Secure Boot + Automatic LUKS decryption#

Generate secure boot keys:
```
sudo nix run nixpkgs#sbctl create-keys
```

Include nixos-programs-lanzaboote or manually enable lanzaboote in NixOS host configuration:

boot = {
  initrd.systemd.enable = true; # For automatic decryption with TPM.
  loader.systemd-boot.enable = lib.mkForce false; # Interferes with lanzaboote and must be force-disabled.

  lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/sbctl";
  };
};

In UEFI, set secure boot to "setup mode" or erase platform keys.

Enroll your secure boot keys:

sudo nix run nixpkgs#sbctl -- enroll-keys --microsoft

Reboot, make sure secure boot is enabled in UEFI.

Check secure boot status with bootctl status:

System:
      Firmware: UEFI 2.70 (American Megatrends 5.17)
Firmware Arch: x64
  Secure Boot: enabled (user)
  TPM2 Support: yes
  Measured UKI: yes
  Boot into FW: supported

If your root drive is encrypted with LUKS, you can have the TPM automatically decrypt it on boot:
```
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7+12 --wipe-slot=tpm2 /dev/nvme0n1p2
```
Replace /dev/nvme0n1p2 with your root partition. Check the Linux TPM PCR Registry for more details.

NOTE: This requires a TPM2 module, devices with prior versions will not work.