Always do a quick comparison to the official Arch Linux Installation guide before a new complete installation.

• lsb_release -a
• cat /etc/*-release
• hostnamectl
• uname -a

• Decide on an init system: init, SystemD, SysVinit.
• Decide on Instruction Set Architecture: i686, x86_64, Multilib.
• If Internet connection requires login, make sure to note all required credentials.

1. Load keymap for keyboard
2. Verify boot mode: BIOS or UEFI
3. Partition devices
4. Mount devices
   • The order devices or partitions are mounted or activated is the order genfstab arranges devices in fstab.
   • Example of recommended mount order:
     • # mount /dev/<device> /mnt
       • mkdir -p /mnt/boot/{esp,grub}
     • # mount /dev/<device> /mnt/boot
     • # swapon /dev/<device>
     • Mount or activate other devices.
5. Connect to the Internet
   • Wireless
6. Adjust system clock
   • [timedatectl](systemd#timedatectl)
7. Select pacman mirrorlist
8. [pacstrap](#pacstrap)
9. genfstab -U /mnt >> /mnt/etc/fstab
   • This could be done after changed root, however see Fstab for possible problems.
10. Change root arch-chroot /mnt
11. Install packages necessary for configuration.
12. Configure basic installation.
13. Before reboot:
    • Assign password for root user.
    • Configure not-root user.
    • If the internet connection will be lost after reboot, install all minimum necessary packages.
14. Reboot.
15. Expand basic configuration as needed:
    • bumblebee
    • diskless node, workstation
    • kvm
    • server
    • xorg

• Query the package database (-Q) and print installed packages (-d) neither required nor optionally required by any currently installed package (-t) pacman -Qdt <package name>.
• Query the package database (-Q) for owner (-o) of program pacman -Qo <program name>.
• Query the package database (-Q) and list all of its paths (-l) of program pacman -Ql <package name>.
• Query the package database (-Q) quietly (-q) for packages that are dependencies (-d) but are not required (-t) pacman -Qdtq.
• Query the package database (-Q) and check if installed packages are missing any files (-k) pacman -Qk.
• Remove all packages (-R) and their dependencies (-s) which are no longer necessary pacman -Rs $(pacman -Qdtq).
• Remove specific package (-R), but not its dependencies pacman -R <package name>.
• Remove specific package (-R), and its dependencies (-s) and configuration files (-n) pacman -Rns <package name>.
• Remove all cached (-cc) packages pacman -Scc.
• Remove all cached packages paccache -rk0.

• Required to be non-root user

• Download snapshot

• Make package as normal user $ makepkg -src.

  • -i Install or upgrade the package after a successful build using pacman.
  • -s Install missing dependencies using pacman. When build-time or run-time dependencies are not found, pacman will try to resolve them. If successful, the missing packages will be downloaded and installed.
  • -r Upon successful build, remove any dependencies installed by makepkg during dependency auto-resolution and installation when using -s.
  • -c Clean up leftover work files and directories after a successful build.

• Install package requires root # pacman -U <package name>.pkg.tar.xz.

If error ==> ERROR: Cannot find the fakeroot binary.

• Install pacman -S base-devel

• The mirrorlist directory /etc/pacman.d/mirrorlist.
• Download mirrorlist curl -o /etc/pacman.d/mirrorlist "https://archlinux.org/mirrorlist/?country=all&protocol=https&ip_version=4&ip_version=6".
• NOTE The subdomain www is no longer required (2021-12-29).
• NOTE The trailing / after mirrorlist is required.

Assign -d to allow installation to a non-mountpoint directory.

• For example, when installing from on existing Arch Linux installation to a directory to chroot into.

pacstrap [-d] /<root> <package 1> <package 2> <package 3> ...

• The base package base.
• AUR build tools base-devel.
• The Linux kernel linux.
• Firmware files for Linux linux-firmware.
• sudo

• printer
• scanner

A minimal configuration to expand depending on additional functional requirements.

Expanded from the basic configuration, xorg.

1. Add regular user to bumblebee group # gpasswd -a <USER> bumblebee.
2. Enable bumblebee service # systemctl enable bumblebeed.
3. Reboot, login to xorg server and test bumblebee $ optirun glxgears -info.

Expanded from the basic configuration. The diskless node, workstation, system is a minimal configuration that enables a client to boot over the network to a server using a PXE. The Linux OS root is mounted on the client over the network using NFS or NBD. Although the OS and all data are stored on the server, the OS and subsequent programs are executed on the client hardware.

Source:

• Arch Linux wiki, Diskless system
• gentoo linux wiki, Diskless nodes

Assuming network configuration:

SERVER 1 NETWORK DEVICE (0) GATEWAY IP : 192.168.0.1
SERVER 1 NETWORK DEVICE (0) IP         : 192.168.0.101/24
SERVER 1 NETWORK DEVICE (1) IP         : 192.168.1.101/24
SERVER 1 NETWORK DEVICE (2) IP         : 192.168.2.101/24
SERVER 1 NETWORK DEVICE (3) IP         : 192.168.3.101/24
SERVER ...

