You can get around that with a semi-manual install. And yes you want your boot files in the zfs root for zbm to work properly and for security. What I did for encrypted zfs root with zfsbootmenu
- Picked refind for boot manager
- Chose manual partitioning rather than automatic and set my EFS partition to /boot/efi
- Use the rest for zfs mounted at /, encrypted
- (The installer correctly warned that this might not be bootable, but I didn’t care…)
- Before reboot I mount the system partition and manually copy one of tbe ZBM binaries there
- Need to set a couple of filesystem properties
sudo zfs set org.zfsbootmenu:rootprefix="root=ZFS=" zpcachyos(without this it misdetects the root prefix and won’t boot)sudo zfs set org.zfsbootmenu:commandline="rw quiet loglevel=4" zpcachyosand any other kernel parameters (if you don’t set this the default is read only…)- reboot - on the first boot only hit “ctrl-d” on your boot pool to mark it as the boot filesystem. alternatively you can use
zpool seton the command line to do this. Snapshots won’t work until the bootfs is set. - Make sure zfs-utils is installed
pacman -S zfs-utils - the zfs pacmanhook is in aur so install (
paru pacman-zfs-hook) It’s important that the zfs-utils is installed and boot pool is marked first - if not it will break pacman…) - I also uninstall the (useless) refind.
Then if you don’t want to need to enter your pool password twice follow https://docs.zfsbootmenu.org/en/v3.0.x/general/native-encryption.html
-
save your encryption password into /etc/zfs/zroot.key with appropriate permissions
-
echo 'FILES+=(/etc/zfs/zroot.key)' >> /etc/mkinitcpio.conf -
sudo zfs set keylocation=file:///etc/zfs/zroot.key zpcachyosYou need to rebuild the intramfs (mkinitpcio -S, or will happen automatically when you install a new kernel) to add the key for this to become effective, but if you don’t it should just keep asking for your password twice at boot.
You can optionally save the key on a different filesystem that you specify with the org.zfsbootmenu:keysource property