ItsDrike/nixdots
1
0
Fork 0
mirror of https://github.com/ItsDrike/nixdots synced 2025-06-29 18:10:41 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add secure-boot

Browse source
This commit is contained in:
ItsDrike 2024-04-12 18:25:26 +02:00
parent fa6f2b49db
commit cb968bdc07
Signed by: ItsDrike
GPG key ID: FA2745890B7048C0
12 changed files with 459 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
system/boot/default.nix
View file

@ -1,5 +1,6 @@
_: {
imports = [
./systemd-boot.nix
./secure-boot.nix
];
}

23
system/boot/secure-boot.nix Normal file
View file

@ -0,0 +1,23 @@
{ config, pkgs, lib, ... }: let
inherit (lib) mkIf;
cfg = config.myOptions.system.secure-boot;
in {
config = mkIf cfg.enabled {
# Secure Boot Key Manager
environment.systemPackages = [ pkgs.sbctl ];
# Persist the secure boot keys (for impermanence)
myOptions.system.impermanence.root.extraDirectories = [
"/etc/secureboot"
];
# Lanzaboote replaces systemd-boot
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
};
}