 15, 2020, 9:03am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/242 "2020-12-15T09:03:53Z")
Deleting data the “normal” way won’t work for you anymore! If you just delete data, it will leave chunks partially filled and therefore _allocated_. What you really need is _unallocated_ space. The only way of getting more unnallocated space is through balancing, which doesn’t work for you anymore, or by adding storage to the pool. > [@baremetaloctopus](#): > > `sudo btrfs device add /dev/loop6 /` > > sudo btrfs fi usage / |head -n 6 > > Overall: > Device size: 232.38GiB > Device allocated: 232.38GiB > Device unallocated: 1.00MiB > Device missing: 0.00B > Used: 187.10GiB I don’t know what went wrong but you should see about 4GB added to the device size and about 4GB unallocated after adding your 4GB ramdisk. This didn’t happen! You still have only 1.00MiB unallocated. So all following balancing tries have to fail. You should double check the ramdisk creation and addition to the pool. Maybe you should just try adding flash media; any usb-stick etc. will do. This will be slower but also more straightforward. * * * > [@baremetaloctopus](#): > > Also, do you just use a cronjob to run it every 3 days? I created a systemd timer but a standard cronjob will also work. * * * * * * **[Edit]** I just reread your commands; you’ve only mounted the subvolume @ from `/dev/mapper/cryptdata` to `/mnt` and later on try to add the ramdisk to `/` in a chroot environment. Maybe try creating the ramdisk and adding to `/mnt` without chrooting instead. 1. Try mounting without the subvol parameter instead: `sudo mount -o defaults,ssd,noatime,compress=zstd /dev/mapper/cryptdata /mnt` When you now run `ls /mnt` you should see this: ``` ~$ ls /mnt @ @home ``` 1. Now create and add your ramdisk to `/mnt` (from the “outside”, not from within a chroot environment) `sudo btrfs device add /dev/loop6 /mnt` 2. Balance (I suspect this also needs to be run from the “outside”). You’ll probably need to balance `/mnt` (or `/mnt/@`), but I’m not quite sure. ---
**Author:** ![baremetaloctopus](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/baremetaloctopus/32/20380_2.png) [@baremetaloctopus](https://forum.endeavouros.com/u/baremetaloctopus)\ **Post date:** [December 31, 2020, 12:04pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/243 "2020-12-31T12:04:29Z")
Although when I last posted my efforts seemed not to have worked, when I was about to try the extra steps you outlined in your edit I noticed I suddenly had ~ 40 GiB free and I have been reallocating chunks regularly - thank you for your help and happy new year! 🙂 I do not like that I am operating at the moment with no existing Timeshift backups, and no new backups being taken, but the 2TB m.2 SSD I mentioned I thought was lost in the post has finally arrived, so in the coming weeks I want to start a fresh install of BTRFSonLUKS with the full Timeshift setup on it. Once I have the new drive configured I would like to install Windows 10 on the existing SATA SSD and use rEFInd according to [https://endeavouros.com/docs/installation/how-to-install-refind/](https://endeavouros.com/docs/installation/how-to-install-refind/) I understand that rEFInd should automatically detect any installed OS. My goal is that when I turn on my system I see the reEFInd menu, and from there I either boot to the passphrase prompt before GRUB for Ubuntu, or VeraCrypt passphrase prompt for Windows. Could you please tell me if the following plan should work: 1. Install Ubuntu BTRFSonLUKS on the new drive as before using this guide and Willi Mutschler’s for reference 2. Install rEFInd according to the linked forum article 3. Install Windows 10 on old drive and setup full disk encryption with VeraCrypt The reason I install Windows 10 last is so that if I have any issue with the new drive install I can fall back to the currently installed system on the old drive. Are there any special or extra steps I need to take to make this work? From past experience I know that I can configure the Windows install so that VeraCrypt will prompt me for my passphrase and then log me into my desktop without a password prompt. Ideally I would just have to enter one passphrase/prompt to enter my desktop, whether booting Ubuntu or Windows, but I think when I last checked this to keep the BTRFSonLUKS install secure I must continue to have one passphrase prompt before the GRUB menu and then another at my Ubuntu login screen - please let me know if that is not the case. ---
