Hello everyone,
I am currently planning to install Gentoo Linux on my daily driver notebook, and I am probably overthinking it a bit. It feels a bit a little bit overwhelming, because I know what kind of system I would like to install, but also know that it will be a lot of work for me to get there doing it for the first time.
My goal is an installation with the following properties:
- Full Disk Encryption
- Secure Boot
- A custom kernel with SELinux enabled and reasonable policies
- OpenRC as the init system
- Wayland with sway as a windows manager
- All packages and kernel compiled from source
I have some time constraints and need my notebook. Even though I've been using Linux distributions for years, I will have to learn a lot during the process, and this will take some time. (OpenRC and USE flags are totally new to me for example, but I want to look into them)
So my idea is to start with FDE and Secure Boot only, because this is the only thing hard to change at a later point. I am planning to use gentoo-kernel-bin and binary packages temporarily, to get a usable desktop system up and running asap and migrating my files back.
From that point moving from binary packages to source based packages would be the next step. The final step would be the kernel configuration as well as SELinux polices.
I am currently just hesitating to start the install process, so is there anything I can do in advance beside reading the handbook and preparing a customizied guide for myself to use later?
Thanks in advance for any tips or insights!
Needing some advice for installing in incremental steps
Message
Welcome to the forums.
You are right that adding Full Disk Encryption later would be very disruptive, so that cannot practically be retrofitted. I think Secure Boot is relatively easy to retrofit, so you could opt not to use that at first. SELinux is a difficult project. I recommend budgeting considerable time for just that step.
Since you've been using Linux for years, you (probably) already have some (possibly not Gentoo) Linux available to you. If so, consider prototyping Gentoo as a virtual machine running as a guest on your existing Linux system. That lets you avoid impairing the functionality of your daily driver notebook until you are more confident in your plans and procedures. Running as a virtual machine imposes some performance penalty, but it will be an accurate enough test that you will see whether you did FDE correctly, know how to configure openrc and Portage, and so on.
Compiling everything from source is a useful feature of Gentoo, but its main value comes from being able to omit functionality (including entire packages) that you don't want, and being able to incorporate patches that are not part of the main tree (too new, too niche, etc.). If Gentoo's binhost offers a prebuilt binary that matches your requirements, a local compile adds little value. You're welcome to do everything from source if you want, but you should not expect obvious performance gains from doing so.
If you get stuck, or reach a point where you are unsure how to proceed, please post back. We have many knowledgeable users who are happy to offer individualized advice.
You are right that adding Full Disk Encryption later would be very disruptive, so that cannot practically be retrofitted. I think Secure Boot is relatively easy to retrofit, so you could opt not to use that at first. SELinux is a difficult project. I recommend budgeting considerable time for just that step.
Since you've been using Linux for years, you (probably) already have some (possibly not Gentoo) Linux available to you. If so, consider prototyping Gentoo as a virtual machine running as a guest on your existing Linux system. That lets you avoid impairing the functionality of your daily driver notebook until you are more confident in your plans and procedures. Running as a virtual machine imposes some performance penalty, but it will be an accurate enough test that you will see whether you did FDE correctly, know how to configure openrc and Portage, and so on.
Compiling everything from source is a useful feature of Gentoo, but its main value comes from being able to omit functionality (including entire packages) that you don't want, and being able to incorporate patches that are not part of the main tree (too new, too niche, etc.). If Gentoo's binhost offers a prebuilt binary that matches your requirements, a local compile adds little value. You're welcome to do everything from source if you want, but you should not expect obvious performance gains from doing so.
If you get stuck, or reach a point where you are unsure how to proceed, please post back. We have many knowledgeable users who are happy to offer individualized advice.