How-to auto-unlock TPM at boot (full disk encryption)

[ClementNerma]

I have enabled full-disk encryption (FDE) and would like to automatically unlock the disk at boot.

With Ubuntu, I used to run Clevis in InitRAMFS, but I'm not sure how to do it properly.

Any idea? Thanks :)

[taukakao]

You can install clevis on the host system with "abroot pkg add clevis-initramfs", "abroot pkg add clevis-tpm2" and then "abroot pkg apply".
Afterwards, just configure it using "host-shell pkexec" instead of "sudo".
To apply initramfs changes, do "abroot update-initramfs"

[ClementNerma]

Thanks, i'm going to try that :)

[taukakao]

I should note that you have to reboot after running any abroot operation like "pkg apply" or "upgrade", since it applies changes to the other (currently not booted) root.