rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-06-06 01:28:46 +02:00
Code Issues Projects Releases Packages Wiki Activity

re-enabled impermanence and secure boot

Browse source
This commit is contained in:
Rouven Seifert 2023-08-02 20:28:22 +02:00
parent 085e064e46
commit a7a6c8e320
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
3 changed files with 45 additions and 35 deletions
hosts/thinkpad
default.nix

38
hosts/thinkpad/default.nix
View file

@ -16,13 +16,12 @@
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
# for now.
# loader.systemd-boot.enable = lib.mkForce false;
loader.systemd-boot.enable = true;
# lanzaboote = {
# enable = true;
# pkiBundle = "/etc/secureboot";
# configurationLimit = 10;
# };
loader.systemd-boot.enable = lib.mkForce false;
lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
configurationLimit = 10;
};
extraModulePackages = [
config.boot.kernelPackages.v4l2loopback.out
];
@ -62,19 +61,19 @@
# ];
};
#environment.persistence."/nix/persist/system" = {
# directories = [
# "/etc/nixos" # bind mounted from /nix/persist/system/etc/nixos to /etc/nixos
# "/etc/ssh"
# "/etc/secureboot"
# "/root/.ssh"
# ];
# files = [
# "/etc/machine-id"
# ];
#};
environment.persistence."/nix/persist/system" = {
directories = [
"/etc/nixos" # bind mounted from /nix/persist/system/etc/nixos to /etc/nixos
"/etc/ssh"
"/etc/secureboot"
"/root/.ssh"
];
files = [
"/etc/machine-id"
];
};
# impermanence fixes
#sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ];
sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ];
sops.gnupg.sshKeyPaths = lib.mkForce [ ];
time.timeZone = "Europe/Berlin";
@ -158,6 +157,7 @@
openFirewall = false;
};
fwupd.enable = true; # firmware updates
zfs.autoScrub.enable = true;
};
programs.steam.enable = true; # putting steam in here cause in home manager it doesn't work