randogoth/nanuqsaurus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
nanuqsaurus/docs/secure-boot.md
randogoth 332b5133ce Add optional secure boot module and docs
2026-02-01 20:12:00 +02:00

1 KiB
Raw Blame History

Secure Boot after installing

The installer ISO still requires Secure Boot off to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote.

Steps (per host):

  1. In flake.nix inputs, keep lanzaboote.url = "github:nix-community/lanzaboote"; (already present).
  2. In your host module (e.g. hosts/<hostname>.nix), add imports:
    • inputs.lanzaboote.nixosModules.lanzaboote
    • ../modules/system/secure-boot.nix
  3. Rebuild on the target system (with Secure Boot still disabled):
    sudo nixos-rebuild switch --flake .#<hostname>
  4. Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot.
  5. Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI.

Notes

  • Keys are stored at /var/lib/secureboot (persist this if you use impermanence).
  • Microsoft keys are included for compatibility; adjust in secure-boot.nix if you want fully custom trust.
  • If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings.