Tang/Clevis auto-unlock for LUKS laptops (issue #30) #31

Merged

rpickler merged 1 commit from issue-30-tang-clevis into main

2026-10-31 15:59:23 +00:00

hermes-bot commented

2026-10-17 22:52:13 +00:00

Member

Implements #30: automatic LUKS unlock on the home network via Tang (server: horse) + Clevis (client: kansas), passphrase fallback anywhere else.

modules/tang/server.nix — rpickler.tang-server: nixpkgs services.tang on port 7654, socket-level IPAddressAllow limited to the LAN + wireguard ranges, plus firewall open. Keys auto-generate on first advertisement.
modules/tang/client.nix — rpickler.tang-client: wires the per-host JWE hosts/clevis/<host>-tang-home.jwe into boot.initrd.clevis.devices (tang pin, useTang = true), enables initrd networking (systemd-networkd DHCP — stage-1 systemd is default on 26.05), pulls in dock/adapter NIC modules, and asserts the configured luks device exists. Until a host's JWE is committed, enabling is a safe no-op + build warning, so this PR can merge before enrollment.
Enables server on horse, client on kansas.
modules/tang/README.md — enrollment runbook (luksAddKey slot + clevis encrypt tang with thumbprint pinning, both LAN and .vpn URLs embedded), verification (clevis decrypt | cryptsetup open test), recovery (passphrase slot never removed), tang key rotation, and the phase-2 hook for SeesDeployment/work unlock (second *-tang-work.jwe slot or tpm2/sss pin — drop-in).

Design notes:

The JWE is not secret (encrypted to tang's key), safe to commit — per issue, nothing needs sops.
clevis package installed on clients for enrollment + manual recovery.
Work-reachable unlock intentionally deferred per the issue; the layout anticipates it.

Not built/eval-tested here (no nix in this environment); module options verified against nixos-26.05 boot.initrd.clevis, services.tang, and initrd networkd modules. First nixos-rebuild on horse/kansas will confirm.

Will close issue 30 once enrollment is done — leaving open until kansas actually unlocks via tang.

Implements #30: automatic LUKS unlock on the home network via Tang (server: horse) + Clevis (client: kansas), passphrase fallback anywhere else. - `modules/tang/server.nix` — `rpickler.tang-server`: nixpkgs `services.tang` on port 7654, socket-level `IPAddressAllow` limited to the LAN + wireguard ranges, plus firewall open. Keys auto-generate on first advertisement. - `modules/tang/client.nix` — `rpickler.tang-client`: wires the per-host JWE `hosts/clevis/<host>-tang-home.jwe` into `boot.initrd.clevis.devices` (tang pin, `useTang = true`), enables initrd networking (systemd-networkd DHCP — stage-1 systemd is default on 26.05), pulls in dock/adapter NIC modules, and asserts the configured luks device exists. Until a host's JWE is committed, enabling is a safe no-op + build warning, so this PR can merge before enrollment. - Enables server on `horse`, client on `kansas`. - `modules/tang/README.md` — enrollment runbook (`luksAddKey` slot + `clevis encrypt tang` with thumbprint pinning, both LAN and `.vpn` URLs embedded), verification (`clevis decrypt | cryptsetup open` test), recovery (passphrase slot never removed), tang key rotation, and the phase-2 hook for SeesDeployment/work unlock (second `*-tang-work.jwe` slot or tpm2/sss pin — drop-in). Design notes: - The JWE is not secret (encrypted to tang's key), safe to commit — per issue, nothing needs sops. - `clevis` package installed on clients for enrollment + manual recovery. - Work-reachable unlock intentionally deferred per the issue; the layout anticipates it. Not built/eval-tested here (no nix in this environment); module options verified against nixos-26.05 `boot.initrd.clevis`, `services.tang`, and initrd networkd modules. First `nixos-rebuild` on horse/kansas will confirm. Will close issue 30 once enrollment is done — leaving open until kansas actually unlocks via tang.

hermes-bot added 1 commit

2026-10-17 22:52:14 +00:00

Add Tang/Clevis auto-unlock for LUKS laptops (issue #30 ) 290200dbb3

- modules/tang/server.nix: rpickler.tang-server — Tang service on horse,
  socket-level IPAddressAllow restricted to LAN + wireguard ranges
- modules/tang/client.nix: rpickler.tang-client — wires per-host
  hosts/clevis/<host>-tang-home.jwe into boot.initrd.clevis with tang
  pin, DHCP in initrd, NIC modules for dock/adapter unlocking; warns
  (no-op) until the JWE is enrolled
- enable server on horse, client on kansas
- modules/tang/README.md: enrollment runbook, verification, recovery,
  and the phase-2 hook for work-reachable unlock (SeesDeployment)

hermes-bot referenced this pull request

2026-10-17 22:53:21 +00:00

Tang/Clevis for laptops #30