9 lines
348 B
Nix
9 lines
348 B
Nix
# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
|
|
# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
|
|
# so this needs lanzaboote.nix. Enrolled once per host with
|
|
# `systemd-cryptenroll`, see INSTALLATION.md.
|
|
|
|
{
|
|
boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
|
|
}
|