initramfs-tpm-luks.yaml

# Set dracut configuration for the initramfs
# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml
# See: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d
postprocess:
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail

    install -dm 0755 -o 0 -g 0 /usr/lib/dracut/dracut.conf.d

  - |
    #!/usr/bin/env bash
    set -xeuo pipefail

    cat > /usr/lib/dracut/dracut.conf.d/20-atomic-tpm-luks.conf << 'EOF'
    # Add support for systemd-cryptsetup and tpm2-tss LUKS locking
    add_dracutmodules+=" tpm2-tss systemd-pcrphase "
    EOF