rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gaming: enable signed Secure Boot with Lanzaboote

Browse source
This commit is contained in:
rope 2026-10-05 13:36:43 +01:00
parent b110ae6a54
commit 88d7606d80
3 changed files with 118 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/hardware/FredOS-Gaming.nix
View file

@ -24,9 +24,17 @@
boot.kernelModules = [ "kvm-amd" "ntsync" ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
# Sign systemd-boot and each NixOS generation for UEFI Secure Boot. Keys are
# machine-local and must exist before activation (`sudo sbctl create-keys`).
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
boot.loader.efi.canTouchEfiVariables = true;
environment.systemPackages = [ pkgs.sbctl ];
boot.kernelParams = [ "amdgpu.ppfeaturemask=0xffffffff" "acpi_osi=\"!Windows 2015\"" "amdgpu.freesync_video=1" ];
fileSystems."/" = {