From a7095408cdeb34db35a79ff7eb1b06ce6ebe12e2 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Wed, 8 Jul 2026 01:09:47 -0700
Subject: [PATCH] Add fido2 instructions.

---
 fido2.txt                                | 65 ++++++++++++++++++++++++
 hw/straylight/hardware-configuration.nix |  4 --
 2 files changed, 65 insertions(+), 4 deletions(-)
 create mode 100644 fido2.txt

diff --git a/fido2.txt b/fido2.txt
new file mode 100644
index 0000000..a2bd1eb
--- /dev/null
+++ b/fido2.txt
@@ -0,0 +1,65 @@
+Enrolling a FIDO2 key for LUKS unlock on straylight (systemd-cryptenroll method)
+=================================================================================
+
+Background
+----------
+NixOS 26.05 removed support for the old scripted-stage-1 option
+boot.initrd.luks.fido2Support. The supported method is systemd-cryptsetup:
+enroll the key directly into the LUKS2 header with systemd-cryptenroll, then
+tell the initrd to look for a FIDO2 token via crypttab options.
+
+straylight's encrypted devices:
+  root:  /dev/disk/by-uuid/922e2c13-35bc-40de-a829-716b9368e4a7  (luks-922e2c13-...)
+  home:  /dev/disk/by-uuid/edfdcdf4-083a-4826-a1f8-9670545e0bc5  (home-crypt)
+
+Steps
+-----
+1. Plug in the FIDO2 key, then enroll it in each LUKS device (you will be
+   prompted for an existing passphrase and the token PIN):
+
+     doas systemd-cryptenroll --fido2-device=auto /dev/disk/by-uuid/922e2c13-35bc-40de-a829-716b9368e4a7
+     doas systemd-cryptenroll --fido2-device=auto /dev/disk/by-uuid/edfdcdf4-083a-4826-a1f8-9670545e0bc5
+
+   Verify with:
+     doas systemd-cryptenroll /dev/disk/by-uuid/922e2c13-35bc-40de-a829-716b9368e4a7
+   (should list a "fido2" slot alongside the "password" slot)
+
+2. Update hw/straylight/hardware-configuration.nix to use systemd stage 1 and
+   point crypttab at the token (mirrors orion/vade):
+
+     boot.initrd.systemd.enable = true;
+
+     boot.initrd.luks.devices."luks-922e2c13-35bc-40de-a829-716b9368e4a7" = {
+       device = "/dev/disk/by-uuid/922e2c13-35bc-40de-a829-716b9368e4a7";
+       crypttabExtraOpts = [
+         "fido2-device=auto"
+         "token-timeout=10"
+       ];
+     };
+
+     boot.initrd.luks.devices."home-crypt" = {
+       device = "/dev/disk/by-uuid/edfdcdf4-083a-4826-a1f8-9670545e0bc5";
+       crypttabExtraOpts = [
+         "fido2-device=auto"
+         "token-timeout=10"
+       ];
+     };
+
+   token-timeout=10 makes boot fall back to a passphrase prompt after 10
+   seconds if the key is not plugged in.
+
+3. Rebuild and reboot to test:
+     rebuild-nixos
+
+   Keep the passphrase slot — do NOT remove it. It is the fallback if the
+   hardware key fails or is lost.
+
+Notes
+-----
+- If migrating from an old scripted-stage-1 enrollment (fido2luks), remove the
+  old key slot afterwards with `doas cryptsetup luksKillSlot <device> <slot>`;
+  straylight never had one enrolled, so this does not apply here.
+- References:
+    https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html
+    https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup.html
+    https://www.freedesktop.org/software/systemd/man/crypttab.html
diff --git a/hw/straylight/hardware-configuration.nix b/hw/straylight/hardware-configuration.nix
index d1e9dcf..cc6d0d1 100644
--- a/hw/straylight/hardware-configuration.nix
+++ b/hw/straylight/hardware-configuration.nix
@@ -11,12 +11,8 @@
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  boot.initrd.luks.fido2Support = true;
-
   boot.initrd.luks.devices."luks-922e2c13-35bc-40de-a829-716b9368e4a7" = {
     device = "/dev/disk/by-uuid/922e2c13-35bc-40de-a829-716b9368e4a7";
-    #fido2.credential = "<credential-hex-string>";
-    #fido2.passwordLess = true;
   };
 
   fileSystems."/" =