diff options
| author | Grigory Shipunov | 2023-04-23 01:03:53 +0200 |
|---|---|---|
| committer | Grigory Shipunov | 2023-04-23 17:23:37 +0200 |
| commit | 7e815dd5d07e05d6b79cf31385ae5ab776625184 (patch) | |
| tree | 5819b1569c6c22cc687e9d94b2621e68a400cf4f /hosts/toaster | |
| parent | ad9ced32507e9047075ad542387bced8ef62632b (diff) | |
first stab at secure boot
Diffstat (limited to 'hosts/toaster')
| -rw-r--r-- | hosts/toaster/default.nix | 1 | ||||
| -rw-r--r-- | hosts/toaster/secure-boot.nix | 12 |
2 files changed, 13 insertions, 0 deletions
diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix index 6aaa4bc..e7ff5b9 100644 --- a/hosts/toaster/default.nix +++ b/hosts/toaster/default.nix @@ -6,6 +6,7 @@ ./network-vpns.nix ./network.nix ./secrets.nix + ./secure-boot.nix ./zfs.nix ]; diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix new file mode 100644 index 0000000..d18e1cb --- /dev/null +++ b/hosts/toaster/secure-boot.nix @@ -0,0 +1,12 @@ +{ pkgs, lib, ... }: { + boot = { + bootspec.enable = true; + loader.systemd-boot.enable = lib.mkForce false; + lanzaboote = { + enable = true; + pkiBundle = "/etc/secureboot"; + }; + }; + + environment.systemPackages = [ pkgs.sbctl ]; +} |