feature(boot): add secure-boot support and tpm-unlock to argon

Merge pull request 'fix: do not allow edits to the bootloader' (#92 ) from feature/bootloader_security into main
Reviewed-on: #92
2026-10-03 15:07:13 +02:00 · 2026-10-03 14:11:56 +02:00 · 2026-10-03 14:11:29 +02:00 · 2026-10-03 13:44:31 +02:00 · 2026-10-03 13:39:35 +02:00 · 2026-10-03 13:35:50 +02:00
3 changed files with 11 additions and 0 deletions
@@ -12,6 +12,7 @@
    ../../modules/nixos/data-drives.nix
    ../../modules/nixos/gnupg.nix
    ../../modules/nixos/greetd.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -23,6 +24,7 @@
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
    ../../modules/nixos/thunar.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -32,6 +32,13 @@
  # host-specific niri config (input devices, laptop binds)
  home-manager.users.aaron.imports = [ ./niri.nix ];

+  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
+  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
+
+  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
+  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
+  boot.lanzaboote.settings.console-mode = "6";
+
  networking.hostName = "krypton";
  system.stateVersion = "26.05"; # don't change
 }
@@ -4,6 +4,8 @@
  # set bootloader to systemd
  boot.loader = {
    systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
    efi.canTouchEfiVariables = true;
  };
Author	SHA1	Message	Date
aaron	8c56b00247	feature(boot): add secure-boot support and tpm-unlock to argon	2026-10-03 15:07:13 +02:00
aaron	ff2e4d2f69	Merge pull request 'fix: do not allow edits to the bootloader' (#92 ) from feature/bootloader_security into main Reviewed-on: #92	2026-10-03 14:11:56 +02:00
aaron	318e17ac27	fix: do not allow edits to the bootloader	2026-10-03 14:11:29 +02:00
aaron	c66549f3bf	Merge pull request 'feature(hidpi): adapt sddm and systemd-boot to hidpi display' (#91 ) from feature/krypton_hidpi into main Reviewed-on: #91	2026-10-03 13:44:31 +02:00
aaron	620c415be9	fix: adapt systemd-boot for kryptons hidpi screen by using the right console mode	2026-10-03 13:39:35 +02:00
aaron	472f359f80	fix: adapt kryptons sddm for hidpi using the qt scale factor	2026-10-03 13:35:50 +02:00
aaron	ad494d1209	Merge pull request 'feature(boot): add luks unlock method using TPM+PIN' (#90 ) from feature/tpm_unlock into main Reviewed-on: #90	2026-10-03 13:28:35 +02:00