1
0
Fork 0
nix-configuration/modules/system/bootloader.nix

75 lines
2 KiB
Nix
Raw Normal View History

# Configuration options specific to bootloader management.
# SecureBoot is handled via Lanzaboote. See https://github.com/nix-community/lanzaboote
{
config,
lib,
pkgs,
...
}:
# Bootloader
let
cfg = config.aux.system.bootloader;
in
{
options = {
aux.system.bootloader = {
enable = lib.mkOption {
description = "Automatically configures the bootloader. Set to false to configure manually.";
type = lib.types.bool;
default = true;
};
2024-09-08 11:58:56 -04:00
secureboot.enable = lib.mkEnableOption "Enables Secureboot support (please read the README before enabling!).";
tpm2.enable = lib.mkEnableOption "Enables TPM2 support.";
};
};
config = lib.mkIf cfg.enable (
lib.mkMerge [
(lib.mkIf cfg.secureboot.enable {
boot = {
# Enable Secure Boot
bootspec.enable = true;
# Use Lanzaboote in place of systemd-boot.
2024-09-08 11:58:56 -04:00
loader = {
systemd-boot.enable = false;
efi.canTouchEfiVariables = true;
};
lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
};
})
# Set up TPM if enabled. See https://wiki.nixos.org/wiki/TPM
(lib.mkIf (cfg.tpm2.enable) {
2024-06-24 13:08:18 -04:00
boot.initrd = {
2024-09-08 11:58:56 -04:00
# Enable modules and support for TPM auto-unlocking
2024-06-24 13:08:18 -04:00
systemd.enable = true;
availableKernelModules = [ "tpm_crb" ];
kernelModules = [ "tpm_crb" ];
};
# After installing and rebooting, set it up via https://wiki.archlinux.org/title/Systemd-cryptenroll#Trusted_Platform_Module
environment.systemPackages = with pkgs; [ tpm2-tss ];
security.tpm2 = {
enable = true;
pkcs11.enable = true;
tctiEnvironment.enable = true;
};
})
# Use the default systemd-boot bootloader.
(lib.mkIf (!cfg.secureboot.enable) {
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
})
]
);
}