Something went wrong. Try again.
nix and nixos configs forked from filemagic.tngl.sh/nix
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647# based on https://tangled.org/ed209.dev/nix-config/blob/c68d0f252cb126cbe0540cb7a1709e8294777c1c/modules/nixos/system/boot/default.nix{ config, lib, pkgs, ...}: let cfg = config.hardened;in { config = lib.mkIf cfg.secureboot.enable { systemd.tmpfiles.rules = [ "d /etc/secureboot/pki 0700 root root -" ];
boot = { lanzaboote = { enable = true; pkiBundle = "/etc/secureboot/pki"; autoGenerateKeys.enable = true; autoEnrollKeys = { includeMicrosoftKeys = false; allowBrickingMyMachine = true; enable = true; autoReboot = true; }; }; loader.systemd-boot = { enable = lib.mkForce false; configurationLimit = 10; editor = false; }; };
environment.systemPackages = with pkgs; [ sbctl ];
environment.persistence = lib.mkIf config.hardened.impermanence.enable { "/persistent" = { directories = [ "/etc/secureboot" ]; }; }; };}