Skip to content
This repository was archived by the owner on Feb 13, 2026. It is now read-only.

Commit f175650

Browse files
pixincreatepixincreate
committed
refactor: speed up fedora system by enabling auto unlock luks with tpm2 and reducing grub timeout to 1 second
1 parent aae8799 commit f175650

File tree

3 files changed

+151
-2
lines changed

3 files changed

+151
-2
lines changed

‎unix/fedora/config.json‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,10 @@
6161
"redis.service",
6262
"tailscaled.service"
6363
],
64-
"disable": ["NetworkManager-wait-online.service"]
64+
"disable": [
65+
"cups.service",
66+
"NetworkManager-wait-online.service"
67+
]
6568
},
6669
"hardware": {
6770
"asus": {
@@ -82,7 +85,10 @@
8285
"zram_size_mb": 24576,
8386
"disable_cpu_mitigations": false,
8487
"enable_fstrim": true,
85-
"enable_oomd": true
88+
"enable_oomd": true,
89+
"grub_timeout": 1,
90+
"auto_luks": true
91+
8692
},
8793
"git": {
8894
"user_name": "PiX",

‎unix/fedora/install/config/performance.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,4 +70,51 @@ if [[ "$disable_mitigations" == "true" ]]; then
7070
fi
7171
fi
7272

73+
# Reduce grub timeout
74+
grub_timeout=$(get_config '.performance.grub_timeout')
75+
76+
# If grub_timeout is a valid integer
77+
if [[ -v grub_timeout && "$grub_timeout" =~ ^[0-9]+$ ]]; then
78+
log_warning "Reducing GRUB timeout to 1 second"
79+
80+
if confirm "This will reduce GRUB timeout. Continue?"; then
81+
if [ -f /etc/default/grub ] && sudo sed -i.bak "s/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=$grub_timeout/" /etc/default/grub; then
82+
grub_cfg=$( [ -d /boot/grub2 ] && echo "/boot/grub2/grub.cfg" || echo "/boot/grub/grub.cfg" )
83+
84+
if [ -n "$grub_cfg" ] && sudo grub2-mkconfig -o "$grub_cfg"; then
85+
log_success "GRUB timeout reduced to 1 second"
86+
else
87+
log_warning "Failed to update GRUB configuration"
88+
fi
89+
else
90+
log_warning "Failed to modify /etc/default/grub or file not found"
91+
fi
92+
else
93+
log_warning "Operation cancelled by user"
94+
fi
95+
else
96+
log_warning "grub_timeout is not set or not a valid integer"
97+
fi
98+
99+
# Do not ask user to enter the LUKS password
100+
auto_luks=$(get_config '.performance.auto_luks')
101+
102+
if [[ "$auto_luks" == "true" ]]; then
103+
log_warning "Setting up TPM2 auto-unlock for LUKS"
104+
105+
if confirm "This will reduce security. Continue?"; then
106+
LUKS_DEVICE=$(lsblk -nlo NAME,FSTYPE | grep crypto_LUKS | awk '{print "/dev/"$1}')
107+
108+
if [ -n "$LUKS_DEVICE" ]; then
109+
log_info "TPM2 device found, enrolling..."
110+
111+
sudo systemd-cryptenroll "$LUKS_DEVICE" --tpm2-device=auto --tpm2-pcrs=0+1+7
112+
sudo dracut -f
113+
114+
log_info "To rollback tpm2 auto-unlock, execute:\nsudo system-cryptenroll $LUKS_DEVICE --wipe-slot=tpm2\nsudo dracut -f"
115+
fi
116+
117+
fi
118+
fi
119+
73120
log_success "Performance optimizations applied"

‎unix/fedora/migrations/1760812842.sh‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash
2+
# Migration: Set up LUKS Auto Unlock and reduce GRUB timeout to 1 second
3+
4+
echo "Running migration: Set up LUKS Auto Unlock and reduce GRUB timeout to 1 second"
5+
6+
confirm() {
7+
read -p "$1 [y/N]: " response
8+
[[ "$response" =~ ^[Yy]$ ]]
9+
}
10+
11+
echo ""
12+
echo "[1/3] Reducing GRUB timeout..."
13+
14+
if [[ -f /etc/default/grub ]]; then
15+
if confirm "This will reduce GRUB timeout to 1 second. Continue?"; then
16+
17+
sudo cp /etc/default/grub /etc/default/grub.bak
18+
sudo sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=1/' /etc/default/grub
19+
20+
if [[ -d /boot/grub2 ]]; then
21+
grub_cfg="/boot/grub2/grub.cfg"
22+
else
23+
grub_cfg="/boot/grub/grub.cfg"
24+
fi
25+
26+
if sudo grub2-mkconfig -o "$grub_cfg"; then
27+
echo "GRUB timeout reduced to 1 second"
28+
else
29+
echo "Failed to update GRUB configuration"
30+
fi
31+
else
32+
echo "Skipped GRUB timeout modification"
33+
fi
34+
else
35+
echo "/etc/default/grub not found, skipping"
36+
fi
37+
38+
echo ""
39+
echo "[2/3] Setting up TPM2 auto-unlock for LUKS..."
40+
41+
LUKS_DEVICE=$(lsblk -nlo NAME,FSTYPE | grep crypto_LUKS | awk '{print "/dev/"$1}')
42+
43+
if [[ -z "$LUKS_DEVICE" ]]; then
44+
echo "No LUKS device found, skipping TPM2 setup"
45+
elif [[ ! -e /dev/tpm0 ]]; then
46+
echo "TPM2 device not found, skipping"
47+
else
48+
echo "Found LUKS device: $LUKS_DEVICE"
49+
echo "⚠ WARNING: This reduces security by auto-unlocking your encrypted drive"
50+
echo " The drive will only unlock on this specific hardware with Secure Boot"
51+
52+
if confirm "Continue with TPM2 enrollment?"; then
53+
echo "You will be asked for your LUKS passphrase..."
54+
55+
if sudo systemd-cryptenroll "$LUKS_DEVICE" --tpm2-device=auto --tpm2-pcrs=0+1+7; then
56+
echo "TPM2 enrollment successful"
57+
58+
echo "Rebuilding initramfs..."
59+
if sudo dracut -f; then
60+
echo "Initramfs rebuilt"
61+
else
62+
echo "Failed to rebuild initramfs"
63+
fi
64+
65+
echo ""
66+
echo "To rollback TPM2 auto-unlock, run:"
67+
echo " sudo systemd-cryptenroll $LUKS_DEVICE --wipe-slot=tpm2"
68+
echo " sudo dracut -f"
69+
else
70+
echo "TPM2 enrollment failed"
71+
fi
72+
else
73+
echo "Skipped TPM2 enrollment"
74+
fi
75+
fi
76+
77+
78+
echo ""
79+
echo "[3/3] Disabling CUPS service..."
80+
81+
service="cups.service"
82+
if ! systemctl list-unit-files "$service" &>/dev/null; then
83+
echo "Service not available: $service"
84+
continue
85+
fi
86+
87+
if systemctl is-enabled "$service" &>/dev/null; then
88+
echo "Disabling service: $service"
89+
sudo systemctl disable "$service" 2>/dev/null || echo "Failed to disable: $service"
90+
else
91+
echo "Service already disabled: $service"
92+
fi
93+
94+
echo ""
95+
echo "Migration completed: LUKS Auto Unlock and GRUB timeout optimization"
96+
echo "Changes will take effect after reboot"

0 commit comments

Comments
 (0)