**Author:** ![2000](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/2/ee59a6/32.png) [@2000](https://forum.endeavouros.com/u/2000)\ **Post date:** [December 31, 2020, 1:03pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/244 "2020-12-31T13:03:03Z")
Should work as planned. rEFInd should pick up all the OS’s automatically. If not, note that rEFInd can be tweaked quite a lot, both functionally and visually; so don’t be turned off by it’s default look. I’d advise to “hide” the drives from each other (BIOS? or simply unplug) during installation of Windows and EndeavourOS. With rEFInd as your boot loader you don’t really need the OS’s seeing each other. You could also add `GRUB_DISABLE_OS_PROBER=true` to your `/etc/default/grub` later on to stop Grub from probing and adding Windows. > [@baremetaloctopus](#): > > I think when I last checked this to keep the BTRFSonLUKS install secure I must continue to have one passphrase prompt before the GRUB menu and then another at my Ubuntu login screen - please let me know if that is not the case. This is **not the case**! You only need your passphrase for the first unlock, after that everything can be “chain-unlocked” (through crypttab and a second key). Most Window Managers allow automatic login too. This is the way [our BTRFSonLUKS](https://endeavouros.com/docs/encrypted-installation-2/btrfsonluks-quick-copypaste-version/) sets up the system. So, only one password at boot necessary. ---
**Author:** ![baremetaloctopus](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/baremetaloctopus/32/20380_2.png) [@baremetaloctopus](https://forum.endeavouros.com/u/baremetaloctopus)\ **Post date:** [January 1, 2021, 1:59am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/245 "2021-01-01T01:59:48Z")
That is great news, I did have auto login set on Ubuntu at some point but I was then soon prompted to unlock the gnome keyring. Is there any part of that guide you linked in particular I should use instead of some part of Willi’s guide, or in addition to Willi’s guide, to set the chain-unlock up? ---
**Author:** ![Meow](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/meow/32/39330_2.png) [@Meow](https://forum.endeavouros.com/u/Meow)\ **Post date:** [January 22, 2021, 10:46pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/246 "2021-01-22T22:46:59Z")
@2000 Sent your guide to the offial archinstaller devs on github > > > Just a question/feature request? > > Would it be possible to have an option for B…TRFS that sets up subvolumes like OpenSUSE and/or any Timeshift/Snapper compatible way? > > https://rootco.de/2018-01-19-opensuse-btrfs-subvolumes/ > > https://endeavouros.com/docs/encrypted-installation-2/btrfsonluks-verbose-version/ > https://endeavouros.com/docs/encrypted-installation-2/btrfsonluks-quick-copypaste-version/ And it seems like they want to implement a btrfs setup compatible with snapper. ---
**Author:** ![Feakster](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/feakster/32/24784_2.png) [@Feakster](https://forum.endeavouros.com/u/Feakster)\ **Post date:** [March 27, 2021, 4:33pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/247 "2021-03-27T16:33:14Z")
What are people’s current thoughts on BTRFS mount options in /etc/fstab? For my BTRFS subvolumes I’ve gone with: ```nohighlight rw,noatime,ssd,discard=async,compress=zstd,space_cache=v2,autodefrag,subvol=@ rw,noatime,ssd,discard=async,compress=no,space_cache=v2,subvol=@swap rw,noatime,ssd,discard=async,compress=zstd,space_cache=v2,autodefrag,subvol=@home rw,noatime,ssd,discard=async,compress=zstd,space_cache=v2,autodefrag,subvol=@var-cache-pacman-pkg ``` I’m not sure on the benefits of `noatime` vs `relatime` mount options. I’ve read conflicting advice related to this. An [interesting piece](https://lwn.net/Articles/499293/) on the matter can be found in the [BTRFS manpage](https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)). For the `space_cache` version, I’ve seen some guides specify a version and others not. When not specified, the default is `space_cache=v1`. Should there be a `space_cache` in use for the `/swap` subvolume? In the way of possible additional subvolumes, would it also be beneficial to setup `/tmp` & `/srv` as subvolumes? I’m not sure of the benefit of including `/tmp` in timeshift backups. NB: I note that `grub-btrfs` is available in the community repo now, so it could be installed via `pacman` instead of `yay`. ---
