From beb520a61536f9a9fe8a8d8b200f8a6a7fd3d827 Mon Sep 17 00:00:00 2001 From: aaron Date: Sat, 3 Oct 2026 15:55:36 +0200 Subject: [PATCH 1/2] feature(boot): add secure-boot support and tpm-unlock to neon --- hosts/neon/configuration.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/neon/configuration.nix b/hosts/neon/configuration.nix index 362289d..deab538 100644 --- a/hosts/neon/configuration.nix +++ b/hosts/neon/configuration.nix @@ -17,6 +17,7 @@ ../../modules/nixos/certificates.nix ../../modules/nixos/docker.nix ../../modules/nixos/gnupg.nix + ../../modules/nixos/lanzaboote.nix ../../modules/nixos/locales.nix ../../modules/nixos/networking.nix ../../modules/nixos/niri.nix @@ -28,6 +29,7 @@ ../../modules/nixos/services.nix ../../modules/nixos/settings.nix ../../modules/nixos/steam.nix + ../../modules/nixos/tpm-unlock.nix ../../modules/nixos/users.nix ../../modules/nixos/vial.nix ]; -- 2.52.0 From e35311dfd591fc09908c4bff03042de5478a8838 Mon Sep 17 00:00:00 2001 From: aaron Date: Sat, 3 Oct 2026 16:21:54 +0200 Subject: [PATCH 2/2] chore: update installation guide with secure-boot setup pitfalls --- INSTALLATION.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/INSTALLATION.md b/INSTALLATION.md index 9c929d8..1c7380a 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -149,6 +149,16 @@ $ sudo sbctl enroll-keys Don't force it, either trust exactly those with `--tpm-eventlog` or microsoft's keys with `--microsoft`. Without either, the firmware may not start the device, in the worst case the machine doesn't boot at all. +- Check what sbctl found first, a real option ROM has a PCI device path: +```bash +$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER" +``` +- Paths starting with `0407` (firmware volume) are drivers from the firmware + itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts + exactly those, after a firmware update they may need to be enrolled again + (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`) +- Without an integrated gpu (argon), the gpu's option ROM draws the firmware + setup too, use `--microsoft` there, a refused gpu means no picture at all 6. enable Secure Boot in the firmware and set a firmware password, then check ```bash -- 2.52.0