NyxErinys/Nix-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

enable lanzaboote

Browse source
This commit is contained in:
nyxerinys 2026-10-02 18:33:05 -05:00
parent 31c4db1e15
commit d223de2604
5 changed files with 65 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

67
hosts/apollo/boot.nix
View file

@ -1,34 +1,53 @@
{ pkgs, lib, inputs, ... }:
{
boot.initrd = {
supportedFilesystems = [ "ext4" "zfs" ];
availableKernelModules = [ "hid_apple" ];
systemd = {
imports = [
lanzaboote.nixosModules.lanzaboote
];
boot = {
#Bootloader
environment.systemPackages = [ pkgs.sbctl ];
lanzaboote = {
enable = true;
fido2.enable = true;
emergencyAccess = true;
mounts = [
{
what = "/dev/mapper/zfs-keys";
where = "/keys";
type = "ext4";
options = "ro";
}
];
pkiBundle = "/var/lib/sbctl";
autoGenerateKeys.enable = true;
autoEnrollKeys.enable = true;
};
luks.fido2Support = false;
loader.efi.canTouchEfiVariables = true;
loader.systemd-boot.enable = lib.mkForce false;
# Luks Decryption for ZFS
initrd = {
supportedFilesystems = [ "ext4" "zfs" ];
availableKernelModules = [ "hid_apple" ];
systemd = {
enable = true;
fido2.enable = true;
emergencyAccess = true;
mounts = [
{
what = "/dev/mapper/zfs-keys";
where = "/keys";
type = "ext4";
options = "ro";
}
];
};
luks.fido2Support = false;
luks.devices."zfs-keys" = {
device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
crypttabExtraOpts = [ "fido2-device=auto" ];
};
systemd.services."zfs-import-nix-root" = {
wants = [ "keys.mount" ];
after = [ "keys.mount" ];
};
luks.devices."zfs-keys" = {
device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
crypttabExtraOpts = [ "fido2-device=auto" ];
};
systemd.services."zfs-import-nix-root" = {
wants = [ "keys.mount" ];
after = [ "keys.mount" ];
};
};
systemd.services."zfs-import-nix-main" = {