nixdots/system/boot/secure-boot.nix

24 lines
558 B
Nix
Raw Normal View History

2024-04-12 16:25:26 +00:00
{ config, pkgs, lib, ... }: let
inherit (lib) mkIf;
2024-04-12 18:57:52 +00:00
cfg = config.myOptions.system.boot.secure-boot;
2024-04-12 16:25:26 +00:00
in {
2024-04-12 18:57:52 +00:00
config = mkIf cfg.enable {
2024-04-12 16:25:26 +00:00
# Secure Boot Key Manager
environment.systemPackages = [ pkgs.sbctl ];
# Persist the secure boot keys (for impermanence)
myOptions.system.impermanence.root.extraDirectories = [
"/etc/secureboot"
];
# Lanzaboote replaces systemd-boot
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
};
}