sandwich/Ansible-Bootstrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(cleanup): enroll Secure Boot keys in VM NVRAM after OS installation

Browse Source
This commit is contained in:
sandwich
2026-04-02 07:22:53 +02:00
committed by MORAWSKI Norbert
parent b31a5a2580
commit ce79728744
3 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
roles/configuration/tasks/encryption.yml
View File

@@ -20,11 +20,16 @@
| regex_replace('\\s+', '')
| regex_replace('^\\+|\\+$', '')
}}
_sb_pcr7_safe: >-
{{
system_cfg.features.secure_boot.enabled | bool
and system_cfg.type | default('virtual') != 'virtual'
}}
luks_tpm2_pcrs: >-
{{
_raw_pcrs
if _raw_pcrs | length > 0
else ('7' if (system_cfg.features.secure_boot.enabled | bool) else '')
else ('7' if (_sb_pcr7_safe | bool) else '')
}}
ansible.builtin.set_fact:
configuration_luks_mapper_name: "{{ system_cfg.luks.mapper }}"