tschingel: TPM PIN for measured boot via sops-nix #125

New issue

Open

opened 2026-07-21 20:54:03 +00:00 by fabianhauser · 0 comments

fabianhauser commented 2026-07-21 20:54:03 +00:00

Owner

Copy link

Add a TPM2 PIN (--tpm2-with-pin) to the measured-boot LUKS unlock on tschingel, so a valid TPM state still requires a PIN at boot. Currently hands-free (TPM only), with passphrase/SSH fallback.

The PIN should be managed via sops-nix (separate task). Touch points already marked with TODO(tpm-pin):

• nixos-modules/base/secure-boot-measured.nix
• packages/dotfiles-enroll-tpm/default.nix

Refs (lanzaboote how-to):

• https://nix-community.github.io/lanzaboote/how-to-guides/enable-measured-boot.html
• https://nix-community.github.io/lanzaboote/how-to-guides/automatically-enroll-keys.html

Add a TPM2 PIN (`--tpm2-with-pin`) to the measured-boot LUKS unlock on tschingel, so a valid TPM state still requires a PIN at boot. Currently hands-free (TPM only), with passphrase/SSH fallback. The PIN should be managed via sops-nix (separate task). Touch points already marked with `TODO(tpm-pin)`: - `nixos-modules/base/secure-boot-measured.nix` - `packages/dotfiles-enroll-tpm/default.nix` Refs (lanzaboote how-to): - https://nix-community.github.io/lanzaboote/how-to-guides/enable-measured-boot.html - https://nix-community.github.io/lanzaboote/how-to-guides/automatically-enroll-keys.html

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

tschingel-setup

update-stylix

update-lanzaboote

update-git-hooks-nix

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fabianhauser/dotfiles#125

No description provided.