tpm unlock

systems/x86_64-linux/matt-nixos/boot.nix

@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   pkgs,
   namespace,
   ...
@@ -38,6 +39,14 @@ in
         "usb_storage"
         "sd_mod"
       ];
+
+      luks.devices = {
+        cryptroot = {
+          device = "/dev/disk/by-partlabel/disk-main-matt-nixos-cryptroot";
+          allowDiscards = true; # Used if primary device is a SSD
+          preLVM = true;
+        };
+      };
     };
 
     kernelPackages = kernel;
@@ -56,7 +65,10 @@ in
 
   nixpkgs.crossSystem.system = "aarch64-linux";
 
-  environment.systemPackages = with pkgsVersion; [
-    edk2-uefi-shell
-  ];
+  environment = {
+    etc."clevis/disk.jwe".source = ./disk.jwe;
+    systemPackages = with pkgsVersion; [
+      edk2-uefi-shell
+    ];
+  };
 }