secureboot: generalise, enable for framenix

hosts/framenix/default.nix

@@ -84,5 +84,8 @@ in
     unstable.amd-debug-tools
   ];
 
-  schmittlauch.audio-sharing.enable = true;
+  schmittlauch = {
+    audio-sharing.enable = true;
+    secureboot.enable = true;
+  };
 }

hosts/thinknix/default.nix

@@ -12,8 +12,6 @@
     ./hardware-configuration.nix
     ./storage.nix
     ./swap.nix
-    # FIXME: move this to common, conditional enabling
-    ./secureboot.nix
   ];
 
   hardware.trackpoint = {
@@ -24,7 +22,10 @@
 
   boot.extraModprobeConfig = "options thinkpad_acpi fan_control=1"; # enable fan control via echo to /proc/acpi/ibm/fan
 
-  schmittlauch.guestUser.enable = true;
+  schmittlauch = {
+    guestUser.enable = true;
+    secureboot.enable = true;
+  };
 
   networking.hostName = "thinknix";
 

hosts/thinknix/secureboot.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # UEFI secure boot
-  environment.systemPackages = [ pkgs.sbctl ];
-  # Lanzaboote currently replaces the systemd-boot module.
-  # This setting is usually set to true in configuration.nix
-  # generated at installation time. So we force it to false
-  # for now.
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/etc/secureboot";
-  };
-}