An explanation of how to enable secure boot on NixOS, using a community project named ‘Lanzaboote’, and further how to automatically unlock a LUKS-encrypted disk using a TPM with systemd-cryptenroll.| jnsgr.uk
The Trusted Platform Module is a security device that sits on a physical motherboard, runs in a CPU trust zone, or is provided by a hypervisor. By functioning below the OS and boot sequence, it provides a trust anchor to verify those systems even if they’ve been compromised. TPMs are required for any device qualified for Windows, underpinning technologies like Windows’ BitLocker, various features in ChromeOS, and Linux’s Integrity Measurement Architecture.| ericchiang.github.io