rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gaming: enable signed Secure Boot with Lanzaboote

Browse source
This commit is contained in:
rope 2026-10-05 13:36:43 +01:00
parent b110ae6a54
commit 88d7606d80
3 changed files with 118 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

101
flake.lock generated
View file

@ -68,6 +68,21 @@
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1789760033,
"narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
"owner": "ipetkov",
"repo": "crane",
"rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"firefox-gnome-theme": {
"flake": false,
"locked": {
@ -100,6 +115,22 @@
"type": "github"
}
},
"flake-compat_2": {
"flake": false,
"locked": {
"lastModified": 1767039857,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
"owner": "NixOS",
"repo": "flake-compat",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
"type": "github"
},
"original": {
"owner": "NixOS",
"repo": "flake-compat",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib"
@ -193,6 +224,30 @@
"type": "github"
}
},
"lanzaboote": {
"inputs": {
"crane": "crane",
"nixpkgs": [
"nixpkgs"
],
"pre-commit": "pre-commit",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1790423250,
"narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "v1.2.0",
"repo": "lanzaboote",
"type": "github"
}
},
"loupe": {
"inputs": {
"nixpkgs": [
@ -215,7 +270,7 @@
},
"nix-cachyos-kernel": {
"inputs": {
"flake-compat": "flake-compat",
"flake-compat": "flake-compat_2",
"flake-parts": "flake-parts",
"nixpkgs": "nixpkgs"
},
@ -338,6 +393,28 @@
"type": "github"
}
},
"pre-commit": {
"inputs": {
"flake-compat": "flake-compat",
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1789514889,
"narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
"owner": "cachix",
"repo": "git-hooks.nix",
"rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "git-hooks.nix",
"type": "github"
}
},
"proton-cachyos-nix": {
"inputs": {
"nixpkgs": "nixpkgs_3"
@ -375,6 +452,7 @@
"root": {
"inputs": {
"home-manager": "home-manager",
"lanzaboote": "lanzaboote",
"loupe": "loupe",
"nix-cachyos-kernel": "nix-cachyos-kernel",
"nixpkgs": "nixpkgs_2",
@ -385,6 +463,27 @@
"zen-browser": "zen-browser"
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1789889921,
"narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"stardew-tracker": {
"inputs": {
"nixpkgs": [

10
flake.nix
View file

@ -16,6 +16,11 @@
nix-cachyos-kernel.url = "github:xddxdd/nix-cachyos-kernel/release";
lanzaboote = {
url = "github:nix-community/lanzaboote/v1.2.0";
inputs.nixpkgs.follows = "nixpkgs";
};
proton-cachyos-nix.url = "github:powerofthe69/proton-cachyos-nix";
loupe = {
@ -93,7 +98,10 @@
};
nixosConfigurations = {
FredOS-Gaming = mkHost "FredOS-Gaming" [ ./hosts/hardware/FredOS-Gaming.nix ];
FredOS-Gaming = mkHost "FredOS-Gaming" [
inputs.lanzaboote.nixosModules.lanzaboote
./hosts/hardware/FredOS-Gaming.nix
];
FredOS-Mediaserver = mkHost "FredOS-Mediaserver" [ ./hosts/hardware/FredOS-Mediaserver.nix ];
FredOS-Macbook = mkHost "FredOS-Macbook" [ ./hosts/hardware/FredOS-Macbook.nix ];
FredOS-Kayla = mkHost "FredOS-Kayla" [ ./hosts/hardware/FredOS-Kayla.nix ];

10
hosts/hardware/FredOS-Gaming.nix
View file

@ -24,9 +24,17 @@
boot.kernelModules = [ "kvm-amd" "ntsync" ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
# Sign systemd-boot and each NixOS generation for UEFI Secure Boot. Keys are
# machine-local and must exist before activation (`sudo sbctl create-keys`).
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
boot.loader.efi.canTouchEfiVariables = true;
environment.systemPackages = [ pkgs.sbctl ];
boot.kernelParams = [ "amdgpu.ppfeaturemask=0xffffffff" "acpi_osi=\"!Windows 2015\"" "amdgpu.freesync_video=1" ];
fileSystems."/" = {