From 572a0f481189b83c07018c6404acfe766d8dc57e Mon Sep 17 00:00:00 2001 From: moons-14 Date: Wed, 5 Nov 2025 02:13:02 +0900 Subject: [PATCH] secure boot --- flake.lock | 151 ++++++++++++++++++++++++++++++++++- flake.nix | 4 + hosts/x1g13/default.nix | 1 + modules/core/packages.nix | 1 + modules/core/secure-boot.nix | 17 ++++ modules/core/services.nix | 11 ++- modules/home/zoom.nix | 9 +++ profiles/gui.nix | 1 + 8 files changed, 192 insertions(+), 3 deletions(-) create mode 100644 modules/core/secure-boot.nix create mode 100644 modules/home/zoom.nix diff --git a/flake.lock b/flake.lock index 34bb1e6..15e4f87 100644 --- a/flake.lock +++ b/flake.lock @@ -68,6 +68,21 @@ "type": "github" } }, + "crane": { + "locked": { + "lastModified": 1754269165, + "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=", + "owner": "ipetkov", + "repo": "crane", + "rev": "444e81206df3f7d92780680e45858e31d2f07a08", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "firefox-gnome-theme": { "flake": false, "locked": { @@ -116,7 +131,44 @@ "type": "github" } }, + "flake-compat_3": { + "flake": false, + "locked": { + "lastModified": 1747046372, + "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1754091436, + "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_2": { "inputs": { "nixpkgs-lib": [ "stylix", @@ -211,6 +263,28 @@ "type": "github" } }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "gnome-shell": { "flake": false, "locked": { @@ -249,6 +323,31 @@ "type": "github" } }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1762205063, + "narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "lanzaboote", + "type": "github" + } + }, "niri-flake": { "inputs": { "niri-stable": "niri-stable", @@ -323,7 +422,7 @@ }, "nixos-wsl": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "nixpkgs": "nixpkgs_4" }, "locked": { @@ -511,6 +610,32 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1750779888, + "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "quickshell": { "inputs": { "nixpkgs": [ @@ -535,6 +660,7 @@ "inputs": { "ghostty": "ghostty", "home-manager": "home-manager", + "lanzaboote": "lanzaboote", "niri-flake": "niri-flake", "nixos-hardware": "nixos-hardware", "nixos-wsl": "nixos-wsl", @@ -546,6 +672,27 @@ "vicinae": "vicinae" } }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1761791894, + "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "59c45eb69d9222a4362673141e00ff77842cd219", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "stylix": { "inputs": { "base16": "base16", @@ -553,7 +700,7 @@ "base16-helix": "base16-helix", "base16-vim": "base16-vim", "firefox-gnome-theme": "firefox-gnome-theme", - "flake-parts": "flake-parts", + "flake-parts": "flake-parts_2", "gnome-shell": "gnome-shell", "nixpkgs": [ "nixpkgs" diff --git a/flake.nix b/flake.nix index 59caa6d..5c0f980 100644 --- a/flake.nix +++ b/flake.nix @@ -28,6 +28,10 @@ url = "github:nix-community/stylix"; inputs.nixpkgs.follows = "nixpkgs"; }; + lanzaboote = { + url = "github:nix-community/lanzaboote"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = inputs@{ self, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, ...}: diff --git a/hosts/x1g13/default.nix b/hosts/x1g13/default.nix index d0e74ec..abb7787 100644 --- a/hosts/x1g13/default.nix +++ b/hosts/x1g13/default.nix @@ -9,6 +9,7 @@ [ inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x1-13th-gen ./../../modules/drivers/intel-drivers.nix + ./../../modules/core/secure-boot.nix ./hardware-configuration.nix ]; } diff --git a/modules/core/packages.nix b/modules/core/packages.nix index f716868..3f69a86 100644 --- a/modules/core/packages.nix +++ b/modules/core/packages.nix @@ -42,5 +42,6 @@ in docker # Containerization Platform unstable._1password-cli unstable._1password-gui + sbctl ]; } diff --git a/modules/core/secure-boot.nix b/modules/core/secure-boot.nix new file mode 100644 index 0000000..fa89542 --- /dev/null +++ b/modules/core/secure-boot.nix @@ -0,0 +1,17 @@ +{ inputs, pkgs, lib, ... }: +{ + imports = [ + inputs.lanzaboote.nixosModules.lanzaboote + ]; + + boot.loader = { + systemd-boot.enable = lib.mkForce false; + efi.canTouchEfiVariables = true; + efi.efiSysMountPoint = "/boot"; + }; + + boot.lanzaboote = { + enable = true; + pkiBundle = "/var/lib/sbctl"; + }; +} \ No newline at end of file diff --git a/modules/core/services.nix b/modules/core/services.nix index 7dc2aa1..1acdfcc 100644 --- a/modules/core/services.nix +++ b/modules/core/services.nix @@ -1,4 +1,4 @@ -{ ... }: { +{ pkgs, ... }: { services = { blueman.enable = true; # Bluetooth Support @@ -36,4 +36,13 @@ dates = "weekly"; }; }; + + xdg.portal = { + enable = true; + wlr.enable = true; + extraPortals = [ + pkgs.xdg-desktop-portal-wlr + pkgs.xdg-desktop-portal-gtk + ]; + }; } \ No newline at end of file diff --git a/modules/home/zoom.nix b/modules/home/zoom.nix new file mode 100644 index 0000000..63d87c9 --- /dev/null +++ b/modules/home/zoom.nix @@ -0,0 +1,9 @@ +{ pkgs, lib, ... }: +{ + nixpkgs.config.allowUnfreePredicate = pkg: + lib.getName pkg == "zoom-us"; + + home.packages = with pkgs; [ + zoom-us + ]; +} diff --git a/profiles/gui.nix b/profiles/gui.nix index a2a6f0c..389c70b 100644 --- a/profiles/gui.nix +++ b/profiles/gui.nix @@ -22,5 +22,6 @@ ./../modules/home/discord.nix ./../modules/home/nautilus.nix ./../modules/home/gtk.nix + ./../modules/home/zoom.nix ]; } \ No newline at end of file