commit d1b3df4234cb07aa3896f28a760e19395bc88ff7 · soopy.moe/gensokyo

+234 -9

flake.lock

···

       9
       9
        
               "nixpkgs-stable": "nixpkgs-stable"

     

       10
       10
        
             },

     

       11
       11
        
             "locked": {

     

       12
       12
       -
               "lastModified": 1691972610,

     

       13
       13
       -
               "narHash": "sha256-01X6GZ7nGZIvqzjM7zfnRemNXwgx5kneMldbTqRnPTU=",

     

       12
       12
       +
               "lastModified": 1692225040,

     

       13
       13
       +
               "narHash": "sha256-jbQNvkgWGioiC6S39dZVyn6us8p/DlEvm5hQKEYkzDU=",

     

       14
       14
        
               "owner": "zhaofengli",

     

       15
       15
        
               "repo": "attic",

     

       16
       16
       -
               "rev": "f4cf5704d64303ad11cc6918fbc6ab3cab6ca333",

     

       16
       16
       +
               "rev": "b43d12082e34bceb26038bdad0438fd68804cfcd",

     

       17
       17
        
               "type": "github"

     

       18
       18
        
             },

     

       19
       19
        
             "original": {

     
···

       52
       52
        
               "type": "github"

     

       53
       53
        
             }

     

       54
       54
        
           },

     

       55
       55
       +
           "crane_2": {

     

       56
       56
       +
             "inputs": {

     

       57
       57
       +
               "flake-compat": [

     

       58
       58
       +
                 "lanzaboote",

     

       59
       59
       +
                 "flake-compat"

     

       60
       60
       +
               ],

     

       61
       61
       +
               "flake-utils": [

     

       62
       62
       +
                 "lanzaboote",

     

       63
       63
       +
                 "flake-utils"

     

       64
       64
       +
               ],

     

       65
       65
       +
               "nixpkgs": [

     

       66
       66
       +
                 "lanzaboote",

     

       67
       67
       +
                 "nixpkgs"

     

       68
       68
       +
               ],

     

       69
       69
       +
               "rust-overlay": [

     

       70
       70
       +
                 "lanzaboote",

     

       71
       71
       +
                 "rust-overlay"

     

       72
       72
       +
               ]

     

       73
       73
       +
             },

     

       74
       74
       +
             "locked": {

     

       75
       75
       +
               "lastModified": 1681177078,

     

       76
       76
       +
               "narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",

     

       77
       77
       +
               "owner": "ipetkov",

     

       78
       78
       +
               "repo": "crane",

     

       79
       79
       +
               "rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",

     

       80
       80
       +
               "type": "github"

     

       81
       81
       +
             },

     

       82
       82
       +
             "original": {

     

       83
       83
       +
               "owner": "ipetkov",

     

       84
       84
       +
               "repo": "crane",

     

       85
       85
       +
               "type": "github"

     

       86
       86
       +
             }

     

       87
       87
       +
           },

     

       55
       88
        
           "flake-compat": {

     

       56
       89
        
             "flake": false,

     

       57
       90
        
             "locked": {

     
···

       68
       101
        
               "type": "github"

     

       69
       102
        
             }

     

       70
       103
        
           },

     

       104
       104
       +
           "flake-compat_2": {

     

       105
       105
       +
             "flake": false,

     

       106
       106
       +
             "locked": {

     

       107
       107
       +
               "lastModified": 1673956053,

     

       108
       108
       +
               "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",

     

       109
       109
       +
               "owner": "edolstra",

     

       110
       110
       +
               "repo": "flake-compat",

     

       111
       111
       +
               "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",

     

       112
       112
       +
               "type": "github"

     

       113
       113
       +
             },

     

       114
       114
       +
             "original": {

     

       115
       115
       +
               "owner": "edolstra",

     

       116
       116
       +
               "repo": "flake-compat",

     

       117
       117
       +
               "type": "github"

     

       118
       118
       +
             }

     

