lanzaboote/nix/modules/lanzaboote.nix

58 lines
1.7 KiB
Nix

{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.boot.lanzaboote;
sbctlWithPki = pkgs.sbctl.override {
databasePath = "/tmp/pki";
};
in
{
options.boot.lanzaboote = {
enable = mkEnableOption "Enable the LANZABOOTE";
enrollKeys = mkEnableOption "Automatic enrollment of the keys using sbctl";
pkiBundle = mkOption {
type = types.nullOr types.path;
description = "PKI bundle containg db, PK, KEK";
};
publicKeyFile = mkOption {
type = types.path;
default = "${cfg.pkiBundle}/keys/db/db.pem";
description = "Public key to sign your boot files";
};
privateKeyFile = mkOption {
type = types.path;
default = "${cfg.pkiBundle}/keys/db/db.key";
description = "Private key to sign your boot files";
};
package = mkOption {
type = types.package;
default = pkgs.lanzatool;
description = "Lanzatool package";
};
};
config = mkIf cfg.enable {
boot.bootspec = {
enable = true;
extensions."lanzaboote"."osRelease" = config.environment.etc."os-release".source;
};
boot.loader.supportsInitrdSecrets = true;
boot.loader.external = {
enable = true;
installHook = pkgs.writeShellScript "bootinstall" ''
${optionalString cfg.enrollKeys ''
mkdir -p /tmp/pki
cp -r ${cfg.pkiBundle}/* /tmp/pki
${sbctlWithPki}/bin/sbctl enroll-keys --yes-this-might-brick-my-machine
''}
${cfg.package}/bin/lanzatool install \
--public-key ${cfg.publicKeyFile} \
--private-key ${cfg.privateKeyFile} \
${config.boot.loader.efi.efiSysMountPoint} \
/nix/var/nix/profiles/system-*-link
'';
};
};
}