feature(boot): restrict access for /boot to root only

INSTALLATION.md

@@ -102,96 +102,8 @@ nixos-install
 
 ## how to deploy the initial config
 - Don't forget to install the bootloader, if you changed it since `nixos-install`
-- The fresh install has no flakes and no git yet, a temporary shell is enough
-- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
-  `nixos-rebuild` from re-executing a newer version of itself, which can fail
-  against the older systemd of the fresh install (only needed once)
-- Set a password for the user before rebooting, `users.nix` doesn't set one
 ```bash
-$ export NIX_CONFIG="experimental-features = nix-command flakes"
+$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
-$ nix-shell -p git
-$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
-$ sudo passwd aaron
-```
-
-## how to enable secure boot
-Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
-Do this after the initial config is deployed and boots.
-
-1. create the keys, before the first rebuild with the lanzaboote module
-```bash
-# the keys end up in /var/lib/sbctl, they never leave the host
-$ sudo nix run nixpkgs#sbctl -- create-keys
-```
-
-2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
-```bash
-$ sudo nixos-rebuild switch --flake .#host_name
-# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
-# are not, lanzaboote checks them by hash
-$ sudo sbctl verify
-```
-
-3. reboot once with Secure Boot still disabled, to make sure the new entries boot
-
-4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
-```bash
-# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
-$ sudo sbctl status
-```
-
-5. enroll the keys
-```bash
-# only our own keys, no microsoft keys
-$ sudo sbctl enroll-keys
-```
-- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
-  Don't force it, either trust exactly those with `--tpm-eventlog` or
-  microsoft's keys with `--microsoft`. Without either, the firmware may not
-  start the device, in the worst case the machine doesn't boot at all.
-- Check what sbctl found first, a real option ROM has a PCI device path:
-```bash
-$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
-```
-- Paths starting with `0407` (firmware volume) are drivers from the firmware
-  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
-  exactly those, after a firmware update they may need to be enrolled again
-  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
-- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
-  setup too, use `--microsoft` there, a refused gpu means no picture at all
-- On the Framework (krypton), keep the firmware's built-in OEM certificates
-  with `--firmware-builtin`, vendor firmware updates may need them. If an
-  update fails or the keys were enrolled without them, erase the keys in the
-  firmware again (Setup Mode) and re-enroll:
-```bash
-$ sudo sbctl enroll-keys --firmware-builtin
-```
-
-6. enable Secure Boot in the firmware and set a firmware password, then check
-```bash
-$ bootctl status | grep "Secure Boot"   # enabled (user)
-$ sudo sbctl status                     # Secure Boot: ✓ Enabled
-```
-- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
-- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
-
-## how to unlock the disk with the tpm (laptops)
-Needs Secure Boot first. The TPM releases the key only with the PIN and while
-the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
-
-1. enroll the TPM with a PIN as an additional key slot
-```bash
-# asks for the current passphrase, then the new PIN
-$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
-```
-
-2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
-
-- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
-  state changed. After a firmware update that's expected, otherwise investigate
-  before typing the passphrase. To re-enroll:
-```bash
-$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
 ```
 
 ## how to upgrade the system

README.md

@@ -10,7 +10,7 @@ My personal NixOS configurations.
 ├── hosts
 │   ├── argon # desktop
 │   ├── neon # laptop
-│   └── krypton # second laptop
+│   └── default # test vm
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)

flake.lock

@@ -1,36 +1,5 @@
 {
   "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1789760033,
-        "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -72,30 +41,6 @@
         "type": "github"
       }
     },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit": "pre-commit",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1790423250,
-        "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v1.2.0",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": [
@@ -174,59 +119,15 @@
         "type": "github"
       }
     },
-    "pre-commit": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1789514889,
-        "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
-        "lanzaboote": "lanzaboote",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "noctalia": "noctalia"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1789889921,
-        "narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "systems": {
       "flake": false,
       "locked": {

flake.nix

@@ -11,10 +11,6 @@
       url = "github:noctalia-dev/noctalia-shell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v1.2.0";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -57,6 +53,7 @@
     in
     {
       nixosConfigurations = {
+        default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
         krypton = mkHost "krypton";

hosts/argon/configuration.nix

@@ -12,7 +12,6 @@
     ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
-    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -24,7 +23,6 @@
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/thunar.nix
-    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

