installation guide: update

_posts/2026-01-25-archlinux-uefi-lvm-on-luks-with-selinux-installation-guide.md

@@ -325,9 +325,38 @@ swapoff -a
 reboot
 ```
 
-### 4) post reboot steps
+### 4) (Optional) avoid entering the same password twice to decrypt the disk when booting
 
-#### 4.1) relabel files
+GRUB unlocks /dev/vda2 so it can read /boot and load the kernel/initramfs.  
+The initramfs then takes over and unlocks /dev/vda2 again for the actual root/LVM setup.  
+But GRUB doesn't pass the password it obtained to the initramfs requiring you to enter the password twice to decrypt the system.  
+You can follow these steps to avoid this issue:
+
+```bash
+sudo install -d -m 700 /etc/cryptsetup-keys.d
+
+sudo dd bs=512 count=4 if=/dev/random iflag=fullblock \
+    | sudo install -m 600 /dev/stdin /etc/cryptsetup-keys.d/system.key
+
+sudo cryptsetup luksAddKey /dev/vda2 /etc/cryptsetup-keys.d/system.key
+```
+Then add to `/etc/mkinitcpio.conf`:
+```bash
+FILES=(/etc/cryptsetup-keys.d/system.key)
+```
+Then in `/etc/default/grub` in `GRUB_CMDLINE_LINUX=""` append:
+```
+ cryptkey=rootfs:/etc/cryptsetup-keys.d/system.key
+```
+Then rebuild:
+```bash
+sudo mkinitcpio -P
+sudo grub-mkconfig -o /boot/grub/grub.cfg
+```
+
+### 5) post reboot steps
+
+#### 5.1) relabel files
 
 check SELinux status with `sestatus`, it should be in permissive with refpolicy-arch as the loaded policy.  
 Relabel all the files correctly with the following command:  
@@ -342,7 +371,7 @@ you might want to clean yay cache before doing that to have less files to relabe
 rm -rf ~/.cache/yay/*
 ```
 
-#### 4.2) enable auditd
+#### 5.2) enable auditd
 
 enable auditd service to read AVC denials from SELinux later.  
 
@@ -350,7 +379,7 @@ enable auditd service to read AVC denials from SELinux later.
 systemctl enable --now auditd
 ```
 
-#### 4.3) create and load necessary policy
+#### 5.3) create and load necessary policy
 
 Create a file `requiredmod.te` with the following content:
 
@@ -467,4 +496,6 @@ setsebool -P ssh_sysadm_login on
 ```
 
 Then in `/etc/selinux/config`, set SELinux mode to enforcing instead of permissive and reboot.  
+
+
 And that's it, you now have a minimal archlinux installation in UEFI with full disk encryption, secure boot, and SELinux in enforcing mode.