24 lines
648 B
Nix
24 lines
648 B
Nix
|
{ lib, ... }:
|
||
|
|
|
||
|
|
{
|
||
|
|
# Requires: import `inputs.lanzaboote.nixosModules.lanzaboote` alongside this module.
|
||
|
|
# Purpose: post-install Secure Boot enablement with self-managed keys.
|
||
|
|
|
||
|
|
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||
|
|
boot.loader.efi = {
|
||
|
|
canTouchEfiVariables = true;
|
||
|
|
efiSysMountPoint = "/boot";
|
||
|
|
};
|
||
|
|
|
||
|
|
boot.lanzaboote = {
|
||
|
|
enable = true;
|
||
|
|
pkiBundle = "/var/lib/secureboot"; # persistent location (not in the Nix store)
|
||
|
|
autoGenerateKeys.enable = true;
|
||
|
|
autoEnrollKeys = {
|
||
|
|
enable = true;
|
||
|
|
includeMicrosoftKeys = true; # keeps Windows/option-ROM compatibility
|
||
|
|
autoReboot = false;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|