migrated

modules/security/sys/secureboot.nix

@@ -0,0 +1,16 @@
+{ inputs, ... }: {
+  flake.nixosModules.security-sys-secureboot = { pkgs, lib, ... }: {
+    imports = [
+      inputs.lanzaboote.nixosModules.lanzaboote
+    ];
+
+    environment.systemPackages = [ pkgs.sbctl ];
+
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}