disk encrypto

modules/features/boot/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./power.nix
     ./secure-boot.nix
+    ./storage-crypto.nix
     ./uefi.nix
   ];
 }

modules/features/boot/storage-crypto.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.features.boot.storageCrypto;
+in
+{
+  options.my.features.boot.storageCrypto = {
+    enable = lib.mkEnableOption "LUKS decryption via TPM2";
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.initrd.systemd.enable = true;
+
+    boot.initrd.luks.devices.cryptroot = {
+      crypttabExtraOpts = [
+        "tpm2-device=auto"
+      ];
+    };
+
+    security.tpm2.enable = true;
+
+    environment.systemPackages = with pkgs; [
+      tpm2-tools # TPM2 management tools
+    ];
+  };
+}