diff --git a/nix/configuration/boot.nix b/nix/configuration/boot.nix index 432ba18..3ccb635 100644 --- a/nix/configuration/boot.nix +++ b/nix/configuration/boot.nix @@ -9,42 +9,81 @@ { imports = [ ]; - config = lib.mkIf (!config.me.buildingIso) { - - boot.loader.grub.enable = false; - # Use the systemd-boot EFI boot loader. - boot.loader.systemd-boot.enable = true; - # TODO: make not write bootx64.efi - boot.loader.efi.canTouchEfiVariables = false; - - # Automatically delete old generations - boot.loader.systemd-boot.configurationLimit = 3; - - # Check what will be lost with `zfs diff zroot/linux/root@blank` - boot.initrd.systemd.enable = lib.mkDefault true; - boot.initrd.systemd.services.zfs-rollback = { - description = "Rollback ZFS root dataset to blank snapshot"; - wantedBy = [ - "initrd.target" - ]; - after = [ - "zfs-import-zroot.service" - ]; - before = [ - "sysroot.mount" - ]; - path = with pkgs; [ - zfs - ]; - unitConfig.DefaultDependencies = "no"; - serviceConfig.Type = "oneshot"; - script = '' - zfs rollback -r zroot/linux/nix/root@blank - zfs rollback -r zroot/linux/nix/home@blank - echo "rollback complete" - ''; + options = { + me.secureBoot = { + enable = lib.mkOption { + default = false; + type = lib.types.bool; + description = '' + Enable to use secure boot. + ''; + }; }; }; + + config = lib.mkMerge [ + (lib.mkIf (!config.me.buildingIso) { + + boot.loader.grub.enable = false; + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + # TODO: make not write bootx64.efi + boot.loader.efi.canTouchEfiVariables = false; + + # Automatically delete old generations + boot.loader.systemd-boot.configurationLimit = 3; + + # Check what will be lost with `zfs diff zroot/linux/root@blank` + boot.initrd.systemd.enable = lib.mkDefault true; + boot.initrd.systemd.services.zfs-rollback = { + description = "Rollback ZFS root dataset to blank snapshot"; + wantedBy = [ + "initrd.target" + ]; + after = [ + "zfs-import-zroot.service" + ]; + before = [ + "sysroot.mount" + ]; + path = with pkgs; [ + zfs + ]; + unitConfig.DefaultDependencies = "no"; + serviceConfig.Type = "oneshot"; + script = '' + zfs rollback -r zroot/linux/nix/root@blank + zfs rollback -r zroot/linux/nix/home@blank + echo "rollback complete" + ''; + }; + + # boot.loader.systemd-boot.extraEntries = { + # "windows.conf" = '' + # title Windows + # efi /EFI/Microsoft/Boot/bootmgfw.efi + # options root=PARTUUID=17e325bf-a378-4d1d-be6a-f6df5476f0fa + # ''; + # }; + }) + (lib.mkIf (config.me.secureBoot.enable) { + # For debugging and troubleshooting Secure Boot. + environment.systemPackages = with pkgs; [ + sbctl + ]; + boot.loader.systemd-boot.enable = lib.mkForce false; + boot.lanzaboote = { + enable = true; + pkiBundle = "/etc/secureboot"; + }; + environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) { + hideMounts = true; + directories = [ + "/etc/secureboot" # Secure Boot Keys + ]; + }; + }) + ]; } # efibootmgr -c -d /dev/sda -p 1 -L NixOS-boot -l '\EFI\NixOS-boot\grubx64.efi' diff --git a/nix/configuration/flake.lock b/nix/configuration/flake.lock index 96f9515..8b0048b 100644 --- a/nix/configuration/flake.lock +++ b/nix/configuration/flake.lock @@ -1,5 +1,103 @@ { "nodes": { + "crane": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717535930, + "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=", + "owner": "ipetkov", + "repo": "crane", + "rev": "55e7754ec31dac78980c8be45f8a28e80e370946", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-parts": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -36,6 +134,33 @@ "type": "github" } }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "flake-utils": "flake-utils", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1718178907, + "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.1", + "repo": "lanzaboote", + "type": "github" + } + }, "nixpkgs": { "locked": { "lastModified": 1734323986, @@ -68,6 +193,22 @@ "type": "github" } }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs-unstable": { "locked": { "lastModified": 1734424634, @@ -84,14 +225,82 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "root": { "inputs": { "home-manager": "home-manager", "impermanence": "impermanence", + "lanzaboote": "lanzaboote", "nixpkgs": "nixpkgs", "nixpkgs-b93b4e9b5": "nixpkgs-b93b4e9b5", "nixpkgs-unstable": "nixpkgs-unstable" } + }, + "rust-overlay": { + "inputs": { + "flake-utils": [ + "lanzaboote", + "flake-utils" + ], + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717813066, + "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } } }, "root": "root", diff --git a/nix/configuration/flake.nix b/nix/configuration/flake.nix index 3fc688a..63bd9e2 100644 --- a/nix/configuration/flake.nix +++ b/nix/configuration/flake.nix @@ -35,6 +35,12 @@ nixpkgs-b93b4e9b5.url = "github:NixOS/nixpkgs/b93b4e9b527904aadf52dba6ca35efde2067cbd4"; home-manager.url = "github:nix-community/home-manager/release-24.11"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; + lanzaboote = { + url = "github:nix-community/lanzaboote/v0.4.1"; + + # Optional but recommended to limit the size of your system closure. + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -45,6 +51,7 @@ nixpkgs-b93b4e9b5, impermanence, home-manager, + lanzaboote, ... }@inputs: let @@ -61,6 +68,7 @@ modules = [ impermanence.nixosModules.impermanence home-manager.nixosModules.home-manager + lanzaboote.nixosModules.lanzaboote { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; diff --git a/nix/configuration/hosts/odo/default.nix b/nix/configuration/hosts/odo/default.nix index f7a70de..79ef251 100644 --- a/nix/configuration/hosts/odo/default.nix +++ b/nix/configuration/hosts/odo/default.nix @@ -11,4 +11,6 @@ networking.hostName = "odo"; # Define your hostname. time.timeZone = "America/New_York"; + + me.secureBoot.enable = true; } diff --git a/nix/configuration/roles/chromium/default.nix b/nix/configuration/roles/chromium/default.nix index 737bb31..409c35f 100644 --- a/nix/configuration/roles/chromium/default.nix +++ b/nix/configuration/roles/chromium/default.nix @@ -8,6 +8,8 @@ { imports = [ ]; + # TODO: Read https://bbs.archlinux.org/viewtopic.php?pid=2209507#p2209507 and apply desired settings. + environment.systemPackages = with pkgs; [ (chromium.override { enableWideVine = true; }) ];