[disko]Force grub on legacy boot

nix flake check and show now work again

.gitea/workflows/flake-check.yml

@@ -0,0 +1,15 @@
+name: "Check flake syntax"
+on:
+  pull_request:
+  push:
+jobs:
+  flake-check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install dependencies for Nix setup action
+      run: |
+        apt update -y
+        apt install sudo -y        
+    - uses: cachix/install-nix-action@v27
+    - run: nix flake check --no-update-lock-file --accept-flake-config .

machines/bakunin/configuration.nix

@@ -26,6 +26,7 @@ in
 
   malobeo.disks = {
     enable = true;
+    legacy = true;
     hostId = "a3c3102f";
     root = {
       disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
@@ -33,9 +34,7 @@ in
   };
 
   malobeo.initssh = {
-    enable = true;
+    enable = false;
-    authorizedKeys = sshKeys.admins;
-    ethernetDrivers = ["r8169"];
   };
 
   hardware.sane.enable = true; #scanner support

machines/configuration.nix

@@ -3,6 +3,7 @@
 , nixpkgs
 , sops-nix
 , inputs
+, microvm
 , nixos-hardware
 , home-manager
 , ...
@@ -34,15 +35,14 @@ let
             };
           };
         })
-
         sops-nix.nixosModules.sops
+        microvm.nixosModules.microvm
       ];
     }
   ];
   defaultModules = baseModules;
 
   makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
-    inputs.microvm.nixosModules.microvm
     {
       microvm = {
         hypervisor = "cloud-hypervisor";

machines/modules/disko/default.nix

@@ -20,6 +20,11 @@ in
       default = true;
       description = "Allows encryption to be disabled for testing";
     };
+    legacy = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable legacy boot (bios)";
+    };
     devNodes = lib.mkOption {
       type = lib.types.str;
       default = "/dev/disk/by-id/";
@@ -81,7 +86,25 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && !cfg.legacy) {
+      boot = {
+        loader.systemd-boot.enable = true;
+        loader.efi.canTouchEfiVariables = true;
+        supportedFilesystems = [ "vfat" "zfs" ];
+      };
+      fileSystems."/boot".neededForBoot = true;
+    })
+    (lib.mkIf (cfg.enable && cfg.legacy) {
+      boot.loader.grub = {
+        enable = lib.mkForce true;
+        device = "/dev/${cfg.root.disk0}-part1";
+        efiSupport = false;
+        enableCryptodisk = cfg.encryption;
+        zfsSupport = true;
+      };
+    })
+    (lib.mkIf cfg.enable {
       networking.hostId = cfg.hostId;
       disko.devices = {
         disk = lib.mkMerge [
@@ -92,7 +115,7 @@ in
               content = {
                 type = "gpt";
                 partitions = {
-                ESP = {
+                  ESP = lib.mkIf (!cfg.legacy) {
                     size = "1024M";
                     type = "EF00";
                     content = {
@@ -102,6 +125,10 @@ in
                       mountOptions = [ "umask=0077" ];
                     };
                   };
+                  boot = lib.mkIf cfg.legacy {
+                    size = "1024M";
+                    type = "EF02";
+                  };
                   encryptedSwap = {
                     size = cfg.root.swap;
                     content =  {
@@ -270,9 +297,9 @@ in
 
       fileSystems."/".neededForBoot = true;
       fileSystems."/etc".neededForBoot = true;
-    fileSystems."/boot".neededForBoot = true;
       fileSystems."/var".neededForBoot = true;
       fileSystems."/home".neededForBoot = true;
       fileSystems."/nix".neededForBoot = true;
-  };
+    })
+  ];
 }

machines/modules/malobeo/initssh.nix

@@ -26,13 +26,9 @@ in
   
   config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
     boot = {
-      loader.systemd-boot.enable = true;
-      loader.efi.canTouchEfiVariables = true;
-      supportedFilesystems = [ "vfat" "zfs" ];
       zfs = {
         forceImportAll = true;
         requestEncryptionCredentials = true;
-        
       };
       initrd = {
         availableKernelModules = cfg.ethernetDrivers;

outputs.nix

@@ -20,7 +20,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
     let
       sops = sops-nix.packages."${pkgs.system}";
       microvmpkg = microvm.packages."${pkgs.system}";
-      installed = builtins.attrNames self.packages."${pkgs.system}".scripts;
+      installed = builtins.attrNames self.legacyPackages."${pkgs.system}".scripts;
     in
     pkgs.mkShell {
       sopsPGPKeyDirs = [
@@ -38,13 +38,14 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         pkgs.mdbook
         microvmpkg.microvm
       ];
-      packages = builtins.map (pkgName: self.packages."${pkgs.system}".scripts.${pkgName}) installed;
+      packages = builtins.map (pkgName: self.legacyPackages."${pkgs.system}".scripts.${pkgName}) installed;
       shellHook = ''echo "Available scripts: ${builtins.concatStringsSep " " installed}"'';
     };
-
+    legacyPackages = {
-    packages = {
       scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
       scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
+    };
+    packages = {
       docs = pkgs.stdenv.mkDerivation {
         name = "malobeo-docs";
         phases = [ "buildPhase" ];