Steps

0. The board itself

The board looks like this:

And with a 3d printed case like this one it can even look like a somewhat genuine USB stick:

1. Preparing the environment

1.1. Installing Arduino IDE and the required libraries

First install micronucleus, on Archlinux this can be done with the command sudo pacman -S micronucleus
Then install the Arduino IDE. On Archlinux it’s available in the AUR as the package arduino-ide-bin.

1.2. Installing the boards manager

Open Arduino IDE and go to File > Preferences and in the field “Additional Board Manager URLs:” add:

https://raw.githubusercontent.com/digistump/arduino-boards-index/master/package_digistump_index.json

If you have multiple additional board manager URLs you can separate them with a comma: ,

Then in Tools > Board > Boards Manager, search for “digispark” and install “Digistump AVR Boards”

2. Flashing a payload

Select in Tools > Board > Digistump AVR Boards, the board “Digispark (Default - 16.5mhz)”
Then create a sketch and write your bad USB payload, for example:

#include "DigiKeyboard.h"

void setup() {
  // Give Linux time to enumerate the Digispark as a keyboard.
  DigiKeyboard.delay(1000);

  // Open a terminal.
  DigiKeyboard.sendKeyStroke(KEY_T, MOD_CONTROL_LEFT | MOD_ALT_LEFT);
  DigiKeyboard.delay(1000);

  // Launch Firefox.
  DigiKeyboard.print("firefox https://hadow.fr");
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
}

void loop() {
}

(Please note that this payload will work only with a QWERTY layout)

You can also find payloads here and here.

Then upload the sketch, in the output you should see:

Sketch uses 2944 bytes (48%) of program storage space. Maximum is 6012 bytes.
Global variables use 162 bytes of dynamic memory.
Running Digispark Uploader...
Plug in device now... (will timeout in 60 seconds)

Plug in your device and you should see:

> Please plug in the device ... 
> Press CTRL+C to terminate the program.
> Device is found!
connecting: 16% complete
connecting: 22% complete
connecting: 28% complete
connecting: 33% complete
> Device has firmware version 1.6
> Available space for user applications: 6012 bytes
> Suggested sleep time between sending pages: 8ms
> Whole page count: 94  page size: 64
> Erase function sleep duration: 752ms
parsing: 50% complete
> Erasing the memory ...
erasing: 55% complete
erasing: 60% complete
erasing: 65% complete
> Starting to upload ...
writing: 70% complete
writing: 75% complete
writing: 80% complete
> Starting the user app ...
running: 100% complete
>> Micronucleus done. Thank you!

You can then unplug your device and plug it into a computer to execute the payload.
Disclaimer: Only plug in this device in computers you are allowed to.

This short blog post also demonstrates why you should never pick up random USB sticks from the ground and plug them into your computer.

Steps

1. Preparing the environment

1.1. Installing Arduino IDE and the required libraries

First install esptool and pyserial, on Archlinux this can be done with the command sudo pacman -S esptool python-pyserial
Then install the Arduino IDE. On Archlinux it’s available in the AUR as the package arduino-ide-bin.

Once it’s installed, you’ll need to add 3 libraries in your Arduino library directory (usually located in ~/Arduino/libraries).

• copy and unzip the USB library included in the repository in EvilCrowCable-Wind/modified-libraries/
• copy and unzip the husarnet-esp32-arduino library included in the repository in EvilCrowCable-Wind/modified-libraries/
• download the ArduinoJSON library with git clone https://github.com/bblanchon/ArduinoJson.git

1.2. Installing the boards manager

Open Arduino IDE and go to File > Preferences and in the field “Additional Board Manager URLs:” add

https://espressif.github.io/arduino-esp32/package_esp32_index.json

Then in Tools > Board > Boards Manager, search for “esp32” and install “esp 32 by Espressif Systems”

2. Flashing the firmware

2.1. Plugging the EvilCrow Cable Wind in flash mode

Place a magnet on the active end (USB A) of the EvilCrow Cable Wind and connect it to the computer, it should be recognized as “USB JTAG/serial debug unit” in dmesg (sudo dmesg --follow). Example output:

[ 4371.460527] usb 1-9: new full-speed USB device number 32 using xhci_hcd
[ 4371.585041] usb 1-9: New USB device found, idVendor=303a, idProduct=1001, bcdDevice= 1.01
[ 4371.585060] usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 4371.585068] usb 1-9: Product: USB JTAG/serial debug unit
[ 4371.585075] usb 1-9: Manufacturer: Espressif
[ 4371.585080] usb 1-9: SerialNumber: 10:51:DB:38:6E:9C
[ 4371.589316] cdc_acm 1-9:1.0: ttyACM0: USB ACM device

2.2. Flashing the firmware

Open EvilCrowCable-Wind/firmware/firmware.ino in Arduino IDE from the repository. You can modify in this file the password and SSID of the access point the ESP32 will try to connect to. By default it’s Evil Crow Cable Wind for the SSID and 123456789 for the password. I recommend changing these values.

Then in Tools, select your port and the board “ESP32S3 Dev Module”, in my case the port is ACM0, but it could be USB0 or another port. And configure all the parameters as follow:

Specifically:

3. Using the EvilCrow Cable Wind

3.1. Connecting to the cable

Upon start the EvilCrow Cable Wind will try to connect to a network with the SSID and password specified in the firmware, so first setup an access point with a phone or laptop and then plug in the active end (USB A) of the EvilCrow Cable in a computer.
Theorically the cable should be accessible at http://cable-wind.local but it doesn’t work well with a phone.
Instead you can connect a laptop (or use the laptop with the access point) to the access point and directly find the IP address of the cable.

• If you have a laptop setup as an access point:

  ip neighbor
  

• If you connected a laptop to the access point:

  ip route
  

  A possible output is:

  default via 10.27.197.13 dev wlp2s0 proto dhcp src 10.27.197.114 metric 600 
  10.27.197.0/24 dev wlp2s0 proto kernel scope link src 10.27.197.114 metric 600
  

  Then force the discovery of the devices on this subnetwork

  sudo nmap -sn 10.27.197.0/24
  

  And find the host Espressif

  Nmap scan report for 10.27.197.126
  Host is up (0.21s latency).
  MAC Address: XX:XX:XX:XX:XX:XX (Espressif)
  

  You can then connect to the cable with this IP address.