hosts/default/configuration.nix

@@ -0,0 +1,139 @@
+# 0x29a nixos config
+
+{ pkgs, ... }:
+
+{
+  # use flakes
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  # configure bootloader
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    efiSupport = true;
+  };
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelParams = [
+    "quiet"
+    "console.ttyS0,115200n8" # allow terminals on serial console
+  ];
+  # plymouth boot eye candy
+  boot.initrd.systemd.enable = true;
+  boot.plymouth.enable = true;
+  boot.plymouth.theme = "spinner";
+  # use latest kernel
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # guest agent for proxmox
+  services.qemuGuest.enable = true;
+
+  # networking
+  networking.hostName = "nixos";
+  networking.networkmanager.enable = true;
+
+  # time zone.
+  time.timeZone = "Europe/Amsterdam";
+  # select internationalisation properties
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "de_CH-latin1";
+  };
+
+  # window manager configs
+  services.xserver = {
+    enable = true;
+    xkb.layout = "ch";
+    xkb.options = "eurosign:e,caps:escape";
+
+    windowManager.qtile = {
+      enable = true;
+      extraPackages =
+        python3Packages: with python3Packages; [
+          qtile-extras
+        ];
+    };
+  };
+
+  environment.pathsToLink = [ "/libexec" ];
+  environment.variables.EDITOR = "vim";
+
+  # enable sound
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+
+  # define a user account
+  users.users.aaron = {
+    isNormalUser = true;
+    group = "users";
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    packages = with pkgs; [
+      tree
+      fastfetch
+    ];
+  };
+
+  # browser
+  programs.firefox.enable = true;
+
+  # zsh config
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    autosuggestions.enable = true;
+    ohMyZsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "sudo"
+      ];
+      theme = "agnoster";
+    };
+  };
+
+  # system packages
+  environment.systemPackages = with pkgs; [
+    vim
+    neovim
+    git
+    ghostty
+    kitty
+    wget
+    gnupg
+  ];
+
+  # Some programs need SUID wrappers
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # enable the OpenSSH daemon
+  services.openssh.enable = true;
+
+  # firewall configs
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+
+  # install state version
+  system.stateVersion = "25.05"; # Don't change
+}

hosts/default/hardware-configuration.nix

@@ -0,0 +1,60 @@
+# 0x29a nixos hardware configuration
+
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  # boot and initrd configs
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+
+  # file systems
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
+
+  # enable dhcp on all interfaces
+  networking.useDHCP = lib.mkDefault true;
+
+  # set host arch
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/default/home.nix

@@ -0,0 +1,79 @@
+{ pkgs, ... }:
+
+{
+  # user config
+  home.username = "aaron";
+  home.homeDirectory = "/home/aaron";
+
+  # packages
+  home.packages = with pkgs; [
+    fastfetch
+    zip
+    xz
+    unzip
+    p7zip
+    jq
+    mtr
+    iperf3
+    dnsutils
+    ldns
+    socat
+    nmap
+    cowsay
+    file
+    which
+    tree
+    zstd
+    gnupg
+    btop
+    iotop
+    iftop
+    strace
+    lsof
+    sysstat
+    lm_sensors
+    ethtool
+    pciutils
+    usbutils
+  ];
+
+  # configure git
+  programs.git.settings = {
+    enable = true;
+    userName = "aaron";
+    userEmail = "aaron@0x29a.ch";
+  };
+
+  programs.zsh = {
+    enable = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "sudo"
+        "python"
+        "ansible"
+      ];
+      theme = "agnoster";
+    };
+  };
+
+  ## deploy qtile config
+  #home.file."qtile-config" = {
+  #  target = ".config/qtile/config.py";
+  #  source = "${inputs.qtile-config}/qtile_config/config.py";
+  #  force = true;
+  #};
+
+  home.sessionVariables = {
+    EDITOR = "vim";
+  };
+
+  # enable home manager
+  programs.home-manager.enable = true;
+
+  # don't change
+  home.stateVersion = "25.05";
+}

hosts/krypton/configuration.nix

@@ -12,7 +12,6 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -24,7 +23,6 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
-    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
@@ -32,13 +30,6 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
-  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
-  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
-
-  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
-  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
-  boot.lanzaboote.settings.console-mode = "6";
-
   networking.hostName = "krypton";
   system.stateVersion = "26.05"; # don't change
 }

hosts/neon/configuration.nix

@@ -17,7 +17,6 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -29,7 +28,6 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
-    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

modules/nixos/bootloader.nix

@@ -4,8 +4,6 @@
   # set bootloader to systemd
   boot.loader = {
     systemd-boot.enable = true;
-    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
-    systemd-boot.editor = false;
     efi.canTouchEfiVariables = true;
   };
 

modules/nixos/lanzaboote.nix

@@ -1,25 +0,0 @@
-# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
-# installs it signed and writes signed boot entries instead of the nixos module.
-# The keys are created once per host with `sudo sbctl create-keys` before the
-# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
-
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
-
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
-  # key management and verification
-  environment.systemPackages = [ pkgs.sbctl ];
-}

modules/nixos/tpm-unlock.nix

@@ -1,8 +0,0 @@
-# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
-# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
-# so this needs lanzaboote.nix. Enrolled once per host with
-# `systemd-cryptenroll`, see INSTALLATION.md.
-
-{
-  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
-}