mirror of
https://github.com/moons-14/dotfiles.git
synced 2026-10-06 05:48:12 +09:00
37 lines
663 B
Nix
37 lines
663 B
Nix
{
|
|
pkgs,
|
|
inputs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.my.system.secure-boot;
|
|
in
|
|
{
|
|
imports = [
|
|
inputs.lanzaboote.nixosModules.lanzaboote
|
|
];
|
|
|
|
options.my.system.secure-boot = {
|
|
enable = lib.mkEnableOption "secure boot (lanzaboote)";
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
boot.loader = {
|
|
systemd-boot.enable = lib.mkForce false;
|
|
efi.canTouchEfiVariables = true;
|
|
efi.efiSysMountPoint = "/boot";
|
|
};
|
|
|
|
boot.lanzaboote = {
|
|
enable = true;
|
|
pkiBundle = "/var/lib/sbctl";
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
sbctl # A tool to manage UEFI Secure Boot keys and signatures
|
|
];
|
|
};
|
|
}
|