# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
# so this needs lanzaboote.nix. Enrolled once per host with
# `systemd-cryptenroll`, see INSTALLATION.md.

{
  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
}