dotfiles

  1## Boot Configuration ##
  2{inputs, ...}: {
  3  flake.modules.nixos.boot = {
  4    config,
  5    lib,
  6    pkgs,
  7    ...
  8  }: let
  9    inherit
 10      (lib)
 11      mkDefault
 12      mkForce
 13      mkIf
 14      mkMerge
 15      mkOption
 16      optional
 17      types
 18      ;
 19    scheme = config.system.scheme;
 20  in {
 21    imports = [inputs.boot.nixosModules.lanzaboote];
 22
 23    options.system.scheme = mkOption {
 24      description = "Supported Boot Firmware Scheme";
 25      type = types.nullOr (
 26        types.enum [
 27          "mbr"
 28          "efi"
 29          "secure"
 30        ]
 31      );
 32      default = "efi";
 33    };
 34
 35    config =
 36      {warnings = optional (scheme == null) "Boot firmware is unknown";}
 37      // mkIf (scheme != null) (mkMerge [
 38        {
 39          boot = {
 40            tmp.cleanOnBoot = true;
 41
 42            # Debug
 43            consoleLogLevel = 3;
 44            initrd.verbose = false;
 45            # Plymouth
 46            plymouth.enable = true;
 47            kernelParams = [
 48              "quiet"
 49              "splash"
 50              "boot.shell_on_fail"
 51              "rd.systemd.show_status=false"
 52              "rd.udev.log_level=3"
 53              "udev.log_priority=3"
 54            ];
 55
 56            loader = {
 57              timeout = mkDefault 0;
 58              efi.canTouchEfiVariables = true;
 59              grub.enable = mkDefault false;
 60              systemd-boot.enable = mkDefault false;
 61            };
 62          };
 63
 64          specialisation.recovery.configuration = {
 65            system.nixos.label = "special.recovery";
 66            boot = {
 67              initrd.verbose = mkForce true;
 68              plymouth.enable = mkForce false;
 69            };
 70          };
 71        }
 72
 73        ## GRUB MBR Boot Loader ##
 74        (mkIf (scheme == "mbr") {
 75          boot.loader.grub = {
 76            enable = mkForce true;
 77            device = "nodev";
 78            efiSupport = true;
 79            zfsSupport = true;
 80            useOSProber = true;
 81            splashImage = null;
 82            extraConfig = "set timeout_style=hidden";
 83          };
 84        })
 85
 86        ## SYSTEMD EFI Boot Loader ##
 87        (mkIf (scheme == "efi") {
 88          boot.loader.systemd-boot = {
 89            enable = mkForce true;
 90            editor = false;
 91            configurationLimit = 15;
 92          };
 93        })
 94
 95        ## EFI Secure Boot ##
 96        (mkIf (scheme == "secure") rec {
 97          boot.lanzaboote = {
 98            enable = true;
 99            configurationLimit = 15;
100            pkiBundle = "/etc/secureboot";
101            autoGenerateKeys.enable = true;
102            autoEnrollKeys = {
103              enable = true;
104              autoReboot = true;
105            };
106          };
107
108          environment = {
109            systemPackages = [pkgs.sbctl];
110            persist.directories = [boot.lanzaboote.pkiBundle];
111          };
112        })
113      ]);
114  };
115}