n0vvvonder/my_nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

enabled secure boot

Browse Source
This commit is contained in:
yaroslav
2026-04-20 17:55:34 +03:00
parent c33db29c04
commit a371861dd5
5 changed files with 142 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+122
View File
@@ -54,6 +54,21 @@
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1765145449,
"narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
"owner": "ipetkov",
"repo": "crane",
"rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"curl-src": {
"flake": false,
"locked": {
@@ -71,6 +86,22 @@
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1761588595,
"narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
@@ -139,6 +170,28 @@
"type": "github"
}
},
"gitignore": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"pre-commit",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"hm-stable": {
"inputs": {
"nixpkgs": [
@@ -255,6 +308,30 @@
"type": "github"
}
},
"lanzaboote": {
"inputs": {
"crane": "crane",
"nixpkgs": [
"nixpkgs-unstable"
],
"pre-commit": "pre-commit",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1765382359,
"narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "v1.0.0",
"repo": "lanzaboote",
"type": "github"
}
},
"libgit2-src": {
"flake": false,
"locked": {
@@ -513,6 +590,29 @@
"type": "github"
}
},
"pre-commit": {
"inputs": {
"flake-compat": "flake-compat",
"gitignore": "gitignore",
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765016596,
"narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"re2-src": {
"flake": false,
"locked": {
@@ -536,6 +636,7 @@
"hm-stable": "hm-stable",
"home-manager": "home-manager",
"impermanence": "impermanence",
"lanzaboote": "lanzaboote",
"lix-module": "lix-module",
"millennium": "millennium",
"nixpkgs-stable": "nixpkgs-stable",
@@ -543,6 +644,27 @@
"zapret-discord-youtube": "zapret-discord-youtube"
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765075567,
"narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
flake.nix
+18 -1
View File
@@ -21,6 +21,11 @@
url = "github:nix-community/home-manager/release-25.05";
inputs.nixpkgs.follows = "nixpkgs-stable";
};
lanzaboote = {
url = "github:nix-community/lanzaboote/v1.0.0";
# Optional but recommended to limit the size of your system closure.
inputs.nixpkgs.follows = "nixpkgs-unstable";
};
asus-numberpad-driver = {
url = "github:asus-linux-drivers/asus-numberpad-driver";
inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -33,7 +38,7 @@
# chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
};
outputs = { self, nixpkgs-unstable, impermanence, home-manager, nixpkgs-stable, hm-stable, millennium, lix-module, asus-numberpad-driver, zapret-discord-youtube, ...}@inputs: {
outputs = { self, nixpkgs-unstable, impermanence, home-manager, nixpkgs-stable, hm-stable, lanzaboote, millennium, lix-module, asus-numberpad-driver, zapret-discord-youtube, ...}@inputs: {
nixosConfigurations = {
Ratchet = nixpkgs-unstable.lib.nixosSystem {
system = "x86_64-linux";
@@ -87,6 +92,18 @@
# ./hosts/generic/zapret.nix
./hosts/Aphelion/dlna.nix
./hosts/Aphelion/Aphelion_misc.nix
lanzaboote.nixosModules.lanzaboote
({ pkgs, lib, ... }: {
# Lanzaboote currently replaces the systemd-boot module.
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
# for now.
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
})
home-manager.nixosModules.home-manager
{
home-manager.useUserPackages = true;
hosts/Aphelion/hardware-Aphelion.nix
-3
View File
@@ -13,9 +13,6 @@
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
boot.supportedFilesystems = [ "zfs" ];
boot.kernelParams = [
"video=DP-1:1920x1080@60"
];
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.zfs.package = pkgs.zfs_2_4;
fileSystems."/" =
hosts/generic/configuration_generic.nix
+1
View File
@@ -17,6 +17,7 @@
git
wget
nfs-utils
sbctl
];
#enable scanner support
hardware.sane.enable = true;
hosts/generic/persistence.nix
+1
View File
@@ -8,6 +8,7 @@
"/var/lib/nixos"
"/var/lib/systemd/coredump"
"/var/lib/systemd/timers"
"/var/lib/sbctl"
"/var/lib/tailscale"
"/var/lib/fprint"
"/var/lib/flatpak"