Modules/Bootloader: Update lanzaboote config (enable automatic key generation and enrollment)

2026-08-31 20:30:27 +02:00
parent daf7eb8d75
commit 76c28f65ff
1 changed files with 7 additions and 0 deletions
@@ -42,6 +42,13 @@ in {

      boot.lanzaboote = {
        enable = true;
+        autoGenerateKeys.enable = true;
+
+        # WARN: Needs persistent /var/lib/auto-cryptenroll
+        autoEnrollKeys = {
+          enable = true;
+          includeMicrosoftKeys = true;
+        };

        # WARN: Make sure to persist this if using impermanence!
        pkiBundle = "/var/lib/sbctl";