randogoth/nanuqsaurus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable secure boot via lanzaboote on installer ISO

Browse source
This commit is contained in:
randogoth 2026-02-01 20:06:55 +02:00
parent 906a668987
commit 4d0aef1c86
2 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/installer.nix
View file

@ -5,6 +5,7 @@
(inputs.nixpkgs + "/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix") (inputs.nixpkgs + "/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix")
inputs.lix-module.nixosModules.lixFromNixpkgs inputs.lix-module.nixosModules.lixFromNixpkgs
../modules/system/base.nix ../modules/system/base.nix
../modules/system/secure-boot.nix
../modules/users/admin.nix ../modules/users/admin.nix
]; ];

20
modules/system/secure-boot.nix Normal file
View file

@ -0,0 +1,20 @@
{ lib, ... }:
{
# Use Lanzaboote to build signed Unified Kernel Images and shim-compatible boot chain.
boot.lanzaboote = {
enable = true;
pkiBundle = {
name = "nanuqsaurus";
description = "Secure Boot keys for nanuqsaurus installer ISO";
};
};
# Ensure systemd-boot is not pulled in by other modules.
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.loader.efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot";
};
}