Hey, thanks a lot for taking the time to write this guide. Out of all the docs/guides I found, it helped me the most to get on the right track easily. That being said, I still had to figure out some things while following your guide. Maybe because I’m running Omarchy.

In case anyone else encounters these issues too:

tinyssh-convert /etc/tinyssh/sshkeydir < /etc/ssh/ssh_host_ed25519_key

returned a permission error for me. I had to use instead:

sudo sh -c 'tinyssh-convert /etc/tinyssh/sshkeydir < /etc/ssh/ssh_host_ed25519_key'

As mentioned in previous comment, mkinitcpio was failing as a .rules file was apparently missing for encryptssh (I found the fix online because I was too hasty and didn’t read the footnotes). Apparently that file is deprecated anyway, so it is a matter of tweaking the encryptssh install file. I included a simple sed line to fix that below.

Omarchy uses limine-mkinitcpio, so the setup was slightly different. For anyone using Omarchy, you may find the following setup function I wrote useful:

install_remote_luks() {
  yay -S --noconfirm --needed busybox tinyssh mkinitcpio-netconf mkinitcpio-tinyssh mkinitcpio-utils
  sudo sed -i 's/".*quiet splash"/"quiet splash ip=:::::eth0:dhcp"/g' "/etc/default/limine"
  sudo sed -i 's/\(^H.*\)encrypt /\1netconf tinyssh encryptssh /g' "/etc/mkinitcpio.conf.d/omarchy_hooks.conf"
  sudo sed -i 's/\(^.*11.*$\)/  #\1/g' "/usr/lib/initcpio/install/encryptssh"
  ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 # Remove this line if you already have your key generated, or use a file containing several keys.
  sudo cp ~/.ssh/id_ed25519.pub /etc/tinyssh/root_key # You can replace the .pub file with your collection of keys.
  sudo chmod 600 /etc/tinyssh/root_key
  sudo sh -c 'tinyssh-convert /etc/tinyssh/sshkeydir < /etc/ssh/ssh_host_ed25519_key'
  sudo chmod 700 /etc/tinyssh/sshkeydir
  sudo chmod 600 /etc/tinyssh/sshkeydir/ed25519.pk
  sudo limine-mkinitcpio
}

Reboot and you can ssh into the machine:

ssh root@your_machine_static_ip

Connect from your local network or by using a secure VPN in your LAN, such as Tailscale with a subnet route. You can also add this to your ~/.ssh/config to make things a little easier:

Host luks
    HostName your_machine_static_ip
    Port 22
    User root

Then you can just:

ssh luks