1 files changed, 33 insertions, 30 deletions

diff --git a/modules/by-name/bo/boot/module.nix b/modules/by-name/bo/boot/module.nix
index 4dc9130a..86ad58da 100644
--- a/modules/by-name/bo/boot/module.nix
+++ b/modules/by-name/bo/boot/module.nix
@@ -22,7 +22,7 @@
   tails = let
     tailsPrefix = "/EFI/tails";
   in {
-    root = "${tailsPrefix}/tails.iso";
+    iso = "${tailsPrefix}/tails.iso";
     initrd = "${tailsPrefix}/initrd.img";
     vmlinuz = "${tailsPrefix}/vmlinuz-linux";
   };
@@ -37,42 +37,43 @@
   iso_options =
     ## General options?
     [
-      "initrd=${tails.initrd}"
-      # "noprompt"
-      # "timezone=Etc/UTC"
       # "config"
-      # "noautologin"
-      # "slab_nomerge"
-      # "slub_debug=FZ"
-      # "mce=0"
-      # "vsyscall=none"
-      # "init_on_free=1"
-      # "mds=full,nosmt"
-      # "page_alloc.shuffle=1"
-      # "randomize_kstack_offset=on"
-      # "efi_pstore.pstore_disable=1"
-      # "erst_disable"
-      # "spec_store_bypass_disable=on"
-      # "systemd.condition_needs_update=no"
+      "initrd=${tails.initrd}"
+
+      "efi_pstore.pstore_disable=1"
+      "erst_disable"
+      "init_on_free=1"
+      "mce=0"
+      "mds=full,nosmt"
+      "noautologin"
+      "noprompt"
+      "page_alloc.shuffle=1"
+      "randomize_kstack_offset=on"
+      "slab_nomerge"
+      "slub_debug=FZ"
+      "spec_store_bypass_disable=on"
+      "systemd.condition_needs_update=no"
+      "timezone=Etc/UTC"
+      "vsyscall=none"
     ]
     ## Systemd log options
     ++ [
-      "systemd.log_level=debug"
-      "systemd.log_target=console"
-      "console=tty1"
-      "systemd.journald.forward_to_console=1"
-      "systemd.unit=rescue.target"
+      # "systemd.log_level=debug"
+      # "systemd.log_target=console"
+      # "console=tty1"
+      # "systemd.journald.forward_to_console=1"
+      # "systemd.unit=rescue.target"
     ]
     ## Options for the first `init` script
     ++ [
       # Use the `*-live` scripts
       "boot=live"
 
-      # "splash"
-      "plymouth.enable=0"
+      "splash"
+      # "plymouth.enable=0"
 
       # "quiet"
-      "debug"
+      # "debug"
     ]
     ## Options for the `*-live` `init` scripts
     ++ [
@@ -84,7 +85,7 @@
       # Don't store things persistently
       "nopersistence"
 
-      "fromiso=/dev/nvme0n1p1/${tails.root}"
+      "fromiso=/dev/nvme0n1p1/${tails.iso}"
     ];
 in {
   options.soispha.boot = {
@@ -153,10 +154,10 @@ in {
             };
 
             install = pkgs.writeShellScript "wrapped-install-tails-iso-marker" ''
-              echo "[Wrapped bootloader install] Copying tails iso..."
+              echo "Wrapped bootloader install> Copying tails iso..."
               ${copyExtraFiles}
 
-              echo "[Wrapped bootloader install] Running original lanzaboote install..."
+              echo "Wrapped bootloader install> Running original lanzaboote install..."
               ${lanzabooteInstallHook.config.boot.loader.external.installHook}
             '';
 
@@ -202,12 +203,14 @@ in {
               title Tails ${iso.passthru.version} Live ISO
               linux ${tails.vmlinuz}
               initrd ${tails.initrd}
-              options ${builtins.concatStringsSep " " iso_options}
+              options boot=casper iso-scan/filename=${tails.iso} noeject noprompt
             '';
           };
 
           extraFiles = {
-            "${tails.root}" = "${iso}/tails.iso";
+            # TODO: Check that the ISO we use for booting is _actually_ still the one we
+            # copied there (someone might exchange it in between) <2026-06-09>
+            "${tails.iso}" = "${iso}/tails.iso";
             "${tails.vmlinuz}" = "${iso}/live/vmlinuz-linux";
             "${tails.initrd}" = "${iso}/live/initrd.img";
           };