       119
       119
       +
           },

     

       120
       120
       +
           "flake-parts": {

     

       121
       121
       +
             "inputs": {

     

       122
       122
       +
               "nixpkgs-lib": [

     

       123
       123
       +
                 "lanzaboote",

     

       124
       124
       +
                 "nixpkgs"

     

       125
       125
       +
               ]

     

       126
       126
       +
             },

     

       127
       127
       +
             "locked": {

     

       128
       128
       +
               "lastModified": 1680392223,

     

       129
       129
       +
               "narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",

     

       130
       130
       +
               "owner": "hercules-ci",

     

       131
       131
       +
               "repo": "flake-parts",

     

       132
       132
       +
               "rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",

     

       133
       133
       +
               "type": "github"

     

       134
       134
       +
             },

     

       135
       135
       +
             "original": {

     

       136
       136
       +
               "owner": "hercules-ci",

     

       137
       137
       +
               "repo": "flake-parts",

     

       138
       138
       +
               "type": "github"

     

       139
       139
       +
             }

     

       140
       140
       +
           },

     

       71
       141
        
           "flake-utils": {

     

       72
       142
        
             "locked": {

     

       73
       143
        
               "lastModified": 1667395993,

     
···

       83
       153
        
               "type": "github"

     

       84
       154
        
             }

     

       85
       155
        
           },

     

       156
       156
       +
           "flake-utils_2": {

     

       157
       157
       +
             "inputs": {

     

       158
       158
       +
               "systems": "systems"

     

       159
       159
       +
             },

     

       160
       160
       +
             "locked": {

     

       161
       161
       +
               "lastModified": 1681202837,

     

       162
       162
       +
               "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",

     

       163
       163
       +
               "owner": "numtide",

     

       164
       164
       +
               "repo": "flake-utils",

     

       165
       165
       +
               "rev": "cfacdce06f30d2b68473a46042957675eebb3401",

     

       166
       166
       +
               "type": "github"

     

       167
       167
       +
             },

     

       168
       168
       +
             "original": {

     

       169
       169
       +
               "owner": "numtide",

     

       170
       170
       +
               "repo": "flake-utils",

     

       171
       171
       +
               "type": "github"

     

       172
       172
       +
             }

     

       173
       173
       +
           },

     

       174
       174
       +
           "gitignore": {

     

       175
       175
       +
             "inputs": {

     

       176
       176
       +
               "nixpkgs": [

     

       177
       177
       +
                 "lanzaboote",

     

       178
       178
       +
                 "pre-commit-hooks-nix",

     

       179
       179
       +
                 "nixpkgs"

     

       180
       180
       +
               ]

     

       181
       181
       +
             },

     

       182
       182
       +
             "locked": {

     

       183
       183
       +
               "lastModified": 1660459072,

     

       184
       184
       +
               "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",

     

       185
       185
       +
               "owner": "hercules-ci",

     

       186
       186
       +
               "repo": "gitignore.nix",

     

       187
       187
       +
               "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",

     

       188
       188
       +
               "type": "github"

     

       189
       189
       +
             },

     

       190
       190
       +
             "original": {

     

       191
       191
       +
               "owner": "hercules-ci",

     

       192
       192
       +
               "repo": "gitignore.nix",

     

       193
       193
       +
               "type": "github"

     

       194
       194
       +
             }

     

       195
       195
       +
           },

     

       86
       196
        
           "home-manager": {

     

       87
       197
        
             "inputs": {

     

       88
       198
        
               "nixpkgs": [

     
···

       90
       200
        
               ]

     

       91
       201
        
             },

     

       92
       202
        
             "locked": {

     

       93
       93
       -
               "lastModified": 1691963086,

     

       94
       94
       -
               "narHash": "sha256-OHpCjDC9jsMDzyNJslJUeONaNkSDQA5t7qGpurVsVww=",

     

       203
       203
       +
               "lastModified": 1692099905,

     

