asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

arch linux systemd-boot+secure boot signing

Browse source
This commit is contained in:
Sergei Poljanski 2026-03-19 17:57:28 +02:00
commit faf0174638
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 18 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

31
modules/boot.nix
View file

@ -15,18 +15,23 @@
boot.loader.efi.canTouchEfiVariables = true;
/* GRUB disabled for Secure Boot (Lanzaboote)
boot.loader.grub = {
enable = true;
device = "nodev";
efiSupport = true;
extraEntries = ''
menuentry "Arch Linux (default)" {
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux.img
}
# Arch Linux systemd-boot entry
# Copies kernel/initramfs from Arch btrfs partition to ESP and creates loader entry
system.activationScripts.archBoot = let
archEntry = pkgs.writeText "arch.conf" ''
title Arch Linux
linux /arch/vmlinuz-linux
initrd /arch/initramfs-linux.img
options root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
'';
};
*/
in ''
mkdir -p /boot/arch
if mountpoint -q /mnt/arch; then
cp /mnt/arch/boot/vmlinuz-linux /boot/arch/vmlinuz-linux
cp /mnt/arch/boot/initramfs-linux.img /boot/arch/initramfs-linux.img
${pkgs.sbctl}/bin/sbctl sign /boot/arch/vmlinuz-linux
fi
mkdir -p /boot/loader/entries
cp ${archEntry} /boot/loader/entries/arch.conf
'';
}