/tech/ - Soyence and Technology

Good evening everyone,
Is there any wizard here willing to walk me through setting up a Debian install with the following:
1.Plain disk-encrypted root
2.USB boot key(s):
•One for the UKI
•One to store the first half of the encryption password
3.Kernel signed with my own key
4.Extract hashes from TPM for Secure Boot using my own PK + db
5.Prepare cert files (cut to fit UEFI limits)
6.Create + sign UKI
7.Add a script that:
•Prompts for + creates the full passphrase at boot
•First half = stored on USB
•Second half = PIN/passphrase entered at boot

I’ve done all of these steps individually in the past, but never combined them into one setup.
Also dealing with some mental fatigue rn so struggling to organize it all.

Would appreciate help from someone experienced—not just command dumps, but going through the whole idea properly.