diff --git a/deploy.sh b/deploy.sh index f3a9cf8..4369b5c 100755 --- a/deploy.sh +++ b/deploy.sh @@ -568,6 +568,8 @@ EOF postrun_action() { echo "" + # Add TPM2 boot disk decryption + # Add pcr-check.nix } nixos_update() { diff --git a/nix-config/configuration.nix b/nix-config/configuration.nix index 4888bb9..4212006 100644 --- a/nix-config/configuration.nix +++ b/nix-config/configuration.nix @@ -7,8 +7,7 @@ inputs.sops-nix.nixosModules.sops ./disks/disko.nix ./disks/snapraid.nix - ./disks/pcr-check.nix - ./hardware-configuration.nix +# ./disks/pcr-check.nix ]; # Hardware settings @@ -37,10 +36,8 @@ boot.loader.efi.canTouchEfiVariables = true; # TPM2 PCR check - systemIdentity.enable = true; - # On first boot, get the value with: systemd-analyze pcrs 15 --json=short | jq -r ".[0].sha256" - # and place it here. - systemIdentity.pcr15 = null; # "6214de8c3d861c4b451acc8c4e24294c95d55bcec516bbf15c077ca3bffb6547"; +# systemIdentity.enable = true; +# systemIdentity.pcr15 = null; # Timezone time.timeZone = "Europe/Paris"; diff --git a/nix-config/disks/pcr-check.nix b/nix-config/disks/pcr-check.original similarity index 100% rename from nix-config/disks/pcr-check.nix rename to nix-config/disks/pcr-check.original