feature(boot): add luks unlock method using TPM+PIN

INSTALLATION.md

@@ -158,6 +158,25 @@ $ sudo sbctl status                     # Secure Boot: ✓ Enabled
 - If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
 - Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
 
+## how to unlock the disk with the tpm (laptops)
+Needs Secure Boot first. The TPM releases the key only with the PIN and while
+the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
+
+1. enroll the TPM with a PIN as an additional key slot
+```bash
+# asks for the current passphrase, then the new PIN
+$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
+2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
+
+- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
+  state changed. After a firmware update that's expected, otherwise investigate
+  before typing the passphrase. To re-enroll:
+```bash
+$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
 ## how to upgrade the system
 ```bash
 $ cd /path/to/repo

hosts/krypton/configuration.nix

@@ -24,6 +24,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

modules/nixos/tpm-unlock.nix

@@ -0,0 +1,8 @@
+# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
+# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
+# so this needs lanzaboote.nix. Enrolled once per host with
+# `systemd-cryptenroll`, see INSTALLATION.md.
+
+{
+  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
+}