20 lines
1 KiB
Markdown
20 lines
1 KiB
Markdown
|
# Secure Boot after installing
|
|||
|
|
|
|||
|
|
The installer ISO still requires Secure Boot *off* to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote.
|
|||
|
|
|
|||
|
|
Steps (per host):
|
|||
|
|
|
|||
|
|
1) In `flake.nix` inputs, keep `lanzaboote.url = "github:nix-community/lanzaboote";` (already present).
|
|||
|
|
2) In your host module (e.g. `hosts/<hostname>.nix`), add imports:
|
|||
|
|
- `inputs.lanzaboote.nixosModules.lanzaboote`
|
|||
|
|
- `../modules/system/secure-boot.nix`
|
|||
|
|
3) Rebuild on the target system (with Secure Boot still disabled):
|
|||
|
|
`sudo nixos-rebuild switch --flake .#<hostname>`
|
|||
|
|
4) Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot.
|
|||
|
|
5) Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI.
|
|||
|
|
|
|||
|
|
Notes
|
|||
|
|
- Keys are stored at `/var/lib/secureboot` (persist this if you use impermanence).
|
|||
|
|
- Microsoft keys are included for compatibility; adjust in `secure-boot.nix` if you want fully custom trust.
|
|||
|
|
- If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings.
|