numbus/numbus
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updates. Bugfixes.

Browse Source
This commit is contained in:
Raphaël Numbus
2026-02-15 13:41:37 +01:00
parent a85de9a2c0
commit b3464e477b
6 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy.sh
+12 -7
View File
@@ -901,17 +901,22 @@ postrun_action() {
if gum confirm "➡️ I understand, 'yes' to proceed."; then
ssh_to_host 'bash -s' << EOF
echo "Enrolling boot disk key to TPM..."
if [[ ${#BOOT_DISKS_ID[@]} -eq 1 ]]; then
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-1 /dev/${BOOT_DISK_1_NAME}
elif [[ ${#BOOT_DISKS_ID[@]} -eq 2 ]]; then
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-1 /dev/${BOOT_DISK_1_NAME}
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-2 /dev/${BOOT_DISK_2_NAME}
fi
j=1
for i in ${!BOOT_DISKS_ID[@]}; do
if [[ echo "${BOOT_DISKS_ID[${i}]}" | grep -iq "nvme" ]]; then
DISK_PATH="/dev/${BOOT_DISKS_ID[${i}]}p2"
else
DISK_PATH="/dev/${BOOT_DISKS_ID[${i}]}2"
fi
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-${j} ${DISK_PATH}
((j++))
done
echo "Getting PCRS 15 hash..."
PCR_HASH=\$(echo ${REMOTE_PASS} | sudo -S systemd-analyze pcrs 15 --json=short)
sed -i "s|PCR_HASH|\${PCR_HASH}|" /etc/nixos/configuration.nix
echo ${REMOTE_PASS} | sudo -S sed -i "s|PCR_HASH|\${PCR_HASH}|" /etc/nixos/configuration.nix
EOF
else
echo "Skipping TPM configuration."