48 lines
1.3 KiB
Nix
48 lines
1.3 KiB
Nix
|
{
|
||
|
|
description = "A SecureBoot-enabled NixOS configurations";
|
||
|
|
|
||
|
|
inputs = {
|
||
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||
|
|
|
||
|
|
lanzaboote = {
|
||
|
|
url = "github:nix-community/lanzaboote";
|
||
|
|
|
||
|
|
# Optional but recommended to limit the size of your system closure.
|
||
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
outputs = { self, nixpkgs, lanzaboote, ...}: {
|
||
|
|
nixosConfigurations = {
|
||
|
|
yourHost = nixpkgs.lib.nixosSystem {
|
||
|
|
system = "x86_64-linux";
|
||
|
|
|
||
|
|
modules = [
|
||
|
|
# This is not a complete NixOS configuration and you need to reference
|
||
|
|
# your normal configuration here.
|
||
|
|
|
||
|
|
lanzaboote.nixosModules.lanzaboote
|
||
|
|
|
||
|
|
({ pkgs, lib, ... }: {
|
||
|
|
|
||
|
|
environment.systemPackages = [
|
||
|
|
# For debugging and troubleshooting Secure Boot.
|
||
|
|
pkgs.sbctl
|
||
|
|
];
|
||
|
|
|
||
|
|
# Lanzaboote currently replaces the systemd-boot module.
|
||
|
|
# This setting is usually set to true in configuration.nix
|
||
|
|
# generated at installation time. So we force it to false
|
||
|
|
# for now.
|
||
|
|
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||
|
|
|
||
|
|
boot.lanzaboote = {
|
||
|
|
enable = true;
|
||
|
|
pkiBundle = "/etc/secureboot";
|
||
|
|
};
|
||
|
|
})
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|