infra

installation with disko-install

HOST=asmara
MOUNT=/mnt
sudo sh <<EOF
umask 077
mkdir -p /run/disko ${MOUNT}/run/disko
printf "%s" "$(
    nix run nixpkgs#sops -- \
        --decrypt --extract "[\"luks\"][\"${HOST}\"]" infra.yml
)" | tee ${MOUNT}/run/disko/luks-password >/run/disko/luks-password
EOF

installation with nixos-anywhere

HOST=asmara
IP=192.168.1.22
nixos-anywhere \
    --flake ".#${HOST}" \
    --disk-encryption-keys /tmp/luks-password <(
        nix run nixpkgs#sops -- -d --extract "[\"luks\"][\"${HOST}\"]" infra.yml
    ) "root@${IP}"

secureboot setup

Put the system in secureboot setup mode.

HOST=asmara
sbctl status # verify that setup mode is active
sbctl create-keys # generate PKI bundle
sudo sbctl enroll-keys -m # enroll PKI bundle and Microsoft keys
sudo nixos-rebuild switch --flake .#${HOST} --option fallback true
sbctl verify # verify file signing