wow

modules/mizukios/features/system/boot.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
   # boot.plymouth.enable = true;
   boot.loader = {
@@ -10,6 +10,36 @@
       device = "nodev";
       enableCryptodisk = true;
 
+      # GRUB is signed directly with the sbctl db key.  Do not use the shim
+      # verifier here; it would reject the NixOS kernel/initrd chain before
+      # GRUB can load it.
+      extraGrubInstallArgs = [
+        "--modules=tpm"
+        "--disable-shim-lock"
+      ];
+
+      # Sign the freshly installed GRUB and NixOS kernels before rebooting.
+      # Key creation/enrollment is intentionally a one-time manual step and
+      # is skipped until /var/lib/sbctl/keys/db/db.key exists.
+      extraInstallCommands = ''
+        if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+          for file in \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/NixOS-boot/grubx64.efi" \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/BOOT/BOOTX64.EFI"; do
+            if [ -f "$file" ]; then
+              ${pkgs.sbctl}/bin/sbctl sign -s "$file" || true
+            fi
+          done
+
+          if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+            ${pkgs.findutils}/bin/find \
+              "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+              -type f -name '*-bzImage' \
+              -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
+          fi
+        fi
+      '';
+
       # extraInstallCommands = ''
       #   mkdir -p /boot/EFI/BOOT