fix: do not allow edits to the bootloader

Reviewed-on: #90

INSTALLATION.md

@@ -158,6 +158,25 @@ $ sudo sbctl status                     # Secure Boot: ✓ Enabled
 - If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
 - Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
 
+## how to unlock the disk with the tpm (laptops)
+Needs Secure Boot first. The TPM releases the key only with the PIN and while
+the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
+
+1. enroll the TPM with a PIN as an additional key slot
+```bash
+# asks for the current passphrase, then the new PIN
+$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
+2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
+
+- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
+  state changed. After a firmware update that's expected, otherwise investigate
+  before typing the passphrase. To re-enroll:
+```bash
+$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
 ## how to upgrade the system
 ```bash
 $ cd /path/to/repo

hosts/krypton/configuration.nix

@@ -24,6 +24,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
@@ -31,6 +32,13 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
+  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
+
+  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
+  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
+  boot.lanzaboote.settings.console-mode = "6";
+
   networking.hostName = "krypton";
   system.stateVersion = "26.05"; # don't change
 }

modules/nixos/bootloader.nix

@@ -4,6 +4,8 @@
   # set bootloader to systemd
   boot.loader = {
     systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
     efi.canTouchEfiVariables = true;
   };
 

modules/nixos/tpm-unlock.nix

@@ -0,0 +1,8 @@
+# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
+# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
+# so this needs lanzaboote.nix. Enrolled once per host with
+# `systemd-cryptenroll`, see INSTALLATION.md.
+
+{
+  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
+}