3.2. Writing your first payload

For example to payload a Linux running a desktop with CTRL+ALT+T shortcut to open a terminal (Like Gnome, KDE Plasma, XFCE, etc…) and open my website in firefox:

Delay 1000
Press KEY_LEFT_CTRL
Press KEY_LEFT_ALT
PressRelease t
Delay 1000
PrintLine firefox https://hadow.fr
Delay 500

As you can imagine, you can run much more complex payloads targeting a wide range of environments. As such it should be treated as a serious security tool, not as a harmless gadget or toy.
This is also why the paranoia around unknown USB cables isn’t entirely unjustified: you can’t always tell what’s hiding inside a cable. Use it only on systems you own or have explicit permission to payload.

Steps

1. Installing the required packages

sudo apt install default-jre openjdk-25-jre

2. Running the server

2.1) Creating a dedicated user:

sudo useradd -m minecraft

2.2) Enabling autologin for minecraft on TTY2

sudo mkdir -p /etc/systemd/system/getty@tty2.service.d

and in this folder I created this file:

#/etc/systemd/system/getty@tty2.service.d/autologin.conf
[Service]
ExecStart=
ExecStart=-/sbin/agetty --autologin minecraft --noclear %I $TERM

2.3) Enabling lingering for minecraft (which is needed to start user systemd services even without a shell session)

sudo loginctl enable-linger minecraft

2.4) Downloading the minecraft server:

Download the latest version of fabric minecraft server from here
For example:

sudo curl -o /home/minecraft/server.jar https://meta.fabricmc.net/v2/versions/loader/26.2/0.19.3/1.1.2/server/jar

2.5) Creating the systemd service

First creating the folder:

sudo mkdir -p /home/minecraft/.config/systemd/user

And then a service unit file:

#/home/minecraft/.config/systemd/user/minecraft.service
[Unit]
Description=Minecraft Server
After=network-online.target
Wants=network-online.target

[Service]
WorkingDirectory=/home/minecraft
ExecStart=/usr/bin/java -Xmx4G -jar /home/minecraft/server.jar nogui

Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target

After this make sure the ownership is correct:

sudo chown -R minecraft:minecraft /home/minecraft

And then to start the service:

sudo systemctl --user --machine=minecraft@.host daemon-reload
sudo systemctl --user --machine=minecraft@.host start minecraft

after the first start you’ll need to accept the EULA:

#/home/minecraft/eula.txt
eula=TRUE

sudo systemctl --user --machine=minecraft@.host restart minecraft

3. Checking logs

To check the minecraft server related logs, we can use the following command:

sudo journalctl _UID=$(id -u minecraft)

4. Additional remarks

4.1) Server properties

You can change the server properties in /home/minecraft/server.properties.
I recommend enabling the whitelist if your server is exposed on the internet.

4.2) Executing commands

In /home/minecraft/server.properties enable RCON:

enable-rcon=true
rcon.port=25575
rcon.password=CHANGE_ME

Ideally you now want strict permissions on this file since it contains your RCON password in cleartext:

sudo chmod 600 /home/minecraft/server.properties

Then you can administer your server with a RCON client like mcrcon:

mcrcon -H 127.0.0.1 -P 25575 -p 'YOUR_RCON_PASSWORD'

4.3) Mods

Put your mods in /home/minecraft/mods
I recommend installing these mods:

• fabric api
• carpet : For technical minecraft players
• lithium : For optimizations

steps

1. enabling experimental features

in the homeserver.yaml in your synapse homeserver add the following:

experimental_features:
  # MSC3266: Room summary API. Used for knocking over federation
  msc3266_enabled: true
  # MSC4222 needed for syncv2 state_after. This allow clients to
  # correctly track the state of the room.
  msc4222_enabled: true

# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h

rc_message:
  # This needs to match at least e2ee key sharing frequency plus a bit of headroom
  # Note key sharing events are bursty
  per_second: 0.5
  burst_count: 30

rc_delayed_event_mgmt:
  # This needs to match at least the heart-beat frequency plus a bit of headroom
  # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2Hz
  per_second: 1
  burst_count: 20

2. generating keys for the livekit server

run:

podman run --rm livekit/livekit-server:latest generate-keys

And write down the API key and API secret.

3. running the containers for the livekit

Don’t forget to replace YOUR_PUBLIC_IP, YOUR_API_KEY and YOUR_API_SECRET

mkdir -p /home/data/podman/element-call

in /home/data/podman/element-call/config-livekit.yaml:

port: 7880

bind_addresses:
  - "0.0.0.0"

rtc:
  tcp_port: 7881
  port_range_start: 50100
  port_range_end: 50200

  node_ip: YOUR_PUBLIC_IP

room:
  auto_create: false

logging:
  level: info

turn:
  enabled: false

keys:
  YOUR_API_KEY: YOUR_API_SECRET

For the containers replace matrixrtc.hadow.fr, hadow.fr and synapse.hadow.fr with your own domains.

podman run -d \
    --pod=synapse \
    --name=element-call-jwt \
    --restart=unless-stopped \
    -e LIVEKIT_JWT_BIND=:8080 \
    -e LIVEKIT_URL=wss://matrixrtc.hadow.fr/livekit/sfu \
    -e LIVEKIT_KEY=YOUR_API_KEY \
    -e LIVEKIT_SECRET=YOUR_API_SECRET \
    -e LIVEKIT_FULL_ACCESS_HOMESERVERS=hadow.fr \
    -e MATRIX_HOMESERVER_URL=https://synapse.hadow.fr \
    ghcr.io/element-hq/lk-jwt-service:latest

podman run -d \
    --pod=synapse \
    --name=element-call-livekit \
    --restart=unless-stopped \
    -v /home/data/podman/element-call/config-livekit.yaml:/etc/livekit.yaml:ro,Z \
    docker.io/livekit/livekit-server:latest \
    --config /etc/livekit.yaml

You can now regenerate the files for the systemd services:

cd ~/.config/systemd/user/
podman generate systemd --restart-policy=on-failure --files --new --name synapse

systemctl --user daemon-reload
systemctl --user restart pod-synapse.service

Then complete in pod-synapse.service with the ports:

    -p 8008:8008 \
    -p 7880:7880 \
    -p 7881:7881 \
    -p 50100-50200:50100-50200/udp \
    -p 8070:8080 \
    -m=2048m

Don’t forget to open the UDP range 50100-50200 and the TCP port 7881 in your firewall. For example with nftables:

        #element call
        tcp dport 7881 accept
        udp dport 50100-50200 accept

4. nginx configuration files

In a nginx configuration file (for example in /etc/nginx/sites-available/matrixrtc.conf):

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name matrixrtc.hadow.fr;

    ssl_certificate /etc/letsencrypt/live/hadow.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hadow.fr/privkey.pem;

    location ^~ /livekit/jwt/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://127.0.0.1:8070/;
    }

    location ^~ /livekit/sfu/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_send_timeout 120;
      proxy_read_timeout 120;
      proxy_buffering off;
      proxy_set_header Accept-Encoding gzip;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_pass http://127.0.0.1:7880/;
    }
}

In your well known in /etc/nginx/sites-available/http.conf modify the snippet with the following:

    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://synapse.hadow.fr"},"m.identity_server": {"base_url": "https://vector.im"},"org.matrix.msc4143.rtc_foci": [{"type": "livekit","livekit_service_url": "https://matrixrtc.hadow.fr/livekit/jwt"}]}';
        add_header Content-Type application/json;
        add_header "Access-Control-Allow-Origin" *;
    }

What are matrix.org and synapse?

