feature(lanzaboote): add support for secure-boot through lanazaboote

modules/nixos/lanzaboote.nix

@@ -0,0 +1,25 @@
+# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
+# installs it signed and writes signed boot entries instead of the nixos module.
+# The keys are created once per host with `sudo sbctl create-keys` before the
+# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  # key management and verification
+  environment.systemPackages = [ pkgs.sbctl ];
+}