From 332b5133ce0ca0f2196b4d635e92e895e16c132a Mon Sep 17 00:00:00 2001 From: randogoth Date: Sun, 1 Feb 2026 20:12:00 +0200 Subject: [PATCH] Add optional secure boot module and docs --- docs/secure-boot.md | 19 ++++++ flake.lock | 121 +++++++++++++++++++++++++++++++++ flake.nix | 2 + modules/system/secure-boot.nix | 23 +++++++ 4 files changed, 165 insertions(+) create mode 100644 docs/secure-boot.md create mode 100644 modules/system/secure-boot.nix diff --git a/docs/secure-boot.md b/docs/secure-boot.md new file mode 100644 index 0000000..92eb58d --- /dev/null +++ b/docs/secure-boot.md @@ -0,0 +1,19 @@ +# Secure Boot after installing + +The installer ISO still requires Secure Boot *off* to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote. + +Steps (per host): + +1) In `flake.nix` inputs, keep `lanzaboote.url = "github:nix-community/lanzaboote";` (already present). +2) In your host module (e.g. `hosts/.nix`), add imports: + - `inputs.lanzaboote.nixosModules.lanzaboote` + - `../modules/system/secure-boot.nix` +3) Rebuild on the target system (with Secure Boot still disabled): + `sudo nixos-rebuild switch --flake .#` +4) Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot. +5) Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI. + +Notes +- Keys are stored at `/var/lib/secureboot` (persist this if you use impermanence). +- Microsoft keys are included for compatibility; adjust in `secure-boot.nix` if you want fully custom trust. +- If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings. diff --git a/flake.lock b/flake.lock index 9d9adbb..72073bf 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,36 @@ { "nodes": { + "crane": { + "locked": { + "lastModified": 1769287525, + "narHash": "sha256-gABuYA6BzoRMLuPaeO5p7SLrpd4qExgkwEmYaYQY4bM=", + "owner": "ipetkov", + "repo": "crane", + "rev": "0314e365877a85c9e5758f9ea77a9972afbb4c21", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "NixOS", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "flake-compat", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -33,6 +64,51 @@ "type": "github" } }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit": "pre-commit", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1769949118, + "narHash": "sha256-Ue9kYZenqMw9yHGFnBpoWxQqhs2tlH/el4AxKVicXBE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "0be0641613a13323a61a6406c46b6f28b8894395", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "lanzaboote", + "type": "github" + } + }, "lix": { "flake": false, "locked": { @@ -87,12 +163,57 @@ "type": "github" } }, + "pre-commit": { + "inputs": { + "flake-compat": "flake-compat", + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1769069492, + "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "root": { "inputs": { + "lanzaboote": "lanzaboote", "lix-module": "lix-module", "nixpkgs": "nixpkgs" } }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1769309768, + "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, diff --git a/flake.nix b/flake.nix index fe39301..3423fd1 100644 --- a/flake.nix +++ b/flake.nix @@ -5,6 +5,8 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; lix-module.url = "git+https://git.lix.systems/lix-project/nixos-module?ref=release-2.93"; lix-module.inputs.nixpkgs.follows = "nixpkgs"; + lanzaboote.url = "github:nix-community/lanzaboote"; + lanzaboote.inputs.nixpkgs.follows = "nixpkgs"; }; outputs = inputs@{ self, nixpkgs, ... }: diff --git a/modules/system/secure-boot.nix b/modules/system/secure-boot.nix new file mode 100644 index 0000000..11c59a7 --- /dev/null +++ b/modules/system/secure-boot.nix @@ -0,0 +1,23 @@ +{ lib, ... }: + +{ + # Requires: import `inputs.lanzaboote.nixosModules.lanzaboote` alongside this module. + # Purpose: post-install Secure Boot enablement with self-managed keys. + + boot.loader.systemd-boot.enable = lib.mkForce false; + boot.loader.efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + + boot.lanzaboote = { + enable = true; + pkiBundle = "/var/lib/secureboot"; # persistent location (not in the Nix store) + autoGenerateKeys.enable = true; + autoEnrollKeys = { + enable = true; + includeMicrosoftKeys = true; # keeps Windows/option-ROM compatibility + autoReboot = false; + }; + }; +}