First a short introduction:
matrix.org is an open source, secure and decentralized communication protocol. Secure because it defines how end to end encryption should be implemented in the clients.
With matrix.org you have homeservers and clients. Homeservers are what the clients connect to and can federate with each other (meaning someone with an account on homeserver A can talk to someone with an account on homeserver B).
Bridges to other messaging services can also be hosted alongside a homeserver. Hosting your own homeserver allows you to host the bridges you want.
In this blog post I explain how to self host a specific homeserver, which is maintained by the matrix.org foundation: synapse.

self hosting synapse

initial setup

creating secret and directories

Create the database secret not to expose it in your configuration files:

echo -n "<postgres-pass>" > /tmp/secret
podman secret create synapse_postgres_pass /tmp/secret

Adapt the path to your own path for the directories:

mkdir -p /home/data/podman/synapse/{db,config,media,logs}

generating the configuration file

(adapt your-domain to your own, for example: example.org)

podman pod create --name synapse -p 8008:8008 -m=2048m

podman run -it --rm \
    -v /home/data/podman/synapse/config:/data:Z \
    -e SYNAPSE_SERVER_NAME=<your-domain> \
    -e SYNAPSE_REPORT_STATS=no \
    docker.io/matrixdotorg/synapse:latest generate

modifying the configuration file

The previous command will generate a homeserver.yaml file. You’ll have to modify this file before using synapse. You’ll have to modify at least the following parts:

• modify the database part (replace the password)

  database:
  name: psycopg2
  txn_limit: 10000
  args:
    user: synapse
    password: <POSTGRES_PASSWORD>
    dbname: synapse
    host: 127.0.0.1
    port: 5432
    cp_min: 5
    cp_max: 10
  

• set enable_registration to false unless you want users to register freely on your instance.
• set a shared secret file with registration_shared_secret_path to have access to an API to create users. Be sure to use a secure secret as anyone having this secret can register on your instance as an admin. Also keep in mind the path is relative to the container, not the host.

reverse proxy

In this guide the port used is 8008, we’ll use nginx to server the synapse homeserver on the port 443.
(adapt your-domain to your own)
This part is important for users to have the name user@your-domain while hosting synapse on a subdomain. And it’s also important for clients and other homeserver to recognize your server.

in sites-available:

# synapse.conf
server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name synapse.<your-domain>;

    ssl_certificate /etc/letsencrypt/live/<your-domain>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<your-domain>/privkey.pem;

    location /.well-known/matrix/server {
      return 200 '{"m.server": "synapse.<your-domain>:443"}';
      add_header Content-Type application/json;
    }
    location /.well-known/matrix/client {
      return 200 '{"m.homeserver": {"base_url": "https://synapse.<your-domain>"},"m.identity_server": {"base_url": "https://vector.im"}}';
      add_header Content-Type application/json;
      add_header "Access-Control-Allow-Origin" *;
    }

    location / {
        proxy_pass http://127.0.0.1:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;

        # Nginx by default only allows file uploads up to 1M in size
        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
        client_max_body_size 256M;

        # Synapse responses may be chunked, which is an HTTP/1.1 feature.
        proxy_http_version 1.1;
    }

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

In your http.conf add this snippet in the https server block:

location /.well-known/matrix/server {
    return 200 '{"m.server": "synapse.<your-domain>:443"}';
    add_header Content-Type application/json;
    add_header "Access-Control-Allow-Origin" *;
}

location /.well-known/matrix/client {
    return 200 '{"m.homeserver": {"base_url": "https://synapse.<your-domain>"},"m.identity_server": {"base_url": "https://vector.im"}}';
    add_header Content-Type application/json;
    add_header "Access-Control-Allow-Origin" *;
}

running the pod

with podman command line

Again adapt the path:
The database version can be different but it needs to be pinned to a specific version to avoid issues with updates. You’ll have to manually update this container.

podman run -d --pod=synapse \
    --secret synapse_postgres_pass,type=env,target=POSTGRES_PASSWORD \
    -e POSTGRES_DB="synapse" \
    -e POSTGRES_USER="synapse" \
    -e POSTGRES_INITDB_ARGS="--encoding=UTF-8 --lc-collate=C --lc-ctype=C" \
    -v /home/data/podman/synapse/db:/var/lib/postgresql/data:Z \
    --name=synapse-db \
    docker.io/library/postgres:16

podman run -d --pod=synapse \
    -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml \
    -v /home/data/podman/synapse/config:/data:Z \
    -v /home/data/podman/synapse/media:/data/media:z \
    -v /home/data/podman/synapse/logs:/data/logs:Z \
    --name=synapse-app \
    --label io.containers.autoupdate=registry docker.io/matrixdotorg/synapse:latest

Then you can generate the systemd services:

cd ~/.config/systemd/user/
podman generate systemd --restart-policy=on-failure --files --new --name synapse

systemctl --user daemon-reload
systemctl --user enable --now pod-synapse.service

with systemd services directly

Create these files in ~/.config/systemd/user/.

