19 lines
1 KiB
Markdown
19 lines
1 KiB
Markdown
# Secure Boot after installing
|
||
|
||
The installer ISO still requires Secure Boot *off* to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote.
|
||
|
||
Steps (per host):
|
||
|
||
1) In `flake.nix` inputs, keep `lanzaboote.url = "github:nix-community/lanzaboote";` (already present).
|
||
2) In your host module (e.g. `hosts/<hostname>.nix`), add imports:
|
||
- `inputs.lanzaboote.nixosModules.lanzaboote`
|
||
- `../modules/system/secure-boot.nix`
|
||
3) Rebuild on the target system (with Secure Boot still disabled):
|
||
`sudo nixos-rebuild switch --flake .#<hostname>`
|
||
4) Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot.
|
||
5) Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI.
|
||
|
||
Notes
|
||
- Keys are stored at `/var/lib/secureboot` (persist this if you use impermanence).
|
||
- Microsoft keys are included for compatibility; adjust in `secure-boot.nix` if you want fully custom trust.
|
||
- If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings.
|