roles/lmn_encrypt/tasks/tpm2.yml

@@ -32,7 +32,7 @@
     cmd: >
       systemd-run -P --wait
       -p SetCredential=cryptenroll.passphrase:{{ encrypt_passphrase | default(encrypt_passphrase_initial) }}
-      systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" {{ encrypt_device }} --wipe-slot=tpm2
+      systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 {{ encrypt_device }} --wipe-slot=tpm2
   no_log: true
   when: "'tpm2' not in encrypt_slots_result.stdout"
 

roles/lmn_kde/defaults/main.yml

@@ -3,7 +3,7 @@ kde_desktop_pkg:
   - akonadi-backend-sqlite
   - arduino
   - bluefish
-  # - calligra
+  - calligra
   - codeblocks
   - dia
   - filius

roles/lmn_tmpfixes/tasks/main.yml

@@ -24,11 +24,3 @@
     replace: 'GRUB_CMDLINE_LINUX="i915.force_probe=4909"'
   notify: Run update-grub
   when: ansible_board_vendor == "LENOVO" and ansible_board_name == "32CB"
-
-- name: Remove calligra
-  ansible.builtin.apt:
-    name:
-      - calligra
-    state: absent
-    purge: true
-    autoremove: true