       204
       204
       +
               "narHash": "sha256-/pSusGhmIdSdAaywQRFA5dVbfdIzlWQTecM+E46+cJ0=",

     

       95
       205
        
               "owner": "nix-community",

     

       96
       206
        
               "repo": "home-manager",

     

       97
       97
       -
               "rev": "7f351e2993ed170dd9b8521a9e41f4d91d9b9c5d",

     

       207
       207
       +
               "rev": "2a6679aa9cc3872c29ba2a57fe1b71b3e3c5649f",

     

       98
       208
        
               "type": "github"

     

       99
       209
        
             },

     

       100
       210
        
             "original": {

     
···

       104
       214
        
               "type": "github"

     

       105
       215
        
             }

     

       106
       216
        
           },

     

       217
       217
       +
           "lanzaboote": {

     

       218
       218
       +
             "inputs": {

     

       219
       219
       +
               "crane": "crane_2",

     

       220
       220
       +
               "flake-compat": "flake-compat_2",

     

       221
       221
       +
               "flake-parts": "flake-parts",

     

       222
       222
       +
               "flake-utils": "flake-utils_2",

     

       223
       223
       +
               "nixpkgs": [

     

       224
       224
       +
                 "nixpkgs"

     

       225
       225
       +
               ],

     

       226
       226
       +
               "pre-commit-hooks-nix": "pre-commit-hooks-nix",

     

       227
       227
       +
               "rust-overlay": "rust-overlay_2"

     

       228
       228
       +
             },

     

       229
       229
       +
             "locked": {

     

       230
       230
       +
               "lastModified": 1682802423,

     

       231
       231
       +
               "narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",

     

       232
       232
       +
               "owner": "nix-community",

     

       233
       233
       +
               "repo": "lanzaboote",

     

       234
       234
       +
               "rev": "64b903ca87d18cef2752c19c098af275c6e51d63",

     

       235
       235
       +
               "type": "github"

     

       236
       236
       +
             },

     

       237
       237
       +
             "original": {

     

       238
       238
       +
               "owner": "nix-community",

     

       239
       239
       +
               "ref": "v0.3.0",

     

       240
       240
       +
               "repo": "lanzaboote",

     

       241
       241
       +
               "type": "github"

     

       242
       242
       +
             }

     

       243
       243
       +
           },

     

       107
       244
        
           "nixpkgs": {

     

       108
       245
        
             "locked": {

     

       109
       246
        
               "lastModified": 1691853136,

     
···

       136
       273
        
               "type": "github"

     

       137
       274
        
             }

     

       138
       275
        
           },

     

       276
       276
       +
           "nixpkgs-stable_2": {

     

       277
       277
       +
             "locked": {

     

       278
       278
       +
               "lastModified": 1678872516,

     

       279
       279
       +
               "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",

     

       280
       280
       +
               "owner": "NixOS",

     

       281
       281
       +
               "repo": "nixpkgs",

     

       282
       282
       +
               "rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",

     

       283
       283
       +
               "type": "github"

     

       284
       284
       +
             },

     

       285
       285
       +
             "original": {

     

       286
       286
       +
               "owner": "NixOS",

     

       287
       287
       +
               "ref": "nixos-22.11",

     

       288
       288
       +
               "repo": "nixpkgs",

     

       289
       289
       +
               "type": "github"

     

       290
       290
       +
             }

     

       291
       291
       +
           },

     

       139
       292
        
           "nixpkgs_2": {

     

       140
       293
        
             "locked": {

     

       141
       141
       -
               "lastModified": 1691950488,

     

       142
       142
       -
               "narHash": "sha256-iUNEeudc4dGjx+HsHccnGiuZUVE/nhjXuQ1DVCsHIUY=",

     

       294
       294
       +
               "lastModified": 1692311310,

     

       295
       295
       +
               "narHash": "sha256-K3VAwgGl7BnoAbDp6qNoCiE2TRuF7j/3nUao57hfh6U=",

     

       143
       296
        
               "owner": "NixOS",

     

