Disk encryption
The installer always encrypts the root partition with LUKS2.
- cipher
- aes-xts-plain64 · 512-bit key
- KDF
- argon2id
- keyslot 0
- passphrase (12+ chars, enforced by the installer)
- keyslot 1
- TPM2 — empty (opt-in: customos-tpm-enroll)
- /boot
- unencrypted ext4 — see §3.1 (signed UKI closes the initrd half)
Sample values. TPM2 sealing is offered on first login only when /dev/tpmrm0 exists; the passphrase is always kept as fallback.
SESSION LOCKED
lightdm Obsidian greeter · preview only
Auto-lock 5 min. This is a visual preview; it unlocks nothing.