Had to secure a mobile workstation against data theft in case I loose my device.
Test unlocking with enrolled key
cryptsetup luksOpen --test-passphrase --token-only /dev/<device>Listing luks header (includes key&token entries)
cryptsetup luksDump /dev/<device>Adding FIDO Key to existing luks device
systemd-cryptenroll --fido2-with-client-pin=yes --fido2-device=auto /dev/<device>https://unix.stackexchange.com/questions/577379/how-can-i-install-debian-with-full-disk-encryption-and-a-custom-sized-swapfile (Archive)
https://debianforum.de/forum/viewtopic.php?t=177435 (Archive)
https://www.blakecarpenter.dev/installing-debian-on-existing-encrypted-lvm/ (Archive)
https://www.reddit.com/r/debian/comments/hhvucx/comment/fwck8pq/ (Archive)
https://www.reddit.com/r/debian/comments/10rh1on/do_i_have_to_put_bootefi_outside_the_encrypted_lvm/ (Archive)
https://gist.github.com/luispabon/db2c9e5f6cc73bb37812a19a40e137bc ([Archive(https://web.archive.org/web/20240214143258/https://gist.github.com/luispabon/db2c9e5f6cc73bb37812a19a40e137bc))
https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/ (Archive)
https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html (Archive)
https://wiki.archlinux.org/title/Resizing_LVM-on-LUKS (Archive)
https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html (Archive)
https://www.guyrutenberg.com/2022/02/17/unlock-luks-volume-with-a-yubikey/ (Archive)
https://discussion.fedoraproject.org/t/unlock-luks-with-fido2-token/66323 (Archive)
https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/ (Archive)