1.4 KiB
1.4 KiB
Fabian's Dotfiles
System Setup
🐈⬛
Secure Boot & TPM Disk Unlock
See lanzaboote documentation for more information on how to enable secure boot.
- Create secure boot keys before switching to the system configuration:
sudo sbctl create-keys - After applying the system configuration, verify signatures:
sudo sbctl verify/boot/EFI/nixos/kernel*.efiis not supposed to be signed.
- Activate enrollment of new Secure Boot key in the UEFI:
systemctl reboot --firmware-setup- Depends on vendor, see lanzaboote docs
- Boot linux, run
sudo sbctl enroll-keys --microsoft- Keeps microsoft keys - some vendor firmware and Windows dual boot require this.
- Activate secure boot:
systemctl reboot --firmware-setup - Boot your system and verify that a secure boot worked with:
bootctl status - After enabling secure boot, enroll the boot PCR measurement based LUKS unlock:
dotfiles-enroll-tpm
- With
nixos-rebuild {switch|boot}, new EFI files will be automatically signed. - In case your firmware or boot process changes, you need to insert the luks password manually.
- After a successful boot, you can re-enroll with
dotfiles-enroll-tpm.
- After a successful boot, you can re-enroll with