secureboot: generalise, enable for framenix

common/default.nix

@@ -19,6 +19,7 @@ in
     ./audio-sharing.nix
     ./angrr.nix
     ./sops.nix
+    ./secureboot.nix
   ];
 
   services.davfs2.enable = true;

common/secureboot.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.schmittlauch.secureboot.enable = lib.mkEnableOption "Enable lanzaboote secure boot, make sure keys and firmware are setup correctly.";
+  config = lib.mkIf config.schmittlauch.secureboot.enable {
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # UEFI secure boot
+    environment.systemPackages = [ pkgs.sbctl ];
+    # Lanzaboote currently replaces the systemd-boot module.
+    # This setting is usually set to true in configuration.nix
+    # generated at installation time. So we force it to false
+    # for now.
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}

hosts/framenix/default.nix

@@ -84,5 +84,8 @@ in
     unstable.amd-debug-tools
   ];
 
-  schmittlauch.audio-sharing.enable = true;
+  schmittlauch = {
+    audio-sharing.enable = true;
+    secureboot.enable = true;
+  };
 }

hosts/thinknix/default.nix

@@ -12,8 +12,6 @@
     ./hardware-configuration.nix
     ./storage.nix
     ./swap.nix
-    # FIXME: move this to common, conditional enabling
-    ./secureboot.nix
   ];
 
   hardware.trackpoint = {
@@ -24,7 +22,10 @@
 
   boot.extraModprobeConfig = "options thinkpad_acpi fan_control=1"; # enable fan control via echo to /proc/acpi/ibm/fan
 
-  schmittlauch.guestUser.enable = true;
+  schmittlauch = {
+    guestUser.enable = true;
+    secureboot.enable = true;
+  };
 
   networking.hostName = "thinknix";
 

hosts/thinknix/secureboot.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # UEFI secure boot
-  environment.systemPackages = [ pkgs.sbctl ];
-  # Lanzaboote currently replaces the systemd-boot module.
-  # This setting is usually set to true in configuration.nix
-  # generated at installation time. So we force it to false
-  # for now.
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/etc/secureboot";
-  };
-}