62 lines
1.9 KiB
Nix
62 lines
1.9 KiB
Nix
{ config, pkgs, ... }:
|
|
{
|
|
# boot.plymouth.enable = true;
|
|
boot.loader = {
|
|
grub = {
|
|
enable = true;
|
|
efiSupport = true;
|
|
useOSProber = true;
|
|
efiInstallAsRemovable = true;
|
|
device = "nodev";
|
|
enableCryptodisk = true;
|
|
|
|
# GRUB is signed directly with the sbctl db key. Do not use the shim
|
|
# verifier here; it would reject the NixOS kernel/initrd chain before
|
|
# GRUB can load it.
|
|
extraGrubInstallArgs = [
|
|
"--modules=tpm"
|
|
"--disable-shim-lock"
|
|
];
|
|
|
|
# Sign the freshly installed GRUB and NixOS kernels before rebooting.
|
|
# Key creation/enrollment is intentionally a one-time manual step and
|
|
# is skipped until /var/lib/sbctl/keys/db/db.key exists.
|
|
extraInstallCommands = ''
|
|
if [ -r /var/lib/sbctl/keys/db/db.key ]; then
|
|
for file in \
|
|
"${config.boot.loader.efi.efiSysMountPoint}/EFI/NixOS-boot/grubx64.efi" \
|
|
"${config.boot.loader.efi.efiSysMountPoint}/EFI/BOOT/BOOTX64.EFI"; do
|
|
if [ -f "$file" ]; then
|
|
${pkgs.sbctl}/bin/sbctl sign -s "$file" || true
|
|
fi
|
|
done
|
|
|
|
if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
|
|
${pkgs.findutils}/bin/find \
|
|
"${config.boot.loader.efi.efiSysMountPoint}/kernels" \
|
|
-type f -name '*-bzImage' \
|
|
-exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
|
|
fi
|
|
fi
|
|
'';
|
|
|
|
# extraInstallCommands = ''
|
|
# mkdir -p /boot/EFI/BOOT
|
|
|
|
# cp -f /boot/EFI/NixOS-boot/grubx64.efi /boot/EFI/BOOT/BOOTX64.EFI
|
|
# '';
|
|
|
|
default = "saved";
|
|
extraConfig = ''
|
|
GRUB_SAVEDEFAULT=true
|
|
'';
|
|
};
|
|
# efi.canTouchEfiVariables = true;
|
|
efi.efiSysMountPoint = "/boot";
|
|
};
|
|
|
|
boot.initrd.systemd.enable = true;
|
|
boot.initrd.systemd.emergencyAccess = true;
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
}
|