Update for secure boot

disko/EDI/configuration.nix

@@ -19,6 +19,20 @@
                 ];
               };
             };
+            encryptedSwap = {
+              size = "20M";
+              content = {
+                type = "swap";
+                randomEncryption = true;
+              };
+            };
+            plainSwap = {
+              size = "4G";
+              content = {
+                type = "swap";
+                resumeDevice = true; # resume from hiberation from this device
+              };
+            };
             luks = {
               size = "100%";
               content = {
@@ -28,35 +42,15 @@
                 #passwordFile = "/tmp/secret.key"; # Interactive
                 settings = {
                   allowDiscards = true;
-                  keyFile = "/tmp/secret.key";
+                  #keyFile = "/tmp/secret.key";
                 };
                 #additionalKeyFiles = ["/tmp/additionalSecret.key"];
-                content = {
-                  root = {
-                    name = "root";
-                    end = "-2G";
                     content = {
                       type = "filesystem";
                       format = "bcachefs";
                       mountpoint = "/";
                     };
                 };
-                  encryptedSwap = {
-                    size = "20M";
-                    content = {
-                      type = "swap";
-                      randomEncryption = true;
-                    };
-                  };
-                  plainSwap = {
-                    size = "100%";
-                    content = {
-                      type = "swap";
-                      resumeDevice = true; # resume from hiberation from this device
-                    };
-                  };
-                };
-              };
               };
             };
           };

nixos/desktop/configuration.nix

@@ -165,7 +165,6 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.systemd-boot.configurationLimit = 3;
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.bootspec.enable = true;
   boot.supportedFilesystems = ["bcachefs"];
   boot.kernelPackages = pkgs.linuxPackages_latest;
 

nixos/hosts/EDI/configuration.nix

@@ -38,6 +38,8 @@
 
   networking.hostName = "EDI";
 
+  boot.bootspec.enable = true;
+
   # Enable bluetooth hardware
   hardware.bluetooth.enable = true;