feat!: secureboot configuration

Changed files
+263 -13
systems
koumakan
+234 -9
flake.lock
···
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
-
"lastModified": 1691972610,
-
"narHash": "sha256-01X6GZ7nGZIvqzjM7zfnRemNXwgx5kneMldbTqRnPTU=",
"owner": "zhaofengli",
"repo": "attic",
-
"rev": "f4cf5704d64303ad11cc6918fbc6ab3cab6ca333",
"type": "github"
},
"original": {
···
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
···
"type": "github"
}
},
"flake-utils": {
"locked": {
"lastModified": 1667395993,
···
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
···
]
},
"locked": {
-
"lastModified": 1691963086,
-
"narHash": "sha256-OHpCjDC9jsMDzyNJslJUeONaNkSDQA5t7qGpurVsVww=",
"owner": "nix-community",
"repo": "home-manager",
-
"rev": "7f351e2993ed170dd9b8521a9e41f4d91d9b9c5d",
"type": "github"
},
"original": {
···
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1691853136,
···
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
-
"lastModified": 1691950488,
-
"narHash": "sha256-iUNEeudc4dGjx+HsHccnGiuZUVE/nhjXuQ1DVCsHIUY=",
"owner": "NixOS",
"repo": "nixpkgs",
-
"rev": "720e61ed8de116eec48d6baea1d54469b536b985",
"type": "github"
},
"original": {
···
"type": "indirect"
}
},
"root": {
"inputs": {
"attic": "attic",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs_2"
}
},
···
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
}
···
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
+
"lastModified": 1692225040,
+
"narHash": "sha256-jbQNvkgWGioiC6S39dZVyn6us8p/DlEvm5hQKEYkzDU=",
"owner": "zhaofengli",
"repo": "attic",
+
"rev": "b43d12082e34bceb26038bdad0438fd68804cfcd",
"type": "github"
},
"original": {
···
"type": "github"
}
},
+
"crane_2": {
+
"inputs": {
+
"flake-compat": [
+
"lanzaboote",
+
"flake-compat"
+
],
+
"flake-utils": [
+
"lanzaboote",
+
"flake-utils"
+
],
+
"nixpkgs": [
+
"lanzaboote",
+
"nixpkgs"
+
],
+
"rust-overlay": [
+
"lanzaboote",
+
"rust-overlay"
+
]
+
},
+
"locked": {
+
"lastModified": 1681177078,
+
"narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",
+
"owner": "ipetkov",
+
"repo": "crane",
+
"rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",
+
"type": "github"
+
},
+
"original": {
+
"owner": "ipetkov",
+
"repo": "crane",
+
"type": "github"
+
}
+
},
"flake-compat": {
"flake": false,
"locked": {
···
"type": "github"
}
},
+
"flake-compat_2": {
+
"flake": false,
+
"locked": {
+
"lastModified": 1673956053,
+
"narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+
"owner": "edolstra",
+
"repo": "flake-compat",
+
"rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+
"type": "github"
+
},
+
"original": {
+
"owner": "edolstra",
+
"repo": "flake-compat",
+
"type": "github"
+
}
+
},
+
"flake-parts": {
+
"inputs": {
+
"nixpkgs-lib": [
+
"lanzaboote",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1680392223,
+
"narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",
+
"type": "github"
+
},
+
"original": {
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"type": "github"
+
}
+
},
"flake-utils": {
"locked": {
"lastModified": 1667395993,
···
"type": "github"
}
},
+
"flake-utils_2": {
+
"inputs": {
+
"systems": "systems"
+
},
+
"locked": {
+
"lastModified": 1681202837,
+
"narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+
"owner": "numtide",
+
"repo": "flake-utils",
+
"rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+
"type": "github"
+
},
+
"original": {
+
"owner": "numtide",
+
"repo": "flake-utils",
+
"type": "github"
+
}
+
},
+
"gitignore": {
+
"inputs": {
+
"nixpkgs": [
+
"lanzaboote",
+
"pre-commit-hooks-nix",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1660459072,
+
"narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
+
"owner": "hercules-ci",
+
"repo": "gitignore.nix",
+
"rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
+
"type": "github"
+
},
+
"original": {
+
"owner": "hercules-ci",
+
"repo": "gitignore.nix",
+
"type": "github"
+
}
+
},
"home-manager": {
"inputs": {
"nixpkgs": [
···
]
},
"locked": {
+
"lastModified": 1692099905,
+
"narHash": "sha256-/pSusGhmIdSdAaywQRFA5dVbfdIzlWQTecM+E46+cJ0=",
"owner": "nix-community",
"repo": "home-manager",
+
"rev": "2a6679aa9cc3872c29ba2a57fe1b71b3e3c5649f",
"type": "github"
},
"original": {
···
"type": "github"
}
},
+
"lanzaboote": {
+
"inputs": {
+
"crane": "crane_2",
+
"flake-compat": "flake-compat_2",
+
"flake-parts": "flake-parts",
