dotfiles

My PC Dotfiles & Website
git clone https://github.com/maydayv7/dotfiles

boot.nix (2817B)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
## Boot Configuration ##
{inputs, ...}: {
  flake.modules.nixos.boot = {
    config,
    lib,
    pkgs,
    ...
  }: let
    inherit
      (lib)
      mkDefault
      mkForce
      mkIf
      mkMerge
      mkOption
      optional
      types
      ;
    scheme = config.system.scheme;
  in {
    imports = [inputs.boot.nixosModules.lanzaboote];

    options.system.scheme = mkOption {
      description = "Supported Boot Firmware Scheme";
      type = types.nullOr (
        types.enum [
          "mbr"
          "efi"
          "secure"
        ]
      );
      default = "efi";
    };

    config =
      {warnings = optional (scheme == null) "Boot firmware is unknown";}
      // mkIf (scheme != null) (mkMerge [
        {
          boot = {
            tmp.cleanOnBoot = true;

            # Debug
            consoleLogLevel = 3;
            initrd.verbose = false;
            # Plymouth
            plymouth.enable = true;
            kernelParams = [
              "quiet"
              "splash"
              "boot.shell_on_fail"
              "rd.systemd.show_status=false"
              "rd.udev.log_level=3"
              "udev.log_priority=3"
            ];

            loader = {
              timeout = mkDefault 0;
              efi.canTouchEfiVariables = true;
              grub.enable = mkDefault false;
              systemd-boot.enable = mkDefault false;
            };
          };

          specialisation.recovery.configuration = {
            system.nixos.label = "special.recovery";
            boot = {
              initrd.verbose = mkForce true;
              plymouth.enable = mkForce false;
            };
          };
        }

        ## GRUB MBR Boot Loader ##
        (mkIf (scheme == "mbr") {
          boot.loader.grub = {
            enable = mkForce true;
            device = "nodev";
            efiSupport = true;
            zfsSupport = true;
            useOSProber = true;
            splashImage = null;
            extraConfig = "set timeout_style=hidden";
          };
        })

        ## SYSTEMD EFI Boot Loader ##
        (mkIf (scheme == "efi") {
          boot.loader.systemd-boot = {
            enable = mkForce true;
            editor = false;
            configurationLimit = 15;
          };
        })

        ## EFI Secure Boot ##
        (mkIf (scheme == "secure") rec {
          boot.lanzaboote = {
            enable = true;
            configurationLimit = 15;
            pkiBundle = "/etc/secureboot";
            autoGenerateKeys.enable = true;
            autoEnrollKeys = {
              enable = true;
              autoReboot = true;
            };
          };

          environment = {
            systemPackages = [pkgs.sbctl];
            persist.directories = [boot.lanzaboote.pkiBundle];
          };
        })
      ]);
  };
}