feature(lanzaboote): add support for secure-boot through lanazaboote

Reviewed-on: #86

INSTALLATION.md

@@ -2,8 +2,13 @@
 
 - The installations presented in this repository are always luks encrypted
 - For simplicity I'm using device labels rather than uuids
+- Secure Boot has to be disabled in the firmware, the installer iso isn't signed
 
-1. the partitioning layout should look somewhat like this after the installation
+1. create the partitions with `cfdisk` or `fdisk` (gpt)
+   - `nvme0n1p1`: 2G, type `EFI System`, otherwise the firmware won't find the bootloader
+   - `nvme0n1p2`: the rest, type `Linux filesystem`
+
+   the layout should look somewhat like this after the installation
 ```bash
 NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
 nvme0n1            259:0    0 476.9G  0 disk
@@ -30,12 +35,13 @@ cryptsetup luksOpen /dev/nvme0n1p2 cryptroot
 pvcreate /dev/mapper/cryptroot
 # create a volume group inside
 vgcreate lvmroot /dev/mapper/cryptroot
-# create the swap volume
-lvcreate --size 8G lvmroot --name swap
+# create the swap volume, half the ram (no hibernation)
+lvcreate --size 16G lvmroot --name swap
 # if you desire, create a home volume
 lvcreate --size 150G lvmroot --name home
-# create the root volume
-lvcreate -l 100%FREE lvmroot --name root
+# create the root volume, leave some space in the vg to grow volumes later
+# (lvextend -r -L +50G lvmroot/home works while mounted)
+lvcreate -l 90%FREE lvmroot --name root
 
 # format as usual for root partition
 mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
@@ -47,7 +53,7 @@ mkswap -L "nixswap" /dev/mapper/lvmroot-swap
 # mount root
 mount /dev/disk/by-label/nixroot /mnt
 # mount boot
-mount --mkdir /dev/nvme0n1p1 /mnt/boot
+mount --mkdir /dev/disk/by-label/nixboot /mnt/boot
 # again, if you did the home volume
 mount --mkdir /dev/disk/by-label/nixhome /mnt/home
 # turn on swap
@@ -59,8 +65,7 @@ swapon /dev/disk/by-label/nixswap
 # generate templates and update the hardware-configuration.nix
 nixos-generate-config --root /mnt
 
-# add dm-crypt and dm-mod to the kernelModules
-boot.initrd.kernelModules = [ "dm-crypt" "dm-mod" ];
+# no extra kernelModules needed, luks and lvm load dm_crypt and dm_mod themselves
 
 # add file systems using labels
 fileSystems."/" =
@@ -81,7 +86,13 @@ swapDevices =
   ];
 
 # point the bootloader to the luks device
-boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+boot.initrd.luks.devices."cryptroot" = {
+  device = "/dev/disk/by-label/nixcrypt";
+  # without this fstrim never reaches the ssd
+  allowDiscards = true;
+  # lower latency on nvme
+  bypassWorkqueues = true;
+};
 ```
 
 4. install nixos

flake.lock

@@ -1,5 +1,36 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1789760033,
+        "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -41,6 +72,50 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1790423250,
+        "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.2.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790948122,
+        "narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "0953bb1a609df63013176e3463393f8df993d3ef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1790689126,
@@ -99,14 +174,59 @@
         "type": "github"
       }
     },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789514889,
+        "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "noctalia": "noctalia"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789889921,
+        "narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "systems": {
       "flake": false,
       "locked": {

flake.nix

@@ -11,6 +11,14 @@
       url = "github:noctalia-dev/noctalia-shell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixvim = {
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -52,6 +60,7 @@
         default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
+        krypton = mkHost "krypton";
       };
     };
 }

hosts/argon/configuration.nix

@@ -51,6 +51,8 @@ in
   boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
     device = "/dev/disk/by-uuid/${uuid}";
     keyFile = key name;
+    # trim for ssds, ignored by drives without discard support
+    allowDiscards = true;
   }) drives;
   fileSystems = lib.mapAttrs' (
     name: _:

