WIP: Add Lanzaboote Secure Boot for cyprianspitz #150

Draft

fabianhauser wants to merge 2 commits from cyprianspitz-lanzaboote into main

pull from: cyprianspitz-lanzaboote

merge into: qo.is:main

qo.is:main

qo.is:renovate/lock-file-maintenance

qo.is:monitor-backup-jobs

qo.is:update-sops-rekey

qo.is:kanidm-identity-provider

qo.is:storage-metrics-plan

qo.is:nginx-access-log-loki

qo.is:jellyfin

qo.is:microvm-services

qo.is:microvm-experiment

qo.is:test-cloud

qo.is:18-caral

Conversation 0 Commits 2 Files changed 7 +345 -14

fabianhauser commented 2026-07-23 14:42:19 +00:00

Owner

Copy link

Summary

• Replace cyprianspitz's GRUB mirroredBoots dual-ESP setup with systemd-boot + Lanzaboote (UKI signing/UEFI Secure Boot), since Lanzaboote requires systemd-boot and can't coexist with GRUB.
• Add a new qois.lanzaboote module (nixos-modules/lanzaboote) wrapping Lanzaboote: auto-generated/auto-enrolled Secure Boot keys (manual reboot required, no autoReboot), Measured Boot always on (pcrs = [ 0 1 2 3 4 7 ]), and TPM2 autoCryptenroll for LUKS volumes (multi-device, since Lanzaboote's built-in option only supports one).
• Enable it on cyprianspitz, mirroring boot artifacts to both /boot-primary and /boot-secondary via extraEfiSysMountPoints, and auto-enrolling both crypted_system and crypted_data LUKS volumes.
• Document the one-time manual Secure Boot Setup Mode / key enrollment step in nixos-configurations/setup.md.

Test plan

• CI: nix flake check (builds, formatting, and the new nixos-modules VM test lanzaboote)
• Manual, after merge + deploy, during a maintenance window with physical/IPMI access to cyprianspitz:
  • Clear the Platform Key to enter firmware Secure Boot Setup Mode, reboot once, confirm bootctl status reports Secure Boot: enabled (user)
  • Confirm auto-cryptenroll.service and auto-cryptenroll-data.service succeed and both LUKS volumes auto-unlock on a subsequent reboot without the qois.initrd-ssh-unlock passphrase step

## Summary - Replace cyprianspitz's GRUB `mirroredBoots` dual-ESP setup with `systemd-boot` + [Lanzaboote](https://github.com/nix-community/lanzaboote) (UKI signing/UEFI Secure Boot), since Lanzaboote requires systemd-boot and can't coexist with GRUB. - Add a new `qois.lanzaboote` module (`nixos-modules/lanzaboote`) wrapping Lanzaboote: auto-generated/auto-enrolled Secure Boot keys (manual reboot required, no `autoReboot`), Measured Boot always on (`pcrs = [ 0 1 2 3 4 7 ]`), and TPM2 `autoCryptenroll` for LUKS volumes (multi-device, since Lanzaboote's built-in option only supports one). - Enable it on cyprianspitz, mirroring boot artifacts to both `/boot-primary` and `/boot-secondary` via `extraEfiSysMountPoints`, and auto-enrolling both `crypted_system` and `crypted_data` LUKS volumes. - Document the one-time manual Secure Boot Setup Mode / key enrollment step in `nixos-configurations/setup.md`. ## Test plan - [ ] CI: `nix flake check` (builds, formatting, and the new `nixos-modules` VM test `lanzaboote`) - [ ] Manual, after merge + deploy, during a maintenance window with physical/IPMI access to cyprianspitz: - [ ] Clear the Platform Key to enter firmware Secure Boot Setup Mode, reboot once, confirm `bootctl status` reports `Secure Boot: enabled (user)` - [ ] Confirm `auto-cryptenroll.service` and `auto-cryptenroll-data.service` succeed and both LUKS volumes auto-unlock on a subsequent reboot without the `qois.initrd-ssh-unlock` passphrase step

fabianhauser added 1 commit 2026-07-23 14:42:19 +00:00

Add Lanzaboote Secure Boot module and enable it on cyprianspitz ... 2062366bfd

Replaces cyprianspitz's GRUB mirroredBoots dual-ESP setup with
systemd-boot + Lanzaboote (UKI signing, measured boot, and TPM2
autoCryptenroll for both LUKS volumes), since Lanzaboote requires
systemd-boot and can't coexist with GRUB.

fabianhauser added 1 commit 2026-07-23 14:50:58 +00:00

Fix lanzaboote module VM test ... f875f03adc

Sets up a nix profile symlink before switch-to-configuration (lzbt
needs it to parse the generation number for the UKI filename) and
stops waiting on systemd-pcrlock units whose live state doesn't
reflect success in this test environment (a plain oneshot that
already finished, and a firmware-measurement unit with no event log
available under this VM's OVMF).

fabianhauser changed title from Add Lanzaboote Secure Boot for cyprianspitz to WIP: Add Lanzaboote Secure Boot for cyprianspitz 2026-08-20 15:46:13 +00:00

fabianhauser force-pushed cyprianspitz-lanzaboote from f875f03adc to b3f45a2fc1 2026-08-28 11:11:09 +00:00 Compare

All checks were successful

Hide checks

CI / build (push) Successful in 3m57s

Details

CI / deploy (docs-ops.qo.is) (push) Has been skipped

Details

CI / deploy (system-physical) (push) Has been skipped

Details

CI / deploy (system-vm) (push) Has been skipped

Details

CI / deploy-ci (push) Has been skipped

Details

This pull request is marked as a work in progress.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin cyprianspitz-lanzaboote:cyprianspitz-lanzaboote

git switch cyprianspitz-lanzaboote

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

urgent

This issue should be tackled soon

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

question

urgent

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

qo.is/infrastructure!150

No description provided.