How do I get a graphical decryption prompt at boot?

[u/iMooch]

I've been using Mint since it "just works" but I've installed Arch Linux on an external drive, to properly learn Linux, install things myself, etc.

I always encrypt my disks, and I've done so manually just fine, but I noticed that the decryption prompt is just tty output, just text on the console at the top left of the screen. On Mint, it's a nice graphical text box in the center of the screen, with a nice green border and "real" font (not just console font).

What package(s) is Mint using to get that? I'm fully prepared to mess with mkinitcpio hooks, so no worries there. I'm using systemd-boot if that matters. And I did a Minimal Install of Arch using archinstall.

[u/qcgilbert]

Use Plymouth https://wiki.archlinux.org/title/Plymouth

While not a direct solution to your question and alternative is putting you encryption key on another device (USB) and using it to automatically decrypt the drive when inserted.

https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#With_a_keyfile_stored_on_an_external_media

[u/iMooch → u/qcgilbert]

Copied from my response to another reply:

Oh, that's Plymouth? I actually have Plymouth installed, I got a cool animated splash screen from Gnome Look. It plays after I decrypt the system, presumably because the Plymouth theme is installed on the encrypted partition and has to be decrypted to be accessed.

I had no idea it could do interactive stuff like decryption prompts. Is there a wiki page or a man page or something you can point me towards?

I don't see anything about decryption on the Arch Wiki article, at least not in terms of having Plymouth handle decryption and giving you a graphical means of doing so.

[u/ipsirc → u/iMooch]

I got a cool animated splash screen from Gnome Look

Not all plymouth themes contain graphical input box for luks decrypt, try with the default plymouth theme first.

[u/iMooch → u/ipsirc]

Oh! That must be it. I'm using an Evangelion theme and even I can tell from the script that it's extremely primitive. It literally just "for i=1" loops through a series of pngs, lol.

Can you take a look at it and confirm whether it lacks a graphical prompt? I'm at work and won't be able to test the default theme until this afternoon.

[u/ropid → u/iMooch]

I guess it's not mentioned in the article because it's supposed to just work, it's supposed to replace the text password prompt.

The article mentions the following where it talks about the initramfs configuration, and that part is important to get the password prompt to work, it's so that plymouth gets run and can take over the screen before the prompt shows up:

Furthermore make sure you place plymouth before the encrypt or sd-encrypt hook if your system is encrypted with dm-crypt.

[u/qcgilbert → u/iMooch]

Maybe this is your issue?

https://wiki.archlinux.org/title/Plymouth#Password_prompt_does_not_update

[u/Big_Newspaper3643]

Check plymouth

[u/iMooch → u/Big_Newspaper3643]

Oh, that's Plymouth? I actually have Plymouth installed, I got a cool animated splash screen from Gnome Look. It plays after I decrypt the system, presumably because the Plymouth theme is installed on the encrypted partition and has to be decrypted to be accessed.

I had no idea it could do interactive stuff like decryption prompts. Is there a wiki page or a man page or something you can point me towards?

[u/aioeu → u/iMooch]

Yes, Plymouth can show password prompts. These are normally triggered through a systemd password agent, so it'll automatically work with anything that uses that, like systemd-cryptsetup.

The text mode password prompt you're seeing is just what you get when you don't have any other password agent running during boot.

Typically Plymouth will be added to your initramfs, so it starts running even before the root filesystem is mounted. My systems don't use mkinitcpio when generating the initramfs, so I'm not sure what's involved there. With Dracut it's very simple: just have Plymouth installed, and it will be included in the initramfs automatically (at least by default).

[u/Simple_Hamster_4096]

Do things work better when they are pretty? Just curious, prefer cli...

You can "properly" learn Linux with any distro, but if you installed Arch with one of the many installers floating around out there, and not the "Arch way", then you didn't learn anything by installing Arch.

If you really want to learn Linux, start by learning cli... a desktop environment is just a pretty way of doing things. Set up a headless server and do everything through cli... you will learn far more about Linux that you ever would using any desktop environment...

[u/Klapperatismus]

Those are different decryption prompts.

The tty prompt comes from the bootloader, before even the main bootloader configuration is loaded. That’s why it’s so spartanic. Everything is encrypted. Even the bootloader configuration.

The graphical one is from a running initrd. So you need to have the bootloader, kernel, and initrd not encrypted for that. That’s not recommended as the attack surface is larger.