Option to enroll luks device for unlock methods (e.g. TPM2)

[MattSturgeon]

It would be useful to have an option for luks devices to enable TPM2 unlock (and maybe others like FIDO2 or PKCS11 too?).

This would be more convenient than running sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/<device> after using disko.

An error should be thrown if the option is used on a system without TPM2 support.

[iFreilicht]

Wouldn't it be possible to just use something like this?

postCreateHook="systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/<device>";

Or is there some distinct advantage to implementing this feature in disko directly?

[Mic92]

It's most a documentation issue I suppose. Having a NixOS option can help with that, but also a template could.

[kagehisa]

Wouldn't it be possible to just use something like this?

postCreateHook="systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/<device>";

Or is there some distinct advantage to implementing this feature in disko directly?

So far I just used disko for simple partition layouts, but this time I would like to use it to create a luks setup with a fido2 device to unlock it. I have the basics down I guess (using systemd enabled initrd as described in the nixos manual).

The only thing that is missing is to have the systemd-cryptenroll done. The solution with postCreateHook sounds good to me, but I couldn't find an example where a hook is used for a luks device. And according to this comment there is no support for running hooks on a luks device if I understood that correctly.

Do I need to run the hook after the filesystem creation that is using the luks device? Is there maybe an example that shows on what level the hook has to be set?

[phaer]

And according to #415 (comment) comment there is no support for running hooks on a luks device if I understood that correctly.

I believe the reason for this is just that noone with enough interest in such a feature implemented it yet. I personally don't have a use-case but I am happy to review PRs for that and provide guidance where I can. I wrote the original implementation for zfs and think the one for luks could work almost the same.

[kagehisa]

@phaer would you be so kind to point me to the src for this? I looked in lib/types/ at all zfs related files but I wasn't able to pinpoint the hook related code. The disko source is a bit puzzling for me tbo.