diff --git a/flake.lock b/flake.lock index 73dee47..d26e771 100644 --- a/flake.lock +++ b/flake.lock @@ -23,6 +23,27 @@ "type": "github" } }, + "crane": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717535930, + "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=", + "owner": "ipetkov", + "repo": "crane", + "rev": "55e7754ec31dac78980c8be45f8a28e80e370946", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "fizz-strat": { "inputs": { "flake-utils": "flake-utils_2", @@ -79,6 +100,22 @@ } }, "flake-compat_3": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_4": { "locked": { "lastModified": 1688025799, "narHash": "sha256-ktpB4dRtnksm9F5WawoIkEneh1nrEvuxb5lJFt1iOyw=", @@ -93,7 +130,7 @@ "type": "github" } }, - "flake-compat_4": { + "flake-compat_5": { "flake": false, "locked": { "lastModified": 1696426674, @@ -131,6 +168,27 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "flake-programs-sqlite": { "inputs": { "nixpkgs": [ @@ -171,6 +229,24 @@ "inputs": { "systems": "systems_10" }, + "locked": { + "lastModified": 1694529238, + "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_11": { + "inputs": { + "systems": "systems_11" + }, "locked": { "lastModified": 1681202837, "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=", @@ -280,11 +356,11 @@ "systems": "systems_6" }, "locked": { - "lastModified": 1705309234, - "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -298,11 +374,11 @@ "systems": "systems_7" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1705309234, + "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", "type": "github" }, "original": { @@ -313,14 +389,14 @@ }, "flake-utils_9": { "inputs": { - "systems": "systems_9" + "systems": "systems_8" }, "locked": { - "lastModified": 1694529238, - "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -345,6 +421,28 @@ } }, "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "gitignore_2": { "inputs": { "nixpkgs": [ "pre-commit-hooks", @@ -409,9 +507,36 @@ "url": "https://git@git.lix.systems/lix-project/hydra" } }, - "lix": { + "lanzaboote": { "inputs": { + "crane": "crane", "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", + "flake-utils": "flake-utils_5", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay_2" + }, + "locked": { + "lastModified": 1718178907, + "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.1", + "repo": "lanzaboote", + "type": "github" + } + }, + "lix": { + "inputs": { + "flake-compat": "flake-compat_3", "nix2container": "nix2container", "nixpkgs": [ "nixpkgs" @@ -435,7 +560,7 @@ }, "lix-module": { "inputs": { - "flake-utils": "flake-utils_5", + "flake-utils": "flake-utils_6", "flakey-profile": "flakey-profile", "lix": [ "lix" @@ -460,12 +585,12 @@ }, "mpdiscord": { "inputs": { - "flake-utils": "flake-utils_6", + "flake-utils": "flake-utils_7", "naersk": "naersk_2", "nixpkgs": [ "nixpkgs" ], - "rust-overlay": "rust-overlay_2" + "rust-overlay": "rust-overlay_3" }, "locked": { "lastModified": 1726106249, @@ -653,11 +778,11 @@ }, "nixos-apple-silicon": { "inputs": { - "flake-compat": "flake-compat_3", + "flake-compat": "flake-compat_4", "nixpkgs": [ "nixpkgs" ], - "rust-overlay": "rust-overlay_3" + "rust-overlay": "rust-overlay_4" }, "locked": { "lastModified": 1725418254, @@ -721,6 +846,22 @@ } }, "nixpkgs-stable": { + "locked": { + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-stable_2": { "locked": { "lastModified": 1720386169, "narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=", @@ -753,12 +894,12 @@ }, "poetry2nix-src": { "inputs": { - "flake-utils": "flake-utils_8", + "flake-utils": "flake-utils_9", "nix-github-actions": "nix-github-actions_2", "nixpkgs": [ "nixpkgs" ], - "systems": "systems_8", + "systems": "systems_9", "treefmt-nix": "treefmt-nix_2" }, "locked": { @@ -791,15 +932,42 @@ "type": "github" } }, - "pre-commit-hooks_2": { + "pre-commit-hooks-nix": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], "gitignore": "gitignore", "nixpkgs": [ + "lanzaboote", "nixpkgs" ], "nixpkgs-stable": "nixpkgs-stable" }, + "locked": { + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, + "pre-commit-hooks_2": { + "inputs": { + "flake-compat": "flake-compat_5", + "gitignore": "gitignore_2", + "nixpkgs": [ + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable_2" + }, "locked": { "lastModified": 1725513492, "narHash": "sha256-tyMUA6NgJSvvQuzB7A1Sf8+0XCHyfSPRx/b00o6K0uo=", @@ -842,6 +1010,7 @@ "flake-utils": "flake-utils_4", "home-manager": "home-manager", "hydra": "hydra", + "lanzaboote": "lanzaboote", "lix": "lix", "lix-module": "lix-module", "mpdiscord": "mpdiscord", @@ -853,7 +1022,7 @@ "poetry2nix-src": "poetry2nix-src", "pre-commit-hooks": "pre-commit-hooks_2", "rom-properties": "rom-properties", - "rust-overlay": "rust-overlay_4", + "rust-overlay": "rust-overlay_5", "treefmt-nix": "treefmt-nix_3", "upd8r": "upd8r" } @@ -882,7 +1051,32 @@ }, "rust-overlay_2": { "inputs": { - "flake-utils": "flake-utils_7", + "flake-utils": [ + "lanzaboote", + "flake-utils" + ], + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717813066, + "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_3": { + "inputs": { + "flake-utils": "flake-utils_8", "nixpkgs": [ "mpdiscord", "nixpkgs" @@ -902,7 +1096,7 @@ "type": "github" } }, - "rust-overlay_3": { + "rust-overlay_4": { "flake": false, "locked": { "lastModified": 1686795910, @@ -918,7 +1112,7 @@ "type": "github" } }, - "rust-overlay_4": { + "rust-overlay_5": { "inputs": { "nixpkgs": [ "nixpkgs" @@ -938,9 +1132,9 @@ "type": "github" } }, - "rust-overlay_5": { + "rust-overlay_6": { "inputs": { - "flake-utils": "flake-utils_10", + "flake-utils": "flake-utils_11", "nixpkgs": [ "upd8r", "nixpkgs" @@ -1006,6 +1200,21 @@ "type": "github" } }, + "systems_11": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "systems_2": { "locked": { "lastModified": 1681028828, @@ -1106,8 +1315,9 @@ "type": "github" }, "original": { - "id": "systems", - "type": "indirect" + "owner": "nix-systems", + "repo": "default", + "type": "github" } }, "systems_9": { @@ -1120,9 +1330,8 @@ "type": "github" }, "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" + "id": "systems", + "type": "indirect" } }, "treefmt-nix": { @@ -1190,12 +1399,12 @@ }, "upd8r": { "inputs": { - "flake-utils": "flake-utils_9", + "flake-utils": "flake-utils_10", "naersk": "naersk_4", "nixpkgs": [ "nixpkgs" ], - "rust-overlay": "rust-overlay_5" + "rust-overlay": "rust-overlay_6" }, "locked": { "lastModified": 1710542743, diff --git a/flake.nix b/flake.nix index f1550db..a7882eb 100644 --- a/flake.nix +++ b/flake.nix @@ -69,6 +69,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; inputs.nixos-hardware.url = "github:NixOS/nixos-hardware"; + inputs.lanzaboote = { + url = "github:nix-community/lanzaboote/v0.4.1"; + inputs.nixpkgs.follows = "nixpkgs"; + }; outputs = { diff --git a/hardware/penumbra.nix b/hardware/penumbra.nix index fe4534a..5a8fb41 100644 --- a/hardware/penumbra.nix +++ b/hardware/penumbra.nix @@ -12,6 +12,7 @@ imports = [ "${modulesPath}/installer/scan/not-detected.nix" flakes.nixos-hardware.nixosModules.framework-13-7040-amd + flakes.lanzaboote.nixosModules.lanzaboote ]; boot.initrd.availableKernelModules = [ @@ -69,6 +70,15 @@ echo 'Xcursor.theme: breeze_cursors' | ${pkgs.xorg.xrdb}/bin/xrdb -nocpp -merge ''; + boot.loader.systemd-boot.enable = lib.mkForce false; + + boot.lanzaboote = { + enable = true; + pkiBundle = "/etc/secureboot"; + }; + + environment.systemPackages = [ pkgs.sbctl ]; + deployment.tags = [ "workstation" ]; deployment.allowLocalDeployment = true; };