**Author:** ![linuxislife](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/linuxislife/32/91372_2.png) [@linuxislife](https://forum.endeavouros.com/u/linuxislife)\ **Post date:** [May 6, 2021, 11:28am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/248 "2021-05-06T11:28:55Z")
Hey ! Thanks for that wonderful guide. May I ask if it is still valid with the last Endeavour release ( **endeavouros-2021.04.17-x86\_64.iso** ) ? Cheers ! Edit: And would it be safe to enable fstrim timer with this install ? (if my SSD support it of course) ---
**Author:** ![2000](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/2/ee59a6/32.png) [@2000](https://forum.endeavouros.com/u/2000)\ **Post date:** [May 8, 2021, 7:31am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/249 "2021-05-08T07:31:42Z")
> [@linuxislife](#): > > May I ask if it is still valid with the last Endeavour release To be honest, I haven’t checked with the newest release but I assume there would have been some flags raised on the forum if not. 😬 > [@linuxislife](#): > > And would it be safe to enable fstrim timer with this install ? Yes, you should definitely run fstrim from time to time. Maybe also balance and scrub the btrfs filesystem once in a while. ---
**Author:** ![linuxislife](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/linuxislife/32/91372_2.png) [@linuxislife](https://forum.endeavouros.com/u/linuxislife)\ **Post date:** [May 10, 2021, 12:50pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/250 "2021-05-10T12:50:22Z")
Hey ! Thanks a lot for the answer, i’ll try on an new install and report back 🙂 > [@2000](#): > > balance and scrub the btrfs filesystem once in a while. May I ask how ? Cheers ! ---
**Author:** ![mjl](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/74df32/32.png) [@mjl](https://forum.endeavouros.com/u/mjl)\ **Post date:** [May 13, 2021, 4:01pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/251 "2021-05-13T16:01:15Z")
Hi guys Thought I would like you know if you don’t already - BTRFS is now an installable option on calamares. If you edit `/usr/share/calamares/modules/partitions` while in the live installer and change the default partition type from EXT4 to BTRFS, start the installer, you have the option to do a fresh install with BTRFS as default AND… it allows you to choose a swap partiton or swapfile!. Hope this helps ---
**Author:** ![Meow](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/meow/32/39330_2.png) [@Meow](https://forum.endeavouros.com/u/Meow)\ **Post date:** [May 22, 2021, 3:05pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/252 "2021-05-22T15:05:18Z")
Thanks. Hopefully this will be added to the installer with snapper ---
**Author:** ![S0PEX](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/s0pex/32/29629_2.png) [@S0PEX](https://forum.endeavouros.com/u/S0PEX)\ **Post date:** [June 8, 2021, 11:20pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/253 "2021-06-08T23:20:48Z")
They just a quick question is this luks or luks2? I am not sure which version is the default in the installer. ---
**Author:** ![Evident4146](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/e/58f4c7/32.png) [@Evident4146](https://forum.endeavouros.com/u/Evident4146)\ **Post date:** [June 9, 2021, 3:28am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/254 "2021-06-09T03:28:06Z")
This does it on LUKS1. ---
**Author:** ![S0PEX](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/s0pex/32/29629_2.png) [@S0PEX](https://forum.endeavouros.com/u/S0PEX)\ **Post date:** [June 9, 2021, 7:20am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/255 "2021-06-09T07:20:46Z")
@Evident4146 Thanks for fast reply. Would there be any reason to use luks2? I have seen people who have luks1 for boot and luks 2 doe the system, because of Grub not supporting luks2, although I am not sure how update this statement is. ---
**Author:** ![marteng69](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@marteng69](https://forum.endeavouros.com/u/marteng69)\ **Post date:** [June 9, 2021, 6:38pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/256 "2021-06-09T18:38:14Z")
> [@S0PEX](#): > > Would there be any reason to use luks2? I have seen people who have luks1 for boot and luks 2 doe the system, because of Grub not supporting luks2, although I am not sure how update this statement is. See in the Arch wiki: [https://wiki.archlinux.org/title/GRUB#Encrypted\_/boot](https://wiki.archlinux.org/title/GRUB#Encrypted_/boot) Still not solved. ---