# pod-synapse.service

[Unit]
Description=Podman pod-synapse.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=/run/user/1000/containers
Wants=container-synapse-app.service container-synapse-db.service
Before=container-synapse-app.service container-synapse-db.service

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStartPre=/usr/bin/podman pod create \
	--infra-conmon-pidfile %t/pod-synapse.pid \
	--pod-id-file %t/pod-synapse.pod-id \
	--exit-policy=stop \
	--name synapse \
	-p 8008:8008 \
	-m=2048m \
	--replace
ExecStart=/usr/bin/podman pod start \
	--pod-id-file %t/pod-synapse.pod-id
ExecStop=/usr/bin/podman pod stop \
	--ignore \
	--pod-id-file %t/pod-synapse.pod-id  \
	-t 10
ExecStopPost=/usr/bin/podman pod rm \
	--ignore \
	-f \
	--pod-id-file %t/pod-synapse.pod-id
PIDFile=%t/pod-synapse.pid
Type=forking

[Install]
WantedBy=default.target

# container-synapse-db.service
[Unit]
Description=Podman container-synapse-db.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
BindsTo=pod-synapse.service
After=pod-synapse.service

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
	--cidfile=%t/%n.ctr-id \
	--cgroups=no-conmon \
	--rm \
	--pod-id-file %t/pod-synapse.pod-id \
	--sdnotify=conmon \
	--replace \
	-d \
	--secret synapse_postgres_pass,type=env,target=POSTGRES_PASSWORD \
	-e POSTGRES_DB=synapse \
	-e POSTGRES_USER=synapse \
	-e "POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C" \
	-v /home/data/podman/synapse/db:/var/lib/postgresql/data:Z \
	--name=synapse-db \
	docker.io/library/postgres:16
ExecStop=/usr/bin/podman stop \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
	-f \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

# container-synapse-app.service

[Unit]
Description=Podman container-synapse-app.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
BindsTo=pod-synapse.service
After=pod-synapse.service

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
	--cidfile=%t/%n.ctr-id \
	--cgroups=no-conmon \
	--rm \
	--pod-id-file %t/pod-synapse.pod-id \
	--sdnotify=conmon \
	--replace \
	-d \
	-e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml \
	-v /home/data/podman/synapse/config:/data:Z \
	-v /home/data/podman/synapse/media:/data/media:z \
	-v /home/data/podman/synapse/logs:/data/logs:Z \
	--name=synapse-app \
	--label io.containers.autoupdate=registry docker.io/matrixdotorg/synapse:latest
ExecStop=/usr/bin/podman stop \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
	-f \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

managing the homeserver

registering users

With access to the server, creating the user interactively:

podman exec -it synapse-app /bin/sh
register_new_matrix_user --user <username> --config /data/homeserver.yaml

Or with the registration API, you can use this script.

what about bridges?

Bridges allow you to receive message from other services in matrix. In this section I’ll give an example on how to self host a bridge alongside your matrix instance with the discord bridge.

discord bridge example

Creating the initial bridge files:

mkdir -p /home/data/podman/synapse/mautrix-discord
podman run --rm -v /home/data/podman/synapse/mautrix-discord:/data:z dock.mau.dev/mautrix/discord:latest

Create the database: (adapt the password)

podman exec -it synapse-db /bin/bash
psql -U synapse
CREATE USER discordmautrix WITH PASSWORD 'password';
CREATE DATABASE discordmautrix WITH OWNER = 'discordmautrix' ;

Then delete synapse container and recreate it with the bridge registration file: (don’t forget to regenerate, or adapt, the systemd service)

podman run -d --pod=synapse \
-e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml \
-v /home/data/podman/synapse/config:/data:Z \
-v /home/data/podman/synapse/media:/data/media:z \
-v /home/data/podman/synapse/logs:/data/logs:Z \
-v /home/data/podman/synapse/mautrix-discord-registration.yaml:/data/mautrix-discord-registration.yaml:Z \
--name=synapse-app \
--label io.containers.autoupdate=registry docker.io/matrixdotorg/synapse:latest

And for the bridge:

Adapt the file /home/data/podman/synapse/mautrix-discord/config.yaml:

for the database part:

    database:
        type: postgres
        uri: postgres://discordmautrix:password:5432/discordmautrix?sslmode=disable

Then run the bridge:

podman run -d --pod=synapse \
-v /home/data/podman/synapse/mautrix-discord:/data:z \
--name=synapse-discord-mautrix \
--label io.containers.autoupdate=registry dock.mau.dev/mautrix/discord:latest

using the bridge

You’ll then have access to a user “discord bridge bot” on your instance where you can log in into your discord account and then bridge your messages.

steps

3d printing parts

Just like for the numpad I designed the parts with openscad, the parts and bash scripts are in the same repository here.
The script keyboard60.sh can be used to generate the stl files for the backplate and case. They’re both cut in half to make them fit on my 3d printer plate.
If you want to 3d print the keycaps, there is a script too. But I personally used keycaps I already had on the side instead, mostly to see the letters better on the keycaps. The side engraving on my 3d printed keycaps is not that visible.
I printed the parts with my bambulab P1S 3d printer, I used a 0.4mm nozzle and a 0.16mm layer height, white PETG filament as the material.
I used T8000 glue to glue the parts.

The backplate looks like this before gluing the two halves:

With the switches mounted (I used MMD holy panda switches this time too):

handwiring the keyboard

Just like with the numpad we first need to bend the diodes so that it’s easier to solder them to the switches. I then soldered the rows with the legs of the diodes and cut the extra length after the anode.
The keyboard is handwired columns to rows, so the diodes are soldered with the anodes soldered to the switches pins (the red part here). I used 1N4148 diodes as they’re very cheap.

And then after a few hours of soldering, and gluing the two haves together:
(I also mounted the stabilizers, this time I used cheap plated mounted stabilizers.)

I used yellow and green wires alternating them between the columns to have an easier time soldering them to the microcontroller and writing the firmware after. I also used a pen to mark where to strip the wire to solder it to the pins. It was more convenient than just using my thumb to hold the wire where I have to strip it.

And this time too I used a Pro Micro NRF52840.

flashing the firmware

I used ZMK to flash the firmware, you can find the ZMK configuration in this repository and this one for github action to automate the build process. This keyboard is named keeb60_3d. Like in the previous blog post, I recommand flashing the firmware before clipping the backplate in the case as you might have to reset the microcontroller to flash a fixed firmware.

assembling the keyboard

I glued the two halves of the keyboard, taped the battery on the side of the case, soldered it to the microcontroller and the power switch of the keyboard.
Like last time the switch is a 15mm round switch like this one. And the battery is a 3.7V LiPo battery with a 320mAh capacity (for the bluetooth).

I then glued the microcontroller in its holder, clipped in the backplate to the holder and mounted the keycaps.

final result

The keyboard:

The power switch and USB C port in the back:

steps

3d printing parts

I designed the parts with openscad, the repository is available here.
I used the script keycaps_numpad.sh and the openscad script xda_keycap.scad to generate the stl files for the keycaps with an engraving on the side for each keycap. Then generated the stl files for the backplate and case with the files backplate_numpad.scad and case_numpad.scad.
I then printed them with my bambulab P1S 3d printer, I used a 0.4mm nozzle and a 0.08mm layer height. I used white PETG filament to print all the parts. All the parts took about 12 hours to print.
Here is the result for the 3d printed parts:

You’ll notice the backplate and the case changed between the two pictures. I changed the backplate design to be able to fit stabilizers instead of printing them myself. And for the case I changed the design to have stronger pillars and also enabled supports generation in the slicer.
You’ll also notice the keycaps were printed with the side, and not the bottom, facing the plate. It takes longer to print but gives a smoother top with a XDA keycap profile. The engraving was printed facing away from the plate to make the seam between the front and top of the key smoother.

mounting the switches and stabilizers on the backplate

I used MMD holy panda switches and cheap plate mounted stabilizers that I glued on the backplate. Just be careful not to glue the metal part to the stabilizer and pay attention to the orientation of the metal parts so that they don’t collide with the pillars in the case.

