53 lines
1.4 KiB
Nix
53 lines
1.4 KiB
Nix
{
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
|
|
# secure boot
|
|
lanzaboote = {
|
|
url = "github:nix-community/lanzaboote/v0.4.1";
|
|
|
|
# Optional but recommended to limit the size of your system closure.
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# polymc
|
|
polymc.url = "github:PolyMC/PolyMC";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, lanzaboote, polymc, ... }: {
|
|
nixosConfigurations = {
|
|
laptop = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
|
|
modules = [
|
|
./configuration.nix
|
|
lanzaboote.nixosModules.lanzaboote
|
|
|
|
({ pkgs, lib, ... }: {
|
|
environment.systemPackages = [
|
|
# For debugging and troubleshooting Secure Boot.
|
|
pkgs.sbctl
|
|
];
|
|
|
|
nixpkgs.overlays = [ polymc.overlay ];
|
|
|
|
# Lanzaboote currently replaces the systemd-boot module.
|
|
# This setting is usually set to true in configuration.nix
|
|
# generated at installation time. So we force it to false
|
|
# for now.
|
|
boot = {
|
|
initrd.systemd.enable = true;
|
|
loader.systemd-boot.enable = lib.mkForce false;
|
|
|
|
lanzaboote = {
|
|
enable = true;
|
|
pkiBundle = "/etc/secureboot";
|
|
};
|
|
};
|
|
})
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|