Tang/Clevis for laptops #30
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
I want to install tang/clevis to automatically unlock encrypted laptops on my network like Kansas. An additional restriction is those laptops should be able to be unlocked at work as well. We'll implement that in SeesDeployment later.
@hermes-bot implement support for this on both Kansas, and using horse as the server.
hermes-bot referenced this issue2026-10-17 22:52:13 +00:00
Implemented in #31 (branch
issue-30-tang-clevis):rpickler.tang-server.enable) — nixpkgsservices.tangon :7654, restricted by systemdIPAddressAllowto the LAN + wireguard ranges; keys auto-generate on first advertisement.rpickler.tang-client.enable) — per-host JWE wired intoboot.initrd.cleviswith the tang pin, DHCP in the initrd, dock/adapter NIC modules. Passphrase fallback stays intact (slot is never removed), so booting off-LAN still prompts.hosts/clevis/kansas-tang-home.jweis enrolled, so the PR is safe to merge ahead of enrollment.modules/tang/README.mdhas the one-time enrollment runbook (LUKS slot + thumbprint-pinnedclevis encrypt tang, LAN +horse.vpnURLs embedded), verification, rotation, and the phase-2 hook for work-reachable unlock — a second*-tang-work.jweslot on a work-side tang is a drop-in for the SeesDeployment phase.Next steps (need a physical console on kansas): enroll on the home LAN, commit the JWE, rebuild, then test on-LAN reboot (unattended) and off-LAN reboot (prompt).