diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/by-name/bo/boot/module.nix | 33 |
1 files changed, 17 insertions, 16 deletions
diff --git a/modules/by-name/bo/boot/module.nix b/modules/by-name/bo/boot/module.nix index 04540676..86ad58da 100644 --- a/modules/by-name/bo/boot/module.nix +++ b/modules/by-name/bo/boot/module.nix @@ -22,7 +22,7 @@ tails = let tailsPrefix = "/EFI/tails"; in { - root = "${tailsPrefix}/tails.iso"; + iso = "${tailsPrefix}/tails.iso"; initrd = "${tailsPrefix}/initrd.img"; vmlinuz = "${tailsPrefix}/vmlinuz-linux"; }; @@ -37,23 +37,24 @@ iso_options = ## General options? [ + # "config" "initrd=${tails.initrd}" - "noprompt" - "timezone=Etc/UTC" - "config" - "noautologin" - "slab_nomerge" - "slub_debug=FZ" - "mce=0" - "vsyscall=none" + + "efi_pstore.pstore_disable=1" + "erst_disable" "init_on_free=1" + "mce=0" "mds=full,nosmt" + "noautologin" + "noprompt" "page_alloc.shuffle=1" "randomize_kstack_offset=on" - "efi_pstore.pstore_disable=1" - "erst_disable" + "slab_nomerge" + "slub_debug=FZ" "spec_store_bypass_disable=on" "systemd.condition_needs_update=no" + "timezone=Etc/UTC" + "vsyscall=none" ] ## Systemd log options ++ [ @@ -84,7 +85,7 @@ # Don't store things persistently "nopersistence" - "fromiso=/dev/nvme0n1p1/${tails.root}" + "fromiso=/dev/nvme0n1p1/${tails.iso}" ]; in { options.soispha.boot = { @@ -153,10 +154,10 @@ in { }; install = pkgs.writeShellScript "wrapped-install-tails-iso-marker" '' - echo "[Wrapped bootloader install] Copying tails iso..." + echo "Wrapped bootloader install> Copying tails iso..." ${copyExtraFiles} - echo "[Wrapped bootloader install] Running original lanzaboote install..." + echo "Wrapped bootloader install> Running original lanzaboote install..." ${lanzabooteInstallHook.config.boot.loader.external.installHook} ''; @@ -202,14 +203,14 @@ in { title Tails ${iso.passthru.version} Live ISO linux ${tails.vmlinuz} initrd ${tails.initrd} - options ${builtins.concatStringsSep " " iso_options} + options boot=casper iso-scan/filename=${tails.iso} noeject noprompt ''; }; extraFiles = { # TODO: Check that the ISO we use for booting is _actually_ still the one we # copied there (someone might exchange it in between) <2026-06-09> - "${tails.root}" = "${iso}/tails.iso"; + "${tails.iso}" = "${iso}/tails.iso"; "${tails.vmlinuz}" = "${iso}/live/vmlinuz-linux"; "${tails.initrd}" = "${iso}/live/initrd.img"; }; |