feat(stolas): enable TPM2 LUKS keyslot

nixos/stolas/default.nix

@@ -32,6 +32,8 @@
         "usb_storage"
         "sd_mod"
       ];
+      # Ensure that TPM module is loaded
+      kernelModules = [ "tpm" ];
     };
   };
 

nixos/stolas/disks.nix

@@ -30,10 +30,12 @@
               content = {
                 type = "luks";
                 name = "crypted";
-                #passwordFile = "/tmp/secret.key"; # Interactive
                 settings = {
                   allowDiscards = true;
-                  #keyFile = "/tmp/secret.key";
+                  crypttabExtraOpts = [
+                    "tpm2-device=auto"
+                    "tpm2-pin=true"
+                  ];
                 };
                 #additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
                 content = {