tux/nix-config
1
0
Fork 0
mirror of https://github.com/tuxdotrs/nix-config.git synced 2026-09-19 16:49:04 +05:30
Code Issues Actions Packages Projects Releases Wiki Activity

style: format code

Browse Source
This commit is contained in:
tux
2026-09-11 01:59:55 +05:30
parent 49a341d6b3
commit 344d8bdd4a
87 changed files with 2528 additions and 2719 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
modules/nixos/boot/secure-boot.nix
View File

@@ -1,43 +1,39 @@
{ inputs, ... }:
{
flake.modules.nixos.boot =
{
config,
lib,
pkgs,
...
}:
let
cfg = config.tnix.boot;
in
{
imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
{inputs, ...}: {
flake.modules.nixos.boot = {
config,
lib,
pkgs,
...
}: let
cfg = config.tnix.boot;
in {
imports = [inputs.lanzaboote.nixosModules.lanzaboote];
options.tnix.boot.secure-boot = {
enable = lib.mkEnableOption "Enable secure-boot";
};
options.tnix.boot.secure-boot = {
enable = lib.mkEnableOption "Enable secure-boot";
};
config = lib.mkIf cfg.secure-boot.enable {
assertions = [
{
assertion = !cfg.legacy.enable;
message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
}
];
config = lib.mkIf cfg.secure-boot.enable {
assertions = [
{
assertion = !cfg.legacy.enable;
message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
}
];
environment.systemPackages = [ pkgs.sbctl ];
environment.systemPackages = [pkgs.sbctl];
# Lanzaboote replaces systemd-boot, so force it off
boot.loader.systemd-boot.enable = lib.mkForce false;
# Lanzaboote replaces systemd-boot, so force it off
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
autoGenerateKeys.enable = true;
autoEnrollKeys.enable = true;
boot.lanzaboote = {
enable = true;
autoGenerateKeys.enable = true;
autoEnrollKeys.enable = true;
configurationLimit = 10;
pkiBundle = "/var/lib/sbctl";
};
configurationLimit = 10;
pkiBundle = "/var/lib/sbctl";
};
};
};
}