# Full disk encryption + TPM2

**URL:** https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454
**Category:** Help
**Created:** [June 21, 2023, 5:59pm UTC](https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454 "2023-06-21T17:59:45Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![getchoo](https://discourse.nixos.org/user_avatar/discourse.nixos.org/getchoo/32/30204_2.png) [@getchoo](https://discourse.nixos.org/u/getchoo)
#### Post date: [June 21, 2023, 10:09pm UTC](https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454/2 "2023-06-21T22:09:40Z")

</div>

i did this by setting `boot.initrd.systemd.enable` to `true`, adding `tpm2-tss` to `environment.systemPackages`, rebuilding, and then running `systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/<my encrypted device>`. in your case, the device should be `/dev/vda2`; and if you’re not using secureboot, you may want to change `--tpm2-pcrs=0+7` to just `--tpm2-pcrs=0`

hope this helps 🙂

---

_[View the full topic](https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454)._