From 5d6cdef1b39698bdac5248a99ed1024d83eedbeb Mon Sep 17 00:00:00 2001 From: Anthony Rodriguez Date: Sun, 20 Oct 2024 00:05:19 +0200 Subject: [PATCH] repo: add lanzaboote for laptop --- flake.lock | 235 +++++++++++++++++++++++++++++++++++-- flake.nix | 7 ++ hosts/default.nix | 2 +- system/core/lanzaboote.nix | 26 ++++ 4 files changed, 256 insertions(+), 14 deletions(-) create mode 100644 system/core/lanzaboote.nix diff --git a/flake.lock b/flake.lock index 3eb305a..0ddfab5 100644 --- a/flake.lock +++ b/flake.lock @@ -61,6 +61,27 @@ "type": "github" } }, + "crane": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717535930, + "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=", + "owner": "ipetkov", + "repo": "crane", + "rev": "55e7754ec31dac78980c8be45f8a28e80e370946", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -77,6 +98,22 @@ "type": "github" } }, + "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -116,6 +153,27 @@ } }, "flake-parts_3": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_4": { "inputs": { "nixpkgs-lib": "nixpkgs-lib_2" }, @@ -133,7 +191,7 @@ "type": "github" } }, - "flake-parts_4": { + "flake-parts_5": { "inputs": { "nixpkgs-lib": "nixpkgs-lib_3" }, @@ -205,7 +263,25 @@ }, "flake-utils_3": { "inputs": { - "systems": "systems_5" + "systems": "systems_3" + }, + "locked": { + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_4": { + "inputs": { + "systems": "systems_6" }, "locked": { "lastModified": 1710146030, @@ -238,6 +314,28 @@ "type": "github" } }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "harfbuzz": { "flake": false, "locked": { @@ -318,6 +416,33 @@ "type": "github" } }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_3", + "flake-utils": "flake-utils_2", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1718178907, + "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.1", + "repo": "lanzaboote", + "type": "github" + } + }, "libpng": { "flake": false, "locked": { @@ -382,7 +507,7 @@ "nvf", "nixpkgs" ], - "rust-overlay": "rust-overlay" + "rust-overlay": "rust-overlay_2" }, "locked": { "lastModified": 1714571717, @@ -400,11 +525,11 @@ }, "niri": { "inputs": { - "flake-parts": "flake-parts_3", + "flake-parts": "flake-parts_4", "niri-stable": "niri-stable", "niri-unstable": "niri-unstable", "nixpkgs": "nixpkgs_4", - "nixpkgs-stable": "nixpkgs-stable", + "nixpkgs-stable": "nixpkgs-stable_2", "xwayland-satellite-stable": "xwayland-satellite-stable", "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, @@ -546,6 +671,22 @@ } }, "nixpkgs-stable": { + "locked": { + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-stable_2": { "locked": { "lastModified": 1728909085, "narHash": "sha256-WLxED18lodtQiayIPDE5zwAfkPJSjHJ35UhZ8h3cJUg=", @@ -691,8 +832,8 @@ }, "nvf": { "inputs": { - "flake-parts": "flake-parts_4", - "flake-utils": "flake-utils_2", + "flake-parts": "flake-parts_5", + "flake-utils": "flake-utils_3", "mnw": "mnw", "nil": "nil", "nixpkgs": "nixpkgs_6", @@ -799,7 +940,7 @@ "plugin-vim-vsnip": "plugin-vim-vsnip", "plugin-which-key": "plugin-which-key", "rnix-lsp": "rnix-lsp", - "systems": "systems_3" + "systems": "systems_4" }, "locked": { "lastModified": 1728378979, @@ -2455,6 +2596,33 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "rnix-lsp": { "inputs": { "naersk": "naersk", @@ -2483,17 +2651,43 @@ "flake-parts": "flake-parts_2", "flake-utils": "flake-utils", "home-manager": "home-manager_2", + "lanzaboote": "lanzaboote", "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_5", "nvf": "nvf", "plasma-manager": "plasma-manager", - "systems": "systems_4", + "systems": "systems_5", "treefmt-nix": "treefmt-nix", "wezterm": "wezterm" } }, "rust-overlay": { + "inputs": { + "flake-utils": [ + "lanzaboote", + "flake-utils" + ], + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717813066, + "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_2": { "inputs": { "flake-utils": [ "nvf", @@ -2520,7 +2714,7 @@ "type": "github" } }, - "rust-overlay_2": { + "rust-overlay_3": { "inputs": { "nixpkgs": [ "wezterm", @@ -2587,6 +2781,21 @@ } }, "systems_4": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_5": { "locked": { "lastModified": 1689347949, "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", @@ -2601,7 +2810,7 @@ "type": "github" } }, - "systems_5": { + "systems_6": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -2651,14 +2860,14 @@ }, "wezterm": { "inputs": { - "flake-utils": "flake-utils_3", + "flake-utils": "flake-utils_4", "freetype2": "freetype2", "harfbuzz": "harfbuzz", "libpng": "libpng", "nixpkgs": [ "nixpkgs" ], - "rust-overlay": "rust-overlay_2", + "rust-overlay": "rust-overlay_3", "zlib": "zlib" }, "locked": { diff --git a/flake.nix b/flake.nix index 55a8963..06b8cad 100644 --- a/flake.nix +++ b/flake.nix @@ -66,6 +66,13 @@ url = "github:sodiboo/niri-flake"; }; + lanzaboote = { + url = "github:nix-community/lanzaboote/v0.4.1"; + + # Optional but recommended to limit the size of your system closure. + inputs.nixpkgs.follows = "nixpkgs"; + }; + treefmt-nix.url = "github:numtide/treefmt-nix"; nixos-hardware.url = "github:NixOS/nixos-hardware"; diff --git a/hosts/default.nix b/hosts/default.nix index 1a5fe59..f7a739b 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -18,11 +18,11 @@ laptop ++ [ ./vamos + "${mod}/core/lanzaboote.nix" "${mod}/services/greetd.nix" "${mod}/programs/niri" "${mod}/services/gnome.nix" - self.nixosModules.style ({pkgs, ...}: { diff --git a/system/core/lanzaboote.nix b/system/core/lanzaboote.nix new file mode 100644 index 0000000..d6cc73d --- /dev/null +++ b/system/core/lanzaboote.nix @@ -0,0 +1,26 @@ +{ + pkgs, + lib, + inputs, + ... +}: { + imports = [ + inputs.lanzaboote.nixosModules.lanzaboote + ]; + + environment.systemPackages = [ + # For debugging and troubleshooting Secure Boot. + pkgs.sbctl + ]; + + # Lanzaboote currently replaces the systemd-boot module. + # This setting is usually set to true in configuration.nix + # generated at installation time. So we force it to false + # for now. + boot.loader.systemd-boot.enable = lib.mkForce false; + + boot.lanzaboote = { + enable = true; + pkiBundle = "/etc/secureboot"; + }; +}