hosts/argon/hardware-configuration.nix

@@ -22,18 +22,21 @@
     "usb_storage"
     "sd_mod"
   ];
-  boot.initrd.kernelModules = [ "dm-crypt dm-mod" ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/mapper/lvmroot-root";
+    device = "/dev/disk/by-label/nixroot";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/AC1C-20EB";
+    device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
       "fmask=0022"
@@ -42,12 +45,12 @@
   };
 
   fileSystems."/home" = {
-    device = "/dev/mapper/lvmroot-home";
+    device = "/dev/disk/by-label/nixhome";
     fsType = "ext4";
   };
 
   swapDevices = [
-    { device = "/dev/mapper/lvmroot-swap"; }
+    { device = "/dev/disk/by-label/nixswap"; }
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

hosts/krypton/configuration.nix

@@ -0,0 +1,36 @@
+# krypton: framework 13 pro, intel core ultra x7 358H
+
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.framework-intel-core-ultra-series3
+    ../../modules/nixos/appimage.nix
+    ../../modules/nixos/astro.nix
+    ../../modules/nixos/audio.nix
+    ../../modules/nixos/bootloader.nix
+    ../../modules/nixos/certificates.nix
+    ../../modules/nixos/docker.nix
+    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
+    ../../modules/nixos/locales.nix
+    ../../modules/nixos/networking.nix
+    ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia.nix
+    ../../modules/nixos/openssh.nix
+    ../../modules/nixos/packages.nix
+    ../../modules/nixos/protonvpn.nix
+    ../../modules/nixos/sddm.nix
+    ../../modules/nixos/services.nix
+    ../../modules/nixos/settings.nix
+    ../../modules/nixos/steam.nix
+    ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
+  ];
+
+  # host-specific niri config (input devices, laptop binds)
+  home-manager.users.aaron.imports = [ ./niri.nix ];
+
+  networking.hostName = "krypton";
+  system.stateVersion = "26.05"; # don't change
+}

hosts/krypton/hardware-configuration.nix

@@ -0,0 +1,60 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
+
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.npu.enable = true;
+}

hosts/krypton/niri.nix

@@ -0,0 +1,24 @@
+# krypton: framework 13 laptop, the built-in display is auto-configured by niri
+
+{ lib, ... }:
+
+{
+  wayland.windowManager.niri.settings = {
+    input.touchpad = {
+      tap = { };
+      natural-scroll = { };
+    };
+
+    layout.gaps = lib.mkForce 10;
+
+    binds = {
+      "Print".screenshot = { };
+      "Ctrl+Print".screenshot-screen = { };
+      "Mod+Shift+P".power-off-monitors = { };
+
+      # finer brightness steps
+      "XF86MonBrightnessUp".spawn-sh = lib.mkForce "brightnessctl --class=backlight set +1%";
+      "XF86MonBrightnessDown".spawn-sh = lib.mkForce "brightnessctl --class=backlight set 1%-";
+    };
+  };
+}

hosts/neon/configuration.nix

@@ -1,5 +1,15 @@
+# neon: thinkpad t14 gen1 (intel)
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
 {
   imports = [
+    inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t14-intel-gen1
     ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
@@ -25,6 +35,16 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # nixos-hardware's intel module adds intel-compute-runtime-legacy1 (opencl),
+  # which isn't cached and currently fails to build; not needed on neon
+  hardware.graphics.extraPackages = lib.mkForce (
+    with pkgs;
+    [
+      intel-media-driver
+      vpl-gpu-rt
+    ]
+  );
+
   networking.hostName = "neon";
   system.stateVersion = "25.11"; # don't change
 }

hosts/neon/hardware-configuration.nix

@@ -25,7 +25,11 @@
     "dm-snapshot"
     "cryptd"
   ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

modules/nixos/lanzaboote.nix

@@ -0,0 +1,25 @@
+# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
+# installs it signed and writes signed boot entries instead of the nixos module.
+# The keys are created once per host with `sudo sbctl create-keys` before the
+# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  # key management and verification
+  environment.systemPackages = [ pkgs.sbctl ];
+}