You’ll notice some switches have 2 additional legs, they’re the same switches apart from this variation which doesn’t matter in this build. These two additional plastic legs are for PCB mount builds but are still adequate for plate mount builds. Just buy the cheapest version, or the one in stock with your supplier.

handwiring the keyboard

bending the diodes

The diodes are just there to have the current flowing in one direction (in my build from the columns to the rows) so you can use whichever diodes you have. I used 1N4148 diodes myself as they’re very cheap.
We first need to bend the diode to have an easier time soldering them to the switches pins, I used the edge of my desk and then a small L shaped hex key to bend the diodes. For this build we need to prepare 21 diodes.
Pay attention to the orientation of the diode, the anode (red part here) needs to be where the bend is while we keep the wire after the cathode (black part) straight

soldering the diodes

We then need to solder the diodes to one pin for each switch, you can pick the “top” or “bottom” pin, it doesn’t matter as long as you’re consistent with your rows and columns wiring later. You can stay consistent and always pick the same pin to have an easier time wiring the rows and columns but electrically it doesn’t matter. After soldering the diodes you can cut the extra wire after the anode.

wiring the rows

I used the extra wire after the cathode on the diodes to wire the rows like this:

wiring the columns and the microcontroller

After wiring the rows, wire the columns using the other pin on each switch. And then wire each row and column to a pin on your microcontroller. I used a pro micro nRF52840 as it support bluetooth, is supported by ZMK, and is pretty cheap. I also wired a 3.7V LiPo battery with a 320mAh capacity to the controller to be able to use the keyboard wirelessly. The capacity doesn’t matter much, above 300mAh is good to have a long lasting battery. At least if you don’t plan to use RGB leds.
Also note to which pin you wire each row and column to adapt the ZMK layout later.

flashing the firmware

I recommend flashing the firmware before clipping the plate in the case so that you can easily access to reset pin to reset your microcontroller if you mess up the firmware and proceed with trial and error with ZMK.
I have this repository and this one on github as the build process is simplified with github action. The config for this keyboard is in zmk-config/boards/shield/numpad3d, in there you need to define the layout in numpad3d.keymap and the GPIO mapping for each row and column in numpad3d.overlay. You can also enable the bluetooth and tweak some features in numpad3d.conf. You then need to specify the keyboard to build and which microcontroller is used in zmk-config/build.yaml.
To flash the firmware you plug in the microcontroller and copy the firmware to the detected disk device, the microcontroller will then automatically reset itself.

assembling the keyboard

You can then assemble the keyboard. I used electrical tape to keep the microcontroller and the battery in place in the case. After that I clipped in the plate in the case and added the keycaps on the switches. Here is the final result:

possible improvements

Overall 3d printing and handwiring this keyboard was a fun project but, as always, there are possible improvements, I’ll list them here in no particular order.

• Adapting the github action automation to gitea action.
• Designing a screw in cover to hold the microcontroller and battery in place instead of using electrical tape.
• Multi filament printing and having a text in a different color instead of an engraving for the keycaps, though I don’t own an AMS yet. Currently the keycaps look okay during the day, but it’s harder to see the engraving in low light conditions.
• Adding a switch on one of the battery wire to be able to turn off the keyboard. Currently it’s constantly on.

Update 24/03/2026

I modified the case a little and added a switch for the battery to turn off the keyboard. The switch I used is a 15mm round switch like this one (sanitized and non affiliated link).

What is waydroid?

Waydroid is a container-based approach to boot a ful android system on a regular linux system with an x86 or ARM CPU, and so has less overhead than an android x86 virtual machine to run android apps on a linux system. Waydroid only works in a wayland session but it’s still possible to use a nested session if you use X11, which will be covered in this guide.

Installation guide

Requirements

A kernel which comes with the rust_binder module is necessary to run waydroid, linux-zen kernel includes this module.

Other kernels

If you’re using another kernel you can add it via DKMS (note that you can use another aur helper than yay).

yay -S binder_linux-dkms

Then you can manually load it:

sudo modprobe binder-linux devices=binder,hwbinder,vndbinder

Or load it automatically at boot:

echo "binder_linux" > /etc/modules-load.d/binder_linux.conf
echo "options binder_linux devices=binder,hwbinder,vndbinder" > /etc/modprobe.d/binder_linux.conf

Installing necessary packages:

sudo pacman -S waydroid

[On X11]

If using X11, you’ll need to run a nested wayland session, a simple solution is using cage. You could also use weston.

sudo pacman -S cage

Initializing waydroid:

sudo waydroid init

Or with google apps support:

sudo waydroid init -s GAPPS

Running waydroid

This command will automatically start the waydroid container and a session before showing the UI.

waydroid show-full-ui

Otherwise if you want a CLI, you have to start the container and then a session:

sudo systemctl start waydroid-container.service
waydroid session start

Useful commands

[On X11]

On X11 waydroid container can be started but then all waydroid commands need to be run inside a nested wayland session.
If you just need waydroid UI the simplest is with cage:

cage -- waydroid show-full-ui

If you need the command line then you need to have a console running inside a wayland session. For example with Konsole:

cage -- konsole

You can then type the commands the same as described above.

Firewall rules and packet forwarding

You need some additional rules in your firewall if you want the network to work inside waydroid. For example with nftables you need these additional rules in your tables:

table inet filter {
        chain input {
                # -------------------------------- waydroid
                iifname "waydroid0" accept comment "Allow incoming network traffic from WayDroid"

        }

        chain forward {
                # -------------------------------- waydroid
                iifname "waydroid0" accept comment "Allow incomming network traffic from WayDroid"
                oifname "waydroid0" accept comment "Allow outgoing network traffic from WayDroid"
        }
        chain output {
        }
}

You also need to enable packet forwarding. To check if it’s already enabled:

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding

If it’s not enabled you can permanently enable it in the file /etc/sysctl.conf by uncommenting the lines net.ipv4.ip_forward=1 for IPv4 and net.ipv6.conf.all.forwarding=1 for IPv6. Please note that in most cases you can for now just enable the IPv4 packet forwarding and ignore the IPv6 one.
And to reload the configuration:

sudo sysctl -p /etc/sysctl.conf

Additional notes

1) clipboard sharing

If you want to share the clipboard between a wayland session and waydroid UI you need to install the packages python-pyclip and wl-clipboard.
It however won’t work with X11 and nested wayland sessions.

