fix: disable secureboot key enrollment

Lehmanator · Jul 24, 2024 · 5276d8b · 5276d8b
1 parent d2134b2
commit 5276d8b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nixos/profiles/modules/lanzaboote.nix b/nixos/profiles/modules/lanzaboote.nix
@@ -52,7 +52,7 @@ in
   boot = {
     lanzaboote = mkDefault {
       enable =  true;
-      enrollKeys = true;
+      # enrollKeys = true;
       configurationLimit = config.boot.loader.systemd-boot.configurationLimit or 20;
       pkiBundle = "/etc/secureboot"; #config.sops.secrets.secureboot-keys.path;
       # publicKeyFile  = config.sops.secrets.secureboot-pubkey.path;