nixos/limine: add secureBoot.configFile option

This adds a new `boot.loader.limine.secureBoot.configFile` option that
allows users to specify a custom sbctl configuration file. This is
useful for managing secure boot keys in non-standard locations, such as
when using declarative secret management systems like sops-nix or
clan-core vars.

The configuration file is passed to sbctl via the --config flag for all
sbctl operations (create-keys, enroll-keys, sign), including fwupd EFI
binary signing.

When configFile is not specified, sbctl uses its default location
(/var/lib/sbctl).

Author: Mic92

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -430,9 +430,11 @@ def install_bootloader() -> None:
             partition formatted as FAT.
         '''))
 
-    if config('secureBoot', 'enable') and not config('secureBoot', 'autoGenerateKeys') and not os.path.exists("/var/lib/sbctl"):
-        print("There are no sbctl secure boot keys present. Please generate some.")
-        sys.exit(1)
+    # Check if sbctl keys exist (only if not using custom config)
+    if config('secureBoot', 'enable') and not config('secureBoot', 'autoGenerateKeys'):
+        if config('secureBoot', 'configFile') is None and not os.path.exists("/var/lib/sbctl"):
+            print("There are no sbctl secure boot keys present at /var/lib/sbctl. Please generate some or specify a configFile.")
+            sys.exit(1)
 
     if not os.path.exists(limine_install_dir):
         os.makedirs(limine_install_dir)
@@ -557,16 +559,22 @@ def install_bootloader() -> None:
 
         if config('secureBoot', 'enable'):
             sbctl = os.path.join(str(config('secureBoot', 'sbctl')), 'bin', 'sbctl')
+            sbctl_args = []
+
+            # If using a custom config file, pass it to sbctl
+            if config('secureBoot', 'configFile') is not None:
+                sbctl_args = ['--config', config('secureBoot', 'configFile')]
+
             if not os.path.exists("/var/lib/sbctl") and config('secureBoot', 'autoGenerateKeys'):
                 print('auto generating keys')
                 try:
-                    subprocess.run([sbctl, 'create-keys'])
+                    subprocess.run([sbctl] + sbctl_args + ['create-keys'])
                 except:
                     print('error: failed to create keys', file=sys.stderr)
                     sys.exit(1)
                 if config('secureBoot', 'autoEnrollKeys', 'enable'):
                     try:
-                        command = [sbctl, 'enroll-keys']
+                        command = [sbctl] + sbctl_args + ['enroll-keys']
                         command.extend(config('secureBoot', 'autoEnrollKeys', 'extraArgs'))
                         subprocess.run(command)
                     except:
@@ -575,7 +583,7 @@ def install_bootloader() -> None:
 
             print('signing limine...')
             try:
-                subprocess.run([sbctl, 'sign', dest_path])
+                subprocess.run([sbctl] + sbctl_args + ['sign', dest_path])
             except:
                 print('error: failed to sign limine', file=sys.stderr)
                 sys.exit(1)

nixos/modules/system/boot/loader/limine/limine.nix

@@ -19,7 +19,9 @@ let
       canTouchEfiVariables = efi.canTouchEfiVariables;
       efiSupport = cfg.efiSupport;
       efiRemovable = cfg.efiInstallAsRemovable;
-      secureBoot = cfg.secureBoot;
+      secureBoot = cfg.secureBoot // {
+        configFile = if cfg.secureBoot.configFile != null then toString cfg.secureBoot.configFile else null;
+      };
       biosSupport = cfg.biosSupport;
       biosDevice = cfg.biosDevice;
       partitionIndex = cfg.partitionIndex;
@@ -225,6 +227,23 @@ in
         '';
       };
 
+      configFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = lib.literalExpression ''
+          pkgs.writeText "sbctl.conf" '''
+            keydir: ''${config.clan.core.vars.generators.secureboot.directory}/keys
+          '''
+        '';
+        description = ''
+          Path to sbctl configuration file.
+          If specified, this will be passed to sbctl via the --config flag.
+
+          The configuration file should specify at minimum the keydir location.
+          See sbctl.conf(5) for all available options.
+        '';
+      };
+
       autoGenerateKeys = lib.mkEnableOption null // {
         description = "Generate keys automatically when none exists during bootloader installation";
       };
@@ -474,7 +493,7 @@ in
         partOf = [ "fwupd.service" ];
         before = [ "fwupd.service" ];
 
-        unitConfig.ConditionPathIsDirectory = "/var/lib/sbctl";
+        unitConfig.ConditionPathIsDirectory = lib.mkIf (cfg.secureBoot.configFile == null) "/var/lib/sbctl";
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
@@ -483,7 +502,7 @@ in
 
         script = ''
           fwupd_efi=(${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi)
-          ${lib.getExe cfg.secureBoot.sbctl} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi"
+          ${lib.getExe cfg.secureBoot.sbctl} ${lib.optionalString (cfg.secureBoot.configFile != null) "--config ${cfg.secureBoot.configFile}"} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi"
         '';
       };