       144
       297
        
               "repo": "nixpkgs",

     

       145
       145
       -
               "rev": "720e61ed8de116eec48d6baea1d54469b536b985",

     

       298
       298
       +
               "rev": "53baed0863ff7df14b14444b779ddfaa80621f1a",

     

       146
       299
        
               "type": "github"

     

       147
       300
        
             },

     

       148
       301
        
             "original": {

     
···

       151
       304
        
               "type": "indirect"

     

       152
       305
        
             }

     

       153
       306
        
           },

     

       307
       307
       +
           "pre-commit-hooks-nix": {

     

       308
       308
       +
             "inputs": {

     

       309
       309
       +
               "flake-compat": [

     

       310
       310
       +
                 "lanzaboote",

     

       311
       311
       +
                 "flake-compat"

     

       312
       312
       +
               ],

     

       313
       313
       +
               "flake-utils": [

     

       314
       314
       +
                 "lanzaboote",

     

       315
       315
       +
                 "flake-utils"

     

       316
       316
       +
               ],

     

       317
       317
       +
               "gitignore": "gitignore",

     

       318
       318
       +
               "nixpkgs": [

     

       319
       319
       +
                 "lanzaboote",

     

       320
       320
       +
                 "nixpkgs"

     

       321
       321
       +
               ],

     

       322
       322
       +
               "nixpkgs-stable": "nixpkgs-stable_2"

     

       323
       323
       +
             },

     

       324
       324
       +
             "locked": {

     

       325
       325
       +
               "lastModified": 1681413034,

     

       326
       326
       +
               "narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",

     

       327
       327
       +
               "owner": "cachix",

     

       328
       328
       +
               "repo": "pre-commit-hooks.nix",

     

       329
       329
       +
               "rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",

     

       330
       330
       +
               "type": "github"

     

       331
       331
       +
             },

     

       332
       332
       +
             "original": {

     

       333
       333
       +
               "owner": "cachix",

     

       334
       334
       +
               "repo": "pre-commit-hooks.nix",

     

       335
       335
       +
               "type": "github"

     

       336
       336
       +
             }

     

       337
       337
       +
           },

     

       154
       338
        
           "root": {

     

       155
       339
        
             "inputs": {

     

       156
       340
        
               "attic": "attic",

     

       157
       341
        
               "home-manager": "home-manager",

     

       342
       342
       +
               "lanzaboote": "lanzaboote",

     

       158
       343
        
               "nixpkgs": "nixpkgs_2"

     

       159
       344
        
             }

     

       160
       345
        
           },

     
···

       182
       367
        
             "original": {

     

       183
       368
        
               "owner": "oxalica",

     

       184
       369
        
               "repo": "rust-overlay",

     

       370
       370
       +
               "type": "github"

     

       371
       371
       +
             }

     

       372
       372
       +
           },

     

       373
       373
       +
           "rust-overlay_2": {

     

       374
       374
       +
             "inputs": {

     

       375
       375
       +
               "flake-utils": [

     

       376
       376
       +
                 "lanzaboote",

     

       377
       377
       +
                 "flake-utils"

     

       378
       378
       +
               ],

     

       379
       379
       +
               "nixpkgs": [

     

       380
       380
       +
                 "lanzaboote",

     

       381
       381
       +
                 "nixpkgs"

     

       382
       382
       +
               ]

     

       383
       383
       +
             },

     

       384
       384
       +
             "locked": {

     

       385
       385
       +
               "lastModified": 1682129965,

     

       386
       386
       +
               "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",

     

       387
       387
       +
               "owner": "oxalica",

     

       388
       388
       +
               "repo": "rust-overlay",

     

       389
       389
       +
               "rev": "2c417c0460b788328220120c698630947547ee83",

     

       390
       390
       +
               "type": "github"

     

       391
       391
       +
             },

     

       392
       392
       +
             "original": {

     

       393
       393
       +
               "owner": "oxalica",

     

       394
       394
       +
               "repo": "rust-overlay",

     

