feature(software): add signal-desktop electron app

chore: update installation guide
Merge pull request 'feature(boot): add secure-boot and tpm-unlock to neon' (#94 ) from feature/neon_secureboot into main
2026-10-04 10:29:30 +02:00 · 2026-10-03 22:49:18 +02:00 · 2026-10-03 16:22:29 +02:00 · 2026-10-03 16:21:54 +02:00 · 2026-10-03 15:55:36 +02:00 · 2026-10-03 15:48:06 +02:00
4 changed files with 22 additions and 0 deletions
@@ -149,6 +149,23 @@ $ sudo sbctl enroll-keys
  Don't force it, either trust exactly those with `--tpm-eventlog` or
  microsoft's keys with `--microsoft`. Without either, the firmware may not
  start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```

 6. enable Secure Boot in the firmware and set a firmware password, then check
 ```bash
@@ -12,6 +12,7 @@
    ../../modules/nixos/data-drives.nix
    ../../modules/nixos/gnupg.nix
    ../../modules/nixos/greetd.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -23,6 +24,7 @@
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
    ../../modules/nixos/thunar.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -17,6 +17,7 @@
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -28,6 +29,7 @@
    ../../modules/nixos/services.nix
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -7,6 +7,7 @@
    discord
    fastfetch
    keepassxc
+    signal-desktop
    teamspeak6-client
    typst
    zathura
Author	SHA1	Message	Date
aaron	e602ba9df1	feature(software): add signal-desktop electron app	2026-10-04 10:29:30 +02:00
aaron	863c496400	chore: update installation guide	2026-10-03 22:49:18 +02:00
aaron	20bf806666	Merge pull request 'feature(boot): add secure-boot and tpm-unlock to neon' (#94 ) from feature/neon_secureboot into main Reviewed-on: #94	2026-10-03 16:22:29 +02:00
aaron	e35311dfd5	chore: update installation guide with secure-boot setup pitfalls	2026-10-03 16:21:54 +02:00
aaron	beb520a615	feature(boot): add secure-boot support and tpm-unlock to neon	2026-10-03 15:55:36 +02:00
aaron	4eb3e27f8b	Merge pull request 'feature(boot): add secure-boot support and tpm-unlock to argon' (#93 ) from feature/argon_secureboot into main Reviewed-on: #93	2026-10-03 15:48:06 +02:00
aaron	8c56b00247	feature(boot): add secure-boot support and tpm-unlock to argon	2026-10-03 15:07:13 +02:00
aaron	ff2e4d2f69	Merge pull request 'fix: do not allow edits to the bootloader' (#92 ) from feature/bootloader_security into main Reviewed-on: #92	2026-10-03 14:11:56 +02:00
aaron	c66549f3bf	Merge pull request 'feature(hidpi): adapt sddm and systemd-boot to hidpi display' (#91 ) from feature/krypton_hidpi into main Reviewed-on: #91	2026-10-03 13:44:31 +02:00