2) app stores

You might want to install aurora store, an open source google play store client not requiring a google account. And an F-Droid client like droidify.

3) GPU

If you have an Intel or AMD GPU it should work out of the box. But if you have a NVIDIA GPU you’ll need to enable software rendering. For that in /var/lib/waydroid/waydroid.cfg add the following:

[properties]
ro.hardware.gralloc=default
ro.hardware.egl=swiftshader

and then run:

sudo waydroid upgrade --offline
sudo systemctl restart waydroid-container.service

4) Running ARM apps

ARM apps won’t work at first if you have a x86 CPU, it’ll say the app is incompatible for your device when trying to install it. To use arm apps you need to install a translation layer. It’s recommanded to use libndk on AMD CPUs and libhoudini on Intel CPUs. To do that:

yay -S waydroid-script-git

sudo waydroid-extras install libndk 
# or
sudo waydroid-extras install libhoudini 

sudo systemctl restart waydroid-container.service

And if you’re interested in learning more about Intel houdini you can have a look at this presentation, and in video

5) Disabling on screen keyboard

By default waydroid shows AOSP on screen keyboard, which is useless on a computer with a keyboard already, to disable it the setting is in Settings > System > Languages & input > Physical keyboard > Use on-screen keyboard

6) SELinux

This module is necessary for waydroid to work:

module local-waydroid-nft 1.0;

require {
        type virtd_t;
        type iptables_t;
        class process { noatsecure rlimitinh siginh };
}

#============= virtd_t ==============
allow virtd_t iptables_t:process { noatsecure rlimitinh siginh };

You can compile it and load it with these commands (with the content above in a file local-waydroid-nft.te):

checkmodule -m -o local-waydroid-nft.mod local-waydroid-nft.te
semodule_package -o local-waydroid-nft.pp -m local-waydroid-nft.mod
semodule -i local-waydroid-nft.pp

And this script makes starting waydroid more convenient:

#!/bin/bash
sudo /usr/lib/waydroid/data/scripts/waydroid-net.sh start
cage -- waydroid show-full-ui

7) Additional troubleshooting

Finally you might want to check the archwiki directly if having issues with waydroid.
And although it’s quite old and contains some unecessary steps now, you can check this guide too.

Pre-requisite: packer and its plugins

On archlinux:

sudo pacman -S packer

then independently of your distribution:

packer plugins install github.com/hashicorp/qemu
packer plugins install github.com/hashicorp/chef

Steps:

1) Clone metasploitable3 repository

git clone https://github.com/rapid7/metasploitable3.git
cd metasploitable3

2) Disable Vagrant post-processor

The default template packages the build in a .box Vagrant file which is unnecessary. Backup the template and then edit it.

cp packer/templates/ubuntu_1404.json packer/templates/ubuntu_1404.json.bak

In packer/templates/ubuntu_1404.json remove the entire post-processors block.
You can check if the JSON file is valid with this command:

python3 -m json.tool packer/templates/ubuntu_1404.json >/dev/null && echo "OK"

If it doesn’t print OK the JSON is not valid

3) Docker fix

Modern docker is broken with metasploitable3.
Backup the original file:

cp chef/cookbooks/metasploitable/recipes/flags.rb chef/cookbooks/metasploitable/recipes/flags.rb.bak

Then remove the docker part from it:

sed -e "/^# 7 of Diamonds$/,/^end$/d" \
    -e "/^include_recipe 'metasploitable::docker'/d" \
    -e "/^directory '\/opt\/docker' do/,/^end$/d" \
    -e "/^cookbook_file '\/opt\/docker\/Dockerfile' do/,/^end$/d" \
    -e "/^cookbook_file '\/opt\/docker\/7_of_diamonds.zip' do/,/^end$/d" \
    -e "/^docker_image '7_of_diamonds' do/,/^end$/d" \
    -e "/^docker_container '7_of_diamonds' do/,/^end$/d" \
    -e "/^file '\/opt\/docker\/7_of_diamonds.zip' do/,/^end$/d" \
    chef/cookbooks/metasploitable/recipes/flags.rb > /tmp/flags.rb.$$ && mv /tmp/flags.rb.$$ chef/cookbooks/metasploitable/recipes/flags.rb

4) Build the image

packer build -only=qemu packer/templates/ubuntu_1404.json

It will open a GUI and start the installation, in the console you should see the installation process. It will connect to the virtual machine in SSH to install the vulnerable services.

5) Using the built image

You’ll find the built image in qcow2 format in output-qemu/, for example mine is output-qemu/metasploitable3-ub1404.
You can then import it in virt-manager.
Please note that the disk device bus type should be SATA, not VirtIO or the boot will fail as the initramfs inside the image does not have VirtIO drivers. Similarly the virtual network device model should be e1000e and not virtio. The default user and password will be vagrant.
Please also note that you should never connect this virtual machine to the internet as it’s intentionally made to have all sort of vulnerabilities. As such you should create an isolated network in virt-manager and connect it to this network only.
You can then study the vulnerabilities from an another virtual machine like a Kali linux or from your host using metasploit or other similar tools.

preparing installation media

Follow the initial steps from archlinux wiki to prepare your installation media, the most convenient solution is to copy the ISO to a ventoy USB key.
Then boot your archlinux ISO and first check you have internet access on your computer:

ping archlinux.org

If using WiFi, you’ll need to use iwctl

installation steps

1) setting up LVM and preparing volumes

1.1) loading the required kernel modules

modprobe efivarfs
modprobe dm-crypt 
modprobe dm-mod 

1.2) partition table

Find the disk you want to use to install your system with lsblk. For me it’s vda as I’m using a virtual machine to write this guide.
important: Select a GPT parition table type and not MBR.
Create a partition table with cfdisk /dev/vda (or your prefered tool) and create 2 partitions:

• /dev/vda1 as ef EFI (FAT-12/16/32) type, a size of 512MB is fine
• /dev/vda2 as 83 Linux filesystem type for the rest of the disk

Write the partition table to the disk.

