Commit 4e31a75b368c

@@ -243,7 +243,38 @@ setup_tpm() {
 	fi
 }
 
-# --- Phase 5: lid-close behavior (systemd-logind) ---
+# --- Phase 5: LUKS FIDO2 (YubiKey) ---
+
+setup_luks_fido2() {
+	local luks_dev
+	luks_dev=$(blkid -t TYPE=crypto_LUKS -o device 2>/dev/null | head -1)
+
+	if [[ -z "$luks_dev" ]]; then
+		log_warn "No LUKS device found; skipping FIDO2 enrollment"
+		return 0
+	fi
+
+	log_info "Found LUKS device: $luks_dev"
+
+	# Check if FIDO2 is already enrolled
+	if sudo systemd-cryptenroll "$luks_dev" --fido2-device=list 2>/dev/null | grep -q 'fido2'; then
+		log_info "FIDO2 already available"
+	else
+		log_warn "No FIDO2 device detected. Plug in YubiKey, then run:"
+		log_warn "  sudo systemd-cryptenroll $luks_dev --fido2-device=auto --fido2-with-client-pin=no"
+	fi
+
+	# Ensure dracut includes fido2 support in initramfs
+	if ! lsinitrd 2>/dev/null | grep -q fido2; then
+		log_info "Adding fido2 support to initramfs..."
+		sudo dracut --add fido2 -f
+		log_info "Initramfs rebuilt with fido2 support"
+	else
+		log_info "Initramfs already has fido2 support"
+	fi
+}
+
+# --- Phase 5b: lid-close behavior (systemd-logind) ---
 
 setup_lid() {
 	# Under niri there is no gnome-settings-daemon power plugin, so lid handling
@@ -472,6 +503,7 @@ main() {
 	setup_selinux_policy
 	install_native_apps
 	setup_tpm
+	setup_luks_fido2
 	setup_lid
 	setup_unscd
 	build_and_activate

@@ -242,7 +242,38 @@ setup_tpm() {
 	fi
 }
 
-# --- Phase 7: unscd for nix NSS resolution ---
+# --- Phase 7: LUKS FIDO2 (YubiKey) ---
+
+setup_luks_fido2() {
+	local luks_dev
+	luks_dev=$(blkid -t TYPE=crypto_LUKS -o device 2>/dev/null | head -1)
+
+	if [[ -z "$luks_dev" ]]; then
+		log_warn "No LUKS device found; skipping FIDO2 enrollment"
+		return 0
+	fi
+
+	log_info "Found LUKS device: $luks_dev"
+
+	# Check if FIDO2 is already enrolled
+	if sudo systemd-cryptenroll "$luks_dev" --fido2-device=list 2>/dev/null | grep -q 'fido2'; then
+		log_info "FIDO2 already available"
+	else
+		log_warn "No FIDO2 device detected. Plug in YubiKey, then run:"
+		log_warn "  sudo systemd-cryptenroll $luks_dev --fido2-device=auto --fido2-with-client-pin=no"
+	fi
+
+	# Ensure dracut includes fido2 support in initramfs
+	if ! lsinitrd 2>/dev/null | grep -q fido2; then
+		log_info "Adding fido2 support to initramfs..."
+		sudo dracut --add fido2 -f
+		log_info "Initramfs rebuilt with fido2 support"
+	else
+		log_info "Initramfs already has fido2 support"
+	fi
+}
+
+# --- Phase 8: unscd for nix NSS resolution ---
 
 setup_unscd() {
 	# Nix glibc can't load system NSS modules (libnss_sss.so) so nix programs
@@ -392,6 +423,7 @@ main() {
 	setup_selinux_policy
 	install_native_apps
 	setup_tpm
+	setup_luks_fido2
 	setup_unscd
 	setup_system_configs
 	setup_wireguard