Add Aegis TPM-backed btrfs storage

Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com>

ansible/bootstrap/aegis.bu

@@ -1,5 +1,5 @@
 # Bootstrap monouso per Fedora CoreOS su Aegis.
-# Sostituire la chiave SSH prima di generare Ignition con butane --strict.
+# Sostituire le chiavi SSH prima di generare Ignition con butane --strict.
 variant: fcos
 version: 1.6.0
 passwd:
@@ -7,10 +7,83 @@ passwd:
     - name: core
       ssh_authorized_keys:
         - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
+    - name: pi
+      ssh_authorized_keys:
+        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
 storage:
+  disks:
+    - device: /dev/mmcblk0
+      wipe_table: false
+      partitions:
+        - label: aegis-data
+          number: 5
+          size_mib: 0
   files:
     - path: /etc/hostname
       mode: 0644
       contents:
         inline: |
           aegis
+    - path: /etc/crypttab
+      mode: 0644
+      contents:
+        inline: |
+          aegis-data /dev/disk/by-partlabel/aegis-data - tpm2-device=auto
+    - path: /etc/fstab
+      mode: 0644
+      contents:
+        inline: |
+          /dev/mapper/aegis-data /var/lib btrfs defaults,compress=zstd 0 0
+    - path: /usr/local/sbin/aegis-storage-init
+      mode: 0750
+      user:
+        name: root
+      group:
+        name: root
+      contents:
+        inline: |
+          #!/bin/bash
+          set -euo pipefail
+
+          device=/dev/disk/by-partlabel/aegis-data
+          mapper=aegis-data
+          key_file=/run/aegis-storage/key
+          marker=/etc/aegis-storage.initialized
+
+          if [[ -e "$marker" ]]; then
+            exit 0
+          fi
+
+          trap 'rm -f "$key_file"' EXIT
+          install -d -m 0700 /run/aegis-storage
+          dd if=/dev/urandom of="$key_file" bs=64 count=1 status=none
+          chmod 0600 "$key_file"
+
+          cryptsetup luksFormat --batch-mode --type luks2 --key-file="$key_file" "$device"
+          systemd-cryptenroll --tpm2-device=auto --unlock-key-file="$key_file" "$device"
+          cryptsetup open --key-file="$key_file" "$device" "$mapper"
+          mkfs.btrfs -L aegis-data "/dev/mapper/$mapper"
+          mount "/dev/mapper/$mapper" /var/lib
+          touch "$marker"
+
+    - path: /etc/systemd/system/aegis-storage-init.service
+      mode: 0644
+      contents:
+        inline: |
+          [Unit]
+          Description=Initialize the TPM-backed Aegis data volume
+          Wants=systemd-udev-settle.service
+          After=systemd-udev-settle.service
+          Before=local-fs.target
+          ConditionPathExists=!/etc/aegis-storage.initialized
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/local/sbin/aegis-storage-init
+
+          [Install]
+          WantedBy=local-fs-pre.target
+  systemd:
+    units:
+      - name: aegis-storage-init.service
+        enabled: true