1.3) setting up the encrypted volume

Create the encrypted volume, it will ask you for a confirmation and let you choose a passphrase. (Note that PBKDF2 key derivation algorithm is weaker than Argon2 but is required when using the default grub bootloader, the installation using systemd-boot will not be covered in this guide.)

cryptsetup luksFormat --type luks2 --pbkdf pbkdf2 /dev/vda2

Then open it with the passphrase chosen.

cryptsetup luksOpen /dev/vda2 luks

1.4) setting up LVM

We will create 3 volumes, one for the SWAP, one for the ROOT filesystem and one for the HOME filesystem. Adapt the sizes to what is appropriate for you, in my case I’m using a virtual machine with a 25GB disk so I won’t create a huge root volume.

pvcreate /dev/mapper/luks
vgcreate system /dev/mapper/luks
lvcreate -L 1G -n swap system
lvcreate -L 10G -n root system
lvcreate -l 100%FREE -n home system

1.5) formating and mounting the volumes

I’ll use a BTRFS filesystem but use the filesystem you prefer.

#formatting
mkfs.fat -F32 /dev/vda1
fatlabel /dev/vda1 BOOT
mkswap -L SWAP /dev/mapper/system-swap
mkfs.btrfs -L ROOT /dev/mapper/system-root
mkfs.btrfs -L HOME /dev/mapper/system-home

#mounting
swapon /dev/mapper/system-swap
mount -o compress=zstd /dev/mapper/system-root /mnt 
mkdir -p /mnt/{home,boot,boot/efi,etc}
mount -o compress=zstd /dev/mapper/system-home /mnt/home
mount /dev/vda1 /mnt/boot/efi

Then create the fstab.

genfstab -pU /mnt >> /mnt/etc/fstab

2) base installation

2.1) installing required packages

We’ll use reflector to generate the mirrorlist. Adapt the country code to pick the closest mirrors.

reflector -c FR -p https -a 12 --sort rate --save /etc/pacman.d/mirrorlist

Then install the required packages and some useful packages.

pacstrap -i /mnt base base-devel linux linux-firmware linux-headers pacman-contrib man-pages btrfs-progs vim git bash-completion

2.2) chroot

Chroot into the system to continue the installation.

arch-chroot /mnt /bin/bash

2.2.1) locales, hostname, clock and timezone

In the file /etc/locale.gen, uncomment your locales (for example en_US.UTF-8 UTF-8)
You can also set your preferences for the virtual console in /etc/vconsole.conf, for example for a QWERTY layout:

KEYMAP=us
FONT=lat9w-16

And in /etc/locale.conf (LC_COLLATE=C for case sensitive sorting):

LANG=en_US.UTF-8
LC_COLLATE=C 

And finally generate the locales:

locale-gen 

You can set your hostname in /etc/hostname.

For your clock and timezone: (adapt to your timezone)

ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime
hwclock --systohc --utc

2.2.2) root password and user creation

Set your root password with passwd
Then create a user (named sam here) in the wheel group (to use sudo) and set its password with:

useradd -m -G wheel sam
passwd sam

and uncomment the line containing %wheel ALL=(ALL:ALL) ALL in /etc/sudoers

2.2.3) SELinux installation (from AUR)

Log in as your created user and install an AUR helper to make things easier:

su sam
cd
git clone https://aur.archlinux.org/yay.git
cd yay
makepkg -si
cd

Then install the required packages for SELinux to work. It will ask you for replacements with conflicting packages, answer yes every time.

yay -S libsepol libselinux checkpolicy secilc setools libsemanage semodule-utils policycoreutils selinux-python python-ipy mcstrans restorecond
yay -S pam-selinux pambase-selinux coreutils-selinux findutils-selinux iproute2-selinux logrotate-selinux openssh-selinux psmisc-selinux shadow-selinux cronie-selinux
yay -S sudo-selinux

Note: If sudo-selinux fails to build, build it with --nocheck option:

cd ~/.cache/yay/sudo-selinux
makepkg -si --nocheck

Then exit your user, remodify /etc/sudoers to uncomment the line containing %wheel ALL=(ALL:ALL) ALL and relog as your user. After that:

sudo pacman -S less
yay -S systemd-selinux systemd-libs-selinux util-linux-selinux util-linux-libs-selinux
cd ~/.cache/yay/systemd-selinux
makepkg -si --nocheck

Due to a cyclic dependency which won’t be fixed the complete build will fail at first, that’s why you need to manually build systemd-selinux again after. For some reason less is also required for the build but not a build dependency.
Then more SELinux packages and a policy:

yay -S selinux-alpm-hook dbus-selinux selinux-refpolicy-arch

If the check fails for dbus-selinux build it with --nocheck option:

cd ~/.cache/yay/dbus-selinux
makepkg -si --nocheck

If you want to apply a fedora-style user context (as root):

semanage login -m -s unconfined_u __default__

2.2.4) necessary packages

Network for next boot:

pacman -S networkmanager
systemctl enable NetworkManager

grub and lvm2:

pacman -S grub efibootmgr lvm2

Secure boot:
Note: If you don’t want to bother with secure boot, do not run sbctl related command, and later when generating the boot image with grub, remove --modules="tpm" --disable-shim-lock from the command

pacman -S sbctl
sbctl create-keys
sbctl enroll-keys -m

linking TPM and LUKS key

Without this step, the computer is still vulnerable to evild maid attacks and a software keylogger could be installed by disabling the secure boot (clear CMOS for example). To make sure the encrypted device is linked to the TPM, we need to run the following command:

systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/vda2 

systemd-cryptenroll also support hardware security keys like FIDO2 tokens, in this case you can refer to the archwiki for the command syntax.
systemd-boot is also the recommended option instead of using grub when linking the TPM and LUKS key, you can then only have a PIN and also be protected in more scenarios.

2.2.5) optional packages

If you have an intel CPU:

pacman -S intel-ucode

If you have a laptop and want battery optimization:

pacman -S tlp
systemctl enable tlp

If you need bluetooth:

pacman -S bluez
systemctl enable bluetooth

If you want 32bits apps (necessary for some packages), in /etc/pacman.conf uncomment these lines:

#[multilib]
#include = /etc/pacman.d/mirrorlist

2.2.5) generating boot images

in /etc/mkinitcpio.conf on the MODULES=() line, add dm-mod and in the HOOKS=() line you should have:

HOOKS=(base udev autodetect modconf block keyboard encrypt lvm2 filesystems fsck)

Then:

mkinitcpio -p linux

sbctl post-hook should automatically sign /boot/vmlinuz-linux. Otherwise run:

sbctl sign -s /boot/vmlinuz-linux

Then in /etc/default/grub

• uncomment the line GRUB_UNABLE_CRYPTODISK=y
• in GRUB_CMDLINE_LINUX="" add cryptdevice=/dev/vda2:system root=/dev/mapper/system-root
• in GRUB_CMDLINE_LINUX_DEFAULT="" add lsm=selinux,landlock,lockdown,yama,integrity,bpf

Then:

grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=arch_grub --modules="tpm" --disable-shim-lock --recheck
grub-mkconfig -o /boot/grub/grub.cfg
sbctl sign -s /boot/efi/EFI/arch_grub/grubx64.efi

Please note that in a virtual machine you’ll need an emulated TPM for the virtual machine to boot if you want secure boot enabled.

