documentation/docs/alpine-desktop-setup/installation.md

Installation

To install the Alpine Linux distribution on the system, the alpine root partition and the EFI partition have to be mounted to the main system.

# mount /dev/vg/alpine_root /mnt -t ext4
# mkdir /mnt/esp
# mount /dev/disk/by-label/esp /mnt/esp -t vfat

Then install Alpine Linux using setup disk

# setup-disk -m sys /mnt

This will also add grub as bootloader which will be replaced but for now it will reside on the ESP.

To have a functional chroot into the system, bind the system process directories

# for i in dev proc sys run; do
> mount --rbind --make-rslave /$i /mnt/$i
> done
# chroot /mnt

The other setup scripts can be used to configure key aspects of the system. Besides that a few necessary services have to be activated.

# setup-hostname <hostname>
# setup-keymap us us-euro
# setup-timezone -i <area>/<subarea>
# setup-ntp openntpd
# rc-update add acpid default
# rc-update add lvm boot
# rc-update add seedrng boot
# rm -rf /var/tmp
# ln -s /tmp /var/tmp
# passwd root

The root password does not really matter because it is going to be locked after a user has been created.

Set the hwclock to use UTC in /etc/conf.d/hwclock and disable writing the time to hardware. Running a NTP negates its usability.

clock="UTC"
clock_hctosys="NO"
clock_systohc="NO"

Edit /etc/fstab for correct mounts

/dev/disk/by-label/esp  /esp        vfat    defaults,nodev,nosuid,noexec                            0 2
/dev/vg/alpine_root     /           ext4    defaults,noatime                                        0 1
/dev/vg/home            /home       ext4    defaults,noatime,nodev,nosuid                           0 2
/dev/vg/var             /var        ext4    defaults,nodev,nosuid,noexec                            0 2
/dev/vg/nix             /nix        ext4    defaults,noatime,nodev,nosuid                           0 2
tmpfs                   /tmp        tmpfs   rw,size=4G,nr_inodes=5k,nodev,nosuid,noexec,mode=1777   0 0
proc                    /proc       proc    nodev,nosuid,noexec,hidepid=2                           0 0

By default, Alpine Linux uses mkinitfs to create an initial ram filesystem, although it is minimal that also means that it lacks some functionality which is needed for a proper setup. Because of this mkinitfs and grub-efi will be replaced with booster and secureboot-hook.

# apk add booster secureboot-hook sbctl
# apk del mkinitfs grub-efi

To configure booster edit /etc/booster.yaml:

enable_lvm: true
busybox: false
modules: vfat,nls_cp437,nls_iso8859_1

The most important step is the creation of a UKI using secureboot-hook which also automatically signs them. First the hook itself will have to be tweaked to use booster instead of mkinitfs, edit /etc/kernel-hooks.d/50-secureboot.hook and change the line:

/sbin/mkinitfs -o "$tmpdir"/initramfs "$NEW_VERSION-$FLAVOR"

to:

/usr/bin/booster build "$tmpdir"/initramfs --kernel-version "$NEW_VERSION-$FLAVOR"

and configure /etc/kernel-hooks.d/secureboot.conf for cmdline and secureboot.

cmdline="rw rd.luks.name=<uuid>=luks rd.lvm.vg=vg root=/dev/vg/alpine_root modules=ext4 quiet splash"

signing_cert="/usr/share/secureboot/keys/db/db.pem"
signing_key="/usr/share/secureboot/keys/db/db.key"

output_dir="/esp/efi/linux"
output_name="alpine-linux-{flavor}.efi"

Here <uuid> has to be replaced with the UUID of the partition which contains the volume group:

# blkid /dev/<disk>2 >> /etc/kernel-hooks.d/secureboot.conf

Use sbctl to create secureboot keys and sign them.

# sbctl create-keys
# sbctl enroll-keys

Whilst enrolling the keys it might be necessary to add the --microsoft flag if you are unable to use custom keys.

Now to see if everything went succesfully run:

# apk fix kernel-hooks

and it should give no warnings if done properly.

As discussed earlier grub will be replaced, install gummiboot as a bootloader.

# apk add gummiboot
# mkdir /esp/loader
# mkdir /esp/efi/boot
# cp /usr/lib/gummiboot/gummibootx64.efi /esp/efi/boot/bootx64.efi

Sign the bootloader with sbctl

# sbctl sign -s /esp/efi/boot/bootx64.efi

and also remove some remnants of grub.

# rm -rf /boot/grub
# rm -rf /etc/default
# cd /boot && unlink boot && cd ..

gummiboot can be configured with the file /esp/loader/loader.conf with which the timeout and the default OS can be specified.

default alpine-linux-<flavor>.efi
timeout 2
editor no

Before finishing the installation networkmanager will be installed for networking. Also install networkmanager-wifi and wpa_supplicant for Wi-Fi functionality.

# apk add networkmanager networkmanager-wifi wpa_supplicant
# setup-devd udev
# rc-update add networkmanager default

Wi-Fi will not yet work. For Wi-Fi configuration see the network section.

If internet does not work after reboot create the config file as described in the network section and restart the service.

Now exit the chroot and you should be able to reboot into a working Alpine system.

# exit
# umount -lf /mnt
# reboot

When booting up your screen might appear blank, this is the encryption prompt. Enter the encryption key and press enter to boot.