**Author:** ![realmx2](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/realmx2/32/27381_2.png) [@realmx2](https://forum.endeavouros.com/u/realmx2)\ **Post date:** [June 10, 2021, 1:42am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/257 "2021-06-10T01:42:38Z")
just performed all updates and having a n error message after timeshift updated. rebooted and attempting updates produces same error… EDIT - this may be relevant - [https://forum.garudalinux.org/t/timeshift-autosnap-not-working-and-pacman-is-not-installing-anything/8882](https://forum.garudalinux.org/t/timeshift-autosnap-not-working-and-pacman-is-not-installing-anything/8882) ```auto Total Installed Size: 262.82 MiB Net Upgrade Size: 4.87 MiB :: Proceed with installation? [Y/n] (1/1) checking keys in keyring [----------------------] 100% (1/1) checking package integrity [----------------------] 100% (1/1) loading package files [----------------------] 100% (1/1) checking for file conflicts [----------------------] 100% :: Running pre-transaction hooks... (1/1) Creating Timeshift snapshot before upgrade... E: ts: Failed to get partition list. E: System disk not found! Unable to run timeshift-autosnap! Please close Timeshift and try again. Script will now exit... error: command failed to execute correctly error: failed to commit transaction (failed to run transaction hooks) Errors occurred, no packages were upgraded. ``` ---
**Author:** ![Feakster](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/feakster/32/24784_2.png) [@Feakster](https://forum.endeavouros.com/u/Feakster)\ **Post date:** [June 10, 2021, 8:30am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/258 "2021-06-10T08:30:41Z")
Is it the same problem as this: > [@Help - Timeshift in Live USB Mode as device UUID not found](https://forum.endeavouros.com/t/help-timeshift-in-live-usb-mode-as-device-uuid-not-found/14914): > > After updating today, I’ve just started getting an error in timeshift where it says it’s in “Live USB Mode (Restore Only)”. All previous snapshots are missing & an error message is listed which states "Device not found: UUID=’[my-hexadecimal-device-id]’. This is now also interfering with pacman updates as I now get the following error. :: Running pre-transaction hooks... (1/1) Creating Timeshift snapshot before upgrade... E: ts: Failed to get partition list. E: System disk not found! Unable to … ---
**Author:** ![Feakster](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/feakster/32/24784_2.png) [@Feakster](https://forum.endeavouros.com/u/Feakster)\ **Post date:** [June 10, 2021, 9:33am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/259 "2021-06-10T09:33:11Z")
Maybe in the upcoming version of GRUB: [https://www.phoronix.com/scan.php?page=news\_item&px=GRUB-2.11-Next-Year](https://www.phoronix.com/scan.php?page=news_item&px=GRUB-2.11-Next-Year) ---
**Author:** ![realmx2](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/realmx2/32/27381_2.png) [@realmx2](https://forum.endeavouros.com/u/realmx2)\ **Post date:** [June 10, 2021, 2:41pm UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/260 "2021-06-10T14:41:14Z")
Fixed the issue by removing timeshift-autosnap, updating packages (timeshift package then gets updated), and then reinstallng timeshift-autosnap… 1. remove timeshift-autosnap ```auto yay -R timeshift-autosnap ``` 1. Update all packages (this will let the timeshift package upgrade) ```auto yay ``` 1. Reinstall timeshift-autosnap ```auto yay timeshift-autosnap ``` ---
**Author:** ![Brtza](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/brtza/32/86831_2.png) [@Brtza](https://forum.endeavouros.com/u/Brtza)\ **Post date:** [June 28, 2021, 11:58am UTC](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782/261 "2021-06-28T11:58:45Z")
Hi, what if I want 2 separate partitions, root and home. And use timeshift snapshots of root and store them on separate home partitions . What I need for that ? I am confused with mounting and creating subvolumes xD [Previous page](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782.md?page=12) [Next page](https://forum.endeavouros.com/t/howto-gpt-uefi-install-with-full-disk-encryption-btrfsonluks-with-separate-root-home-and-pkg-subvolumes-hibernation-with-a-swapfile-auto-snapshots-with-easy-system-rollback-gui-boot-into-snapshots/3782.md?page=14)