documentation/docs/alpine-desktop-setup/post-install/automatic-decryption.md

# Automatic decryption

TPM can be used to automatically decrypt the root partition. This can be done because the bootchain is secure and it is tedious to enter an encryption password everytime the system boots up.

Both `clevis` and `tpm2-tools` will be used and can be installed with `nix` by

```
$ nix-env -iA nixpkgs.clevis
$ nix-env -iA nixpkgs.tpm2-tools
```

This allows for the binding of the luks encrypted root partition to TPM with clevis:

```
# clevis luks bind -d /dev/<disk2> tpm2 '{"pcr_bank":"sha256","pcr_ids":"0,1,5,7"}'
```

After rebooting it should automatically decrypt the disk.

Clevis can be evoked again if automatic decryption has been disabled due to changes to secureboot or the system. 

First find the keyslot `clevis` is using and then regenerate the key by:

```
# cryptsetup luksDump /dev/<disk2>
# clevis luks regen -d /dev/<disk2> -s <keyslot>
```

If done correctly it should work again.