How to Increase the LUKS-Encrypted Swap partition size on a default EndeavourOS Install

28 Jul, 2025

Hi all,

Today I spent longer than I'd like to admit growing the size of my swap file partition on a new EndeavourOS install in anticipation of a RAM upgrade. Hopefully the guide below will help you if you ever find yourself in a similar situation.

Introduction

If you've upgraded your RAM or need hibernation support, you might find yourself needing to resize your encrypted swap partition. Unfortunately, when swap is at the end of your disk (as is common with default installations), you can't simply extend it in place. This guide walks through safely recreating your encrypted swap partition while maintaining the same security model and automatic unlocking behavior that Calamares originally set up.

This guide is followed at your own risk. These instructions were correct as of the time of writing with the March 2025 Calamares installer, but configurations change over time so this will eventually be out of date.

This guide specifically covers LUKS-encrypted swap partitions that use keyfile authentication - the default setup when you install EndeavourOS with full disk encryption enabled.

Prerequisites and Preparation

Before You Start

Essential preparations:

Create backups of any important data - while this process is generally safe, encrypted disk operations always carry some risk
Ensure you have a working live USB - you'll need to boot from external media to perform these operations (these instructions assume it is either EndeavourOS or Arch based and has access to the arch-chroot command)
Know your root filesystem password - you'll need this to unlock your encrypted root partition
Verify you have sufficient free space on your disk for the larger swap partition

Understanding Your Setup

First, let's understand what we're working with. Boot into your normal system and run these commands to identify your current configuration:

# See your partition layout
lsblk

# Identify encrypted partitions
sudo blkid | grep crypto_LUKS

# Check current swap configuration
cat /etc/crypttab
cat /etc/fstab

Key things to note:

Your encrypted partitions will show TYPE="crypto_LUKS"
EndeavourOS uses UUID-based device naming in crypttab (like luks-c501e600-32ea-4083-beda-5c200429fd94)
Your system uses a keyfile (typically /crypto_keyfile.bin) to automatically unlock swap at boot
Both root and swap partitions likely appear in /etc/crypttab

Step-by-Step Process

Phase 1: Create New Swap Partition

1. Boot from your EndeavourOS live USB

2. Identify your current partitions:

lsblk
sudo blkid

Make note of:

Your encrypted root partition (usually the largest)
Your current encrypted swap partition
Available free space on your disk

3. Delete and recreate the swap partition:

You can use KDE Partition Manager (my preference for its visual interface) or command line tools like fdisk/cryptsetup - use whichever you're more comfortable with:

Using KDE Partition Manager:

Delete the existing swap partition
Shrink your system partition if necessary to make space for the amount of Swap required (backups are very important in case this goes wrong!)
Create a new partition with your desired size
Important: Set up LUKS encryption on the new partition
Use the same password you used during your original EndeavourOS installation (or a password that you'll remember, as you'll need it later in the process)

Using command line tools: Alternatively you can use fdisk or gparted or similar to repartition the disk, and then use cryptsetup in order to encrypt the new partition.

4. Note the new partition's details:

# Get the UUID of your new swap partition
sudo blkid /dev/sdXY  # replace with your new swap partition device

Write down this UUID - you'll need it later.

Phase 2: Access Your Installed System

1. Unlock your encrypted root filesystem:

# Replace sdXY with your encrypted root partition
sudo cryptsetup luksOpen /dev/sdXY root
# Enter your root filesystem password when prompted

2. Mount your root filesystem:

For Btrfs with subvolumes (EndeavourOS default):

# Mount the @ subvolume as root
sudo mount -o subvol=@ /dev/mapper/root /mnt

# Mount @home subvolume if you have one
sudo mount -o subvol=@home /dev/mapper/root /mnt/home

3. Set up chroot environment:

sudo mount --bind /dev /mnt/dev
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys
sudo mount --bind /run /mnt/run

Phase 3: Configure the New Swap

1. Chroot into your system:

sudo arch-chroot /mnt

2. Verify your existing keyfile:

ls -la /crypto_keyfile.bin
# Should show: -rw------- 1 root root [size] [date] /crypto_keyfile.bin

3. Add the keyfile to your new swap partition:

# Replace /dev/sdXY with your new swap partition
cryptsetup luksAddKey /dev/sdXY /crypto_keyfile.bin
# Enter the password you set when creating the partition in KDE Partition Manager

4. Remove the password from the new partition (optional but recommended):

cryptsetup luksRemoveKey /dev/sdXY
# Enter the password you set in KDE Partition Manager when prompted

Note: This step makes the setup cleaner by ensuring only the keyfile can unlock the swap partition, matching the original Calamares setup. If you prefer to keep the password as a backup, you can skip this step.

5. Test that the keyfile works:

# Test unlocking with keyfile
cryptsetup luksOpen /dev/sdXY test_swap --key-file /crypto_keyfile.bin
mkswap /dev/mapper/test_swap
swapon /dev/mapper/test_swap
free -h  # should show your new swap size
swapoff /dev/mapper/test_swap
cryptsetup luksClose test_swap

5. Update your configuration files:

Update /etc/crypttab:

nano /etc/crypttab

Change the swap line to use your new UUID:

luks-dd83da02-4289-4471-9aae-e7f2f57284c3 UUID=dd83da02-4289-4471-9aae-e7f2f57284c3     /crypto_keyfile.bin luks

(Replace the UUIDs with your actual new swap partition UUID)

Update /etc/fstab:

nano /etc/fstab

Ensure the swap line matches your new device:

/dev/mapper/luks-dd83da02-4289-4471-9aae-e7f2f57284c3 swap           swap    defaults   0 0

Phase 4: Update Boot Configuration

I missed this step and it caused me a lot of problems - make sure you don't make the same mistake!

1. Update dracut configuration:

nano /etc/dracut.conf.d/calamares-luks.conf

Find the line that looks like:

add_device+=" /dev/disk/by-uuid/OLD-SWAP-UUID "

Change it to use your new swap UUID:

add_device+=" /dev/disk/by-uuid/dd83da02-4289-4471-9aae-e7f2f57284c3 "

2. Regenerate initramfs:

dracut-rebuild

3. Update GRUB configuration:

grub-mkconfig -o /boot/grub/grub.cfg

4. Exit chroot:

exit

Phase 5: Final Steps

1. Unmount everything:

sudo umount -R /mnt

2. Reboot:

reboot

Your system should now boot normally and automatically unlock your new, larger swap partition.

Testing and Verification

After rebooting successfully:

1. Verify swap is active:

free -h
swapon -s

2. Test hibernation (if needed):

systemctl hibernate

3. Check automatic unlocking: Your swap should appear in /proc/swaps without any manual intervention during boot.

Conclusion

Resizing encrypted swap partitions requires recreating them entirely, but by following these steps, you can safely expand your swap while maintaining all the convenience and security of your original installation.

If you encounter issues not covered in this guide, the EndeavourOS forum and Arch Linux documentation are excellent resources for further troubleshooting.