···

       
6
       
6
       
 
       
<!-- These are coincidentally the same length. magic! -->

     

       
7
       
7
       
 
       


     

       
8
       
8
       
 
       
- `-r-------- /etc/lego/desec`: acme credentials

     

       
9
       
9
       
-
       
- `drwx------ /etc/secureboot`: secureboot keys

     

       
9
       
9
       
+
       
- `drwx------ /var/lib/sbctl`: secure boot keys

     

       
10
       
10
       
 
       
- `-r-------- /v/l/forgejo/data/jwt/oauth.pem`: forgejo oauth jwt private key

     

       
11
       
11
       
 
       
- `-r-------- kita:/etc/radicale/users`: radicale user htpasswd mappings

     

       
12
       
12
       
 
       


     

···

       
15
       
15
       
 
       
  boot.loader.systemd-boot.enable = lib.mkForce false;

     

       
16
       
16
       
 
       
  boot.lanzaboote = {

     

       
17
       
17
       
 
       
    enable = true;

     

       
18
       
18
       
-
       
    pkiBundle = "/etc/secureboot";

     

       
18
       
18
       
+
       
    pkiBundle = "/var/lib/sbctl";

     

       
19
       
19
       
 
       
  };

     

       
20
       
20
       
 
       
}