# Encrypted storage configuration

zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
clearpart --all --initlabel # Erase all partitions and Initializes the disk label to the default for the target architecture

part /boot/efi --fstype="efi" --size=512 --fsoptions="umask=0077,shortname=winnt" --label=efi # Creates a 512 MiB EFI system partition
part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" --encrypted --passphrase= # Create a single encrypted root partition with the remaining space.

# Tools for LUKS management and TPM2-based auto-unlock
%packages --exclude-weakdeps

cryptsetup # Userspace tool for dm-crypt, required to open and manage the LUKS root device
tpm2-tools # TPM2 tools, provides the dracut tpm2-tss module needed to rebuild the initrd for TPM2 auto-unlock
tpm2-tss # TPM2 TSS libraries, runtime dependency of tpm2-tools and systemd-cryptenroll

%end # End of the packages section

# Stash a preseeded LUKS passphrase so the %post below can enroll TPM2-based
# auto-unlock. Only acts when `--passphrase=` was preseeded on the encrypted
# `part /` line; with the interactive default (empty passphrase) nothing is
# stashed and the %post enrollment is skipped cleanly.
%pre --logfile=/tmp/luks-tpm-pre.log

KS_FILE=""
for candidate in /run/install/ks.cfg /tmp/ks.cfg; do
    if [ -f "$candidate" ]; then
        KS_FILE="$candidate"
        break
    fi
done

if [ -n "$KS_FILE" ]; then
    LINE=$(grep -E '^[[:space:]]*part[[:space:]]+/[[:space:]].*--encrypted' "$KS_FILE" | grep -- '--passphrase=' | head -n 1)
    if [ -n "$LINE" ]; then
        PW=${LINE#*--passphrase=}
        case "$PW" in
            \"*) PW=${PW#\"}; PW=${PW%%\"*} ;;
            *)   PW=${PW%%[[:space:]]*} ;;
        esac
        if [ -n "$PW" ]; then
            printf '%s' "$PW" > /tmp/.luks-passphrase
            chmod 600 /tmp/.luks-passphrase
        fi
    fi
fi

%end

# Enroll TPM2-based LUKS auto-unlock (PCR 7-bound) when both guards hold: a
# TPM2 device is available at install time and a passphrase was preseeded in
# the kickstart (stashed by the %pre above). Otherwise the system keeps the
# regular passphrase prompt at boot. On any failure the LUKS configuration is
# left untouched, so the worst case is a passphrase prompt on every boot.
%post --logfile=/root/luks-tpm-post.log

if [ -e /dev/tpmrm0 ] && [ -s /tmp/.luks-passphrase ]; then
    set -x
    LUKSUUID=$(awk '$2 ~ /^UUID=/ {sub(/^UUID=/, "", $2); print $2}' /etc/crypttab)
    LUKSDEV="/dev/disk/by-uuid/$LUKSUUID"
    if systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --unlock-key-file=/tmp/.luks-passphrase "$LUKSDEV"; then
        sed -i 's| none discard,x-initrd.attach| tpm2-device=auto,discard,x-initrd.attach|' /etc/crypttab
        if ! grep -q 'tpm2-device=auto' /etc/crypttab; then
            sed -i -E 's|[[:space:]]none([[:space:]]|$)| tpm2-device=auto,discard\1|' /etc/crypttab
        fi
        if grep -q 'tpm2-device=auto' /etc/crypttab; then
            MID=$(cat /etc/machine-id)
            KVER=$(ls /usr/lib/modules | head -n 1)
            dracut -f --kver "$KVER" "/boot/efi/$MID/$KVER/initrd"
        fi
    fi
    shred -u /tmp/.luks-passphrase 2>/dev/null || true
fi

%end