99 lines
4.0 KiB
YAML
99 lines
4.0 KiB
YAML
---
|
|
# Resolve initramfs generator and TPM2 unlock method.
|
|
# Sets _initramfs_generator and _tpm2_method facts.
|
|
#
|
|
# Generator detection: derived from the platform's initramfs_cmd
|
|
# (dracut → dracut, mkinitcpio → mkinitcpio, else → initramfs-tools)
|
|
# TPM2 method: systemd-cryptenroll when generator supports tpm2-device,
|
|
# clevis fallback otherwise. Non-native dracut installed automatically.
|
|
|
|
- name: Resolve initramfs generator
|
|
vars:
|
|
_user_generator: "{{ system_cfg.features.initramfs.generator | default('') }}"
|
|
_native_generator: >-
|
|
{{
|
|
'dracut' if _configuration_platform.initramfs_cmd is search('dracut')
|
|
else ('mkinitcpio' if _configuration_platform.initramfs_cmd is search('mkinitcpio')
|
|
else 'initramfs-tools')
|
|
}}
|
|
ansible.builtin.set_fact:
|
|
_initramfs_generator: >-
|
|
{{ _user_generator if _user_generator | length > 0 else _native_generator }}
|
|
_initramfs_native_generator: "{{ _native_generator }}"
|
|
|
|
# --- Install non-native dracut if overridden or needed ---
|
|
- name: Install dracut in chroot when not native
|
|
when:
|
|
- _initramfs_generator == 'dracut'
|
|
- _initramfs_native_generator != 'dracut'
|
|
ansible.builtin.shell: >-
|
|
{{ chroot_command }} sh -c '
|
|
command -v apt >/dev/null 2>&1 && apt install -y dracut ||
|
|
command -v pacman >/dev/null 2>&1 && pacman -S --noconfirm dracut ||
|
|
command -v dnf >/dev/null 2>&1 && dnf install -y dracut
|
|
'
|
|
register: _dracut_install_result
|
|
changed_when: _dracut_install_result.rc == 0
|
|
failed_when: false
|
|
|
|
- name: Override initramfs command to dracut
|
|
when:
|
|
- _initramfs_generator == 'dracut'
|
|
- _initramfs_native_generator != 'dracut'
|
|
vars:
|
|
# Generate dracut initramfs with output name matching what GRUB expects:
|
|
# mkinitcpio native: /boot/initramfs-linux.img (Arch convention)
|
|
# initramfs-tools native: /boot/initrd.img-<kver> (Debian convention)
|
|
_dracut_cmd: >-
|
|
{{
|
|
'bash -c "for kver in /lib/modules/*/; do kver=$(basename $kver); dracut --force /boot/initramfs-linux.img $kver; done"'
|
|
if _initramfs_native_generator == 'mkinitcpio'
|
|
else 'bash -c "for kver in /lib/modules/*/; do kver=$(basename $kver); dracut --force /boot/initrd.img-$kver $kver; done"'
|
|
}}
|
|
ansible.builtin.set_fact:
|
|
_configuration_platform: >-
|
|
{{ _configuration_platform | combine({'initramfs_cmd': _dracut_cmd}) }}
|
|
|
|
# --- TPM2 method detection ---
|
|
- name: Probe dracut for TPM2 module support
|
|
when:
|
|
- configuration_luks_auto_method == 'tpm2'
|
|
- _initramfs_generator != 'mkinitcpio'
|
|
ansible.builtin.command: "{{ chroot_command }} dracut --list-modules"
|
|
register: _dracut_modules_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Resolve TPM2 unlock method
|
|
when: configuration_luks_auto_method == 'tpm2'
|
|
vars:
|
|
# mkinitcpio sd-encrypt supports tpm2-device natively
|
|
# dracut with tpm2-tss module supports tpm2-device natively
|
|
# everything else needs clevis
|
|
_supports_tpm2_native: >-
|
|
{{
|
|
_initramfs_generator == 'mkinitcpio'
|
|
or ('tpm2-tss' in (_dracut_modules_check.stdout | default('')))
|
|
}}
|
|
ansible.builtin.set_fact:
|
|
_tpm2_method: "{{ 'systemd-cryptenroll' if _supports_tpm2_native | bool else 'clevis' }}"
|
|
|
|
# --- Auto-upgrade to dracut when tpm2-tss available but generator isn't dracut ---
|
|
- name: Switch to dracut for TPM2 support
|
|
when:
|
|
- configuration_luks_auto_method == 'tpm2'
|
|
- _tpm2_method == 'systemd-cryptenroll'
|
|
- _initramfs_generator not in ['dracut', 'mkinitcpio']
|
|
vars:
|
|
_dracut_cmd: >-
|
|
bash -c "for kver in /lib/modules/*/; do kver=$(basename $kver); dracut --force /boot/initrd.img-$kver $kver; done"
|
|
ansible.builtin.set_fact:
|
|
_initramfs_generator: dracut
|
|
_configuration_platform: >-
|
|
{{ _configuration_platform | combine({'initramfs_cmd': _dracut_cmd}) }}
|
|
|
|
- name: Report TPM2 configuration
|
|
when: configuration_luks_auto_method == 'tpm2'
|
|
ansible.builtin.debug:
|
|
msg: "TPM2 unlock: {{ _tpm2_method | default('none') }} | initramfs: {{ _initramfs_generator }}"
|