secureboot: generalise, enable for framenix

common/default.nix

@@ -19,6 +19,7 @@ in
     ./audio-sharing.nix
     ./angrr.nix
     ./sops.nix
+    ./secureboot.nix
   ];
 
   services.davfs2.enable = true;

common/secureboot.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.schmittlauch.secureboot.enable = lib.mkEnableOption "Enable lanzaboote secure boot, make sure keys and firmware are setup correctly.";
+  config = lib.mkIf config.schmittlauch.secureboot.enable {
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # UEFI secure boot
+    environment.systemPackages = [ pkgs.sbctl ];
+    # Lanzaboote currently replaces the systemd-boot module.
+    # This setting is usually set to true in configuration.nix
+    # generated at installation time. So we force it to false
+    # for now.
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}