Merge remote-tracking branch 'origin/main' into chore/remove-default-host

# Conflicts:
#	hosts/default/hardware-configuration.nix

INSTALLATION.md

@@ -102,62 +102,10 @@ nixos-install
 
 ## how to deploy the initial config
 - Don't forget to install the bootloader, if you changed it since `nixos-install`
-- The fresh install has no flakes and no git yet, a temporary shell is enough
-- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
-  `nixos-rebuild` from re-executing a newer version of itself, which can fail
-  against the older systemd of the fresh install (only needed once)
-- Set a password for the user before rebooting, `users.nix` doesn't set one
 ```bash
-$ export NIX_CONFIG="experimental-features = nix-command flakes"
+$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
-$ nix-shell -p git
-$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
-$ sudo passwd aaron
 ```
 
-## how to enable secure boot
-Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
-Do this after the initial config is deployed and boots.
-
-1. create the keys, before the first rebuild with the lanzaboote module
-```bash
-# the keys end up in /var/lib/sbctl, they never leave the host
-$ sudo nix run nixpkgs#sbctl -- create-keys
-```
-
-2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
-```bash
-$ sudo nixos-rebuild switch --flake .#host_name
-# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
-# are not, lanzaboote checks them by hash
-$ sudo sbctl verify
-```
-
-3. reboot once with Secure Boot still disabled, to make sure the new entries boot
-
-4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
-```bash
-# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
-$ sudo sbctl status
-```
-
-5. enroll the keys
-```bash
-# only our own keys, no microsoft keys
-$ sudo sbctl enroll-keys
-```
-- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
-  Don't force it, either trust exactly those with `--tpm-eventlog` or
-  microsoft's keys with `--microsoft`. Without either, the firmware may not
-  start the device, in the worst case the machine doesn't boot at all.
-
-6. enable Secure Boot in the firmware and set a firmware password, then check
-```bash
-$ bootctl status | grep "Secure Boot"   # enabled (user)
-$ sudo sbctl status                     # Secure Boot: ✓ Enabled
-```
-- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
-- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
-
 ## how to upgrade the system
 ```bash
 $ cd /path/to/repo

flake.lock

@@ -1,36 +1,5 @@
 {
   "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1789760033,
-        "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -72,30 +41,6 @@
         "type": "github"
       }
     },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit": "pre-commit",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1790423250,
-        "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v1.2.0",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": [
@@ -174,59 +119,15 @@
         "type": "github"
       }
     },
-    "pre-commit": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1789514889,
-        "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
-        "lanzaboote": "lanzaboote",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "noctalia": "noctalia"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1789889921,
-        "narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "systems": {
       "flake": false,
       "locked": {

flake.nix

@@ -11,10 +11,6 @@
       url = "github:noctalia-dev/noctalia-shell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v1.2.0";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/krypton/configuration.nix

@@ -12,7 +12,6 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix

modules/nixos/lanzaboote.nix

@@ -1,25 +0,0 @@
-# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
-# installs it signed and writes signed boot entries instead of the nixos module.
-# The keys are created once per host with `sudo sbctl create-keys` before the
-# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
-
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
-
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
-  # key management and verification
-  environment.systemPackages = [ pkgs.sbctl ];
-}