Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 aaron
|
1796969682
|
||
|
aaron
|
21e7e68ad4
|
||
|
aaron
|
499f15ce56
|
||
|
aaron
|
2e32024350
|
+1
-82
@@ -102,89 +102,8 @@ nixos-install
|
||||
|
||||
## how to deploy the initial config
|
||||
- Don't forget to install the bootloader, if you changed it since `nixos-install`
|
||||
- The fresh install has no flakes and no git yet, a temporary shell is enough
|
||||
- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
|
||||
`nixos-rebuild` from re-executing a newer version of itself, which can fail
|
||||
against the older systemd of the fresh install (only needed once)
|
||||
- Set a password for the user before rebooting, `users.nix` doesn't set one
|
||||
```bash
|
||||
$ export NIX_CONFIG="experimental-features = nix-command flakes"
|
||||
$ nix-shell -p git
|
||||
$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
|
||||
$ sudo passwd aaron
|
||||
```
|
||||
|
||||
## how to enable secure boot
|
||||
Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
|
||||
Do this after the initial config is deployed and boots.
|
||||
|
||||
1. create the keys, before the first rebuild with the lanzaboote module
|
||||
```bash
|
||||
# the keys end up in /var/lib/sbctl, they never leave the host
|
||||
$ sudo nix run nixpkgs#sbctl -- create-keys
|
||||
```
|
||||
|
||||
2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
|
||||
```bash
|
||||
$ sudo nixos-rebuild switch --flake .#host_name
|
||||
# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
|
||||
# are not, lanzaboote checks them by hash
|
||||
$ sudo sbctl verify
|
||||
```
|
||||
|
||||
3. reboot once with Secure Boot still disabled, to make sure the new entries boot
|
||||
|
||||
4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
|
||||
```bash
|
||||
# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
|
||||
$ sudo sbctl status
|
||||
```
|
||||
|
||||
5. enroll the keys
|
||||
```bash
|
||||
# only our own keys, no microsoft keys
|
||||
$ sudo sbctl enroll-keys
|
||||
```
|
||||
- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
|
||||
Don't force it, either trust exactly those with `--tpm-eventlog` or
|
||||
microsoft's keys with `--microsoft`. Without either, the firmware may not
|
||||
start the device, in the worst case the machine doesn't boot at all.
|
||||
- Check what sbctl found first, a real option ROM has a PCI device path:
|
||||
```bash
|
||||
$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
|
||||
```
|
||||
- Paths starting with `0407` (firmware volume) are drivers from the firmware
|
||||
itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
|
||||
exactly those, after a firmware update they may need to be enrolled again
|
||||
(disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
|
||||
- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
|
||||
setup too, use `--microsoft` there, a refused gpu means no picture at all
|
||||
|
||||
6. enable Secure Boot in the firmware and set a firmware password, then check
|
||||
```bash
|
||||
$ bootctl status | grep "Secure Boot" # enabled (user)
|
||||
$ sudo sbctl status # Secure Boot: ✓ Enabled
|
||||
```
|
||||
- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
|
||||
- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
|
||||
|
||||
## how to unlock the disk with the tpm (laptops)
|
||||
Needs Secure Boot first. The TPM releases the key only with the PIN and while
|
||||
the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
|
||||
|
||||
1. enroll the TPM with a PIN as an additional key slot
|
||||
```bash
|
||||
# asks for the current passphrase, then the new PIN
|
||||
$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
```
|
||||
|
||||
2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
|
||||
|
||||
- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
|
||||
state changed. After a firmware update that's expected, otherwise investigate
|
||||
before typing the passphrase. To re-enroll:
|
||||
```bash
|
||||
$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
|
||||
```
|
||||
|
||||
## how to upgrade the system
|
||||
|
||||
Generated
-99
@@ -1,36 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1789760033,
|
||||
"narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
@@ -72,30 +41,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"lanzaboote": {
|
||||
"inputs": {
|
||||
"crane": "crane",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"pre-commit": "pre-commit",
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790423250,
|
||||
"narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
|
||||
"owner": "nix-community",
|
||||
"repo": "lanzaboote",
|
||||
"rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "v1.2.0",
|
||||
"repo": "lanzaboote",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -174,59 +119,15 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789514889,
|
||||
"narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager",
|
||||
"lanzaboote": "lanzaboote",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixvim": "nixvim",
|
||||
"noctalia": "noctalia"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789889921,
|
||||
"narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
||||
@@ -11,10 +11,6 @@
|
||||
url = "github:noctalia-dev/noctalia-shell";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
lanzaboote = {
|
||||
url = "github:nix-community/lanzaboote/v1.2.0";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixos-hardware = {
|
||||
url = "github:NixOS/nixos-hardware";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
../../modules/nixos/data-drives.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/greetd.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -24,7 +23,6 @@
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/thunar.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -24,7 +23,6 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
@@ -32,13 +30,6 @@
|
||||
# host-specific niri config (input devices, laptop binds)
|
||||
home-manager.users.aaron.imports = [ ./niri.nix ];
|
||||
|
||||
# hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
|
||||
services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
|
||||
|
||||
# bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
|
||||
# what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
|
||||
boot.lanzaboote.settings.console-mode = "6";
|
||||
|
||||
networking.hostName = "krypton";
|
||||
system.stateVersion = "26.05"; # don't change
|
||||
}
|
||||
|
||||
@@ -17,7 +17,6 @@
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -29,7 +28,6 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -4,8 +4,6 @@
|
||||
# set bootloader to systemd
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
# no kernel command line editing at the boot menu (e.g. init=/bin/sh)
|
||||
systemd-boot.editor = false;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
|
||||
# installs it signed and writes signed boot entries instead of the nixos module.
|
||||
# The keys are created once per host with `sudo sbctl create-keys` before the
|
||||
# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
|
||||
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
|
||||
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
|
||||
boot.lanzaboote = {
|
||||
enable = true;
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
|
||||
# key management and verification
|
||||
environment.systemPackages = [ pkgs.sbctl ];
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
|
||||
# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
|
||||
# so this needs lanzaboote.nix. Enrolled once per host with
|
||||
# `systemd-cryptenroll`, see INSTALLATION.md.
|
||||
|
||||
{
|
||||
boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
|
||||
}
|
||||
Reference in New Issue
Block a user