encrypting the whole drive with luks
i just wiped and reinstalled arch from scratch, and this time i did it with LUKS full-disk encryption. the previous install worked fine, but the drive was sitting there completely unencrypted — meaning anyone with physical access could pull the NVMe and read everything on it.
why bother
if your machine never leaves your desk and you trust everyone in your house, maybe you don't. but i have SSH keys, API tokens, docker credentials, and enough saved passwords in browser profiles to make an unencrypted drive a liability. LUKS means the entire partition is gibberish without the passphrase at boot.
how it works
LUKS (Linux Unified Key Setup) encrypts the partition at the block level. the kernel decrypts it at boot using a passphrase, then mounts the filesystem on top. everything written to disk is encrypted transparently — no per-file decisions, no forgetting to encrypt something sensitive.
my layout ended up being:
/dev/nvme0n1p1— EFI system partition (unencrypted, just the bootloader)/dev/nvme0n1p2— LUKS-encrypted partition with btrfs and subvolumes inside
btrfs subvolumes handle /, /home, snapshots, etc. all sitting on top of the single encrypted partition.
the tradeoff
there's one extra step at every boot — typing the passphrase. that's it. no measurable performance hit on a modern NVMe with AES-NI hardware acceleration. the CPU handles the encryption faster than the drive can read anyway.
gotchas i ran into
grub and LUKS2: grub's LUKS2 support is still finicky. if you're using grub, you might need to either use LUKS1 for /boot or use systemd-boot instead. i went with systemd-boot and avoided the headache entirely.
btrfs on LUKS: works great, but make sure your crypttab and mkinitcpio.conf hooks are set up before you reboot. getting locked out of an encrypted drive you just set up is a special kind of frustrating.
the second NVMe: i have a Windows drive on the other NVMe slot. LUKS only covers the Linux partition — Windows stays on its own NTFS partitions, untouched and unencrypted (BitLocker is its own thing).
eli5
imagine your hard drive is a storage locker. normally, the lock is on the building's front door (your login password), but anyone who takes the locker out of the building can open it freely. LUKS puts a lock on the locker itself (encryption). even if someone physically takes the drive, they just get a box of scrambled nonsense without the key (passphrase).