       395
       395
       +
               "type": "github"

     

       396
       396
       +
             }

     

       397
       397
       +
           },

     

       398
       398
       +
           "systems": {

     

       399
       399
       +
             "locked": {

     

       400
       400
       +
               "lastModified": 1681028828,

     

       401
       401
       +
               "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",

     

       402
       402
       +
               "owner": "nix-systems",

     

       403
       403
       +
               "repo": "default",

     

       404
       404
       +
               "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",

     

       405
       405
       +
               "type": "github"

     

       406
       406
       +
             },

     

       407
       407
       +
             "original": {

     

       408
       408
       +
               "owner": "nix-systems",

     

       409
       409
       +
               "repo": "default",

     

       185
       410
        
               "type": "github"

     

       186
       411
        
             }

     

       187
       412
        
           }

+12 -3

flake.nix

···

       4
       4
        
         inputs = {

     

       5
       5
        
           nixpkgs.url = "nixpkgs/nixos-23.05";

     

       6
       6
        
       

     

       7
       7
       -
           home-manager.url = "github:nix-community/home-manager/release-23.05";

     

       8
       8
       -
           home-manager.inputs.nixpkgs.follows = "nixpkgs";

     

       7
       7
       +
           home-manager = {

     

       8
       8
       +
             url = "github:nix-community/home-manager/release-23.05";

     

       9
       9
       +
             inputs.nixpkgs.follows = "nixpkgs";

     

       10
       10
       +
           };

     

       11
       11
       +
       

     

       12
       12
       +
           lanzaboote = {

     

       13
       13
       +
             url = "github:nix-community/lanzaboote/v0.3.0";

     

       14
       14
       +
             inputs.nixpkgs.follows = "nixpkgs";

     

       15
       15
       +
           };

     

       9
       16
        
       

     

       10
       17
        
           attic.url = "github:zhaofengli/attic";

     

       11
       18
        
         };

     

       12
       19
        
       

     

       13
       13
       -
         outputs = { nixpkgs, home-manager, ... }:

     

       20
       20
       +
         outputs = { nixpkgs, home-manager, lanzaboote, ... }:

     

       14
       21
        
         let

     

       15
       22
        
           pkgs = import nixpkgs {};

     

       16
       23
        
           lib = nixpkgs.lib;

     
···

       26
       33
        
                     _utils = (import ./global/utils.nix) { inherit pkgs; };

     

       27
       34
        
                   };

     

       28
       35
        
                 }

     

       36
       36
       +
                 lanzaboote.nixosModules.lanzaboote

     

       37
       37
       +
                 

     

       29
       38
        
                 ./systems/koumakan/configuration.nix

     

       30
       39
        
               ];

     

       31
       40
        
             };

+2 -1

systems/koumakan/security/default.nix

···

       1
       1
       -
       { ... }: 

     

       1
       1
       +
       { ... }:

     

       2
       2
        
       {

     

       3
       3
        
         imports = [

     

       4
       4
        
           ./pam.nix

     

       5
       5
        
           ./sudo.nix

     

       6
       6
       +
           ./secureboot.nix

     

       6
       7
        
         ];

     

       7
       8
        
       }

+15

systems/koumakan/security/secureboot.nix

···

       1
       1
       +
       { pkgs, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       {

     

       4
       4
       +
         environment.systemPackages = with pkgs; [

     

       5
       5
       +
           cryptsetup

     

       6
       6
       +
           sbctl

     

       7
       7
       +
         ];

     

       8
       8
       +
       

     

       9
       9
       +
         # lanzaboote currently replaces systemd-boot, so disable that here.

     

       10
       10
       +
         boot.loader.systemd-boot.enable = lib.mkForce false;

     

       11
       11
       +
         boot.lanzaboote = {

     

       12
       12
       +
           enable = true;

     

       13
       13
       +
           pkiBundle = "/etc/secureboot";

     

       14
       14
       +
         };

     

       15
       15
       +
       }