From cce1f7241044dc0f53aec5002a81c5d05c18c6df Mon Sep 17 00:00:00 2001 From: Florian RICHER Date: Fri, 3 Jan 2025 23:51:19 +0100 Subject: [PATCH] perso-desktop: Enable secure boot --- flake.lock | 215 +++++++++++++++++++++++++- flake.nix | 7 + hosts/perso-desktop/configuration.nix | 17 +- modules/system/common.nix | 3 + 4 files changed, 232 insertions(+), 10 deletions(-) diff --git a/flake.lock b/flake.lock index 8d023ed..0f68d35 100644 --- a/flake.lock +++ b/flake.lock @@ -27,6 +27,27 @@ "type": "github" } }, + "crane": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717535930, + "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=", + "owner": "ipetkov", + "repo": "crane", + "rev": "55e7754ec31dac78980c8be45f8a28e80e370946", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -196,6 +217,22 @@ } }, "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { "flake": false, "locked": { "lastModified": 1673956053, @@ -212,6 +249,27 @@ } }, "flake-parts": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_2": { "inputs": { "nixpkgs-lib": [ "nur", @@ -252,6 +310,24 @@ "type": "github" } }, + "flake-utils_2": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "format-all": { "flake": false, "locked": { @@ -269,6 +345,28 @@ "type": "github" } }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -289,6 +387,33 @@ "type": "github" } }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "flake-utils": "flake-utils_2", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1718178907, + "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.1", + "repo": "lanzaboote", + "type": "github" + } + }, "nix-doom-emacs": { "inputs": { "doom-emacs": "doom-emacs", @@ -300,7 +425,7 @@ "evil-org-mode": "evil-org-mode", "evil-quick-diff": "evil-quick-diff", "explain-pause-mode": "explain-pause-mode", - "flake-compat": "flake-compat", + "flake-compat": "flake-compat_2", "flake-utils": [ "flake-utils" ], @@ -409,6 +534,22 @@ "type": "github" } }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs_2": { "locked": { "lastModified": 1735471104, @@ -443,7 +584,7 @@ }, "nur": { "inputs": { - "flake-parts": "flake-parts", + "flake-parts": "flake-parts_2", "nixpkgs": "nixpkgs_2", "treefmt-nix": "treefmt-nix" }, @@ -541,6 +682,33 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "revealjs": { "flake": false, "locked": { @@ -562,13 +730,14 @@ "agenix": "agenix", "flake-utils": "flake-utils", "home-manager": "home-manager", + "lanzaboote": "lanzaboote", "nix-doom-emacs": "nix-doom-emacs", "nix-flatpak": "nix-flatpak", "nix-straight": "nix-straight", "nixgl": "nixgl", "nixpkgs": "nixpkgs", "nur": "nur", - "systems": "systems" + "systems": "systems_2" } }, "rotate-text": { @@ -587,6 +756,31 @@ "type": "github" } }, + "rust-overlay": { + "inputs": { + "flake-utils": [ + "lanzaboote", + "flake-utils" + ], + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717813066, + "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "sln-mode": { "flake": false, "locked": { @@ -618,6 +812,21 @@ "type": "github" } }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ diff --git a/flake.nix b/flake.nix index c9cee98..9e9da21 100644 --- a/flake.nix +++ b/flake.nix @@ -47,6 +47,11 @@ inputs.nixpkgs.follows = "nixpkgs"; inputs.flake-utils.follows = "flake-utils"; }; + + lanzaboote = { + url = "github:nix-community/lanzaboote/v0.4.1"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = inputs@{ @@ -54,6 +59,7 @@ flake-utils, home-manager, agenix, + lanzaboote, ... }: let @@ -86,6 +92,7 @@ ./hosts/${s.name}/configuration.nix home-manager.nixosModules.home-manager agenix.nixosModules.default + lanzaboote.nixosModules.lanzaboote { nixpkgs.overlays = overlays; } { home-manager.useGlobalPkgs = true; diff --git a/hosts/perso-desktop/configuration.nix b/hosts/perso-desktop/configuration.nix index 9cbb6b9..387988a 100644 --- a/hosts/perso-desktop/configuration.nix +++ b/hosts/perso-desktop/configuration.nix @@ -2,7 +2,7 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ ... }: +{ lib, ... }: { imports = @@ -14,13 +14,16 @@ ]; # Bootloader. - boot.loader.systemd-boot = { + # For lanzaboote see https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md + boot.loader.systemd-boot.enable = lib.mkForce false; + boot.lanzaboote = { enable = true; - windows = { - "11-pro" = { - title = "Windows 11 Pro"; - efiDeviceHandle = "HD1b"; - }; + pkiBundle = "/var/lib/sbctl"; + }; + boot.loader.systemd-boot.windows = { + "11-pro" = { + title = "Windows 11 Pro"; + efiDeviceHandle = "HD1b"; }; }; boot.loader.efi.canTouchEfiVariables = true; diff --git a/modules/system/common.nix b/modules/system/common.nix index dab2ced..13638cf 100644 --- a/modules/system/common.nix +++ b/modules/system/common.nix @@ -39,6 +39,9 @@ vim nixd + # For debugging and troubleshooting Secure Boot. + sbctl + # Usefull tools to debug gdb lldb