asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

lanzaboote + secure boot

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 09:01:40 +02:00
commit 82ce7186fd
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
4 changed files with 141 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

30
modules/boot.nix
View file

@ -1,38 +1,32 @@
# Bootloader and GRUB configuration
# Bootloader and Secure Boot configuration
{ config, pkgs, lib, ... }:
{
# Use latest kernel instead of LTS
boot.kernelPackages = pkgs.linuxPackages_latest;
# boot.kernelPackages = pkgs.linuxPackages_latest;
# Note: security.nix forces hardened kernel, so we use that.
# Lanzaboote Secure Boot
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
# boot.loader.systemd-boot.enable = true; # Disabled for GRUB
boot.loader.efi.canTouchEfiVariables = true;
# GRUB bootloader
/* GRUB disabled for Secure Boot (Lanzaboote)
boot.loader.grub = {
enable = true;
device = "nodev";
efiSupport = true;
# useOSProber = true;
# extraConfig = "GRUB_DISABLE_OS_PROBER=false";
extraEntries = ''
menuentry "Arch Linux (default)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux.img
}
menuentry "Arch Linux (zen)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux-zen root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux-zen.img
}
menuentry "Arch Linux (lts)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux-lts root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux-lts.img
}
'';
};
*/
}