158 lines
4.0 KiB
Nix
158 lines
4.0 KiB
Nix
{
|
|
nixos =
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
inputs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.features.bootloader;
|
|
keyDir = "/etc/secrets/initrd";
|
|
|
|
mkIpString =
|
|
{
|
|
address,
|
|
gateway,
|
|
netmask,
|
|
interface,
|
|
...
|
|
}:
|
|
"${address}::${gateway}:${netmask}::${interface}:none";
|
|
in
|
|
{
|
|
imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
|
|
|
|
options.features.bootloader = {
|
|
enable = lib.mkEnableOption "bootloader";
|
|
|
|
mode = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"systemd-boot"
|
|
"lanzaboote"
|
|
];
|
|
default = "systemd-boot";
|
|
};
|
|
|
|
configurationLimit = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 10;
|
|
};
|
|
|
|
consoleFont = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "ter-v32n";
|
|
};
|
|
|
|
resumeDevice = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
};
|
|
|
|
initrdSsh = {
|
|
enable = lib.mkEnableOption "remote LUKS unlock via ssh in initrd";
|
|
|
|
networkModule = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
|
|
ip = {
|
|
enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
|
|
|
|
address = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
|
|
gateway = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
|
|
netmask = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "255.255.255.0";
|
|
};
|
|
|
|
interface = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
};
|
|
|
|
authorizedKeys = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable (
|
|
lib.mkMerge [
|
|
{
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# lanzaboote inherits editor and configurationLimit from systemd-boot.*
|
|
boot.loader.systemd-boot = {
|
|
editor = false;
|
|
inherit (cfg) configurationLimit;
|
|
};
|
|
|
|
# readable luks prompt on high-dpi panels
|
|
console = {
|
|
earlySetup = true;
|
|
font = cfg.consoleFont;
|
|
packages = [ pkgs.terminus_font ];
|
|
};
|
|
}
|
|
|
|
(lib.mkIf (cfg.mode == "systemd-boot") {
|
|
boot.loader.systemd-boot.enable = true;
|
|
})
|
|
|
|
(lib.mkIf (cfg.mode == "lanzaboote") {
|
|
boot.loader.systemd-boot.enable = lib.mkForce false;
|
|
boot.lanzaboote = {
|
|
enable = true;
|
|
pkiBundle = "/var/lib/sbctl";
|
|
};
|
|
})
|
|
|
|
(lib.mkIf (cfg.resumeDevice != null) {
|
|
boot.resumeDevice = cfg.resumeDevice;
|
|
})
|
|
|
|
(lib.mkIf cfg.initrdSsh.enable {
|
|
boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
|
|
|
|
boot.initrd.availableKernelModules = [ cfg.initrdSsh.networkModule ];
|
|
|
|
boot.kernelParams = lib.mkIf cfg.initrdSsh.ip.enable [
|
|
"ip=${mkIpString cfg.initrdSsh.ip}"
|
|
];
|
|
|
|
boot.initrd.network = {
|
|
enable = true;
|
|
ssh = {
|
|
enable = true;
|
|
port = 22;
|
|
hostKeys = [
|
|
"${keyDir}/ssh_host_rsa_key"
|
|
"${keyDir}/ssh_host_ed25519_key"
|
|
];
|
|
# forward LUKS password prompt to the SSH session
|
|
shell = "/bin/systemd-tty-ask-password-agent";
|
|
inherit (cfg.initrdSsh) authorizedKeys;
|
|
};
|
|
};
|
|
|
|
boot.initrd.systemd.network.networks = lib.mkIf (!cfg.initrdSsh.ip.enable) {
|
|
"10-initrd" = {
|
|
matchConfig.Driver = cfg.initrdSsh.networkModule;
|
|
networkConfig.DHCP = "yes";
|
|
};
|
|
};
|
|
})
|
|
]
|
|
);
|
|
};
|
|
}
|