Full Disk Encryption & Secure Boot

[0xlua]

To significantly increase security, I'd like to encrypt my disk and use Secure Boot. A lot of the required steps are not declarative and will require further documentation, once implemented (see #205).

Since this requires a reinstall I can largely follow the installation guide on the NixOS Wiki.

Full Disk Encryption

A lot of information is covered in the Wiki.

• First download a recent ISO, create a bootable media, etc...
• Before booting: make sure Secure Boot is disabled
• The only really important thing during install is the disk partinioning, since this can't be changed later
  • I want to either use btrfs or bcachefs. More below.
• Select the "Encrypt" Option during the installation process

Secure Boot

Once FDE is setup and the system is installed, I can deploy Secure Boot.
Again there is a lot of information on the Wiki.

Follow this guide

For Secure Boot Lanzaboote is needed: Guide

[0xlua]

Done for europa in 6fbaeef.

I'll still have to do the same for the other hosts, but I can just follow the setup instructions, once #205 is closed.