fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-09-27 19:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add Aegis TPM-backed btrfs storage

Browse Source 
Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-09-03 22:43:54 +00:00
committed by GitHub
parent cb88e95385
commit 54e1e88a4e
2 changed files with 80 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@@ -117,12 +117,17 @@ ansible-playbook ansible/site.yml --limit prometheus \
## Aegis
`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Provision it once with
`ansible/bootstrap/aegis.bu`, after replacing the SSH public-key placeholder:
`ansible/bootstrap/aegis.bu`, after replacing the SSH public-key placeholders:
```bash
butane --strict --pretty --output aegis.ign ansible/bootstrap/aegis.bu
```
The bootstrap reserves partition 5 on `/dev/mmcblk0` for `/var/lib`. On the first boot it
generates a random LUKS2 key, enrolls it in the attached TPM2 device, and formats the unlocked
volume as btrfs. This is destructive for that partition and requires a TPM2 module/device; a
Raspberry Pi 4 has no TPM onboard. The `core` and `pi` users both receive the configured SSH key.
The controller then manages it remotely as `core@aegis`; unlike local desktop profiles, Aegis is
intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, and