CLIENT 1 NETWORK DEVICE (1) IP         : 192.168.1.102/24
CLIENT 2 NETWORK DEVICE (2) IP         : 192.168.2.102/24
CLIENT 3 NETWORK DEVICE (3) IP         : 192.168.3.102/24
CLIENT ...

1. Recommended packages:
   • arch-install-scripts to install Arch Linux for the clients.
   • tcpdump to debug network traffic.
   • wireshark-cli to debug network traffic.
2. Install and configure the client OS on Server:
   1. basic configuration
   2. Create a mkinitcpio for NFS, for example mkinitcpio.netboot.nfs.conf.
      • Build the new image mkinitcpio -c /etc/mkinitcpio.netboot.nfs.conf -k 5.8.14-arch1-1 -g /boot/initramfs-linux.nfs.img.
      • Ensure that the initramfs is
        • small, no more than around 50MiB, because if it is too large then the connection to TFTP could be dropped with error: timeout reading netboot/initramfs-linux.nfs.img (atftpd.log), ICMP enp0s0.localdomain udp port 46503 unreachable, length 40 (tcpdump), and
        • allowed to be read otherwise ATFTP returns error File netboot/initramfs-linux.nfs.img not found.
   3. Create a symbolic link from the client /boot/ to the /srv/tftp/netboot/ directory. The boot files have to be in the TFTP search path.
   4. Configure boot loader:
      • Grub
      • Uboot
3. Configure SystemD NetworkD
   • Configure network for 2 or more static interfaces.
   • Ping the IP addresses to confirm that they work.
4. Configure DNS
   • /etc/resolvconf.conf.
5. Configure TFTP
6. Configure NFS

• systemctl status systemd-networkd
• systemctl status atftpd
• systemctl status nfs-server

Setup a VNC.

Expanded from the basic configuration.

Assuming

• deployment on a minimal, basic or simple plan, where
• the memory can be upgraded,
• storage can be added.

The storage is partione in three sections. The swap is stored as a file in order to expand and shrink it as needed.

sda
├─sda1
├─sda2  vfat  FAT32 ESP   abcd-ef01
└─sda4  ext4  1.0   data  01234567-89ab-cdef-0123-456789abcdef  10G  50% /
sdb
└─sdb1  ext4  1.0   data  abcdef01-2345-6789-abcd-ef0123456789  40G  10% /

Install packages for VPS configuration:

• dhcpcd (# systemctl enable dhcpcd)
• man-db
• mc
• nano
• ncdu
• nftables
• openresolv
• openssh
• pacman-contrib
• rsync (for user admin)

• StackExchange Information Security NMAP - Closed vs Filtered
• StackExchange Unix & Linux Why are some ports reported by nmap filtered and not the others?

The result of a scan depends on the type of scan. Multiple options may be required for a conclusive result. For example, a reported state of "filtered" indicates that nmap could not determine whether or not the port is open because packet filtering prevents its probes from reaching the port.

• Scan server for selected open ports nmap <SERVER IP>.
• Scan server for all open ports nmap -p 0-65535 <SERVER IP>.
• TCP SYN scan (sS) server with root privilegas # nmap -sS <SERVER IP>
• UDP scan (sU) server with root privilegas for # nmap -sS <SERVER IP>
• TCP ACK scan (sA) server with root privilegas # nmap -sS <SERVER IP>

A SYN scan that results in "filtered", which can be because of a firewall.

• Attempt to determine the status of the port nmap -sV <SERVER IP> or nmap -A <SERVER IP>
• Attempt to bypass the firewall nmap --tcp-flags SYN,FIN <SERVER IP>

Expanded from the basic configuration.

Careful, read all instructions before upgrade:

• System maintenance -- Upgrading the system (20171226)
• pacman -- Usage -- Upgrading packages (20171226)
• Sync packages (-S), and update package database even if the local database is updated (-yy) # pacman -Syy.
• Update Arch Linux key ring # pacman -Sy archlinux-keyring.
• Execute system wide upgrade # pacman -Syu.

If Linux boot depends on a custom initramfs image, then manually update the mkinitcpio accordingly before restarting the system after system upgrade.

• Ensure that resulting image file is readable chmod +r
• portable.conf
• nfs.conf

Observed from 4.14.15-1-ARCH upgrade 4.15.9-1-ARCH to 4.17.2-1-ARCH. The System clock synchronized and systemd-timesyncd.service active is set to no.

$ timedatectl status
                      Local time: Tue 2018-07-03 23:28:44 UTC
                  Universal time: Tue 2018-07-03 23:28:44 UTC
                        RTC time: Tue 2018-07-03 23:28:44
                       Time zone: UTC (UTC, +0000)
       System clock synchronized: no
systemd-timesyncd.service active: no
                 RTC in local TZ: no

Re-adjust the system clock # timedatectl set-ntp true.

If problems occur at the boot up stage then add the arguments debug amd ignore_loglevel to the linux parameter in grub.cfg.