Secure boot and wsl #10

Merged
DashieTM merged 5 commits from main into main 2025-05-02 10:16:15 +02:00
8 changed files with 28 additions and 42 deletions
Showing only changes of commit c57a9984c1 - Show all commits

View file

@ -13,13 +13,13 @@ in {
#(modulesPath + "/misc/nixpkgs/read-only.nix") #(modulesPath + "/misc/nixpkgs/read-only.nix")
]; ];
wsl.enable = config.conf.wsl;
# Bootloader. # Bootloader.
boot = { boot = lib.mkIf (!config.conf.wsl) {
consoleLogLevel = 0; consoleLogLevel = 0;
boot.loader.systemd-boot.enable = lib.mkForce false; lanzaboote = lib.mkIf config.conf.secureBoot {
boot.lanzaboote = lib.mkIf config.conf.secureBoot {
enable = true; enable = true;
pkiBundle = "/var/lib/sbctl"; pkiBundle = "/var/lib/sbctl";
}; };
@ -29,7 +29,7 @@ in {
enable = enable =
if config.conf.secureBoot if config.conf.secureBoot
then lib.mkForce false then lib.mkForce false
else if config.conf.useSystemdBootloadertrue else if config.conf.useSystemdBootloader
then true then true
else false; else false;
configurationLimit = 5; configurationLimit = 5;
@ -74,7 +74,6 @@ in {
# Enable the X11 windowing system. # Enable the X11 windowing system.
services = { services = {
lorri.enable = true; lorri.enable = true;
flatpak.enable = true;
xserver.enable = true; xserver.enable = true;
fstrim.enable = lib.mkDefault true; fstrim.enable = lib.mkDefault true;
# Enable sound with pipewire. # Enable sound with pipewire.

View file

@ -237,7 +237,6 @@ For package lists, please check the individual modules, as the lists can be long
- drives : A drive configuration module - drives : A drive configuration module
- firefox: Enables and configures firefox (extensions and settings) - firefox: Enables and configures firefox (extensions and settings)
- fish: Enables and configures fish shell - fish: Enables and configures fish shell
- flatpak : Installs and enables declarative flatpak
- gaming : Configures gaming related features (launchers, gamemode) - gaming : Configures gaming related features (launchers, gamemode)
- git : Git key and config module - git : Git key and config module
- gnome_services : Gnome services for minimal enviroments -> Window managers etc - gnome_services : Gnome services for minimal enviroments -> Window managers etc

View file

@ -4,10 +4,11 @@
inputs = { inputs = {
unstable.url = "github:NixOs/nixpkgs/nixos-unstable"; unstable.url = "github:NixOs/nixpkgs/nixos-unstable";
stable.url = "github:NixOs/nixpkgs/nixos-24.11"; stable.url = "github:NixOs/nixpkgs/nixos-24.11";
nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
nur.url = "github:nix-community/NUR"; nur.url = "github:nix-community/NUR";
lanzaboote = {
nix-flatpak = { url = "github:nix-community/lanzaboote/v0.4.2";
url = "github:gmodena/nix-flatpak"; inputs.nixpkgs.follows = "unstable";
}; };
home-manager = { home-manager = {

View file

@ -26,10 +26,10 @@ in {
keyboard = null; keyboard = null;
file.".local/share/flatpak/overrides/global".text = '' #file.".local/share/flatpak/overrides/global".text = lib.mkForce ''
[Context] # [Context]
filesystems=xdg-config/gtk-3.0;xdg-config/gtk-4.0 # filesystems=xdg-config/gtk-3.0;xdg-config/gtk-4.0
''; #'';
}; };
programs.nix-index = { programs.nix-index = {

View file

@ -43,6 +43,8 @@
}, },
mods ? { mods ? {
nixos = [ nixos = [
inputs.lanzaboote.nixosModules.lanzaboote
inputs.nixos-wsl.nixosModules.default
inputs.home-manager.nixosModules.home-manager inputs.home-manager.nixosModules.home-manager
inputs.stylix.nixosModules.stylix inputs.stylix.nixosModules.stylix
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
@ -62,7 +64,6 @@
inputs.hyprdock.homeManagerModules.default inputs.hyprdock.homeManagerModules.default
inputs.hyprland.homeManagerModules.default inputs.hyprland.homeManagerModules.default
inputs.reset.homeManagerModules.default inputs.reset.homeManagerModules.default
inputs.nix-flatpak.homeManagerModules.nix-flatpak
inputs.sops-nix.homeManagerModules.sops inputs.sops-nix.homeManagerModules.sops
inputs.dashvim.homeManagerModules.dashvim inputs.dashvim.homeManagerModules.dashvim
../modules ../modules

View file

@ -20,6 +20,14 @@
''; '';
}; };
wsl = lib.mkOption {
default = false;
example = true;
description = ''
Runs Nix in wsl
'';
};
secureBoot = lib.mkOption { secureBoot = lib.mkOption {
default = false; default = false;
example = true; example = true;

View file

@ -149,7 +149,7 @@
config = ( config = (
lib.optionalAttrs (options ? fileSystems) { lib.optionalAttrs (options ? fileSystems) {
fileSystems = lib.mkIf (config.mods.drives.variant == "manual") ( fileSystems = lib.mkIf (config.mods.drives.variant == "manual" && !config.conf.wsl) (
builtins.listToAttrs ( builtins.listToAttrs (
map ( map (
{ {
@ -196,7 +196,7 @@
} }
); );
swapDevices = lib.mkIf (config.mods.drives.useSwap && config.mods.drives.variant == "manual") [ swapDevices = lib.mkIf (config.mods.drives.useSwap && config.mods.drives.variant == "manual" && !config.conf.wsl) [
{device = "/dev/disk/by-label/SWAP";} {device = "/dev/disk/by-label/SWAP";}
]; ];

View file

@ -7,37 +7,15 @@
}: { }: {
options.mods.flatpak = { options.mods.flatpak = {
enable = lib.mkOption { enable = lib.mkOption {
default = true; default = false;
example = false; example = true;
type = lib.types.bool; type = lib.types.bool;
description = "Enables the flatpak package manager"; description = "Enables the flatpak package manager";
}; };
additional_packages = lib.mkOption {
default = [];
example = [];
type = with lib.types; listOf str;
description = "Flatpak packages";
};
}; };
config = lib.mkIf config.mods.flatpak.enable ( config = lib.mkIf config.mods.flatpak.enable (
lib.optionalAttrs (options ? services.flatpak.remote) { lib.optionalAttrs (options ? environment.systemPackages) {
environment.systemPackages = [pkgs.flatpak]; environment.systemPackages = [pkgs.flatpak];
services.flatpak.remotes = lib.mkOptionDefault [
{
name = "flathub-stable";
location = "https://dl.flathub.org/repo/flathub.flatpakrepo";
}
];
services.flatpak.uninstallUnmanaged = true;
}
// lib.optionalAttrs (options ? services.flatpak.packages) {
services.flatpak.packages =
[
# fallback if necessary, but generally avoided as nix is superior :)
# default flatseal installation since flatpak permissions are totally not a broken idea
"com.github.tchx84.Flatseal"
]
++ config.mods.flatpak.additional_packages;
} }
); );
} }