From 82ce7186fd83f57c8dac2c3964d1cf94d4351599 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Tue, 13 Jan 2026 09:01:40 +0200 Subject: [PATCH] lanzaboote + secure boot --- flake.lock | 122 +++++++++++++++++++++++++++++++++++++++++++ flake.nix | 7 ++- modules/boot.nix | 30 +++++------ modules/packages.nix | 1 + 4 files changed, 141 insertions(+), 19 deletions(-) diff --git a/flake.lock b/flake.lock index 041927b..b6fe524 100644 --- a/flake.lock +++ b/flake.lock @@ -21,6 +21,37 @@ "type": "github" } }, + "crane": { + "locked": { + "lastModified": 1765145449, + "narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=", + "owner": "ipetkov", + "repo": "crane", + "rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1761588595, + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -39,6 +70,52 @@ "type": "github" } }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit": "pre-commit", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1765382359, + "narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v1.0.0", + "repo": "lanzaboote", + "type": "github" + } + }, "nixpkgs": { "locked": { "lastModified": 1768127708, @@ -55,12 +132,57 @@ "type": "github" } }, + "pre-commit": { + "inputs": { + "flake-compat": "flake-compat", + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1765016596, + "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "root": { "inputs": { "claude-code-nix": "claude-code-nix", + "lanzaboote": "lanzaboote", "nixpkgs": "nixpkgs" } }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1765075567, + "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, diff --git a/flake.nix b/flake.nix index 1b3cfee..30b25ed 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,11 @@ { - description = "NixOS configuration with latest Claude Code"; + description = "NixOS configuration with latest Claude Code & Lanzaboot"; inputs = { + lanzaboote = { + url = "github:nix-community/lanzaboote/v1.0.0"; + inputs.nixpkgs.follows = "nixpkgs"; + }; nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; claude-code-nix = { url = "github:sadjow/claude-code-nix"; @@ -14,6 +18,7 @@ system = "x86_64-linux"; specialArgs = { inherit inputs; }; modules = [ + inputs.lanzaboote.nixosModules.lanzaboote ./configuration.nix ({ pkgs, inputs, ... }: { environment.systemPackages = [ diff --git a/modules/boot.nix b/modules/boot.nix index 16f6ce2..2d9c04d 100644 --- a/modules/boot.nix +++ b/modules/boot.nix @@ -1,38 +1,32 @@ -# Bootloader and GRUB configuration +# Bootloader and Secure Boot configuration { config, pkgs, lib, ... }: { # Use latest kernel instead of LTS - boot.kernelPackages = pkgs.linuxPackages_latest; + # boot.kernelPackages = pkgs.linuxPackages_latest; + # Note: security.nix forces hardened kernel, so we use that. + + # Lanzaboote Secure Boot + boot.loader.systemd-boot.enable = lib.mkForce false; + boot.lanzaboote = { + enable = true; + pkiBundle = "/var/lib/sbctl"; + }; - # boot.loader.systemd-boot.enable = true; # Disabled for GRUB boot.loader.efi.canTouchEfiVariables = true; - # GRUB bootloader + /* GRUB disabled for Secure Boot (Lanzaboote) boot.loader.grub = { enable = true; device = "nodev"; efiSupport = true; - # useOSProber = true; - # extraConfig = "GRUB_DISABLE_OS_PROBER=false"; extraEntries = '' menuentry "Arch Linux (default)" { search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw initrd /@/boot/initramfs-linux.img } - - menuentry "Arch Linux (zen)" { - search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d - linux /@/boot/vmlinuz-linux-zen root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw - initrd /@/boot/initramfs-linux-zen.img - } - - menuentry "Arch Linux (lts)" { - search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d - linux /@/boot/vmlinuz-linux-lts root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw - initrd /@/boot/initramfs-linux-lts.img - } ''; }; + */ } diff --git a/modules/packages.nix b/modules/packages.nix index b6a9a17..a5d11a9 100644 --- a/modules/packages.nix +++ b/modules/packages.nix @@ -40,6 +40,7 @@ jq # JSON processor # Hardware & system info + sbctl pciutils # lspci usbutils # lsusb lsof # list open files