Caution
If you are here looking to learn more about Nix and or get started with Nixos, Please use these resources instead, [ official wiki, nix.dev, noggle.dev ]
desktop
server
laptop
enroll tpm2 to root crypt, this could be done properly with lanzaboote's measured boot options, but its not very reliable in my experience.
sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=4+7+8+9 /dev/<root uuid>