+
"flake-utils": "flake-utils_2",
+
"nixpkgs": [
+
"nixpkgs"
+
],
+
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
+
"rust-overlay": "rust-overlay_2"
+
},
+
"locked": {
+
"lastModified": 1682802423,
+
"narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",
+
"owner": "nix-community",
+
"repo": "lanzaboote",
+
"rev": "64b903ca87d18cef2752c19c098af275c6e51d63",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-community",
+
"ref": "v0.3.0",
+
"repo": "lanzaboote",
+
"type": "github"
+
}
+
},
"nixpkgs": {
"locked": {
"lastModified": 1691853136,
···
"type": "github"
}
},
+
"nixpkgs-stable_2": {
+
"locked": {
+
"lastModified": 1678872516,
+
"narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
+
"owner": "NixOS",
+
"repo": "nixpkgs",
+
"rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
+
"type": "github"
+
},
+
"original": {
+
"owner": "NixOS",
+
"ref": "nixos-22.11",
+
"repo": "nixpkgs",
+
"type": "github"
+
}
+
},
"nixpkgs_2": {
"locked": {
+
"lastModified": 1692311310,
+
"narHash": "sha256-K3VAwgGl7BnoAbDp6qNoCiE2TRuF7j/3nUao57hfh6U=",
"owner": "NixOS",
"repo": "nixpkgs",
+
"rev": "53baed0863ff7df14b14444b779ddfaa80621f1a",
"type": "github"
},
"original": {
···
"type": "indirect"
}
},
+
"pre-commit-hooks-nix": {
+
"inputs": {
+
"flake-compat": [
+
"lanzaboote",
+
"flake-compat"
+
],
+
"flake-utils": [
+
"lanzaboote",
+
"flake-utils"
+
],
+
"gitignore": "gitignore",
+
"nixpkgs": [
+
"lanzaboote",
+
"nixpkgs"
+
],
+
"nixpkgs-stable": "nixpkgs-stable_2"
+
},
+
"locked": {
+
"lastModified": 1681413034,
+
"narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",
+
"owner": "cachix",
+
"repo": "pre-commit-hooks.nix",
+
"rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",
+
"type": "github"
+
},
+
"original": {
+
"owner": "cachix",
+
"repo": "pre-commit-hooks.nix",
+
"type": "github"
+
}
+
},
"root": {
"inputs": {
"attic": "attic",
"home-manager": "home-manager",
+
"lanzaboote": "lanzaboote",
"nixpkgs": "nixpkgs_2"
}
},
···
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
+
"type": "github"
+
}
+
},
+
"rust-overlay_2": {
+
"inputs": {
+
"flake-utils": [
+
"lanzaboote",
+
"flake-utils"
+
],
+
"nixpkgs": [
+
"lanzaboote",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1682129965,
+
"narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
+
"owner": "oxalica",
+
"repo": "rust-overlay",
+
"rev": "2c417c0460b788328220120c698630947547ee83",
+
"type": "github"
+
},
+
"original": {
+
"owner": "oxalica",
+
"repo": "rust-overlay",
+
"type": "github"
+
}
+
},
+
"systems": {
+
"locked": {
+
"lastModified": 1681028828,
+
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+
"owner": "nix-systems",
+
"repo": "default",
+
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-systems",
+
"repo": "default",
"type": "github"
}
}
+12 -3
flake.nix
···
inputs = {
nixpkgs.url = "nixpkgs/nixos-23.05";
-
home-manager.url = "github:nix-community/home-manager/release-23.05";
-
home-manager.inputs.nixpkgs.follows = "nixpkgs";
attic.url = "github:zhaofengli/attic";
};
-
outputs = { nixpkgs, home-manager, ... }:
let
pkgs = import nixpkgs {};
lib = nixpkgs.lib;
···
_utils = (import ./global/utils.nix) { inherit pkgs; };
};
}
./systems/koumakan/configuration.nix
];
};
···
inputs = {
nixpkgs.url = "nixpkgs/nixos-23.05";
+
home-manager = {
+
url = "github:nix-community/home-manager/release-23.05";
+
inputs.nixpkgs.follows = "nixpkgs";
+
};
+
+
lanzaboote = {
+
url = "github:nix-community/lanzaboote/v0.3.0";
+
inputs.nixpkgs.follows = "nixpkgs";
+
};
attic.url = "github:zhaofengli/attic";
};
+
outputs = { nixpkgs, home-manager, lanzaboote, ... }:
let
pkgs = import nixpkgs {};
lib = nixpkgs.lib;
···
_utils = (import ./global/utils.nix) { inherit pkgs; };
};
}
+
lanzaboote.nixosModules.lanzaboote
+
./systems/koumakan/configuration.nix
];
};
+2 -1
systems/koumakan/security/default.nix
···
-
{ ... }:
{
imports = [
./pam.nix
./sudo.nix
];
}
···
+
{ ... }:
{
imports = [
./pam.nix
./sudo.nix
+
./secureboot.nix
];
}
+15
systems/koumakan/security/secureboot.nix
···
···
+
{ pkgs, lib, ... }:
+
+
{
+
environment.systemPackages = with pkgs; [
+
cryptsetup
+
sbctl
+
];
+
+
# lanzaboote currently replaces systemd-boot, so disable that here.
+
boot.loader.systemd-boot.enable = lib.mkForce false;
+
boot.lanzaboote = {
+
enable = true;
+
pkiBundle = "/etc/secureboot";
+
};
+
}