Put lanzaboote as an option that will only be enabled if secureboot is

true in a options.nix file
jwyuen · Jul 10, 2024 · 7450e65 · 7450e65
1 parent c63d139
commit 7450e65
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 4 deletions.
diff --git a/nix-config/hosts/nix-deskstar/options.nix b/nix-config/hosts/nix-deskstar/options.nix
@@ -80,4 +80,7 @@ in {
 
   # Power profiles daemon
   powerprofiles = false;
+
+  # Use lanzaboote for secureboot
+  secureboot = false;
 }
diff --git a/nix-config/hosts/nix-lappy/options.nix b/nix-config/hosts/nix-lappy/options.nix
@@ -81,4 +81,7 @@ in {
 
   # Power profiles daemon
   powerprofiles = true;
+
+  # Use lanzaboote for secureboot
+  secureboot = true;
 }
diff --git a/nix-config/hosts/nix-vm/options.nix b/nix-config/hosts/nix-vm/options.nix
@@ -80,5 +80,8 @@ in {
 
   # Power profiles daemon
   powerprofiles = false;
+
+  # Use lanzaboote for secureboot
+  secureboot = false;
 }
 
diff --git a/nix-config/system/boot.nix b/nix-config/system/boot.nix
@@ -1,13 +1,31 @@
-{ pkgs, config, lib, ... }:
+{ pkgs, config, lib, host, ... }:
 
+let inherit (import ../hosts/${host}/options.nix) secureboot; in
 {
+
+
   # Bootloader
-  #boot.loader.systemd-boot.enable = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
+  #boot.loader.systemd-boot.enable = lib.mkForce false;
+  #boot.loader.systemd-boot.enable = mkMerge 
+  boot.loader.systemd-boot = lib.mkMerge [
+    (lib.mkIf (secureboot == true)
+      {
+        enable = lib.mkForce false;
+      }
+    )
+    (lib.mkIf (secureboot == false)
+      {
+        enable = true;
+      }
+    )
+  ];
+
+  boot.lanzaboote = lib.mkIf (secureboot == true) {
     enable = true;
     pkiBundle = "/etc/secureboot";
   };
+
+
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernel.sysctl = { "vm.max_map_count" = 2147483642; };
   boot.tmp.useTmpfs = true;