23 lines
648 B
Nix
23 lines
648 B
Nix
{ lib, ... }:
|
|
|
|
{
|
|
# Requires: import `inputs.lanzaboote.nixosModules.lanzaboote` alongside this module.
|
|
# Purpose: post-install Secure Boot enablement with self-managed keys.
|
|
|
|
boot.loader.systemd-boot.enable = lib.mkForce false;
|
|
boot.loader.efi = {
|
|
canTouchEfiVariables = true;
|
|
efiSysMountPoint = "/boot";
|
|
};
|
|
|
|
boot.lanzaboote = {
|
|
enable = true;
|
|
pkiBundle = "/var/lib/secureboot"; # persistent location (not in the Nix store)
|
|
autoGenerateKeys.enable = true;
|
|
autoEnrollKeys = {
|
|
enable = true;
|
|
includeMicrosoftKeys = true; # keeps Windows/option-ROM compatibility
|
|
autoReboot = false;
|
|
};
|
|
};
|
|
}
|