disko: Enable Luks disk encryption

[vunnyso]

This patch creates luks filesystem which is encrypted and can be decrypted using Yubikey or system password.

Description of changes

Checklist for things done

• Summary of the proposed changes in the PR description
• More detailed description in the commit message(s)
• Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• PR linked to architecture documentation and requirement(s) (ticket id)
• Test procedure described (or includes tests). Select one or more:
  • Tested on Lenovo X1 x86_64
  • Tested on Jetson Orin NX or AGX aarch64
  • Tested on Polarfire riscv64
• Author has run nix flake check --accept-flake-config and it passes
• All automatic Github Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing

Please follow the below steps:

1. After fresh installation on first boot system will ask for Yubikey PIN:
   
2. After which need to tap Yubikey 2 times (Repeat steps 1 and 2 depending on how many devices need to encrypted)
3. System will automatically continue to boot up, please check in ghaf-host terminal you will see lvm block devices encrypted.

4. On Next boot user need to enter Yubikey PIN once + tap on Yubikey device (depending on devices to be decrypted).
   

Improvements

• For encryption depending on number of devices need to encrypted user need to enter Yubikey PIN each time + double tap the Yubikey.
• For decryption user need to enter Yubikey PIN once + tap once Yubikey for each device which need to be decrypted.
• More block devices can be added later.

[brianmcgillion]

I believe this has to be done in an installation phase? Either choose passwd or yubikey. Because rebuilding an image per installation is not really viable.

If full luks can't be done on the fly in the installer, can we prompt for a key rotation (i.e. force a password change on first boot, and give option for either passwd or yubikey)

Secondly, shouldn't the passwd,/yubikey be mixed with tpm on the device? Or does fido2luks do this behind the scene?

[vunnyso]

I believe this has to be done in an installation phase? Either choose passwd or yubikey. Because rebuilding an image per installation is not really viable.

If full luks can't be done on the fly in the installer, can we prompt for a key rotation (i.e. force a password change on first boot, and give option for either passwd or yubikey)

Secondly, shouldn't the passwd,/yubikey be mixed with tpm on the device? Or does fido2luks do this behind the scene?

Hi @remimimimimi can we do Luks encryption along with yubikey enrollment during installation phase?
Hi @TanelDettenborn can you please comment about tpm question?

[vunnyso]

Hi @Mic92 please help to review my commit b11ed1c.