Installing

After partitioning, see partition(7), genluks(8) does the rest in one command: it formats, opens, makes the file systems, mounts everything under the mount point, creates the key files and writes /etc/crypttab. It shows what it is about to erase and waits for yes.

# genluks /mnt /dev/sdX2:/
# genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX4:/home /dev/sdX5:swap
# genluks /mnt /dev/sdX2:/ /dev/sdX9:/data:plain,xfs

Each argument is device:target[:options], where target is a mount point or the word swap, and options is plain for no encryption and/or ext4, xfs or btrfs.

Then format and mount the EFI system partition as in partition(7), and go on with setup-filesystem /mnt. setup-boot(8) finds the encrypted root and puts cryptroot= in the kernel command line.

Adding an encrypted partition later

On the installed system, as root. Format and open it under a name of your choice, here cdata, make a file system and mount it:

# cryptsetup luksFormat --type luks2 /dev/sdXn
# cryptsetup open /dev/sdXn cdata
# mkfs.ext4 /dev/mapper/cdata
# mkdir -p /data && mount /dev/mapper/cdata /data

Give it a key file on root so it opens at boot without a prompt:

# mkdir -p /etc/cryptkeys && chmod 700 /etc/cryptkeys
# head -c 64 /dev/urandom > /etc/cryptkeys/cdata.key
# chmod 400 /etc/cryptkeys/cdata.key
# cryptsetup luksAddKey /dev/sdXn /etc/cryptkeys/cdata.key

List it in /etc/crypttab, with the UUID from cryptsetup luksUUID /dev/sdXn:

cdata  UUID=<uuid>  /etc/cryptkeys/cdata.key  luks

Finally add it to /etc/fstab. genfstab / > /etc/fstab.new writes a table of everything mounted now, to copy the new line from.