I am trying to setup a full encrypted disk, which will automatically unlock using TPM2.
At the moment I have been able to achieve the OS installation, but now I am stuck unknowing how to setup the automatic unlock.
I have read on internet that some programs (as dracut) can be used, but also, according to a nixos issue, it should be useless: systemd-cryptenroll should be enough… so how am I supposed to proceed?
My current configuration is:
/vda1: the efi/boot partition
/vda2: the encrypted partition, with LVM swap and root partitions.
I am using the nixos unstable version, and I am testing the installation in a KVM VM.
i did this by setting boot.initrd.systemd.enable to true, adding tpm2-tss to environment.systemPackages, rebuilding, and then running systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/<my encrypted device>. in your case, the device should be /dev/vda2; and if you’re not using secureboot, you may want to change --tpm2-pcrs=0+7 to just --tpm2-pcrs=0
Is it possible to get the same result by using zfs and its encryption?
i’m not very familiar with that since i’ve only used luks with zfs, but i know systemd-cryptenroll doesn’t support it. this might be a good resource though
Is it possible to encrypt also the /boot partition and still unlock with tpm?
i’ve only seen this done with grub and with patches. the only real setup guide i’ve found is here and as it’s not officially supported, i will have to say YMMV. i don’t see why it wouldn’t work on nixos though
I installed NixOS pre-24.04 and chose “encrypt”, but it created LUKS1 instead of LUKS2, which is annoying. I had to upgrade LUKS. Is there a way of installing LUKS2 from the start? Does it need manual partitioning when installing?
for nixos at the moment I always prefer manual partitioning & installation,
since the installer does not seem to support all the advanced features… and this is a pity…
I do not know if there is a luks2 option directly in the installer.
I don’t think there’s a way to go with LUKS2 in the installer. You can follow this to upgrade using a live USB or this for a more comprehensive setup guide.