diff options
| author | sefidel <contact@sefidel.net> | 2024-08-05 00:29:51 +0900 |
|---|---|---|
| committer | sefidel <contact@sefidel.net> | 2024-08-06 16:01:39 +0900 |
| commit | 6b9185dcdb8e6a3a2142cf44158e47d39884440e (patch) | |
| tree | 67f42e15f90de51a4ae877dd232cafa31013849d /nixos/alpha | |
| parent | 8ceb49caa51301bb29fb3d545848319f1196901d (diff) | |
| download | nixrc-6b9185dcdb8e6a3a2142cf44158e47d39884440e.zip | |
feat(nixos/alpha): enable secure boot
Diffstat (limited to 'nixos/alpha')
| -rw-r--r-- | nixos/alpha/configuration.nix | 27 | ||||
| -rw-r--r-- | nixos/alpha/hardware-configuration.nix | 1 |
2 files changed, 10 insertions, 18 deletions
diff --git a/nixos/alpha/configuration.nix b/nixos/alpha/configuration.nix index b3ceccc..0bf7683 100644 --- a/nixos/alpha/configuration.nix +++ b/nixos/alpha/configuration.nix @@ -33,24 +33,13 @@ boot.zfs.forceImportAll = false; boot.zfs.allowHibernation = true; # NOTE: disable if using swap on ZFS - # GRUB bootloader - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.grub = { - enable = true; - - efiSupport = true; - configurationLimit = 10; - device = "nodev"; - useOSProber = true; - copyKernels = true; - extraEntries = '' - menuentry "Reboot" { - reboot - } - menuentry "Shutdown" { - halt - } - ''; + boot.loader.systemd-boot = { + # Managed by lanzaboote + enable = false; + editor = false; + configurationLimit = 16; + bootCounting.enable = true; + bootCounting.tries = 3; }; boot.initrd.postDeviceCommands = lib.mkAfter '' @@ -117,6 +106,8 @@ services.openssh.settings.PasswordAuthentication = false; modules = { + secure-boot.enable = true; + persistence = { enable = true; storagePath = "/persist"; diff --git a/nixos/alpha/hardware-configuration.nix b/nixos/alpha/hardware-configuration.nix index 5ec5d86..8c40065 100644 --- a/nixos/alpha/hardware-configuration.nix +++ b/nixos/alpha/hardware-configuration.nix @@ -21,6 +21,7 @@ fileSystems."/boot" = { device = "/dev/disk/by-uuid/12CE-A600"; fsType = "vfat"; + options = [ "umask=0077" ]; }; fileSystems."/nix" = |