3) exit and reboot

exit    # until you exit the chroot
umount -R /mnt
swapoff -a
reboot

4) (Optional) avoid entering the same password twice to decrypt the disk when booting

GRUB unlocks /dev/vda2 so it can read /boot and load the kernel/initramfs.
The initramfs then takes over and unlocks /dev/vda2 again for the actual root/LVM setup.
But GRUB doesn’t pass the password it obtained to the initramfs requiring you to enter the password twice to decrypt the system.
You can follow these steps to avoid this issue:

sudo install -d -m 700 /etc/cryptsetup-keys.d

sudo dd bs=512 count=4 if=/dev/random iflag=fullblock \
    | sudo install -m 600 /dev/stdin /etc/cryptsetup-keys.d/system.key

sudo cryptsetup luksAddKey /dev/vda2 /etc/cryptsetup-keys.d/system.key

Then add to /etc/mkinitcpio.conf:

FILES=(/etc/cryptsetup-keys.d/system.key)

Then in /etc/default/grub in GRUB_CMDLINE_LINUX="" append:

 cryptkey=rootfs:/etc/cryptsetup-keys.d/system.key

Then rebuild:

sudo mkinitcpio -P
sudo grub-mkconfig -o /boot/grub/grub.cfg

5) post reboot steps

5.1) relabel files

check SELinux status with sestatus, it should be in permissive with refpolicy-arch as the loaded policy.
Relabel all the files correctly with the following command:

restorecon -RFv /

you might want to clean yay cache before doing that to have less files to relabel:

rm -rf ~/.cache/yay/*

5.2) enable auditd

enable auditd service to read AVC denials from SELinux later.

systemctl enable --now auditd

5.3) create and load necessary policy

Create a file requiredmod.te with the following content:

module requiredmod 1.0;

require {
        type auditd_etc_t;
        type getty_t;
        type var_run_t;
        type tmpfs_t;
        type local_login_t;
        type systemd_tmpfiles_t;
        type init_runtime_t;
        type devpts_t;
        type kernel_t;
        type device_t;
        type udev_t;
        type hugetlbfs_t;
        type udev_tbl_t;
        type policy_config_t;
        type tmp_t;
        type unconfined_t;
        type var_lib_t;
        type systemd_userdbd_runtime_t;
        type systemd_user_runtime_dir_t;
        type systemd_sessions_t;
        type systemd_userdbd_t;
        type etc_runtime_t;
        type systemd_logind_t;
        type file_context_t;
        type semanage_t;
        type selinux_config_t;
        type initrc_runtime_t;
        type sshd_t;
        class dir { write add_name remove_name getattr open read search };
        class file { getattr open read write create getattr ioctl lock relabelfrom relabelto setattr unlink };
        class sock_file write;
        class unix_stream_socket { read write ioctl connectto};
        class capability2 block_suspend;
        class filesystem { associate quotaget quotamod };
        class key { link search };
        class process { noatsecure rlimitinh siginh transition };

}

#============= getty_t ==============
allow getty_t tmpfs_t:dir { getattr open read };
allow getty_t var_run_t:file { getattr open read };
allow getty_t initrc_runtime_t:dir { getattr open read };

#============= local_login_t ==============
allow local_login_t init_runtime_t:sock_file write;
allow local_login_t systemd_logind_t:unix_stream_socket connectto;
allow local_login_t var_lib_t:dir { add_name remove_name };
allow local_login_t var_lib_t:file { create getattr lock open read setattr unlink write };

#============= sshd_t ==============
allow sshd_t local_login_t:key { link search };
allow sshd_t systemd_logind_t:unix_stream_socket connectto;
allow sshd_t unconfined_t:process { noatsecure rlimitinh siginh };

#============= systemd_tmpfiles_t ==============
allow systemd_tmpfiles_t auditd_etc_t:dir search;
allow systemd_tmpfiles_t auditd_etc_t:file getattr;

#============= systemd_sessions_t ==============
allow systemd_sessions_t kernel_t:dir search;
allow systemd_sessions_t kernel_t:file { getattr ioctl open read };

#============= systemd_user_runtime_dir_t ==============
allow systemd_user_runtime_dir_t etc_runtime_t:file { open read };
allow systemd_user_runtime_dir_t kernel_t:dir search;
allow systemd_user_runtime_dir_t kernel_t:file { getattr ioctl open read };
allow systemd_user_runtime_dir_t systemd_userdbd_runtime_t:sock_file write;
allow systemd_user_runtime_dir_t systemd_userdbd_t:unix_stream_socket connectto;
allow systemd_user_runtime_dir_t tmp_t:dir read;
allow systemd_user_runtime_dir_t tmpfs_t:filesystem { quotaget quotamod };

#============= systemd_userdbd_t ==============
allow systemd_userdbd_t initrc_runtime_t:dir { getattr open read search };

#============= devpts_t ==============
allow devpts_t device_t:filesystem associate;

#============= hugetlbfs_t ==============
allow hugetlbfs_t device_t:filesystem associate;

#============= kernel_t ==============
allow kernel_t self:capability2 block_suspend;

#============= tmpfs_t ==============
allow tmpfs_t device_t:filesystem associate;

#============= udev_t ==============
allow udev_t kernel_t:unix_stream_socket { read write ioctl };
allow udev_t udev_tbl_t:dir { write add_name };
allow udev_t var_run_t:sock_file write;

Run the following command to compile and load the module:

checkmodule -m -o requiredmod.mod requiredmod.te
semodule_package -o requiredmod.pp -m requiredmod.mod
semodule -i requiredmod.pp

And set a few booleans:

setsebool -P allow_polyinstantiation on
setsebool -P systemd_tmpfiles_manage_all on
setsebool -P ssh_sysadm_login on

Then in /etc/selinux/config, set SELinux mode to enforcing instead of permissive and reboot.

And that’s it, you now have a minimal archlinux installation in UEFI with full disk encryption, secure boot, and SELinux in enforcing mode.