koishi/nixos
1
0
Fork 0
Code Issues Pull requests Projects Activity

feat(boot): systemd-boot and lanzaboote toggles

Browse source 
Secure boot is not applicable in every use case.
This commit is contained in:
514fpv 2024-01-02 14:44:00 +08:00
parent 61db72b9ab
commit ba8cd0d40b
Signed by: koishi
SSH key fingerprint: SHA256:axz0uIzzY+5W19i7QOUuiw5LSqhKfCBKPf3L4xFRxLw
1 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
faucet/boot/default.nix Normal file
View file

@ -0,0 +1,28 @@
{ pkgs
, lib
, config
, ... }: with lib; let
cfg = config.faucet.boot;
in {
options.faucet.boot = {
enable = mkEnableOption "bootloader installation and maintenance" // { default = true; };
systemd-boot = mkEnableOption "generation selection via systemd-boot" // { default = !cfg.lanzaboote; };
lanzaboote = mkEnableOption "secure boot maintenance via lanzaboote";
};
config = let
sbPath = "/nix/persist/lanzaboote";
in mkIf cfg.enable {
boot = {
initrd.systemd.enable = true;
lanzaboote.enable = cfg.lanzaboote;
lanzaboote.pkiBundle = sbPath;
loader.systemd-boot.enable = cfg.systemd-boot;
loader.efi.canTouchEfiVariables = true;
};
# symlink for sbctl
environment.etc.secureboot = mkIf cfg.lanzaboote { source = sbPath; };
#environment.systemPackages = optional cfg.lanzaboote pkgs.sbctl;
};
}