asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

lanzaboote + secure boot

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 09:01:40 +02:00
commit 82ce7186fd
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
4 changed files with 141 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

122
flake.lock generated
View file

@ -21,6 +21,37 @@
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1765145449,
"narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
"owner": "ipetkov",
"repo": "crane",
"rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1761588595,
"narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
@ -39,6 +70,52 @@
"type": "github"
}
},
"gitignore": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"pre-commit",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"lanzaboote": {
"inputs": {
"crane": "crane",
"nixpkgs": [
"nixpkgs"
],
"pre-commit": "pre-commit",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1765382359,
"narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "v1.0.0",
"repo": "lanzaboote",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1768127708,
@ -55,12 +132,57 @@
"type": "github"
}
},
"pre-commit": {
"inputs": {
"flake-compat": "flake-compat",
"gitignore": "gitignore",
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765016596,
"narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": {
"inputs": {
"claude-code-nix": "claude-code-nix",
"lanzaboote": "lanzaboote",
"nixpkgs": "nixpkgs"
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765075567,
"narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,

7
flake.nix
View file

@ -1,7 +1,11 @@
{
description = "NixOS configuration with latest Claude Code";
description = "NixOS configuration with latest Claude Code & Lanzaboot";
inputs = {
lanzaboote = {
url = "github:nix-community/lanzaboote/v1.0.0";
inputs.nixpkgs.follows = "nixpkgs";
};
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
claude-code-nix = {
url = "github:sadjow/claude-code-nix";
@ -14,6 +18,7 @@
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
inputs.lanzaboote.nixosModules.lanzaboote
./configuration.nix
({ pkgs, inputs, ... }: {
environment.systemPackages = [

30
modules/boot.nix
View file

@ -1,38 +1,32 @@
# Bootloader and GRUB configuration
# Bootloader and Secure Boot configuration
{ config, pkgs, lib, ... }:
{
# Use latest kernel instead of LTS
boot.kernelPackages = pkgs.linuxPackages_latest;
# boot.kernelPackages = pkgs.linuxPackages_latest;
# Note: security.nix forces hardened kernel, so we use that.
# Lanzaboote Secure Boot
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
# boot.loader.systemd-boot.enable = true; # Disabled for GRUB
boot.loader.efi.canTouchEfiVariables = true;
# GRUB bootloader
/* GRUB disabled for Secure Boot (Lanzaboote)
boot.loader.grub = {
enable = true;
device = "nodev";
efiSupport = true;
# useOSProber = true;
# extraConfig = "GRUB_DISABLE_OS_PROBER=false";
extraEntries = ''
menuentry "Arch Linux (default)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux.img
}
menuentry "Arch Linux (zen)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux-zen root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux-zen.img
}
menuentry "Arch Linux (lts)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux-lts root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux-lts.img
}
'';
};
*/
}

1
modules/packages.nix
View file

@ -40,6 +40,7 @@
jq # JSON processor
# Hardware & system info
sbctl
pciutils # lspci
usbutils # lsusb
lsof # list open files