feat(configuration): generic FDE with systemd-cryptenroll, clevis fallback, and configurable initramfs

roles/configuration/tasks/encryption/dracut.yml

@@ -9,48 +9,58 @@
   ansible.builtin.copy:
     dest: /mnt/etc/dracut.conf.d/crypt.conf
     content: |
-      add_dracutmodules+=" crypt "
-      {% if configuration_luks_keyfile_in_use %}
+      add_dracutmodules+=" crypt systemd "
+      {% if configuration_luks_keyfile_in_use | default(false) %}
       install_items+=" {{ configuration_luks_keyfile_path }} "
       {% endif %}
+      {% if configuration_luks_auto_method == 'tpm2' %}
+      install_items+=" {{ configuration_luks_tpm2_token_lib | default('') }} "
+      {% endif %}
     mode: "0644"
 
-- name: Read kernel cmdline defaults
+# --- Kernel cmdline: write rd.luks.* args for dracut ---
+- name: Ensure kernel cmdline directory exists
+  ansible.builtin.file:
+    path: /mnt/etc/kernel
+    state: directory
+    mode: "0755"
+
+- name: Read existing kernel cmdline
   ansible.builtin.slurp:
     src: /mnt/etc/kernel/cmdline
-  register: configuration_kernel_cmdline_slurp
+  register: _kernel_cmdline_slurp
+  failed_when: false
 
 - name: Build kernel cmdline with LUKS args
   vars:
-    kernel_cmdline_current: >-
-      {{ configuration_kernel_cmdline_slurp.content | b64decode | trim }}
-    kernel_cmdline_list: >-
+    _cmdline_current: >-
+      {{ (_kernel_cmdline_slurp.content | default('') | b64decode | default('')) | trim }}
+    _cmdline_list: >-
+      {{ _cmdline_current.split() if _cmdline_current | length > 0 else [] }}
+    _cmdline_filtered: >-
       {{
-        kernel_cmdline_current.split()
-        if kernel_cmdline_current | length > 0 else []
-      }}
-    kernel_cmdline_filtered: >-
-      {{
-        kernel_cmdline_list
+        _cmdline_list
         | reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=')
         | list
       }}
-    kernel_cmdline_new: >-
+    _cmdline_new: >-
       {{
-        (kernel_cmdline_filtered + configuration_luks_kernel_args.split())
+        (_cmdline_filtered + configuration_luks_kernel_args.split())
         | unique
         | join(' ')
       }}
   ansible.builtin.set_fact:
-    configuration_kernel_cmdline_new: "{{ kernel_cmdline_new }}"
+    _dracut_kernel_cmdline: "{{ _cmdline_new }}"
 
 - name: Write kernel cmdline with LUKS args
   ansible.builtin.copy:
     dest: /mnt/etc/kernel/cmdline
     mode: "0644"
-    content: "{{ configuration_kernel_cmdline_new }}\n"
+    content: "{{ _dracut_kernel_cmdline }}\n"
 
+# --- BLS entries: RedHat-specific ---
 - name: Update BLS entries with LUKS kernel cmdline
+  when: os_family == 'RedHat'
   vars:
-    _bls_cmdline: "{{ configuration_kernel_cmdline_new }}"
+    _bls_cmdline: "{{ _dracut_kernel_cmdline }}"
   ansible.builtin.include_tasks: ../_bls_update.yml