try: help

guest@bastion:~/docs/linux/tpm2-fde-enrollment$ man linux/tpm2-fde-enrollment

TPM2-FDE-ENROLLMENT(7)Simon Cornet's docsTPM2-FDE-ENROLLMENT(7)

Use TPM2 for automatic FDE unlocking

Prerequisite #

The disk is already encrypted using LUKS.
A passphrase is required for unlocking the partition.
The package tpm2-tools is available.

Enroll TPM2 using systemd #

Find the encrypted partition using lsblk

# lbslk
...
└─nvme0n1p3                 259:3    0   1.8T  0 part
  └─dm_crypt-0              252:0    0   1.8T  0 crypt
...

# systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/nvme0n1p3
🔐 Please enter current passphrase for disk /dev/nvme0n1p3: ••••••••••••••••••••••••••••••••

Update /etc/crypttab #

- dm_crypt-0 UUID=12345678-1234-5678-1234-abcdefg12345 none luks
+ dm_crypt-0 UUID=12345678-1234-5678-1234-abcdefg12345 none luks,tpm2-device=auto

update-initramfs -u

Reboot #

linux80 wordsTPM2-FDE-ENROLLMENT(7)